git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/legicrf.c

   1 //-----------------------------------------------------------------------------
   2 // (c) 2009 Henryk Plötz <henryk@ploetzli.ch>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // LEGIC RF simulation code
   9 //-----------------------------------------------------------------------------
  10
  11 #include "proxmark3.h"
  12 #include "apps.h"
  13 #include "util.h"
  14 #include "string.h"
  15
  16 #include "legicrf.h"
  17 #include "legic_prng.h"
  18 #include "crc.h"
  19
  20 static struct legic_frame {
  21         int bits;
  22         uint32_t data;
  23 } current_frame;
  24
  25 static enum {
  26   STATE_DISCON,
  27   STATE_IV,
  28   STATE_CON,
  29 } legic_state;
  30
  31 static crc_t    legic_crc;
  32 static int      legic_read_count;
  33 static uint32_t legic_prng_bc;
  34 static uint32_t legic_prng_iv;
  35
  36 static int      legic_phase_drift;
  37 static int      legic_frame_drift;
  38 static int      legic_reqresp_drift;
  39
  40 AT91PS_TC timer;
  41 AT91PS_TC prng_timer;
  42
  43 static void setup_timer(void)
  44 {
  45         /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging
  46          * this it won't be terribly accurate but should be good enough.
  47          */
  48         AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1);
  49         timer = AT91C_BASE_TC1;
  50         timer->TC_CCR = AT91C_TC_CLKDIS;
  51         timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK;
  52         timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
  53
  54         /*
  55      * Set up Timer 2 to use for measuring time between frames in
  56      * tag simulation mode. Runs 4x faster as Timer 1
  57          */
  58     AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC2);
  59     prng_timer = AT91C_BASE_TC2;
  60     prng_timer->TC_CCR = AT91C_TC_CLKDIS;
  61         prng_timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV2_CLOCK;
  62     prng_timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
  63 }
  64
  65 /* At TIMER_CLOCK3 (MCK/32) */
  66 #define RWD_TIME_1 150     /* RWD_TIME_PAUSE off, 80us on = 100us */
  67 #define RWD_TIME_0 90      /* RWD_TIME_PAUSE off, 40us on = 60us */
  68 #define RWD_TIME_PAUSE 30  /* 20us */
  69 #define RWD_TIME_FUZZ 20   /* rather generous 13us, since the peak detector + hysteresis fuzz quite a bit */
  70 #define TAG_TIME_BIT 150   /* 100us for every bit */
  71 #define TAG_TIME_WAIT 490  /* time from RWD frame end to tag frame start, experimentally determined */
  72
  73 #define SIM_DIVISOR  586   /* prng_time/SIM_DIVISOR count prng needs to be forwared */
  74 #define SIM_SHIFT    900   /* prng_time+SIM_SHIFT shift of delayed start */
  75
  76 #define SESSION_IV 0x55
  77 #define OFFSET_LOG 1024
  78
  79 #define FUZZ_EQUAL(value, target, fuzz) ((value) > ((target)-(fuzz)) && (value) < ((target)+(fuzz)))
  80
  81 /* Generate Keystream */
  82 static uint32_t get_key_stream(int skip, int count)
  83 {
  84         uint32_t key=0; int i;
  85
  86         /* Use int to enlarge timer tc to 32bit */
  87         legic_prng_bc += prng_timer->TC_CV;
  88         prng_timer->TC_CCR = AT91C_TC_SWTRG;
  89
  90         /* If skip == -1, forward prng time based */
  91         if(skip == -1) {
  92                 i  = (legic_prng_bc+SIM_SHIFT)/SIM_DIVISOR; /* Calculate Cycles based on timer */
  93                 i -= legic_prng_count(); /* substract cycles of finished frames */
  94                 i -= count; /* substract current frame length, rewidn to bedinning */
  95                 legic_prng_forward(i);
  96         } else {
  97                 legic_prng_forward(skip);
  98         }
  99
 100         /* Write Time Data into LOG */
 101         uint8_t *BigBuf = BigBuf_get_addr();
 102         i = (count == 6) ? -1 : legic_read_count;
 103
 104         BigBuf[OFFSET_LOG+128+i] = legic_prng_count();
 105         BigBuf[OFFSET_LOG+256+i*4]   = (legic_prng_bc >> 0) & 0xff;
 106         BigBuf[OFFSET_LOG+256+i*4+1] = (legic_prng_bc >> 8) & 0xff;
