-void LegicRfReader(void)
-{
- SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
- FpgaSetupSsc();
- FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
-
- /* Bitbang the transmitter */
- AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
- AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
- AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
-
- setup_timer();
-
- while(!BUTTON_PRESS()) {
- /* Switch on carrier and let the tag charge for 1ms */
- AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
- SpinDelay(1);
-
- LED_A_ON();
- frame_send_rwd(queries[0].data, queries[0].bits);
- LED_A_OFF();
-
- frame_clean(¤t_frame);
- LED_B_ON();
- frame_receive_rwd(¤t_frame, responses[0].bits);
- LED_B_OFF();
-
- /* Switch off carrier, make sure tag is reset */
- AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
- SpinDelay(10);
-
- WDT_HIT();
- }
-
+// Transmit write command, wait until (3.6ms) the tag sends back an unencrypted
+// ACK ('1' bit) and forward the prng time based.
+bool write_byte(uint16_t index, uint8_t byte, uint8_t addr_sz) {
+ uint32_t cmd = index << 1 | LEGIC_WRITE; // prepare command
+ uint8_t crc = calc_crc4(cmd, addr_sz + 1, byte); // calculate crc
+ cmd |= byte << (addr_sz + 1); // append value
+ cmd |= (crc & 0xF) << (addr_sz + 1 + 8); // and crc
+
+ // send write command
+ LED_C_ON();
+ legic_prng_forward(2);
+ tx_frame(cmd, addr_sz + 1 + 8 + 4); // sz = addr_sz + cmd + data + crc
+ legic_prng_forward(3);
+ LED_C_OFF();
+
+ // wait for ack
+ return rx_ack();
+}
+
+//-----------------------------------------------------------------------------
+// Command Line Interface
+//
+// Only this functions are public / called from appmain.c
+//-----------------------------------------------------------------------------
+void LegicRfReader(int offset, int bytes) {
+ uint8_t *BigBuf = BigBuf_get_addr();
+ memset(BigBuf, 0, 1024);
+
+ // configure ARM and FPGA
+ init_reader(false);
+
+ // establish shared secret and detect card type
+ DbpString("Reading card ...");
+ uint8_t card_type = setup_phase(SESSION_IV);
+ uint8_t result = 0;
+ if(init_card(card_type, &card) != 0) {
+ result = 1;
+ goto OUT;
+ }
+
+ // if no argument is specified create full dump
+ if(bytes == -1) {
+ bytes = card.cardsize;
+ }
+
+ // do not read beyond card memory
+ if(bytes + offset > card.cardsize) {
+ bytes = card.cardsize - offset;
+ }
+
+ for(uint16_t i = 0; i < bytes; ++i) {
+ int16_t byte = read_byte(offset + i, card.cmdsize);
+ if(byte == -1) {
+ result = 2;
+ goto OUT;
+ }
+ BigBuf[i] = byte;
+ }
+
+OUT:
+ cmd_send(CMD_ACK, result, bytes, 0, &card, sizeof(card));
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ LED_B_OFF();
+ LED_C_OFF();
+ LED_D_OFF();
+ StopTicks();
+}
+
+void LegicRfWriter(int bytes, int offset) {
+ uint8_t *BigBuf = BigBuf_get_addr();
+
+ // configure ARM and FPGA
+ init_reader(false);
+
+ // uid is not writeable
+ if(offset <= WRITE_LOWERLIMIT) {
+ goto OUT;
+ }
+
+ // establish shared secret and detect card type
+ Dbprintf("Writing 0x%02.2x - 0x%02.2x ...", offset, offset+bytes);
+ uint8_t card_type = setup_phase(SESSION_IV);
+ if(init_card(card_type, &card) != 0) {
+ Dbprintf("No or unknown card found, aborting");
+ goto OUT;
+ }
+
+ // do not write beyond card memory
+ if(bytes + offset > card.cardsize) {
+ bytes = card.cardsize - offset;
+ }
+
+ // write in reverse order, only then is DCF (decremental field) writable
+ while(bytes-- > 0 && !BUTTON_PRESS()) {
+ if(!write_byte(bytes + offset, BigBuf[bytes + offset], card.addrsize)) {
+ Dbprintf("operation failed @ 0x%03.3x", bytes);
+ goto OUT;
+ }
+ }
+
+ // OK
+ DbpString("Write successful");
+
+OUT:
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ LED_B_OFF();
+ LED_C_OFF();
+ LED_D_OFF();
+ StopTicks();
projects / proxmark3-svn / blobdiff