]>
Commit | Line | Data |
---|---|---|
15c4dc5a | 1 | //----------------------------------------------------------------------------- |
2 | // Miscellaneous routines for low frequency tag operations. | |
3 | // Tags supported here so far are Texas Instruments (TI), HID | |
4 | // Also routines for raw mode reading/simulating of LF waveform | |
5 | // | |
6 | //----------------------------------------------------------------------------- | |
e30c654b | 7 | #include "proxmark3.h" |
15c4dc5a | 8 | #include "apps.h" |
f7e3ed82 | 9 | #include "util.h" |
15c4dc5a | 10 | #include "hitag2.h" |
11 | #include "crc16.h" | |
9ab7a6c7 | 12 | #include "string.h" |
15c4dc5a | 13 | |
f7e3ed82 | 14 | void AcquireRawAdcSamples125k(int at134khz) |
15c4dc5a | 15 | { |
16 | if (at134khz) | |
17 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
18 | else | |
19 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
20 | ||
21 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER); | |
22 | ||
23 | // Connect the A/D to the peak-detected low-frequency path. | |
24 | SetAdcMuxFor(GPIO_MUXSEL_LOPKD); | |
25 | ||
26 | // Give it a bit of time for the resonant antenna to settle. | |
27 | SpinDelay(50); | |
28 | ||
29 | // Now set up the SSC to get the ADC samples that are now streaming at us. | |
30 | FpgaSetupSsc(); | |
31 | ||
32 | // Now call the acquisition routine | |
33 | DoAcquisition125k(); | |
34 | } | |
35 | ||
36 | // split into two routines so we can avoid timing issues after sending commands // | |
37 | void DoAcquisition125k(void) | |
38 | { | |
f7e3ed82 | 39 | uint8_t *dest = (uint8_t *)BigBuf; |
15c4dc5a | 40 | int n = sizeof(BigBuf); |
41 | int i; | |
e30c654b | 42 | |
15c4dc5a | 43 | memset(dest, 0, n); |
44 | i = 0; | |
45 | for(;;) { | |
46 | if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) { | |
47 | AT91C_BASE_SSC->SSC_THR = 0x43; | |
48 | LED_D_ON(); | |
49 | } | |
50 | if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) { | |
f7e3ed82 | 51 | dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR; |
15c4dc5a | 52 | i++; |
53 | LED_D_OFF(); | |
54 | if (i >= n) break; | |
55 | } | |
56 | } | |
57 | Dbprintf("buffer samples: %02x %02x %02x %02x %02x %02x %02x %02x ...", | |
58 | dest[0], dest[1], dest[2], dest[3], dest[4], dest[5], dest[6], dest[7]); | |
59 | } | |
60 | ||
f7e3ed82 | 61 | void ModThenAcquireRawAdcSamples125k(int delay_off, int period_0, int period_1, uint8_t *command) |
15c4dc5a | 62 | { |
f7e3ed82 | 63 | int at134khz; |
15c4dc5a | 64 | |
65 | /* Make sure the tag is reset */ | |
66 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
67 | SpinDelay(2500); | |
e30c654b | 68 | |
15c4dc5a | 69 | // see if 'h' was specified |
70 | if (command[strlen((char *) command) - 1] == 'h') | |
71 | at134khz = TRUE; | |
72 | else | |
73 | at134khz = FALSE; | |
74 | ||
75 | if (at134khz) | |
76 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
77 | else | |
78 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
79 | ||
80 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER); | |
81 | ||
82 | // Give it a bit of time for the resonant antenna to settle. | |
83 | SpinDelay(50); | |
84 | // And a little more time for the tag to fully power up | |
85 | SpinDelay(2000); | |
86 | ||
87 | // Now set up the SSC to get the ADC samples that are now streaming at us. | |
88 | FpgaSetupSsc(); | |
89 | ||
90 | // now modulate the reader field | |
91 | while(*command != '\0' && *command != ' ') { | |
92 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
93 | LED_D_OFF(); | |
94 | SpinDelayUs(delay_off); | |
95 | if (at134khz) | |
96 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
97 | else | |
98 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
99 | ||
100 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER); | |
101 | LED_D_ON(); | |
102 | if(*(command++) == '0') | |
103 | SpinDelayUs(period_0); | |
104 | else | |
105 | SpinDelayUs(period_1); | |
106 | } | |
107 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
108 | LED_D_OFF(); | |
109 | SpinDelayUs(delay_off); | |
110 | if (at134khz) | |
111 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
112 | else | |
113 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
114 | ||
115 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER); | |
116 | ||
117 | // now do the read | |
118 | DoAcquisition125k(); | |
119 | } | |
120 | ||
121 | /* blank r/w tag data stream | |
