X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/fabef615ec2fbe1fbe4b69af9482931e781d8d08..b1cd7d5ca67c4cbe566d1662cafc0f3eb9949f6f:/armsrc/legicrf.c?ds=sidebyside diff --git a/armsrc/legicrf.c b/armsrc/legicrf.c index 7f8c05a6..8042fc8d 100644 --- a/armsrc/legicrf.c +++ b/armsrc/legicrf.c @@ -72,7 +72,7 @@ static void setup_timer(void) { #define RWD_TIME_1 120 // READER_TIME_PAUSE 20us off, 80us on = 100us 80 * 1.5 == 120ticks #define RWD_TIME_0 60 // READER_TIME_PAUSE 20us off, 40us on = 60us 40 * 1.5 == 60ticks #define RWD_TIME_PAUSE 30 // 20us == 20 * 1.5 == 30ticks */ -#define TAG_BIT_PERIOD 143 // 100us == 100 * 1.5 == 150ticks +#define TAG_BIT_PERIOD 142 // 100us == 100 * 1.5 == 150ticks #define TAG_FRAME_WAIT 495 // 330us from READER frame end to TAG frame start. 330 * 1.5 == 495 #define RWD_TIME_FUZZ 20 // rather generous 13us, since the peak detector + hysteresis fuzz quite a bit @@ -140,14 +140,13 @@ static void frame_clean(struct legic_frame * const f) { /* Generate Keystream */ uint32_t get_key_stream(int skip, int count) { - uint32_t key = 0; + int i; // Use int to enlarge timer tc to 32bit legic_prng_bc += prng_timer->TC_CV; // reset the prng timer. - ResetTimer(prng_timer); /* If skip == -1, forward prng time based */ if(skip == -1) { @@ -161,55 +160,41 @@ uint32_t get_key_stream(int skip, int count) { i = (count == 6) ? -1 : legic_read_count; - /* Write Time Data into LOG */ - // uint8_t *BigBuf = BigBuf_get_addr(); - // BigBuf[OFFSET_LOG+128+i] = legic_prng_count(); - // BigBuf[OFFSET_LOG+256+i*4] = (legic_prng_bc >> 0) & 0xff; - // BigBuf[OFFSET_LOG+256+i*4+1] = (legic_prng_bc >> 8) & 0xff; - // BigBuf[OFFSET_LOG+256+i*4+2] = (legic_prng_bc >>16) & 0xff; - // BigBuf[OFFSET_LOG+256+i*4+3] = (legic_prng_bc >>24) & 0xff; - // BigBuf[OFFSET_LOG+384+i] = count; + // log + //uint8_t cmdbytes[] = {bits, BYTEx(data, 0), BYTEx(data, 1), BYTEx(send, 0), BYTEx(send, 1), legic_prng_count()}; + //LogTrace(cmdbytes, sizeof(cmdbytes), starttime, GET_TICKS, NULL, TRUE); /* Generate KeyStream */ - for(i=0; iPIO_OER = GPIO_SSC_DOUT; AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; - /* Use time to crypt frame */ - if(crypt) { - legic_prng_forward(2); /* TAG_FRAME_WAIT -> shift by 2 */ - response ^= legic_prng_get_bits(bits); - } + /* TAG_FRAME_WAIT -> shift by 2 */ + legic_prng_forward(2); + response ^= legic_prng_get_bits(bits); /* Wait for the frame start */ - WaitUS( TAG_FRAME_WAIT ); - - uint8_t bit = 0; - for(int i = 0; i < bits; i++) { + WaitTicks( TAG_FRAME_WAIT ); - bit = response & 1; - response >>= 1; - - if (bit) - HIGH(GPIO_SSC_DOUT); + for (; mask < BITMASK(bits); mask <<= 1) { + if (response & mask) + OPEN_COIL else - LOW(GPIO_SSC_DOUT); - - WaitUS(100); + SHORT_COIL + WaitTicks(TAG_BIT_PERIOD); } - LOW(GPIO_SSC_DOUT); + SHORT_COIL; } /* Send a frame in reader mode, the FPGA must have been set up by @@ -264,7 +249,6 @@ static void