From: henryk@ploetzli.ch Date: Fri, 6 Nov 2009 15:37:53 +0000 (+0000) Subject: Add basic communication shell for Legic RF in reader mode. Needs the new receive... X-Git-Tag: v1.0.0~454 X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/commitdiff_plain/dcc10e5e310a9e652e698593b7ba34bacbdd2b80 Add basic communication shell for Legic RF in reader mode. Needs the new receive function of hi_read_tx. --- diff --git a/armsrc/appmain.c b/armsrc/appmain.c index c83400da..fb501304 100644 --- a/armsrc/appmain.c +++ b/armsrc/appmain.c @@ -553,6 +553,10 @@ void UsbPacketReceived(BYTE *packet, int len) ReaderIso15693(c->ext1); break; + case CMD_READER_LEGIC_RF: + LegicRfReader(); + break; + case CMD_SIMTAG_ISO_15693: SimTagIso15693(c->ext1); break; diff --git a/armsrc/legicrf.c b/armsrc/legicrf.c index 00cb52b6..a8c0cd11 100644 --- a/armsrc/legicrf.c +++ b/armsrc/legicrf.c @@ -79,6 +79,108 @@ static void frame_send_tag(uint16_t response, int bits) #endif } +/* Send a frame in reader mode, the FPGA must have been set up by + * LegicRfReader + */ +static void frame_send_rwd(uint16_t data, int bits) +{ + /* Start clock */ + timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; + while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ + + int i; + for(i=0; iTC_CV; + int pause_end = starttime + RWD_TIME_PAUSE, bit_end; + int bit = data & 1; + data = data >> 1; + + if(bit) { + bit_end = starttime + RWD_TIME_1; + } else { + bit_end = starttime + RWD_TIME_0; + } + + /* RWD_TIME_PAUSE time off, then some time on, so that the complete bit time is + * RWD_TIME_x, where x is the bit to be transmitted */ + AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; + while(timer->TC_CV < pause_end) ; + AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; + while(timer->TC_CV < bit_end) ; + } + + { + /* One final pause to mark the end of the frame */ + int pause_end = timer->TC_CV + RWD_TIME_PAUSE; + AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; + while(timer->TC_CV < pause_end) ; + AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; + } + + /* Reset the timer, to measure time until the start of the tag frame */ + timer->TC_CCR = AT91C_TC_SWTRG; +} + +/* Receive a frame from the card in reader emulation mode, the FPGA and + * timer must have been set up by LegicRfReader and frame_send_rwd. + * + * The LEGIC RF protocol from card to reader does not include explicit + * frame start/stop information or length information. The reader must + * know beforehand how many bits it wants to receive. (Notably: a card + * sending a stream of 0-bits is indistinguishable from no card present.) + * + * Receive methodology: There is a fancy correlator in hi_read_rx_xcorr, but + * I'm not smart enough to use it. Instead I have patched hi_read_tx to output + * the ADC signal with hysteresis on SSP_DIN. Bit-bang that signal and look + * for edges. Count the edges in each bit interval. If they are approximately + * 0 this was a 0-bit, if they are approximately equal to the number of edges + * expected for a 212kHz subcarrier, this was a 1-bit. For timing we use the + * timer that's still running from frame_send_rwd in order to get a synchronization + * with the frame that we just sent. + * + * FIXME: Because we're relying on the hysteresis to just do the right thing + * the range is severely reduced (and you'll probably also need a good antenna). + * So this should be fixed some time in the future for a proper receiver. + */ +static void frame_receive_rwd(struct legic_frame * const f, int bits) +{ + uint16_t the_bit = 1; /* Use a bitmask to save on shifts */ + uint16_t data=0; + int i, old_level=0, edges=0; + int next_bit_at = TAG_TIME_WAIT; + + + if(bits > 16) + bits = 16; + + AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; + AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; + + while(timer->TC_CV < next_bit_at) ; + next_bit_at += TAG_TIME_BIT; + + for(i=0; iTC_CV < next_bit_at) { + int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); + if(level != old_level) + edges++; + old_level = level; + } + next_bit_at += TAG_TIME_BIT; + + if(edges > 20 && edges < 60) { /* expected are 42 edges */ + data |= the_bit; + } + + + the_bit <<= 1; + } + + f->data = data; + f->bits = bits; +} + /* Figure out a response to a frame in tag mode */ static void frame_respond_tag(struct legic_frame const * const f) { @@ -220,3 +322,39 @@ void LegicRfSimulate(void) WDT_HIT(); } } + +void LegicRfReader(void) +{ + SetAdcMuxFor(GPIO_MUXSEL_HIPKD); + FpgaSetupSsc(); + FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX); + + /* Bitbang the transmitter */ + AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; + AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; + AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; + + setup_timer(); + + while(!BUTTON_PRESS()) { + /* Switch on carrier and let the tag charge for 1ms */ + AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; + SpinDelay(1); + + LED_A_ON(); + frame_send_rwd(queries[0].data, queries[0].bits); + LED_A_OFF(); + + frame_clean(¤t_frame); + LED_B_ON(); + frame_receive_rwd(¤t_frame, responses[0].bits); + LED_B_OFF(); + + /* Switch off carrier, make sure tag is reset */ + AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; + SpinDelay(10); + + WDT_HIT(); + } + +} diff --git a/armsrc/legicrf.h b/armsrc/legicrf.h index 39119dd1..0c9e69d9 100644 --- a/armsrc/legicrf.h +++ b/armsrc/legicrf.h @@ -8,5 +8,6 @@ #define LEGICRF_H_ extern void LegicRfSimulate(void); +extern void LegicRfReader(void); #endif /* LEGICRF_H_ */ diff --git a/include/usb_cmd.h b/include/usb_cmd.h index 5ff2f260..6932e45d 100644 --- a/include/usb_cmd.h +++ b/include/usb_cmd.h @@ -70,6 +70,7 @@ typedef struct { #define CMD_READER_ISO_14443a 0x0385 #define CMD_SIMULATE_MIFARE_CARD 0x0386 #define CMD_SIMULATE_TAG_LEGIC_RF 0x387 +#define CMD_READER_LEGIC_RF 0x388 // For measurements of the antenna tuning #define CMD_MEASURE_ANTENNA_TUNING 0x0400 diff --git a/winsrc/command.cpp b/winsrc/command.cpp index e94c234c..5892a8e5 100644 --- a/winsrc/command.cpp +++ b/winsrc/command.cpp @@ -214,6 +214,13 @@ static void CmdLegicRfSim(char *str) SendCommand(&c, FALSE); } +static void CmdLegicRfRead(char *str) +{ + UsbCommand c; + c.cmd = CMD_READER_LEGIC_RF; + SendCommand(&c, FALSE); +} + static void CmdFPGAOff(char *str) // ## FPGA Control { UsbCommand c; @@ -2908,6 +2915,7 @@ static struct { {"lcd", CmdLcd, 0, " -- Send command/data to LCD"}, {"lcdreset", CmdLcdReset, 0, "Hardware reset LCD"}, {"legicrfsim", CmdLegicRfSim, 0, "Start the LEGIC RF tag simulator"}, + {"legicrfread", CmdLegicRfRead, 0, "Start the LEGIC RF reader"}, {"load", CmdLoad, 1, " -- Load trace (to graph window"}, {"locomread", CmdLoCommandRead, 0, " <'0' period> <'1' period> ['h'] -- Modulate LF reader field to send command before read (all periods in microseconds) (option 'h' for 134)"}, {"loread", CmdLoread, 0, "['h'] -- Read 125/134 kHz LF ID-only tag (option 'h' for 134)"},