| 1 | //----------------------------------------------------------------------------- |
| 2 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
| 3 | // at your option, any later version. See the LICENSE.txt file for the text of |
| 4 | // the license. |
| 5 | //----------------------------------------------------------------------------- |
| 6 | // Hitag2 emulation (preliminary test version) |
| 7 | // |
| 8 | // (c) 2009 Henryk Plötz <henryk@ploetzli.ch> |
| 9 | //----------------------------------------------------------------------------- |
| 10 | // Hitag2 complete rewrite of the code |
| 11 | // - Fixed modulation/encoding issues |
| 12 | // - Rewrote code for transponder emulation |
| 13 | // - Added snooping of transponder communication |
| 14 | // - Added reader functionality |
| 15 | // |
| 16 | // (c) 2012 Roel Verdult |
| 17 | //----------------------------------------------------------------------------- |
| 18 | |
| 19 | #include "proxmark3.h" |
| 20 | #include "apps.h" |
| 21 | #include "util.h" |
| 22 | #include "hitag2.h" |
| 23 | #include "string.h" |
| 24 | #include "BigBuf.h" |
| 25 | |
| 26 | static bool bQuiet; |
| 27 | |
| 28 | static bool bCrypto; |
| 29 | static bool bAuthenticating; |
| 30 | static bool bPwd; |
| 31 | static bool bSuccessful; |
| 32 | |
| 33 | |
| 34 | |
| 35 | struct hitag2_tag { |
| 36 | uint32_t uid; |
| 37 | enum { |
| 38 | TAG_STATE_RESET = 0x01, // Just powered up, awaiting GetSnr |
| 39 | TAG_STATE_ACTIVATING = 0x02 , // In activation phase (password mode), sent UID, awaiting reader password |
| 40 | TAG_STATE_ACTIVATED = 0x03, // Activation complete, awaiting read/write commands |
| 41 | TAG_STATE_WRITING = 0x04, // In write command, awaiting sector contents to be written |
| 42 | } state; |
| 43 | unsigned int active_sector; |
| 44 | byte_t crypto_active; |
| 45 | uint64_t cs; |
| 46 | byte_t sectors[12][4]; |
| 47 | }; |
| 48 | |
| 49 | static struct hitag2_tag tag = { |
| 50 | .state = TAG_STATE_RESET, |
| 51 | .sectors = { // Password mode: | Crypto mode: |
| 52 | [0] = { 0x02, 0x4e, 0x02, 0x20}, // UID | UID |
| 53 | [1] = { 0x4d, 0x49, 0x4b, 0x52}, // Password RWD | 32 bit LSB key |
| 54 | [2] = { 0x20, 0xf0, 0x4f, 0x4e}, // Reserved | 16 bit MSB key, 16 bit reserved |
| 55 | [3] = { 0x0e, 0xaa, 0x48, 0x54}, // Configuration, password TAG | Configuration, password TAG |
| 56 | [4] = { 0x46, 0x5f, 0x4f, 0x4b}, // Data: F_OK |
| 57 | [5] = { 0x55, 0x55, 0x55, 0x55}, // Data: UUUU |
| 58 | [6] = { 0xaa, 0xaa, 0xaa, 0xaa}, // Data: .... |
| 59 | [7] = { 0x55, 0x55, 0x55, 0x55}, // Data: UUUU |
| 60 | [8] = { 0x00, 0x00, 0x00, 0x00}, // RSK Low |
| 61 | [9] = { 0x00, 0x00, 0x00, 0x00}, // RSK High |
| 62 | [10] = { 0x00, 0x00, 0x00, 0x00}, // RCF |
| 63 | [11] = { 0x00, 0x00, 0x00, 0x00}, // SYNC |
| 64 | }, |
| 65 | }; |
| 66 | |
| 67 | static enum { |
| 68 | WRITE_STATE_START = 0x0, |
| 69 | WRITE_STATE_PAGENUM_WRITTEN, |
| 70 | WRITE_STATE_PROG |
| 71 | } writestate; |
| 72 | |
| 73 | |
| 74 | // ToDo: define a meaningful maximum size for auth_table. The bigger this is, the lower will be the available memory for traces. |
| 75 | // Historically it used to be FREE_BUFFER_SIZE, which was 2744. |
| 76 | #define AUTH_TABLE_LENGTH 2744 |
| 77 | static byte_t* auth_table; |
| 78 | static size_t auth_table_pos = 0; |
| 79 | static size_t auth_table_len = AUTH_TABLE_LENGTH; |
| 80 | |
| 81 | static byte_t password[4]; |
| 82 | static byte_t NrAr[8]; |
| 83 | static byte_t key[8]; |
| 84 | static byte_t writedata[4]; |
| 85 | static uint64_t cipher_state; |
| 86 | |
| 87 | /* Following is a modified version of cryptolib.com/ciphers/hitag2/ */ |
| 88 | // Software optimized 48-bit Philips/NXP Mifare Hitag2 PCF7936/46/47/52 stream cipher algorithm by I.C. Wiener 2006-2007. |
| 89 | // For educational purposes only. |
| 90 | // No warranties or guarantees of any kind. |
| 91 | // This code is released into the public domain by its author. |
| 92 | |
| 93 | // Basic macros: |
| 94 | |
| 95 | #define u8 uint8_t |
| 96 | #define u32 uint32_t |
| 97 | #define u64 uint64_t |
| 98 | #define rev8(x) ((((x)>>7)&1)+((((x)>>6)&1)<<1)+((((x)>>5)&1)<<2)+((((x)>>4)&1)<<3)+((((x)>>3)&1)<<4)+((((x)>>2)&1)<<5)+((((x)>>1)&1)<<6)+(((x)&1)<<7)) |
| 99 | #define rev16(x) (rev8 (x)+(rev8 (x>> 8)<< 8)) |
| 100 | #define rev32(x) (rev16(x)+(rev16(x>>16)<<16)) |
| 101 | #define rev64(x) (rev32(x)+(rev32(x>>32)<<32)) |
| 102 | #define bit(x,n) (((x)>>(n))&1) |
| 103 | #define bit32(x,n) ((((x)[(n)>>5])>>((n)))&1) |
| 104 | #define inv32(x,i,n) ((x)[(i)>>5]^=((u32)(n))<<((i)&31)) |
| 105 | #define rotl64(x, n) ((((u64)(x))<<((n)&63))+(((u64)(x))>>((0-(n))&63))) |
| 106 | |
| 107 | // Single bit Hitag2 functions: |
| 108 | |
| 109 | #define i4(x,a,b,c,d) ((u32)((((x)>>(a))&1)+(((x)>>(b))&1)*2+(((x)>>(c))&1)*4+(((x)>>(d))&1)*8)) |
| 110 | |
| 111 | static const u32 ht2_f4a = 0x2C79; // 0010 1100 0111 1001 |
| 112 | static const u32 ht2_f4b = 0x6671; // 0110 0110 0111 0001 |
| 113 | static const u32 ht2_f5c = 0x7907287B; // 0111 1001 0000 0111 0010 1000 0111 1011 |
| 114 | |
| 115 | static u32 _f20 (const u64 x) |
| 116 | { |
| 117 | u32 i5; |
| 118 | |
| 119 | i5 = ((ht2_f4a >> i4 (x, 1, 2, 4, 5)) & 1)* 1 |
| 120 | + ((ht2_f4b >> i4 (x, 7,11,13,14)) & 1)* 2 |
| 121 | + ((ht2_f4b >> i4 (x,16,20,22,25)) & 1)* 4 |
| 122 | + ((ht2_f4b >> i4 (x,27,28,30,32)) & 1)* 8 |
| 123 | + ((ht2_f4a >> i4 (x,33,42,43,45)) & 1)*16; |
| 124 | |
| 125 | return (ht2_f5c >> i5) & 1; |
| 126 | } |
| 127 | |
| 128 | static u64 _hitag2_init (const u64 key, const u32 serial, const u32 IV) |
| 129 | { |
| 130 | u32 i; |
| 131 | u64 x = ((key & 0xFFFF) << 32) + serial; |
| 132 | |
| 133 | for (i = 0; i < 32; i++) |
| 134 | { |
| 135 | x >>= 1; |
| 136 | x += (u64) (_f20 (x) ^ (((IV >> i) ^ (key >> (i+16))) & 1)) << 47; |
| 137 | } |
| 138 | return x; |
| 139 | } |
| 140 | |
| 141 | static u64 _hitag2_round (u64 *state) |
| 142 | { |
| 143 | u64 x = *state; |
| 144 | |
| 145 | x = (x >> 1) + |
| 146 | ((((x >> 0) ^ (x >> 2) ^ (x >> 3) ^ (x >> 6) |
| 147 | ^ (x >> 7) ^ (x >> 8) ^ (x >> 16) ^ (x >> 22) |
| 148 | ^ (x >> 23) ^ (x >> 26) ^ (x >> 30) ^ (x >> 41) |
| 149 | ^ (x >> 42) ^ (x >> 43) ^ (x >> 46) ^ (x >> 47)) & 1) << 47); |
| 150 | |
| 151 | *state = x; |
| 152 | return _f20 (x); |
| 153 | } |
| 154 | |
| 155 | static u32 _hitag2_byte (u64 * x) |
| 156 | { |
| 157 | u32 i, c; |
| 158 | |
| 159 | for (i = 0, c = 0; i < 8; i++) c += (u32) _hitag2_round (x) << (i^7); |
| 160 | return c; |
| 161 | } |
| 162 | |
| 163 | static int hitag2_reset(void) |
| 164 | { |
| 165 | tag.state = TAG_STATE_RESET; |
| 166 | tag.crypto_active = 0; |
| 167 | return 0; |
| 168 | } |
| 169 | |
| 170 | static int hitag2_init(void) |
| 171 | { |
| 172 | // memcpy(&tag, &resetdata, sizeof(tag)); |
| 173 | hitag2_reset(); |
| 174 | return 0; |
| 175 | } |
| 176 | |
| 177 | static void hitag2_cipher_reset(struct hitag2_tag *tag, const byte_t *iv) |
| 178 | { |
| 179 | uint64_t key = ((uint64_t)tag->sectors[2][2]) | |
| 180 | ((uint64_t)tag->sectors[2][3] << 8) | |
| 181 | ((uint64_t)tag->sectors[1][0] << 16) | |
| 182 | ((uint64_t)tag->sectors[1][1] << 24) | |
| 183 | ((uint64_t)tag->sectors[1][2] << 32) | |
| 184 | ((uint64_t)tag->sectors[1][3] << 40); |
| 185 | uint32_t uid = ((uint32_t)tag->sectors[0][0]) | |
| 186 | ((uint32_t)tag->sectors[0][1] << 8) | |
| 187 | ((uint32_t)tag->sectors[0][2] << 16) | |
| 188 | ((uint32_t)tag->sectors[0][3] << 24); |
| 189 | uint32_t iv_ = (((uint32_t)(iv[0]))) | |
| 190 | (((uint32_t)(iv[1])) << 8) | |
| 191 | (((uint32_t)(iv[2])) << 16) | |
| 192 | (((uint32_t)(iv[3])) << 24); |
| 193 | tag->cs = _hitag2_init(rev64(key), rev32(uid), rev32(iv_)); |
| 194 | } |
| 195 | |
| 196 | static int hitag2_cipher_authenticate(uint64_t* cs, const byte_t *authenticator_is) |
| 197 | { |
| 198 | byte_t authenticator_should[4]; |
| 199 | authenticator_should[0] = ~_hitag2_byte(cs); |
| 200 | authenticator_should[1] = ~_hitag2_byte(cs); |
| 201 | authenticator_should[2] = ~_hitag2_byte(cs); |
| 202 | authenticator_should[3] = ~_hitag2_byte(cs); |
| 203 | return (memcmp(authenticator_should, authenticator_is, 4) == 0); |
| 204 | } |
| 205 | |
| 206 | static int hitag2_cipher_transcrypt(uint64_t* cs, byte_t *data, unsigned int bytes, unsigned int bits) |
| 207 | { |
| 208 | int i; |
| 209 | for(i=0; i<bytes; i++) data[i] ^= _hitag2_byte(cs); |
