git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/pcf7931.c

   1 #include "pcf7931.h"
   2
   3 #define T0_PCF 8 //period for the pcf7931 in us
   4 #define ALLOC 16
   5
   6 int DemodPCF7931(uint8_t **outBlocks) {
   7
   8     uint8_t bits[256] = {0x00};
   9         uint8_t blocks[8][16];
  10     uint8_t *dest = BigBuf_get_addr();
  11
  12         int GraphTraceLen = BigBuf_max_traceLen();
  13         if (  GraphTraceLen > 18000 )
  14                 GraphTraceLen = 18000;
  15
  16         int i, j, lastval, bitidx, half_switch;
  17         int clock = 64;
  18         int tolerance = clock / 8;
  19         int pmc, block_done;
  20         int lc, warnings = 0;
  21         int num_blocks = 0;
  22         int lmin=128, lmax=128;
  23         uint8_t dir;
  24         //clear read buffer
  25         BigBuf_Clear_keep_EM();
  26
  27         LFSetupFPGAForADC(95, true);
  28         DoAcquisition_default(0, true);
  29
  30         lmin = 64;
  31         lmax = 192;
  32
  33         i = 2;
  34
  35         /* Find first local max/min */
  36     if(dest[1] > dest[0]) {
  37                 while(i < GraphTraceLen) {
  38             if( !(dest[i] > dest[i-1]) && dest[i] > lmax)
  39                                 break;
  40                         i++;
  41                 }
  42                 dir = 0;
  43         }
  44         else {
  45                 while(i < GraphTraceLen) {
  46             if( !(dest[i] < dest[i-1]) && dest[i] < lmin)
  47                                 break;
  48                         i++;
  49                 }
  50                 dir = 1;
  51         }
  52
  53         lastval = i++;
  54         half_switch = 0;
  55         pmc = 0;
  56         block_done = 0;
  57
  58         for (bitidx = 0; i < GraphTraceLen; i++)
  59         {
  60         if ( (dest[i-1] > dest[i] && dir == 1 && dest[i] > lmax) || (dest[i-1] < dest[i] && dir == 0 && dest[i] < lmin))
  61                 {
  62                         lc = i - lastval;
  63                         lastval = i;
  64
  65                         // Switch depending on lc length:
  66                         // Tolerance is 1/8 of clock rate (arbitrary)
  67                         if (ABS(lc-clock/4) < tolerance) {
  68                                 // 16T0
  69                                 if((i - pmc) == lc) { /* 16T0 was previous one */
  70                                         /* It's a PMC ! */
  71                                         i += (128+127+16+32+33+16)-1;
  72                                         lastval = i;
  73                                         pmc = 0;
  74                                         block_done = 1;
  75                                 }
  76                                 else {
  77                                         pmc = i;
  78                                 }
  79                         } else if (ABS(lc-clock/2) < tolerance) {
  80                                 // 32TO
  81                                 if((i - pmc) == lc) { /* 16T0 was previous one */
  82                                         /* It's a PMC ! */
  83                                         i += (128+127+16+32+33)-1;
  84                                         lastval = i;
  85                                         pmc = 0;
  86                                         block_done = 1;
  87                                 }
  88                                 else if(half_switch == 1) {
  89                     bits[bitidx++] = 0;
  90                                         half_switch = 0;
  91                                 }
  92                                 else
  93                                         half_switch++;
  94                         } else if (ABS(lc-clock) < tolerance) {
  95                                 // 64TO
  96                 bits[bitidx++] = 1;
  97                         } else {
  98                                 // Error
  99                                 warnings++;
 100                                 if (warnings > 10)
 101                                 {
 102                                         Dbprintf("Error: too many detection errors, aborting.");
 103                                         return 0;
 104                                 }
 105                         }
 106
 107                         if(block_done == 1) {
 108                                 if(bitidx == 128) {
 109                                         for(j=0; j<16; j++) {
 110                         blocks[num_blocks][j] = 128*bits[j*8+7]+
 111                                 64*bits[j*8+6]+
 112                                 32*bits[j*8+5]+
 113                                 16*bits[j*8+4]+
 114                                 8*bits[j*8+3]+
 115                                 4*bits[j*8+2]+
 116                                 2*bits[j*8+1]+
 117                                 bits[j*8];
 118
 119                                         }
 120                                         num_blocks++;
 121                                 }
 122                                 bitidx = 0;
 123                                 block_done = 0;
 124                                 half_switch = 0;
 125                         }
 126                         if(i < GraphTraceLen)
 127                 dir =(dest[i-1] > dest[i]) ? 0 : 1;
 128                 }
 129                 if(bitidx==255)
 130                         bitidx=0;
 131                 warnings = 0;
 132                 if(num_blocks == 4) break;
 133         }
 134     memcpy(outBlocks, blocks, 16*num_blocks);
 135         return num_blocks;
 136 }
 137
 138 int IsBlock0PCF7931(uint8_t *Block) {
 139         // Assume RFU means 0 :)
 140         if((memcmp(Block, "\x00\x00\x00\x00\x00\x00\x00\x01", 8) == 0) && memcmp(Block+9, "\x00\x00\x00\x00\x00\x00\x00", 7) == 0) // PAC enabled
 141                 return 1;
 142         if((memcmp(Block+9, "\x00\x00\x00\x00\x00\x00\x00", 7) == 0) && Block[7] == 0) // PAC disabled, can it *really* happen ?
