]>
Commit | Line | Data |
---|---|---|
a7247d85 | 1 | /* |
2 | * LEGIC RF simulation code | |
3 | * | |
4 | * (c) 2009 Henryk Plötz <henryk@ploetzli.ch> | |
5 | */ | |
6 | ||
7 | #include <proxmark3.h> | |
8 | ||
9 | #include "apps.h" | |
10 | #include "legicrf.h" | |
ccedd6ae | 11 | #include "unistd.h" |
12 | #include "stdint.h" | |
a7247d85 | 13 | |
14 | static struct legic_frame { | |
ccedd6ae | 15 | int bits; |
16 | uint16_t data; | |
a7247d85 | 17 | } current_frame; |
add16a62 | 18 | AT91PS_TC timer; |
19 | ||
20 | static void setup_timer(void) | |
21 | { | |
22 | /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging | |
23 | * this it won't be terribly accurate but should be good enough. | |
24 | */ | |
25 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); | |
26 | timer = AT91C_BASE_TC1; | |
27 | timer->TC_CCR = AT91C_TC_CLKDIS; | |
28 | timer->TC_CMR = TC_CMR_TCCLKS_TIMER_CLOCK3; | |
29 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; | |
30 | ||
31 | /* At TIMER_CLOCK3 (MCK/32) */ | |
32 | #define RWD_TIME_1 150 /* RWD_TIME_PAUSE off, 80us on = 100us */ | |
33 | #define RWD_TIME_0 90 /* RWD_TIME_PAUSE off, 40us on = 60us */ | |
34 | #define RWD_TIME_PAUSE 30 /* 20us */ | |
35 | #define RWD_TIME_FUZZ 20 /* rather generous 13us, since the peak detector + hysteresis fuzz quite a bit */ | |
36 | #define TAG_TIME_BIT 150 /* 100us for every bit */ | |
37 | #define TAG_TIME_WAIT 490 /* time from RWD frame end to tag frame start, experimentally determined */ | |
38 | ||
39 | } | |
40 | ||
41 | #define FUZZ_EQUAL(value, target, fuzz) ((value) > ((target)-(fuzz)) && (value) < ((target)+(fuzz))) | |
aac23b24 | 42 | |
4014b814 | 43 | static const struct legic_frame queries[] = { |
aac23b24 | 44 | {7, 0x55}, /* 1010 101 */ |
45 | }; | |
ccedd6ae | 46 | |
4014b814 | 47 | static const struct legic_frame responses[] = { |
aac23b24 | 48 | {6, 0x3b}, /* 1101 11 */ |
49 | }; | |
a7247d85 | 50 | |
add16a62 | 51 | /* Send a frame in tag mode, the FPGA must have been set up by |
52 | * LegicRfSimulate | |
53 | */ | |
54 | static void frame_send_tag(uint16_t response, int bits) | |
a7247d85 | 55 | { |
56 | #if 0 | |
57 | /* Use the SSC to send a response. 8-bit transfers, LSBit first, 100us per bit */ | |
58 | #else | |
59 | /* Bitbang the response */ | |
60 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
61 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
62 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; | |
63 | ||
64 | /* Wait for the frame start */ | |
add16a62 | 65 | while(timer->TC_CV < TAG_TIME_WAIT) ; |
a7247d85 | 66 | |
67 | int i; | |
ccedd6ae | 68 | for(i=0; i<bits; i++) { |
add16a62 | 69 | int nextbit = timer->TC_CV + TAG_TIME_BIT; |
ccedd6ae | 70 | int bit = response & 1; |
71 | response = response >> 1; | |
a7247d85 | 72 | if(bit) |
73 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; | |
74 | else | |
75 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
add16a62 | 76 | while(timer->TC_CV < nextbit) ; |
a7247d85 | 77 | } |
78 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
79 | #endif | |
80 | } | |
81 | ||
dcc10e5e | 82 | /* Send a frame in reader mode, the FPGA must have been set up by |
83 | * LegicRfReader | |
84 | */ | |
85 | static void frame_send_rwd(uint16_t data, int bits) | |
86 | { | |
87 | /* Start clock */ | |
88 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; | |