 107         BigBuf[OFFSET_LOG+256+i*4+2] = (legic_prng_bc >>16) & 0xff;
 108         BigBuf[OFFSET_LOG+256+i*4+3] = (legic_prng_bc >>24) & 0xff;
 109         BigBuf[OFFSET_LOG+384+i] = count;
 110
 111         /* Generate KeyStream */
 112         for(i=0; i<count; i++) {
 113                 key |= legic_prng_get_bit() << i;
 114                 legic_prng_forward(1);
 115         }
 116         return key;
 117 }
 118
 119 /* Send a frame in tag mode, the FPGA must have been set up by
 120  * LegicRfSimulate
 121  */
 122 static void frame_send_tag(uint16_t response, int bits, int crypt)
 123 {
 124    /* Bitbang the response */
 125    AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 126    AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
 127    AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
 128
 129    /* Use time to crypt frame */
 130    if(crypt) {
 131       legic_prng_forward(2); /* TAG_TIME_WAIT -> shift by 2 */
 132       int i; int key = 0;
 133       for(i=0; i<bits; i++) {
 134          key |= legic_prng_get_bit() << i;
 135          legic_prng_forward(1);
 136       }
 137       //Dbprintf("key = 0x%x", key);
 138       response = response ^ key;
 139    }
 140
 141    /* Wait for the frame start */
 142    while(timer->TC_CV < (TAG_TIME_WAIT - 30)) ;
 143
 144    int i;
 145    for(i=0; i<bits; i++) {
 146       int nextbit = timer->TC_CV + TAG_TIME_BIT;
 147       int bit = response & 1;
 148       response = response >> 1;
 149       if(bit)
 150          AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 151       else
 152          AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 153
 154       while(timer->TC_CV < nextbit) ;
 155    }
 156    AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 157 }
 158
 159 /* Send a frame in reader mode, the FPGA must have been set up by
 160  * LegicRfReader
 161  */
 162 static void frame_send_rwd(uint32_t data, int bits)
 163 {
 164         /* Start clock */
 165         timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
 166         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 167
 168         int i;
 169         for(i=0; i<bits; i++) {
 170                 int starttime = timer->TC_CV;
 171                 int pause_end = starttime + RWD_TIME_PAUSE, bit_end;
 172                 int bit = data & 1;
 173                 data = data >> 1;
 174
 175                 if(bit ^ legic_prng_get_bit())
 176                         bit_end = starttime + RWD_TIME_1;
 177                 else
 178                         bit_end = starttime + RWD_TIME_0;
 179
 180
 181                 /* RWD_TIME_PAUSE time off, then some time on, so that the complete bit time is
 182                  * RWD_TIME_x, where x is the bit to be transmitted */
 183                 AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 184                 while(timer->TC_CV < pause_end) ;
 185                 AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 186                 legic_prng_forward(1); /* bit duration is longest. use this time to forward the lfsr */
 187
 188                 while(timer->TC_CV < bit_end);
 189         }
 190
 191         /* One final pause to mark the end of the frame */
 192         int pause_end = timer->TC_CV + RWD_TIME_PAUSE;
 193         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 194         while(timer->TC_CV < pause_end) ;
 195         AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 196
 197
 198         /* Reset the timer, to measure time until the start of the tag frame */
 199         timer->TC_CCR = AT91C_TC_SWTRG;
 200         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 201 }
 202
 203 /* Receive a frame from the card in reader emulation mode, the FPGA and
 204  * timer must have been set up by LegicRfReader and frame_send_rwd.
 205  *
 206  * The LEGIC RF protocol from card to reader does not include explicit
 207  * frame start/stop information or length information. The reader must
 208  * know beforehand how many bits it wants to receive. (Notably: a card
 209  * sending a stream of 0-bits is indistinguishable from no card present.)
