//-----------------------------------------------------------------------------
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
// Miscellaneous routines for low frequency tag operations.
// Tags supported here so far are Texas Instruments (TI), HID
// Also routines for raw mode reading/simulating of LF waveform
-//
//-----------------------------------------------------------------------------
-#include <proxmark3.h>
+
+#include "proxmark3.h"
#include "apps.h"
+#include "util.h"
#include "hitag2.h"
#include "crc16.h"
+#include "string.h"
-void AcquireRawAdcSamples125k(BOOL at134khz)
+void AcquireRawAdcSamples125k(int at134khz)
{
if (at134khz)
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
// split into two routines so we can avoid timing issues after sending commands //
void DoAcquisition125k(void)
{
- BYTE *dest = (BYTE *)BigBuf;
+ uint8_t *dest = (uint8_t *)BigBuf;
int n = sizeof(BigBuf);
int i;
-
+
memset(dest, 0, n);
i = 0;
for(;;) {
LED_D_ON();
}
if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
- dest[i] = (BYTE)AT91C_BASE_SSC->SSC_RHR;
+ dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
i++;
LED_D_OFF();
if (i >= n) break;
dest[0], dest[1], dest[2], dest[3], dest[4], dest[5], dest[6], dest[7]);
}
-void ModThenAcquireRawAdcSamples125k(int delay_off, int period_0, int period_1, BYTE *command)
+void ModThenAcquireRawAdcSamples125k(int delay_off, int period_0, int period_1, uint8_t *command)
{
- BOOL at134khz;
+ int at134khz;
/* Make sure the tag is reset */
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
SpinDelay(2500);
-
+
// see if 'h' was specified
if (command[strlen((char *) command) - 1] == 'h')
at134khz = TRUE;
// int n = GraphTraceLen;
// 128 bit shift register [shift3:shift2:shift1:shift0]
- DWORD shift3 = 0, shift2 = 0, shift1 = 0, shift0 = 0;
+ uint32_t shift3 = 0, shift2 = 0, shift1 = 0, shift0 = 0;
int i, cycles=0, samples=0;
// how many sample points fit in 16 cycles of each frequency
- DWORD sampleslo = (FSAMPLE<<4)/FREQLO, sampleshi = (FSAMPLE<<4)/FREQHI;
+ uint32_t sampleslo = (FSAMPLE<<4)/FREQLO, sampleshi = (FSAMPLE<<4)/FREQHI;
// when to tell if we're close enough to one freq or another
- DWORD threshold = (sampleslo - sampleshi + 1)>>1;
+ uint32_t threshold = (sampleslo - sampleshi + 1)>>1;
// TI tags charge at 134.2Khz
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
// i'm 99% sure the crc algorithm is correct, but it may need to eat the
// bytes in reverse or something
// calculate CRC
- DWORD crc=0;
+ uint32_t crc=0;
crc = update_crc16(crc, (shift0)&0xff);
crc = update_crc16(crc, (shift0>>8)&0xff);
}
}
-void WriteTIbyte(BYTE b)
+void WriteTIbyte(uint8_t b)
{
int i = 0;
{
int i, j, n;
// tag transmission is <20ms, sampling at 2M gives us 40K samples max
- // each sample is 1 bit stuffed into a DWORD so we need 1250 DWORDS
+ // each sample is 1 bit stuffed into a uint32_t so we need 1250 uint32_t
#define TIBUFLEN 1250
// clear buffer
// arguments: 64bit data split into 32bit idhi:idlo and optional 16bit crc
// if crc provided, it will be written with the data verbatim (even if bogus)
// if not provided a valid crc will be computed from the data and written.
-void WriteTItag(DWORD idhi, DWORD idlo, WORD crc)
+void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc)
{
if(crc == 0) {
crc = update_crc16(crc, (idlo)&0xff);
void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
{
int i;
- BYTE *tab = (BYTE *)BigBuf;
+ uint8_t *tab = (uint8_t *)BigBuf;
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR);
i++;
if(i == period) {
i = 0;
- if (gap) {
+ if (gap) {
SHORT_COIL();
SpinDelayUs(gap);
}
/* Provides a framework for bidirectional LF tag communication
* Encoding is currently Hitag2, but the general idea can probably
* be transferred to other encodings.