| 210 | for(i=0; i<bits; i++) data[bytes] ^= _hitag2_round(cs) << (7-i); |
| 211 | return 0; |
| 212 | } |
| 213 | |
| 214 | // Sam7s has several timers, we will use the source TIMER_CLOCK1 (aka AT91C_TC_CLKS_TIMER_DIV1_CLOCK) |
| 215 | // TIMER_CLOCK1 = MCK/2, MCK is running at 48 MHz, Timer is running at 48/2 = 24 MHz |
| 216 | // Hitag units (T0) have duration of 8 microseconds (us), which is 1/125000 per second (carrier) |
| 217 | // T0 = TIMER_CLOCK1 / 125000 = 192 |
| 218 | #define T0 192 |
| 219 | |
| 220 | #define SHORT_COIL() LOW(GPIO_SSC_DOUT) |
| 221 | #define OPEN_COIL() HIGH(GPIO_SSC_DOUT) |
| 222 | |
| 223 | #define HITAG_FRAME_LEN 20 |
| 224 | #define HITAG_T_STOP 36 /* T_EOF should be > 36 */ |
| 225 | #define HITAG_T_LOW 8 /* T_LOW should be 4..10 */ |
| 226 | #define HITAG_T_0_MIN 15 /* T[0] should be 18..22 */ |
| 227 | #define HITAG_T_1_MIN 25 /* T[1] should be 26..30 */ |
| 228 | //#define HITAG_T_EOF 40 /* T_EOF should be > 36 */ |
| 229 | #define HITAG_T_EOF 80 /* T_EOF should be > 36 */ |
| 230 | #define HITAG_T_WAIT_1 200 /* T_wresp should be 199..206 */ |
| 231 | #define HITAG_T_WAIT_2 90 /* T_wresp should be 199..206 */ |
| 232 | #define HITAG_T_WAIT_MAX 300 /* bit more than HITAG_T_WAIT_1 + HITAG_T_WAIT_2 */ |
| 233 | #define HITAG_T_PROG 614 |
| 234 | |
| 235 | #define HITAG_T_TAG_ONE_HALF_PERIOD 10 |
| 236 | #define HITAG_T_TAG_TWO_HALF_PERIOD 25 |
| 237 | #define HITAG_T_TAG_THREE_HALF_PERIOD 41 |
| 238 | #define HITAG_T_TAG_FOUR_HALF_PERIOD 57 |
| 239 | |
| 240 | #define HITAG_T_TAG_HALF_PERIOD 16 |
| 241 | #define HITAG_T_TAG_FULL_PERIOD 32 |
| 242 | |
| 243 | #define HITAG_T_TAG_CAPTURE_ONE_HALF 13 |
| 244 | #define HITAG_T_TAG_CAPTURE_TWO_HALF 25 |
| 245 | #define HITAG_T_TAG_CAPTURE_THREE_HALF 41 |
| 246 | #define HITAG_T_TAG_CAPTURE_FOUR_HALF 57 |
| 247 | |
| 248 | |
| 249 | static void hitag_send_bit(int bit) { |
| 250 | LED_A_ON(); |
| 251 | // Reset clock for the next bit |
| 252 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG; |
| 253 | |
| 254 | // Fixed modulation, earlier proxmark version used inverted signal |
| 255 | if(bit == 0) { |
| 256 | // Manchester: Unloaded, then loaded |__--| |
| 257 | LOW(GPIO_SSC_DOUT); |
| 258 | while(AT91C_BASE_TC0->TC_CV < T0*HITAG_T_TAG_HALF_PERIOD); |
| 259 | HIGH(GPIO_SSC_DOUT); |
| 260 | while(AT91C_BASE_TC0->TC_CV < T0*HITAG_T_TAG_FULL_PERIOD); |
| 261 | } else { |
| 262 | // Manchester: Loaded, then unloaded |--__| |
| 263 | HIGH(GPIO_SSC_DOUT); |
| 264 | while(AT91C_BASE_TC0->TC_CV < T0*HITAG_T_TAG_HALF_PERIOD); |
| 265 | LOW(GPIO_SSC_DOUT); |
| 266 | while(AT91C_BASE_TC0->TC_CV < T0*HITAG_T_TAG_FULL_PERIOD); |
| 267 | } |
| 268 | LED_A_OFF(); |
| 269 | } |
| 270 | |
| 271 | static void hitag_send_frame(const byte_t* frame, size_t frame_len) |
| 272 | { |
| 273 | // Send start of frame |
| 274 | for(size_t i=0; i<5; i++) { |
| 275 | hitag_send_bit(1); |
| 276 | } |
| 277 | |
| 278 | // Send the content of the frame |
| 279 | for(size_t i=0; i<frame_len; i++) { |
| 280 | hitag_send_bit((frame[i/8] >> (7-(i%8)))&1); |
| 281 | } |
| 282 | |
| 283 | // Drop the modulation |
| 284 | LOW(GPIO_SSC_DOUT); |
| 285 | } |
| 286 | |
| 287 | |
| 288 | static void hitag2_handle_reader_command(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen) |
| 289 | { |
| 290 | byte_t rx_air[HITAG_FRAME_LEN]; |
| 291 | |
| 292 | // Copy the (original) received frame how it is send over the air |
| 293 | memcpy(rx_air,rx,nbytes(rxlen)); |
| 294 | |
| 295 | if(tag.crypto_active) { |
| 296 | hitag2_cipher_transcrypt(&(tag.cs),rx,rxlen/8,rxlen%8); |
| 297 | } |
| 298 | |
| 299 | // Reset the transmission frame length |
| 300 | *txlen = 0; |
| 301 | |
| 302 | // Try to find out which command was send by selecting on length (in bits) |
| 303 | switch (rxlen) { |
| 304 | // Received 11000 from the reader, request for UID, send UID |
| 305 | case 05: { |
| 306 | // Always send over the air in the clear plaintext mode |
| 307 | if(rx_air[0] != 0xC0) { |
| 308 | // Unknown frame ? |
| 309 | return; |
| 310 | } |
| 311 | *txlen = 32; |
| 312 | memcpy(tx,tag.sectors[0],4); |
| 313 | tag.crypto_active = 0; |
| 314 | } |
| 315 | break; |
| 316 | |
| 317 | // Read/Write command: ..xx x..y yy with yyy == ~xxx, xxx is sector number |
| 318 | case 10: { |
| 319 | unsigned int sector = (~( ((rx[0]<<2)&0x04) | ((rx[1]>>6)&0x03) ) & 0x07); |
| 320 | // Verify complement of sector index |
| 321 | if(sector != ((rx[0]>>3)&0x07)) { |
| 322 | //DbpString("Transmission error (read/write)"); |
| 323 | return; |
| 324 | } |
| 325 | |
| 326 | switch (rx[0] & 0xC6) { |
| 327 | // Read command: 11xx x00y |
| 328 | case 0xC0: |
| 329 | memcpy(tx,tag.sectors[sector],4); |
| 330 | *txlen = 32; |
| 331 | break; |
| 332 | |
| 333 | // Inverted Read command: 01xx x10y |
| 334 | case 0x44: |
| 335 | for (size_t i=0; i<4; i++) { |
| 336 | tx[i] = tag.sectors[sector][i] ^ 0xff; |
| 337 | } |
| 338 | *txlen = 32; |
| 339 | break; |
| 340 | |
| 341 | // Write command: 10xx x01y |
| 342 | case 0x82: |
| 343 | // Prepare write, acknowledge by repeating command |
| 344 | memcpy(tx,rx,nbytes(rxlen)); |
| 345 | *txlen = rxlen; |
| 346 | tag.active_sector = sector; |
| 347 | tag.state=TAG_STATE_WRITING; |
| 348 | break; |
| 349 | |
| 350 | // Unknown command |
| 351 | default: |
| 352 | Dbprintf("Unknown command: %02x %02x",rx[0],rx[1]); |
| 353 | return; |
| 354 | break; |
| 355 | } |
| 356 | } |
| 357 | break; |
| 358 | |
| 359 | // Writing data or Reader password |
| 360 | case 32: { |
| 361 | if(tag.state == TAG_STATE_WRITING) { |
| 362 | // These are the sector contents to be written. We don't have to do anything else. |
| 363 | memcpy(tag.sectors[tag.active_sector],rx,nbytes(rxlen)); |
| 364 | tag.state=TAG_STATE_RESET; |
| 365 | return; |
| 366 | } else { |
| 367 | // Received RWD password, respond with configuration and our password |
| 368 | if(memcmp(rx,tag.sectors[1],4) != 0) { |
| 369 | DbpString("Reader password is wrong"); |
| 370 | return; |
| 371 | } |
| 372 | *txlen = 32; |
| 373 | memcpy(tx,tag.sectors[3],4); |
| 374 | } |
| 375 | } |
| 376 | break; |
| 377 | |
| 378 | // Received RWD authentication challenge and respnse |
| 379 | case 64: { |
| 380 | // Store the authentication attempt |
| 381 | if (auth_table_len < (AUTH_TABLE_LENGTH-8)) { |
| 382 | memcpy(auth_table+auth_table_len,rx,8); |
| 383 | auth_table_len += 8; |
| 384 | } |
| 385 | |
| 386 | // Reset the cipher state |
| 387 | hitag2_cipher_reset(&tag,rx); |
| 388 | // Check if the authentication was correct |
| 389 | if(!hitag2_cipher_authenticate(&(tag.cs),rx+4)) { |
| 390 | // The reader failed to authenticate, do nothing |
| 391 | Dbprintf("auth: %02x%02x%02x%02x%02x%02x%02x%02x Failed!",rx[0],rx[1],rx[2],rx[3],rx[4],rx[5],rx[6],rx[7]); |
| 392 | return; |
| 393 | } |
| 394 | // Succesful, but commented out reporting back to the Host, this may delay to much. |
| 395 | // Dbprintf("auth: %02x%02x%02x%02x%02x%02x%02x%02x OK!",rx[0],rx[1],rx[2],rx[3],rx[4],rx[5],rx[6],rx[7]); |
| 396 | |
| 397 | // Activate encryption algorithm for all further communication |
| 398 | tag.crypto_active = 1; |
| 399 | |
| 400 | // Use the tag password as response |
| 401 | memcpy(tx,tag.sectors[3],4); |
| 402 | *txlen = 32; |
| 403 | } |
| 404 | break; |
| 405 | } |
| 406 | |
| 407 | // LogTraceHitag(rx,rxlen,0,0,false); |
| 408 | // LogTraceHitag(tx,*txlen,0,0,true); |
| 409 | |
| 410 | if(tag.crypto_active) { |
| 411 | hitag2_cipher_transcrypt(&(tag.cs), tx, *txlen/8, *txlen%8); |
| 412 | } |
| 413 | } |
| 414 | |
| 415 | static void hitag_reader_send_bit(int bit) { |
| 416 | LED_A_ON(); |
| 417 | // Reset clock for the next bit |
| 418 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG; |
| 419 | |
| 420 | // Binary puls length modulation (BPLM) is used to encode the data stream |
| 421 | // This means that a transmission of a one takes longer than that of a zero |
| 422 | |
| 423 | // Enable modulation, which means, drop the field |
| 424 | HIGH(GPIO_SSC_DOUT); |
| 425 | |
| 426 | // Wait for 4-10 times the carrier period |
| 427 | while(AT91C_BASE_TC0->TC_CV < T0*6); |
| 428 | // SpinDelayUs(8*8); |
| 429 | |
| 430 | // Disable modulation, just activates the field again |
| 431 | LOW(GPIO_SSC_DOUT); |
| 432 | |
| 433 | if(bit == 0) { |
| 434 | // Zero bit: |_-| |
| 435 | while(AT91C_BASE_TC0->TC_CV < T0*22); |
| 436 | // SpinDelayUs(16*8); |
