for (i=0; i<size; i++){
askSimBit(BitStream[i]^invert, &n, clk, encoding);
}
- if (encoding==0 && BitStream[0]==BitStream[size-1]){ //run a second set inverted (for biphase phase)
+ if (encoding==0 && BitStream[0]==BitStream[size-1]){ //run a second set inverted (for ask/raw || biphase phase)
for (i=0; i<size; i++){
askSimBit(BitStream[i]^invert^1, &n, clk, encoding);
}
data[0] = T55x7_BITRATE_RF_50 | T55x7_MODULATION_FSK2a | last_block << T55x7_MAXBLOCK_SHIFT;
//TODO add selection of chip for Q5 or T55x7
- // data[0] = (((50-2)/2)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | last_block << T5555_MAXBLOCK_SHIFT;
+ // data[0] = (((50-2)>>1)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | last_block << T5555_MAXBLOCK_SHIFT;
LED_D_ON();
WriteT55xx(data, 0, last_block+1);
uint32_t data[] = {T55x7_BITRATE_RF_64 | T55x7_MODULATION_FSK2a | (2 << T55x7_MAXBLOCK_SHIFT), hi, lo};
//TODO add selection of chip for Q5 or T55x7
//t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
- // data[0] = (64 << T5555_BITRATE_SHIFT) | T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | 2 << T5555_MAXBLOCK_SHIFT;
+ // data[0] = ( ((64-2)>>1) << T5555_BITRATE_SHIFT) | T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | 2 << T5555_MAXBLOCK_SHIFT;
LED_D_ON();
// Program the data blocks for supplied ID
// and the Config for Indala 64 format (RF/32;PSK1 with RF/2;Maxblock=2)
uint32_t data[] = { T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK1 | (2 << T55x7_MAXBLOCK_SHIFT), hi, lo};
//TODO add selection of chip for Q5 or T55x7
- // data[0] = (((32-2)/2)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_PSK1 | 2 << T5555_MAXBLOCK_SHIFT;
+ // data[0] = (((32-2)>>1)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_PSK1 | 2 << T5555_MAXBLOCK_SHIFT;
WriteT55xx(data, 0, 3);
//Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=2;Inverse data)
//Config for Indala (RF/32;PSK1 with RF/2;Maxblock=7)
data[0] = T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK1 | (7 << T55x7_MAXBLOCK_SHIFT);
//TODO add selection of chip for Q5 or T55x7
- // data[0] = (((32-2)/2)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_PSK1 | 7 << T5555_MAXBLOCK_SHIFT;
+ // data[0] = (((32-2)>>1) << T5555_BITRATE_SHIFT) | T5555_MODULATION_PSK1 | 7 << T5555_MAXBLOCK_SHIFT;
WriteT55xx(data, 0, 8);
//Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=7;Inverse data)
// T5567WriteBlock(0x603E10E2,0);
void CopyVikingtoT55xx(uint32_t block1, uint32_t block2, uint8_t Q5) {
uint32_t data[] = {T55x7_BITRATE_RF_32 | T55x7_MODULATION_MANCHESTER | (2 << T55x7_MAXBLOCK_SHIFT), block1, block2};
//t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
- if (Q5) data[0] = (32 << T5555_BITRATE_SHIFT) | T5555_MODULATION_MANCHESTER | 2 << T5555_MAXBLOCK_SHIFT;
+ if (Q5) data[0] = (((32-2)>>1) << T5555_BITRATE_SHIFT) | T5555_MODULATION_MANCHESTER | 2 << T5555_MAXBLOCK_SHIFT;
// Program the data blocks for supplied ID and the block 0 config
WriteT55xx(data, 0, 3);
LED_D_OFF();
}
data[0] = clock | T55x7_MODULATION_MANCHESTER | (2 << T55x7_MAXBLOCK_SHIFT);
} else { //t5555 (Q5)
- clock = (clock-2)>>1; //n = (RF-2)/2
- data[0] = (clock << T5555_BITRATE_SHIFT) | T5555_MODULATION_MANCHESTER | (2 << T5555_MAXBLOCK_SHIFT);
+ // t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
+ data[0] = ( ((clock-2) >> 1) << T5555_BITRATE_SHIFT) | T5555_MODULATION_MANCHESTER | (2 << T5555_MAXBLOCK_SHIFT);
}
WriteT55xx(data, 0, 3);
//-----------------------------------
// EM4469 / EM4305 routines
//-----------------------------------
-#define FWD_CMD_LOGIN 0xC //including the even parity, binary mirrored
+// Below given command set.
