| 1 | //----------------------------------------------------------------------------- |
| 2 | // (c) 2009 Henryk Plötz <henryk@ploetzli.ch> |
| 3 | // |
| 4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
| 5 | // at your option, any later version. See the LICENSE.txt file for the text of |
| 6 | // the license. |
| 7 | //----------------------------------------------------------------------------- |
| 8 | // LEGIC RF simulation code |
| 9 | //----------------------------------------------------------------------------- |
| 10 | |
| 11 | #include "../include/proxmark3.h" |
| 12 | #include "apps.h" |
| 13 | #include "util.h" |
| 14 | #include "string.h" |
| 15 | |
| 16 | #include "legicrf.h" |
| 17 | #include "../include/legic_prng.h" |
| 18 | #include "../common/crc.h" |
| 19 | |
| 20 | static struct legic_frame { |
| 21 | int bits; |
| 22 | uint32_t data; |
| 23 | } current_frame; |
| 24 | |
| 25 | static enum { |
| 26 | STATE_DISCON, |
| 27 | STATE_IV, |
| 28 | STATE_CON, |
| 29 | } legic_state; |
| 30 | |
| 31 | static crc_t legic_crc; |
| 32 | static int legic_read_count; |
| 33 | static uint32_t legic_prng_bc; |
| 34 | static uint32_t legic_prng_iv; |
| 35 | |
| 36 | static int legic_phase_drift; |
| 37 | static int legic_frame_drift; |
| 38 | static int legic_reqresp_drift; |
| 39 | |
| 40 | AT91PS_TC timer; |
| 41 | AT91PS_TC prng_timer; |
| 42 | |
| 43 | static void setup_timer(void) |
| 44 | { |
| 45 | /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging |
| 46 | * this it won't be terribly accurate but should be good enough. |
| 47 | */ |
| 48 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); |
| 49 | timer = AT91C_BASE_TC1; |
| 50 | timer->TC_CCR = AT91C_TC_CLKDIS; |
| 51 | timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK; |
| 52 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
| 53 | |
| 54 | /* |
| 55 | * Set up Timer 2 to use for measuring time between frames in |
| 56 | * tag simulation mode. Runs 4x faster as Timer 1 |
| 57 | */ |
| 58 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC2); |
| 59 | prng_timer = AT91C_BASE_TC2; |
| 60 | prng_timer->TC_CCR = AT91C_TC_CLKDIS; |
| 61 | prng_timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV2_CLOCK; |
| 62 | prng_timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
| 63 | } |
| 64 | |
| 65 | /* At TIMER_CLOCK3 (MCK/32) */ |
| 66 | #define RWD_TIME_1 150 /* RWD_TIME_PAUSE off, 80us on = 100us */ |
| 67 | #define RWD_TIME_0 90 /* RWD_TIME_PAUSE off, 40us on = 60us */ |
| 68 | #define RWD_TIME_PAUSE 30 /* 20us */ |
| 69 | #define RWD_TIME_FUZZ 20 /* rather generous 13us, since the peak detector + hysteresis fuzz quite a bit */ |
| 70 | #define TAG_TIME_BIT 150 /* 100us for every bit */ |
| 71 | #define TAG_TIME_WAIT 490 /* time from RWD frame end to tag frame start, experimentally determined */ |
| 72 | |
| 73 | #define SIM_DIVISOR 586 /* prng_time/SIM_DIVISOR count prng needs to be forwared */ |
| 74 | #define SIM_SHIFT 900 /* prng_time+SIM_SHIFT shift of delayed start */ |
| 75 | |
| 76 | #define SESSION_IV 0x55 |
| 77 | #define OFFSET_LOG 1024 |
| 78 | |
| 79 | #define FUZZ_EQUAL(value, target, fuzz) ((value) > ((target)-(fuzz)) && (value) < ((target)+(fuzz))) |
| 80 | |
| 81 | /* Generate Keystream */ |
| 82 | static uint32_t get_key_stream(int skip, int count) |
| 83 | { |
| 84 | uint32_t key=0; int i; |
| 85 | |
| 86 | /* Use int to enlarge timer tc to 32bit */ |
