cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/legicrf.c

   1 /*
   2  * LEGIC RF simulation code
   3  *
   4  * (c) 2009 Henryk Plötz <henryk@ploetzli.ch>
   5  */
   6
   7 #include <proxmark3.h>
   8
   9 #include "apps.h"
  10 #include "legicrf.h"
  11 #include "unistd.h"
  12 #include "stdint.h"
  13
  14 static struct legic_frame {
  15         int bits;
  16         uint16_t data;
  17 } current_frame;
  18 AT91PS_TC timer;
  19
  20 static void setup_timer(void)
  21 {
  22         /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging
  23          * this it won't be terribly accurate but should be good enough.
  24          */
  25         AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1);
  26         timer = AT91C_BASE_TC1;
  27         timer->TC_CCR = AT91C_TC_CLKDIS;
  28         timer->TC_CMR = TC_CMR_TCCLKS_TIMER_CLOCK3;
  29         timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
  30
  31 /* At TIMER_CLOCK3 (MCK/32) */
  32 #define RWD_TIME_1 150     /* RWD_TIME_PAUSE off, 80us on = 100us */
  33 #define RWD_TIME_0 90      /* RWD_TIME_PAUSE off, 40us on = 60us */
  34 #define RWD_TIME_PAUSE 30  /* 20us */
  35 #define RWD_TIME_FUZZ 20   /* rather generous 13us, since the peak detector + hysteresis fuzz quite a bit */
  36 #define TAG_TIME_BIT 150   /* 100us for every bit */
  37 #define TAG_TIME_WAIT 490  /* time from RWD frame end to tag frame start, experimentally determined */
  38
  39 }
  40
  41 #define FUZZ_EQUAL(value, target, fuzz) ((value) > ((target)-(fuzz)) && (value) < ((target)+(fuzz)))
  42
  43 /* Send a frame in reader mode, the FPGA must have been set up by
  44  * LegicRfReader
  45  */
  46 static void frame_send_rwd(uint16_t data, int bits)
  47 {
  48         /* Start clock */
  49         timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
  50         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
  51
  52         int i;
  53         for(i=0; i<bits; i++) {
  54                 int starttime = timer->TC_CV;
  55                 int pause_end = starttime + RWD_TIME_PAUSE, bit_end;
  56                 int bit = data & 1;
  57                 data = data >> 1;
  58
  59                 if(bit) {
  60                         bit_end = starttime + RWD_TIME_1;
  61                 } else {
  62                         bit_end = starttime + RWD_TIME_0;
  63                 }
  64
  65                 /* RWD_TIME_PAUSE time off, then some time on, so that the complete bit time is
  66                  * RWD_TIME_x, where x is the bit to be transmitted */
  67                 AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
  68                 while(timer->TC_CV < pause_end) ;
  69                 AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
  70                 while(timer->TC_CV < bit_end) ;
  71         }
  72
  73         {
  74                 /* One final pause to mark the end of the frame */
  75                 int pause_end = timer->TC_CV + RWD_TIME_PAUSE;
  76                 AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
  77                 while(timer->TC_CV < pause_end) ;
  78                 AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
  79         }
  80
  81         /* Reset the timer, to measure time until the start of the tag frame */
  82         timer->TC_CCR = AT91C_TC_SWTRG;
  83 }
  84
  85 /* Receive a frame from the card in reader emulation mode, the FPGA and
  86  * timer must have been set up by LegicRfReader and frame_send_rwd.
  87  *
  88  * The LEGIC RF protocol from card to reader does not include explicit
  89  * frame start/stop information or length information. The reader must
  90  * know beforehand how many bits it wants to receive. (Notably: a card
  91  * sending a stream of 0-bits is indistinguishable from no card present.)
  92  *
  93  * Receive methodology: There is a fancy correlator in hi_read_rx_xcorr, but
  94  * I'm not smart enough to use it. Instead I have patched hi_read_tx to output
  95  * the ADC signal with hysteresis on SSP_DIN. Bit-bang that signal and look
  96  * for edges. Count the edges in each bit interval. If they are approximately
  97  * 0 this was a 0-bit, if they are approximately equal to the number of edges
  98  * expected for a 212kHz subcarrier, this was a 1-bit. For timing we use the
  99  * timer that's still running from frame_send_rwd in order to get a synchronization
 100  * with the frame that we just sent.
 101  *
 102  * FIXME: Because we're relying on the hysteresis to just do the right thing
 103  * the range is severely reduced (and you'll probably also need a good antenna).
 104  * So this should be fixed some time in the future for a proper receiver.
 105  */
 106 static void frame_receive_rwd(struct legic_frame * const f, int bits)
 107 {
 108         uint16_t the_bit = 1;  /* Use a bitmask to save on shifts */
 109         uint16_t data=0;
 110         int i, old_level=0, edges=0;
 111         int next_bit_at = TAG_TIME_WAIT;
 112
 113
 114         if(bits > 16)
 115                 bits = 16;
 116
 117         AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
 118         AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
 119
 120         while(timer->TC_CV < next_bit_at) ;
 121         next_bit_at += TAG_TIME_BIT;
 122
 123         for(i=0; i<bits; i++) {
 124                 edges = 0;
 125                 while(timer->TC_CV < next_bit_at) {
 126                         int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
 127                         if(level != old_level)
 128                                 edges++;
 129                         old_level = level;
 130                 }
 131                 next_bit_at += TAG_TIME_BIT;
 132
 133                 if(edges > 20 && edges < 60) { /* expected are 42 edges */
 134                         data |= the_bit;
 135                 }
 136
 137
 138                 the_bit <<= 1;
 139         }
 140
 141         f->data = data;
 142         f->bits = bits;
 143 }
 144
 145 static void frame_clean(struct legic_frame * const f)
 146 {
 147         f->data = 0;
 148         f->bits = 0;
 149 }
 150
 151 void LegicRfReader(void)
 152 {
 153         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 154         FpgaSetupSsc();
 155         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
 156
 157         /* Bitbang the transmitter */
 158         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 159         AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
 160         AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
 161
 162         setup_timer();
 163
 164         while(!BUTTON_PRESS()) {
 165                 /* Switch on carrier and let the tag charge for 1ms */
 166                 AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 167                 SpinDelay(1);
 168
 169                 LED_A_ON();
 170                 frame_send_rwd(queries[0].data, queries[0].bits);
 171                 LED_A_OFF();
 172
 173                 frame_clean(&current_frame);
 174                 LED_B_ON();
 175                 frame_receive_rwd(&current_frame, responses[0].bits);
 176                 LED_B_OFF();
 177
 178                 /* Switch off carrier, make sure tag is reset */
 179                 AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 180                 SpinDelay(10);
 181
 182                 WDT_HIT();
 183         }
 184
 185 }