 210  *
 211  * Receive methodology: There is a fancy correlator in hi_read_rx_xcorr, but
 212  * I'm not smart enough to use it. Instead I have patched hi_read_tx to output
 213  * the ADC signal with hysteresis on SSP_DIN. Bit-bang that signal and look
 214  * for edges. Count the edges in each bit interval. If they are approximately
 215  * 0 this was a 0-bit, if they are approximately equal to the number of edges
 216  * expected for a 212kHz subcarrier, this was a 1-bit. For timing we use the
 217  * timer that's still running from frame_send_rwd in order to get a synchronization
 218  * with the frame that we just sent.
 219  *
 220  * FIXME: Because we're relying on the hysteresis to just do the right thing
 221  * the range is severely reduced (and you'll probably also need a good antenna).
 222  * So this should be fixed some time in the future for a proper receiver.
 223  */
 224 static void frame_receive_rwd(struct legic_frame * const f, int bits, int crypt)
 225 {
 226         uint32_t the_bit = 1;  /* Use a bitmask to save on shifts */
 227         uint32_t data=0;
 228         int i, old_level=0, edges=0;
 229         int next_bit_at = TAG_TIME_WAIT;
 230
 231         if(bits > 32) {
 232                 bits = 32;
 233     }
 234
 235         AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
 236         AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
 237
 238         /* we have some time now, precompute the cipher
 239      * since we cannot compute it on the fly while reading */
 240         legic_prng_forward(2);
 241
 242         if(crypt) {
 243                 for(i=0; i<bits; i++) {
 244                         data |= legic_prng_get_bit() << i;
 245                         legic_prng_forward(1);
 246                 }
 247         }
 248
 249         while(timer->TC_CV < next_bit_at) ;
 250
 251         next_bit_at += TAG_TIME_BIT;
 252
 253         for(i=0; i<bits; i++) {
 254                 edges = 0;
 255                 while(timer->TC_CV < next_bit_at) {
 256                         int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
 257                         if(level != old_level)
 258                                 edges++;
 259                         old_level = level;
 260                 }
 261                 next_bit_at += TAG_TIME_BIT;
 262
 263                 if(edges > 20 && edges < 60) { /* expected are 42 edges */
 264                         data ^= the_bit;
 265                 }
 266                 the_bit <<= 1;
 267         }
 268
 269         f->data = data;
 270         f->bits = bits;
 271
 272         /* Reset the timer, to synchronize the next frame */
 273         timer->TC_CCR = AT91C_TC_SWTRG;
 274         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 275 }
 276
 277 static void frame_append_bit(struct legic_frame * const f, int bit)
 278 {
 279    if (f->bits >= 31)
 280        return; /* Overflow, won't happen */
 281
 282    f->data |= (bit << f->bits);
 283    f->bits++;
 284 }
 285
 286 static void frame_clean(struct legic_frame * const f)
 287 {
 288         f->data = 0;
 289         f->bits = 0;
 290 }
 291
 292 static uint32_t perform_setup_phase_rwd(int iv)
 293 {
 294
 295         /* Switch on carrier and let the tag charge for 1ms */
 296         AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 297         SpinDelay(1);
 298
 299         legic_prng_init(0); /* no keystream yet */
 300         frame_send_rwd(iv, 7);
 301         legic_prng_init(iv);
 302
 303         frame_clean(&current_frame);
 304         frame_receive_rwd(&current_frame, 6, 1);
 305         legic_prng_forward(1); /* we wait anyways */
 306         while(timer->TC_CV < 387) ; /* ~ 258us */
 307         frame_send_rwd(0x19, 6);
 308
 309         return current_frame.data;
 310 }
 311
 312 static void LegicCommonInit(void) {
 313         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 314         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 315         FpgaSetupSsc();
 316         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