| 87 | legic_prng_bc += prng_timer->TC_CV; |
| 88 | prng_timer->TC_CCR = AT91C_TC_SWTRG; |
| 89 | |
| 90 | /* If skip == -1, forward prng time based */ |
| 91 | if(skip == -1) { |
| 92 | i = (legic_prng_bc+SIM_SHIFT)/SIM_DIVISOR; /* Calculate Cycles based on timer */ |
| 93 | i -= legic_prng_count(); /* substract cycles of finished frames */ |
| 94 | i -= count; /* substract current frame length, rewidn to bedinning */ |
| 95 | legic_prng_forward(i); |
| 96 | } else { |
| 97 | legic_prng_forward(skip); |
| 98 | } |
| 99 | |
| 100 | /* Write Time Data into LOG */ |
| 101 | uint8_t *BigBuf = BigBuf_get_addr(); |
| 102 | if(count == 6) { i = -1; } else { i = legic_read_count; } |
| 103 | BigBuf[OFFSET_LOG+128+i] = legic_prng_count(); |
| 104 | BigBuf[OFFSET_LOG+256+i*4] = (legic_prng_bc >> 0) & 0xff; |
| 105 | BigBuf[OFFSET_LOG+256+i*4+1] = (legic_prng_bc >> 8) & 0xff; |
| 106 | BigBuf[OFFSET_LOG+256+i*4+2] = (legic_prng_bc >>16) & 0xff; |
| 107 | BigBuf[OFFSET_LOG+256+i*4+3] = (legic_prng_bc >>24) & 0xff; |
| 108 | BigBuf[OFFSET_LOG+384+i] = count; |
| 109 | |
| 110 | /* Generate KeyStream */ |
| 111 | for(i=0; i<count; i++) { |
| 112 | key |= legic_prng_get_bit() << i; |
| 113 | legic_prng_forward(1); |
| 114 | } |
| 115 | return key; |
| 116 | } |
| 117 | |
| 118 | /* Send a frame in tag mode, the FPGA must have been set up by |
| 119 | * LegicRfSimulate |
| 120 | */ |
| 121 | static void frame_send_tag(uint16_t response, int bits, int crypt) |
| 122 | { |
| 123 | /* Bitbang the response */ |
| 124 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; |
| 125 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; |
| 126 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; |
| 127 | |
| 128 | /* Use time to crypt frame */ |
| 129 | if(crypt) { |
| 130 | legic_prng_forward(2); /* TAG_TIME_WAIT -> shift by 2 */ |
| 131 | int i; int key = 0; |
| 132 | for(i=0; i<bits; i++) { |
| 133 | key |= legic_prng_get_bit() << i; |
| 134 | legic_prng_forward(1); |
| 135 | } |
| 136 | //Dbprintf("key = 0x%x", key); |
| 137 | response = response ^ key; |
| 138 | } |
| 139 | |
| 140 | /* Wait for the frame start */ |
| 141 | while(timer->TC_CV < (TAG_TIME_WAIT - 30)) ; |
| 142 | |
| 143 | int i; |
| 144 | for(i=0; i<bits; i++) { |
| 145 | int nextbit = timer->TC_CV + TAG_TIME_BIT; |
| 146 | int bit = response & 1; |
| 147 | response = response >> 1; |
| 148 | if(bit) { |
| 149 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; |
| 150 | } else { |
| 151 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; |
| 152 | } |
| 153 | while(timer->TC_CV < nextbit) ; |
| 154 | } |
| 155 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; |
| 156 | } |
| 157 | |
| 158 | /* Send a frame in reader mode, the FPGA must have been set up by |
| 159 | * LegicRfReader |
| 160 | */ |
| 161 | static void frame_send_rwd(uint32_t data, int bits) |
| 162 | { |
| 163 | /* Start clock */ |
| 164 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
| 165 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ |
| 166 | |
| 167 | int i; |
| 168 | for(i=0; i<bits; i++) { |
| 169 | int starttime = timer->TC_CV; |
| 170 | int pause_end = starttime + RWD_TIME_PAUSE, bit_end; |
| 171 | int bit = data & 1; |
| 172 | data = data >> 1; |
| 173 | |
| 174 | if(bit ^ legic_prng_get_bit()) { |
| 175 | bit_end = starttime + RWD_TIME_1; |
| 176 | } else { |
| 177 | bit_end = starttime + RWD_TIME_0; |