| 437 | } else { |
| 438 | // One bit: |_--| |
| 439 | while(AT91C_BASE_TC0->TC_CV < T0*28); |
| 440 | // SpinDelayUs(22*8); |
| 441 | } |
| 442 | LED_A_OFF(); |
| 443 | } |
| 444 | |
| 445 | |
| 446 | static void hitag_reader_send_frame(const byte_t* frame, size_t frame_len) |
| 447 | { |
| 448 | // Send the content of the frame |
| 449 | for(size_t i=0; i<frame_len; i++) { |
| 450 | hitag_reader_send_bit((frame[i/8] >> (7-(i%8)))&1); |
| 451 | } |
| 452 | // Send EOF |
| 453 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG; |
| 454 | // Enable modulation, which means, drop the field |
| 455 | HIGH(GPIO_SSC_DOUT); |
| 456 | // Wait for 4-10 times the carrier period |
| 457 | while(AT91C_BASE_TC0->TC_CV < T0*6); |
| 458 | // Disable modulation, just activates the field again |
| 459 | LOW(GPIO_SSC_DOUT); |
| 460 | } |
| 461 | |
| 462 | size_t blocknr; |
| 463 | |
| 464 | static bool hitag2_password(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen) { |
| 465 | // Reset the transmission frame length |
| 466 | *txlen = 0; |
| 467 | |
| 468 | // Try to find out which command was send by selecting on length (in bits) |
| 469 | switch (rxlen) { |
| 470 | // No answer, try to resurrect |
| 471 | case 0: { |
| 472 | // Stop if there is no answer (after sending password) |
| 473 | if (bPwd) { |
| 474 | DbpString("Password failed!"); |
| 475 | return false; |
| 476 | } |
| 477 | *txlen = 5; |
| 478 | memcpy(tx,"\xc0",nbytes(*txlen)); |
| 479 | } break; |
| 480 | |
| 481 | // Received UID, tag password |
| 482 | case 32: { |
| 483 | if (!bPwd) { |
| 484 | *txlen = 32; |
| 485 | memcpy(tx,password,4); |
| 486 | bPwd = true; |
| 487 | memcpy(tag.sectors[blocknr],rx,4); |
| 488 | blocknr++; |
| 489 | } else { |
| 490 | |
| 491 | if(blocknr == 1){ |
| 492 | //store password in block1, the TAG answers with Block3, but we need the password in memory |
| 493 | memcpy(tag.sectors[blocknr],tx,4); |
| 494 | }else{ |
| 495 | memcpy(tag.sectors[blocknr],rx,4); |
| 496 | } |
| 497 | |
| 498 | blocknr++; |
| 499 | if (blocknr > 7) { |
| 500 | DbpString("Read succesful!"); |
| 501 | bSuccessful = true; |
| 502 | return false; |
| 503 | } |
| 504 | *txlen = 10; |
| 505 | tx[0] = 0xc0 | (blocknr << 3) | ((blocknr^7) >> 2); |
| 506 | tx[1] = ((blocknr^7) << 6); |
| 507 | } |
| 508 | } break; |
| 509 | |
| 510 | // Unexpected response |
| 511 | default: { |
| 512 | Dbprintf("Uknown frame length: %d",rxlen); |
| 513 | return false; |
| 514 | } break; |
| 515 | } |
| 516 | return true; |
| 517 | } |
| 518 | |
| 519 | static bool hitag2_write_page(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen) |
| 520 | { |
| 521 | switch (writestate) { |
| 522 | case WRITE_STATE_START: |
| 523 | *txlen = 10; |
| 524 | tx[0] = 0x82 | (blocknr << 3) | ((blocknr^7) >> 2); |
| 525 | tx[1] = ((blocknr^7) << 6); |
| 526 | writestate = WRITE_STATE_PAGENUM_WRITTEN; |
| 527 | break; |
| 528 | case WRITE_STATE_PAGENUM_WRITTEN: |
| 529 | // Check if page number was received correctly |
| 530 | if ((rxlen == 10) && |
| 531 | (rx[0] == (0x82 | (blocknr << 3) | ((blocknr^7) >> 2))) && |
| 532 | (rx[1] == (((blocknr & 0x3) ^ 0x3) << 6))) { |
| 533 | *txlen = 32; |
| 534 | memset(tx, 0, HITAG_FRAME_LEN); |
| 535 | memcpy(tx, writedata, 4); |
| 536 | writestate = WRITE_STATE_PROG; |
| 537 | } else { |
| 538 | Dbprintf("hitag2_write_page: Page number was not received correctly: rxlen=%d rx=%02x%02x%02x%02x", |
| 539 | rxlen, rx[0], rx[1], rx[2], rx[3]); |
| 540 | bSuccessful = false; |
| 541 | return false; |
| 542 | } |
| 543 | break; |
| 544 | case WRITE_STATE_PROG: |
| 545 | if (rxlen == 0) { |
| 546 | bSuccessful = true; |
| 547 | } else { |
| 548 | bSuccessful = false; |
| 549 | Dbprintf("hitag2_write_page: unexpected rx data (%d) after page write", rxlen); |
| 550 | } |
| 551 | return false; |
| 552 | default: |
| 553 | DbpString("hitag2_write_page: Unknown state %d"); |
| 554 | bSuccessful = false; |
| 555 | return false; |
| 556 | } |
| 557 | |
| 558 | return true; |
| 559 | } |
| 560 | |
| 561 | static bool hitag2_crypto(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen, bool write) { |
| 562 | // Reset the transmission frame length |
| 563 | *txlen = 0; |
| 564 | |
| 565 | if(bCrypto) { |
| 566 | hitag2_cipher_transcrypt(&cipher_state,rx,rxlen/8,rxlen%8); |
| 567 | |
| 568 | } |
| 569 | |
| 570 | if (bCrypto && !bAuthenticating && write) { |
| 571 | if (!hitag2_write_page(rx, rxlen, tx, txlen)) { |
| 572 | return false; |
| 573 | } |
| 574 | } |
| 575 | else |
| 576 | { |
| 577 | |
| 578 | // Try to find out which command was send by selecting on length (in bits) |
| 579 | switch (rxlen) { |
| 580 | // No answer, try to resurrect |
| 581 | case 0: |
| 582 | { |
| 583 | // Stop if there is no answer while we are in crypto mode (after sending NrAr) |
| 584 | if (bCrypto) { |
| 585 | // Failed during authentication |
| 586 | if (bAuthenticating) { |
| 587 | DbpString("Authentication failed!"); |
| 588 | return false; |
| 589 | } else { |
| 590 | // Failed reading a block, could be (read/write) locked, skip block and re-authenticate |
| 591 | if (blocknr == 1) { |
| 592 | // Write the low part of the key in memory |
| 593 | memcpy(tag.sectors[1],key+2,4); |
| 594 | } else if (blocknr == 2) { |
| 595 | // Write the high part of the key in memory |
| 596 | tag.sectors[2][0] = 0x00; |
| 597 | tag.sectors[2][1] = 0x00; |
| 598 | tag.sectors[2][2] = key[0]; |
| 599 | tag.sectors[2][3] = key[1]; |
| 600 | } else { |
| 601 | // Just put zero's in the memory (of the unreadable block) |
| 602 | memset(tag.sectors[blocknr],0x00,4); |
| 603 | } |
| 604 | blocknr++; |
| 605 | bCrypto = false; |
| 606 | } |
| 607 | } else { |
| 608 | *txlen = 5; |
| 609 | memcpy(tx,"\xc0",nbytes(*txlen)); |
| 610 | } |
| 611 | break; |
| 612 | } |
| 613 | // Received UID, crypto tag answer |
| 614 | case 32: { |
| 615 | if (!bCrypto) { |
| 616 | uint64_t ui64key = key[0] | ((uint64_t)key[1]) << 8 | ((uint64_t)key[2]) << 16 | ((uint64_t)key[3]) << 24 | ((uint64_t)key[4]) << 32 | ((uint64_t)key[5]) << 40; |
| 617 | uint32_t ui32uid = rx[0] | ((uint32_t)rx[1]) << 8 | ((uint32_t)rx[2]) << 16 | ((uint32_t)rx[3]) << 24; |
| 618 | Dbprintf("hitag2_crypto: key=0x%x%x uid=0x%x", (uint32_t) ((rev64(ui64key)) >> 32), (uint32_t) ((rev64(ui64key)) & 0xffffffff), rev32(ui32uid)); |
| 619 | cipher_state = _hitag2_init(rev64(ui64key), rev32(ui32uid), 0); |
| 620 | memset(tx,0x00,4); |
| 621 | memset(tx+4,0xff,4); |
| 622 | hitag2_cipher_transcrypt(&cipher_state, tx+4, 4, 0); |
| 623 | *txlen = 64; |
| 624 | bCrypto = true; |
| 625 | bAuthenticating = true; |
| 626 | } else { |
| 627 | // Check if we received answer tag (at) |
| 628 | if (bAuthenticating) { |
| 629 | bAuthenticating = false; |
| 630 | if (write) { |
| 631 | if (!hitag2_write_page(rx, rxlen, tx, txlen)) { |
| 632 | return false; |
| 633 | } |
| 634 | break; |
| 635 | } |
| 636 | } else { |
| 637 | // Store the received block |
| 638 | memcpy(tag.sectors[blocknr],rx,4); |
| 639 | blocknr++; |
| 640 | } |
| 641 | |
| 642 | if (blocknr > 7) { |
| 643 | DbpString("Read succesful!"); |
| 644 | bSuccessful = true; |
| 645 | return false; |
| 646 | } else { |
| 647 | *txlen = 10; |
| 648 | tx[0] = 0xc0 | (blocknr << 3) | ((blocknr^7) >> 2); |
| 649 | tx[1] = ((blocknr^7) << 6); |
| 650 | } |
| 651 | } |
| 652 | } break; |
| 653 | |
| 654 | // Unexpected response |
| 655 | default: { |
| 656 | Dbprintf("Uknown frame length: %d",rxlen); |
| 657 | return false; |
| 658 | } break; |
| 659 | } |
| 660 | } |
| 661 | |
| 662 | if(bCrypto) { |
| 663 | // We have to return now to avoid double encryption |
| 664 | if (!bAuthenticating) { |
| 665 | hitag2_cipher_transcrypt(&cipher_state,tx,*txlen/8,*txlen%8); |
| 666 | } |
| 667 | } |
| 668 | |
| 669 | return true; |
| 670 | } |
| 671 | |
| 672 | |
| 673 | static bool hitag2_authenticate(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen) { |
| 674 | // Reset the transmission frame length |
| 675 | *txlen = 0; |
| 676 | |
| 677 | // Try to find out which command was send by selecting on length (in bits) |
| 678 | switch (rxlen) { |
| 679 | // No answer, try to resurrect |
| 680 | case 0: { |
| 681 | // Stop if there is no answer while we are in crypto mode (after sending NrAr) |
| 682 | if (bCrypto) { |
| 683 | DbpString("Authentication failed!"); |
| 684 | return false; |
| 685 | } |
| 686 | *txlen = 5; |