 317
 318         /* Bitbang the transmitter */
 319         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 320         AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
 321         AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
 322
 323         setup_timer();
 324
 325         crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0);
 326 }
 327
 328 static void switch_off_tag_rwd(void)
 329 {
 330         /* Switch off carrier, make sure tag is reset */
 331         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 332         SpinDelay(10);
 333
 334         WDT_HIT();
 335 }
 336 /* calculate crc for a legic command */
 337 static int LegicCRC(int byte_index, int value, int cmd_sz) {
 338         crc_clear(&legic_crc);
 339         crc_update(&legic_crc, 1, 1); /* CMD_READ */
 340         crc_update(&legic_crc, byte_index, cmd_sz-1);
 341         crc_update(&legic_crc, value, 8);
 342         return crc_finish(&legic_crc);
 343 }
 344
 345 int legic_read_byte(int byte_index, int cmd_sz) {
 346         int byte;
 347
 348         legic_prng_forward(4); /* we wait anyways */
 349         while(timer->TC_CV < 387) ; /* ~ 258us + 100us*delay */
 350
 351         frame_send_rwd(1 | (byte_index << 1), cmd_sz);
 352         frame_clean(&current_frame);
 353
 354         frame_receive_rwd(&current_frame, 12, 1);
 355
 356         byte = current_frame.data & 0xff;
 357
 358         if( LegicCRC(byte_index, byte, cmd_sz) != (current_frame.data >> 8) ) {
 359                 Dbprintf("!!! crc mismatch: expected %x but got %x !!!",
 360                         LegicCRC(byte_index, current_frame.data & 0xff, cmd_sz),
 361                         current_frame.data >> 8);
 362                 return -1;
 363         }
 364
 365         return byte;
 366 }
 367
 368 /* legic_write_byte() is not included, however it's trivial to implement
 369  * and here are some hints on what remains to be done:
 370  *
 371  *  * assemble a write_cmd_frame with crc and send it
 372  *  * wait until the tag sends back an ACK ('1' bit unencrypted)
 373  *  * forward the prng based on the timing
 374  */
 375 int legic_write_byte(int byte, int addr, int addr_sz) {
 376     //do not write UID, CRC, DCF
 377     if(addr <= 0x06)
 378                 return 0;
 379
 380         //== send write command ==============================
 381         crc_clear(&legic_crc);
 382         crc_update(&legic_crc, 0, 1); /* CMD_WRITE */
 383         crc_update(&legic_crc, addr, addr_sz);
 384         crc_update(&legic_crc, byte, 8);
 385
 386         uint32_t crc = crc_finish(&legic_crc);
 387         uint32_t cmd = ((crc     <<(addr_sz+1+8)) //CRC
 388                    |(byte    <<(addr_sz+1))   //Data
 389                    |(addr    <<1)             //Address
 390                    |(0x00    <<0));           //CMD = W
 391     uint32_t cmd_sz = addr_sz+1+8+4;          //crc+data+cmd
 392
 393     legic_prng_forward(2); /* we wait anyways */
 394     while(timer->TC_CV < 387) ; /* ~ 258us */
 395         frame_send_rwd(cmd, cmd_sz);
 396
 397         //== wait for ack ====================================
 398     int t, old_level=0, edges=0;
 399     int next_bit_at =0;
 400         while(timer->TC_CV < 387) ; /* ~ 258us */
 401     for(t=0; t<80; t++) {
 402         edges = 0;
 403                 next_bit_at += TAG_TIME_BIT;
 404         while(timer->TC_CV < next_bit_at) {
 405             int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
 406             if(level != old_level) {
 407                 edges++;
 408                         }
 409             old_level = level;
 410         }
 411         if(edges > 20 && edges < 60) { /* expected are 42 edges */
 412                         int t = timer->TC_CV;
 413                         int c = t/TAG_TIME_BIT;
 414                         timer->TC_CCR = AT91C_TC_SWTRG;
 415                         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 416                         legic_prng_forward(c);
 417                 return 0;
