git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/legicrf.c

   1 //-----------------------------------------------------------------------------
   2 // (c) 2009 Henryk Plötz <henryk@ploetzli.ch>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // LEGIC RF simulation code
   9 //-----------------------------------------------------------------------------
  10
  11 #include "proxmark3.h"
  12 #include "apps.h"
  13 #include "util.h"
  14 #include "string.h"
  15
  16 #include "legicrf.h"
  17 #include "legic_prng.h"
  18 #include "crc.h"
  19
  20 static struct legic_frame {
  21         int bits;
  22         uint32_t data;
  23 } current_frame;
  24
  25 static enum {
  26   STATE_DISCON,
  27   STATE_IV,
  28   STATE_CON,
  29 } legic_state;
  30
  31 static crc_t    legic_crc;
  32 static int      legic_read_count;
  33 static uint32_t legic_prng_bc;
  34 static uint32_t legic_prng_iv;
  35
  36 static int      legic_phase_drift;
  37 static int      legic_frame_drift;
  38 static int      legic_reqresp_drift;
  39
  40 AT91PS_TC timer;
  41 AT91PS_TC prng_timer;
  42
  43 static void setup_timer(void)
  44 {
  45         /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging
  46          * this it won't be terribly accurate but should be good enough.
  47          */
  48         AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1);
  49         timer = AT91C_BASE_TC1;
  50         timer->TC_CCR = AT91C_TC_CLKDIS;
  51         timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK;
  52         timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
  53
  54         /*
  55      * Set up Timer 2 to use for measuring time between frames in
  56      * tag simulation mode. Runs 4x faster as Timer 1
  57          */
  58     AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC2);
  59     prng_timer = AT91C_BASE_TC2;
  60     prng_timer->TC_CCR = AT91C_TC_CLKDIS;
  61         prng_timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV2_CLOCK;
  62     prng_timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
  63 }
  64
  65 /* At TIMER_CLOCK3 (MCK/32) */
  66 #define RWD_TIME_1 150     /* RWD_TIME_PAUSE off, 80us on = 100us */
  67 #define RWD_TIME_0 90      /* RWD_TIME_PAUSE off, 40us on = 60us */
  68 #define RWD_TIME_PAUSE 30  /* 20us */
  69 #define RWD_TIME_FUZZ 20   /* rather generous 13us, since the peak detector + hysteresis fuzz quite a bit */
  70 #define TAG_TIME_BIT 150   /* 100us for every bit */
  71 #define TAG_TIME_WAIT 490  /* time from RWD frame end to tag frame start, experimentally determined */
  72
  73 #define SIM_DIVISOR  586   /* prng_time/SIM_DIVISOR count prng needs to be forwared */
  74 #define SIM_SHIFT    900   /* prng_time+SIM_SHIFT shift of delayed start */
  75
  76 #define SESSION_IV 0x55
  77 #define OFFSET_LOG 1024
  78
  79 #define FUZZ_EQUAL(value, target, fuzz) ((value) > ((target)-(fuzz)) && (value) < ((target)+(fuzz)))
  80
  81 /* Generate Keystream */
  82 static uint32_t get_key_stream(int skip, int count)
  83 {
  84         uint32_t key=0; int i;
  85
  86         /* Use int to enlarge timer tc to 32bit */
  87         legic_prng_bc += prng_timer->TC_CV;
  88         prng_timer->TC_CCR = AT91C_TC_SWTRG;
  89
  90         /* If skip == -1, forward prng time based */
  91         if(skip == -1) {
  92                 i  = (legic_prng_bc+SIM_SHIFT)/SIM_DIVISOR; /* Calculate Cycles based on timer */
  93                 i -= legic_prng_count(); /* substract cycles of finished frames */
  94                 i -= count; /* substract current frame length, rewidn to bedinning */
  95                 legic_prng_forward(i);
  96         } else {
  97                 legic_prng_forward(skip);
  98         }
  99
 100         /* Write Time Data into LOG */
 101         uint8_t *BigBuf = BigBuf_get_addr();
 102         i = (count == 6) ? -1 : legic_read_count;
 103
 104         BigBuf[OFFSET_LOG+128+i] = legic_prng_count();
 105         BigBuf[OFFSET_LOG+256+i*4]   = (legic_prng_bc >> 0) & 0xff;
 106         BigBuf[OFFSET_LOG+256+i*4+1] = (legic_prng_bc >> 8) & 0xff;
