]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/lfops.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
FIX: lf hitag : Mea culpa, simulation should not have reader_field on. thanks to...
[proxmark3-svn] / armsrc / lfops.c
1 //-----------------------------------------------------------------------------
2 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
3 // at your option, any later version. See the LICENSE.txt file for the text of
4 // the license.
5 //-----------------------------------------------------------------------------
6 // Miscellaneous routines for low frequency tag operations.
7 // Tags supported here so far are Texas Instruments (TI), HID
8 // Also routines for raw mode reading/simulating of LF waveform
9 //-----------------------------------------------------------------------------
10
11 #include "proxmark3.h"
12 #include "apps.h"
13 #include "util.h"
14 #include "hitag2.h"
15 #include "crc16.h"
16 #include "string.h"
17 #include "lfdemod.h"
18 #include "lfsampling.h"
19 #include "protocols.h"
20 #include "usb_cdc.h" // for usb_poll_validate_length
21
22 #ifndef SHORT_COIL
23 # define SHORT_COIL() LOW(GPIO_SSC_DOUT)
24 #endif
25 #ifndef OPEN_COIL
26 # define OPEN_COIL() HIGH(GPIO_SSC_DOUT)
27 #endif
28
29 /**
30 * Function to do a modulation and then get samples.
31 * @param delay_off
32 * @param periods 0xFFFF0000 is period_0, 0x0000FFFF is period_1
33 * @param useHighFreg
34 * @param command
35 */
36 void ModThenAcquireRawAdcSamples125k(uint32_t delay_off, uint32_t periods, uint32_t useHighFreq, uint8_t *command)
37 {
38 /* Make sure the tag is reset */
39 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
40 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
41 SpinDelay(200);
42
43 uint16_t period_0 = periods >> 16;
44 uint16_t period_1 = periods & 0xFFFF;
45
46 // 95 == 125 KHz 88 == 134.8 KHz
47 int divisor_used = (useHighFreq) ? 88 : 95;
48 sample_config sc = { 0,0,1, divisor_used, 0};
49 setSamplingConfig(&sc);
50
51 //clear read buffer
52 BigBuf_Clear_keep_EM();
53
54 LFSetupFPGAForADC(sc.divisor, 1);
55
56 // And a little more time for the tag to fully power up
57 SpinDelay(50);
58
59 // now modulate the reader field
60 while(*command != '\0' && *command != ' ') {
61 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
62 LED_D_OFF();
63 WaitUS(delay_off);
64 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, sc.divisor);
65
66 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
67 LED_D_ON();
68 if(*(command++) == '0')
69 WaitUS(period_0);
70 else
71 WaitUS(period_1);
72 }
73 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
74 LED_D_OFF();
75 WaitUS(delay_off);
76 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, sc.divisor);
77 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
78
79 // now do the read
80 DoAcquisition_config(false);
81
82 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
83 }
84
85 /* blank r/w tag data stream
86 ...0000000000000000 01111111
87 1010101010101010101010101010101010101010101010101010101010101010
88 0011010010100001
89 01111111
90 101010101010101[0]000...
91
92 [5555fe852c5555555555555555fe0000]
93 */
94 void ReadTItag(void)
95 {
96 StartTicks();
97 // some hardcoded initial params
98 // when we read a TI tag we sample the zerocross line at 2Mhz
99 // TI tags modulate a 1 as 16 cycles of 123.2Khz
100 // TI tags modulate a 0 as 16 cycles of 134.2Khz
101 #define FSAMPLE 2000000
102 #define FREQLO 123200
103 #define FREQHI 134200
104
105 signed char *dest = (signed char *)BigBuf_get_addr();
106 uint16_t n = BigBuf_max_traceLen();
107 // 128 bit shift register [shift3:shift2:shift1:shift0]
108 uint32_t shift3 = 0, shift2 = 0, shift1 = 0, shift0 = 0;
109
110 int i, cycles=0, samples=0;
111 // how many sample points fit in 16 cycles of each frequency
112 uint32_t sampleslo = (FSAMPLE<<4)/FREQLO, sampleshi = (FSAMPLE<<4)/FREQHI;
113 // when to tell if we're close enough to one freq or another
114 uint32_t threshold = (sampleslo - sampleshi + 1)>>1;
115
116 // TI tags charge at 134.2Khz
117 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
118 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
119
120 // Place FPGA in passthrough mode, in this mode the CROSS_LO line
121 // connects to SSP_DIN and the SSP_DOUT logic level controls
122 // whether we're modulating the antenna (high)
123 // or listening to the antenna (low)
124 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);
125
126 // get TI tag data into the buffer
127 AcquireTiType();
128
129 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
130
131 for (i=0; i<n-1; i++) {
132 // count cycles by looking for lo to hi zero crossings
133 if ( (dest[i]<0) && (dest[i+1]>0) ) {
134 cycles++;
135 // after 16 cycles, measure the frequency
136 if (cycles>15) {
137 cycles=0;
138 samples=i-samples; // number of samples in these 16 cycles
139
140 // TI bits are coming to us lsb first so shift them
141 // right through our 128 bit right shift register
142 shift0 = (shift0>>1) | (shift1 << 31);
143 shift1 = (shift1>>1) | (shift2 << 31);
144 shift2 = (shift2>>1) | (shift3 << 31);
145 shift3 >>= 1;
146
147 // check if the cycles fall close to the number
148 // expected for either the low or high frequency
149 if ( (samples>(sampleslo-threshold)) && (samples<(sampleslo+threshold)) ) {
150 // low frequency represents a 1
151 shift3 |= (1<<31);
152 } else if ( (samples>(sampleshi-threshold)) && (samples<(sampleshi+threshold)) ) {
153 // high frequency represents a 0
154 } else {
155 // probably detected a gay waveform or noise
156 // use this as gaydar or discard shift register and start again
157 shift3 = shift2 = shift1 = shift0 = 0;
158 }
159 samples = i;
160
161 // for each bit we receive, test if we've detected a valid tag
162
163 // if we see 17 zeroes followed by 6 ones, we might have a tag
164 // remember the bits are backwards
165 if ( ((shift0 & 0x7fffff) == 0x7e0000) ) {
166 // if start and end bytes match, we have a tag so break out of the loop
167 if ( ((shift0>>16)&0xff) == ((shift3>>8)&0xff) ) {
168 cycles = 0xF0B; //use this as a flag (ugly but whatever)
169 break;
170 }
171 }
172 }
173 }
174 }
175
176 // if flag is set we have a tag
177 if (cycles!=0xF0B) {
178 DbpString("Info: No valid tag detected.");
179 } else {
180 // put 64 bit data into shift1 and shift0
181 shift0 = (shift0>>24) | (shift1 << 8);
182 shift1 = (shift1>>24) | (shift2 << 8);
183
184 // align 16 bit crc into lower half of shift2
185 shift2 = ((shift2>>24) | (shift3 << 8)) & 0x0ffff;
186
187 // if r/w tag, check ident match
188 if (shift3 & (1<<15) ) {
189 DbpString("Info: TI tag is rewriteable");
190 // only 15 bits compare, last bit of ident is not valid
191 if (((shift3 >> 16) ^ shift0) & 0x7fff ) {
192 DbpString("Error: Ident mismatch!");
193 } else {
194 DbpString("Info: TI tag ident is valid");
195 }
196 } else {
197 DbpString("Info: TI tag is readonly");
198 }
199
200 // WARNING the order of the bytes in which we calc crc below needs checking
201 // i'm 99% sure the crc algorithm is correct, but it may need to eat the
202 // bytes in reverse or something
203 // calculate CRC
204 uint32_t crc=0;
205
206 crc = update_crc16(crc, (shift0)&0xff);
207 crc = update_crc16(crc, (shift0>>8)&0xff);
208 crc = update_crc16(crc, (shift0>>16)&0xff);
209 crc = update_crc16(crc, (shift0>>24)&0xff);
210 crc = update_crc16(crc, (shift1)&0xff);
211 crc = update_crc16(crc, (shift1>>8)&0xff);
212 crc = update_crc16(crc, (shift1>>16)&0xff);
213 crc = update_crc16(crc, (shift1>>24)&0xff);
214
215 Dbprintf("Info: Tag data: %x%08x, crc=%x", (unsigned int)shift1, (unsigned int)shift0, (unsigned int)shift2 & 0xFFFF);
216 if (crc != (shift2&0xffff)) {
217 Dbprintf("Error: CRC mismatch, expected %x", (unsigned int)crc);
218 } else {
219 DbpString("Info: CRC is good");
220 }
221 }
222 StopTicks();
223 }
224
225 void WriteTIbyte(uint8_t b)
226 {
227 int i = 0;
228
229 // modulate 8 bits out to the antenna
230 for (i=0; i<8; i++)
231 {
232 if ( b & ( 1 << i ) ) {
233 // stop modulating antenna 1ms
234 LOW(GPIO_SSC_DOUT);
235 WaitUS(1000);
236 // modulate antenna 1ms
237 HIGH(GPIO_SSC_DOUT);
238 WaitUS(1000);
239 } else {
240 // stop modulating antenna 1ms
241 LOW(GPIO_SSC_DOUT);
242 WaitUS(300);
243 // modulate antenna 1m
244 HIGH(GPIO_SSC_DOUT);
245 WaitUS(1700);
246 }
247 }
248 }
249
250 void AcquireTiType(void)
251 {
252 int i, j, n;
253 // tag transmission is <20ms, sampling at 2M gives us 40K samples max
254 // each sample is 1 bit stuffed into a uint32_t so we need 1250 uint32_t
255 #define TIBUFLEN 1250
256
257 // clear buffer
258 uint32_t *buf = (uint32_t *)BigBuf_get_addr();
259
260 //clear buffer now so it does not interfere with timing later
261 BigBuf_Clear_ext(false);
262
263 // Set up the synchronous serial port
264 AT91C_BASE_PIOA->PIO_PDR = GPIO_SSC_DIN;
265 AT91C_BASE_PIOA->PIO_ASR = GPIO_SSC_DIN;
266
267 // steal this pin from the SSP and use it to control the modulation
268 AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
269 AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
270
271 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
272 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_RXEN | AT91C_SSC_TXEN;
273
274 // Sample at 2 Mbit/s, so TI tags are 16.2 vs. 14.9 clocks long
275 // 48/2 = 24 MHz clock must be divided by 12
276 AT91C_BASE_SSC->SSC_CMR = 12;
277
278 AT91C_BASE_SSC->SSC_RCMR = SSC_CLOCK_MODE_SELECT(0);
279 AT91C_BASE_SSC->SSC_RFMR = SSC_FRAME_MODE_BITS_IN_WORD(32) | AT91C_SSC_MSBF;
280 AT91C_BASE_SSC->SSC_TCMR = 0;
281 AT91C_BASE_SSC->SSC_TFMR = 0;
282 // iceman, FpgaSetupSsc() ?? the code above? can it be replaced?
