git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/legicrf.c

   1 //-----------------------------------------------------------------------------
   2 // (c) 2009 Henryk Plötz <henryk@ploetzli.ch>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // LEGIC RF simulation code
   9 //-----------------------------------------------------------------------------
  10
  11 #include "proxmark3.h"
  12 #include "apps.h"
  13 #include "util.h"
  14 #include "string.h"
  15
  16 #include "legicrf.h"
  17 #include "legic_prng.h"
  18 #include "crc.h"
  19
  20 static struct legic_frame {
  21         int bits;
  22         uint32_t data;
  23 } current_frame;
  24
  25 static enum {
  26   STATE_DISCON,
  27   STATE_IV,
  28   STATE_CON,
  29 } legic_state;
  30
  31 static crc_t    legic_crc;
  32 static int      legic_read_count;
  33 static uint32_t legic_prng_bc;
  34 static uint32_t legic_prng_iv;
  35
  36 static int      legic_phase_drift;
  37 static int      legic_frame_drift;
  38 static int      legic_reqresp_drift;
  39
  40 AT91PS_TC timer;
  41 AT91PS_TC prng_timer;
  42
  43 static void setup_timer(void)
  44 {
  45         /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging
  46          * this it won't be terribly accurate but should be good enough.
  47          */
  48         AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1);
  49         timer = AT91C_BASE_TC1;
  50         timer->TC_CCR = AT91C_TC_CLKDIS;
  51         timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK;
  52         timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
  53
  54         /*
  55      * Set up Timer 2 to use for measuring time between frames in
  56      * tag simulation mode. Runs 4x faster as Timer 1
  57          */
  58     AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC2);
  59     prng_timer = AT91C_BASE_TC2;
  60     prng_timer->TC_CCR = AT91C_TC_CLKDIS;
  61         prng_timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV2_CLOCK;
  62     prng_timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
  63 }
  64
  65 /* At TIMER_CLOCK3 (MCK/32) */
  66 #define RWD_TIME_1 150     /* RWD_TIME_PAUSE off, 80us on = 100us */
  67 #define RWD_TIME_0 90      /* RWD_TIME_PAUSE off, 40us on = 60us */
  68 #define RWD_TIME_PAUSE 30  /* 20us */
  69 #define RWD_TIME_FUZZ 20   /* rather generous 13us, since the peak detector + hysteresis fuzz quite a bit */
  70 #define TAG_TIME_BIT 150   /* 100us for every bit */
  71 #define TAG_TIME_WAIT 490  /* time from RWD frame end to tag frame start, experimentally determined */
  72
  73 #define SIM_DIVISOR  586   /* prng_time/SIM_DIVISOR count prng needs to be forwared */
  74 #define SIM_SHIFT    900   /* prng_time+SIM_SHIFT shift of delayed start */
  75
  76 #define SESSION_IV 0x55
  77 #define OFFSET_LOG 1024
  78
  79 #define FUZZ_EQUAL(value, target, fuzz) ((value) > ((target)-(fuzz)) && (value) < ((target)+(fuzz)))
  80
  81 /* Generate Keystream */
  82 static uint32_t get_key_stream(int skip, int count)
  83 {
  84   uint32_t key=0; int i;
  85
  86   /* Use int to enlarge timer tc to 32bit */
  87   legic_prng_bc += prng_timer->TC_CV;
  88   prng_timer->TC_CCR = AT91C_TC_SWTRG;
  89
  90   /* If skip == -1, forward prng time based */
  91   if(skip == -1) {
  92      i  = (legic_prng_bc+SIM_SHIFT)/SIM_DIVISOR; /* Calculate Cycles based on timer */
  93      i -= legic_prng_count(); /* substract cycles of finished frames */
  94      i -= count; /* substract current frame length, rewidn to bedinning */
  95      legic_prng_forward(i);
  96   } else {
  97      legic_prng_forward(skip);
  98   }
  99
 100   /* Write Time Data into LOG */
 101   if(count == 6) { i = -1; } else { i = legic_read_count; }
 102   ((uint8_t*)BigBuf)[OFFSET_LOG+128+i] = legic_prng_count();
 103   ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4]   = (legic_prng_bc >> 0) & 0xff;
 104   ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+1] = (legic_prng_bc >> 8) & 0xff;
 105   ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+2] = (legic_prng_bc >>16) & 0xff;