| 178 | } |
| 179 | |
| 180 | /* RWD_TIME_PAUSE time off, then some time on, so that the complete bit time is |
| 181 | * RWD_TIME_x, where x is the bit to be transmitted */ |
| 182 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; |
| 183 | while(timer->TC_CV < pause_end) ; |
| 184 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; |
| 185 | legic_prng_forward(1); /* bit duration is longest. use this time to forward the lfsr */ |
| 186 | |
| 187 | while(timer->TC_CV < bit_end) ; |
| 188 | } |
| 189 | |
| 190 | { |
| 191 | /* One final pause to mark the end of the frame */ |
| 192 | int pause_end = timer->TC_CV + RWD_TIME_PAUSE; |
| 193 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; |
| 194 | while(timer->TC_CV < pause_end) ; |
| 195 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; |
| 196 | } |
| 197 | |
| 198 | /* Reset the timer, to measure time until the start of the tag frame */ |
| 199 | timer->TC_CCR = AT91C_TC_SWTRG; |
| 200 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ |
| 201 | } |
| 202 | |
| 203 | /* Receive a frame from the card in reader emulation mode, the FPGA and |
| 204 | * timer must have been set up by LegicRfReader and frame_send_rwd. |
| 205 | * |
| 206 | * The LEGIC RF protocol from card to reader does not include explicit |
| 207 | * frame start/stop information or length information. The reader must |
| 208 | * know beforehand how many bits it wants to receive. (Notably: a card |
| 209 | * sending a stream of 0-bits is indistinguishable from no card present.) |
| 210 | * |
| 211 | * Receive methodology: There is a fancy correlator in hi_read_rx_xcorr, but |
| 212 | * I'm not smart enough to use it. Instead I have patched hi_read_tx to output |
| 213 | * the ADC signal with hysteresis on SSP_DIN. Bit-bang that signal and look |
| 214 | * for edges. Count the edges in each bit interval. If they are approximately |
| 215 | * 0 this was a 0-bit, if they are approximately equal to the number of edges |
| 216 | * expected for a 212kHz subcarrier, this was a 1-bit. For timing we use the |
| 217 | * timer that's still running from frame_send_rwd in order to get a synchronization |
| 218 | * with the frame that we just sent. |
| 219 | * |
| 220 | * FIXME: Because we're relying on the hysteresis to just do the right thing |
| 221 | * the range is severely reduced (and you'll probably also need a good antenna). |
| 222 | * So this should be fixed some time in the future for a proper receiver. |
| 223 | */ |
| 224 | static void frame_receive_rwd(struct legic_frame * const f, int bits, int crypt) |
| 225 | { |
| 226 | uint32_t the_bit = 1; /* Use a bitmask to save on shifts */ |
| 227 | uint32_t data=0; |
| 228 | int i, old_level=0, edges=0; |
| 229 | int next_bit_at = TAG_TIME_WAIT; |
| 230 | |
| 231 | if(bits > 32) { |
| 232 | bits = 32; |
| 233 | } |
| 234 | |
| 235 | AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; |
| 236 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; |
| 237 | |
| 238 | /* we have some time now, precompute the cipher |
| 239 | * since we cannot compute it on the fly while reading */ |
| 240 | legic_prng_forward(2); |
| 241 | |
| 242 | if(crypt) |
| 243 | { |
| 244 | for(i=0; i<bits; i++) { |
| 245 | data |= legic_prng_get_bit() << i; |
| 246 | legic_prng_forward(1); |
| 247 | } |
| 248 | } |
| 249 | |
| 250 | while(timer->TC_CV < next_bit_at) ; |
| 251 | |