| 687 | memcpy(tx,"\xc0",nbytes(*txlen)); |
| 688 | } break; |
| 689 | |
| 690 | // Received UID, crypto tag answer |
| 691 | case 32: { |
| 692 | if (!bCrypto) { |
| 693 | *txlen = 64; |
| 694 | memcpy(tx,NrAr,8); |
| 695 | bCrypto = true; |
| 696 | } else { |
| 697 | DbpString("Authentication succesful!"); |
| 698 | // We are done... for now |
| 699 | return false; |
| 700 | } |
| 701 | } break; |
| 702 | |
| 703 | // Unexpected response |
| 704 | default: { |
| 705 | Dbprintf("Uknown frame length: %d",rxlen); |
| 706 | return false; |
| 707 | } break; |
| 708 | } |
| 709 | |
| 710 | return true; |
| 711 | } |
| 712 | |
| 713 | |
| 714 | static bool hitag2_test_auth_attempts(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen) { |
| 715 | |
| 716 | // Reset the transmission frame length |
| 717 | *txlen = 0; |
| 718 | |
| 719 | // Try to find out which command was send by selecting on length (in bits) |
| 720 | switch (rxlen) { |
| 721 | // No answer, try to resurrect |
| 722 | case 0: { |
| 723 | // Stop if there is no answer while we are in crypto mode (after sending NrAr) |
| 724 | if (bCrypto) { |
| 725 | Dbprintf("auth: %02x%02x%02x%02x%02x%02x%02x%02x Failed, removed entry!",NrAr[0],NrAr[1],NrAr[2],NrAr[3],NrAr[4],NrAr[5],NrAr[6],NrAr[7]); |
| 726 | |
| 727 | // Removing failed entry from authentiations table |
| 728 | memcpy(auth_table+auth_table_pos,auth_table+auth_table_pos+8,8); |
| 729 | auth_table_len -= 8; |
| 730 | |
| 731 | // Return if we reached the end of the authentications table |
| 732 | bCrypto = false; |
| 733 | if (auth_table_pos == auth_table_len) { |
| 734 | return false; |
| 735 | } |
| 736 | |
| 737 | // Copy the next authentication attempt in row (at the same position, b/c we removed last failed entry) |
| 738 | memcpy(NrAr,auth_table+auth_table_pos,8); |
| 739 | } |
| 740 | *txlen = 5; |
| 741 | memcpy(tx,"\xc0",nbytes(*txlen)); |
| 742 | } break; |
| 743 | |
| 744 | // Received UID, crypto tag answer, or read block response |
| 745 | case 32: { |
| 746 | if (!bCrypto) { |
| 747 | *txlen = 64; |
| 748 | memcpy(tx,NrAr,8); |
| 749 | bCrypto = true; |
| 750 | } else { |
| 751 | Dbprintf("auth: %02x%02x%02x%02x%02x%02x%02x%02x OK",NrAr[0],NrAr[1],NrAr[2],NrAr[3],NrAr[4],NrAr[5],NrAr[6],NrAr[7]); |
| 752 | bCrypto = false; |
| 753 | if ((auth_table_pos+8) == auth_table_len) { |
| 754 | return false; |
| 755 | } |
| 756 | auth_table_pos += 8; |
| 757 | memcpy(NrAr,auth_table+auth_table_pos,8); |
| 758 | } |
| 759 | } break; |
| 760 | |
| 761 | default: { |
| 762 | Dbprintf("Uknown frame length: %d",rxlen); |
| 763 | return false; |
| 764 | } break; |
| 765 | } |
| 766 | |
| 767 | return true; |
| 768 | } |
| 769 | |
| 770 | static bool hitag2_read_uid(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen) { |
| 771 | // Reset the transmission frame length |
| 772 | *txlen = 0; |
| 773 | |
| 774 | // Try to find out which command was send by selecting on length (in bits) |
| 775 | switch (rxlen) { |
| 776 | // No answer, try to resurrect |
| 777 | case 0: { |
| 778 | // Just starting or if there is no answer |
| 779 | *txlen = 5; |
| 780 | memcpy(tx,"\xc0",nbytes(*txlen)); |
| 781 | } break; |
| 782 | // Received UID |
| 783 | case 32: { |
| 784 | // Check if we received answer tag (at) |
| 785 | if (bAuthenticating) { |
| 786 | bAuthenticating = false; |
| 787 | } else { |
| 788 | // Store the received block |
| 789 | memcpy(tag.sectors[blocknr],rx,4); |
| 790 | blocknr++; |
| 791 | } |
| 792 | if (blocknr > 0) { |
| 793 | //DbpString("Read successful!"); |
| 794 | bSuccessful = true; |
| 795 | return false; |
| 796 | } |
| 797 | } break; |
| 798 | // Unexpected response |
| 799 | default: { |
| 800 | Dbprintf("Uknown frame length: %d",rxlen); |
| 801 | return false; |
| 802 | } break; |
| 803 | } |
| 804 | return true; |
| 805 | } |
| 806 | |
| 807 | void SnoopHitag(uint32_t type) { |
| 808 | int frame_count; |
| 809 | int response; |
| 810 | int overflow; |
| 811 | bool rising_edge; |
| 812 | bool reader_frame; |
| 813 | int lastbit; |
| 814 | bool bSkip; |
| 815 | int tag_sof; |
| 816 | byte_t rx[HITAG_FRAME_LEN]; |
| 817 | size_t rxlen=0; |
| 818 | |
| 819 | FpgaDownloadAndGo(FPGA_BITSTREAM_LF); |
| 820 | |
| 821 | // Clean up trace and prepare it for storing frames |
| 822 | set_tracing(TRUE); |
| 823 | clear_trace(); |
| 824 | |
| 825 | auth_table_len = 0; |
| 826 | auth_table_pos = 0; |
| 827 | |
| 828 | BigBuf_free(); |
| 829 | auth_table = (byte_t *)BigBuf_malloc(AUTH_TABLE_LENGTH); |
| 830 | memset(auth_table, 0x00, AUTH_TABLE_LENGTH); |
| 831 | |
| 832 | DbpString("Starting Hitag2 snoop"); |
| 833 | LED_D_ON(); |
| 834 | |
| 835 | // Set up eavesdropping mode, frequency divisor which will drive the FPGA |
| 836 | // and analog mux selection. |
| 837 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_TOGGLE_MODE); |
| 838 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz |
| 839 | SetAdcMuxFor(GPIO_MUXSEL_LOPKD); |
| 840 | RELAY_OFF(); |
| 841 | |
| 842 | // Configure output pin that is connected to the FPGA (for modulating) |
| 843 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; |
| 844 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; |
| 845 | |
| 846 | // Disable modulation, we are going to eavesdrop, not modulate ;) |
| 847 | LOW(GPIO_SSC_DOUT); |
| 848 | |
| 849 | // Enable Peripheral Clock for TIMER_CLOCK1, used to capture edges of the reader frames |
| 850 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); |
| 851 | AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME; |
| 852 | |
| 853 | // Disable timer during configuration |
| 854 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; |
| 855 | |
| 856 | // Capture mode, defaul timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger, |
| 857 | // external trigger rising edge, load RA on rising edge of TIOA. |
| 858 | uint32_t t1_channel_mode = AT91C_TC_CLKS_TIMER_DIV1_CLOCK | AT91C_TC_ETRGEDG_BOTH | AT91C_TC_ABETRG | AT91C_TC_LDRA_BOTH; |
| 859 | AT91C_BASE_TC1->TC_CMR = t1_channel_mode; |
| 860 | |
| 861 | // Enable and reset counter |
| 862 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
| 863 | |
| 864 | // Reset the received frame, frame count and timing info |
| 865 | frame_count = 0; |
| 866 | response = 0; |
| 867 | overflow = 0; |
| 868 | reader_frame = false; |
| 869 | lastbit = 1; |
| 870 | bSkip = true; |
| 871 | tag_sof = 4; |
| 872 | |
| 873 | while(!BUTTON_PRESS()) { |
| 874 | // Watchdog hit |
| 875 | WDT_HIT(); |
| 876 | |
| 877 | // Receive frame, watch for at most T0*EOF periods |
| 878 | while (AT91C_BASE_TC1->TC_CV < T0*HITAG_T_EOF) { |
| 879 | // Check if rising edge in modulation is detected |
| 880 | if(AT91C_BASE_TC1->TC_SR & AT91C_TC_LDRAS) { |
| 881 | // Retrieve the new timing values |
| 882 | int ra = (AT91C_BASE_TC1->TC_RA/T0); |
| 883 | |
| 884 | // Find out if we are dealing with a rising or falling edge |
| 885 | rising_edge = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_FRAME) > 0; |
| 886 | |
| 887 | // Shorter periods will only happen with reader frames |
| 888 | if (!reader_frame && rising_edge && ra < HITAG_T_TAG_CAPTURE_ONE_HALF) { |
| 889 | // Switch from tag to reader capture |
| 890 | LED_C_OFF(); |
| 891 | reader_frame = true; |
| 892 | memset(rx,0x00,sizeof(rx)); |
| 893 | rxlen = 0; |
| 894 | } |
| 895 | |
| 896 | // Only handle if reader frame and rising edge, or tag frame and falling edge |
| 897 | if (reader_frame != rising_edge) { |
| 898 | overflow += ra; |
| 899 | continue; |
| 900 | } |
| 901 | |
| 902 | // Add the buffered timing values of earlier captured edges which were skipped |
| 903 | ra += overflow; |
| 904 | overflow = 0; |
| 905 | |
| 906 | if (reader_frame) { |
| 907 | LED_B_ON(); |
| 908 | // Capture reader frame |
| 909 | if(ra >= HITAG_T_STOP) { |
| 910 | if (rxlen != 0) { |
| 911 | //DbpString("wierd0?"); |
| 912 | } |
| 913 | // Capture the T0 periods that have passed since last communication or field drop (reset) |
| 914 | response = (ra - HITAG_T_LOW); |
| 915 | } else if(ra >= HITAG_T_1_MIN ) { |
| 916 | // '1' bit |
| 917 | rx[rxlen / 8] |= 1 << (7-(rxlen%8)); |
| 918 | rxlen++; |
| 919 | } else if(ra >= HITAG_T_0_MIN) { |
| 920 | // '0' bit |
| 921 | rx[rxlen / 8] |= 0 << (7-(rxlen%8)); |
| 922 | rxlen++; |
| 923 | } else { |
| 924 | // Ignore wierd value, is to small to mean anything |
| 925 | } |