 106   ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+3] = (legic_prng_bc >>24) & 0xff;
 107   ((uint8_t*)BigBuf)[OFFSET_LOG+384+i] = count;
 108
 109   /* Generate KeyStream */
 110   for(i=0; i<count; i++) {
 111     key |= legic_prng_get_bit() << i;
 112     legic_prng_forward(1);
 113   }
 114   return key;
 115 }
 116
 117 /* Send a frame in tag mode, the FPGA must have been set up by
 118  * LegicRfSimulate
 119  */
 120 static void frame_send_tag(uint16_t response, int bits, int crypt)
 121 {
 122    /* Bitbang the response */
 123    AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 124    AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
 125    AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
 126
 127    /* Use time to crypt frame */
 128    if(crypt) {
 129       legic_prng_forward(2); /* TAG_TIME_WAIT -> shift by 2 */
 130       int i; int key = 0;
 131       for(i=0; i<bits; i++) {
 132          key |= legic_prng_get_bit() << i;
 133          legic_prng_forward(1);
 134       }
 135       //Dbprintf("key = 0x%x", key);
 136       response = response ^ key;
 137    }
 138
 139    /* Wait for the frame start */
 140    while(timer->TC_CV < (TAG_TIME_WAIT - 30)) ;
 141
 142    int i;
 143    for(i=0; i<bits; i++) {
 144       int nextbit = timer->TC_CV + TAG_TIME_BIT;
 145       int bit = response & 1;
 146       response = response >> 1;
 147       if(bit) {
 148          AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 149       } else {
 150          AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 151       }
 152       while(timer->TC_CV < nextbit) ;
 153    }
 154    AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 155 }
 156
 157 /* Send a frame in reader mode, the FPGA must have been set up by
 158  * LegicRfReader
 159  */
 160 static void frame_send_rwd(uint32_t data, int bits)
 161 {
 162         /* Start clock */
 163         timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
 164         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 165
 166         int i;
 167         for(i=0; i<bits; i++) {
 168                 int starttime = timer->TC_CV;
 169                 int pause_end = starttime + RWD_TIME_PAUSE, bit_end;
 170                 int bit = data & 1;
 171                 data = data >> 1;
 172
 173                 if(bit ^ legic_prng_get_bit()) {
 174                         bit_end = starttime + RWD_TIME_1;
 175                 } else {
 176                         bit_end = starttime + RWD_TIME_0;
 177                 }
 178
 179                 /* RWD_TIME_PAUSE time off, then some time on, so that the complete bit time is
 180                  * RWD_TIME_x, where x is the bit to be transmitted */
 181                 AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 182                 while(timer->TC_CV < pause_end) ;
 183                 AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 184                 legic_prng_forward(1); /* bit duration is longest. use this time to forward the lfsr */
 185
 186                 while(timer->TC_CV < bit_end) ;
 187         }
 188
 189         {
 190                 /* One final pause to mark the end of the frame */
 191                 int pause_end = timer->TC_CV + RWD_TIME_PAUSE;
 192                 AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 193                 while(timer->TC_CV < pause_end) ;
 194                 AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 195         }
 196
 197         /* Reset the timer, to measure time until the start of the tag frame */
 198         timer->TC_CCR = AT91C_TC_SWTRG;
 199         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 200 }
 201
 202 /* Receive a frame from the card in reader emulation mode, the FPGA and
 203  * timer must have been set up by LegicRfReader and frame_send_rwd.
 204  *
 205  * The LEGIC RF protocol from card to reader does not include explicit
 206  * frame start/stop information or length information. The reader must
 207  * know beforehand how many bits it wants to receive. (Notably: a card
 208  * sending a stream of 0-bits is indistinguishable from no card present.)