122 | ...0000000000000000 01111111 | |
123 | 1010101010101010101010101010101010101010101010101010101010101010 | |
124 | 0011010010100001 | |
125 | 01111111 | |
126 | 101010101010101[0]000... | |
127 | ||
128 | [5555fe852c5555555555555555fe0000] | |
129 | */ | |
130 | void ReadTItag(void) | |
131 | { | |
132 | // some hardcoded initial params | |
133 | // when we read a TI tag we sample the zerocross line at 2Mhz | |
134 | // TI tags modulate a 1 as 16 cycles of 123.2Khz | |
135 | // TI tags modulate a 0 as 16 cycles of 134.2Khz | |
136 | #define FSAMPLE 2000000 | |
137 | #define FREQLO 123200 | |
138 | #define FREQHI 134200 | |
139 | ||
140 | signed char *dest = (signed char *)BigBuf; | |
141 | int n = sizeof(BigBuf); | |
142 | // int *dest = GraphBuffer; | |
143 | // int n = GraphTraceLen; | |
144 | ||
145 | // 128 bit shift register [shift3:shift2:shift1:shift0] | |
f7e3ed82 | 146 | uint32_t shift3 = 0, shift2 = 0, shift1 = 0, shift0 = 0; |
15c4dc5a | 147 | |
148 | int i, cycles=0, samples=0; | |
149 | // how many sample points fit in 16 cycles of each frequency | |
f7e3ed82 | 150 | uint32_t sampleslo = (FSAMPLE<<4)/FREQLO, sampleshi = (FSAMPLE<<4)/FREQHI; |
15c4dc5a | 151 | // when to tell if we're close enough to one freq or another |
f7e3ed82 | 152 | uint32_t threshold = (sampleslo - sampleshi + 1)>>1; |
15c4dc5a | 153 | |
154 | // TI tags charge at 134.2Khz | |
155 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
156 | ||
157 | // Place FPGA in passthrough mode, in this mode the CROSS_LO line | |
158 | // connects to SSP_DIN and the SSP_DOUT logic level controls | |
159 | // whether we're modulating the antenna (high) | |
160 | // or listening to the antenna (low) | |
161 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU); | |
162 | ||
163 | // get TI tag data into the buffer | |
164 | AcquireTiType(); | |
165 | ||
166 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
167 | ||
168 | for (i=0; i<n-1; i++) { | |
169 | // count cycles by looking for lo to hi zero crossings | |
170 | if ( (dest[i]<0) && (dest[i+1]>0) ) { | |
171 | cycles++; | |
172 | // after 16 cycles, measure the frequency | |
173 | if (cycles>15) { | |
174 | cycles=0; | |
175 | samples=i-samples; // number of samples in these 16 cycles | |
176 | ||
177 | // TI bits are coming to us lsb first so shift them | |
178 | // right through our 128 bit right shift register | |
179 | shift0 = (shift0>>1) | (shift1 << 31); | |
180 | shift1 = (shift1>>1) | (shift2 << 31); | |
181 | shift2 = (shift2>>1) | (shift3 << 31); | |
182 | shift3 >>= 1; | |
183 | ||
184 | // check if the cycles fall close to the number | |
185 | // expected for either the low or high frequency | |
186 | if ( (samples>(sampleslo-threshold)) && (samples<(sampleslo+threshold)) ) { | |
187 | // low frequency represents a 1 | |
188 | shift3 |= (1<<31); | |
189 | } else if ( (samples>(sampleshi-threshold)) && (samples<(sampleshi+threshold)) ) { | |
190 | // high frequency represents a 0 | |
191 | } else { | |
192 | // probably detected a gay waveform or noise | |
193 | // use this as gaydar or discard shift register and start again | |
194 | shift3 = shift2 = shift1 = shift0 = 0; | |
195 | } | |
196 | samples = i; | |
197 | ||
198 | // for each bit we receive, test if we've detected a valid tag | |
199 | ||
200 | // if we see 17 zeroes followed by 6 ones, we might have a tag | |
201 | // remember the bits are backwards | |
202 | if ( ((shift0 & 0x7fffff) == 0x7e0000) ) { | |
203 | // if start and end bytes match, we have a tag so break out of the loop | |
204 | if ( ((shift0>>16)&0xff) == ((shift3>>8)&0xff) ) { | |
205 | cycles = 0xF0B; //use this as a flag (ugly but whatever) | |
206 | break; | |
207 | } | |
208 | } | |
209 | } | |
210 | } | |
211 | } | |
212 | ||
213 | // if flag is set we have a tag | |
214 | if (cycles!=0xF0B) { | |
215 | DbpString("Info: No valid tag detected."); | |
216 | } else { | |
217 | // put 64 bit data into shift1 and shift0 | |
218 | shift0 = (shift0>>24) | (shift1 << 8); | |
219 | shift1 = (shift1>>24) | (shift2 << 8); | |
220 | ||
221 | // align 16 bit crc into lower half of shift2 | |
222 | shift2 = ((shift2>>24) | (shift3 << 8)) & 0x0ffff; | |
223 | ||
224 | // if r/w tag, check ident match | |
225 | if ( shift3&(1<<15) ) { | |
226 | DbpString("Info: TI tag is rewriteable"); | |
227 | // only 15 bits compare, last bit of ident is not valid | |
228 | if ( ((shift3>>16)^shift0)&0x7fff ) { | |