| 252 | next_bit_at += TAG_TIME_BIT; |
| 253 | |
| 254 | for(i=0; i<bits; i++) { |
| 255 | edges = 0; |
| 256 | while(timer->TC_CV < next_bit_at) { |
| 257 | int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); |
| 258 | if(level != old_level) |
| 259 | edges++; |
| 260 | old_level = level; |
| 261 | } |
| 262 | next_bit_at += TAG_TIME_BIT; |
| 263 | |
| 264 | if(edges > 20 && edges < 60) { /* expected are 42 edges */ |
| 265 | data ^= the_bit; |
| 266 | } |
| 267 | the_bit <<= 1; |
| 268 | } |
| 269 | |
| 270 | f->data = data; |
| 271 | f->bits = bits; |
| 272 | |
| 273 | /* Reset the timer, to synchronize the next frame */ |
| 274 | timer->TC_CCR = AT91C_TC_SWTRG; |
| 275 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ |
| 276 | } |
| 277 | |
| 278 | static void frame_append_bit(struct legic_frame * const f, int bit) |
| 279 | { |
| 280 | if(f->bits >= 31) { |
| 281 | return; /* Overflow, won't happen */ |
| 282 | } |
| 283 | f->data |= (bit<<f->bits); |
| 284 | f->bits++; |
| 285 | } |
| 286 | |
| 287 | static void frame_clean(struct legic_frame * const f) |
| 288 | { |
| 289 | f->data = 0; |
| 290 | f->bits = 0; |
| 291 | } |
| 292 | |
| 293 | static uint32_t perform_setup_phase_rwd(int iv) |
| 294 | { |
| 295 | |
| 296 | /* Switch on carrier and let the tag charge for 1ms */ |
| 297 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; |
| 298 | SpinDelay(1); |
| 299 | |
| 300 | legic_prng_init(0); /* no keystream yet */ |
| 301 | frame_send_rwd(iv, 7); |
| 302 | legic_prng_init(iv); |
| 303 | |
| 304 | frame_clean(¤t_frame); |
| 305 | frame_receive_rwd(¤t_frame, 6, 1); |
| 306 | legic_prng_forward(1); /* we wait anyways */ |
| 307 | while(timer->TC_CV < 387) ; /* ~ 258us */ |
| 308 | frame_send_rwd(0x19, 6); |
| 309 | |
| 310 | return current_frame.data; |
| 311 | } |
| 312 | |
| 313 | static void LegicCommonInit(void) { |
| 314 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
| 315 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
| 316 | FpgaSetupSsc(); |
| 317 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX); |
| 318 | |
| 319 | /* Bitbang the transmitter */ |
| 320 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; |
| 321 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; |
| 322 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; |
| 323 | |
| 324 | setup_timer(); |
| 325 | |
| 326 | crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0); |
| 327 | } |
| 328 | |
| 329 | static void switch_off_tag_rwd(void) |
| 330 | { |
| 331 | /* Switch off carrier, make sure tag is reset */ |
| 332 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; |
| 333 | SpinDelay(10); |
| 334 | |
| 335 | WDT_HIT(); |
| 336 | } |
| 337 | /* calculate crc for a legic command */ |
| 338 | static int LegicCRC(int byte_index, int value, int cmd_sz) { |
| 339 | crc_clear(&legic_crc); |
| 340 | crc_update(&legic_crc, 1, 1); /* CMD_READ */ |
| 341 | crc_update(&legic_crc, byte_index, cmd_sz-1); |
| 342 | crc_update(&legic_crc, value, 8); |
| 343 | return crc_finish(&legic_crc); |
| 344 | } |
| 345 | |
| 346 | int legic_read_byte(int byte_index, int cmd_sz) { |
| 347 | int byte; |
| 348 | |
| 349 | legic_prng_forward(4); /* we wait anyways */ |
| 350 | while(timer->TC_CV < 387) ; /* ~ 258us + 100us*delay */ |
| 351 | |
| 352 | frame_send_rwd(1 | (byte_index << 1), cmd_sz); |
| 353 | frame_clean(¤t_frame); |
| 354 | |