 418         }
 419     }
 420     timer->TC_CCR = AT91C_TC_SWTRG;
 421     while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 422         return -1;
 423 }
 424
 425 int LegicRfReader(int offset, int bytes) {
 426         int byte_index=0, cmd_sz=0, card_sz=0;
 427
 428         LegicCommonInit();
 429
 430         uint8_t *BigBuf = BigBuf_get_addr();
 431         memset(BigBuf, 0, 1024);
 432
 433         DbpString("setting up legic card");
 434         uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV);
 435         switch_off_tag_rwd(); //we lose to mutch time with dprintf
 436         switch(tag_type) {
 437                 case 0x1d:
 438                         DbpString("MIM 256 card found, reading card ...");
 439             cmd_sz = 9;
 440                         card_sz = 256;
 441                         break;
 442                 case 0x3d:
 443                         DbpString("MIM 1024 card found, reading card ...");
 444             cmd_sz = 11;
 445                         card_sz = 1024;
 446                         break;
 447                 default:
 448                         Dbprintf("Unknown card format: %x",tag_type);
 449                         return -1;
 450         }
 451         if(bytes == -1)
 452                 bytes = card_sz;
 453
 454         if(bytes+offset >= card_sz)
 455                 bytes = card_sz-offset;
 456
 457         perform_setup_phase_rwd(SESSION_IV);
 458
 459         LED_B_ON();
 460         while(byte_index < bytes) {
 461                 int r = legic_read_byte(byte_index+offset, cmd_sz);
 462                 if(r == -1 ||BUTTON_PRESS()) {
 463                 DbpString("operation aborted");
 464                         switch_off_tag_rwd();
 465                 LED_B_OFF();
 466                 LED_C_OFF();
 467                 return -1;
 468                 }
 469                 BigBuf[byte_index] = r;
 470         WDT_HIT();
 471                 byte_index++;
 472                 if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF();
 473         }
 474         LED_B_OFF();
 475     LED_C_OFF();
 476         switch_off_tag_rwd();
 477         Dbprintf("Card read, use 'hf legic decode' or");
 478     Dbprintf("'data hexsamples %d' to view results", (bytes+7) & ~7);
 479     return 0;
 480 }
 481
 482 void LegicRfWriter(int bytes, int offset) {
 483         int byte_index=0, addr_sz=0;
 484         uint8_t *BigBuf = BigBuf_get_addr();
 485
 486         LegicCommonInit();
 487
 488         DbpString("setting up legic card");
 489         uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV);
 490         switch_off_tag_rwd();
 491         switch(tag_type) {
 492                 case 0x1d:
 493                         if(offset+bytes > 0x100) {
 494                                 Dbprintf("Error: can not write to 0x%03.3x on MIM 256", offset+bytes);
 495                                 return;
 496                         }
 497                         addr_sz = 8;
 498                         Dbprintf("MIM 256 card found, writing 0x%02.2x - 0x%02.2x ...", offset, offset+bytes);
 499                         break;
 500                 case 0x3d:
 501                         if(offset+bytes > 0x400) {
 502                         Dbprintf("Error: can not write to 0x%03.3x on MIM 1024", offset+bytes);
 503                         return;
 504                 }
 505                         addr_sz = 10;
 506                         Dbprintf("MIM 1024 card found, writing 0x%03.3x - 0x%03.3x ...", offset, offset+bytes);
 507                         break;
 508                 default:
 509                         Dbprintf("No or unknown card found, aborting");
 510             return;
 511         }
 512
 513     LED_B_ON();
 514         perform_setup_phase_rwd(SESSION_IV);
 515     legic_prng_forward(2);
 516         while(byte_index < bytes) {
 517                 int r = legic_write_byte(BigBuf[byte_index+offset], byte_index+offset, addr_sz);
 518                 if((r != 0) || BUTTON_PRESS()) {