229 | DbpString("Error: Ident mismatch!"); | |
230 | } else { | |
231 | DbpString("Info: TI tag ident is valid"); | |
232 | } | |
233 | } else { | |
234 | DbpString("Info: TI tag is readonly"); | |
235 | } | |
236 | ||
237 | // WARNING the order of the bytes in which we calc crc below needs checking | |
238 | // i'm 99% sure the crc algorithm is correct, but it may need to eat the | |
239 | // bytes in reverse or something | |
240 | // calculate CRC | |
f7e3ed82 | 241 | uint32_t crc=0; |
15c4dc5a | 242 | |
243 | crc = update_crc16(crc, (shift0)&0xff); | |
244 | crc = update_crc16(crc, (shift0>>8)&0xff); | |
245 | crc = update_crc16(crc, (shift0>>16)&0xff); | |
246 | crc = update_crc16(crc, (shift0>>24)&0xff); | |
247 | crc = update_crc16(crc, (shift1)&0xff); | |
248 | crc = update_crc16(crc, (shift1>>8)&0xff); | |
249 | crc = update_crc16(crc, (shift1>>16)&0xff); | |
250 | crc = update_crc16(crc, (shift1>>24)&0xff); | |
251 | ||
252 | Dbprintf("Info: Tag data: %x%08x, crc=%x", | |
253 | (unsigned int)shift1, (unsigned int)shift0, (unsigned int)shift2 & 0xFFFF); | |
254 | if (crc != (shift2&0xffff)) { | |
255 | Dbprintf("Error: CRC mismatch, expected %x", (unsigned int)crc); | |
256 | } else { | |
257 | DbpString("Info: CRC is good"); | |
258 | } | |
259 | } | |
260 | } | |
261 | ||
f7e3ed82 | 262 | void WriteTIbyte(uint8_t b) |
15c4dc5a | 263 | { |
264 | int i = 0; | |
265 | ||
266 | // modulate 8 bits out to the antenna | |
267 | for (i=0; i<8; i++) | |
268 | { | |
269 | if (b&(1<<i)) { | |
270 | // stop modulating antenna | |
271 | LOW(GPIO_SSC_DOUT); | |
272 | SpinDelayUs(1000); | |
273 | // modulate antenna | |
274 | HIGH(GPIO_SSC_DOUT); | |
275 | SpinDelayUs(1000); | |
276 | } else { | |
277 | // stop modulating antenna | |
278 | LOW(GPIO_SSC_DOUT); | |
279 | SpinDelayUs(300); | |
280 | // modulate antenna | |
281 | HIGH(GPIO_SSC_DOUT); | |
282 | SpinDelayUs(1700); | |
283 | } | |
284 | } | |
285 | } | |
286 | ||
287 | void AcquireTiType(void) | |
288 | { | |
289 | int i, j, n; | |
290 | // tag transmission is <20ms, sampling at 2M gives us 40K samples max | |
f7e3ed82 | 291 | // each sample is 1 bit stuffed into a uint32_t so we need 1250 uint32_t |
15c4dc5a | 292 | #define TIBUFLEN 1250 |
293 | ||
294 | // clear buffer | |
295 | memset(BigBuf,0,sizeof(BigBuf)); | |
296 | ||
297 | // Set up the synchronous serial port | |
298 | AT91C_BASE_PIOA->PIO_PDR = GPIO_SSC_DIN; | |
299 | AT91C_BASE_PIOA->PIO_ASR = GPIO_SSC_DIN; | |
300 | ||
301 | // steal this pin from the SSP and use it to control the modulation | |
302 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; | |
303 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
304 | ||
305 | AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST; | |
306 | AT91C_BASE_SSC->SSC_CR = AT91C_SSC_RXEN | AT91C_SSC_TXEN; | |
307 | ||
308 | // Sample at 2 Mbit/s, so TI tags are 16.2 vs. 14.9 clocks long | |
309 | // 48/2 = 24 MHz clock must be divided by 12 | |
310 | AT91C_BASE_SSC->SSC_CMR = 12; | |
311 | ||
312 | AT91C_BASE_SSC->SSC_RCMR = SSC_CLOCK_MODE_SELECT(0); | |
313 | AT91C_BASE_SSC->SSC_RFMR = SSC_FRAME_MODE_BITS_IN_WORD(32) | AT91C_SSC_MSBF; | |
314 | AT91C_BASE_SSC->SSC_TCMR = 0; | |
315 | AT91C_BASE_SSC->SSC_TFMR = 0; | |
316 | ||
317 | LED_D_ON(); | |
318 | ||
319 | // modulate antenna | |
320 | HIGH(GPIO_SSC_DOUT); | |
321 | ||
322 | // Charge TI tag for 50ms. | |
323 | SpinDelay(50); | |
324 | ||
325 | // stop modulating antenna and listen | |
326 | LOW(GPIO_SSC_DOUT); | |
327 | ||
328 | LED_D_OFF(); | |
329 | ||
330 | i = 0; | |
331 | for(;;) { | |
332 | if(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) { | |
333 | BigBuf[i] = AT91C_BASE_SSC->SSC_RHR; // store 32 bit values in buffer | |
334 | i++; if(i >= TIBUFLEN) break; | |
335 | } | |
336 | WDT_HIT(); | |
337 | } | |
338 | ||
339 | // return stolen pin to SSP | |
340 | AT91C_BASE_PIOA->PIO_PDR = GPIO_SSC_DOUT; | |
341 | AT91C_BASE_PIOA->PIO_ASR = GPIO_SSC_DIN | GPIO_SSC_DOUT; | |
342 | ||
343 | char *dest = (char *)BigBuf; | |
344 | n = TIBUFLEN*32; | |
345 | // unpack buffer | |
346 | for (i=TIBUFLEN-1; i>=0; i--) { | |
347 | for (j=0; j<32; j++) { | |
348 | if(BigBuf[i] & (1 << j)) { | |
349 | dest[--n] = 1; | |
350 | } else { | |
351 | dest[--n] = -1; | |
352 | } | |
353 | } | |
354 | } | |
355 | } | |
356 | ||
357 | // arguments: 64bit data split into 32bit idhi:idlo and optional 16bit crc | |