 209  *
 210  * Receive methodology: There is a fancy correlator in hi_read_rx_xcorr, but
 211  * I'm not smart enough to use it. Instead I have patched hi_read_tx to output
 212  * the ADC signal with hysteresis on SSP_DIN. Bit-bang that signal and look
 213  * for edges. Count the edges in each bit interval. If they are approximately
 214  * 0 this was a 0-bit, if they are approximately equal to the number of edges
 215  * expected for a 212kHz subcarrier, this was a 1-bit. For timing we use the
 216  * timer that's still running from frame_send_rwd in order to get a synchronization
 217  * with the frame that we just sent.
 218  *
 219  * FIXME: Because we're relying on the hysteresis to just do the right thing
 220  * the range is severely reduced (and you'll probably also need a good antenna).
 221  * So this should be fixed some time in the future for a proper receiver.
 222  */
 223 static void frame_receive_rwd(struct legic_frame * const f, int bits, int crypt)
 224 {
 225         uint32_t the_bit = 1;  /* Use a bitmask to save on shifts */
 226         uint32_t data=0;
 227         int i, old_level=0, edges=0;
 228         int next_bit_at = TAG_TIME_WAIT;
 229
 230         if(bits > 32) {
 231                 bits = 32;
 232     }
 233
 234         AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
 235         AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
 236
 237         /* we have some time now, precompute the cipher
 238      * since we cannot compute it on the fly while reading */
 239         legic_prng_forward(2);
 240
 241         if(crypt)
 242         {
 243                 for(i=0; i<bits; i++) {
 244                         data |= legic_prng_get_bit() << i;
 245                         legic_prng_forward(1);
 246                 }
 247         }
 248
 249         while(timer->TC_CV < next_bit_at) ;
 250
 251         next_bit_at += TAG_TIME_BIT;
 252
 253         for(i=0; i<bits; i++) {
 254                 edges = 0;
 255                 while(timer->TC_CV < next_bit_at) {
 256                         int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
 257                         if(level != old_level)
 258                                 edges++;
 259                         old_level = level;
 260                 }
 261                 next_bit_at += TAG_TIME_BIT;
 262
 263                 if(edges > 20 && edges < 60) { /* expected are 42 edges */
 264                         data ^= the_bit;
 265                 }
 266                 the_bit <<= 1;
 267         }
 268
 269         f->data = data;
 270         f->bits = bits;
 271
 272         /* Reset the timer, to synchronize the next frame */
 273         timer->TC_CCR = AT91C_TC_SWTRG;
 274         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 275 }
 276
 277 static void frame_append_bit(struct legic_frame * const f, int bit)
 278 {
 279    if(f->bits >= 31) {
 280        return; /* Overflow, won't happen */
 281    }
 282    f->data |= (bit<<f->bits);
 283    f->bits++;
 284 }
 285
 286 static void frame_clean(struct legic_frame * const f)
 287 {
 288         f->data = 0;
 289         f->bits = 0;
 290 }
 291
 292 static uint32_t perform_setup_phase_rwd(int iv)
 293 {
 294
 295         /* Switch on carrier and let the tag charge for 1ms */
 296         AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 297         SpinDelay(1);
 298
 299         legic_prng_init(0); /* no keystream yet */
 300         frame_send_rwd(iv, 7);
 301         legic_prng_init(iv);
 302
 303         frame_clean(&current_frame);
 304         frame_receive_rwd(&current_frame, 6, 1);
 305         legic_prng_forward(1); /* we wait anyways */
 306         while(timer->TC_CV < 387) ; /* ~ 258us */
 307         frame_send_rwd(0x19, 6);
 308
 309         return current_frame.data;
 310 }
 311
 312 static void LegicCommonInit(void) {
 313         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 314         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 315         FpgaSetupSsc();
 316         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
