// if not provided a valid crc will be computed from the data and written.
void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc)
{
- StartTicks();
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
if(crc == 0) {
crc = update_crc16(crc, (idlo)&0xff);
// whether we're modulating the antenna (high)
// or listening to the antenna (low)
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);
+ StartTicks();
+
LED_A_ON();
-
+
// steal this pin from the SSP and use it to control the modulation
AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
// then write 80 bits of data (or 64 bit data + 16 bit crc if you prefer)
// finally end with 0x0300 (write frame)
// all data is sent lsb first
- // finish with 15ms programming time
+ // finish with 50ms programming time
// modulate antenna
HIGH(GPIO_SSC_DOUT);
int i = 0;
uint8_t *buf = BigBuf_get_addr();
- FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);
+ //FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
//FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_READER_FIELD);
//FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_TOGGLE_MODE );
AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
// power on antenna
- // OPEN_COIL();
- // SpinDelay(50);
+ OPEN_COIL();
+ // charge time
+ WaitMS(50);
for(;;) {
WDT_HIT();
for (i=0; i<size; i++){
askSimBit(BitStream[i]^invert, &n, clk, encoding);
}
- if (encoding==0 && BitStream[0]==BitStream[size-1]){ //run a second set inverted (for biphase phase)
+ if (encoding==0 && BitStream[0]==BitStream[size-1]){ //run a second set inverted (for ask/raw || biphase phase)
for (i=0; i<size; i++){
askSimBit(BitStream[i]^invert^1, &n, clk, encoding);
}
// Give it a bit of time for the resonant antenna to settle.
WaitUS(delay);
}
+void TurnReadLF_off(uint32_t delay) {
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ WaitUS(delay);
+}
// Write one bit to card
void T55xxWriteBit(int bit) {
data[0] = T55x7_BITRATE_RF_50 | T55x7_MODULATION_FSK2a | last_block << T55x7_MAXBLOCK_SHIFT;
//TODO add selection of chip for Q5 or T55x7
- // data[0] = (((50-2)/2)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | last_block << T5555_MAXBLOCK_SHIFT;
+ // data[0] = (((50-2)>>1)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | last_block << T5555_MAXBLOCK_SHIFT;
LED_D_ON();
WriteT55xx(data, 0, last_block+1);
uint32_t data[] = {T55x7_BITRATE_RF_64 | T55x7_MODULATION_FSK2a | (2 << T55x7_MAXBLOCK_SHIFT), hi, lo};
//TODO add selection of chip for Q5 or T55x7
//t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
- // data[0] = (64 << T5555_BITRATE_SHIFT) | T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | 2 << T5555_MAXBLOCK_SHIFT;
+ // data[0] = ( ((64-2)>>1) << T5555_BITRATE_SHIFT) | T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | 2 << T5555_MAXBLOCK_SHIFT;
LED_D_ON();
// Program the data blocks for supplied ID
// and the Config for Indala 64 format (RF/32;PSK1 with RF/2;Maxblock=2)
uint32_t data[] = { T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK1 | (2 << T55x7_MAXBLOCK_SHIFT), hi, lo};
//TODO add selection of chip for Q5 or T55x7
- // data[0] = (((32-2)/2)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_PSK1 | 2 << T5555_MAXBLOCK_SHIFT;
+ // data[0] = (((32-2)>>1)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_PSK1 | 2 << T5555_MAXBLOCK_SHIFT;
WriteT55xx(data, 0, 3);
//Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=2;Inverse data)
//Config for Indala (RF/32;PSK1 with RF/2;Maxblock=7)
data[0] = T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK1 | (7 << T55x7_MAXBLOCK_SHIFT);
//TODO add selection of chip for Q5 or T55x7
- // data[0] = (((32-2)/2)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_PSK1 | 7 << T5555_MAXBLOCK_SHIFT;