 107         BigBuf[OFFSET_LOG+256+i*4+2] = (legic_prng_bc >>16) & 0xff;
 108         BigBuf[OFFSET_LOG+256+i*4+3] = (legic_prng_bc >>24) & 0xff;
 109         BigBuf[OFFSET_LOG+384+i] = count;
 110
 111         /* Generate KeyStream */
 112         for(i=0; i<count; i++) {
 113                 key |= legic_prng_get_bit() << i;
 114                 legic_prng_forward(1);
 115         }
 116         return key;
 117 }
 118
 119 /* Send a frame in tag mode, the FPGA must have been set up by
 120  * LegicRfSimulate
 121  */
 122 static void frame_send_tag(uint16_t response, int bits, int crypt)
 123 {
 124    /* Bitbang the response */
 125    AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 126    AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
 127    AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
 128
 129    /* Use time to crypt frame */
 130    if(crypt) {
 131       legic_prng_forward(2); /* TAG_TIME_WAIT -> shift by 2 */
 132       int i; int key = 0;
 133       for(i=0; i<bits; i++) {
 134          key |= legic_prng_get_bit() << i;
 135          legic_prng_forward(1);
 136       }
 137       //Dbprintf("key = 0x%x", key);
 138       response = response ^ key;
 139    }
 140
 141    /* Wait for the frame start */
 142    while(timer->TC_CV < (TAG_TIME_WAIT - 30)) ;
 143
 144    int i;
 145    for(i=0; i<bits; i++) {
 146       int nextbit = timer->TC_CV + TAG_TIME_BIT;
 147       int bit = response & 1;
 148       response = response >> 1;
 149       if(bit)
 150          AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 151       else
 152          AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 153
 154       while(timer->TC_CV < nextbit) ;
 155    }
 156    AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 157 }
 158
 159 /* Send a frame in reader mode, the FPGA must have been set up by
 160  * LegicRfReader
 161  */
 162 static void frame_send_rwd(uint32_t data, int bits)
 163 {
 164         /* Start clock */
 165         timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
 166         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 167
 168         int i;
 169         for(i=0; i<bits; i++) {
 170                 int starttime = timer->TC_CV;
 171                 int pause_end = starttime + RWD_TIME_PAUSE, bit_end;
 172                 int bit = data & 1;
 173                 data = data >> 1;
 174
 175                 if(bit ^ legic_prng_get_bit())
 176                         bit_end = starttime + RWD_TIME_1;
 177                 else
 178                         bit_end = starttime + RWD_TIME_0;
 179
 180
 181                 /* RWD_TIME_PAUSE time off, then some time on, so that the complete bit time is
 182                  * RWD_TIME_x, where x is the bit to be transmitted */
 183                 AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 184                 while(timer->TC_CV < pause_end) ;
 185                 AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 186                 legic_prng_forward(1); /* bit duration is longest. use this time to forward the lfsr */
 187
 188                 while(timer->TC_CV < bit_end);
 189         }
 190
 191         /* One final pause to mark the end of the frame */
 192         int pause_end = timer->TC_CV + RWD_TIME_PAUSE;
 193         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 194         while(timer->TC_CV < pause_end) ;
 195         AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 196
 197
 198         /* Reset the timer, to measure time until the start of the tag frame */
 199         timer->TC_CCR = AT91C_TC_SWTRG;
 200         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 201 }
 202
 203 /* Receive a frame from the card in reader emulation mode, the FPGA and
 204  * timer must have been set up by LegicRfReader and frame_send_rwd.
 205  *
 206  * The LEGIC RF protocol from card to reader does not include explicit
 207  * frame start/stop information or length information. The reader must
 208  * know beforehand how many bits it wants to receive. (Notably: a card
 209  * sending a stream of 0-bits is indistinguishable from no card present.)
