#ifndef OPEN_COIL
# define OPEN_COIL HIGH(GPIO_SSC_DOUT);
#endif
-
+#ifndef LINE_IN
+# define LINE_IN AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
+#endif
// Pause pulse, off in 20us / 30ticks,
// ONE / ZERO bit pulse,
// one == 80us / 120ticks
i = (count == 6) ? -1 : legic_read_count;
- // log
- //uint8_t cmdbytes[] = {bits, BYTEx(data, 0), BYTEx(data, 1), BYTEx(send, 0), BYTEx(send, 1), legic_prng_count()};
- //LogTrace(cmdbytes, sizeof(cmdbytes), starttime, GET_TICKS, NULL, TRUE);
-
/* Generate KeyStream */
return legic_prng_get_bits(count);
}
*/
void frame_sendAsReader(uint32_t data, uint8_t bits){
- uint32_t starttime = GET_TICKS, send = 0;
- uint16_t mask = 1;
+ uint32_t starttime = GET_TICKS, send = 0, mask = 1;
// xor lsfr onto data.
send = data ^ legic_prng_get_bits(bits);
COIL_PULSE(0);
// log
- uint8_t cmdbytes[] = {bits, BYTEx(data, 0), BYTEx(data, 1), BYTEx(send, 0), BYTEx(send, 1)};
+ uint8_t cmdbytes[] = {bits, BYTEx(data,0), BYTEx(data,1), BYTEx(data,2) , BYTEx(send,0), BYTEx(send,1)};
LogTrace(cmdbytes, sizeof(cmdbytes), starttime, GET_TICKS, NULL, TRUE);
}
volatile uint32_t level = 0;
frame_clean(f);
-
- AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
- AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
// calibrate the prng.
legic_prng_forward(2);
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
/* Bitbang the transmitter */
- LOW(GPIO_SSC_DOUT);
+ SHORT_COIL;
AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
-
+ AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
+
// reserve a cardmem, meaning we can use the tracelog function in bigbuff easier.
cardmem = BigBuf_get_EM_addr();
memset(cardmem, 0x00, LEGIC_CARD_MEMSIZE);
// Switch off carrier, make sure tag is reset
static void switch_off_tag_rwd(void) {
- LOW(GPIO_SSC_DOUT);
+ SHORT_COIL;
WaitUS(20);
WDT_HIT();
}
calcCrc = legic4Crc(LEGIC_READ, index, byte, cmd_sz);
if( calcCrc != crc ) {
- Dbprintf("!!! crc mismatch: expected %x but got %x !!!", calcCrc, crc);
+ Dbprintf("!!! crc mismatch: %x != %x !!!", calcCrc, crc);
return -1;
}
* - wait until the tag sends back an ACK ('1' bit unencrypted)
* - forward the prng based on the timing
*/
-int legic_write_byte(uint16_t index, uint8_t byte, uint8_t addr_sz) {
+bool legic_write_byte(uint16_t index, uint8_t byte, uint8_t addr_sz) {
+
+ bool isOK = false;
+ int8_t i = 40;
+ uint8_t edges = 0;
+ uint8_t cmd_sz = addr_sz+1+8+4; //crc+data+cmd;
+ uint32_t steps = 0, next_bit_at, start, crc, old_level = 0;
- // crc
+/*
crc_clear(&legic_crc);
- crc_update(&legic_crc, 0, 1); /* CMD_WRITE */
+ crc_update(&legic_crc, 0, 1); // CMD_WRITE
crc_update(&legic_crc, index, addr_sz);
crc_update(&legic_crc, byte, 8);
- uint32_t crc = crc_finish(&legic_crc);
- uint32_t crc2 = legic4Crc(LEGIC_WRITE, index, byte, addr_sz+1);
- if ( crc != crc2 ) {
- Dbprintf("crc is missmatch");
- return 1;
- }
+ crc = crc_finish(&legic_crc);
+*/
+ crc = legic4Crc(LEGIC_WRITE, index, byte, addr_sz+1);
+
// send write command
- uint32_t cmd = ((crc <<(addr_sz+1+8)) //CRC
- |(byte <<(addr_sz+1)) //Data
- |(index <<1) //index
- | LEGIC_WRITE); //CMD = Write
-
- uint32_t cmd_sz = addr_sz+1+8+4; //crc+data+cmd
-
- legic_prng_forward(2);
+ uint32_t cmd = LEGIC_WRITE;
+ cmd |= index << 1; // index
+ cmd |= byte << (addr_sz+1); // Data
+ cmd |= (crc & 0xF ) << (addr_sz+1+8); // CRC
+
+ /* Bitbang the response */
+ //AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
- WaitTicks(330);
+ WaitTicks(240);
frame_sendAsReader(cmd, cmd_sz);
+
+ LINE_IN;
- // wait for ack
- AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
- AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
-
- int t, old_level = 0, edges = 0;
- int next_bit_at = 0;
-
- // ACK 3.6ms = 3600us * 1.5 = 5400ticks.