 519                         Dbprintf("operation aborted @ 0x%03.3x", byte_index);
 520                         switch_off_tag_rwd();
 521                         LED_B_OFF();
 522                         LED_C_OFF();
 523                         return;
 524                 }
 525         WDT_HIT();
 526                 byte_index++;
 527         if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF();
 528         }
 529     LED_B_OFF();
 530     LED_C_OFF();
 531     DbpString("write successful");
 532 }
 533
 534 int timestamp;
 535
 536 /* Handle (whether to respond) a frame in tag mode */
 537 static void frame_handle_tag(struct legic_frame const * const f)
 538 {
 539         uint8_t *BigBuf = BigBuf_get_addr();
 540
 541    /* First Part of Handshake (IV) */
 542    if(f->bits == 7) {
 543      if(f->data == SESSION_IV) {
 544         LED_C_ON();
 545         prng_timer->TC_CCR = AT91C_TC_SWTRG;
 546         legic_prng_init(f->data);
 547         frame_send_tag(0x3d, 6, 1); /* 0x3d^0x26 = 0x1b */
 548         legic_state = STATE_IV;
 549         legic_read_count = 0;
 550         legic_prng_bc = 0;
 551         legic_prng_iv = f->data;
 552
 553         /* TIMEOUT */
 554         timer->TC_CCR = AT91C_TC_SWTRG;
 555         while(timer->TC_CV > 1);
 556         while(timer->TC_CV < 280);
 557         return;
 558       } else if((prng_timer->TC_CV % 50) > 40) {
 559         legic_prng_init(f->data);
 560         frame_send_tag(0x3d, 6, 1);
 561         SpinDelay(20);
 562         return;
 563      }
 564    }
 565
 566    /* 0x19==??? */
 567    if(legic_state == STATE_IV) {
 568       if((f->bits == 6) && (f->data == (0x19 ^ get_key_stream(1, 6)))) {
 569          legic_state = STATE_CON;
 570
 571          /* TIMEOUT */
 572          timer->TC_CCR = AT91C_TC_SWTRG;
 573          while(timer->TC_CV > 1);
 574          while(timer->TC_CV < 200);
 575          return;
 576       } else {
 577          legic_state = STATE_DISCON;
 578          LED_C_OFF();
 579          Dbprintf("0x19 - Frame: %03.3x", f->data);
 580          return;
 581       }
 582    }
 583
 584    /* Read */
 585    if(f->bits == 11) {
 586       if(legic_state == STATE_CON) {
 587          int key   = get_key_stream(-1, 11); //legic_phase_drift, 11);
 588          int addr  = f->data ^ key; addr = addr >> 1;
 589          int data = BigBuf[addr];
 590          int hash = LegicCRC(addr, data, 11) << 8;
 591          BigBuf[OFFSET_LOG+legic_read_count] = (uint8_t)addr;
 592          legic_read_count++;
 593
 594          //Dbprintf("Data:%03.3x, key:%03.3x, addr: %03.3x, read_c:%u", f->data, key, addr, read_c);
 595          legic_prng_forward(legic_reqresp_drift);
 596
 597          frame_send_tag(hash | data, 12, 1);
 598
 599          /* SHORT TIMEOUT */
 600          timer->TC_CCR = AT91C_TC_SWTRG;
 601          while(timer->TC_CV > 1);
 602          legic_prng_forward(legic_frame_drift);
 603          while(timer->TC_CV < 180);
 604          return;
 605       }
 606    }
 607
 608    /* Write */
 609    if(f->bits == 23) {
 610       int key   = get_key_stream(-1, 23); //legic_frame_drift, 23);
 611       int addr  = f->data ^ key; addr = addr >> 1; addr = addr & 0x3ff;
 612       int data  = f->data ^ key; data = data >> 11; data = data & 0xff;
 613
 614       /* write command */
 615       legic_state = STATE_DISCON;
 616       LED_C_OFF();
 617       Dbprintf("write - addr: %x, data: %x", addr, data);
 618       return;
 619    }
 620
 621    if(legic_state != STATE_DISCON) {
 622       Dbprintf("Unexpected: sz:%u, Data:%03.3x, State:%u, Count:%u", f->bits, f->data, legic_state, legic_read_count);
 623       int i;
 624       Dbprintf("IV: %03.3x", legic_prng_iv);
 625       for(i = 0; i<legic_read_count; i++) {
 626          Dbprintf("Read Nb: %u, Addr: %u", i, BigBuf[OFFSET_LOG+i]);
 627       }
 628
 629       for(i = -1; i<legic_read_count; i++) {
 630          uint32_t t;
 631          t  = BigBuf[OFFSET_LOG+256+i*4];
 632          t |= BigBuf[OFFSET_LOG+256+i*4+1] << 8;
 633          t |= BigBuf[OFFSET_LOG+256+i*4+2] <<16;