+// Commands are including the even parity, binary mirrored
+#define FWD_CMD_LOGIN 0xC
#define FWD_CMD_WRITE 0xA
#define FWD_CMD_READ 0x9
#define FWD_CMD_DISABLE 0x5
uint8_t i;
line_parity = 0;
- for(i=0;i<6;i++) {
+ for( i=0; i<6; i++ ) {
*forward_ptr++ = addr;
line_parity ^= addr;
addr >>= 1;
//====================================================================
void SendForward(uint8_t fwd_bit_count) {
+// iceman, 21.3us increments for the USclock verification.
+// 55FC * 8us == 440us / 21.3 === 20.65 steps. could be too short. Go for 56FC instead
+// 32FC * 8us == 256us / 21.3 == 12.018 steps. ok
+// 16FC * 8us == 128us / 21.3 == 6.009 steps. ok
+
+#ifndef EM_START_GAP
+#define EM_START_GAP 60*8
+#endif
+#ifndef EM_ONE_GAP
+#define EM_ONE_GAP 32*8
+#endif
+#ifndef EM_ZERO_GAP
+# define EM_ZERO_GAP 16*8
+#endif
+
fwd_write_ptr = forwardLink_data;
fwd_bit_sz = fwd_bit_count;
- LED_D_ON();
-
// Set up FPGA, 125kHz
LFSetupFPGAForADC(95, true);
// force 1st mod pulse (start gap must be longer for 4305)
fwd_bit_sz--; //prepare next bit modulation
fwd_write_ptr++;
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
- WaitUS(55*8); //55 cycles off (8us each)for 4305 // ICEMAN: problem with (us) clock is 21.3us increments
- FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);//field on
- WaitUS(16*8); //16 cycles on (8us each) // ICEMAN: problem with (us) clock is 21.3us increments
+
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ WaitUS(EM_START_GAP);
+ TurnReadLFOn(16);
- // now start writting
+ // now start writting with bitbanging the antenna.
while(fwd_bit_sz-- > 0) { //prepare next bit modulation
if(((*fwd_write_ptr++) & 1) == 1)
- WaitUS(32*8); //32 cycles at 125Khz (8us each) // ICEMAN: problem with (us) clock is 21.3us increments
+ WaitUS(EM_ONE_GAP);
else {
- //These timings work for 4469/4269/4305 (with the 55*8 above)
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
- WaitUS(16*8); //16-4 cycles off (8us each) // ICEMAN: problem with (us) clock is 21.3us increments
- FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);//field on
- WaitUS(16*8); //16 cycles on (8us each) // ICEMAN: problem with (us) clock is 21.3us increments
+ //These timings work for 4469/4269/4305
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ WaitUS(20);
+ TurnReadLFOn(12);
}
}
}
-void EM4xLogin(uint32_t Password) {
-
- uint8_t fwd_bit_count;
+void EM4xLogin(uint32_t pwd) {
+ uint8_t len;
forward_ptr = forwardLink_data;
- fwd_bit_count = Prepare_Cmd( FWD_CMD_LOGIN );
- fwd_bit_count += Prepare_Data( Password&0xFFFF, Password>>16 );
- SendForward(fwd_bit_count);
-
- //Wait for command to complete
- WaitMS(20);
+ len = Prepare_Cmd( FWD_CMD_LOGIN );
+ len += Prepare_Data( pwd & 0xFFFF, pwd >> 16 );
+ SendForward(len);
+ //WaitMS(20); - no wait for login command.
+ // should receive
+ // 0000 1010 ok.