| 926 | } else { |
| 927 | LED_C_ON(); |
| 928 | // Capture tag frame (manchester decoding using only falling edges) |
| 929 | if(ra >= HITAG_T_EOF) { |
| 930 | if (rxlen != 0) { |
| 931 | //DbpString("wierd1?"); |
| 932 | } |
| 933 | // Capture the T0 periods that have passed since last communication or field drop (reset) |
| 934 | // We always recieve a 'one' first, which has the falling edge after a half period |-_| |
| 935 | response = ra-HITAG_T_TAG_HALF_PERIOD; |
| 936 | } else if(ra >= HITAG_T_TAG_CAPTURE_FOUR_HALF) { |
| 937 | // Manchester coding example |-_|_-|-_| (101) |
| 938 | rx[rxlen / 8] |= 0 << (7-(rxlen%8)); |
| 939 | rxlen++; |
| 940 | rx[rxlen / 8] |= 1 << (7-(rxlen%8)); |
| 941 | rxlen++; |
| 942 | } else if(ra >= HITAG_T_TAG_CAPTURE_THREE_HALF) { |
| 943 | // Manchester coding example |_-|...|_-|-_| (0...01) |
| 944 | rx[rxlen / 8] |= 0 << (7-(rxlen%8)); |
| 945 | rxlen++; |
| 946 | // We have to skip this half period at start and add the 'one' the second time |
| 947 | if (!bSkip) { |
| 948 | rx[rxlen / 8] |= 1 << (7-(rxlen%8)); |
| 949 | rxlen++; |
| 950 | } |
| 951 | lastbit = !lastbit; |
| 952 | bSkip = !bSkip; |
| 953 | } else if(ra >= HITAG_T_TAG_CAPTURE_TWO_HALF) { |
| 954 | // Manchester coding example |_-|_-| (00) or |-_|-_| (11) |
| 955 | if (tag_sof) { |
| 956 | // Ignore bits that are transmitted during SOF |
| 957 | tag_sof--; |
| 958 | } else { |
| 959 | // bit is same as last bit |
| 960 | rx[rxlen / 8] |= lastbit << (7-(rxlen%8)); |
| 961 | rxlen++; |
| 962 | } |
| 963 | } else { |
| 964 | // Ignore wierd value, is to small to mean anything |
| 965 | } |
| 966 | } |
| 967 | } |
| 968 | } |
| 969 | |
| 970 | // Check if frame was captured |
| 971 | if(rxlen > 0) { |
| 972 | frame_count++; |
| 973 | if (!LogTraceHitag(rx,rxlen,response,0,reader_frame)) { |
| 974 | DbpString("Trace full"); |
| 975 | break; |
| 976 | } |
| 977 | |
| 978 | // Check if we recognize a valid authentication attempt |
| 979 | if (nbytes(rxlen) == 8) { |
| 980 | // Store the authentication attempt |
| 981 | if (auth_table_len < (AUTH_TABLE_LENGTH-8)) { |
| 982 | memcpy(auth_table+auth_table_len,rx,8); |
| 983 | auth_table_len += 8; |
| 984 | } |
| 985 | } |
| 986 | |
| 987 | // Reset the received frame and response timing info |
| 988 | memset(rx,0x00,sizeof(rx)); |
| 989 | response = 0; |
| 990 | reader_frame = false; |
| 991 | lastbit = 1; |
| 992 | bSkip = true; |
| 993 | tag_sof = 4; |
| 994 | overflow = 0; |
| 995 | |
| 996 | LED_B_OFF(); |
| 997 | LED_C_OFF(); |
| 998 | } else { |
| 999 | // Save the timer overflow, will be 0 when frame was received |
| 1000 | overflow += (AT91C_BASE_TC1->TC_CV/T0); |
| 1001 | } |
| 1002 | // Reset the frame length |
| 1003 | rxlen = 0; |
| 1004 | // Reset the timer to restart while-loop that receives frames |
| 1005 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG; |
| 1006 | } |
| 1007 | LED_A_ON(); |
| 1008 | LED_B_OFF(); |
| 1009 | LED_C_OFF(); |
| 1010 | LED_D_OFF(); |
| 1011 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; |
| 1012 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; |
| 1013 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); |
| 1014 | LED_A_OFF(); |
| 1015 | |
| 1016 | // Dbprintf("frame received: %d",frame_count); |
| 1017 | // Dbprintf("Authentication Attempts: %d",(auth_table_len/8)); |
| 1018 | // DbpString("All done"); |
| 1019 | } |
| 1020 | |
| 1021 | void SimulateHitagTag(bool tag_mem_supplied, byte_t* data) { |
| 1022 | int frame_count; |
| 1023 | int response; |
| 1024 | int overflow; |
| 1025 | byte_t rx[HITAG_FRAME_LEN]; |
| 1026 | size_t rxlen=0; |
| 1027 | byte_t tx[HITAG_FRAME_LEN]; |
| 1028 | size_t txlen=0; |
| 1029 | bool bQuitTraceFull = false; |
| 1030 | bQuiet = false; |
| 1031 | |
| 1032 | FpgaDownloadAndGo(FPGA_BITSTREAM_LF); |
| 1033 | |
| 1034 | // Clean up trace and prepare it for storing frames |
| 1035 | set_tracing(TRUE); |
| 1036 | clear_trace(); |
| 1037 | |
| 1038 | auth_table_len = 0; |
| 1039 | auth_table_pos = 0; |
| 1040 | byte_t* auth_table; |
| 1041 | BigBuf_free(); |
| 1042 | auth_table = (byte_t *)BigBuf_malloc(AUTH_TABLE_LENGTH); |
| 1043 | memset(auth_table, 0x00, AUTH_TABLE_LENGTH); |
| 1044 | |
| 1045 | DbpString("Starting Hitag2 simulation"); |
| 1046 | LED_D_ON(); |
| 1047 | hitag2_init(); |
| 1048 | |
| 1049 | if (tag_mem_supplied) { |
| 1050 | DbpString("Loading hitag2 memory..."); |
| 1051 | memcpy((byte_t*)tag.sectors,data,48); |
| 1052 | } |
| 1053 | |
| 1054 | uint32_t block = 0; |
| 1055 | for (size_t i=0; i<12; i++) { |
| 1056 | for (size_t j=0; j<4; j++) { |
| 1057 | block <<= 8; |
| 1058 | block |= tag.sectors[i][j]; |
| 1059 | } |
| 1060 | Dbprintf("| %d | %08x |",i,block); |
| 1061 | } |
| 1062 | |
| 1063 | // Set up simulator mode, frequency divisor which will drive the FPGA |
| 1064 | // and analog mux selection. |
| 1065 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT); |
| 1066 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz |
| 1067 | SetAdcMuxFor(GPIO_MUXSEL_LOPKD); |
| 1068 | RELAY_OFF(); |
| 1069 | |
| 1070 | // Configure output pin that is connected to the FPGA (for modulating) |
| 1071 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; |
| 1072 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; |
| 1073 | |
| 1074 | // Disable modulation at default, which means release resistance |
| 1075 | LOW(GPIO_SSC_DOUT); |
| 1076 | |
| 1077 | // Enable Peripheral Clock for TIMER_CLOCK0, used to measure exact timing before answering |
| 1078 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC0); |
| 1079 | |
| 1080 | // Enable Peripheral Clock for TIMER_CLOCK1, used to capture edges of the reader frames |
| 1081 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); |
| 1082 | AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME; |
| 1083 | |
| 1084 | // Disable timer during configuration |
| 1085 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; |
| 1086 | |
| 1087 | // Capture mode, default timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger, |
| 1088 | // external trigger rising edge, load RA on rising edge of TIOA. |
| 1089 | AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK | AT91C_TC_ETRGEDG_RISING | AT91C_TC_ABETRG | AT91C_TC_LDRA_RISING; |
| 1090 | |
| 1091 | // Reset the received frame, frame count and timing info |
| 1092 | memset(rx,0x00,sizeof(rx)); |
| 1093 | frame_count = 0; |
| 1094 | response = 0; |
| 1095 | overflow = 0; |
| 1096 | |
| 1097 | // Enable and reset counter |
| 1098 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
| 1099 | |
| 1100 | while(!BUTTON_PRESS()) { |
| 1101 | // Watchdog hit |
| 1102 | WDT_HIT(); |
| 1103 | |
| 1104 | // Receive frame, watch for at most T0*EOF periods |
| 1105 | while (AT91C_BASE_TC1->TC_CV < T0*HITAG_T_EOF) { |
| 1106 | // Check if rising edge in modulation is detected |
| 1107 | if(AT91C_BASE_TC1->TC_SR & AT91C_TC_LDRAS) { |
| 1108 | // Retrieve the new timing values |
| 1109 | int ra = (AT91C_BASE_TC1->TC_RA/T0) + overflow; |
| 1110 | overflow = 0; |
| 1111 | |
| 1112 | // Reset timer every frame, we have to capture the last edge for timing |
| 1113 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
| 1114 | |
| 1115 | LED_B_ON(); |
| 1116 | |
| 1117 | // Capture reader frame |
| 1118 | if(ra >= HITAG_T_STOP) { |
| 1119 | if (rxlen != 0) { |
| 1120 | //DbpString("wierd0?"); |
| 1121 | } |
| 1122 | // Capture the T0 periods that have passed since last communication or field drop (reset) |
| 1123 | response = (ra - HITAG_T_LOW); |
| 1124 | } else if(ra >= HITAG_T_1_MIN ) { |
| 1125 | // '1' bit |
| 1126 | rx[rxlen / 8] |= 1 << (7-(rxlen%8)); |
| 1127 | rxlen++; |
| 1128 | } else if(ra >= HITAG_T_0_MIN) { |
| 1129 | // '0' bit |
| 1130 | rx[rxlen / 8] |= 0 << (7-(rxlen%8)); |
| 1131 | rxlen++; |
| 1132 | } else { |
| 1133 | // Ignore wierd value, is to small to mean anything |
| 1134 | } |
| 1135 | } |
| 1136 | } |
| 1137 | |
| 1138 | // Check if frame was captured |
| 1139 | if(rxlen > 4) { |
| 1140 | frame_count++; |
| 1141 | if (!bQuiet) { |
| 1142 | if (!LogTraceHitag(rx,rxlen,response,0,true)) { |
| 1143 | DbpString("Trace full"); |
| 1144 | if (bQuitTraceFull) { |
| 1145 | break; |
| 1146 | } else { |
| 1147 | bQuiet = true; |
| 1148 | } |
| 1149 | } |
| 1150 | } |
| 1151 | |
| 1152 | // Disable timer 1 with external trigger to avoid triggers during our own modulation |