358 | // if crc provided, it will be written with the data verbatim (even if bogus) | |
359 | // if not provided a valid crc will be computed from the data and written. | |
f7e3ed82 | 360 | void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc) |
15c4dc5a | 361 | { |
362 | if(crc == 0) { | |
363 | crc = update_crc16(crc, (idlo)&0xff); | |
364 | crc = update_crc16(crc, (idlo>>8)&0xff); | |
365 | crc = update_crc16(crc, (idlo>>16)&0xff); | |
366 | crc = update_crc16(crc, (idlo>>24)&0xff); | |
367 | crc = update_crc16(crc, (idhi)&0xff); | |
368 | crc = update_crc16(crc, (idhi>>8)&0xff); | |
369 | crc = update_crc16(crc, (idhi>>16)&0xff); | |
370 | crc = update_crc16(crc, (idhi>>24)&0xff); | |
371 | } | |
372 | Dbprintf("Writing to tag: %x%08x, crc=%x", | |
373 | (unsigned int) idhi, (unsigned int) idlo, crc); | |
374 | ||
375 | // TI tags charge at 134.2Khz | |
376 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
377 | // Place FPGA in passthrough mode, in this mode the CROSS_LO line | |
378 | // connects to SSP_DIN and the SSP_DOUT logic level controls | |
379 | // whether we're modulating the antenna (high) | |
380 | // or listening to the antenna (low) | |
381 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU); | |
382 | LED_A_ON(); | |
383 | ||
384 | // steal this pin from the SSP and use it to control the modulation | |
385 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; | |
386 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
387 | ||
388 | // writing algorithm: | |
389 | // a high bit consists of a field off for 1ms and field on for 1ms | |
390 | // a low bit consists of a field off for 0.3ms and field on for 1.7ms | |
391 | // initiate a charge time of 50ms (field on) then immediately start writing bits | |
392 | // start by writing 0xBB (keyword) and 0xEB (password) | |
393 | // then write 80 bits of data (or 64 bit data + 16 bit crc if you prefer) | |
394 | // finally end with 0x0300 (write frame) | |
395 | // all data is sent lsb firts | |
396 | // finish with 15ms programming time | |
397 | ||
398 | // modulate antenna | |
399 | HIGH(GPIO_SSC_DOUT); | |
400 | SpinDelay(50); // charge time | |
401 | ||
402 | WriteTIbyte(0xbb); // keyword | |
403 | WriteTIbyte(0xeb); // password | |
404 | WriteTIbyte( (idlo )&0xff ); | |
405 | WriteTIbyte( (idlo>>8 )&0xff ); | |
406 | WriteTIbyte( (idlo>>16)&0xff ); | |
407 | WriteTIbyte( (idlo>>24)&0xff ); | |
408 | WriteTIbyte( (idhi )&0xff ); | |
409 | WriteTIbyte( (idhi>>8 )&0xff ); | |
410 | WriteTIbyte( (idhi>>16)&0xff ); | |
411 | WriteTIbyte( (idhi>>24)&0xff ); // data hi to lo | |
412 | WriteTIbyte( (crc )&0xff ); // crc lo | |
413 | WriteTIbyte( (crc>>8 )&0xff ); // crc hi | |
414 | WriteTIbyte(0x00); // write frame lo | |
415 | WriteTIbyte(0x03); // write frame hi | |
416 | HIGH(GPIO_SSC_DOUT); | |
417 | SpinDelay(50); // programming time | |
418 | ||
419 | LED_A_OFF(); | |
420 | ||
421 | // get TI tag data into the buffer | |
422 | AcquireTiType(); | |
423 | ||
424 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
425 | DbpString("Now use tiread to check"); | |
426 | } | |
427 | ||
428 | void SimulateTagLowFrequency(int period, int gap, int ledcontrol) | |
429 | { | |
430 | int i; | |
f7e3ed82 | 431 | uint8_t *tab = (uint8_t *)BigBuf; |
15c4dc5a | 432 | |
433 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR); | |
434 | ||
435 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK; | |
436 | ||
437 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
438 | AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK; | |
439 | ||
440 | #define SHORT_COIL() LOW(GPIO_SSC_DOUT) | |
441 | #define OPEN_COIL() HIGH(GPIO_SSC_DOUT) | |
442 | ||
443 | i = 0; | |
444 | for(;;) { | |
445 | while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) { | |
446 | if(BUTTON_PRESS()) { | |
447 | DbpString("Stopped"); | |
448 | return; | |
449 | } | |
450 | WDT_HIT(); | |
451 | } | |
452 | ||
453 | if (ledcontrol) | |
454 | LED_D_ON(); | |
455 | ||
456 | if(tab[i]) | |
457 | OPEN_COIL(); | |
458 | else | |
459 | SHORT_COIL(); | |
460 | ||
461 | if (ledcontrol) | |
462 | LED_D_OFF(); | |
463 | ||
464 | while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) { | |
465 | if(BUTTON_PRESS()) { | |
466 | DbpString("Stopped"); | |
467 | return; | |
468 | } | |
469 | WDT_HIT(); | |
470 | } | |
471 | ||
472 | i++; | |
473 | if(i == period) { | |
474 | i = 0; | |
e30c654b | 475 | if (gap) { |
15c4dc5a | 476 | SHORT_COIL(); |