| 355 | frame_receive_rwd(¤t_frame, 12, 1); |
| 356 | |
| 357 | byte = current_frame.data & 0xff; |
| 358 | if( LegicCRC(byte_index, byte, cmd_sz) != (current_frame.data >> 8) ) { |
| 359 | Dbprintf("!!! crc mismatch: expected %x but got %x !!!", |
| 360 | LegicCRC(byte_index, current_frame.data & 0xff, cmd_sz), current_frame.data >> 8); |
| 361 | return -1; |
| 362 | } |
| 363 | |
| 364 | return byte; |
| 365 | } |
| 366 | |
| 367 | /* legic_write_byte() is not included, however it's trivial to implement |
| 368 | * and here are some hints on what remains to be done: |
| 369 | * |
| 370 | * * assemble a write_cmd_frame with crc and send it |
| 371 | * * wait until the tag sends back an ACK ('1' bit unencrypted) |
| 372 | * * forward the prng based on the timing |
| 373 | */ |
| 374 | int legic_write_byte(int byte, int addr, int addr_sz) { |
| 375 | //do not write UID, CRC, DCF |
| 376 | if(addr <= 0x06) { |
| 377 | return 0; |
| 378 | } |
| 379 | |
| 380 | //== send write command ============================== |
| 381 | crc_clear(&legic_crc); |
| 382 | crc_update(&legic_crc, 0, 1); /* CMD_WRITE */ |
| 383 | crc_update(&legic_crc, addr, addr_sz); |
| 384 | crc_update(&legic_crc, byte, 8); |
| 385 | |
| 386 | uint32_t crc = crc_finish(&legic_crc); |
| 387 | uint32_t cmd = ((crc <<(addr_sz+1+8)) //CRC |
| 388 | |(byte <<(addr_sz+1)) //Data |
| 389 | |(addr <<1) //Address |
| 390 | |(0x00 <<0)); //CMD = W |
| 391 | uint32_t cmd_sz = addr_sz+1+8+4; //crc+data+cmd |
| 392 | |
| 393 | legic_prng_forward(2); /* we wait anyways */ |
| 394 | while(timer->TC_CV < 387) ; /* ~ 258us */ |
| 395 | frame_send_rwd(cmd, cmd_sz); |
| 396 | |
| 397 | //== wait for ack ==================================== |
| 398 | int t, old_level=0, edges=0; |
| 399 | int next_bit_at =0; |
| 400 | while(timer->TC_CV < 387) ; /* ~ 258us */ |
| 401 | for(t=0; t<80; t++) { |
| 402 | edges = 0; |
| 403 | next_bit_at += TAG_TIME_BIT; |
| 404 | while(timer->TC_CV < next_bit_at) { |
| 405 | int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); |
| 406 | if(level != old_level) { |
| 407 | edges++; |
| 408 | } |
| 409 | old_level = level; |
| 410 | } |
| 411 | if(edges > 20 && edges < 60) { /* expected are 42 edges */ |
| 412 | int t = timer->TC_CV; |
| 413 | int c = t/TAG_TIME_BIT; |
| 414 | timer->TC_CCR = AT91C_TC_SWTRG; |
| 415 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ |
| 416 | legic_prng_forward(c); |
| 417 | return 0; |
| 418 | } |
| 419 | } |
| 420 | timer->TC_CCR = AT91C_TC_SWTRG; |
| 421 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ |
| 422 | return -1; |
| 423 | } |
| 424 | |
| 425 | int LegicRfReader(int offset, int bytes) { |
| 426 | int byte_index=0, cmd_sz=0, card_sz=0; |
| 427 | |
| 428 | LegicCommonInit(); |
| 429 | |
| 430 | uint8_t *BigBuf = BigBuf_get_addr(); |
| 431 | memset(BigBuf, 0, 1024); |
| 432 | |
| 433 | DbpString("setting up legic card"); |
| 434 | uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV); |
| 435 | switch_off_tag_rwd(); //we lose to mutch time with dprintf |
| 436 | switch(tag_type) { |
| 437 | case 0x1d: |
| 438 | DbpString("MIM 256 card found, reading card ..."); |
| 439 | cmd_sz = 9; |
| 440 | card_sz = 256; |
| 441 | break; |
| 442 | case 0x3d: |
| 443 | DbpString("MIM 1024 card found, reading card ..."); |
| 444 | cmd_sz = 11; |
| 445 | card_sz = 1024; |
| 446 | break; |
| 447 | default: |
| 448 | Dbprintf("Unknown card format: %x",tag_type); |