frame_receiveAsReader(struct legic_frame * const f, uint8_t bits) { if ( bits > 32 ) return; uint8_t i = bits, edges = 0; - uint16_t lsfr = 0; uint32_t the_bit = 1, next_bit_at = 0, data = 0; uint32_t old_level = 0; volatile uint32_t level = 0; @@ -276,18 +260,14 @@ static void frame_receiveAsReader(struct legic_frame * const f, uint8_t bits) { // calibrate the prng. legic_prng_forward(2); - data = lsfr = legic_prng_get_bits(bits); + data = legic_prng_get_bits(bits); //FIXED time between sending frame and now listening frame. 330us uint32_t starttime = GET_TICKS; - if ( bits == 6) { - //WaitTicks( 495 - 9 - 9 ); - WaitTicks( 475 ); - } else { - WaitTicks( 450 ); - } + // its about 9+9 ticks delay from end-send to here. + WaitTicks( 477 ); - next_bit_at = GET_TICKS + TAG_BIT_PERIOD; + next_bit_at = GET_TICKS + TAG_BIT_PERIOD; while ( i-- ){ edges = 0; @@ -324,7 +304,7 @@ static uint32_t setup_phase_reader(uint8_t iv) { // Switch on carrier and let the tag charge for 1ms HIGH(GPIO_SSC_DOUT); - WaitUS(1000); + WaitUS(5000); ResetTicks(); @@ -370,7 +350,7 @@ static void LegicCommonInit(void) { AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; // reserve a cardmem, meaning we can use the tracelog function in bigbuff easier. - cardmem = BigBuf_malloc(LEGIC_CARD_MEMSIZE); + cardmem = BigBuf_get_EM_addr(); memset(cardmem, 0x00, LEGIC_CARD_MEMSIZE); clear_trace(); @@ -399,15 +379,17 @@ int legic_read_byte( uint16_t index, uint8_t cmd_sz) { uint8_t byte, crc, calcCrc = 0; uint32_t cmd = (index << 1) | LEGIC_READ; - - WaitTicks(366); + + // 90ticks = 60us (should be 100us but crc calc takes time.) + //WaitTicks(330); // 330ticks prng(4) - works + WaitTicks(240); // 240ticks prng(3) - works frame_sendAsReader(cmd, cmd_sz); frame_receiveAsReader(¤t_frame, 12); + // CRC check. byte = BYTEx(current_frame.data, 0); crc = BYTEx(current_frame.data, 1); - calcCrc = legic4Crc(LEGIC_READ, index, byte, cmd_sz); if( calcCrc != crc ) { @@ -415,8 +397,7 @@ int legic_read_byte( uint16_t index, uint8_t cmd_sz) { return -1; } - legic_prng_forward(4); - WaitTicks(50); + legic_prng_forward(3); return byte; } @@ -437,11 +418,11 @@ int legic_write_byte(uint8_t byte, uint16_t addr, uint8_t addr_sz) { crc_update(&legic_crc, addr, addr_sz); crc_update(&legic_crc, byte, 8); uint32_t crc = crc_finish(&legic_crc); - uint32_t crc2 = legic4Crc(LEGIC_WRITE, addr, byte, addr_sz+1); - if ( crc != crc2 ) + if ( crc != crc2 ) { Dbprintf("crc is missmatch"); - + return 1; + } // send write command uint32_t cmd = ((crc <<(addr_sz+1+8)) //CRC |(byte <<(addr_sz+1)) //Data @@ -450,13 +431,12 @@ int legic_write_byte(uint8_t byte, uint16_t addr, uint8_t addr_sz) { uint32_t cmd_sz = addr_sz+1+8+4; //crc+data+cmd - legic_prng_forward(2); /* we wait anyways */ + legic_prng_forward(2); - WaitUS(TAG_FRAME_WAIT); + WaitTicks(330); frame_sendAsReader(cmd, cmd_sz); - - // wllm-rbnt doesnt have these + AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; @@ -464,19 +444,19 @@ int legic_write_byte(uint8_t byte, uint16_t addr, uint8_t addr_sz) { int t, old_level = 0, edges = 0; int next_bit_at = 0; - WaitUS(TAG_FRAME_WAIT); + WaitTicks(TAG_FRAME_WAIT); for( t = 0; t < 80; ++t) { edges = 0; next_bit_at += TAG_BIT_PERIOD; while(timer->TC_CV < next_bit_at) { - int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); + volatile uint32_t level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); if(level != old_level) edges++; old_level = level; } - if(edges > 20 && edges < 60) { /* expected are 42 edges */ + if(edges > 20 ) { /* expected are 42 edges */ int t = timer->TC_CV; int c = t / TAG_BIT_PERIOD; @@ -492,8 +472,6 @@ int legic_write_byte(uint8_t byte, uint16_t addr, uint8_t addr_sz) { int LegicRfReader(uint16_t offset, uint16_t len, uint8_t iv) { - len &= 0x3FF; - uint16_t i = 0; uint8_t isOK = 1; legic_card_select_t card; @@ -529,7 +507,7 @@ OUT: WDT_HIT(); switch_off_tag_rwd(); LEDsoff(); - cmd_send(CMD_ACK,isOK,len,0,cardmem,len); + cmd_send(CMD_ACK, isOK, len, 0, cardmem, len); return 0; } @@ -617,6 +595,7 @@ void LegicRfWriter(uint16_t offset, uint16_t bytes, uint8_t iv) { LED_B_ON(); setup_phase_reader(iv); + int r = 0; while(byte_index < bytes) { @@ -738,7 +717,6 @@ int legic_select_card_iv(legic_card_select_t *p_card, uint8_t iv){ p_card->addrsize = 0; p_card->cardsize = 0; return 2; - break; } return 0; } @@ -752,7 +730,7 @@ void LegicRfInfo(void){ legic_card_select_t *card = (legic_card_select_t*) buf; LegicCommonInit(); - + if ( legic_select_card(card) ) { cmd_send(CMD_ACK,0,0,0,0,0); goto OUT; @@ -769,7 +747,7 @@ void LegicRfInfo(void){ } cmd_send(CMD_ACK, 1, 0, 0, buf, sizeof(legic_card_select_t)); - + OUT: switch_off_tag_rwd(); LEDsoff(); @@ -782,26 +760,26 @@ static void frame_handle_tag(struct legic_frame const * const f) { uint8_t *BigBuf = BigBuf_get_addr(); - /* First Part of Handshake (IV) */ - if(f->bits == 7) { + /* First Part of Handshake (IV) */ + if(f->bits == 7) { + + LED_C_ON(); - LED_C_ON(); - // Reset prng timer ResetTimer(prng_timer); - - legic_prng_init(f->data); - frame_send_tag(0x3d, 6, 1); /* 0x3d^0x26 = 0x1B */ - legic_state = STATE_IV; - legic_read_count = 0; - legic_prng_bc = 0; - legic_prng_iv = f->data; - - + + legic_prng_init(f->data); + frame_send_tag(0x3d, 6); /* 0x3d^0x26 = 0x1B */ + legic_state = STATE_IV; + legic_read_count = 0; + legic_prng_bc = 0; + legic_prng_iv = f->data; + + ResetTimer(timer); WaitUS(280); - return; - } + return; + } /* 0x19==??? */ if(legic_state == STATE_IV) { @@ -835,7 +813,7 @@ static void frame_handle_tag(struct legic_frame const * const f) //Dbprintf("Data:%03.3x, key:%03.3x, addr: %03.3x, read_c:%u", f->data, key, addr, read_c); legic_prng_forward(legic_reqresp_drift); - frame_send_tag(hash | data, 12, 1); + frame_send_tag(hash | data, 12); ResetTimer(timer); legic_prng_forward(2);