 143                 return 1;
 144         return 0;
 145 }
 146
 147 int IsBlock1PCF7931(uint8_t *Block) {
 148         // Assume RFU means 0 :)
 149         if( Block[10] == 0 &&
 150             Block[11] == 0 &&
 151                 Block[12] == 0 &&
 152                 Block[13] == 0)
 153                  if ( (Block[14] & 0x7f) <= 9 && Block[15] <= 9)
 154                         return 1;
 155         return 0;
 156 }
 157
 158 void ReadPCF7931() {
 159         uint8_t Blocks[8][17];
 160         uint8_t tmpBlocks[4][16];
 161         int i, j, ind, ind2, n;
 162         int num_blocks = 0;
 163         int max_blocks = 8;
 164         int ident = 0;
 165         int error = 0;
 166         int tries = 0;
 167
 168         memset(Blocks, 0, 8*17*sizeof(uint8_t));
 169
 170         do {
 171                 memset(tmpBlocks, 0, 4*16*sizeof(uint8_t));
 172                 n = DemodPCF7931((uint8_t**)tmpBlocks);
 173                 if(!n)
 174                         error++;
 175                 if(error==10 && num_blocks == 0) {
 176                         Dbprintf("Error, no tag or bad tag");
 177                         return;
 178                 }
 179                 else if (tries==20 || error==10) {
 180                         Dbprintf("Error reading the tag");
 181                         Dbprintf("Here is the partial content");
 182                         goto end;
 183                 }
 184
 185                 for(i=0; i<n; i++)
 186                         Dbprintf("(dbg) %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
 187                                          tmpBlocks[i][0], tmpBlocks[i][1], tmpBlocks[i][2], tmpBlocks[i][3], tmpBlocks[i][4], tmpBlocks[i][5], tmpBlocks[i][6], tmpBlocks[i][7],
 188                                         tmpBlocks[i][8], tmpBlocks[i][9], tmpBlocks[i][10], tmpBlocks[i][11], tmpBlocks[i][12], tmpBlocks[i][13], tmpBlocks[i][14], tmpBlocks[i][15]);
 189                 if(!ident) {
 190                         for(i=0; i<n; i++) {
 191                                 if(IsBlock0PCF7931(tmpBlocks[i])) {
 192                                         // Found block 0 ?
 193                                         if(i < n-1 && IsBlock1PCF7931(tmpBlocks[i+1])) {
 194                                                 // Found block 1!