| 449 | return -1; |
| 450 | } |
| 451 | if(bytes == -1) { |
| 452 | bytes = card_sz; |
| 453 | } |
| 454 | if(bytes+offset >= card_sz) { |
| 455 | bytes = card_sz-offset; |
| 456 | } |
| 457 | |
| 458 | perform_setup_phase_rwd(SESSION_IV); |
| 459 | |
| 460 | LED_B_ON(); |
| 461 | while(byte_index < bytes) { |
| 462 | int r = legic_read_byte(byte_index+offset, cmd_sz); |
| 463 | if(r == -1 ||BUTTON_PRESS()) { |
| 464 | DbpString("operation aborted"); |
| 465 | switch_off_tag_rwd(); |
| 466 | LED_B_OFF(); |
| 467 | LED_C_OFF(); |
| 468 | return -1; |
| 469 | } |
| 470 | BigBuf[byte_index] = r; |
| 471 | WDT_HIT(); |
| 472 | byte_index++; |
| 473 | if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF(); |
| 474 | } |
| 475 | LED_B_OFF(); |
| 476 | LED_C_OFF(); |
| 477 | switch_off_tag_rwd(); |
| 478 | Dbprintf("Card read, use 'hf legic decode' or"); |
| 479 | Dbprintf("'data hexsamples %d' to view results", (bytes+7) & ~7); |
| 480 | return 0; |
| 481 | } |
| 482 | |
| 483 | void LegicRfWriter(int bytes, int offset) { |
| 484 | int byte_index=0, addr_sz=0; |
| 485 | uint8_t *BigBuf = BigBuf_get_addr(); |
| 486 | |
| 487 | LegicCommonInit(); |
| 488 | |
| 489 | DbpString("setting up legic card"); |
| 490 | uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV); |
| 491 | switch_off_tag_rwd(); |
| 492 | switch(tag_type) { |
| 493 | case 0x1d: |
| 494 | if(offset+bytes > 0x100) { |
| 495 | Dbprintf("Error: can not write to 0x%03.3x on MIM 256", offset+bytes); |
| 496 | return; |
| 497 | } |
| 498 | addr_sz = 8; |
| 499 | Dbprintf("MIM 256 card found, writing 0x%02.2x - 0x%02.2x ...", offset, offset+bytes); |
| 500 | break; |
| 501 | case 0x3d: |
| 502 | if(offset+bytes > 0x400) { |
| 503 | Dbprintf("Error: can not write to 0x%03.3x on MIM 1024", offset+bytes); |
| 504 | return; |
| 505 | } |
| 506 | addr_sz = 10; |
| 507 | Dbprintf("MIM 1024 card found, writing 0x%03.3x - 0x%03.3x ...", offset, offset+bytes); |
| 508 | break; |
| 509 | default: |
| 510 | Dbprintf("No or unknown card found, aborting"); |
| 511 | return; |
| 512 | } |
| 513 | |
| 514 | LED_B_ON(); |
| 515 | perform_setup_phase_rwd(SESSION_IV); |
| 516 | legic_prng_forward(2); |
| 517 | while(byte_index < bytes) { |
| 518 | int r = legic_write_byte(BigBuf[byte_index+offset], byte_index+offset, addr_sz); |
| 519 | if((r != 0) || BUTTON_PRESS()) { |
| 520 | Dbprintf("operation aborted @ 0x%03.3x", byte_index); |
| 521 | switch_off_tag_rwd(); |
| 522 | LED_B_OFF(); |
| 523 | LED_C_OFF(); |
| 524 | return; |
| 525 | } |
| 526 | WDT_HIT(); |
| 527 | byte_index++; |
| 528 | if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF(); |
| 529 | } |
| 530 | LED_B_OFF(); |
| 531 | LED_C_OFF(); |
| 532 | DbpString("write successful"); |
| 533 | } |
| 534 | |
| 535 | int timestamp; |
| 536 | |
| 537 | /* Handle (whether to respond) a frame in tag mode */ |
| 538 | static void frame_handle_tag(struct legic_frame const * const f) |
| 539 | { |
| 540 | uint8_t *BigBuf = BigBuf_get_addr(); |
| 541 | |
| 542 | /* First Part of Handshake (IV) */ |
| 543 | if(f->bits == 7) { |
| 544 | if(f->data == SESSION_IV) { |
| 545 | LED_C_ON(); |
| 546 | prng_timer->TC_CCR = AT91C_TC_SWTRG; |
| 547 | legic_prng_init(f->data); |
| 548 | frame_send_tag(0x3d, 6, 1); /* 0x3d^0x26 = 0x1b */ |
| 549 | legic_state = STATE_IV; |
| 550 | legic_read_count = 0; |
| 551 | legic_prng_bc = 0; |
| 552 | legic_prng_iv = f->data; |