283 LED_D_ON();
284
285 // modulate antenna
286 HIGH(GPIO_SSC_DOUT);
287
288 // Charge TI tag for 50ms.
289 WaitMS(50);
290
291 // stop modulating antenna and listen
292 LOW(GPIO_SSC_DOUT);
293
294 LED_D_OFF();
295
296 i = 0;
297 for(;;) {
298 if(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
299 buf[i] = AT91C_BASE_SSC->SSC_RHR; // store 32 bit values in buffer
300 i++; if(i >= TIBUFLEN) break;
301 }
302 WDT_HIT();
303 }
304
305 // return stolen pin to SSP
306 AT91C_BASE_PIOA->PIO_PDR = GPIO_SSC_DOUT;
307 AT91C_BASE_PIOA->PIO_ASR = GPIO_SSC_DIN | GPIO_SSC_DOUT;
308
309 char *dest = (char *)BigBuf_get_addr();
310 n = TIBUFLEN * 32;
311
312 // unpack buffer
313 for (i = TIBUFLEN-1; i >= 0; i--) {
314 for (j = 0; j < 32; j++) {
315 if(buf[i] & (1 << j)) {
316 dest[--n] = 1;
317 } else {
318 dest[--n] = -1;
319 }
320 }
321 }
322 }
323
324 // arguments: 64bit data split into 32bit idhi:idlo and optional 16bit crc
325 // if crc provided, it will be written with the data verbatim (even if bogus)
326 // if not provided a valid crc will be computed from the data and written.
327 void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc)
328 {
329 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
330 if(crc == 0) {
331 crc = update_crc16(crc, (idlo)&0xff);
332 crc = update_crc16(crc, (idlo>>8)&0xff);
333 crc = update_crc16(crc, (idlo>>16)&0xff);
334 crc = update_crc16(crc, (idlo>>24)&0xff);
335 crc = update_crc16(crc, (idhi)&0xff);
336 crc = update_crc16(crc, (idhi>>8)&0xff);
337 crc = update_crc16(crc, (idhi>>16)&0xff);
338 crc = update_crc16(crc, (idhi>>24)&0xff);
339 }
340 Dbprintf("Writing to tag: %x%08x, crc=%x", (unsigned int) idhi, (unsigned int) idlo, crc);
341
342 // TI tags charge at 134.2Khz
343 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
344 // Place FPGA in passthrough mode, in this mode the CROSS_LO line
345 // connects to SSP_DIN and the SSP_DOUT logic level controls
346 // whether we're modulating the antenna (high)
347 // or listening to the antenna (low)
348 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);
349 StartTicks();
350
351 LED_A_ON();
352
353 // steal this pin from the SSP and use it to control the modulation
354 AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
355 AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
356
357 // writing algorithm:
358 // a high bit consists of a field off for 1ms and field on for 1ms
359 // a low bit consists of a field off for 0.3ms and field on for 1.7ms
360 // initiate a charge time of 50ms (field on) then immediately start writing bits
361 // start by writing 0xBB (keyword) and 0xEB (password)
362 // then write 80 bits of data (or 64 bit data + 16 bit crc if you prefer)
363 // finally end with 0x0300 (write frame)
364 // all data is sent lsb first
365 // finish with 50ms programming time
366
367 // modulate antenna
368 HIGH(GPIO_SSC_DOUT);
369 WaitMS(50); // charge time
370
371 WriteTIbyte(0xbb); // keyword
372 WriteTIbyte(0xeb); // password
373 WriteTIbyte( (idlo )&0xff );
374 WriteTIbyte( (idlo>>8 )&0xff );
375 WriteTIbyte( (idlo>>16)&0xff );
376 WriteTIbyte( (idlo>>24)&0xff );
377 WriteTIbyte( (idhi )&0xff );
378 WriteTIbyte( (idhi>>8 )&0xff );
379 WriteTIbyte( (idhi>>16)&0xff );
380 WriteTIbyte( (idhi>>24)&0xff ); // data hi to lo
381 WriteTIbyte( (crc )&0xff ); // crc lo
382 WriteTIbyte( (crc>>8 )&0xff ); // crc hi
383 WriteTIbyte(0x00); // write frame lo
384 WriteTIbyte(0x03); // write frame hi
385 HIGH(GPIO_SSC_DOUT);
386 WaitMS(50); // programming time
387
388 LED_A_OFF();
389
390 // get TI tag data into the buffer
391 AcquireTiType();
392
393 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
394 DbpString("Now use `lf ti read` to check");
395 StopTicks();
396 }
397
398 void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
399 {
400 int i = 0;
401 uint8_t *buf = BigBuf_get_addr();
402
403 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);
404 //FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
405 //FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_READER_FIELD);
406 //FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_TOGGLE_MODE );
407
408 // set frequency, get values from 'lf config' command
409 sample_config *sc = getSamplingConfig();
410
411 if ( (sc->divisor == 1) || (sc->divisor < 0) || (sc->divisor > 255) )
412 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
413 else if (sc->divisor == 0)
414 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
415 else
416 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, sc->divisor);
417
418 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
419
420 AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK;
421 AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
422 AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
423
424 // power on antenna
425 OPEN_COIL();
426 // charge time
427 WaitMS(50);
428
429 for(;;) {
430 WDT_HIT();
431
432 if (ledcontrol) LED_D_ON();
433
434 // wait until SSC_CLK goes HIGH
435 // used as a simple detection of a reader field?