 317
 318         /* Bitbang the transmitter */
 319         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 320         AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
 321         AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
 322
 323         setup_timer();
 324
 325         crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0);
 326 }
 327
 328 static void switch_off_tag_rwd(void)
 329 {
 330         /* Switch off carrier, make sure tag is reset */
 331         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 332         SpinDelay(10);
 333
 334         WDT_HIT();
 335 }
 336 /* calculate crc for a legic command */
 337 static int LegicCRC(int byte_index, int value, int cmd_sz) {
 338         crc_clear(&legic_crc);
 339         crc_update(&legic_crc, 1, 1); /* CMD_READ */
 340         crc_update(&legic_crc, byte_index, cmd_sz-1);
 341         crc_update(&legic_crc, value, 8);
 342         return crc_finish(&legic_crc);
 343 }
 344
 345 int legic_read_byte(int byte_index, int cmd_sz) {
 346         int byte;
 347
 348         legic_prng_forward(4); /* we wait anyways */
 349         while(timer->TC_CV < 387) ; /* ~ 258us + 100us*delay */
 350
 351         frame_send_rwd(1 | (byte_index << 1), cmd_sz);
 352         frame_clean(&current_frame);
 353
 354         frame_receive_rwd(&current_frame, 12, 1);
 355
 356         byte = current_frame.data & 0xff;
 357         if( LegicCRC(byte_index, byte, cmd_sz) != (current_frame.data >> 8) ) {
 358                 Dbprintf("!!! crc mismatch: expected %x but got %x !!!",
 359            LegicCRC(byte_index, current_frame.data & 0xff, cmd_sz), current_frame.data >> 8);
 360                 return -1;
 361         }
 362
 363         return byte;
 364 }
 365
 366 /* legic_write_byte() is not included, however it's trivial to implement
 367  * and here are some hints on what remains to be done:
 368  *
 369  *  * assemble a write_cmd_frame with crc and send it
 370  *  * wait until the tag sends back an ACK ('1' bit unencrypted)
 371  *  * forward the prng based on the timing
 372  */
 373 int legic_write_byte(int byte, int addr, int addr_sz) {
 374     //do not write UID, CRC, DCF
 375     if(addr <= 0x06) {
 376                 return 0;
 377         }
 378
 379         //== send write command ==============================
 380         crc_clear(&legic_crc);
 381         crc_update(&legic_crc, 0, 1); /* CMD_WRITE */
 382         crc_update(&legic_crc, addr, addr_sz);
 383         crc_update(&legic_crc, byte, 8);
 384
 385         uint32_t crc = crc_finish(&legic_crc);
 386         uint32_t cmd = ((crc     <<(addr_sz+1+8)) //CRC
 387                    |(byte    <<(addr_sz+1))   //Data
 388                    |(addr    <<1)             //Address
 389                    |(0x00    <<0));           //CMD = W
 390     uint32_t cmd_sz = addr_sz+1+8+4;          //crc+data+cmd
 391
 392     legic_prng_forward(2); /* we wait anyways */
 393     while(timer->TC_CV < 387) ; /* ~ 258us */
 394         frame_send_rwd(cmd, cmd_sz);
 395
 396         //== wait for ack ====================================
 397     int t, old_level=0, edges=0;
 398     int next_bit_at =0;
 399         while(timer->TC_CV < 387) ; /* ~ 258us */
 400     for(t=0; t<80; t++) {
 401         edges = 0;
 402                 next_bit_at += TAG_TIME_BIT;
 403         while(timer->TC_CV < next_bit_at) {
 404             int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
 405             if(level != old_level) {
 406                 edges++;
 407                         }
 408             old_level = level;
 409         }
 410         if(edges > 20 && edges < 60) { /* expected are 42 edges */
 411                         int t = timer->TC_CV;
 412                         int c = t/TAG_TIME_BIT;
 413                         timer->TC_CCR = AT91C_TC_SWTRG;
 414                         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 415                         legic_prng_forward(c);
 416                 return 0;
 417         }
 418     }