| 553 | |
| 554 | /* TIMEOUT */ |
| 555 | timer->TC_CCR = AT91C_TC_SWTRG; |
| 556 | while(timer->TC_CV > 1); |
| 557 | while(timer->TC_CV < 280); |
| 558 | return; |
| 559 | } else if((prng_timer->TC_CV % 50) > 40) { |
| 560 | legic_prng_init(f->data); |
| 561 | frame_send_tag(0x3d, 6, 1); |
| 562 | SpinDelay(20); |
| 563 | return; |
| 564 | } |
| 565 | } |
| 566 | |
| 567 | /* 0x19==??? */ |
| 568 | if(legic_state == STATE_IV) { |
| 569 | if((f->bits == 6) && (f->data == (0x19 ^ get_key_stream(1, 6)))) { |
| 570 | legic_state = STATE_CON; |
| 571 | |
| 572 | /* TIMEOUT */ |
| 573 | timer->TC_CCR = AT91C_TC_SWTRG; |
| 574 | while(timer->TC_CV > 1); |
| 575 | while(timer->TC_CV < 200); |
| 576 | return; |
| 577 | } else { |
| 578 | legic_state = STATE_DISCON; |
| 579 | LED_C_OFF(); |
| 580 | Dbprintf("0x19 - Frame: %03.3x", f->data); |
| 581 | return; |
| 582 | } |
| 583 | } |
| 584 | |
| 585 | /* Read */ |
| 586 | if(f->bits == 11) { |
| 587 | if(legic_state == STATE_CON) { |
| 588 | int key = get_key_stream(-1, 11); //legic_phase_drift, 11); |
| 589 | int addr = f->data ^ key; addr = addr >> 1; |
| 590 | int data = BigBuf[addr]; |
| 591 | int hash = LegicCRC(addr, data, 11) << 8; |
| 592 | BigBuf[OFFSET_LOG+legic_read_count] = (uint8_t)addr; |
| 593 | legic_read_count++; |
| 594 | |
| 595 | //Dbprintf("Data:%03.3x, key:%03.3x, addr: %03.3x, read_c:%u", f->data, key, addr, read_c); |
| 596 | legic_prng_forward(legic_reqresp_drift); |
| 597 | |
| 598 | frame_send_tag(hash | data, 12, 1); |
| 599 | |
| 600 | /* SHORT TIMEOUT */ |
| 601 | timer->TC_CCR = AT91C_TC_SWTRG; |
| 602 | while(timer->TC_CV > 1); |
| 603 | legic_prng_forward(legic_frame_drift); |
| 604 | while(timer->TC_CV < 180); |
| 605 | return; |
| 606 | } |
| 607 | } |
| 608 | |
| 609 | /* Write */ |
| 610 | if(f->bits == 23) { |
| 611 | int key = get_key_stream(-1, 23); //legic_frame_drift, 23); |
| 612 | int addr = f->data ^ key; addr = addr >> 1; addr = addr & 0x3ff; |
| 613 | int data = f->data ^ key; data = data >> 11; data = data & 0xff; |
| 614 | |
| 615 | /* write command */ |
| 616 | legic_state = STATE_DISCON; |
| 617 | LED_C_OFF(); |
| 618 | Dbprintf("write - addr: %x, data: %x", addr, data); |
| 619 | return; |
| 620 | } |
| 621 | |
| 622 | if(legic_state != STATE_DISCON) { |
| 623 | Dbprintf("Unexpected: sz:%u, Data:%03.3x, State:%u, Count:%u", f->bits, f->data, legic_state, legic_read_count); |
| 624 | int i; |
| 625 | Dbprintf("IV: %03.3x", legic_prng_iv); |
| 626 | for(i = 0; i<legic_read_count; i++) { |
| 627 | Dbprintf("Read Nb: %u, Addr: %u", i, BigBuf[OFFSET_LOG+i]); |
| 628 | } |
| 629 | |
| 630 | for(i = -1; i<legic_read_count; i++) { |
| 631 | uint32_t t; |
| 632 | t = BigBuf[OFFSET_LOG+256+i*4]; |
| 633 | t |= BigBuf[OFFSET_LOG+256+i*4+1] << 8; |
| 634 | t |= BigBuf[OFFSET_LOG+256+i*4+2] <<16; |
| 635 | t |= BigBuf[OFFSET_LOG+256+i*4+3] <<24; |
| 636 | |
| 637 | Dbprintf("Cycles: %u, Frame Length: %u, Time: %u", |
| 638 | BigBuf[OFFSET_LOG+128+i], |
| 639 | BigBuf[OFFSET_LOG+384+i], |
| 640 | t); |
| 641 | } |
| 642 | } |
| 643 | legic_state = STATE_DISCON; |
| 644 | legic_read_count = 0; |
| 645 | SpinDelay(10); |
| 646 | LED_C_OFF(); |
| 647 | return; |
| 648 | } |
| 649 | |
| 650 | /* Read bit by bit untill full frame is received |
| 651 | * Call to process frame end answer |
| 652 | */ |
| 653 | static void emit(int bit) |
| 654 | { |
| 655 | if(bit == -1) { |