 210  *
 211  * Receive methodology: There is a fancy correlator in hi_read_rx_xcorr, but
 212  * I'm not smart enough to use it. Instead I have patched hi_read_tx to output
 213  * the ADC signal with hysteresis on SSP_DIN. Bit-bang that signal and look
 214  * for edges. Count the edges in each bit interval. If they are approximately
 215  * 0 this was a 0-bit, if they are approximately equal to the number of edges
 216  * expected for a 212kHz subcarrier, this was a 1-bit. For timing we use the
 217  * timer that's still running from frame_send_rwd in order to get a synchronization
 218  * with the frame that we just sent.
 219  *
 220  * FIXME: Because we're relying on the hysteresis to just do the right thing
 221  * the range is severely reduced (and you'll probably also need a good antenna).
 222  * So this should be fixed some time in the future for a proper receiver.
 223  */
 224 static void frame_receive_rwd(struct legic_frame * const f, int bits, int crypt)
 225 {
 226         uint32_t the_bit = 1;  /* Use a bitmask to save on shifts */
 227         uint32_t data=0;
 228         int i, old_level=0, edges=0;
 229         int next_bit_at = TAG_TIME_WAIT;
 230
 231         if(bits > 32) {
 232                 bits = 32;
 233     }
 234
 235         AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
 236         AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
 237
 238         /* we have some time now, precompute the cipher
 239      * since we cannot compute it on the fly while reading */
 240         legic_prng_forward(2);
 241
 242         if(crypt) {
 243                 for(i=0; i<bits; i++) {
 244                         data |= legic_prng_get_bit() << i;
 245                         legic_prng_forward(1);
 246                 }
 247         }
 248
 249         while(timer->TC_CV < next_bit_at) ;
 250
 251         next_bit_at += TAG_TIME_BIT;
 252
 253         for(i=0; i<bits; i++) {
 254                 edges = 0;
 255                 while(timer->TC_CV < next_bit_at) {
 256                         int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
 257                         if(level != old_level)
 258                                 edges++;
 259                         old_level = level;
 260                 }
 261                 next_bit_at += TAG_TIME_BIT;
 262
 263                 if(edges > 20 && edges < 60) { /* expected are 42 edges */
 264                         data ^= the_bit;
 265                 }
 266                 the_bit <<= 1;
 267         }
 268
 269         f->data = data;
 270         f->bits = bits;
 271
 272         /* Reset the timer, to synchronize the next frame */
 273         timer->TC_CCR = AT91C_TC_SWTRG;
 274         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 275 }
 276
 277 static void frame_append_bit(struct legic_frame * const f, int bit)
 278 {
 279    if(f->bits >= 31)
 280        return; /* Overflow, won't happen */
 281
 282    f->data |= (bit<<f->bits);
 283    f->bits++;
 284 }
 285
 286 static void frame_clean(struct legic_frame * const f)
 287 {
 288         f->data = 0;
 289         f->bits = 0;
 290 }
 291
 292 static uint32_t perform_setup_phase_rwd(int iv)
 293 {
 294
 295         /* Switch on carrier and let the tag charge for 1ms */
 296         AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 297         SpinDelay(1);
 298
 299         legic_prng_init(0); /* no keystream yet */
 300         frame_send_rwd(iv, 7);
 301         legic_prng_init(iv);
 302
 303         frame_clean(&current_frame);
 304         frame_receive_rwd(&current_frame, 6, 1);
 305         legic_prng_forward(1); /* we wait anyways */
 306         while(timer->TC_CV < 387) ; /* ~ 258us */
 307         frame_send_rwd(0x19, 6);
 308
 309         return current_frame.data;
 310 }
 311
 312 static void LegicCommonInit(void) {
 313         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 314         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 315         FpgaSetupSsc();
 316         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