+ // data[0] = (((32-2)>>1) << T5555_BITRATE_SHIFT) | T5555_MODULATION_PSK1 | 7 << T5555_MAXBLOCK_SHIFT;
WriteT55xx(data, 0, 8);
//Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=7;Inverse data)
// T5567WriteBlock(0x603E10E2,0);
void CopyVikingtoT55xx(uint32_t block1, uint32_t block2, uint8_t Q5) {
uint32_t data[] = {T55x7_BITRATE_RF_32 | T55x7_MODULATION_MANCHESTER | (2 << T55x7_MAXBLOCK_SHIFT), block1, block2};
//t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
- if (Q5) data[0] = (32 << T5555_BITRATE_SHIFT) | T5555_MODULATION_MANCHESTER | 2 << T5555_MAXBLOCK_SHIFT;
+ if (Q5) data[0] = (((32-2)>>1) << T5555_BITRATE_SHIFT) | T5555_MODULATION_MANCHESTER | 2 << T5555_MAXBLOCK_SHIFT;
// Program the data blocks for supplied ID and the block 0 config
WriteT55xx(data, 0, 3);
LED_D_OFF();
}
data[0] = clock | T55x7_MODULATION_MANCHESTER | (2 << T55x7_MAXBLOCK_SHIFT);
} else { //t5555 (Q5)
- clock = (clock-2)>>1; //n = (RF-2)/2
- data[0] = (clock << T5555_BITRATE_SHIFT) | T5555_MODULATION_MANCHESTER | (2 << T5555_MAXBLOCK_SHIFT);
+ // t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
+ data[0] = ( ((clock-2) >> 1) << T5555_BITRATE_SHIFT) | T5555_MODULATION_MANCHESTER | (2 << T5555_MAXBLOCK_SHIFT);
}
WriteT55xx(data, 0, 3);
// 55FC * 8us == 440us / 21.3 === 20.65 steps. could be too short. Go for 56FC instead
// 32FC * 8us == 256us / 21.3 == 12.018 steps. ok
// 16FC * 8us == 128us / 21.3 == 6.009 steps. ok
-
#ifndef EM_START_GAP
-#define EM_START_GAP 56*8
-#endif
-#ifndef EM_ONE_GAP
-#define EM_ONE_GAP 32*8
-#endif
-#ifndef EM_ZERO_GAP
-# define EM_ZERO_GAP 16*8
+#define EM_START_GAP 55*8
#endif
fwd_write_ptr = forwardLink_data;
fwd_bit_sz--; //prepare next bit modulation
fwd_write_ptr++;
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
- WaitUS(EM_START_GAP);
-
- TurnReadLFOn(EM_ZERO_GAP);
+ TurnReadLF_off(EM_START_GAP);
+ TurnReadLFOn(18*8);
// now start writting with bitbanging the antenna.
while(fwd_bit_sz-- > 0) { //prepare next bit modulation
- if(((*fwd_write_ptr++) & 1) == 1)
- WaitUS(EM_ONE_GAP);
- else {
- //These timings work for 4469/4269/4305
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
- WaitUS(EM_ZERO_GAP);
- TurnReadLFOn(EM_ZERO_GAP);
+ if(((*fwd_write_ptr++) & 1) == 1) {
+ WaitUS(32);
+ } else {
+ TurnReadLF_off(23*8);
+ TurnReadLFOn(18*8);
}
}
}
len = Prepare_Cmd( FWD_CMD_LOGIN );
len += Prepare_Data( pwd & 0xFFFF, pwd >> 16 );
SendForward(len);
- WaitMS(20);
+ //WaitUS(20); // no wait for login command.
+ // should receive
+ // 0000 1010 ok.
+ // 0000 0001 fail
}
void EM4xReadWord(uint8_t addr, uint32_t pwd, uint8_t usepwd) {
LED_A_ON();
-
uint8_t len;
//clear buffer now so it does not interfere with timing later
BigBuf_Clear_ext(false);
+ /* should we read answer from Logincommand?
+ *
+ * should receive
+ * 0000 1010 ok.
+ * 0000 0001 fail
+ **/
if (usepwd) EM4xLogin(pwd);
forward_ptr = forwardLink_data;
SendForward(len);
- DoAcquisition_config(TRUE);
+ WaitUS(400);
+
+ DoPartialAcquisition(20, true, 6000);
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
cmd_send(CMD_ACK,0,0,0,0,0);
//clear buffer now so it does not interfere with timing later
BigBuf_Clear_ext(false);
-
+
+ /* should we read answer from Logincommand?
+ *
+ * should receive
+ * 0000 1010 ok.
+ * 0000 0001 fail
+ **/
if (usePwd) EM4xLogin(pwd);
forward_ptr = forwardLink_data;
SendForward(len);
- //Wait 20ms for write to complete
- WaitMS(20);
+ //Wait 20ms for write to complete?
+ WaitMS(7);
+
+ //Capture response if one exists
+ DoPartialAcquisition(20, true, 6000);
+
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
cmd_send(CMD_ACK,0,0,0,0,0);
LED_A_OFF();
projects / proxmark3-svn / blobdiff