 419     timer->TC_CCR = AT91C_TC_SWTRG;
 420     while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 421         return -1;
 422 }
 423
 424 int LegicRfReader(int offset, int bytes) {
 425         int byte_index=0, cmd_sz=0, card_sz=0;
 426
 427         LegicCommonInit();
 428
 429         memset(BigBuf, 0, 1024);
 430
 431         DbpString("setting up legic card");
 432         uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV);
 433         switch_off_tag_rwd(); //we lose to mutch time with dprintf
 434         switch(tag_type) {
 435                 case 0x1d:
 436                         DbpString("MIM 256 card found, reading card ...");
 437             cmd_sz = 9;
 438                         card_sz = 256;
 439                         break;
 440                 case 0x3d:
 441                         DbpString("MIM 1024 card found, reading card ...");
 442             cmd_sz = 11;
 443                         card_sz = 1024;
 444                         break;
 445                 default:
 446                         Dbprintf("Unknown card format: %x",tag_type);
 447                         return -1;
 448         }
 449         if(bytes == -1) {
 450                 bytes = card_sz;
 451         }
 452         if(bytes+offset >= card_sz) {
 453                 bytes = card_sz-offset;
 454         }
 455
 456         perform_setup_phase_rwd(SESSION_IV);
 457
 458         LED_B_ON();
 459         while(byte_index < bytes) {
 460                 int r = legic_read_byte(byte_index+offset, cmd_sz);
 461                 if(r == -1 ||BUTTON_PRESS()) {
 462                 DbpString("operation aborted");
 463                         switch_off_tag_rwd();
 464                 LED_B_OFF();
 465                 LED_C_OFF();
 466                 return -1;
 467                 }
 468                 ((uint8_t*)BigBuf)[byte_index] = r;
 469         WDT_HIT();
 470                 byte_index++;
 471                 if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF();
 472         }
 473         LED_B_OFF();
 474     LED_C_OFF();
 475         switch_off_tag_rwd();
 476         Dbprintf("Card read, use 'hf legic decode' or");
 477     Dbprintf("'data hexsamples %d' to view results", (bytes+7) & ~7);
 478     return 0;
 479 }
 480
 481 void LegicRfWriter(int bytes, int offset) {
 482         int byte_index=0, addr_sz=0;
 483
 484         LegicCommonInit();
 485
 486         DbpString("setting up legic card");
 487         uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV);
 488         switch_off_tag_rwd();
 489         switch(tag_type) {
 490                 case 0x1d:
 491                         if(offset+bytes > 0x100) {
 492                                 Dbprintf("Error: can not write to 0x%03.3x on MIM 256", offset+bytes);
 493                                 return;
 494                         }
 495                         addr_sz = 8;
 496                         Dbprintf("MIM 256 card found, writing 0x%02.2x - 0x%02.2x ...", offset, offset+bytes);
 497                         break;
 498                 case 0x3d:
 499                         if(offset+bytes > 0x400) {
 500                         Dbprintf("Error: can not write to 0x%03.3x on MIM 1024", offset+bytes);
 501                         return;
 502                 }
 503                         addr_sz = 10;
 504                         Dbprintf("MIM 1024 card found, writing 0x%03.3x - 0x%03.3x ...", offset, offset+bytes);
 505                         break;
 506                 default:
 507                         Dbprintf("No or unknown card found, aborting");
 508             return;
 509         }
 510
 511     LED_B_ON();
 512         perform_setup_phase_rwd(SESSION_IV);
 513     legic_prng_forward(2);
 514         while(byte_index < bytes) {
 515                 int r = legic_write_byte(((uint8_t*)BigBuf)[byte_index+offset], byte_index+offset, addr_sz);
 516                 if((r != 0) || BUTTON_PRESS()) {
 517                         Dbprintf("operation aborted @ 0x%03.3x", byte_index);