 195                                                 // \o/
 196                                                 ident = 1;
 197                                                 memcpy(Blocks[0], tmpBlocks[i], 16);
 198                                                 Blocks[0][ALLOC] = 1;
 199                                                 memcpy(Blocks[1], tmpBlocks[i+1], 16);
 200                                                 Blocks[1][ALLOC] = 1;
 201                                                 max_blocks = MAX((Blocks[1][14] & 0x7f), Blocks[1][15]) + 1;
 202                                                 // Debug print
 203                                                 Dbprintf("(dbg) Max blocks: %d", max_blocks);
 204                                                 num_blocks = 2;
 205                                                 // Handle following blocks
 206                                                 for(j=i+2, ind2=2; j!=i; j++, ind2++, num_blocks++) {
 207                                                         if(j==n) j=0;
 208                                                         if(j==i) break;
 209                                                         memcpy(Blocks[ind2], tmpBlocks[j], 16);
 210                                                         Blocks[ind2][ALLOC] = 1;
 211                                                 }
 212                                                 break;
 213                                         }
 214                                 }
 215                         }
 216                 }
 217                 else {
 218                         for(i=0; i<n; i++) { // Look for identical block in known blocks
 219                                 if(memcmp(tmpBlocks[i], "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16)) { // Block is not full of 00
 220                                         for(j=0; j<max_blocks; j++) {
 221                                                 if(Blocks[j][ALLOC] == 1 && !memcmp(tmpBlocks[i], Blocks[j], 16)) {
 222                                                         // Found an identical block
 223                                                         for(ind=i-1,ind2=j-1; ind >= 0; ind--,ind2--) {
 224                                                                 if(ind2 < 0)
 225                                                                         ind2 = max_blocks;
 226                                                                 if(!Blocks[ind2][ALLOC]) { // Block ind2 not already found
 227                                                                         // Dbprintf("Tmp %d -> Block %d", ind, ind2);
 228                                                                         memcpy(Blocks[ind2], tmpBlocks[ind], 16);
 229                                                                         Blocks[ind2][ALLOC] = 1;
 230                                                                         num_blocks++;
 231                                                                         if(num_blocks == max_blocks) goto end;
 232                                                                 }
 233                                                         }
 234                                                         for(ind=i+1,ind2=j+1; ind < n; ind++,ind2++) {
 235                                                                 if(ind2 > max_blocks)
 236                                                                         ind2 = 0;
 237                                                                 if(!Blocks[ind2][ALLOC]) { // Block ind2 not already found
 238                                                                         // Dbprintf("Tmp %d -> Block %d", ind, ind2);
 239                                                                         memcpy(Blocks[ind2], tmpBlocks[ind], 16);
 240                                                                         Blocks[ind2][ALLOC] = 1;
 241                                                                         num_blocks++;
 242                                                                         if(num_blocks == max_blocks) goto end;
 243                                                                 }
 244                                                         }
 245                                                 }
 246                                         }
 247                                 }
 248                         }
 249                 }
 250                 tries++;
 251                 if (BUTTON_PRESS()) return;
 252         } while (num_blocks != max_blocks);
 253  end:
 254         Dbprintf("-----------------------------------------");
 255         Dbprintf("Memory content:");