 634          t |= BigBuf[OFFSET_LOG+256+i*4+3] <<24;
 635
 636          Dbprintf("Cycles: %u, Frame Length: %u, Time: %u",
 637             BigBuf[OFFSET_LOG+128+i],
 638             BigBuf[OFFSET_LOG+384+i],
 639             t);
 640       }
 641    }
 642    legic_state = STATE_DISCON;
 643    legic_read_count = 0;
 644    SpinDelay(10);
 645    LED_C_OFF();
 646    return;
 647 }
 648
 649 /* Read bit by bit untill full frame is received
 650  * Call to process frame end answer
 651  */
 652 static void emit(int bit)
 653 {
 654   if(bit == -1) {
 655      if(current_frame.bits <= 4) {
 656         frame_clean(&current_frame);
 657      } else {
 658         frame_handle_tag(&current_frame);
 659         frame_clean(&current_frame);
 660      }
 661      WDT_HIT();
 662   } else if(bit == 0) {
 663     frame_append_bit(&current_frame, 0);
 664   } else if(bit == 1) {
 665     frame_append_bit(&current_frame, 1);
 666   }
 667 }
 668
 669 void LegicRfSimulate(int phase, int frame, int reqresp)
 670 {
 671   /* ADC path high-frequency peak detector, FPGA in high-frequency simulator mode,
 672    * modulation mode set to 212kHz subcarrier. We are getting the incoming raw
 673    * envelope waveform on DIN and should send our response on DOUT.
 674    *
 675    * The LEGIC RF protocol is pulse-pause-encoding from reader to card, so we'll
 676    * measure the time between two rising edges on DIN, and no encoding on the
 677    * subcarrier from card to reader, so we'll just shift out our verbatim data
 678    * on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear,
 679    * seems to be 300us-ish.
 680    */
 681
 682    if(phase < 0) {
 683       int i;
 684       for(i=0; i<=reqresp; i++) {
 685          legic_prng_init(SESSION_IV);
 686          Dbprintf("i=%u, key 0x%3.3x", i, get_key_stream(i, frame));
 687       }
 688       return;
 689    }
 690
 691    legic_phase_drift = phase;
 692    legic_frame_drift = frame;
 693    legic_reqresp_drift = reqresp;
 694
 695    FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 696    SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 697    FpgaSetupSsc();
 698    FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_212K);
 699
 700    /* Bitbang the receiver */
 701    AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
 702    AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
 703
 704    setup_timer();
 705    crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0);
 706
 707    int old_level = 0;
 708    int active = 0;
 709    legic_state = STATE_DISCON;
 710
 711    LED_B_ON();
 712    DbpString("Starting Legic emulator, press button to end");
 713    while(!BUTTON_PRESS() && !usb_poll_validate_length()) {
 714       int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
 715       int time = timer->TC_CV;
 716
 717       if(level != old_level) {
 718          if(level == 1) {
 719             timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
 720             if(FUZZ_EQUAL(time, RWD_TIME_1, RWD_TIME_FUZZ)) {
 721                /* 1 bit */
 722                emit(1);
 723                active = 1;
 724                LED_A_ON();
 725             } else if(FUZZ_EQUAL(time, RWD_TIME_0, RWD_TIME_FUZZ)) {
 726                /* 0 bit */
 727                emit(0);
 728                active = 1;
 729                LED_A_ON();
 730             } else if(active) {
 731                /* invalid */
 732                emit(-1);
 733                active = 0;
 734                LED_A_OFF();
 735             }
 736          }
 737       }
 738
 739       if(time >= (RWD_TIME_1+RWD_TIME_FUZZ) && active) {
 740          /* Frame end */
 741          emit(-1);
 742          active = 0;
 743          LED_A_OFF();
 744       }
 745
 746       if(time >= (20*RWD_TIME_1) && (timer->TC_SR & AT91C_TC_CLKSTA)) {
 747          timer->TC_CCR = AT91C_TC_CLKDIS;
 748       }
 749
 750       old_level = level;
 751       WDT_HIT();
 752    }
 753    DbpString("Stopped");
 754    LED_B_OFF();
 755    LED_A_OFF();
 756    LED_C_OFF();
 757 }
 758