 317
 318         /* Bitbang the transmitter */
 319         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 320         AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
 321         AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
 322
 323         setup_timer();
 324
 325         crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0);
 326 }
 327
 328 static void switch_off_tag_rwd(void)
 329 {
 330         /* Switch off carrier, make sure tag is reset */
 331         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 332         SpinDelay(10);
 333
 334         WDT_HIT();
 335 }
 336 /* calculate crc for a legic command */
 337 static int LegicCRC(int byte_index, int value, int cmd_sz) {
 338         crc_clear(&legic_crc);
 339         crc_update(&legic_crc, 1, 1); /* CMD_READ */
 340         crc_update(&legic_crc, byte_index, cmd_sz-1);
 341         crc_update(&legic_crc, value, 8);
 342         return crc_finish(&legic_crc);
 343 }
 344
 345 int legic_read_byte(int byte_index, int cmd_sz) {
 346         int byte;
 347
 348         legic_prng_forward(4); /* we wait anyways */
 349         while(timer->TC_CV < 387) ; /* ~ 258us + 100us*delay */
 350
 351         frame_send_rwd(1 | (byte_index << 1), cmd_sz);
 352         frame_clean(&current_frame);
 353
 354         frame_receive_rwd(&current_frame, 12, 1);
 355
 356         byte = current_frame.data & 0xff;
 357         if( LegicCRC(byte_index, byte, cmd_sz) != (current_frame.data >> 8) ) {
 358                 Dbprintf("!!! crc mismatch: expected %x but got %x !!!",
 359            LegicCRC(byte_index, current_frame.data & 0xff, cmd_sz), current_frame.data >> 8);
 360                 return -1;
 361         }
 362
 363         return byte;
 364 }
 365
 366 /* legic_write_byte() is not included, however it's trivial to implement
 367  * and here are some hints on what remains to be done:
 368  *
 369  *  * assemble a write_cmd_frame with crc and send it
 370  *  * wait until the tag sends back an ACK ('1' bit unencrypted)
 371  *  * forward the prng based on the timing
 372  */
 373 int legic_write_byte(int byte, int addr, int addr_sz) {
 374     //do not write UID, CRC, DCF
 375     if(addr <= 0x06) {
 376                 return 0;
 377         }
 378
 379         //== send write command ==============================
 380         crc_clear(&legic_crc);
 381         crc_update(&legic_crc, 0, 1); /* CMD_WRITE */
 382         crc_update(&legic_crc, addr, addr_sz);
 383         crc_update(&legic_crc, byte, 8);
 384
 385         uint32_t crc = crc_finish(&legic_crc);
 386         uint32_t cmd = ((crc     <<(addr_sz+1+8)) //CRC
 387                    |(byte    <<(addr_sz+1))   //Data
 388                    |(addr    <<1)             //Address
 389                    |(0x00    <<0));           //CMD = W
 390     uint32_t cmd_sz = addr_sz+1+8+4;          //crc+data+cmd
 391
 392     legic_prng_forward(2); /* we wait anyways */
 393     while(timer->TC_CV < 387) ; /* ~ 258us */
 394         frame_send_rwd(cmd, cmd_sz);
 395
 396         //== wait for ack ====================================
 397     int t, old_level=0, edges=0;
 398     int next_bit_at =0;
 399         while(timer->TC_CV < 387) ; /* ~ 258us */
 400     for(t=0; t<80; t++) {
 401         edges = 0;
 402                 next_bit_at += TAG_TIME_BIT;
 403         while(timer->TC_CV < next_bit_at) {
 404             int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
 405             if(level != old_level) {
 406                 edges++;
 407                         }
 408             old_level = level;
 409         }
 410         if(edges > 20 && edges < 60) { /* expected are 42 edges */
 411                         int t = timer->TC_CV;
 412                         int c = t/TAG_TIME_BIT;
 413                         timer->TC_CCR = AT91C_TC_SWTRG;
 414                         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 415                         legic_prng_forward(c);
 416                 return 0;
 417         }
 418     }