 256         Dbprintf("-----------------------------------------");
 257         for(i=0; i<max_blocks; i++) {
 258                 if(Blocks[i][ALLOC]==1)
 259                         Dbprintf("%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
 260                                          Blocks[i][0], Blocks[i][1], Blocks[i][2], Blocks[i][3], Blocks[i][4], Blocks[i][5], Blocks[i][6], Blocks[i][7],
 261                                         Blocks[i][8], Blocks[i][9], Blocks[i][10], Blocks[i][11], Blocks[i][12], Blocks[i][13], Blocks[i][14], Blocks[i][15]);
 262                 else
 263                         Dbprintf("<missing block %d>", i);
 264         }
 265         Dbprintf("-----------------------------------------");
 266
 267         cmd_send(CMD_ACK,0,0,0,0,0);
 268 }
 269
 270
 271 /* Write on a byte of a PCF7931 tag
 272  * @param address : address of the block to write
 273    @param byte : address of the byte to write
 274     @param data : data to write
 275  */
 276 void WritePCF7931(uint8_t pass1, uint8_t pass2, uint8_t pass3, uint8_t pass4, uint8_t pass5, uint8_t pass6, uint8_t pass7, uint16_t init_delay, int32_t l, int32_t p, uint8_t address, uint8_t byte, uint8_t data)
 277 {
 278         uint32_t tab[1024] = {0}; // data times frame
 279         uint32_t u = 0;
 280         uint8_t parity = 0;
 281         bool comp = 0;
 282
 283         //BUILD OF THE DATA FRAME
 284
 285         //alimentation of the tag (time for initializing)
 286         AddPatternPCF7931(init_delay, 0, 8192/2*T0_PCF, tab);
 287
 288         //PMC
 289         Dbprintf("Initialization delay : %d us", init_delay);
 290         AddPatternPCF7931(8192/2*T0_PCF + 319*T0_PCF+70, 3*T0_PCF, 29*T0_PCF, tab);
 291
 292         Dbprintf("Offsets : %d us on the low pulses width, %d us on the low pulses positions", l, p);
 293
 294         //password indication bit
 295         AddBitPCF7931(1, tab, l, p);
 296
 297         //password (on 56 bits)
 298         Dbprintf("Password (LSB first on each byte) : %02x %02x %02x %02x %02x %02x %02x", pass1,pass2,pass3,pass4,pass5,pass6,pass7);
 299         AddBytePCF7931(pass1, tab, l, p);
 300         AddBytePCF7931(pass2, tab, l, p);
 301         AddBytePCF7931(pass3, tab, l, p);
 302         AddBytePCF7931(pass4, tab, l, p);
 303         AddBytePCF7931(pass5, tab, l, p);
 304         AddBytePCF7931(pass6, tab, l, p);
 305         AddBytePCF7931(pass7, tab, l, p);
 306
 307
 308         //programming mode (0 or 1)
 309         AddBitPCF7931(0, tab, l, p);
 310
 311         //block adress on 6 bits
 312         Dbprintf("Block address : %02x", address);
 313         for (u=0; u<6; u++)
 314         {
 315                 if (address&(1<<u)) {   // bit 1
 316                          parity++;
 317                          AddBitPCF7931(1, tab, l, p);
 318                 } else{                                 // bit 0
 319                          AddBitPCF7931(0, tab, l, p);
 320                 }
 321         }
 322
 323         //byte address on 4 bits
 324         Dbprintf("Byte address : %02x", byte);
 325         for (u=0; u<4; u++)
 326         {
 327                 if (byte&(1<<u)) {      // bit 1
 328                          parity++;
 329                          AddBitPCF7931(1, tab, l, p);
 330                 } else{                         // bit 0
 331                          AddBitPCF7931(0, tab, l, p);
 332                 }
 333         }
 334
 335         //data on 8 bits
 336         Dbprintf("Data : %02x", data);
 337         for (u=0; u<8; u++)
 338         {
 339                 if (data&(1<<u)) {      // bit 1
 340                          parity++;
 341                          AddBitPCF7931(1, tab, l, p);
 342                 } else{                         //bit 0
 343                          AddBitPCF7931(0, tab, l, p);
 344                 }
 345         }
 346
 347
 348         //parity bit
 349         if((parity%2)==0){
 350                 AddBitPCF7931(0, tab, l, p); //even parity
 351         }else{
 352                 AddBitPCF7931(1, tab, l, p);//odd parity
 353         }
 354
 355         //time access memory
 356         AddPatternPCF7931(5120+2680, 0, 0, tab);
 357
 358         //conversion of the scale time
 359         for(u=0;u<500;u++){
 360                 tab[u]=(tab[u] * 3)/2;
 361         }
 362
 363         //compensation of the counter reload
 364         while (!comp){
 365                 comp = 1;
 366                 for(u=0;tab[u]!=0;u++){
 367                         if(tab[u] > 0xFFFF){
 368                           tab[u] -= 0xFFFF;
 369                           comp = 0;
 370                         }
 371                 }
 372         }
 373
 374         SendCmdPCF7931(tab);
