cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/legicrf.c

   1 /*
   2  * LEGIC RF simulation code
   3  *
   4  * (c) 2009 Henryk Plötz <henryk@ploetzli.ch>
   5  */
   6
   7 #include <proxmark3.h>
   8
   9 #include "apps.h"
  10 #include "legicrf.h"
  11 #include "unistd.h"
  12 #include "stdint.h"
  13
  14 static struct legic_frame {
  15         int bits;
  16         uint16_t data;
  17 } current_frame;
  18
  19 static const struct legic_frame queries[] = {
  20                 {7, 0x55}, /* 1010 101 */
  21 };
  22
  23 static const struct legic_frame responses[] = {
  24                 {6, 0x3b}, /* 1101 11 */
  25 };
  26
  27 static void frame_send(uint16_t response, int bits)
  28 {
  29 #if 0
  30         /* Use the SSC to send a response. 8-bit transfers, LSBit first, 100us per bit */
  31 #else
  32         /* Bitbang the response */
  33         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
  34         AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
  35         AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
  36
  37         /* Wait for the frame start */
  38         while(AT91C_BASE_TC1->TC_CV < 490) ;
  39
  40         int i;
  41         for(i=0; i<bits; i++) {
  42                 int nextbit = AT91C_BASE_TC1->TC_CV + 150;
  43                 int bit = response & 1;
  44                 response = response >> 1;
  45                 if(bit)
  46                         AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
  47                 else
  48                         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
  49                 while(AT91C_BASE_TC1->TC_CV < nextbit) ;
  50         }
  51         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
  52 #endif
  53 }
  54
  55 static void frame_respond(struct legic_frame const * const f)
  56 {
  57         LED_D_ON();
  58         int i, r_size;
  59         uint16_t r_data;
  60
  61         for(i=0; i<sizeof(queries)/sizeof(queries[0]); i++) {
  62                 if(f->bits == queries[i].bits && f->data == queries[i].data) {
  63                         r_data = responses[i].data;
  64                         r_size = responses[i].bits;
  65                         break;
  66                 }
  67         }
  68
  69         if(r_size != 0) {
  70                 frame_send(r_data, r_size);
  71                 LED_A_ON();
  72         } else {
  73                 LED_A_OFF();
  74         }
  75
  76         LED_D_OFF();
  77 }
  78
  79 static void frame_append_bit(struct legic_frame * const f, int bit)
  80 {
  81         if(f->bits >= 15)
  82                 return; /* Overflow, won't happen */
  83         f->data |= (bit<<f->bits);
  84         f->bits++;
  85 }
  86
  87 static int frame_is_empty(struct legic_frame const * const f)
  88 {
  89         return( f->bits <= 4 );
  90 }
  91
  92 static void frame_handle(struct legic_frame const * const f)
  93 {
  94         if(f->bits == 6) {
  95                 /* Short path */
  96                 return;
  97         }
  98         if( !frame_is_empty(f) ) {
  99                 frame_respond(f);
 100         }
 101 }
 102
 103 static void frame_clean(struct legic_frame * const f)
 104 {
 105         f->data = 0;
 106         f->bits = 0;
 107 }
 108
 109 static void emit(int bit)
 110 {
 111         if(bit == -1) {
 112                 frame_handle(&current_frame);
 113                 frame_clean(&current_frame);
 114         } else if(bit == 0) {
 115                 frame_append_bit(&current_frame, 0);
 116         } else if(bit == 1) {
 117                 frame_append_bit(&current_frame, 1);
 118         }
 119 }
 120
 121 void LegicRfSimulate(void)
 122 {
 123         /* ADC path high-frequency peak detector, FPGA in high-frequency simulator mode,
 124          * modulation mode set to 212kHz subcarrier. We are getting the incoming raw
 125          * envelope waveform on DIN and should send our response on DOUT.
 126          *
 127          * The LEGIC RF protocol is pulse-pause-encoding from reader to card, so we'll
 128          * measure the time between two rising edges on DIN, and no encoding on the
 129          * subcarrier from card to reader, so we'll just shift out our verbatim data
 130          * on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear,
 131          * seems to be 300us-ish.
 132          */
 133         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 134         FpgaSetupSsc();
 135         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_212K);
 136
 137         /* Bitbang the receiver */
 138         AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
 139         AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
 140
 141         /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging
 142          * this it won't be terribly accurate but should be good enough.
 143          */
 144         AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1);
 145         AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
 146         AT91C_BASE_TC1->TC_CMR = TC_CMR_TCCLKS_TIMER_CLOCK3;
 147         AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
 148         int old_level = 0;
 149
 150 /* At TIMER_CLOCK3 (MCK/32) */
 151 #define BIT_TIME_1 150
 152 #define BIT_TIME_0 90
 153 #define BIT_TIME_FUZZ 20
 154
 155         int active = 0;
 156         while(!BUTTON_PRESS()) {
 157                 int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
 158                 int time = AT91C_BASE_TC1->TC_CV;
 159
 160                 if(level != old_level) {
 161                         if(level == 1) {
 162                                 AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
 163                                 if(time > (BIT_TIME_1-BIT_TIME_FUZZ) && time < (BIT_TIME_1+BIT_TIME_FUZZ)) {
 164                                         /* 1 bit */
 165                                         emit(1);
 166                                         active = 1;
 167                                         LED_B_ON();
 168                                 } else if(time > (BIT_TIME_0-BIT_TIME_FUZZ) && time < (BIT_TIME_0+BIT_TIME_FUZZ)) {
 169                                         /* 0 bit */
 170                                         emit(0);
 171                                         active = 1;
 172                                         LED_B_ON();
 173                                 } else if(active) {
 174                                         /* invalid */
 175                                         emit(-1);
 176                                         active = 0;
 177                                         LED_B_OFF();
 178                                 }
 179                         }
 180                 }
 181
 182                 if(time >= (BIT_TIME_1+BIT_TIME_FUZZ) && active) {
 183                         /* Frame end */
 184                         emit(-1);
 185                         active = 0;
 186                         LED_B_OFF();
 187                 }
 188
 189                 if(time >= (20*BIT_TIME_1) && (AT91C_BASE_TC1->TC_SR & AT91C_TC_CLKSTA)) {
 190                         AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
 191                 }
 192
 193
 194                 old_level = level;
 195                 WDT_HIT();
 196         }
 197 }