| 1153 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; |
| 1154 | |
| 1155 | // Process the incoming frame (rx) and prepare the outgoing frame (tx) |
| 1156 | hitag2_handle_reader_command(rx,rxlen,tx,&txlen); |
| 1157 | |
| 1158 | // Wait for HITAG_T_WAIT_1 carrier periods after the last reader bit, |
| 1159 | // not that since the clock counts since the rising edge, but T_Wait1 is |
| 1160 | // with respect to the falling edge, we need to wait actually (T_Wait1 - T_Low) |
| 1161 | // periods. The gap time T_Low varies (4..10). All timer values are in |
| 1162 | // terms of T0 units |
| 1163 | while(AT91C_BASE_TC0->TC_CV < T0*(HITAG_T_WAIT_1-HITAG_T_LOW)); |
| 1164 | |
| 1165 | // Send and store the tag answer (if there is any) |
| 1166 | if (txlen) { |
| 1167 | // Transmit the tag frame |
| 1168 | hitag_send_frame(tx,txlen); |
| 1169 | // Store the frame in the trace |
| 1170 | if (!bQuiet) { |
| 1171 | if (!LogTraceHitag(tx,txlen,0,0,false)) { |
| 1172 | DbpString("Trace full"); |
| 1173 | if (bQuitTraceFull) { |
| 1174 | break; |
| 1175 | } else { |
| 1176 | bQuiet = true; |
| 1177 | } |
| 1178 | } |
| 1179 | } |
| 1180 | } |
| 1181 | |
| 1182 | // Reset the received frame and response timing info |
| 1183 | memset(rx,0x00,sizeof(rx)); |
| 1184 | response = 0; |
| 1185 | |
| 1186 | // Enable and reset external trigger in timer for capturing future frames |
| 1187 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
| 1188 | LED_B_OFF(); |
| 1189 | } |
| 1190 | // Reset the frame length |
| 1191 | rxlen = 0; |
| 1192 | // Save the timer overflow, will be 0 when frame was received |
| 1193 | overflow += (AT91C_BASE_TC1->TC_CV/T0); |
| 1194 | // Reset the timer to restart while-loop that receives frames |
| 1195 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG; |
| 1196 | } |
| 1197 | LED_B_OFF(); |
| 1198 | LED_D_OFF(); |
| 1199 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; |
| 1200 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; |
| 1201 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); |
| 1202 | |
| 1203 | DbpString("Sim Stopped"); |
| 1204 | |
| 1205 | } |
| 1206 | |
| 1207 | void ReaderHitag(hitag_function htf, hitag_data* htd) { |
| 1208 | int frame_count; |
| 1209 | int response; |
| 1210 | byte_t rx[HITAG_FRAME_LEN]; |
| 1211 | size_t rxlen=0; |
| 1212 | byte_t txbuf[HITAG_FRAME_LEN]; |
| 1213 | byte_t* tx = txbuf; |
| 1214 | size_t txlen=0; |
| 1215 | int lastbit; |
| 1216 | bool bSkip; |
| 1217 | int reset_sof; |
| 1218 | int tag_sof; |
| 1219 | int t_wait = HITAG_T_WAIT_MAX; |
| 1220 | bool bStop; |
| 1221 | bool bQuitTraceFull = false; |
| 1222 | |
| 1223 | FpgaDownloadAndGo(FPGA_BITSTREAM_LF); |
| 1224 | // Reset the return status |
| 1225 | bSuccessful = false; |
| 1226 | |
| 1227 | // Clean up trace and prepare it for storing frames |
| 1228 | set_tracing(TRUE); |
| 1229 | clear_trace(); |
| 1230 | |
| 1231 | //DbpString("Starting Hitag reader family"); |
| 1232 | |
| 1233 | // Check configuration |
| 1234 | switch(htf) { |
| 1235 | case RHT2F_PASSWORD: { |
| 1236 | Dbprintf("List identifier in password mode"); |
| 1237 | memcpy(password,htd->pwd.password,4); |
| 1238 | blocknr = 0; |
| 1239 | bQuitTraceFull = false; |
| 1240 | bQuiet = false; |
| 1241 | bPwd = false; |
| 1242 | } break; |
| 1243 | case RHT2F_AUTHENTICATE: { |
| 1244 | DbpString("Authenticating using nr,ar pair:"); |
| 1245 | memcpy(NrAr,htd->auth.NrAr,8); |
| 1246 | Dbhexdump(8,NrAr,false); |
| 1247 | bQuiet = false; |
| 1248 | bCrypto = false; |
| 1249 | bAuthenticating = false; |
| 1250 | bQuitTraceFull = true; |
| 1251 | } break; |
| 1252 | case RHT2F_CRYPTO: |
| 1253 | { |
| 1254 | DbpString("Authenticating using key:"); |
| 1255 | memcpy(key,htd->crypto.key,6); //HACK; 4 or 6?? I read both in the code. |
| 1256 | Dbhexdump(6,key,false); |
| 1257 | blocknr = 0; |
| 1258 | bQuiet = false; |
| 1259 | bCrypto = false; |
| 1260 | bAuthenticating = false; |
| 1261 | bQuitTraceFull = true; |
| 1262 | } break; |
| 1263 | case RHT2F_TEST_AUTH_ATTEMPTS: { |
| 1264 | Dbprintf("Testing %d authentication attempts",(auth_table_len/8)); |
| 1265 | auth_table_pos = 0; |
| 1266 | memcpy(NrAr, auth_table, 8); |
| 1267 | bQuitTraceFull = false; |
| 1268 | bQuiet = false; |
| 1269 | bCrypto = false; |
| 1270 | } break; |
| 1271 | case RHT2F_UID_ONLY: { |
| 1272 | blocknr = 0; |
| 1273 | bQuiet = false; |
| 1274 | bCrypto = false; |
| 1275 | bAuthenticating = false; |
| 1276 | bQuitTraceFull = true; |
| 1277 | } break; |
| 1278 | default: { |
| 1279 | Dbprintf("Error, unknown function: %d",htf); |
| 1280 | return; |
| 1281 | } break; |
| 1282 | } |
| 1283 | |
| 1284 | LED_D_ON(); |
| 1285 | hitag2_init(); |
| 1286 | |
| 1287 | // Configure output and enable pin that is connected to the FPGA (for modulating) |
| 1288 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; |
| 1289 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; |
| 1290 | |
| 1291 | // Set fpga in edge detect with reader field, we can modulate as reader now |
| 1292 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_READER_FIELD); |
| 1293 | |
| 1294 | // Set Frequency divisor which will drive the FPGA and analog mux selection |
| 1295 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz |
| 1296 | SetAdcMuxFor(GPIO_MUXSEL_LOPKD); |
| 1297 | RELAY_OFF(); |
| 1298 | |
| 1299 | // Disable modulation at default, which means enable the field |
| 1300 | LOW(GPIO_SSC_DOUT); |
| 1301 | |
| 1302 | // Give it a bit of time for the resonant antenna to settle. |
| 1303 | SpinDelay(30); |
| 1304 | |
| 1305 | // Enable Peripheral Clock for TIMER_CLOCK0, used to measure exact timing before answering |
| 1306 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC0); |
| 1307 | |
| 1308 | // Enable Peripheral Clock for TIMER_CLOCK1, used to capture edges of the tag frames |
| 1309 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); |
| 1310 | AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME; |
| 1311 | |
| 1312 | // Disable timer during configuration |
| 1313 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; |
| 1314 | |
| 1315 | // Capture mode, defaul timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger, |
| 1316 | // external trigger rising edge, load RA on falling edge of TIOA. |
| 1317 | AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK | AT91C_TC_ETRGEDG_FALLING | AT91C_TC_ABETRG | AT91C_TC_LDRA_FALLING; |
| 1318 | |
| 1319 | // Enable and reset counters |
| 1320 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
| 1321 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
| 1322 | |
| 1323 | // Reset the received frame, frame count and timing info |
| 1324 | frame_count = 0; |
| 1325 | response = 0; |
| 1326 | lastbit = 1; |
| 1327 | bStop = false; |
| 1328 | |
| 1329 | // Tag specific configuration settings (sof, timings, etc.) |
| 1330 | if (htf < 10){ |
| 1331 | // hitagS settings |
| 1332 | reset_sof = 1; |
| 1333 | t_wait = 200; |
| 1334 | //DbpString("Configured for hitagS reader"); |
| 1335 | } else if (htf < 20) { |
| 1336 | // hitag1 settings |
| 1337 | reset_sof = 1; |
| 1338 | t_wait = 200; |
| 1339 | //DbpString("Configured for hitag1 reader"); |
| 1340 | } else if (htf < 30) { |
| 1341 | // hitag2 settings |
| 1342 | reset_sof = 4; |
| 1343 | t_wait = HITAG_T_WAIT_2; |
| 1344 | //DbpString("Configured for hitag2 reader"); |
| 1345 | } else { |
| 1346 | Dbprintf("Error, unknown hitag reader type: %d",htf); |
| 1347 | return; |
| 1348 | } |
| 1349 | uint8_t attempt_count=0; |
| 1350 | while(!bStop && !BUTTON_PRESS()) { |
| 1351 | // Watchdog hit |
| 1352 | WDT_HIT(); |
| 1353 | |
| 1354 | // Check if frame was captured and store it |
| 1355 | if(rxlen > 0) { |
| 1356 | frame_count++; |
| 1357 | if (!bQuiet) { |
| 1358 | if (!LogTraceHitag(rx,rxlen,response,0,false)) { |
| 1359 | DbpString("Trace full"); |
| 1360 | if (bQuitTraceFull) { |
| 1361 | break; |
| 1362 | } else { |
| 1363 | bQuiet = true; |
| 1364 | } |
| 1365 | } |
| 1366 | } |
| 1367 | } |
| 1368 | |
| 1369 | // By default reset the transmission buffer |
| 1370 | tx = txbuf; |
| 1371 | switch(htf) { |
| 1372 | case RHT2F_PASSWORD: { |
| 1373 | bStop = !hitag2_password(rx,rxlen,tx,&txlen); |
| 1374 | } break; |
| 1375 | case RHT2F_AUTHENTICATE: { |
| 1376 | bStop = !hitag2_authenticate(rx,rxlen,tx,&txlen); |
| 1377 | } break; |
| 1378 | case RHT2F_CRYPTO: { |