+ // 0000 0001 fail
}
-void EM4xReadWord(uint8_t Address, uint32_t Pwd, uint8_t PwdMode) {
+void EM4xReadWord(uint8_t addr, uint32_t pwd, uint8_t usepwd) {
- uint8_t fwd_bit_count;
- uint8_t *dest = BigBuf_get_addr();
- uint16_t bufsize = BigBuf_max_traceLen(); // ICEMAN: this tries to fill up all tracelog space
- uint32_t i = 0;
+ LED_A_ON();
- // Clear destination buffer before sending the command
+ uint8_t len;
+
+ //clear buffer now so it does not interfere with timing later
BigBuf_Clear_ext(false);
- //If password mode do login
- if (PwdMode == 1) EM4xLogin(Pwd);
+ /* should we read answer from Logincommand?
+ *
+ * should receive
+ * 0000 1010 ok.
+ * 0000 0001 fail
+ **/
+ if (usepwd) EM4xLogin(pwd);
forward_ptr = forwardLink_data;
- fwd_bit_count = Prepare_Cmd( FWD_CMD_READ );
- fwd_bit_count += Prepare_Addr( Address );
+ len = Prepare_Cmd( FWD_CMD_READ );
+ len += Prepare_Addr( addr );
- SendForward(fwd_bit_count);
+ SendForward(len);
- // Now do the acquisition
- // ICEMAN, change to the one in lfsampling.c
- i = 0;
- for(;;) {
- if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
- AT91C_BASE_SSC->SSC_THR = 0x43;
- }
- if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
- dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
- ++i;
- if (i >= bufsize) break;
- }
- }
+ DoAcquisition_config(TRUE);
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
cmd_send(CMD_ACK,0,0,0,0,0);
- LED_D_OFF();
+ LED_A_OFF();
}
-void EM4xWriteWord(uint32_t Data, uint8_t Address, uint32_t Pwd, uint8_t PwdMode) {
+void EM4xWriteWord(uint32_t flag, uint32_t data, uint32_t pwd) {
- uint8_t fwd_bit_count;
+ LED_A_ON();
+
+ bool usePwd = (flag & 0xF);
+ uint8_t addr = (flag >> 8) & 0xFF;
+ uint8_t len;
+
+ //clear buffer now so it does not interfere with timing later
+ BigBuf_Clear_ext(false);
- //If password mode do login
- if (PwdMode == 1) EM4xLogin(Pwd);
+ /* should we read answer from Logincommand?
+ *
+ * should receive
+ * 0000 1010 ok.
+ * 0000 0001 fail
+ **/
+ if (usePwd) EM4xLogin(pwd);
forward_ptr = forwardLink_data;
- fwd_bit_count = Prepare_Cmd( FWD_CMD_WRITE );
- fwd_bit_count += Prepare_Addr( Address );
- fwd_bit_count += Prepare_Data( Data&0xFFFF, Data>>16 );
+ len = Prepare_Cmd( FWD_CMD_WRITE );
+ len += Prepare_Addr( addr );
+ len += Prepare_Data( data & 0xFFFF, data >> 16 );
- SendForward(fwd_bit_count);
+ SendForward(len);
- //Wait for write to complete
+ //Wait 20ms for write to complete
WaitMS(20);
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
- LED_D_OFF();
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ cmd_send(CMD_ACK,0,0,0,0,0);
+ LED_A_OFF();
}
/*
This triggers a COTAG tag to response
*/
void Cotag(uint32_t arg0) {
-
-#define OFF { FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); WaitUS(2035); }
-#define ON(x) { FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD); WaitUS((x)); }
-
+#ifndef OFF
+# define OFF { FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); WaitUS(2035); }
+#endif
+#ifndef ON
+# define ON(x) { FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD); WaitUS((x)); }
+#endif
uint8_t rawsignal = arg0 & 0xF;
LED_A_ON();
cmd_send(CMD_ACK,0,0,0,0,0);
LED_A_OFF();
}
+
+/*
+* EM4305 support
+*/
projects / proxmark3-svn / blobdiff