436 while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
437 WDT_HIT();
438 if ( usb_poll_validate_length() || BUTTON_PRESS() )
439 goto OUT;
440 }
441
442 if(buf[i])
443 OPEN_COIL();
444 else
445 SHORT_COIL();
446
447 //wait until SSC_CLK goes LOW
448 while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
449 WDT_HIT();
450 if ( usb_poll_validate_length() || BUTTON_PRESS() )
451 goto OUT;
452 }
453
454 i++;
455 if(i == period) {
456 i = 0;
457 if (gap) {
458 WDT_HIT();
459 SHORT_COIL();
460 SpinDelayUs(gap);
461 }
462 }
463
464 if (ledcontrol) LED_D_OFF();
465 }
466 OUT:
467 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
468 LED_D_OFF();
469 DbpString("Simulation stopped");
470 return;
471 }
472
473 #define DEBUG_FRAME_CONTENTS 1
474 void SimulateTagLowFrequencyBidir(int divisor, int t0)
475 {
476 }
477
478 // compose fc/8 fc/10 waveform (FSK2)
479 static void fc(int c, int *n)
480 {
481 uint8_t *dest = BigBuf_get_addr();
482 int idx;
483
484 // for when we want an fc8 pattern every 4 logical bits
485 if(c==0) {
486 dest[((*n)++)]=1;
487 dest[((*n)++)]=1;
488 dest[((*n)++)]=1;
489 dest[((*n)++)]=1;
490 dest[((*n)++)]=0;
491 dest[((*n)++)]=0;
492 dest[((*n)++)]=0;
493 dest[((*n)++)]=0;
494 }
495
496 // an fc/8 encoded bit is a bit pattern of 11110000 x6 = 48 samples
497 if(c==8) {
498 for (idx=0; idx<6; idx++) {
499 dest[((*n)++)]=1;
500 dest[((*n)++)]=1;
501 dest[((*n)++)]=1;
502 dest[((*n)++)]=1;
503 dest[((*n)++)]=0;
504 dest[((*n)++)]=0;
505 dest[((*n)++)]=0;
506 dest[((*n)++)]=0;
507 }
508 }
509
510 // an fc/10 encoded bit is a bit pattern of 1111100000 x5 = 50 samples
511 if(c==10) {
512 for (idx=0; idx<5; idx++) {
513 dest[((*n)++)]=1;
514 dest[((*n)++)]=1;
515 dest[((*n)++)]=1;
516 dest[((*n)++)]=1;
517 dest[((*n)++)]=1;
518 dest[((*n)++)]=0;
519 dest[((*n)++)]=0;
520 dest[((*n)++)]=0;
521 dest[((*n)++)]=0;
522 dest[((*n)++)]=0;
523 }
524 }
525 }
526 // compose fc/X fc/Y waveform (FSKx)
527 static void fcAll(uint8_t fc, int *n, uint8_t clock, uint16_t *modCnt)
528 {
529 uint8_t *dest = BigBuf_get_addr();
530 uint8_t halfFC = fc/2;
531 uint8_t wavesPerClock = clock/fc;
532 uint8_t mod = clock % fc; //modifier
533 uint8_t modAdj = fc/mod; //how often to apply modifier
534 bool modAdjOk = !(fc % mod); //if (fc % mod==0) modAdjOk=TRUE;
535 // loop through clock - step field clock
536 for (uint8_t idx=0; idx < wavesPerClock; idx++){
537 // put 1/2 FC length 1's and 1/2 0's per field clock wave (to create the wave)
538 memset(dest+(*n), 0, fc-halfFC); //in case of odd number use extra here
539 memset(dest+(*n)+(fc-halfFC), 1, halfFC);
540 *n += fc;
541 }
542 if (mod>0) (*modCnt)++;
543 if ((mod>0) && modAdjOk){ //fsk2
544 if ((*modCnt % modAdj) == 0){ //if 4th 8 length wave in a rf/50 add extra 8 length wave
545 memset(dest+(*n), 0, fc-halfFC);
546 memset(dest+(*n)+(fc-halfFC), 1, halfFC);
547 *n += fc;
548 }
549 }
550 if (mod>0 && !modAdjOk){ //fsk1
551 memset(dest+(*n), 0, mod-(mod/2));
552 memset(dest+(*n)+(mod-(mod/2)), 1, mod/2);
553 *n += mod;
554 }
555 }
556
557 // prepare a waveform pattern in the buffer based on the ID given then
558 // simulate a HID tag until the button is pressed
559 void CmdHIDsimTAG(int hi, int lo, int ledcontrol)
560 {
561 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
562 set_tracing(FALSE);
563
564 int n = 0, i = 0;
565 /*
566 HID tag bitstream format
567 The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits
568 A 1 bit is represented as 6 fc8 and 5 fc10 patterns
569 A 0 bit is represented as 5 fc10 and 6 fc8 patterns
570 A fc8 is inserted before every 4 bits
571 A special start of frame pattern is used consisting a0b0 where a and b are neither 0
572 nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10)
573 */
574
575 if (hi > 0xFFF) {
576 DbpString("Tags can only have 44 bits. - USE lf simfsk for larger tags");
577 return;
578 }
579 fc(0,&n);
580 // special start of frame marker containing invalid bit sequences
581 fc(8, &n); fc(8, &n); // invalid
582 fc(8, &n); fc(10, &n); // logical 0
583 fc(10, &n); fc(10, &n); // invalid
584 fc(8, &n); fc(10, &n); // logical 0
585
586 WDT_HIT();
587 // manchester encode bits 43 to 32
588 for (i=11; i>=0; i--) {
589 if ((i%4)==3) fc(0,&n);
590 if ((hi>>i)&1) {
591 fc(10, &n); fc(8, &n); // low-high transition
592 } else {
593 fc(8, &n); fc(10, &n); // high-low transition
594 }
595 }
596
597 WDT_HIT();
598 // manchester encode bits 31 to 0
599 for (i=31; i>=0; i--) {
600 if ((i%4)==3) fc(0,&n);
601 if ((lo>>i)&1) {
602 fc(10, &n); fc(8, &n); // low-high transition
603 } else {
604 fc(8, &n); fc(10, &n); // high-low transition
605 }
606 }
607 WDT_HIT();
608
609 if (ledcontrol) LED_A_ON();
610 SimulateTagLowFrequency(n, 0, ledcontrol);
611 if (ledcontrol) LED_A_OFF();
612 }
613
614 // prepare a waveform pattern in the buffer based on the ID given then
615 // simulate a FSK tag until the button is pressed
616 // arg1 contains fcHigh and fcLow, arg2 contains invert and clock
617 void CmdFSKsimTAG(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream)
618 {
619 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
620
621 // free eventually allocated BigBuf memory
622 BigBuf_free(); BigBuf_Clear_ext(false);
623 clear_trace();
624 set_tracing(FALSE);
625
626 int ledcontrol = 1, n = 0, i = 0;
627 uint8_t fcHigh = arg1 >> 8;
628 uint8_t fcLow = arg1 & 0xFF;
629 uint16_t modCnt = 0;
630 uint8_t clk = arg2 & 0xFF;
631 uint8_t invert = (arg2 >> 8) & 1;
632
633 for (i=0; i<size; i++){
634
635 if (BitStream[i] == invert)
636 fcAll(fcLow, &n, clk, &modCnt);
637 else
638 fcAll(fcHigh, &n, clk, &modCnt);
639 }
640 WDT_HIT();
641
642 Dbprintf("Simulating with fcHigh: %d, fcLow: %d, clk: %d, invert: %d, n: %d", fcHigh, fcLow, clk, invert, n);
643
644 if (ledcontrol) LED_A_ON();
645 SimulateTagLowFrequency(n, 0, ledcontrol);
646 if (ledcontrol) LED_A_OFF();
647 }
648
649 // compose ask waveform for one bit(ASK)
650 static void askSimBit(uint8_t c, int *n, uint8_t clock, uint8_t manchester)
651 {
652 uint8_t *dest = BigBuf_get_addr();
653 uint8_t halfClk = clock/2;
654 // c = current bit 1 or 0
655 if (manchester==1){
656 memset(dest+(*n), c, halfClk);
657 memset(dest+(*n) + halfClk, c^1, halfClk);
658 } else {
659 memset(dest+(*n), c, clock);
660 }
661 *n += clock;
662 }
663
664 static void biphaseSimBit(uint8_t c, int *n, uint8_t clock, uint8_t *phase)
665 {
666 uint8_t *dest = BigBuf_get_addr();
667 uint8_t halfClk = clock/2;
668 if (c){
669 memset(dest+(*n), c ^ 1 ^ *phase, halfClk);
670 memset(dest+(*n) + halfClk, c ^ *phase, halfClk);
671 } else {
672 memset(dest+(*n), c ^ *phase, clock);
673 *phase ^= 1;
674 }
675 *n += clock;
676 }
677
678 static void stAskSimBit(int *n, uint8_t clock) {
679 uint8_t *dest = BigBuf_get_addr();
680 uint8_t halfClk = clock/2;
681 //ST = .5 high .5 low 1.5 high .5 low 1 high
682 memset(dest+(*n), 1, halfClk);
683 memset(dest+(*n) + halfClk, 0, halfClk);
684 memset(dest+(*n) + clock, 1, clock + halfClk);
685 memset(dest+(*n) + clock*2 + halfClk, 0, halfClk);
686 memset(dest+(*n) + clock*3, 1, clock);
687 *n += clock*4;
688 }
689
690 // args clock, ask/man or askraw, invert, transmission separator
691 void CmdASKsimTag(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream)
692 {
693 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
694 set_tracing(FALSE);
695
696 int ledcontrol = 1, n = 0, i = 0;
697 uint8_t clk = (arg1 >> 8) & 0xFF;
698 uint8_t encoding = arg1 & 0xFF;
699 uint8_t separator = arg2 & 1;
700 uint8_t invert = (arg2 >> 8) & 1;
701
702 if (encoding == 2){ //biphase