89 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ | |
90 | ||
91 | int i; | |
92 | for(i=0; i<bits; i++) { | |
93 | int starttime = timer->TC_CV; | |
94 | int pause_end = starttime + RWD_TIME_PAUSE, bit_end; | |
95 | int bit = data & 1; | |
96 | data = data >> 1; | |
97 | ||
98 | if(bit) { | |
99 | bit_end = starttime + RWD_TIME_1; | |
100 | } else { | |
101 | bit_end = starttime + RWD_TIME_0; | |
102 | } | |
103 | ||
104 | /* RWD_TIME_PAUSE time off, then some time on, so that the complete bit time is | |
105 | * RWD_TIME_x, where x is the bit to be transmitted */ | |
106 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
107 | while(timer->TC_CV < pause_end) ; | |
108 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; | |
109 | while(timer->TC_CV < bit_end) ; | |
110 | } | |
111 | ||
112 | { | |
113 | /* One final pause to mark the end of the frame */ | |
114 | int pause_end = timer->TC_CV + RWD_TIME_PAUSE; | |
115 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
116 | while(timer->TC_CV < pause_end) ; | |
117 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; | |
118 | } | |
119 | ||
120 | /* Reset the timer, to measure time until the start of the tag frame */ | |
121 | timer->TC_CCR = AT91C_TC_SWTRG; | |
122 | } | |
123 | ||
124 | /* Receive a frame from the card in reader emulation mode, the FPGA and | |
125 | * timer must have been set up by LegicRfReader and frame_send_rwd. | |
126 | * | |
127 | * The LEGIC RF protocol from card to reader does not include explicit | |
128 | * frame start/stop information or length information. The reader must | |
129 | * know beforehand how many bits it wants to receive. (Notably: a card | |
130 | * sending a stream of 0-bits is indistinguishable from no card present.) | |
131 | * | |
132 | * Receive methodology: There is a fancy correlator in hi_read_rx_xcorr, but | |
133 | * I'm not smart enough to use it. Instead I have patched hi_read_tx to output | |
134 | * the ADC signal with hysteresis on SSP_DIN. Bit-bang that signal and look | |
135 | * for edges. Count the edges in each bit interval. If they are approximately | |
136 | * 0 this was a 0-bit, if they are approximately equal to the number of edges | |
137 | * expected for a 212kHz subcarrier, this was a 1-bit. For timing we use the | |
138 | * timer that's still running from frame_send_rwd in order to get a synchronization | |
139 | * with the frame that we just sent. | |
140 | * | |
141 | * FIXME: Because we're relying on the hysteresis to just do the right thing | |
142 | * the range is severely reduced (and you'll probably also need a good antenna). | |
143 | * So this should be fixed some time in the future for a proper receiver. | |
144 | */ | |
145 | static void frame_receive_rwd(struct legic_frame * const f, int bits) | |
146 | { | |
147 | uint16_t the_bit = 1; /* Use a bitmask to save on shifts */ | |
148 | uint16_t data=0; | |
149 | int i, old_level=0, edges=0; | |
150 | int next_bit_at = TAG_TIME_WAIT; | |
151 | ||
152 | ||
153 | if(bits > 16) | |
154 | bits = 16; | |
155 | ||
156 | AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; | |
157 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; | |
158 | ||
159 | while(timer->TC_CV < next_bit_at) ; | |
160 | next_bit_at += TAG_TIME_BIT; | |
161 | ||
162 | for(i=0; i<bits; i++) { | |