- *
+ *
* The new FPGA code will, for the LF simulator mode, give on SSC_FRAME
* (PA15) a thresholded version of the signal from the ADC. Setting the
* ADC path to the low frequency peak detection signal, will enable a
* field is switched off, and high when the reader field is active. Due
* to the way that the signal looks like, mostly only the rising edge is
* useful, your mileage may vary.
- *
+ *
* Neat perk: PA15 can not only be used as a bit-banging GPIO, but is also
* TIOA1, which can be used as the capture input for timer 1. This should
* make it possible to measure the exact edge-to-edge time, without processor
* intervention.
- *
+ *
* Arguments: divisor is the divisor to be sent to the FPGA (e.g. 95 for 125kHz)
* t0 is the carrier frequency cycle duration in terms of MCK (384 for 125kHz)
- *
- * The following defines are in carrier periods:
+ *
+ * The following defines are in carrier periods:
*/
-#define HITAG_T_0_MIN 15 /* T[0] should be 18..22 */
+#define HITAG_T_0_MIN 15 /* T[0] should be 18..22 */
#define HITAG_T_1_MIN 24 /* T[1] should be 26..30 */
#define HITAG_T_EOF 40 /* T_EOF should be > 36 */
#define HITAG_T_WRESP 208 /* T_wresp should be 204..212 */
#endif
char frame[10];
int frame_pos=0;
-
+
DbpString("Starting Hitag2 emulator, press button to end");
hitag2_init();
-
+
/* Set up simulator mode, frequency divisor which will drive the FPGA
* and analog mux selection.
*/
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, divisor);
SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
RELAY_OFF();
-
+
/* Set up Timer 1:
* Capture mode, timer source MCK/2 (TIMER_CLOCK1), TIOA is external trigger,
* external trigger rising edge, load RA on rising edge of TIOA, load RB on rising
* edge of TIOA. Assign PA15 to TIOA1 (peripheral B)
*/
-
+
AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1);
AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME;
AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
- AT91C_BASE_TC1->TC_CMR = TC_CMR_TCCLKS_TIMER_CLOCK1 |
+ AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK |
AT91C_TC_ETRGEDG_RISING |
AT91C_TC_ABETRG |
AT91C_TC_LDRA_RISING |
AT91C_TC_LDRB_RISING;
AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN |
AT91C_TC_SWTRG;
-
+
/* calculate the new value for the carrier period in terms of TC1 values */
t0 = t0/2;
-
+
int overflow = 0;
while(!BUTTON_PRESS()) {
WDT_HIT();
((char*)BigBuf)[i] = ra;
i = (i+1) % 8000;
#endif
-
+
if(overflow || (ra > t0*HITAG_T_EOF) || (ra < t0*HITAG_T_0_MIN)) {
/* Ignore */
} else if(ra >= t0*HITAG_T_1_MIN ) {
frame_pos++;
}
}
-
+
overflow = 0;
LED_D_ON();
} else {
* have wrapped. Also, this marks the end of frame, and the
* still running counter can be used to determine the correct
* time for the start of the reply.