703 uint8_t phase = 0;
704 for (i=0; i<size; i++){
705 biphaseSimBit(BitStream[i]^invert, &n, clk, &phase);
706 }
707 if (phase == 1) { //run a second set inverted to keep phase in check
708 for (i=0; i<size; i++){
709 biphaseSimBit(BitStream[i]^invert, &n, clk, &phase);
710 }
711 }
712 } else { // ask/manchester || ask/raw
713 for (i=0; i<size; i++){
714 askSimBit(BitStream[i]^invert, &n, clk, encoding);
715 }
716 if (encoding==0 && BitStream[0]==BitStream[size-1]){ //run a second set inverted (for ask/raw || biphase phase)
717 for (i=0; i<size; i++){
718 askSimBit(BitStream[i]^invert^1, &n, clk, encoding);
719 }
720 }
721 }
722 if (separator==1 && encoding == 1)
723 stAskSimBit(&n, clk);
724 else if (separator==1)
725 Dbprintf("sorry but separator option not yet available");
726
727 WDT_HIT();
728
729 Dbprintf("Simulating with clk: %d, invert: %d, encoding: %d, separator: %d, n: %d",clk, invert, encoding, separator, n);
730
731 if (ledcontrol) LED_A_ON();
732 SimulateTagLowFrequency(n, 0, ledcontrol);
733 if (ledcontrol) LED_A_OFF();
734 }
735
736 //carrier can be 2,4 or 8
737 static void pskSimBit(uint8_t waveLen, int *n, uint8_t clk, uint8_t *curPhase, bool phaseChg)
738 {
739 uint8_t *dest = BigBuf_get_addr();
740 uint8_t halfWave = waveLen/2;
741 //uint8_t idx;
742 int i = 0;
743 if (phaseChg){
744 // write phase change
745 memset(dest+(*n), *curPhase^1, halfWave);
746 memset(dest+(*n) + halfWave, *curPhase, halfWave);
747 *n += waveLen;
748 *curPhase ^= 1;
749 i += waveLen;
750 }
751 //write each normal clock wave for the clock duration
752 for (; i < clk; i+=waveLen){
753 memset(dest+(*n), *curPhase, halfWave);
754 memset(dest+(*n) + halfWave, *curPhase^1, halfWave);
755 *n += waveLen;
756 }
757 }
758
759 // args clock, carrier, invert,
760 void CmdPSKsimTag(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream)
761 {
762 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
763 set_tracing(FALSE);
764
765 int ledcontrol = 1, n = 0, i = 0;
766 uint8_t clk = arg1 >> 8;
767 uint8_t carrier = arg1 & 0xFF;
768 uint8_t invert = arg2 & 0xFF;
769 uint8_t curPhase = 0;
770 for (i=0; i<size; i++){
771 if (BitStream[i] == curPhase){
772 pskSimBit(carrier, &n, clk, &curPhase, FALSE);
773 } else {
774 pskSimBit(carrier, &n, clk, &curPhase, TRUE);
775 }
776 }
777
778 WDT_HIT();
779
780 Dbprintf("Simulating with Carrier: %d, clk: %d, invert: %d, n: %d",carrier, clk, invert, n);
781
782 if (ledcontrol) LED_A_ON();
783 SimulateTagLowFrequency(n, 0, ledcontrol);
784 if (ledcontrol) LED_A_OFF();
785 }
786
787 // loop to get raw HID waveform then FSK demodulate the TAG ID from it
788 void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
789 {
790 uint8_t *dest = BigBuf_get_addr();
791 size_t size = 0;
792 uint32_t hi2=0, hi=0, lo=0;
793 int idx=0;
794 // Configure to go in 125Khz listen mode
795 LFSetupFPGAForADC(95, true);
796
797 //clear read buffer
798 BigBuf_Clear_keep_EM();
799
800 while(!BUTTON_PRESS() && !usb_poll_validate_length()) {
801
802 WDT_HIT();
803 if (ledcontrol) LED_A_ON();
804
805 DoAcquisition_default(0, true);
806 // FSK demodulator
807 size = 50*128*2; //big enough to catch 2 sequences of largest format
808 idx = HIDdemodFSK(dest, &size, &hi2, &hi, &lo);
809
810 if (idx>0 && lo>0 && (size==96 || size==192)){
811 // go over previously decoded manchester data and decode into usable tag ID
812 if (hi2 != 0){ //extra large HID tags 88/192 bits
813 Dbprintf("TAG ID: %x%08x%08x (%d)",
814 (unsigned int) hi2,
815 (unsigned int) hi,
816 (unsigned int) lo,
817 (unsigned int) (lo>>1) & 0xFFFF
818 );
819 } else { //standard HID tags 44/96 bits
820 uint8_t bitlen = 0;
821 uint32_t fc = 0;
822 uint32_t cardnum = 0;
823
824 if (((hi>>5)&1) == 1){//if bit 38 is set then < 37 bit format is used
825 uint32_t lo2=0;
826 lo2=(((hi & 31) << 12) | (lo>>20)); //get bits 21-37 to check for format len bit
827 uint8_t idx3 = 1;
828 while(lo2 > 1){ //find last bit set to 1 (format len bit)
829 lo2=lo2 >> 1;
830 idx3++;
831 }
832 bitlen = idx3+19;
833 fc =0;
834 cardnum=0;
835 if(bitlen == 26){
836 cardnum = (lo>>1)&0xFFFF;
837 fc = (lo>>17)&0xFF;
838 }
839 if(bitlen == 37){
840 cardnum = (lo>>1)&0x7FFFF;
841 fc = ((hi&0xF)<<12)|(lo>>20);
842 }
843 if(bitlen == 34){
844 cardnum = (lo>>1)&0xFFFF;
845 fc= ((hi&1)<<15)|(lo>>17);
846 }
847 if(bitlen == 35){
848 cardnum = (lo>>1)&0xFFFFF;
849 fc = ((hi&1)<<11)|(lo>>21);
850 }
851 }
852 else { //if bit 38 is not set then 37 bit format is used
853 bitlen= 37;
854 fc =0;
855 cardnum=0;
856 if(bitlen==37){
857 cardnum = (lo>>1)&0x7FFFF;
858 fc = ((hi&0xF)<<12)|(lo>>20);
859 }
860 }
861 Dbprintf("TAG ID: %x%08x (%d) - Format Len: %dbit - FC: %d - Card: %d",
862 (unsigned int) hi,
863 (unsigned int) lo,
864 (unsigned int) (lo>>1) & 0xFFFF,
865 (unsigned int) bitlen,
866 (unsigned int) fc,
867 (unsigned int) cardnum);
868 }
869 if (findone){
870 if (ledcontrol) LED_A_OFF();
871 *high = hi;
872 *low = lo;
873 break;
874 }
875 // reset
876 }
877 hi2 = hi = lo = idx = 0;
878 WDT_HIT();
879 }
880 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
881 DbpString("Stopped");
882 if (ledcontrol) LED_A_OFF();
883 }
884
885 // loop to get raw HID waveform then FSK demodulate the TAG ID from it
886 void CmdAWIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
887 {
888 uint8_t *dest = BigBuf_get_addr();
889 size_t size;
890 int idx=0;
891 //clear read buffer
892 BigBuf_Clear_keep_EM();
893 // Configure to go in 125Khz listen mode
894 LFSetupFPGAForADC(95, true);
895
896 while(!BUTTON_PRESS() && !usb_poll_validate_length()) {
897
898 WDT_HIT();
899 if (ledcontrol) LED_A_ON();
900
901 DoAcquisition_default(-1,true);
902 // FSK demodulator
903 size = 50*128*2; //big enough to catch 2 sequences of largest format
904 idx = AWIDdemodFSK(dest, &size);
905
906 if (idx<=0 || size!=96) continue;
907 // Index map
908 // 0 10 20 30 40 50 60
909 // | | | | | | |
910 // 01234567 890 1 234 5 678 9 012 3 456 7 890 1 234 5 678 9 012 3 456 7 890 1 234 5 678 9 012 3 - to 96
911 // -----------------------------------------------------------------------------
912 // 00000001 000 1 110 1 101 1 011 1 101 1 010 0 000 1 000 1 010 0 001 0 110 1 100 0 000 1 000 1
913 // premable bbb o bbb o bbw o fff o fff o ffc o ccc o ccc o ccc o ccc o ccc o wxx o xxx o xxx o - to 96
914 // |---26 bit---| |-----117----||-------------142-------------|
915 // b = format bit len, o = odd parity of last 3 bits
916 // f = facility code, c = card number
917 // w = wiegand parity
918 // (26 bit format shown)
919
920 //get raw ID before removing parities
921 uint32_t rawLo = bytebits_to_byte(dest+idx+64,32);
922 uint32_t rawHi = bytebits_to_byte(dest+idx+32,32);
923 uint32_t rawHi2 = bytebits_to_byte(dest+idx,32);
924
925 size = removeParity(dest, idx+8, 4, 1, 88);
926 if (size != 66) continue;
927
928 // Index map
929 // 0 10 20 30 40 50 60
930 // | | | | | | |
931 // 01234567 8 90123456 7890123456789012 3 456789012345678901234567890123456
932 // -----------------------------------------------------------------------------
933 // 00011010 1 01110101 0000000010001110 1 000000000000000000000000000000000
934 // bbbbbbbb w ffffffff cccccccccccccccc w xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
935 // |26 bit| |-117--| |-----142------|
936 //
937 // 00110010 0 0000011111010000000000000001000100101000100001111 0 00000000
938 // bbbbbbbb w ffffffffffffffffccccccccccccccccccccccccccccccccc w xxxxxxxx
939 // |50 bit| |----4000------||-----------2248975-------------|
940 //
941 // b = format bit len, o = odd parity of last 3 bits