 419     timer->TC_CCR = AT91C_TC_SWTRG;
 420     while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 421         return -1;
 422 }
 423
 424 int LegicRfReader(int offset, int bytes) {
 425         int byte_index=0, cmd_sz=0, card_sz=0;
 426
 427         LegicCommonInit();
 428
 429         uint8_t *BigBuf = BigBuf_get_addr();
 430         memset(BigBuf, 0, 1024);
 431
 432         DbpString("setting up legic card");
 433         uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV);
 434         switch_off_tag_rwd(); //we lose to mutch time with dprintf
 435         switch(tag_type) {
 436                 case 0x1d:
 437                         DbpString("MIM 256 card found, reading card ...");
 438             cmd_sz = 9;
 439                         card_sz = 256;
 440                         break;
 441                 case 0x3d:
 442                         DbpString("MIM 1024 card found, reading card ...");
 443             cmd_sz = 11;
 444                         card_sz = 1024;
 445                         break;
 446                 default:
 447                         Dbprintf("Unknown card format: %x",tag_type);
 448                         return -1;
 449         }
 450         if(bytes == -1)
 451                 bytes = card_sz;
 452
 453         if(bytes+offset >= card_sz)
 454                 bytes = card_sz-offset;
 455
 456         perform_setup_phase_rwd(SESSION_IV);
 457
 458         LED_B_ON();
 459         while(byte_index < bytes) {
 460                 int r = legic_read_byte(byte_index+offset, cmd_sz);
 461                 if(r == -1 ||BUTTON_PRESS()) {
 462                 DbpString("operation aborted");
 463                         switch_off_tag_rwd();
 464                 LED_B_OFF();
 465                 LED_C_OFF();
 466                 return -1;
 467                 }
 468                 BigBuf[byte_index] = r;
 469         WDT_HIT();
 470                 byte_index++;
 471                 if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF();
 472         }
 473         LED_B_OFF();
 474     LED_C_OFF();
 475         switch_off_tag_rwd();
 476         Dbprintf("Card read, use 'hf legic decode' or");
 477     Dbprintf("'data hexsamples %d' to view results", (bytes+7) & ~7);
 478     return 0;
 479 }
 480
 481 void LegicRfWriter(int bytes, int offset) {
 482         int byte_index=0, addr_sz=0;
 483         uint8_t *BigBuf = BigBuf_get_addr();
 484
 485         LegicCommonInit();
 486
 487         DbpString("setting up legic card");
 488         uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV);
 489         switch_off_tag_rwd();
 490         switch(tag_type) {
 491                 case 0x1d:
 492                         if(offset+bytes > 0x100) {
 493                                 Dbprintf("Error: can not write to 0x%03.3x on MIM 256", offset+bytes);
 494                                 return;
 495                         }
 496                         addr_sz = 8;
 497                         Dbprintf("MIM 256 card found, writing 0x%02.2x - 0x%02.2x ...", offset, offset+bytes);
 498                         break;
 499                 case 0x3d:
 500                         if(offset+bytes > 0x400) {
 501                         Dbprintf("Error: can not write to 0x%03.3x on MIM 1024", offset+bytes);
 502                         return;
 503                 }
 504                         addr_sz = 10;
 505                         Dbprintf("MIM 1024 card found, writing 0x%03.3x - 0x%03.3x ...", offset, offset+bytes);
 506                         break;
 507                 default:
 508                         Dbprintf("No or unknown card found, aborting");
 509             return;
 510         }
 511
 512     LED_B_ON();
 513         perform_setup_phase_rwd(SESSION_IV);
 514     legic_prng_forward(2);
 515         while(byte_index < bytes) {
 516                 int r = legic_write_byte(BigBuf[byte_index+offset], byte_index+offset, addr_sz);
 517                 if((r != 0) || BUTTON_PRESS()) {