477 | SpinDelayUs(gap); | |
478 | } | |
479 | } | |
480 | } | |
481 | } | |
482 | ||
483 | /* Provides a framework for bidirectional LF tag communication | |
484 | * Encoding is currently Hitag2, but the general idea can probably | |
485 | * be transferred to other encodings. | |
e30c654b | 486 | * |
15c4dc5a | 487 | * The new FPGA code will, for the LF simulator mode, give on SSC_FRAME |
488 | * (PA15) a thresholded version of the signal from the ADC. Setting the | |
489 | * ADC path to the low frequency peak detection signal, will enable a | |
490 | * somewhat reasonable receiver for modulation on the carrier signal | |
491 | * that is generated by the reader. The signal is low when the reader | |
492 | * field is switched off, and high when the reader field is active. Due | |
493 | * to the way that the signal looks like, mostly only the rising edge is | |
494 | * useful, your mileage may vary. | |
e30c654b | 495 | * |
15c4dc5a | 496 | * Neat perk: PA15 can not only be used as a bit-banging GPIO, but is also |
497 | * TIOA1, which can be used as the capture input for timer 1. This should | |
498 | * make it possible to measure the exact edge-to-edge time, without processor | |
499 | * intervention. | |
e30c654b | 500 | * |
15c4dc5a | 501 | * Arguments: divisor is the divisor to be sent to the FPGA (e.g. 95 for 125kHz) |
502 | * t0 is the carrier frequency cycle duration in terms of MCK (384 for 125kHz) | |
e30c654b | 503 | * |
504 | * The following defines are in carrier periods: | |
15c4dc5a | 505 | */ |
e30c654b | 506 | #define HITAG_T_0_MIN 15 /* T[0] should be 18..22 */ |
15c4dc5a | 507 | #define HITAG_T_1_MIN 24 /* T[1] should be 26..30 */ |
508 | #define HITAG_T_EOF 40 /* T_EOF should be > 36 */ | |
509 | #define HITAG_T_WRESP 208 /* T_wresp should be 204..212 */ | |
510 | ||
511 | static void hitag_handle_frame(int t0, int frame_len, char *frame); | |
512 | //#define DEBUG_RA_VALUES 1 | |
513 | #define DEBUG_FRAME_CONTENTS 1 | |
514 | void SimulateTagLowFrequencyBidir(int divisor, int t0) | |
515 | { | |
516 | #if DEBUG_RA_VALUES || DEBUG_FRAME_CONTENTS | |
517 | int i = 0; | |
518 | #endif | |
519 | char frame[10]; | |
520 | int frame_pos=0; | |
e30c654b | 521 | |
15c4dc5a | 522 | DbpString("Starting Hitag2 emulator, press button to end"); |
523 | hitag2_init(); | |
e30c654b | 524 | |
15c4dc5a | 525 | /* Set up simulator mode, frequency divisor which will drive the FPGA |
526 | * and analog mux selection. | |
527 | */ | |
528 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR); | |
529 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, divisor); | |
530 | SetAdcMuxFor(GPIO_MUXSEL_LOPKD); | |
531 | RELAY_OFF(); | |
e30c654b | 532 | |
15c4dc5a | 533 | /* Set up Timer 1: |
534 | * Capture mode, timer source MCK/2 (TIMER_CLOCK1), TIOA is external trigger, | |
535 | * external trigger rising edge, load RA on rising edge of TIOA, load RB on rising | |
536 | * edge of TIOA. Assign PA15 to TIOA1 (peripheral B) | |
537 | */ | |
e30c654b | 538 | |
15c4dc5a | 539 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); |
540 | AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME; | |
541 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; | |
542 | AT91C_BASE_TC1->TC_CMR = TC_CMR_TCCLKS_TIMER_CLOCK1 | | |
543 | AT91C_TC_ETRGEDG_RISING | | |
544 | AT91C_TC_ABETRG | | |
545 | AT91C_TC_LDRA_RISING | | |
546 | AT91C_TC_LDRB_RISING; | |
547 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | | |
548 | AT91C_TC_SWTRG; | |
e30c654b | 549 | |
15c4dc5a | 550 | /* calculate the new value for the carrier period in terms of TC1 values */ |
551 | t0 = t0/2; | |
e30c654b | 552 | |
15c4dc5a | 553 | int overflow = 0; |
554 | while(!BUTTON_PRESS()) { | |
555 | WDT_HIT(); | |
556 | if(AT91C_BASE_TC1->TC_SR & AT91C_TC_LDRAS) { | |
557 | int ra = AT91C_BASE_TC1->TC_RA; | |
558 | if((ra > t0*HITAG_T_EOF) | overflow) ra = t0*HITAG_T_EOF+1; | |
559 | #if DEBUG_RA_VALUES | |
560 | if(ra > 255 || overflow) ra = 255; | |
561 | ((char*)BigBuf)[i] = ra; | |
562 | i = (i+1) % 8000; | |
563 | #endif | |
e30c654b | 564 | |
15c4dc5a | 565 | if(overflow || (ra > t0*HITAG_T_EOF) || (ra < t0*HITAG_T_0_MIN)) { |
566 | /* Ignore */ | |
567 | } else if(ra >= t0*HITAG_T_1_MIN ) { | |
568 | /* '1' bit */ | |
569 | if(frame_pos < 8*sizeof(frame)) { | |
570 | frame[frame_pos / 8] |= 1<<( 7-(frame_pos%8) ); | |
571 | frame_pos++; | |
572 | } | |
573 | } else if(ra >= t0*HITAG_T_0_MIN) { | |