- */
+ */
overflow = 1;
-
+
if(frame_pos > 0) {
/* Have a frame, do something with it */
#if DEBUG_FRAME_CONTENTS
LED_B_OFF();
}
AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG; /* Reset clock for the next bit */
-
+
}
static void hitag_send_frame(int t0, int frame_len, const char const * frame, int fdt)
{
OPEN_COIL();
AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
-
+
/* Wait for HITAG_T_WRESP carrier periods after the last reader bit,
* not that since the clock counts since the rising edge, but T_wresp is
* with respect to the falling edge, we need to wait actually (T_wresp - T_g)
int saved_cmr = AT91C_BASE_TC1->TC_CMR;
AT91C_BASE_TC1->TC_CMR &= ~AT91C_TC_ETRGEDG; /* Disable external trigger for the clock */
AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG; /* Reset the clock and use it for response timing */
-
+
int i;
for(i=0; i<5; i++)
hitag_send_bit(t0, 1); /* Start of frame */
-
+
for(i=0; i<frame_len; i++) {
hitag_send_bit(t0, !!(frame[i/ 8] & (1<<( 7-(i%8) ))) );
}
-
+
OPEN_COIL();
AT91C_BASE_TC1->TC_CMR = saved_cmr;
}
// compose fc/8 fc/10 waveform
static void fc(int c, int *n) {
- BYTE *dest = (BYTE *)BigBuf;
+ uint8_t *dest = (uint8_t *)BigBuf;
int idx;
// for when we want an fc8 pattern every 4 logical bits
// loop to capture raw HID waveform then FSK demodulate the TAG ID from it
void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
{
- BYTE *dest = (BYTE *)BigBuf;
+ uint8_t *dest = (uint8_t *)BigBuf;
int m=0, n=0, i=0, idx=0, found=0, lastval=0;
- DWORD hi=0, lo=0;
+ uint32_t hi=0, lo=0;
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
LED_D_ON();
}
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
- dest[i] = (BYTE)AT91C_BASE_SSC->SSC_RHR;
+ dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
// we don't care about actual value, only if it's more or less than a
// threshold essentially we capture zero crossings for later analysis
if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;
WDT_HIT();
}
}
+
+//----------------------
+// T5557/T5567 routines
+
+// Relevant times in microsecond
+// To compensate antenna falling times shorten the write times
+// and enlarge the gap ones.
+#define start_gap 250
+#define write_gap 160
+#define write_0 144 //192
+#define write_1 400 //432 for T55x7; 448 for E5550
+
+//Write one bit to card
+void T5567WriteBit(int bit)
+{
+ FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
+ if (bit == 0) SpinDelayUs(write_0);
+ else SpinDelayUs(write_1);
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ SpinDelayUs(write_gap);
+}
+
+//Write one card block in page 0, no lock
+void T5567WriteBlock(int Data, int Block)
+{
+
+ /* Make sure the tag is reset */
+// FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+// SpinDelay(2500);
+
+ FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
+
+ // Give it a bit of time for the resonant antenna to settle.
+ // And for the tag to fully power up
+ SpinDelay(150);
+
+ // now start writting
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ SpinDelayUs(start_gap);
+
+ //Opcode
+ T5567WriteBit(1);
+ T5567WriteBit(0); //Page 0
+ //Lock bit
+ T5567WriteBit(0);
+
+ //Data
+ for (int i=0;i<32;i++){
+ T5567WriteBit(Data&(1<<(31-i)));
+ }
+
+ //Page
+ for (int i=0;i<3;i++){
+ T5567WriteBit(Block&(1<<(2-i)));
+ }
+
+ //Now perform write (nominal is 5.6 ms for T55x7 and 18ms for E5550,
+ // so wait a little more)
+ FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
+ SpinDelay(20);
+
+}
+
+//Copy HID id to card and setup block 0 config
+void CopyHIDtoT5567(int hi, int lo)
+{
+ int data1, data2, data3;
+
+ // ensure no more than 44 bits supplied
+ if (hi>0xFFF) {
+ DbpString("Tags can only have 44 bits.");
+ return;
+ }
+
+ //Build the 3 data blocks for supplied 44bit ID
+ data1 = 0x1D000000; //load preamble
+ for (int i=0;i<12;i++){
+ if (hi & (1<<(11-i))) data1 |= (1<<(((11-i)*2)+1)); // 1 -> 10
+ else data1 |= (1<<((11-i)*2)); // 0 -> 01
+ }
+ data2 = 0;
+ for (int i=0;i<16;i++){
+ if (lo & (1<<(31-i))) data2 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+ else data2 |= (1<<((15-i)*2)); // 0 -> 01
+ }
+ data3 = 0;
+ for (int i=0;i<16;i++){
+ if (lo & (1<<(15-i))) data3 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+ else data3 |= (1<<((15-i)*2)); // 0 -> 01
+ }
+
+ //Program the 3 data blocks for supplied 44bit ID
+ // and the block 0 for HID format
+ T5567WriteBlock(data1,1);
+ T5567WriteBlock(data2,2);
+ T5567WriteBlock(data3,3);
+ //Config for HID (RF/50;FSK2a;Maxblock=3)
+ T5567WriteBlock(0x00107060,0);
+
+ DbpString("DONE!");
+
+}
+
projects / proxmark3-svn / blobdiff