942 // f = facility code, c = card number
943 // w = wiegand parity
944
945 uint32_t fc = 0;
946 uint32_t cardnum = 0;
947 uint32_t code1 = 0;
948 uint32_t code2 = 0;
949 uint8_t fmtLen = bytebits_to_byte(dest,8);
950 switch(fmtLen) {
951 case 26:
952 fc = bytebits_to_byte(dest + 9, 8);
953 cardnum = bytebits_to_byte(dest + 17, 16);
954 code1 = bytebits_to_byte(dest + 8,fmtLen);
955 Dbprintf("AWID Found - BitLength: %d, FC: %d, Card: %u - Wiegand: %x, Raw: %08x%08x%08x", fmtLen, fc, cardnum, code1, rawHi2, rawHi, rawLo);
956 break;
957 case 50:
958 fc = bytebits_to_byte(dest + 9, 16);
959 cardnum = bytebits_to_byte(dest + 25, 32);
960 code1 = bytebits_to_byte(dest + 8, (fmtLen-32) );
961 code2 = bytebits_to_byte(dest + 8 + (fmtLen-32), 32);
962 Dbprintf("AWID Found - BitLength: %d, FC: %d, Card: %u - Wiegand: %x%08x, Raw: %08x%08x%08x", fmtLen, fc, cardnum, code1, code2, rawHi2, rawHi, rawLo);
963 break;
964 default:
965 if (fmtLen > 32 ) {
966 cardnum = bytebits_to_byte(dest+8+(fmtLen-17), 16);
967 code1 = bytebits_to_byte(dest+8,fmtLen-32);
968 code2 = bytebits_to_byte(dest+8+(fmtLen-32),32);
969 Dbprintf("AWID Found - BitLength: %d -unknown BitLength- (%u) - Wiegand: %x%08x, Raw: %08x%08x%08x", fmtLen, cardnum, code1, code2, rawHi2, rawHi, rawLo);
970 } else {
971 cardnum = bytebits_to_byte(dest+8+(fmtLen-17), 16);
972 code1 = bytebits_to_byte(dest+8,fmtLen);
973 Dbprintf("AWID Found - BitLength: %d -unknown BitLength- (%u) - Wiegand: %x, Raw: %08x%08x%08x", fmtLen, cardnum, code1, rawHi2, rawHi, rawLo);
974 }
975 break;
976 }
977 if (findone)
978 break;
979
980 idx = 0;
981 WDT_HIT();
982 }
983
984 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
985 DbpString("Stopped");
986 if (ledcontrol) LED_A_OFF();
987 }
988
989 void CmdEM410xdemod(int findone, int *high, int *low, int ledcontrol)
990 {
991 uint8_t *dest = BigBuf_get_addr();
992
993 size_t size=0, idx=0;
994 int clk=0, invert=0, errCnt=0, maxErr=20;
995 uint32_t hi=0;
996 uint64_t lo=0;
997 //clear read buffer
998 BigBuf_Clear_keep_EM();
999 // Configure to go in 125Khz listen mode
1000 LFSetupFPGAForADC(95, true);
1001
1002 while(!BUTTON_PRESS() && !usb_poll_validate_length()) {
1003
1004 WDT_HIT();
1005 if (ledcontrol) LED_A_ON();
1006
1007 DoAcquisition_default(-1,true);
1008 size = BigBuf_max_traceLen();
1009 //askdemod and manchester decode
1010 if (size > 16385) size = 16385; //big enough to catch 2 sequences of largest format
1011 errCnt = askdemod(dest, &size, &clk, &invert, maxErr, 0, 1);
1012 WDT_HIT();
1013
1014 if (errCnt<0) continue;
1015
1016 errCnt = Em410xDecode(dest, &size, &idx, &hi, &lo);
1017 if (errCnt){
1018 if (size == 128){
1019 Dbprintf("EM XL TAG ID: %06x%08x%08x - (%05d_%03d_%08d)",
1020 hi,
1021 (uint32_t)(lo>>32),
1022 (uint32_t)lo,
1023 (uint32_t)(lo&0xFFFF),
1024 (uint32_t)((lo>>16LL) & 0xFF),
1025 (uint32_t)(lo & 0xFFFFFF));
1026 } else {
1027 Dbprintf("EM TAG ID: %02x%08x - (%05d_%03d_%08d)",
1028 (uint32_t)(lo>>32),
1029 (uint32_t)lo,
1030 (uint32_t)(lo&0xFFFF),
1031 (uint32_t)((lo>>16LL) & 0xFF),
1032 (uint32_t)(lo & 0xFFFFFF));
1033 }
1034
1035 if (findone){
1036 if (ledcontrol) LED_A_OFF();
1037 *high=lo>>32;
1038 *low=lo & 0xFFFFFFFF;
1039 break;
1040 }
1041 }
1042 WDT_HIT();
1043 hi = lo = size = idx = 0;
1044 clk = invert = errCnt = 0;
1045 }
1046 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1047 DbpString("Stopped");
1048 if (ledcontrol) LED_A_OFF();
1049 }
1050
1051 void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
1052 {
1053 uint8_t *dest = BigBuf_get_addr();
1054 int idx=0;
1055 uint32_t code=0, code2=0;
1056 uint8_t version=0;
1057 uint8_t facilitycode=0;
1058 uint16_t number=0;
1059 uint8_t crc = 0;
1060 uint16_t calccrc = 0;
1061
1062 //clear read buffer
1063 BigBuf_Clear_keep_EM();
1064
1065 // Configure to go in 125Khz listen mode
1066 LFSetupFPGAForADC(95, true);
1067
1068 while(!BUTTON_PRESS() && !usb_poll_validate_length()) {
1069 WDT_HIT();
1070 if (ledcontrol) LED_A_ON();
1071 DoAcquisition_default(-1,true);
1072 //fskdemod and get start index
1073 WDT_HIT();
1074 idx = IOdemodFSK(dest, BigBuf_max_traceLen());
1075 if (idx<0) continue;
1076 //valid tag found
1077
1078 //Index map
1079 //0 10 20 30 40 50 60
1080 //| | | | | | |
1081 //01234567 8 90123456 7 89012345 6 78901234 5 67890123 4 56789012 3 45678901 23
1082 //-----------------------------------------------------------------------------
1083 //00000000 0 11110000 1 facility 1 version* 1 code*one 1 code*two 1 checksum 11
1084 //
1085 //Checksum:
1086 //00000000 0 11110000 1 11100000 1 00000001 1 00000011 1 10110110 1 01110101 11
1087 //preamble F0 E0 01 03 B6 75
1088 // How to calc checksum,
1089 // http://www.proxmark.org/forum/viewtopic.php?id=364&p=6
1090 // F0 + E0 + 01 + 03 + B6 = 28A
1091 // 28A & FF = 8A
1092 // FF - 8A = 75
1093 // Checksum: 0x75
1094 //XSF(version)facility:codeone+codetwo
1095 //Handle the data
1096 // if(findone){ //only print binary if we are doing one
1097 // Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx], dest[idx+1], dest[idx+2],dest[idx+3],dest[idx+4],dest[idx+5],dest[idx+6],dest[idx+7],dest[idx+8]);
1098 // Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+9], dest[idx+10],dest[idx+11],dest[idx+12],dest[idx+13],dest[idx+14],dest[idx+15],dest[idx+16],dest[idx+17]);
1099 // Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+18],dest[idx+19],dest[idx+20],dest[idx+21],dest[idx+22],dest[idx+23],dest[idx+24],dest[idx+25],dest[idx+26]);
1100 // Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+27],dest[idx+28],dest[idx+29],dest[idx+30],dest[idx+31],dest[idx+32],dest[idx+33],dest[idx+34],dest[idx+35]);
1101 // Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+36],dest[idx+37],dest[idx+38],dest[idx+39],dest[idx+40],dest[idx+41],dest[idx+42],dest[idx+43],dest[idx+44]);
1102 // Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+45],dest[idx+46],dest[idx+47],dest[idx+48],dest[idx+49],dest[idx+50],dest[idx+51],dest[idx+52],dest[idx+53]);
1103 // Dbprintf("%d%d%d%d%d%d%d%d %d%d",dest[idx+54],dest[idx+55],dest[idx+56],dest[idx+57],dest[idx+58],dest[idx+59],dest[idx+60],dest[idx+61],dest[idx+62],dest[idx+63]);
1104 // }
1105 code = bytebits_to_byte(dest+idx,32);
1106 code2 = bytebits_to_byte(dest+idx+32,32);
1107 version = bytebits_to_byte(dest+idx+27,8); //14,4
1108 facilitycode = bytebits_to_byte(dest+idx+18,8);
1109 number = (bytebits_to_byte(dest+idx+36,8)<<8)|(bytebits_to_byte(dest+idx+45,8)); //36,9
1110
1111 crc = bytebits_to_byte(dest+idx+54,8);
1112 for (uint8_t i=1; i<6; ++i)
1113 calccrc += bytebits_to_byte(dest+idx+9*i,8);
1114 calccrc &= 0xff;
1115 calccrc = 0xff - calccrc;
1116
1117 char *crcStr = (crc == calccrc) ? "ok":"!crc";
1118
1119 Dbprintf("IO Prox XSF(%02d)%02x:%05d (%08x%08x) [%02x %s]",version,facilitycode,number,code,code2, crc, crcStr);
1120 // if we're only looking for one tag
1121 if (findone){
1122 if (ledcontrol) LED_A_OFF();
1123 *high=code;
1124 *low=code2;
1125 break;
1126 }
1127 code=code2=0;
1128 version=facilitycode=0;
1129 number=0;
1130 idx=0;
1131
1132 WDT_HIT();
1133 }
1134 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1135 DbpString("Stopped");
1136 if (ledcontrol) LED_A_OFF();
1137 }
1138
1139 /*------------------------------
1140 * T5555/T5557/T5567/T5577 routines
1141 *------------------------------
1142 * NOTE: T55x7/T5555 configuration register definitions moved to protocols.h
1143 *
1144 * Relevant communication times in microsecond
1145 * To compensate antenna falling times shorten the write times
1146 * and enlarge the gap ones.