| 656 | if(current_frame.bits <= 4) { |
| 657 | frame_clean(¤t_frame); |
| 658 | } else { |
| 659 | frame_handle_tag(¤t_frame); |
| 660 | frame_clean(¤t_frame); |
| 661 | } |
| 662 | WDT_HIT(); |
| 663 | } else if(bit == 0) { |
| 664 | frame_append_bit(¤t_frame, 0); |
| 665 | } else if(bit == 1) { |
| 666 | frame_append_bit(¤t_frame, 1); |
| 667 | } |
| 668 | } |
| 669 | |
| 670 | void LegicRfSimulate(int phase, int frame, int reqresp) |
| 671 | { |
| 672 | /* ADC path high-frequency peak detector, FPGA in high-frequency simulator mode, |
| 673 | * modulation mode set to 212kHz subcarrier. We are getting the incoming raw |
| 674 | * envelope waveform on DIN and should send our response on DOUT. |
| 675 | * |
| 676 | * The LEGIC RF protocol is pulse-pause-encoding from reader to card, so we'll |
| 677 | * measure the time between two rising edges on DIN, and no encoding on the |
| 678 | * subcarrier from card to reader, so we'll just shift out our verbatim data |
| 679 | * on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear, |
| 680 | * seems to be 300us-ish. |
| 681 | */ |
| 682 | |
| 683 | if(phase < 0) { |
| 684 | int i; |
| 685 | for(i=0; i<=reqresp; i++) { |
| 686 | legic_prng_init(SESSION_IV); |
| 687 | Dbprintf("i=%u, key 0x%3.3x", i, get_key_stream(i, frame)); |
| 688 | } |
| 689 | return; |
| 690 | } |
| 691 | |
| 692 | legic_phase_drift = phase; |
| 693 | legic_frame_drift = frame; |
| 694 | legic_reqresp_drift = reqresp; |
| 695 | |
| 696 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
| 697 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
| 698 | FpgaSetupSsc(); |
| 699 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_212K); |
| 700 | |
| 701 | /* Bitbang the receiver */ |
| 702 | AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; |
| 703 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; |
| 704 | |
| 705 | setup_timer(); |
| 706 | crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0); |
| 707 | |
| 708 | int old_level = 0; |
| 709 | int active = 0; |
| 710 | legic_state = STATE_DISCON; |
| 711 | |
| 712 | LED_B_ON(); |
| 713 | DbpString("Starting Legic emulator, press button to end"); |
| 714 | while(!BUTTON_PRESS()) { |
| 715 | int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); |
| 716 | int time = timer->TC_CV; |
| 717 | |
| 718 | if(level != old_level) { |
| 719 | if(level == 1) { |
| 720 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
| 721 | if(FUZZ_EQUAL(time, RWD_TIME_1, RWD_TIME_FUZZ)) { |
| 722 | /* 1 bit */ |
| 723 | emit(1); |
| 724 | active = 1; |
| 725 | LED_A_ON(); |
| 726 | } else if(FUZZ_EQUAL(time, RWD_TIME_0, RWD_TIME_FUZZ)) { |
| 727 | /* 0 bit */ |
| 728 | emit(0); |
| 729 | active = 1; |
| 730 | LED_A_ON(); |
| 731 | } else if(active) { |
| 732 | /* invalid */ |
| 733 | emit(-1); |
| 734 | active = 0; |
| 735 | LED_A_OFF(); |
| 736 | } |
| 737 | } |
| 738 | } |
| 739 | |
| 740 | if(time >= (RWD_TIME_1+RWD_TIME_FUZZ) && active) { |
| 741 | /* Frame end */ |
| 742 | emit(-1); |
| 743 | active = 0; |
| 744 | LED_A_OFF(); |
| 745 | } |
| 746 | |
| 747 | if(time >= (20*RWD_TIME_1) && (timer->TC_SR & AT91C_TC_CLKSTA)) { |
| 748 | timer->TC_CCR = AT91C_TC_CLKDIS; |
| 749 | } |
| 750 | |
| 751 | old_level = level; |
| 752 | WDT_HIT(); |
| 753 | } |
| 754 | DbpString("Stopped"); |
| 755 | LED_B_OFF(); |
| 756 | LED_A_OFF(); |
| 757 | LED_C_OFF(); |
| 758 | } |
| 759 | |