]> cvs.zerfleddert.de Git - proxmark3-svn/blame - fpga/hi_simulate.v
Add 'hf 15 csetuid' command to set UID on ISO15693 Magic tags (#842)
[proxmark3-svn] / fpga / hi_simulate.v
CommitLineData
ba06a4b6 1//-----------------------------------------------------------------------------
2// Pretend to be an ISO 14443 tag. We will do this by alternately short-
3// circuiting and open-circuiting the antenna coil, with the tri-state
4// pins.
5//
6// We communicate over the SSP, as a bitstream (i.e., might as well be
7// unframed, though we still generate the word sync signal). The output
8// (ARM -> FPGA) tells us whether to modulate or not. The input (FPGA
9// -> ARM) is us using the A/D as a fancy comparator; this is with
10// (software-added) hysteresis, to undo the high-pass filter.
11//
12// At this point only Type A is implemented. This means that we are using a
13// bit rate of 106 kbit/s, or fc/128. Oversample by 4, which ought to make
14// things practical for the ARM (fc/32, 423.8 kbits/s, ~50 kbytes/s)
15//
16// Jonathan Westhues, October 2006
17//-----------------------------------------------------------------------------
18
19module hi_simulate(
5ea2a248 20 ck_1356meg,
ba06a4b6 21 pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4,
22 adc_d, adc_clk,
23 ssp_frame, ssp_din, ssp_dout, ssp_clk,
ba06a4b6 24 dbg,
25 mod_type
26);
5ea2a248 27 input ck_1356meg;
ba06a4b6 28 output pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4;
29 input [7:0] adc_d;
30 output adc_clk;
31 input ssp_dout;
32 output ssp_frame, ssp_din, ssp_clk;
ba06a4b6 33 output dbg;
34 input [2:0] mod_type;
35
ba06a4b6 36
37// The comparator with hysteresis on the output from the peak detector.
38reg after_hysteresis;
39assign adc_clk = ck_1356meg;
40
41always @(negedge adc_clk)
42begin
5ea2a248 43 if(& adc_d[7:5]) after_hysteresis = 1'b1; // if (adc_d >= 224)
44 else if(~(| adc_d[7:5])) after_hysteresis = 1'b0; // if (adc_d <= 31)
ba06a4b6 45end
46
645c960f 47
1b902aa0 48// Divide 13.56 MHz to produce various frequencies for SSP_CLK
8c6cca0b 49// and modulation.
50reg [7:0] ssp_clk_divider;
645c960f 51
ba06a4b6 52always @(posedge adc_clk)
53 ssp_clk_divider <= (ssp_clk_divider + 1);
645c960f
MHS
54
55reg ssp_clk;
1b902aa0 56
645c960f
MHS
57always @(negedge adc_clk)
58begin
5ea2a248 59 if(mod_type == `FPGA_HF_SIMULATOR_MODULATE_424K_8BIT)
1b902aa0
A
60 // Get bit every at 53KHz (every 8th carrier bit of 424kHz)
61 ssp_clk <= ssp_clk_divider[7];
5ea2a248 62 else if(mod_type == `FPGA_HF_SIMULATOR_MODULATE_212K)
1b902aa0
A
63 // Get next bit at 212kHz
64 ssp_clk <= ssp_clk_divider[5];
645c960f 65 else
1b902aa0
A
66 // Get next bit at 424Khz
67 ssp_clk <= ssp_clk_divider[4];
645c960f
MHS
68end
69
70
ba06a4b6 71// Divide SSP_CLK by 8 to produce the byte framing signal; the phase of
72// this is arbitrary, because it's just a bitstream.
73// One nasty issue, though: I can't make it work with both rx and tx at
74// once. The phase wrt ssp_clk must be changed. TODO to find out why
75// that is and make a better fix.
76reg [2:0] ssp_frame_divider_to_arm;
77always @(posedge ssp_clk)
78 ssp_frame_divider_to_arm <= (ssp_frame_divider_to_arm + 1);
79reg [2:0] ssp_frame_divider_from_arm;
80always @(negedge ssp_clk)
81 ssp_frame_divider_from_arm <= (ssp_frame_divider_from_arm + 1);
82
645c960f 83
1b902aa0 84reg ssp_frame;
ba06a4b6 85always @(ssp_frame_divider_to_arm or ssp_frame_divider_from_arm or mod_type)
5ea2a248 86 if(mod_type == `FPGA_HF_SIMULATOR_NO_MODULATION) // not modulating, so listening, to ARM
ba06a4b6 87 ssp_frame = (ssp_frame_divider_to_arm == 3'b000);
88 else
1b902aa0 89 ssp_frame = (ssp_frame_divider_from_arm == 3'b000);
ba06a4b6 90
91// Synchronize up the after-hysteresis signal, to produce DIN.
92reg ssp_din;
93always @(posedge ssp_clk)
94 ssp_din = after_hysteresis;
95
1b902aa0 96// Modulating carrier frequency is fc/64 (212kHz) to fc/16 (848kHz). Reuse ssp_clk divider for that.
ba06a4b6 97reg modulating_carrier;
5ea2a248 98always @(*)
99 if (mod_type == `FPGA_HF_SIMULATOR_NO_MODULATION)
ba06a4b6 100 modulating_carrier <= 1'b0; // no modulation
5ea2a248 101 else if (mod_type == `FPGA_HF_SIMULATOR_MODULATE_BPSK)
ba06a4b6 102 modulating_carrier <= ssp_dout ^ ssp_clk_divider[3]; // XOR means BPSK
5ea2a248 103 else if (mod_type == `FPGA_HF_SIMULATOR_MODULATE_212K)
1b902aa0 104 modulating_carrier <= ssp_dout & ssp_clk_divider[5]; // switch 212kHz subcarrier on/off
5ea2a248 105 else if (mod_type == `FPGA_HF_SIMULATOR_MODULATE_424K || mod_type == `FPGA_HF_SIMULATOR_MODULATE_424K_8BIT)
1b902aa0 106 modulating_carrier <= ssp_dout & ssp_clk_divider[4]; // switch 424kHz modulation on/off
ba06a4b6 107 else
108 modulating_carrier <= 1'b0; // yet unused
109
ba06a4b6 110
8c6cca0b 111// Load modulation. Toggle only one of these, since we are already producing much deeper
ba06a4b6 112// modulation than a real tag would.
8c6cca0b 113assign pwr_hi = 1'b0; // HF antenna connected to GND
114assign pwr_oe3 = 1'b0; // 10k Load
115assign pwr_oe1 = modulating_carrier; // 33 Ohms Load
116assign pwr_oe4 = modulating_carrier; // 33 Ohms Load
117
118// This is all LF and doesn't matter
119assign pwr_lo = 1'b0;
120assign pwr_oe2 = 1'b0;
ba06a4b6 121
ba06a4b6 122
1b902aa0 123assign dbg = ssp_din;
ba06a4b6 124
125endmodule
Impressum, Datenschutz