1147 * Q5 tags seems to have issues when these values changes.
1148 */
1149
1150 #define START_GAP 50*8 // was 250 // SPEC: 1*8 to 50*8 - typ 15*8 (15fc)
1151 #define WRITE_GAP 20*8 // was 160 // SPEC: 1*8 to 20*8 - typ 10*8 (10fc)
1152 #define WRITE_0 18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (24fc)
1153 #define WRITE_1 54*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (56fc) 432 for T55x7; 448 for E5550
1154 #define READ_GAP 15*8
1155
1156 // VALUES TAKEN FROM EM4x function: SendForward
1157 // START_GAP = 440; (55*8) cycles at 125Khz (8us = 1cycle)
1158 // WRITE_GAP = 128; (16*8)
1159 // WRITE_1 = 256 32*8; (32*8)
1160
1161 // These timings work for 4469/4269/4305 (with the 55*8 above)
1162 // WRITE_0 = 23*8 , 9*8
1163
1164 // Sam7s has several timers, we will use the source TIMER_CLOCK1 (aka AT91C_TC_CLKS_TIMER_DIV1_CLOCK)
1165 // TIMER_CLOCK1 = MCK/2, MCK is running at 48 MHz, Timer is running at 48/2 = 24 MHz
1166 // Hitag units (T0) have duration of 8 microseconds (us), which is 1/125000 per second (carrier)
1167 // T0 = TIMER_CLOCK1 / 125000 = 192
1168 // 1 Cycle = 8 microseconds(us) == 1 field clock
1169
1170 // new timer:
1171 // = 1us = 1.5ticks
1172 // 1fc = 8us = 12ticks
1173 void TurnReadLFOn(uint32_t delay) {
1174 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
1175
1176 // measure antenna strength.
1177 //int adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
1178
1179 // Give it a bit of time for the resonant antenna to settle.
1180 WaitUS(delay);
1181 }
1182 void TurnReadLF_off(uint32_t delay) {
1183 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1184 WaitUS(delay);
1185 }
1186
1187 // Write one bit to card
1188 void T55xxWriteBit(int bit) {
1189 if (!bit)
1190 TurnReadLFOn(WRITE_0);
1191 else
1192 TurnReadLFOn(WRITE_1);
1193 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1194 WaitUS(WRITE_GAP);
1195 }
1196
1197 // Send T5577 reset command then read stream (see if we can identify the start of the stream)
1198 void T55xxResetRead(void) {
1199 LED_A_ON();
1200 //clear buffer now so it does not interfere with timing later
1201 BigBuf_Clear_keep_EM();
1202
1203 // Set up FPGA, 125kHz
1204 LFSetupFPGAForADC(95, true);
1205
1206 // Trigger T55x7 in mode.
1207 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1208 WaitUS(START_GAP);
1209
1210 // reset tag - op code 00
1211 T55xxWriteBit(0);
1212 T55xxWriteBit(0);
1213
1214 // Turn field on to read the response
1215 TurnReadLFOn(READ_GAP);
1216
1217 // Acquisition
1218 doT55x7Acquisition(BigBuf_max_traceLen());
1219
1220 // Turn the field off
1221 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
1222 cmd_send(CMD_ACK,0,0,0,0,0);
1223 LED_A_OFF();
1224 }
1225
1226 // Write one card block in page 0, no lock
1227 void T55xxWriteBlockExt(uint32_t Data, uint8_t Block, uint32_t Pwd, uint8_t arg) {
1228 LED_A_ON();
1229 bool PwdMode = arg & 0x1;
1230 uint8_t Page = (arg & 0x2)>>1;
1231 uint32_t i = 0;
1232
1233 // Set up FPGA, 125kHz
1234 LFSetupFPGAForADC(95, true);
1235
1236 // Trigger T55x7 in mode.
1237 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1238 WaitUS(START_GAP);
1239
1240 // Opcode 10
1241 T55xxWriteBit(1);
1242 T55xxWriteBit(Page); //Page 0
1243 if (PwdMode){
1244 // Send Pwd
1245 for (i = 0x80000000; i != 0; i >>= 1)
1246 T55xxWriteBit(Pwd & i);
1247 }
1248 // Send Lock bit
1249 T55xxWriteBit(0);
1250
1251 // Send Data
1252 for (i = 0x80000000; i != 0; i >>= 1)
1253 T55xxWriteBit(Data & i);
1254
1255 // Send Block number
1256 for (i = 0x04; i != 0; i >>= 1)
1257 T55xxWriteBit(Block & i);
1258
1259 // Perform write (nominal is 5.6 ms for T55x7 and 18ms for E5550,
1260 // so wait a little more)
1261 TurnReadLFOn(20 * 1000);
1262
1263 //could attempt to do a read to confirm write took
1264 // as the tag should repeat back the new block
1265 // until it is reset, but to confirm it we would
1266 // need to know the current block 0 config mode
1267
1268 // turn field off
1269 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1270 LED_A_OFF();
1271 }
1272
1273 // Write one card block in page 0, no lock
1274 void T55xxWriteBlock(uint32_t Data, uint8_t Block, uint32_t Pwd, uint8_t arg) {
1275 T55xxWriteBlockExt(Data, Block, Pwd, arg);
1276 cmd_send(CMD_ACK,0,0,0,0,0);
1277 }
1278
1279 // Read one card block in page [page]
1280 void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
1281 LED_A_ON();
1282 bool PwdMode = arg0 & 0x1;
1283 uint8_t Page = (arg0 & 0x2) >> 1;
1284 uint32_t i = 0;
1285 bool RegReadMode = (Block == 0xFF);
1286
1287 //clear buffer now so it does not interfere with timing later
1288 BigBuf_Clear_keep_EM();
1289
1290 //make sure block is at max 7
1291 Block &= 0x7;
1292
1293 // Set up FPGA, 125kHz to power up the tag
1294 LFSetupFPGAForADC(95, true);
1295 //SpinDelay(3);
1296
1297 // Trigger T55x7 Direct Access Mode with start gap
1298 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1299 WaitUS(START_GAP);
1300
1301 // Opcode 1[page]
1302 T55xxWriteBit(1);
1303 T55xxWriteBit(Page); //Page 0
1304
1305 if (PwdMode){
1306 // Send Pwd
1307 for (i = 0x80000000; i != 0; i >>= 1)
1308 T55xxWriteBit(Pwd & i);
1309 }
1310 // Send a zero bit separation
1311 T55xxWriteBit(0);
1312
1313 // Send Block number (if direct access mode)
1314 if (!RegReadMode)
1315 for (i = 0x04; i != 0; i >>= 1)
1316 T55xxWriteBit(Block & i);
1317
1318 // Turn field on to read the response
1319 TurnReadLFOn(READ_GAP);
1320
1321 // Acquisition
1322 doT55x7Acquisition(7679);
1323
1324 // Turn the field off
1325 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
1326 cmd_send(CMD_ACK,0,0,0,0,0);
1327 LED_A_OFF();
1328 }
1329
1330 void T55xxWakeUp(uint32_t Pwd){
1331 LED_B_ON();
1332 uint32_t i = 0;
1333
1334 // Set up FPGA, 125kHz
1335 LFSetupFPGAForADC(95, true);
1336
1337 // Trigger T55x7 Direct Access Mode
1338 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1339 WaitUS(START_GAP);
1340
1341 // Opcode 10
1342 T55xxWriteBit(1);
1343 T55xxWriteBit(0); //Page 0
1344
1345 // Send Pwd
1346 for (i = 0x80000000; i != 0; i >>= 1)
1347 T55xxWriteBit(Pwd & i);
1348
1349 // Turn and leave field on to let the begin repeating transmission
1350 TurnReadLFOn(20*1000);
1351 }
1352
1353 /*-------------- Cloning routines -----------*/
1354 void WriteT55xx(uint32_t *blockdata, uint8_t startblock, uint8_t numblocks) {
1355 // write last block first and config block last (if included)
1356 for (uint8_t i = numblocks+startblock; i > startblock; i--)
1357 T55xxWriteBlockExt(blockdata[i-1], i-1, 0, 0);
1358 }
1359
1360 // Copy HID id to card and setup block 0 config
1361 void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT) {
1362 uint32_t data[] = {0,0,0,0,0,0,0};
1363 uint8_t last_block = 0;
1364
1365 if (longFMT){
1366 // Ensure no more than 84 bits supplied