163 | edges = 0; | |
164 | while(timer->TC_CV < next_bit_at) { | |
165 | int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); | |
166 | if(level != old_level) | |
167 | edges++; | |
168 | old_level = level; | |
169 | } | |
170 | next_bit_at += TAG_TIME_BIT; | |
171 | ||
172 | if(edges > 20 && edges < 60) { /* expected are 42 edges */ | |
173 | data |= the_bit; | |
174 | } | |
175 | ||
176 | ||
177 | the_bit <<= 1; | |
178 | } | |
179 | ||
180 | f->data = data; | |
181 | f->bits = bits; | |
182 | } | |
183 | ||
add16a62 | 184 | /* Figure out a response to a frame in tag mode */ |
185 | static void frame_respond_tag(struct legic_frame const * const f) | |
a7247d85 | 186 | { |
187 | LED_D_ON(); | |
1dea88f9 | 188 | int i, r_size=0; |
189 | uint16_t r_data=0; | |
ccedd6ae | 190 | |
aac23b24 | 191 | for(i=0; i<sizeof(queries)/sizeof(queries[0]); i++) { |
ccedd6ae | 192 | if(f->bits == queries[i].bits && f->data == queries[i].data) { |
4014b814 | 193 | r_data = responses[i].data; |
194 | r_size = responses[i].bits; | |
aac23b24 | 195 | break; |
196 | } | |
197 | } | |
198 | ||
4014b814 | 199 | if(r_size != 0) { |
add16a62 | 200 | frame_send_tag(r_data, r_size); |
aac23b24 | 201 | LED_A_ON(); |
202 | } else { | |
203 | LED_A_OFF(); | |
a7247d85 | 204 | } |
aac23b24 | 205 | |
a7247d85 | 206 | LED_D_OFF(); |
207 | } | |
208 | ||
ccedd6ae | 209 | static void frame_append_bit(struct legic_frame * const f, int bit) |
a7247d85 | 210 | { |
ccedd6ae | 211 | if(f->bits >= 15) |
a7247d85 | 212 | return; /* Overflow, won't happen */ |
ccedd6ae | 213 | f->data |= (bit<<f->bits); |
214 | f->bits++; | |
a7247d85 | 215 | } |
216 | ||
ccedd6ae | 217 | static int frame_is_empty(struct legic_frame const * const f) |
a7247d85 | 218 | { |
ccedd6ae | 219 | return( f->bits <= 4 ); |
a7247d85 | 220 | } |
221 | ||
add16a62 | 222 | /* Handle (whether to respond) a frame in tag mode */ |
223 | static void frame_handle_tag(struct legic_frame const * const f) | |
a7247d85 | 224 | { |
ccedd6ae | 225 | if(f->bits == 6) { |
aac23b24 | 226 | /* Short path */ |
227 | return; | |
228 | } | |
a7247d85 | 229 | if( !frame_is_empty(f) ) { |
add16a62 | 230 | frame_respond_tag(f); |
a7247d85 | 231 | } |
232 | } | |
233 | ||
ccedd6ae | 234 | static void frame_clean(struct legic_frame * const f) |
a7247d85 | 235 | { |
ccedd6ae | 236 | f->data = 0; |
237 | f->bits = 0; | |
a7247d85 | 238 | } |
239 | ||
add16a62 | 240 | enum emit_mode { |
241 | EMIT_RWD, /* Emit in tag simulation mode, e.g. the source is the RWD */ | |
242 | EMIT_TAG /* Emit in reader simulation mode, e.g. the source is the TAG */ | |
243 | }; | |
244 | static void emit(enum emit_mode mode, int bit) | |
a7247d85 | 245 | { |
246 | if(bit == -1) { | |
add16a62 | 247 | if(mode == EMIT_RWD) { |
248 | frame_handle_tag(¤t_frame); | |
249 | } | |
a7247d85 | 250 | frame_clean(¤t_frame); |
251 | } else if(bit == 0) { | |
252 | frame_append_bit(¤t_frame, 0); | |
253 | } else if(bit == 1) { | |
254 | frame_append_bit(¤t_frame, 1); | |
255 | } | |
256 | } | |
257 | ||
258 | void LegicRfSimulate(void) | |
259 | { | |
260 | /* ADC path high-frequency peak detector, FPGA in high-frequency simulator mode, | |
261 | * modulation mode set to 212kHz subcarrier. We are getting the incoming raw | |
262 | * envelope waveform on DIN and should send our response on DOUT. | |
263 | * | |