 518                         Dbprintf("operation aborted @ 0x%03.3x", byte_index);
 519                         switch_off_tag_rwd();
 520                         LED_B_OFF();
 521                         LED_C_OFF();
 522                         return;
 523                 }
 524         WDT_HIT();
 525                 byte_index++;
 526         if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF();
 527         }
 528     LED_B_OFF();
 529     LED_C_OFF();
 530     DbpString("write successful");
 531 }
 532
 533 int timestamp;
 534
 535 /* Handle (whether to respond) a frame in tag mode */
 536 static void frame_handle_tag(struct legic_frame const * const f)
 537 {
 538         uint8_t *BigBuf = BigBuf_get_addr();
 539
 540    /* First Part of Handshake (IV) */
 541    if(f->bits == 7) {
 542      if(f->data == SESSION_IV) {
 543         LED_C_ON();
 544         prng_timer->TC_CCR = AT91C_TC_SWTRG;
 545         legic_prng_init(f->data);
 546         frame_send_tag(0x3d, 6, 1); /* 0x3d^0x26 = 0x1b */
 547         legic_state = STATE_IV;
 548         legic_read_count = 0;
 549         legic_prng_bc = 0;
 550         legic_prng_iv = f->data;
 551
 552         /* TIMEOUT */
 553         timer->TC_CCR = AT91C_TC_SWTRG;
 554         while(timer->TC_CV > 1);
 555         while(timer->TC_CV < 280);
 556         return;
 557       } else if((prng_timer->TC_CV % 50) > 40) {
 558         legic_prng_init(f->data);
 559         frame_send_tag(0x3d, 6, 1);
 560         SpinDelay(20);
 561         return;
 562      }
 563    }
 564
 565    /* 0x19==??? */
 566    if(legic_state == STATE_IV) {
 567       if((f->bits == 6) && (f->data == (0x19 ^ get_key_stream(1, 6)))) {
 568          legic_state = STATE_CON;
 569
 570          /* TIMEOUT */
 571          timer->TC_CCR = AT91C_TC_SWTRG;
 572          while(timer->TC_CV > 1);
 573          while(timer->TC_CV < 200);
 574          return;
 575       } else {
 576          legic_state = STATE_DISCON;
 577          LED_C_OFF();
 578          Dbprintf("0x19 - Frame: %03.3x", f->data);
 579          return;
 580       }
 581    }
 582
 583    /* Read */
 584    if(f->bits == 11) {
 585       if(legic_state == STATE_CON) {
 586          int key   = get_key_stream(-1, 11); //legic_phase_drift, 11);
 587          int addr  = f->data ^ key; addr = addr >> 1;
 588          int data = BigBuf[addr];
 589          int hash = LegicCRC(addr, data, 11) << 8;
 590          BigBuf[OFFSET_LOG+legic_read_count] = (uint8_t)addr;
 591          legic_read_count++;
 592
 593          //Dbprintf("Data:%03.3x, key:%03.3x, addr: %03.3x, read_c:%u", f->data, key, addr, read_c);
 594          legic_prng_forward(legic_reqresp_drift);
 595
 596          frame_send_tag(hash | data, 12, 1);
 597
 598          /* SHORT TIMEOUT */
 599          timer->TC_CCR = AT91C_TC_SWTRG;
 600          while(timer->TC_CV > 1);
 601          legic_prng_forward(legic_frame_drift);
 602          while(timer->TC_CV < 180);
 603          return;
 604       }
 605    }
 606
 607    /* Write */
 608    if(f->bits == 23) {
 609       int key   = get_key_stream(-1, 23); //legic_frame_drift, 23);
 610       int addr  = f->data ^ key; addr = addr >> 1; addr = addr & 0x3ff;
 611       int data  = f->data ^ key; data = data >> 11; data = data & 0xff;
 612
 613       /* write command */
 614       legic_state = STATE_DISCON;
 615       LED_C_OFF();
 616       Dbprintf("write - addr: %x, data: %x", addr, data);
 617       return;
 618    }
 619
 620    if(legic_state != STATE_DISCON) {
 621       Dbprintf("Unexpected: sz:%u, Data:%03.3x, State:%u, Count:%u", f->bits, f->data, legic_state, legic_read_count);
 622       int i;
 623       Dbprintf("IV: %03.3x", legic_prng_iv);
 624       for(i = 0; i<legic_read_count; i++) {
 625          Dbprintf("Read Nb: %u, Addr: %u", i, BigBuf[OFFSET_LOG+i]);
 626       }
 627
 628       for(i = -1; i<legic_read_count; i++) {
 629          uint32_t t;
 630          t  = BigBuf[OFFSET_LOG+256+i*4];
 631          t |= BigBuf[OFFSET_LOG+256+i*4+1] << 8;
 632          t |= BigBuf[OFFSET_LOG+256+i*4+2] <<16;