574 | /* '0' bit */ | |
575 | if(frame_pos < 8*sizeof(frame)) { | |
576 | frame[frame_pos / 8] |= 0<<( 7-(frame_pos%8) ); | |
577 | frame_pos++; | |
578 | } | |
579 | } | |
e30c654b | 580 | |
15c4dc5a | 581 | overflow = 0; |
582 | LED_D_ON(); | |
583 | } else { | |
584 | if(AT91C_BASE_TC1->TC_CV > t0*HITAG_T_EOF) { | |
585 | /* Minor nuisance: In Capture mode, the timer can not be | |
586 | * stopped by a Compare C. There's no way to stop the clock | |
587 | * in software, so we'll just have to note the fact that an | |
588 | * overflow happened and the next loaded timer value might | |
589 | * have wrapped. Also, this marks the end of frame, and the | |
590 | * still running counter can be used to determine the correct | |
591 | * time for the start of the reply. | |
e30c654b | 592 | */ |
15c4dc5a | 593 | overflow = 1; |
e30c654b | 594 | |
15c4dc5a | 595 | if(frame_pos > 0) { |
596 | /* Have a frame, do something with it */ | |
597 | #if DEBUG_FRAME_CONTENTS | |
598 | ((char*)BigBuf)[i++] = frame_pos; | |
599 | memcpy( ((char*)BigBuf)+i, frame, 7); | |
600 | i+=7; | |
601 | i = i % sizeof(BigBuf); | |
602 | #endif | |
603 | hitag_handle_frame(t0, frame_pos, frame); | |
604 | memset(frame, 0, sizeof(frame)); | |
605 | } | |
606 | frame_pos = 0; | |
607 | ||
608 | } | |
609 | LED_D_OFF(); | |
610 | } | |
611 | } | |
612 | DbpString("All done"); | |
613 | } | |
614 | ||
615 | static void hitag_send_bit(int t0, int bit) { | |
616 | if(bit == 1) { | |
617 | /* Manchester: Loaded, then unloaded */ | |
618 | LED_A_ON(); | |
619 | SHORT_COIL(); | |
620 | while(AT91C_BASE_TC1->TC_CV < t0*15); | |
621 | OPEN_COIL(); | |
622 | while(AT91C_BASE_TC1->TC_CV < t0*31); | |
623 | LED_A_OFF(); | |
624 | } else if(bit == 0) { | |
625 | /* Manchester: Unloaded, then loaded */ | |
626 | LED_B_ON(); | |
627 | OPEN_COIL(); | |
628 | while(AT91C_BASE_TC1->TC_CV < t0*15); | |
629 | SHORT_COIL(); | |
630 | while(AT91C_BASE_TC1->TC_CV < t0*31); | |
631 | LED_B_OFF(); | |
632 | } | |
633 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG; /* Reset clock for the next bit */ | |
e30c654b | 634 | |
15c4dc5a | 635 | } |
636 | static void hitag_send_frame(int t0, int frame_len, const char const * frame, int fdt) | |
637 | { | |
638 | OPEN_COIL(); | |
639 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
e30c654b | 640 | |
15c4dc5a | 641 | /* Wait for HITAG_T_WRESP carrier periods after the last reader bit, |
642 | * not that since the clock counts since the rising edge, but T_wresp is | |
643 | * with respect to the falling edge, we need to wait actually (T_wresp - T_g) | |
644 | * periods. The gap time T_g varies (4..10). | |
645 | */ | |
646 | while(AT91C_BASE_TC1->TC_CV < t0*(fdt-8)); | |
647 | ||
648 | int saved_cmr = AT91C_BASE_TC1->TC_CMR; | |
649 | AT91C_BASE_TC1->TC_CMR &= ~AT91C_TC_ETRGEDG; /* Disable external trigger for the clock */ | |
650 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG; /* Reset the clock and use it for response timing */ | |
e30c654b | 651 | |
15c4dc5a | 652 | int i; |
653 | for(i=0; i<5; i++) | |
654 | hitag_send_bit(t0, 1); /* Start of frame */ | |
e30c654b | 655 | |
15c4dc5a | 656 | for(i=0; i<frame_len; i++) { |
657 | hitag_send_bit(t0, !!(frame[i/ 8] & (1<<( 7-(i%8) ))) ); | |
658 | } | |
e30c654b | 659 | |
15c4dc5a | 660 | OPEN_COIL(); |
661 | AT91C_BASE_TC1->TC_CMR = saved_cmr; | |
662 | } | |
663 | ||
664 | /* Callback structure to cleanly separate tag emulation code from the radio layer. */ | |
665 | static int hitag_cb(const char* response_data, const int response_length, const int fdt, void *cb_cookie) | |
666 | { | |
667 | hitag_send_frame(*(int*)cb_cookie, response_length, response_data, fdt); | |
668 | return 0; | |
669 | } | |
670 | /* Frame length in bits, frame contents in MSBit first format */ | |
671 | static void hitag_handle_frame(int t0, int frame_len, char *frame) | |
672 | { | |
673 | hitag2_handle_command(frame, frame_len, hitag_cb, &t0); | |
674 | } | |
675 | ||
676 | // compose fc/8 fc/10 waveform | |
677 | static void fc(int c, int *n) { | |
f7e3ed82 | 678 | uint8_t *dest = (uint8_t *)BigBuf; |
15c4dc5a | 679 | int idx; |
680 | ||
681 | // for when we want an fc8 pattern every 4 logical bits | |
682 | if(c==0) { | |
683 | dest[((*n)++)]=1; | |
684 | dest[((*n)++)]=1; | |
685 | dest[((*n)++)]=0; | |
686 | dest[((*n)++)]=0; | |
687 | dest[((*n)++)]=0; | |
688 | dest[((*n)++)]=0; | |
689 | dest[((*n)++)]=0; | |