 518                         switch_off_tag_rwd();
 519                         LED_B_OFF();
 520                         LED_C_OFF();
 521                         return;
 522                 }
 523         WDT_HIT();
 524                 byte_index++;
 525         if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF();
 526         }
 527     LED_B_OFF();
 528     LED_C_OFF();
 529     DbpString("write successful");
 530 }
 531
 532 int timestamp;
 533
 534 /* Handle (whether to respond) a frame in tag mode */
 535 static void frame_handle_tag(struct legic_frame const * const f)
 536 {
 537    /* First Part of Handshake (IV) */
 538    if(f->bits == 7) {
 539      if(f->data == SESSION_IV) {
 540         LED_C_ON();
 541         prng_timer->TC_CCR = AT91C_TC_SWTRG;
 542         legic_prng_init(f->data);
 543         frame_send_tag(0x3d, 6, 1); /* 0x3d^0x26 = 0x1b */
 544         legic_state = STATE_IV;
 545         legic_read_count = 0;
 546         legic_prng_bc = 0;
 547         legic_prng_iv = f->data;
 548
 549         /* TIMEOUT */
 550         timer->TC_CCR = AT91C_TC_SWTRG;
 551         while(timer->TC_CV > 1);
 552         while(timer->TC_CV < 280);
 553         return;
 554       } else if((prng_timer->TC_CV % 50) > 40) {
 555         legic_prng_init(f->data);
 556         frame_send_tag(0x3d, 6, 1);
 557         SpinDelay(20);
 558         return;
 559      }
 560    }
 561
 562    /* 0x19==??? */
 563    if(legic_state == STATE_IV) {
 564       if((f->bits == 6) && (f->data == (0x19 ^ get_key_stream(1, 6)))) {
 565          legic_state = STATE_CON;
 566
 567          /* TIMEOUT */
 568          timer->TC_CCR = AT91C_TC_SWTRG;
 569          while(timer->TC_CV > 1);
 570          while(timer->TC_CV < 200);
 571          return;
 572       } else {
 573          legic_state = STATE_DISCON;
 574          LED_C_OFF();
 575          Dbprintf("0x19 - Frame: %03.3x", f->data);
 576          return;
 577       }
 578    }
 579
 580    /* Read */
 581    if(f->bits == 11) {
 582       if(legic_state == STATE_CON) {
 583          int key   = get_key_stream(-1, 11); //legic_phase_drift, 11);
 584          int addr  = f->data ^ key; addr = addr >> 1;
 585          int data = ((uint8_t*)BigBuf)[addr];
 586          int hash = LegicCRC(addr, data, 11) << 8;
 587          ((uint8_t*)BigBuf)[OFFSET_LOG+legic_read_count] = (uint8_t)addr;
 588          legic_read_count++;
 589
 590          //Dbprintf("Data:%03.3x, key:%03.3x, addr: %03.3x, read_c:%u", f->data, key, addr, read_c);
 591          legic_prng_forward(legic_reqresp_drift);
 592
 593          frame_send_tag(hash | data, 12, 1);
 594
 595          /* SHORT TIMEOUT */
 596          timer->TC_CCR = AT91C_TC_SWTRG;
 597          while(timer->TC_CV > 1);
 598          legic_prng_forward(legic_frame_drift);
 599          while(timer->TC_CV < 180);
 600          return;
 601       }
 602    }
 603
 604    /* Write */
 605    if(f->bits == 23) {
 606       int key   = get_key_stream(-1, 23); //legic_frame_drift, 23);
 607       int addr  = f->data ^ key; addr = addr >> 1; addr = addr & 0x3ff;
 608       int data  = f->data ^ key; data = data >> 11; data = data & 0xff;
 609
 610       /* write command */
 611       legic_state = STATE_DISCON;
 612       LED_C_OFF();
 613       Dbprintf("write - addr: %x, data: %x", addr, data);
 614       return;
 615    }
 616
 617    if(legic_state != STATE_DISCON) {
 618       Dbprintf("Unexpected: sz:%u, Data:%03.3x, State:%u, Count:%u", f->bits, f->data, legic_state, legic_read_count);
 619       int i;
 620       Dbprintf("IV: %03.3x", legic_prng_iv);
 621       for(i = 0; i<legic_read_count; i++) {
 622          Dbprintf("Read Nb: %u, Addr: %u", i, ((uint8_t*)BigBuf)[OFFSET_LOG+i]);
 623       }
 624
 625       for(i = -1; i<legic_read_count; i++) {
 626          uint32_t t;
 627          t  = ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4];
 628          t |= ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+1] << 8;
 629          t |= ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+2] <<16;