 633          t |= BigBuf[OFFSET_LOG+256+i*4+3] <<24;
 634
 635          Dbprintf("Cycles: %u, Frame Length: %u, Time: %u",
 636             BigBuf[OFFSET_LOG+128+i],
 637             BigBuf[OFFSET_LOG+384+i],
 638             t);
 639       }
 640    }
 641    legic_state = STATE_DISCON;
 642    legic_read_count = 0;
 643    SpinDelay(10);
 644    LED_C_OFF();
 645    return;
 646 }
 647
 648 /* Read bit by bit untill full frame is received
 649  * Call to process frame end answer
 650  */
 651 static void emit(int bit)
 652 {
 653   if(bit == -1) {
 654      if(current_frame.bits <= 4) {
 655         frame_clean(&current_frame);
 656      } else {
 657         frame_handle_tag(&current_frame);
 658         frame_clean(&current_frame);
 659      }
 660      WDT_HIT();
 661   } else if(bit == 0) {
 662     frame_append_bit(&current_frame, 0);
 663   } else if(bit == 1) {
 664     frame_append_bit(&current_frame, 1);
 665   }
 666 }
 667
 668 void LegicRfSimulate(int phase, int frame, int reqresp)
 669 {
 670   /* ADC path high-frequency peak detector, FPGA in high-frequency simulator mode,
 671    * modulation mode set to 212kHz subcarrier. We are getting the incoming raw
 672    * envelope waveform on DIN and should send our response on DOUT.
 673    *
 674    * The LEGIC RF protocol is pulse-pause-encoding from reader to card, so we'll
 675    * measure the time between two rising edges on DIN, and no encoding on the
 676    * subcarrier from card to reader, so we'll just shift out our verbatim data
 677    * on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear,
 678    * seems to be 300us-ish.
 679    */
 680
 681    if(phase < 0) {
 682       int i;
 683       for(i=0; i<=reqresp; i++) {
 684          legic_prng_init(SESSION_IV);
 685          Dbprintf("i=%u, key 0x%3.3x", i, get_key_stream(i, frame));
 686       }
 687       return;
 688    }
 689
 690    legic_phase_drift = phase;
 691    legic_frame_drift = frame;
 692    legic_reqresp_drift = reqresp;
 693
 694    FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 695    SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 696    FpgaSetupSsc();
 697    FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_212K);
 698
 699    /* Bitbang the receiver */
 700    AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
 701    AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
 702
 703    setup_timer();
 704    crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0);
 705
 706    int old_level = 0;
 707    int active = 0;
 708    legic_state = STATE_DISCON;
 709
 710    LED_B_ON();
 711    DbpString("Starting Legic emulator, press button to end");
 712    while(!BUTTON_PRESS() && !usb_poll_validate_length()) {
 713       int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
 714       int time = timer->TC_CV;
 715
 716       if(level != old_level) {
 717          if(level == 1) {
 718             timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
 719             if(FUZZ_EQUAL(time, RWD_TIME_1, RWD_TIME_FUZZ)) {
 720                /* 1 bit */
 721                emit(1);
 722                active = 1;
 723                LED_A_ON();
 724             } else if(FUZZ_EQUAL(time, RWD_TIME_0, RWD_TIME_FUZZ)) {
 725                /* 0 bit */
 726                emit(0);
 727                active = 1;
 728                LED_A_ON();
 729             } else if(active) {
 730                /* invalid */
 731                emit(-1);
 732                active = 0;
 733                LED_A_OFF();
 734             }
 735          }
 736       }
 737
 738       if(time >= (RWD_TIME_1+RWD_TIME_FUZZ) && active) {
 739          /* Frame end */
 740          emit(-1);
 741          active = 0;
 742          LED_A_OFF();
 743       }
 744
 745       if(time >= (20*RWD_TIME_1) && (timer->TC_SR & AT91C_TC_CLKSTA)) {
 746          timer->TC_CCR = AT91C_TC_CLKDIS;
 747       }
 748
 749       old_level = level;
 750       WDT_HIT();
 751    }
 752    DbpString("Stopped");
 753    LED_B_OFF();
 754    LED_A_OFF();
 755    LED_C_OFF();
 756 }
 757