690 | dest[((*n)++)]=0; | |
691 | } | |
692 | // an fc/8 encoded bit is a bit pattern of 11000000 x6 = 48 samples | |
693 | if(c==8) { | |
694 | for (idx=0; idx<6; idx++) { | |
695 | dest[((*n)++)]=1; | |
696 | dest[((*n)++)]=1; | |
697 | dest[((*n)++)]=0; | |
698 | dest[((*n)++)]=0; | |
699 | dest[((*n)++)]=0; | |
700 | dest[((*n)++)]=0; | |
701 | dest[((*n)++)]=0; | |
702 | dest[((*n)++)]=0; | |
703 | } | |
704 | } | |
705 | ||
706 | // an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples | |
707 | if(c==10) { | |
708 | for (idx=0; idx<5; idx++) { | |
709 | dest[((*n)++)]=1; | |
710 | dest[((*n)++)]=1; | |
711 | dest[((*n)++)]=1; | |
712 | dest[((*n)++)]=0; | |
713 | dest[((*n)++)]=0; | |
714 | dest[((*n)++)]=0; | |
715 | dest[((*n)++)]=0; | |
716 | dest[((*n)++)]=0; | |
717 | dest[((*n)++)]=0; | |
718 | dest[((*n)++)]=0; | |
719 | } | |
720 | } | |
721 | } | |
722 | ||
723 | // prepare a waveform pattern in the buffer based on the ID given then | |
724 | // simulate a HID tag until the button is pressed | |
725 | void CmdHIDsimTAG(int hi, int lo, int ledcontrol) | |
726 | { | |
727 | int n=0, i=0; | |
728 | /* | |
729 | HID tag bitstream format | |
730 | The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits | |
731 | A 1 bit is represented as 6 fc8 and 5 fc10 patterns | |
732 | A 0 bit is represented as 5 fc10 and 6 fc8 patterns | |
733 | A fc8 is inserted before every 4 bits | |
734 | A special start of frame pattern is used consisting a0b0 where a and b are neither 0 | |
735 | nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10) | |
736 | */ | |
737 | ||
738 | if (hi>0xFFF) { | |
739 | DbpString("Tags can only have 44 bits."); | |
740 | return; | |
741 | } | |
742 | fc(0,&n); | |
743 | // special start of frame marker containing invalid bit sequences | |
744 | fc(8, &n); fc(8, &n); // invalid | |
745 | fc(8, &n); fc(10, &n); // logical 0 | |
746 | fc(10, &n); fc(10, &n); // invalid | |
747 | fc(8, &n); fc(10, &n); // logical 0 | |
748 | ||
749 | WDT_HIT(); | |
750 | // manchester encode bits 43 to 32 | |
751 | for (i=11; i>=0; i--) { | |
752 | if ((i%4)==3) fc(0,&n); | |
753 | if ((hi>>i)&1) { | |
754 | fc(10, &n); fc(8, &n); // low-high transition | |
755 | } else { | |
756 | fc(8, &n); fc(10, &n); // high-low transition | |
757 | } | |
758 | } | |
759 | ||
760 | WDT_HIT(); | |
761 | // manchester encode bits 31 to 0 | |
762 | for (i=31; i>=0; i--) { | |
763 | if ((i%4)==3) fc(0,&n); | |
764 | if ((lo>>i)&1) { | |
765 | fc(10, &n); fc(8, &n); // low-high transition | |
766 | } else { | |
767 | fc(8, &n); fc(10, &n); // high-low transition | |
768 | } | |
769 | } | |
770 | ||
771 | if (ledcontrol) | |
772 | LED_A_ON(); | |
773 | SimulateTagLowFrequency(n, 0, ledcontrol); | |
774 | ||
775 | if (ledcontrol) | |
776 | LED_A_OFF(); | |
777 | } | |
778 | ||
779 | ||
780 | // loop to capture raw HID waveform then FSK demodulate the TAG ID from it | |
781 | void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol) | |
782 | { | |
f7e3ed82 | 783 | uint8_t *dest = (uint8_t *)BigBuf; |
15c4dc5a | 784 | int m=0, n=0, i=0, idx=0, found=0, lastval=0; |
f7e3ed82 | 785 | uint32_t hi=0, lo=0; |
15c4dc5a | 786 | |
787 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
788 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER); | |
789 | ||
790 | // Connect the A/D to the peak-detected low-frequency path. | |
791 | SetAdcMuxFor(GPIO_MUXSEL_LOPKD); | |
792 | ||
793 | // Give it a bit of time for the resonant antenna to settle. | |
794 | SpinDelay(50); | |
795 | ||
796 | // Now set up the SSC to get the ADC samples that are now streaming at us. | |
797 | FpgaSetupSsc(); | |
798 | ||
799 | for(;;) { | |
800 | WDT_HIT(); | |
801 | if (ledcontrol) | |
802 | LED_A_ON(); | |
803 | if(BUTTON_PRESS()) { | |
804 | DbpString("Stopped"); | |
805 | if (ledcontrol) | |
806 | LED_A_OFF(); | |
807 | return; | |
808 | } | |
809 | ||
810 | i = 0; | |
811 | m = sizeof(BigBuf); | |
812 | memset(dest,128,m); | |
813 | for(;;) { | |
814 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { | |
815 | AT91C_BASE_SSC->SSC_THR = 0x43; | |
816 | if (ledcontrol) | |
817 | LED_D_ON(); | |
818 | } | |
819 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { | |
f7e3ed82 | 820 | dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR; |
15c4dc5a | 821 | // we don't care about actual value, only if it's more or less than a |
822 | // threshold essentially we capture zero crossings for later analysis | |