1367 if (hi2 > 0xFFFFF) {
1368 DbpString("Tags can only have 84 bits.");
1369 return;
1370 }
1371 // Build the 6 data blocks for supplied 84bit ID
1372 last_block = 6;
1373 // load preamble (1D) & long format identifier (9E manchester encoded)
1374 data[1] = 0x1D96A900 | (manchesterEncode2Bytes((hi2 >> 16) & 0xF) & 0xFF);
1375 // load raw id from hi2, hi, lo to data blocks (manchester encoded)
1376 data[2] = manchesterEncode2Bytes(hi2 & 0xFFFF);
1377 data[3] = manchesterEncode2Bytes(hi >> 16);
1378 data[4] = manchesterEncode2Bytes(hi & 0xFFFF);
1379 data[5] = manchesterEncode2Bytes(lo >> 16);
1380 data[6] = manchesterEncode2Bytes(lo & 0xFFFF);
1381 } else {
1382 // Ensure no more than 44 bits supplied
1383 if (hi > 0xFFF) {
1384 DbpString("Tags can only have 44 bits.");
1385 return;
1386 }
1387 // Build the 3 data blocks for supplied 44bit ID
1388 last_block = 3;
1389 // load preamble
1390 data[1] = 0x1D000000 | (manchesterEncode2Bytes(hi) & 0xFFFFFF);
1391 data[2] = manchesterEncode2Bytes(lo >> 16);
1392 data[3] = manchesterEncode2Bytes(lo & 0xFFFF);
1393 }
1394 // load chip config block
1395 data[0] = T55x7_BITRATE_RF_50 | T55x7_MODULATION_FSK2a | last_block << T55x7_MAXBLOCK_SHIFT;
1396
1397 //TODO add selection of chip for Q5 or T55x7
1398 // data[0] = (((50-2)>>1)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | last_block << T5555_MAXBLOCK_SHIFT;
1399
1400 LED_D_ON();
1401 WriteT55xx(data, 0, last_block+1);
1402 LED_D_OFF();
1403 }
1404
1405 void CopyIOtoT55x7(uint32_t hi, uint32_t lo) {
1406 uint32_t data[] = {T55x7_BITRATE_RF_64 | T55x7_MODULATION_FSK2a | (2 << T55x7_MAXBLOCK_SHIFT), hi, lo};
1407 //TODO add selection of chip for Q5 or T55x7
1408 //t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
1409 // data[0] = ( ((64-2)>>1) << T5555_BITRATE_SHIFT) | T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | 2 << T5555_MAXBLOCK_SHIFT;
1410
1411 LED_D_ON();
1412 // Program the data blocks for supplied ID
1413 // and the block 0 config
1414 WriteT55xx(data, 0, 3);
1415 LED_D_OFF();
1416 }
1417
1418 // Clone Indala 64-bit tag by UID to T55x7
1419 void CopyIndala64toT55x7(uint32_t hi, uint32_t lo) {
1420 //Program the 2 data blocks for supplied 64bit UID
1421 // and the Config for Indala 64 format (RF/32;PSK1 with RF/2;Maxblock=2)
1422 uint32_t data[] = { T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK1 | (2 << T55x7_MAXBLOCK_SHIFT), hi, lo};
1423 //TODO add selection of chip for Q5 or T55x7
1424 // data[0] = (((32-2)>>1)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_PSK1 | 2 << T5555_MAXBLOCK_SHIFT;
1425
1426 WriteT55xx(data, 0, 3);
1427 //Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=2;Inverse data)
1428 // T5567WriteBlock(0x603E1042,0);
1429 }
1430 // Clone Indala 224-bit tag by UID to T55x7
1431 void CopyIndala224toT55x7(uint32_t uid1, uint32_t uid2, uint32_t uid3, uint32_t uid4, uint32_t uid5, uint32_t uid6, uint32_t uid7) {
1432 //Program the 7 data blocks for supplied 224bit UID
1433 uint32_t data[] = {0, uid1, uid2, uid3, uid4, uid5, uid6, uid7};
1434 // and the block 0 for Indala224 format
1435 //Config for Indala (RF/32;PSK1 with RF/2;Maxblock=7)
1436 data[0] = T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK1 | (7 << T55x7_MAXBLOCK_SHIFT);
1437 //TODO add selection of chip for Q5 or T55x7
1438 // data[0] = (((32-2)>>1) << T5555_BITRATE_SHIFT) | T5555_MODULATION_PSK1 | 7 << T5555_MAXBLOCK_SHIFT;
1439 WriteT55xx(data, 0, 8);
1440 //Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=7;Inverse data)
1441 // T5567WriteBlock(0x603E10E2,0);
1442 }
1443 // clone viking tag to T55xx
1444 void CopyVikingtoT55xx(uint32_t block1, uint32_t block2, uint8_t Q5) {
1445 uint32_t data[] = {T55x7_BITRATE_RF_32 | T55x7_MODULATION_MANCHESTER | (2 << T55x7_MAXBLOCK_SHIFT), block1, block2};
1446 //t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
1447 if (Q5) data[0] = (((32-2)>>1) << T5555_BITRATE_SHIFT) | T5555_MODULATION_MANCHESTER | 2 << T5555_MAXBLOCK_SHIFT;
1448 // Program the data blocks for supplied ID and the block 0 config
1449 WriteT55xx(data, 0, 3);
1450 LED_D_OFF();
1451 cmd_send(CMD_ACK,0,0,0,0,0);
1452 }
1453
1454 // Define 9bit header for EM410x tags
1455 #define EM410X_HEADER 0x1FF
1456 #define EM410X_ID_LENGTH 40
1457
1458 void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo) {
1459 int i, id_bit;
1460 uint64_t id = EM410X_HEADER;
1461 uint64_t rev_id = 0; // reversed ID
1462 int c_parity[4]; // column parity
1463 int r_parity = 0; // row parity
1464 uint32_t clock = 0;
1465
1466 // Reverse ID bits given as parameter (for simpler operations)
1467 for (i = 0; i < EM410X_ID_LENGTH; ++i) {
1468 if (i < 32) {
1469 rev_id = (rev_id << 1) | (id_lo & 1);
1470 id_lo >>= 1;
1471 } else {
1472 rev_id = (rev_id << 1) | (id_hi & 1);
1473 id_hi >>= 1;
1474 }
1475 }
1476
1477 for (i = 0; i < EM410X_ID_LENGTH; ++i) {
1478 id_bit = rev_id & 1;
1479
1480 if (i % 4 == 0) {
1481 // Don't write row parity bit at start of parsing
1482 if (i)
1483 id = (id << 1) | r_parity;
1484 // Start counting parity for new row
1485 r_parity = id_bit;
1486 } else {
1487 // Count row parity
1488 r_parity ^= id_bit;
1489 }
1490
1491 // First elements in column?
1492 if (i < 4)
1493 // Fill out first elements
1494 c_parity[i] = id_bit;
1495 else
1496 // Count column parity
1497 c_parity[i % 4] ^= id_bit;
1498
1499 // Insert ID bit
1500 id = (id << 1) | id_bit;
1501 rev_id >>= 1;
1502 }
1503
1504 // Insert parity bit of last row
1505 id = (id << 1) | r_parity;
1506
1507 // Fill out column parity at the end of tag
1508 for (i = 0; i < 4; ++i)
1509 id = (id << 1) | c_parity[i];
1510
1511 // Add stop bit
1512 id <<= 1;
1513
1514 Dbprintf("Started writing %s tag ...", card ? "T55x7":"T5555");
1515 LED_D_ON();
1516
1517 // Write EM410x ID
1518 uint32_t data[] = {0, (uint32_t)(id>>32), (uint32_t)(id & 0xFFFFFFFF)};
1519
1520 clock = (card & 0xFF00) >> 8;
1521 clock = (clock == 0) ? 64 : clock;
1522 Dbprintf("Clock rate: %d", clock);
1523 if (card & 0xFF) { //t55x7
1524 clock = GetT55xxClockBit(clock);
1525 if (clock == 0) {
1526 Dbprintf("Invalid clock rate: %d", clock);
1527 return;
1528 }
1529 data[0] = clock | T55x7_MODULATION_MANCHESTER | (2 << T55x7_MAXBLOCK_SHIFT);
1530 } else { //t5555 (Q5)
1531 // t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
1532 data[0] = ( ((clock-2) >> 1) << T5555_BITRATE_SHIFT) | T5555_MODULATION_MANCHESTER | (2 << T5555_MAXBLOCK_SHIFT);
1533 }
1534
1535 WriteT55xx(data, 0, 3);
1536
1537 LED_D_OFF();
1538 Dbprintf("Tag %s written with 0x%08x%08x\n",
1539 card ? "T55x7":"T5555",
1540 (uint32_t)(id >> 32),
1541 (uint32_t)id);
1542 }
1543
1544 //-----------------------------------
1545 // EM4469 / EM4305 routines
1546 //-----------------------------------
1547 // Below given command set.