 630          t |= ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+3] <<24;
 631
 632          Dbprintf("Cycles: %u, Frame Length: %u, Time: %u",
 633             ((uint8_t*)BigBuf)[OFFSET_LOG+128+i],
 634             ((uint8_t*)BigBuf)[OFFSET_LOG+384+i],
 635             t);
 636       }
 637    }
 638    legic_state = STATE_DISCON;
 639    legic_read_count = 0;
 640    SpinDelay(10);
 641    LED_C_OFF();
 642    return;
 643 }
 644
 645 /* Read bit by bit untill full frame is received
 646  * Call to process frame end answer
 647  */
 648 static void emit(int bit)
 649 {
 650   if(bit == -1) {
 651      if(current_frame.bits <= 4) {
 652         frame_clean(&current_frame);
 653      } else {
 654         frame_handle_tag(&current_frame);
 655         frame_clean(&current_frame);
 656      }
 657      WDT_HIT();
 658   } else if(bit == 0) {
 659     frame_append_bit(&current_frame, 0);
 660   } else if(bit == 1) {
 661     frame_append_bit(&current_frame, 1);
 662   }
 663 }
 664
 665 void LegicRfSimulate(int phase, int frame, int reqresp)
 666 {
 667   /* ADC path high-frequency peak detector, FPGA in high-frequency simulator mode,
 668    * modulation mode set to 212kHz subcarrier. We are getting the incoming raw
 669    * envelope waveform on DIN and should send our response on DOUT.
 670    *
 671    * The LEGIC RF protocol is pulse-pause-encoding from reader to card, so we'll
 672    * measure the time between two rising edges on DIN, and no encoding on the
 673    * subcarrier from card to reader, so we'll just shift out our verbatim data
 674    * on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear,
 675    * seems to be 300us-ish.
 676    */
 677
 678    if(phase < 0) {
 679       int i;
 680       for(i=0; i<=reqresp; i++) {
 681          legic_prng_init(SESSION_IV);
 682          Dbprintf("i=%u, key 0x%3.3x", i, get_key_stream(i, frame));
 683       }
 684       return;
 685    }
 686
 687    legic_phase_drift = phase;
 688    legic_frame_drift = frame;
 689    legic_reqresp_drift = reqresp;
 690
 691    FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 692    SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 693    FpgaSetupSsc();
 694    FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_212K);
 695
 696    /* Bitbang the receiver */
 697    AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
 698    AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
 699
 700    setup_timer();
 701    crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0);
 702
 703    int old_level = 0;
 704    int active = 0;
 705    legic_state = STATE_DISCON;
 706
 707    LED_B_ON();
 708    DbpString("Starting Legic emulator, press button to end");
 709    while(!BUTTON_PRESS()) {
 710       int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
 711       int time = timer->TC_CV;
 712
 713       if(level != old_level) {
 714          if(level == 1) {
 715             timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
 716             if(FUZZ_EQUAL(time, RWD_TIME_1, RWD_TIME_FUZZ)) {
 717                /* 1 bit */
 718                emit(1);
 719                active = 1;
 720                LED_A_ON();
 721             } else if(FUZZ_EQUAL(time, RWD_TIME_0, RWD_TIME_FUZZ)) {
 722                /* 0 bit */
 723                emit(0);
 724                active = 1;
 725                LED_A_ON();
 726             } else if(active) {
 727                /* invalid */
 728                emit(-1);
 729                active = 0;
 730                LED_A_OFF();
 731             }
 732          }
 733       }
 734
 735       if(time >= (RWD_TIME_1+RWD_TIME_FUZZ) && active) {
 736          /* Frame end */
 737          emit(-1);
 738          active = 0;
 739          LED_A_OFF();
 740       }
 741
 742       if(time >= (20*RWD_TIME_1) && (timer->TC_SR & AT91C_TC_CLKSTA)) {
 743          timer->TC_CCR = AT91C_TC_CLKDIS;
 744       }
 745
 746       old_level = level;
 747       WDT_HIT();
 748    }
 749    DbpString("Stopped");
 750    LED_B_OFF();
 751    LED_A_OFF();
 752    LED_C_OFF();
 753 }
 754