 375 }
 376
 377
 378
 379 /* Send a trame to a PCF7931 tags
 380  * @param tab : array of the data frame
 381  */
 382
 383 void SendCmdPCF7931(uint32_t * tab){
 384         uint16_t u=0, tempo=0;
 385
 386         Dbprintf("Sending data frame...");
 387
 388         FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
 389
 390         FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
 391
 392         FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU );
 393
 394         LED_A_ON();
 395
 396         // steal this pin from the SSP and use it to control the modulation
 397         AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
 398         AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
 399
 400         //initialization of the timer
 401         AT91C_BASE_PMC->PMC_PCER |= (0x1 << AT91C_ID_TC0);
 402         AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_NONE | AT91C_TCB_TC1XC1S_TIOA0 | AT91C_TCB_TC2XC2S_NONE;
 403         AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; // timer disable
 404         AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK;  //clock at 48/32 MHz
 405         AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN;
 406         AT91C_BASE_TCB->TCB_BCR = 1;
 407
 408
 409         tempo = AT91C_BASE_TC0->TC_CV;
 410         for( u = 0; tab[u] != 0; u += 3){
 411
 412                 // modulate antenna
 413                 HIGH(GPIO_SSC_DOUT);
 414                 while(tempo != tab[u]) tempo = AT91C_BASE_TC0->TC_CV;
 415
 416                 // stop modulating antenna
 417                 LOW(GPIO_SSC_DOUT);
 418                 while(tempo != tab[u+1]) tempo = AT91C_BASE_TC0->TC_CV;
 419
 420                 // modulate antenna
 421                 HIGH(GPIO_SSC_DOUT);
 422                 while(tempo != tab[u+2]) tempo = AT91C_BASE_TC0->TC_CV;
 423         }
 424
 425         LED_A_OFF();
 426         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 427         SpinDelay(200);
 428
 429         AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; // timer disable
 430         LED(0xFFFF, 1000);
 431 }
 432
 433
 434 /* Add a byte for building the data frame of PCF7931 tags
 435  * @param b : byte to add
 436  * @param tab : array of the data frame
 437  * @param l : offset on low pulse width
 438  * @param p : offset on low pulse positioning
 439  */
 440
 441 bool AddBytePCF7931(uint8_t byte, uint32_t * tab, int32_t l, int32_t p){
 442
 443         uint32_t u;
 444         for ( u=0; u<8; u++)
 445         {
 446                 if (byte&(1<<u)) {      //bit à 1
 447                         if( AddBitPCF7931(1, tab, l, p)==1) return 1;
 448                 } else { //bit à 0
 449                         if (AddBitPCF7931(0, tab, l, p)==1) return 1;
 450                 }
 451         }
 452         return 0;
 453 }
 454
 455 /* Add a bits for building the data frame of PCF7931 tags
 456  * @param b : bit to add
 457  * @param tab : array of the data frame
 458  * @param l : offset on low pulse width
 459  * @param p : offset on low pulse positioning
 460  */
 461 bool AddBitPCF7931(bool b, uint32_t * tab, int32_t l, int32_t p){
 462         uint8_t u = 0;
 463
 464         //we put the cursor at the last value of the array
 465         for ( u = 0; tab[u] != 0; u += 3 ) { }
 466
 467         if ( b == 1 ) { //add a bit 1
 468                 if ( u == 0 )
 469                         tab[u] = 34 * T0_PCF + p;
 470                 else
 471                         tab[u] = 34 * T0_PCF + tab[u-1] + p;
 472
 473                 tab[u+1] =  6 * T0_PCF + tab[u] + l;
 474                 tab[u+2] = 88 * T0_PCF + tab[u+1] - l - p;
 475                 return 0;
 476         } else {                //add a bit 0
 477
 478                 if ( u == 0 )
 479                         tab[u] = 98 * T0_PCF + p;
 480                 else
 481                         tab[u] = 98 * T0_PCF + tab[u-1] + p;
 482
 483                 tab[u+1] =  6 * T0_PCF + tab[u] + l;
 484                 tab[u+2] = 24 * T0_PCF + tab[u+1] - l - p;
 485                 return 0;
 486         }
 487         return 1;
 488 }
 489
 490 /* Add a custom pattern in the data frame
 491  * @param a : delay of the first high pulse
 492  * @param b : delay of the low pulse
 493  * @param c : delay of the last high pulse
 494  * @param tab : array of the data frame
 495  */
 496 bool AddPatternPCF7931(uint32_t a, uint32_t b, uint32_t c, uint32_t * tab){
 497         uint32_t u = 0;
 498         for(u = 0; tab[u] != 0; u += 3){} //we put the cursor at the last value of the array
 499
 500         tab[u]   = (u == 0) ? a : a + tab[u-1];
 501         tab[u+1] = b + tab[u];
 502         tab[u+2] = c + tab[u+1];
 503
 504         return 0;
 505 }