| 1379 | bStop = !hitag2_crypto(rx,rxlen,tx,&txlen, false); |
| 1380 | } break; |
| 1381 | case RHT2F_TEST_AUTH_ATTEMPTS: { |
| 1382 | bStop = !hitag2_test_auth_attempts(rx,rxlen,tx,&txlen); |
| 1383 | } break; |
| 1384 | case RHT2F_UID_ONLY: { |
| 1385 | bStop = !hitag2_read_uid(rx, rxlen, tx, &txlen); |
| 1386 | attempt_count++; //attempt 3 times to get uid then quit |
| 1387 | if (!bStop && attempt_count == 3) bStop = true; |
| 1388 | } break; |
| 1389 | default: { |
| 1390 | Dbprintf("Error, unknown function: %d",htf); |
| 1391 | return; |
| 1392 | } break; |
| 1393 | } |
| 1394 | |
| 1395 | // Send and store the reader command |
| 1396 | // Disable timer 1 with external trigger to avoid triggers during our own modulation |
| 1397 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; |
| 1398 | |
| 1399 | // Wait for HITAG_T_WAIT_2 carrier periods after the last tag bit before transmitting, |
| 1400 | // Since the clock counts since the last falling edge, a 'one' means that the |
| 1401 | // falling edge occured halfway the period. with respect to this falling edge, |
| 1402 | // we need to wait (T_Wait2 + half_tag_period) when the last was a 'one'. |
| 1403 | // All timer values are in terms of T0 units |
| 1404 | while(AT91C_BASE_TC0->TC_CV < T0*(t_wait+(HITAG_T_TAG_HALF_PERIOD*lastbit))); |
| 1405 | |
| 1406 | //Dbprintf("DEBUG: Sending reader frame"); |
| 1407 | |
| 1408 | // Transmit the reader frame |
| 1409 | hitag_reader_send_frame(tx,txlen); |
| 1410 | |
| 1411 | // Enable and reset external trigger in timer for capturing future frames |
| 1412 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
| 1413 | |
| 1414 | // Add transmitted frame to total count |
| 1415 | if(txlen > 0) { |
| 1416 | frame_count++; |
| 1417 | if (!bQuiet) { |
| 1418 | // Store the frame in the trace |
| 1419 | if (!LogTraceHitag(tx,txlen,HITAG_T_WAIT_2,0,true)) { |
| 1420 | if (bQuitTraceFull) { |
| 1421 | break; |
| 1422 | } else { |
| 1423 | bQuiet = true; |
| 1424 | } |
| 1425 | } |
| 1426 | } |
| 1427 | } |
| 1428 | |
| 1429 | // Reset values for receiving frames |
| 1430 | memset(rx,0x00,sizeof(rx)); |
| 1431 | rxlen = 0; |
| 1432 | lastbit = 1; |
| 1433 | bSkip = true; |
| 1434 | tag_sof = reset_sof; |
| 1435 | response = 0; |
| 1436 | //Dbprintf("DEBUG: Waiting to receive frame"); |
| 1437 | uint32_t errorCount = 0; |
| 1438 | |
| 1439 | // Receive frame, watch for at most T0*EOF periods |
| 1440 | while (AT91C_BASE_TC1->TC_CV < T0*HITAG_T_WAIT_MAX) { |
| 1441 | // Check if falling edge in tag modulation is detected |
| 1442 | if(AT91C_BASE_TC1->TC_SR & AT91C_TC_LDRAS) { |
| 1443 | // Retrieve the new timing values |
| 1444 | int ra = (AT91C_BASE_TC1->TC_RA/T0); |
| 1445 | |
| 1446 | // Reset timer every frame, we have to capture the last edge for timing |
| 1447 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG; |
| 1448 | |
| 1449 | LED_B_ON(); |
| 1450 | |
| 1451 | // Capture tag frame (manchester decoding using only falling edges) |
| 1452 | if(ra >= HITAG_T_EOF) { |
| 1453 | if (rxlen != 0) { |
| 1454 | //Dbprintf("DEBUG: Wierd1"); |
| 1455 | } |
| 1456 | // Capture the T0 periods that have passed since last communication or field drop (reset) |
| 1457 | // We always recieve a 'one' first, which has the falling edge after a half period |-_| |
| 1458 | response = ra-HITAG_T_TAG_HALF_PERIOD; |
| 1459 | } else if(ra >= HITAG_T_TAG_CAPTURE_FOUR_HALF) { |
| 1460 | // Manchester coding example |-_|_-|-_| (101) |
| 1461 | |
| 1462 | //need to test to verify we don't exceed memory... |
| 1463 | //if ( ((rxlen+2) / 8) > HITAG_FRAME_LEN) { |
| 1464 | // break; |
| 1465 | //} |
| 1466 | rx[rxlen / 8] |= 0 << (7-(rxlen%8)); |
| 1467 | rxlen++; |
| 1468 | rx[rxlen / 8] |= 1 << (7-(rxlen%8)); |
| 1469 | rxlen++; |
| 1470 | } else if(ra >= HITAG_T_TAG_CAPTURE_THREE_HALF) { |
| 1471 | // Manchester coding example |_-|...|_-|-_| (0...01) |
| 1472 | |
| 1473 | //need to test to verify we don't exceed memory... |
| 1474 | //if ( ((rxlen+2) / 8) > HITAG_FRAME_LEN) { |
| 1475 | // break; |
| 1476 | //} |
| 1477 | rx[rxlen / 8] |= 0 << (7-(rxlen%8)); |
| 1478 | rxlen++; |
| 1479 | // We have to skip this half period at start and add the 'one' the second time |
| 1480 | if (!bSkip) { |
| 1481 | rx[rxlen / 8] |= 1 << (7-(rxlen%8)); |
| 1482 | rxlen++; |
| 1483 | } |
| 1484 | lastbit = !lastbit; |
| 1485 | bSkip = !bSkip; |
| 1486 | } else if(ra >= HITAG_T_TAG_CAPTURE_TWO_HALF) { |
| 1487 | // Manchester coding example |_-|_-| (00) or |-_|-_| (11) |
| 1488 | |
| 1489 | //need to test to verify we don't exceed memory... |
| 1490 | //if ( ((rxlen+2) / 8) > HITAG_FRAME_LEN) { |
| 1491 | // break; |
| 1492 | //} |
| 1493 | if (tag_sof) { |
| 1494 | // Ignore bits that are transmitted during SOF |
| 1495 | tag_sof--; |
| 1496 | } else { |
| 1497 | // bit is same as last bit |
| 1498 | rx[rxlen / 8] |= lastbit << (7-(rxlen%8)); |
| 1499 | rxlen++; |
| 1500 | } |
| 1501 | } else { |
| 1502 | //Dbprintf("DEBUG: Wierd2"); |
| 1503 | errorCount++; |
| 1504 | // Ignore wierd value, is to small to mean anything |
| 1505 | } |
| 1506 | } |
| 1507 | //if we saw over 100 wierd values break it probably isn't hitag... |
| 1508 | if (errorCount >100) break; |
| 1509 | // We can break this loop if we received the last bit from a frame |
| 1510 | if (AT91C_BASE_TC1->TC_CV > T0*HITAG_T_EOF) { |
| 1511 | if (rxlen>0) break; |
| 1512 | } |
| 1513 | } |
| 1514 | } |
| 1515 | //Dbprintf("DEBUG: Done waiting for frame"); |
| 1516 | |
| 1517 | LED_B_OFF(); |
| 1518 | LED_D_OFF(); |
| 1519 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; |
| 1520 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; |
| 1521 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); |
| 1522 | //Dbprintf("frame received: %d",frame_count); |
| 1523 | //DbpString("All done"); |
| 1524 | cmd_send(CMD_ACK,bSuccessful,0,0,(byte_t*)tag.sectors,48); |
| 1525 | } |
| 1526 | |
| 1527 | void WriterHitag(hitag_function htf, hitag_data* htd, int page) { |
| 1528 | int frame_count; |
| 1529 | int response; |
| 1530 | byte_t rx[HITAG_FRAME_LEN]; |
| 1531 | size_t rxlen=0; |
| 1532 | byte_t txbuf[HITAG_FRAME_LEN]; |
| 1533 | byte_t* tx = txbuf; |
| 1534 | size_t txlen=0; |
| 1535 | int lastbit; |
| 1536 | bool bSkip; |
| 1537 | int reset_sof; |
| 1538 | int tag_sof; |
| 1539 | int t_wait = HITAG_T_WAIT_MAX; |
| 1540 | bool bStop; |
| 1541 | bool bQuitTraceFull = false; |
| 1542 | |
| 1543 | FpgaDownloadAndGo(FPGA_BITSTREAM_LF); |
| 1544 | // Reset the return status |
| 1545 | bSuccessful = false; |
| 1546 | |
| 1547 | // Clean up trace and prepare it for storing frames |
| 1548 | set_tracing(TRUE); |
| 1549 | clear_trace(); |
| 1550 | |
| 1551 | //DbpString("Starting Hitag reader family"); |
| 1552 | |
| 1553 | // Check configuration |
| 1554 | switch(htf) { |
| 1555 | case WHT2F_CRYPTO: |
| 1556 | { |
| 1557 | DbpString("Authenticating using key:"); |
| 1558 | memcpy(key,htd->crypto.key,6); //HACK; 4 or 6?? I read both in the code. |
| 1559 | memcpy(writedata, htd->crypto.data, 4); |
| 1560 | Dbhexdump(6,key,false); |
| 1561 | blocknr = page; |
| 1562 | bQuiet = false; |
| 1563 | bCrypto = false; |
| 1564 | bAuthenticating = false; |
| 1565 | bQuitTraceFull = true; |
| 1566 | writestate = WRITE_STATE_START; |
| 1567 | } break; |
| 1568 | default: { |
| 1569 | Dbprintf("Error, unknown function: %d",htf); |
| 1570 | return; |
| 1571 | } break; |
| 1572 | } |
| 1573 | |
| 1574 | LED_D_ON(); |
| 1575 | hitag2_init(); |
| 1576 | |
| 1577 | // Configure output and enable pin that is connected to the FPGA (for modulating) |
| 1578 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; |
| 1579 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; |
| 1580 | |
| 1581 | // Set fpga in edge detect with reader field, we can modulate as reader now |
| 1582 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_READER_FIELD); |
| 1583 | |
| 1584 | // Set Frequency divisor which will drive the FPGA and analog mux selection |
| 1585 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz |
| 1586 | SetAdcMuxFor(GPIO_MUXSEL_LOPKD); |
| 1587 | RELAY_OFF(); |
| 1588 | |
| 1589 | // Disable modulation at default, which means enable the field |
| 1590 | LOW(GPIO_SSC_DOUT); |
| 1591 | |
| 1592 | // Give it a bit of time for the resonant antenna to settle. |
| 1593 | SpinDelay(30); |
| 1594 | |