823 | if(dest[i] < 127) dest[i] = 0; else dest[i] = 1; | |
824 | i++; | |
825 | if (ledcontrol) | |
826 | LED_D_OFF(); | |
827 | if(i >= m) { | |
828 | break; | |
829 | } | |
830 | } | |
831 | } | |
832 | ||
833 | // FSK demodulator | |
834 | ||
835 | // sync to first lo-hi transition | |
836 | for( idx=1; idx<m; idx++) { | |
837 | if (dest[idx-1]<dest[idx]) | |
838 | lastval=idx; | |
839 | break; | |
840 | } | |
841 | WDT_HIT(); | |
842 | ||
843 | // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8) | |
844 | // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere | |
845 | // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10 | |
846 | for( i=0; idx<m; idx++) { | |
847 | if (dest[idx-1]<dest[idx]) { | |
848 | dest[i]=idx-lastval; | |
849 | if (dest[i] <= 8) { | |
850 | dest[i]=1; | |
851 | } else { | |
852 | dest[i]=0; | |
853 | } | |
854 | ||
855 | lastval=idx; | |
856 | i++; | |
857 | } | |
858 | } | |
859 | m=i; | |
860 | WDT_HIT(); | |
861 | ||
862 | // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns | |
863 | lastval=dest[0]; | |
864 | idx=0; | |
865 | i=0; | |
866 | n=0; | |
867 | for( idx=0; idx<m; idx++) { | |
868 | if (dest[idx]==lastval) { | |
869 | n++; | |
870 | } else { | |
871 | // a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents, | |
872 | // an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets | |
873 | // swallowed up by rounding | |
874 | // expected results are 1 or 2 bits, any more and it's an invalid manchester encoding | |
875 | // special start of frame markers use invalid manchester states (no transitions) by using sequences | |
876 | // like 111000 | |
877 | if (dest[idx-1]) { | |
878 | n=(n+1)/6; // fc/8 in sets of 6 | |
879 | } else { | |
880 | n=(n+1)/5; // fc/10 in sets of 5 | |
881 | } | |
882 | switch (n) { // stuff appropriate bits in buffer | |
883 | case 0: | |
884 | case 1: // one bit | |
885 | dest[i++]=dest[idx-1]; | |
886 | break; | |
887 | case 2: // two bits | |
888 | dest[i++]=dest[idx-1]; | |
889 | dest[i++]=dest[idx-1]; | |
890 | break; | |
891 | case 3: // 3 bit start of frame markers | |
892 | dest[i++]=dest[idx-1]; | |
893 | dest[i++]=dest[idx-1]; | |
894 | dest[i++]=dest[idx-1]; | |
895 | break; | |
896 | // When a logic 0 is immediately followed by the start of the next transmisson | |
897 | // (special pattern) a pattern of 4 bit duration lengths is created. | |
898 | case 4: | |
899 | dest[i++]=dest[idx-1]; | |
900 | dest[i++]=dest[idx-1]; | |
901 | dest[i++]=dest[idx-1]; | |
902 | dest[i++]=dest[idx-1]; | |
903 | break; | |
904 | default: // this shouldn't happen, don't stuff any bits | |
905 | break; | |
906 | } | |
907 | n=0; | |
908 | lastval=dest[idx]; | |
909 | } | |
910 | } | |
911 | m=i; | |
912 | WDT_HIT(); | |
913 | ||
914 | // final loop, go over previously decoded manchester data and decode into usable tag ID | |
915 | // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0 | |
916 | for( idx=0; idx<m-6; idx++) { | |
917 | // search for a start of frame marker | |
918 | if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) ) | |
919 | { | |
920 | found=1; | |
921 | idx+=6; | |
922 | if (found && (hi|lo)) { | |
923 | Dbprintf("TAG ID: %x%08x (%d)", | |
924 | (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); | |
925 | /* if we're only looking for one tag */ | |
926 | if (findone) | |
927 | { | |
928 | *high = hi; | |
929 | *low = lo; | |
930 | return; | |
931 | } | |
932 | hi=0; | |
933 | lo=0; | |
934 | found=0; | |
935 | } | |
936 | } | |
937 | if (found) { | |
938 | if (dest[idx] && (!dest[idx+1]) ) { | |
939 | hi=(hi<<1)|(lo>>31); | |
940 | lo=(lo<<1)|0; | |
941 | } else if ( (!dest[idx]) && dest[idx+1]) { | |
942 | hi=(hi<<1)|(lo>>31); | |
943 | lo=(lo<<1)|1; | |
944 | } else { | |
945 | found=0; | |
946 | hi=0; | |
947 | lo=0; | |
948 | } | |
949 | idx++; | |
950 | } | |
951 | if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) ) | |
952 | { | |
953 | found=1; | |
954 | idx+=6; | |
955 | if (found && (hi|lo)) { | |
956 | Dbprintf("TAG ID: %x%08x (%d)", | |
957 | (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); | |
958 | /* if we're only looking for one tag */ | |
959 | if (findone) | |
960 | { | |
961 | *high = hi; | |
962 | *low = lo; | |
963 | return; | |
964 | } | |
965 | hi=0; | |
966 | lo=0; | |
967 | found=0; | |
968 | } | |
969 | } | |
970 | } | |
971 | WDT_HIT(); | |
972 | } | |
973 | } |