1548 // Commands are including the even parity, binary mirrored
1549 #define FWD_CMD_LOGIN 0xC
1550 #define FWD_CMD_WRITE 0xA
1551 #define FWD_CMD_READ 0x9
1552 #define FWD_CMD_DISABLE 0x5
1553
1554 uint8_t forwardLink_data[64]; //array of forwarded bits
1555 uint8_t * forward_ptr; //ptr for forward message preparation
1556 uint8_t fwd_bit_sz; //forwardlink bit counter
1557 uint8_t * fwd_write_ptr; //forwardlink bit pointer
1558
1559 //====================================================================
1560 // prepares command bits
1561 // see EM4469 spec
1562 //====================================================================
1563 //--------------------------------------------------------------------
1564 // VALUES TAKEN FROM EM4x function: SendForward
1565 // START_GAP = 440; (55*8) cycles at 125Khz (8us = 1cycle)
1566 // WRITE_GAP = 128; (16*8)
1567 // WRITE_1 = 256 32*8; (32*8)
1568
1569 // These timings work for 4469/4269/4305 (with the 55*8 above)
1570 // WRITE_0 = 23*8 , 9*8
1571
1572 uint8_t Prepare_Cmd( uint8_t cmd ) {
1573
1574 *forward_ptr++ = 0; //start bit
1575 *forward_ptr++ = 0; //second pause for 4050 code
1576
1577 *forward_ptr++ = cmd;
1578 cmd >>= 1;
1579 *forward_ptr++ = cmd;
1580 cmd >>= 1;
1581 *forward_ptr++ = cmd;
1582 cmd >>= 1;
1583 *forward_ptr++ = cmd;
1584
1585 return 6; //return number of emited bits
1586 }
1587
1588 //====================================================================
1589 // prepares address bits
1590 // see EM4469 spec
1591 //====================================================================
1592 uint8_t Prepare_Addr( uint8_t addr ) {
1593
1594 register uint8_t line_parity;
1595
1596 uint8_t i;
1597 line_parity = 0;
1598 for( i=0; i<6; i++ ) {
1599 *forward_ptr++ = addr;
1600 line_parity ^= addr;
1601 addr >>= 1;
1602 }
1603
1604 *forward_ptr++ = (line_parity & 1);
1605
1606 return 7; //return number of emited bits
1607 }
1608
1609 //====================================================================
1610 // prepares data bits intreleaved with parity bits
1611 // see EM4469 spec
1612 //====================================================================
1613 uint8_t Prepare_Data( uint16_t data_low, uint16_t data_hi) {
1614
1615 register uint8_t line_parity;
1616 register uint8_t column_parity;
1617 register uint8_t i, j;
1618 register uint16_t data;
1619
1620 data = data_low;
1621 column_parity = 0;
1622
1623 for(i=0; i<4; i++) {
1624 line_parity = 0;
1625 for(j=0; j<8; j++) {
1626 line_parity ^= data;
1627 column_parity ^= (data & 1) << j;
1628 *forward_ptr++ = data;
1629 data >>= 1;
1630 }
1631 *forward_ptr++ = line_parity;
1632 if(i == 1)
1633 data = data_hi;
1634 }
1635
1636 for(j=0; j<8; j++) {
1637 *forward_ptr++ = column_parity;
1638 column_parity >>= 1;
1639 }
1640 *forward_ptr = 0;
1641
1642 return 45; //return number of emited bits
1643 }
1644
1645 //====================================================================
1646 // Forward Link send function
1647 // Requires: forwarLink_data filled with valid bits (1 bit per byte)
1648 // fwd_bit_count set with number of bits to be sent
1649 //====================================================================
1650 void SendForward(uint8_t fwd_bit_count) {
1651
1652 // iceman, 21.3us increments for the USclock verification.
1653 // 55FC * 8us == 440us / 21.3 === 20.65 steps. could be too short. Go for 56FC instead
1654 // 32FC * 8us == 256us / 21.3 == 12.018 steps. ok
1655 // 16FC * 8us == 128us / 21.3 == 6.009 steps. ok
1656 #ifndef EM_START_GAP
1657 #define EM_START_GAP 55*8
1658 #endif
1659
1660 fwd_write_ptr = forwardLink_data;
1661 fwd_bit_sz = fwd_bit_count;
1662
1663 // Set up FPGA, 125kHz
1664 LFSetupFPGAForADC(95, true);
1665
1666 // force 1st mod pulse (start gap must be longer for 4305)
1667 fwd_bit_sz--; //prepare next bit modulation
1668 fwd_write_ptr++;
1669
1670 TurnReadLF_off(EM_START_GAP);
1671 TurnReadLFOn(18*8);
1672
1673 // now start writting with bitbanging the antenna.
1674 while(fwd_bit_sz-- > 0) { //prepare next bit modulation
1675 if(((*fwd_write_ptr++) & 1) == 1) {
1676 WaitUS(32);
1677 } else {
1678 TurnReadLF_off(23*8);
1679 TurnReadLFOn(16*8);
1680 }
1681 }
1682 }
1683
1684 void EM4xLogin(uint32_t pwd) {
1685 uint8_t len;
1686 forward_ptr = forwardLink_data;
1687 len = Prepare_Cmd( FWD_CMD_LOGIN );
1688 len += Prepare_Data( pwd & 0xFFFF, pwd >> 16 );
1689 SendForward(len);
1690 //WaitUS(20); // no wait for login command.
1691 // should receive
1692 // 0000 1010 ok.
1693 // 0000 0001 fail
1694 }
1695
1696 void EM4xReadWord(uint8_t addr, uint32_t pwd, uint8_t usepwd) {
1697
1698 LED_A_ON();
1699 uint8_t len;
1700
1701 //clear buffer now so it does not interfere with timing later
1702 BigBuf_Clear_ext(false);
1703
1704 /* should we read answer from Logincommand?
1705 *
1706 * should receive
1707 * 0000 1010 ok.
1708 * 0000 0001 fail
1709 **/
1710 if (usepwd) EM4xLogin(pwd);
1711
1712 forward_ptr = forwardLink_data;
1713 len = Prepare_Cmd( FWD_CMD_READ );
1714 len += Prepare_Addr( addr );
1715
1716 SendForward(len);
1717
1718 WaitUS(400);
1719
1720 DoPartialAcquisition(20, true, 6000);
1721
1722 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1723 cmd_send(CMD_ACK,0,0,0,0,0);
1724 LED_A_OFF();
1725 }
1726
1727 void EM4xWriteWord(uint32_t flag, uint32_t data, uint32_t pwd) {
1728
1729 LED_A_ON();
1730
1731 bool usePwd = (flag & 0xF);
1732 uint8_t addr = (flag >> 8) & 0xFF;
1733 uint8_t len;
1734
1735 //clear buffer now so it does not interfere with timing later
1736 BigBuf_Clear_ext(false);
1737
1738 /* should we read answer from Logincommand?
1739 *
1740 * should receive
1741 * 0000 1010 ok.
1742 * 0000 0001 fail
1743 **/
1744 if (usePwd) EM4xLogin(pwd);
1745
1746 forward_ptr = forwardLink_data;
1747 len = Prepare_Cmd( FWD_CMD_WRITE );
1748 len += Prepare_Addr( addr );
1749 len += Prepare_Data( data & 0xFFFF, data >> 16 );
1750
1751 SendForward(len);
1752
1753 //Wait 20ms for write to complete?
1754 WaitMS(7);
1755
1756 //Capture response if one exists
1757 DoPartialAcquisition(20, true, 6000);
1758
1759 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1760 cmd_send(CMD_ACK,0,0,0,0,0);
1761 LED_A_OFF();
1762 }
1763
1764 /*
1765 Reading a COTAG.
1766
1767 COTAG needs the reader to send a startsequence and the card has an extreme slow datarate.
1768 because of this, we can "sample" the data signal but we interpreate it to Manchester direct.
1769
1770 READER START SEQUENCE:
1771 burst 800 us, gap 2.2 msecs
1772 burst 3.6 msecs gap 2.2 msecs
1773 burst 800 us gap 2.2 msecs
1774 pulse 3.6 msecs
1775
1776 This triggers a COTAG tag to response
1777 */
1778 void Cotag(uint32_t arg0) {
1779 #ifndef OFF
1780 # define OFF { FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); WaitUS(2035); }
1781 #endif
1782 #ifndef ON
1783 # define ON(x) { FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD); WaitUS((x)); }
1784 #endif
1785 uint8_t rawsignal = arg0 & 0xF;
1786
1787 LED_A_ON();
1788
1789 // Switching to LF image on FPGA. This might empty BigBuff
1790 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1791
1792 //clear buffer now so it does not interfere with timing later
1793 BigBuf_Clear_ext(false);
1794
1795 // Set up FPGA, 132kHz to power up the tag
1796 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 89);
1797 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
1798
1799 // Connect the A/D to the peak-detected low-frequency path.
1800 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
1801
1802 // Now set up the SSC to get the ADC samples that are now streaming at us.
1803 FpgaSetupSsc();
1804
1805 // start clock - 1.5ticks is 1us
1806 StartTicks();
1807
1808 //send COTAG start pulse
1809 ON(740) OFF
1810 ON(3330) OFF
1811 ON(740) OFF
1812 ON(1000)
1813
1814 switch(rawsignal) {
1815 case 0: doCotagAcquisition(50000); break;
1816 case 1: doCotagAcquisitionManchester(); break;
1817 case 2: DoAcquisition_config(TRUE); break;
1818 }
1819
1820 // Turn the field off
1821 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
1822 cmd_send(CMD_ACK,0,0,0,0,0);
1823 LED_A_OFF();
1824 }
1825
1826 /*
1827 * EM4305 support
1828 */
Proxmark3 GIT tracking
Impressum, Datenschutz