- WaitTicks(5360);
+ start = GET_TICKS;
- for( t = 0; t < 80; ++t) {
+ // ACK, - one single "1" bit after 3.6ms
+ // 3.6ms = 3600us * 1.5 = 5400ticks.
+ WaitTicks(5300);
+
+ next_bit_at = GET_TICKS + TAG_BIT_PERIOD;
+
+ while ( i-- ) {
+ WDT_HIT();
edges = 0;
- next_bit_at += TAG_BIT_PERIOD;
- while(timer->TC_CV < next_bit_at) {
+ while ( GET_TICKS < next_bit_at) {
+
volatile uint32_t level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
- if(level != old_level)
- edges++;
+
+ if (level != old_level)
+ ++edges;
old_level = level;
}
- /* expected are 42 edges (ONE) */
+
+ next_bit_at += TAG_BIT_PERIOD;
+
+ // We expect 42 edges (ONE)
if(edges > 20 ) {
- int t = timer->TC_CV;
- int c = t / TAG_BIT_PERIOD;
-
- ResetTimer(timer);
- legic_prng_forward(c);
- return 0;
+ steps = ( (GET_TICKS - start) / TAG_BIT_PERIOD);
+ legic_prng_forward(steps);
+ isOK = true;
+ goto OUT;
}
}
-
- return -1;
+
+OUT: ;
+ // log
+ uint8_t cmdbytes[] = {1, isOK, BYTEx(steps, 0), BYTEx(steps, 1) };
+ LogTrace(cmdbytes, sizeof(cmdbytes), start, GET_TICKS, NULL, FALSE);
+ return isOK;
}
int LegicRfReader(uint16_t offset, uint16_t len, uint8_t iv) {
goto OUT;
}
- switch_off_tag_rwd();
-
if (len + offset >= card.cardsize)
len = card.cardsize - offset;
- setup_phase_reader(iv);
-
LED_B_ON();
while (i < len) {
int r = legic_read_byte(offset + i, card.cmdsize);
void LegicRfWriter(uint16_t offset, uint16_t len, uint8_t iv, uint8_t *data) {
+ #define LOWERLIMIT 4
uint8_t isOK = 1;
+ legic_card_select_t card;
- // UID not is writeable.
- if ( offset <= 4 ) {
+ // uid NOT is writeable.
+ if ( offset <= LOWERLIMIT ) {
isOK = 0;
goto OUT;
}
- legic_card_select_t card;
-
LegicCommonInit();
if ( legic_select_card_iv(&card, iv) ) {
goto OUT;
}
- if (len + offset >= card.cardsize)
- len = card.cardsize - offset;
-
- setup_phase_reader(iv);
+ if ( len + offset + LOWERLIMIT >= card.cardsize) {
+ isOK = 0;
+ goto OUT;
+ }
LED_B_ON();
- int r = 0;
- // how about we write backwards instead. no need for this extra DCF check.
- // index = len - cardsize
- // stops uid 01234,
- /*
- len = 20
- offset = 5
-
- index = 20+5 = 25
- if ( index > cardsize ) return -1;
-
- loop
- write( cardmem[index], index , card.addrsize);
- --index;
- end loop
- */
- uint16_t index = len;
- while(index > 4) {
-
- r = legic_write_byte( index, cardmem[ index ], card.addrsize);
-
- if ( r ) {
- Dbprintf("operation aborted @ 0x%03.3x", index);
+ while( len > 0 ) {
+ --len;
+ if ( !legic_write_byte( len + offset, data[len], card.addrsize) ) {
+ Dbprintf("operation failed | %02X | %02X | %02X", len + offset, len, data[len] );
isOK = 0;
goto OUT;
}
- --index;
WDT_HIT();
}
-
OUT:
cmd_send(CMD_ACK, isOK, 0,0,0,0);
switch_off_tag_rwd();
*/
static void frame_handle_tag(struct legic_frame const * const f)
{
- uint8_t *BigBuf = BigBuf_get_addr();
+ // log
+ //uint8_t cmdbytes[] = {bits, BYTEx(data, 0), BYTEx(data, 1)};
+ //LogTrace(cmdbytes, sizeof(cmdbytes), starttime, GET_TICKS, NULL, FALSE);
+
+ cardmem = BigBuf_get_EM_addr();
/* First Part of Handshake (IV) */
if(f->bits == 7) {
// Reset prng timer
ResetTimer(prng_timer);
+ // IV from reader.
legic_prng_init(f->data);
+
+ // We should have three tagtypes with three different answers.