264 | * The LEGIC RF protocol is pulse-pause-encoding from reader to card, so we'll | |
265 | * measure the time between two rising edges on DIN, and no encoding on the | |
266 | * subcarrier from card to reader, so we'll just shift out our verbatim data | |
267 | * on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear, | |
268 | * seems to be 300us-ish. | |
269 | */ | |
270 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
271 | FpgaSetupSsc(); | |
272 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_212K); | |
273 | ||
274 | /* Bitbang the receiver */ | |
275 | AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; | |
276 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; | |
277 | ||
add16a62 | 278 | setup_timer(); |
a7247d85 | 279 | |
add16a62 | 280 | int old_level = 0; |
a7247d85 | 281 | int active = 0; |
add16a62 | 282 | |
a7247d85 | 283 | while(!BUTTON_PRESS()) { |
284 | int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); | |
add16a62 | 285 | int time = timer->TC_CV; |
a7247d85 | 286 | |
287 | if(level != old_level) { | |
288 | if(level == 1) { | |
add16a62 | 289 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
290 | if(FUZZ_EQUAL(time, RWD_TIME_1, RWD_TIME_FUZZ)) { | |
a7247d85 | 291 | /* 1 bit */ |
add16a62 | 292 | emit(EMIT_RWD, 1); |
a7247d85 | 293 | active = 1; |
aac23b24 | 294 | LED_B_ON(); |
add16a62 | 295 | } else if(FUZZ_EQUAL(time, RWD_TIME_0, RWD_TIME_FUZZ)) { |
a7247d85 | 296 | /* 0 bit */ |
add16a62 | 297 | emit(EMIT_RWD, 0); |
aac23b24 | 298 | active = 1; |
299 | LED_B_ON(); | |
300 | } else if(active) { | |
a7247d85 | 301 | /* invalid */ |
add16a62 | 302 | emit(EMIT_RWD, -1); |
a7247d85 | 303 | active = 0; |
aac23b24 | 304 | LED_B_OFF(); |
a7247d85 | 305 | } |
306 | } | |
307 | } | |
308 | ||
add16a62 | 309 | if(time >= (RWD_TIME_1+RWD_TIME_FUZZ) && active) { |
a7247d85 | 310 | /* Frame end */ |
add16a62 | 311 | emit(EMIT_RWD, -1); |
a7247d85 | 312 | active = 0; |
aac23b24 | 313 | LED_B_OFF(); |
a7247d85 | 314 | } |
315 | ||
add16a62 | 316 | if(time >= (20*RWD_TIME_1) && (timer->TC_SR & AT91C_TC_CLKSTA)) { |
317 | timer->TC_CCR = AT91C_TC_CLKDIS; | |
a7247d85 | 318 | } |
319 | ||
320 | ||
321 | old_level = level; | |
322 | WDT_HIT(); | |
323 | } | |
324 | } | |
dcc10e5e | 325 | |
326 | void LegicRfReader(void) | |
327 | { | |
328 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
329 | FpgaSetupSsc(); | |
330 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX); | |
331 | ||
332 | /* Bitbang the transmitter */ | |
333 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
334 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
335 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; | |
336 | ||
337 | setup_timer(); | |
338 | ||
339 | while(!BUTTON_PRESS()) { | |
340 | /* Switch on carrier and let the tag charge for 1ms */ | |
341 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; | |
342 | SpinDelay(1); | |
343 | ||
344 | LED_A_ON(); | |
345 | frame_send_rwd(queries[0].data, queries[0].bits); | |
346 | LED_A_OFF(); | |
347 | ||
348 | frame_clean(¤t_frame); | |
349 | LED_B_ON(); | |
350 | frame_receive_rwd(¤t_frame, responses[0].bits); | |
351 | LED_B_OFF(); | |
352 | ||
353 | /* Switch off carrier, make sure tag is reset */ | |
354 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
355 | SpinDelay(10); | |
356 | ||
357 | WDT_HIT(); | |
358 | } | |
359 | ||
360 | } |