| 1595 | // Enable Peripheral Clock for TIMER_CLOCK0, used to measure exact timing before answering |
| 1596 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC0); |
| 1597 | |
| 1598 | // Enable Peripheral Clock for TIMER_CLOCK1, used to capture edges of the tag frames |
| 1599 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); |
| 1600 | AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME; |
| 1601 | |
| 1602 | // Disable timer during configuration |
| 1603 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; |
| 1604 | |
| 1605 | // Capture mode, defaul timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger, |
| 1606 | // external trigger rising edge, load RA on falling edge of TIOA. |
| 1607 | AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK | AT91C_TC_ETRGEDG_FALLING | AT91C_TC_ABETRG | AT91C_TC_LDRA_FALLING; |
| 1608 | |
| 1609 | // Enable and reset counters |
| 1610 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
| 1611 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
| 1612 | |
| 1613 | // Reset the received frame, frame count and timing info |
| 1614 | frame_count = 0; |
| 1615 | response = 0; |
| 1616 | lastbit = 1; |
| 1617 | bStop = false; |
| 1618 | |
| 1619 | // Tag specific configuration settings (sof, timings, etc.) |
| 1620 | if (htf < 10){ |
| 1621 | // hitagS settings |
| 1622 | reset_sof = 1; |
| 1623 | t_wait = 200; |
| 1624 | //DbpString("Configured for hitagS reader"); |
| 1625 | } else if (htf < 20) { |
| 1626 | // hitag1 settings |
| 1627 | reset_sof = 1; |
| 1628 | t_wait = 200; |
| 1629 | //DbpString("Configured for hitag1 reader"); |
| 1630 | } else if (htf < 30) { |
| 1631 | // hitag2 settings |
| 1632 | reset_sof = 4; |
| 1633 | t_wait = HITAG_T_WAIT_2; |
| 1634 | //DbpString("Configured for hitag2 reader"); |
| 1635 | } else { |
| 1636 | Dbprintf("Error, unknown hitag reader type: %d",htf); |
| 1637 | return; |
| 1638 | } |
| 1639 | while(!bStop && !BUTTON_PRESS()) { |
| 1640 | // Watchdog hit |
| 1641 | WDT_HIT(); |
| 1642 | |
| 1643 | // Check if frame was captured and store it |
| 1644 | if(rxlen > 0) { |
| 1645 | frame_count++; |
| 1646 | if (!bQuiet) { |
| 1647 | if (!LogTraceHitag(rx,rxlen,response,0,false)) { |
| 1648 | DbpString("Trace full"); |
| 1649 | if (bQuitTraceFull) { |
| 1650 | break; |
| 1651 | } else { |
| 1652 | bQuiet = true; |
| 1653 | } |
| 1654 | } |
| 1655 | } |
| 1656 | } |
| 1657 | |
| 1658 | // By default reset the transmission buffer |
| 1659 | tx = txbuf; |
| 1660 | switch(htf) { |
| 1661 | case WHT2F_CRYPTO: { |
| 1662 | bStop = !hitag2_crypto(rx,rxlen,tx,&txlen, true); |
| 1663 | } break; |
| 1664 | default: { |
| 1665 | Dbprintf("Error, unknown function: %d",htf); |
| 1666 | return; |
| 1667 | } break; |
| 1668 | } |
| 1669 | |
| 1670 | // Send and store the reader command |
| 1671 | // Disable timer 1 with external trigger to avoid triggers during our own modulation |
| 1672 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; |
| 1673 | |
| 1674 | // Wait for HITAG_T_WAIT_2 carrier periods after the last tag bit before transmitting, |
| 1675 | // Since the clock counts since the last falling edge, a 'one' means that the |
| 1676 | // falling edge occured halfway the period. with respect to this falling edge, |
| 1677 | // we need to wait (T_Wait2 + half_tag_period) when the last was a 'one'. |
| 1678 | // All timer values are in terms of T0 units |
| 1679 | while(AT91C_BASE_TC0->TC_CV < T0*(t_wait+(HITAG_T_TAG_HALF_PERIOD*lastbit))); |
| 1680 | |
| 1681 | //Dbprintf("DEBUG: Sending reader frame"); |
| 1682 | |
| 1683 | // Transmit the reader frame |
| 1684 | hitag_reader_send_frame(tx,txlen); |
| 1685 | |
| 1686 | // Enable and reset external trigger in timer for capturing future frames |
| 1687 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
| 1688 | |
| 1689 | // Add transmitted frame to total count |
| 1690 | if(txlen > 0) { |
| 1691 | frame_count++; |
| 1692 | if (!bQuiet) { |
| 1693 | // Store the frame in the trace |
| 1694 | if (!LogTraceHitag(tx,txlen,HITAG_T_WAIT_2,0,true)) { |
| 1695 | if (bQuitTraceFull) { |
| 1696 | break; |
| 1697 | } else { |
| 1698 | bQuiet = true; |
| 1699 | } |
| 1700 | } |
| 1701 | } |
| 1702 | } |
| 1703 | |
| 1704 | // Reset values for receiving frames |
| 1705 | memset(rx,0x00,sizeof(rx)); |
| 1706 | rxlen = 0; |
| 1707 | lastbit = 1; |
| 1708 | bSkip = true; |
| 1709 | tag_sof = reset_sof; |
| 1710 | response = 0; |
| 1711 | //Dbprintf("DEBUG: Waiting to receive frame"); |
| 1712 | uint32_t errorCount = 0; |
| 1713 | |
| 1714 | // Receive frame, watch for at most T0*EOF periods |
| 1715 | while (AT91C_BASE_TC1->TC_CV < T0*HITAG_T_WAIT_MAX) { |
| 1716 | // Check if falling edge in tag modulation is detected |
| 1717 | if(AT91C_BASE_TC1->TC_SR & AT91C_TC_LDRAS) { |
| 1718 | // Retrieve the new timing values |
| 1719 | int ra = (AT91C_BASE_TC1->TC_RA/T0); |
| 1720 | |
| 1721 | // Reset timer every frame, we have to capture the last edge for timing |
| 1722 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG; |
| 1723 | |
| 1724 | LED_B_ON(); |
| 1725 | |
| 1726 | // Capture tag frame (manchester decoding using only falling edges) |
| 1727 | if(ra >= HITAG_T_EOF) { |
| 1728 | if (rxlen != 0) { |
| 1729 | //Dbprintf("DEBUG: Wierd1"); |
| 1730 | } |
| 1731 | // Capture the T0 periods that have passed since last communication or field drop (reset) |
| 1732 | // We always recieve a 'one' first, which has the falling edge after a half period |-_| |
| 1733 | response = ra-HITAG_T_TAG_HALF_PERIOD; |
| 1734 | } else if(ra >= HITAG_T_TAG_CAPTURE_FOUR_HALF) { |
| 1735 | // Manchester coding example |-_|_-|-_| (101) |
| 1736 | |
| 1737 | //need to test to verify we don't exceed memory... |
| 1738 | //if ( ((rxlen+2) / 8) > HITAG_FRAME_LEN) { |
| 1739 | // break; |
| 1740 | //} |
| 1741 | rx[rxlen / 8] |= 0 << (7-(rxlen%8)); |
| 1742 | rxlen++; |
| 1743 | rx[rxlen / 8] |= 1 << (7-(rxlen%8)); |
| 1744 | rxlen++; |
| 1745 | } else if(ra >= HITAG_T_TAG_CAPTURE_THREE_HALF) { |
| 1746 | // Manchester coding example |_-|...|_-|-_| (0...01) |
| 1747 | |
| 1748 | //need to test to verify we don't exceed memory... |
| 1749 | //if ( ((rxlen+2) / 8) > HITAG_FRAME_LEN) { |
| 1750 | // break; |
| 1751 | //} |
| 1752 | rx[rxlen / 8] |= 0 << (7-(rxlen%8)); |
| 1753 | rxlen++; |
| 1754 | // We have to skip this half period at start and add the 'one' the second time |
| 1755 | if (!bSkip) { |
| 1756 | rx[rxlen / 8] |= 1 << (7-(rxlen%8)); |
| 1757 | rxlen++; |
| 1758 | } |
| 1759 | lastbit = !lastbit; |
| 1760 | bSkip = !bSkip; |
| 1761 | } else if(ra >= HITAG_T_TAG_CAPTURE_TWO_HALF) { |
| 1762 | // Manchester coding example |_-|_-| (00) or |-_|-_| (11) |
| 1763 | |
| 1764 | //need to test to verify we don't exceed memory... |
| 1765 | //if ( ((rxlen+2) / 8) > HITAG_FRAME_LEN) { |
| 1766 | // break; |
| 1767 | //} |
| 1768 | if (tag_sof) { |
| 1769 | // Ignore bits that are transmitted during SOF |
| 1770 | tag_sof--; |
| 1771 | } else { |
| 1772 | // bit is same as last bit |
| 1773 | rx[rxlen / 8] |= lastbit << (7-(rxlen%8)); |
| 1774 | rxlen++; |
| 1775 | } |
| 1776 | } else { |
| 1777 | //Dbprintf("DEBUG: Wierd2"); |
| 1778 | errorCount++; |
| 1779 | // Ignore wierd value, is to small to mean anything |
| 1780 | } |
| 1781 | } |
| 1782 | //if we saw over 100 wierd values break it probably isn't hitag... |
| 1783 | if (errorCount >100) break; |
| 1784 | // We can break this loop if we received the last bit from a frame |
| 1785 | if (AT91C_BASE_TC1->TC_CV > T0*HITAG_T_EOF) { |
| 1786 | if (rxlen>0) break; |
| 1787 | } |
| 1788 | } |
| 1789 | |
| 1790 | // Wait some extra time for flash to be programmed |
| 1791 | if ((rxlen == 0) && (writestate == WRITE_STATE_PROG)) |
| 1792 | { |
| 1793 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG; |
| 1794 | while(AT91C_BASE_TC0->TC_CV < T0*(HITAG_T_PROG - HITAG_T_WAIT_MAX)); |
| 1795 | } |
| 1796 | } |
| 1797 | //Dbprintf("DEBUG: Done waiting for frame"); |
| 1798 | |
| 1799 | LED_B_OFF(); |
| 1800 | LED_D_OFF(); |
| 1801 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; |
| 1802 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; |
| 1803 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); |
| 1804 | //Dbprintf("frame received: %d",frame_count); |
| 1805 | //DbpString("All done"); |
| 1806 | cmd_send(CMD_ACK,bSuccessful,0,0,(byte_t*)tag.sectors,48); |
| 1807 | } |