frame_send_tag(0x3d, 6); /* 0x3d^0x26 = 0x1B */
+
legic_state = STATE_IV;
legic_read_count = 0;
legic_prng_bc = 0;
/* 0x19==??? */
if(legic_state == STATE_IV) {
- int local_key = get_key_stream(3, 6);
+ uint32_t local_key = get_key_stream(3, 6);
int xored = 0x39 ^ local_key;
if((f->bits == 6) && (f->data == xored)) {
legic_state = STATE_CON;
/* Read */
if(f->bits == 11) {
if(legic_state == STATE_CON) {
- int key = get_key_stream(2, 11); //legic_phase_drift, 11);
- int addr = f->data ^ key; addr = addr >> 1;
- int data = BigBuf[addr];
+ uint32_t key = get_key_stream(2, 11); //legic_phase_drift, 11);
+ uint16_t addr = f->data ^ key;
+ addr >>= 1;
+ uint8_t data = cardmem[addr];
int hash = legic4Crc(LEGIC_READ, addr, data, 11) << 8;
- BigBuf[OFFSET_LOG+legic_read_count] = (uint8_t)addr;
- legic_read_count++;
- //Dbprintf("Data:%03.3x, key:%03.3x, addr: %03.3x, read_c:%u", f->data, key, addr, read_c);
+ legic_read_count++;
legic_prng_forward(legic_reqresp_drift);
frame_send_tag(hash | data, 12);
-
ResetTimer(timer);
legic_prng_forward(2);
- WaitUS(180);
+ WaitTicks(330);
return;
}
}
/* Write */
if(f->bits == 23) {
- int key = get_key_stream(-1, 23); //legic_frame_drift, 23);
- int addr = f->data ^ key; addr = addr >> 1; addr = addr & 0x3ff;
- int data = f->data ^ key; data = data >> 11; data = data & 0xff;
-
+ uint32_t key = get_key_stream(-1, 23); //legic_frame_drift, 23);
+ uint16_t addr = f->data ^ key;
+ addr >>= 1;
+ addr &= 0x3ff;
+ uint32_t data = f->data ^ key;
+ data >>= 11;
+ data &= 0xff;
+
+ cardmem[addr] = data;
/* write command */
legic_state = STATE_DISCON;
LED_C_OFF();
Dbprintf("write - addr: %x, data: %x", addr, data);
+ // should send a ACK within 3.5ms too
return;
}
if(legic_state != STATE_DISCON) {
Dbprintf("Unexpected: sz:%u, Data:%03.3x, State:%u, Count:%u", f->bits, f->data, legic_state, legic_read_count);
- int i;
Dbprintf("IV: %03.3x", legic_prng_iv);
- for(i = 0; i<legic_read_count; i++) {
- Dbprintf("Read Nb: %u, Addr: %u", i, BigBuf[OFFSET_LOG+i]);
- }
-
- for(i = -1; i<legic_read_count; i++) {
- uint32_t t;
- t = BigBuf[OFFSET_LOG+256+i*4];
- t |= BigBuf[OFFSET_LOG+256+i*4+1] << 8;
- t |= BigBuf[OFFSET_LOG+256+i*4+2] <<16;
- t |= BigBuf[OFFSET_LOG+256+i*4+3] <<24;
-
- Dbprintf("Cycles: %u, Frame Length: %u, Time: %u",
- BigBuf[OFFSET_LOG+128+i],
- BigBuf[OFFSET_LOG+384+i],
- t);
- }
}
+
legic_state = STATE_DISCON;
legic_read_count = 0;
SpinDelay(10);
* on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear,
* seems to be 300us-ish.
*/
+
+ int old_level = 0, active = 0;
+ legic_state = STATE_DISCON;
legic_phase_drift = phase;
legic_frame_drift = frame;
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
- FpgaSetupSsc();
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_212K);
/* Bitbang the receiver */
- AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
- AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
+ LINE_IN;
+
+ // need a way to determine which tagtype we are simulating
+
+ // hook up emulator memory
+ cardmem = BigBuf_get_EM_addr();
+
+ clear_trace();
+ set_tracing(TRUE);
- //setup_timer();
crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0);
- int old_level = 0;
- int active = 0;
- legic_state = STATE_DISCON;
+ StartTicks();
LED_B_ON();
DbpString("Starting Legic emulator, press button to end");
while(!BUTTON_PRESS() && !usb_poll_validate_length()) {
- int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
- int time = timer->TC_CV;
+ volatile uint32_t level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
+
+ uint32_t time = GET_TICKS;
+
+ if (level != old_level) {
+
+ if (level) {
- if(level != old_level) {
- if(level == 1) {
- timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
+ ResetTicks();
if (FUZZ_EQUAL(time, RWD_TIME_1, RWD_TIME_FUZZ)) {
/* 1 bit */
LED_A_OFF();
}
- if(time >= (20*RWD_TIME_1) && (timer->TC_SR & AT91C_TC_CLKSTA)) {
- timer->TC_CCR = AT91C_TC_CLKDIS;
- }
+ /*
+ * Disable the counter, Then wait for the clock to acknowledge the
+ * shutdown in its status register. Reading the SR has the
+ * side-effect of clearing any pending state in there.
+ */
+ if(time >= (20*RWD_TIME_1) && (timer->TC_SR & AT91C_TC_CLKSTA))
+ StopTicks();
old_level = level;
WDT_HIT();
}
- if ( MF_DBGLEVEL >= 1) DbpString("Stopped");
+
+ WDT_HIT();
+ switch_off_tag_rwd();
LEDsoff();
+ cmd_send(CMD_ACK, 1, 0, 0, 0, 0);
}
//-----------------------------------------------------------------------------
projects / proxmark3-svn / blobdiff