+ /* Bitbang the response */
+ AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
+ AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
+ AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
+
+ /* Use time to crypt frame */
+ if(crypt) {
+ legic_prng_forward(2); /* TAG_TIME_WAIT -> shift by 2 */
+ int i; int key = 0;
+ for(i=0; i<bits; i++) {
+ key |= legic_prng_get_bit() << i;
+ legic_prng_forward(1);
+ }
+ //Dbprintf("key = 0x%x", key);
+ response = response ^ key;
+ }
+
+ /* Wait for the frame start */
+ while(timer->TC_CV < (TAG_TIME_WAIT - 30)) ;
+
+ int i;
+ for(i=0; i<bits; i++) {
+ int nextbit = timer->TC_CV + TAG_TIME_BIT;
+ int bit = response & 1;
+ response = response >> 1;
+ if(bit)
+ AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
+ else
+ AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
+
+ while(timer->TC_CV < nextbit) ;
+ }
+ AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
+}
+
+/* Send a frame in reader mode, the FPGA must have been set up by
+ * LegicRfReader
+ */
+static void frame_send_rwd(uint32_t data, int bits)
+{
+ /* Start clock */
+ timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
+ while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
+
+ int i;
+ for(i=0; i<bits; i++) {
+ int starttime = timer->TC_CV;
+ int pause_end = starttime + RWD_TIME_PAUSE, bit_end;
+ int bit = data & 1;
+ data = data >> 1;
+
+ if(bit ^ legic_prng_get_bit())
+ bit_end = starttime + RWD_TIME_1;
+ else
+ bit_end = starttime + RWD_TIME_0;
+
+
+ /* RWD_TIME_PAUSE time off, then some time on, so that the complete bit time is
+ * RWD_TIME_x, where x is the bit to be transmitted */
+ AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
+ while(timer->TC_CV < pause_end) ;
+ AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
+ legic_prng_forward(1); /* bit duration is longest. use this time to forward the lfsr */
+
+ while(timer->TC_CV < bit_end);
+ }
+
+ /* One final pause to mark the end of the frame */
+ int pause_end = timer->TC_CV + RWD_TIME_PAUSE;
+ AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
+ while(timer->TC_CV < pause_end) ;
+ AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
+
+
+ /* Reset the timer, to measure time until the start of the tag frame */
+ timer->TC_CCR = AT91C_TC_SWTRG;
+ while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
+}
+
+/* Receive a frame from the card in reader emulation mode, the FPGA and
+ * timer must have been set up by LegicRfReader and frame_send_rwd.
+ *
+ * The LEGIC RF protocol from card to reader does not include explicit
+ * frame start/stop information or length information. The reader must
+ * know beforehand how many bits it wants to receive. (Notably: a card
+ * sending a stream of 0-bits is indistinguishable from no card present.)
+ *
+ * Receive methodology: There is a fancy correlator in hi_read_rx_xcorr, but
+ * I'm not smart enough to use it. Instead I have patched hi_read_tx to output
+ * the ADC signal with hysteresis on SSP_DIN. Bit-bang that signal and look
+ * for edges. Count the edges in each bit interval. If they are approximately
+ * 0 this was a 0-bit, if they are approximately equal to the number of edges
+ * expected for a 212kHz subcarrier, this was a 1-bit. For timing we use the
+ * timer that's still running from frame_send_rwd in order to get a synchronization
+ * with the frame that we just sent.
+ *
+ * FIXME: Because we're relying on the hysteresis to just do the right thing
+ * the range is severely reduced (and you'll probably also need a good antenna).
+ * So this should be fixed some time in the future for a proper receiver.
+ */
+static void frame_receive_rwd(struct legic_frame * const f, int bits, int crypt)
+{
+ uint32_t the_bit = 1; /* Use a bitmask to save on shifts */
+ uint32_t data=0;
+ int i, old_level=0, edges=0;
+ int next_bit_at = TAG_TIME_WAIT;
+
+ if(bits > 32) {
+ bits = 32;
+ }
+
+ AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
+ AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
+
+ /* we have some time now, precompute the cipher
+ * since we cannot compute it on the fly while reading */
+ legic_prng_forward(2);
+
+ if(crypt) {
+ for(i=0; i<bits; i++) {
+ data |= legic_prng_get_bit() << i;
+ legic_prng_forward(1);
+ }
+ }
+
+ while(timer->TC_CV < next_bit_at) ;
+
+ next_bit_at += TAG_TIME_BIT;
+
+ for(i=0; i<bits; i++) {
+ edges = 0;
+ while(timer->TC_CV < next_bit_at) {
+ int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
+ if(level != old_level)
+ edges++;
+ old_level = level;
+ }
+ next_bit_at += TAG_TIME_BIT;
+
+ if(edges > 20 && edges < 60) { /* expected are 42 edges */
+ data ^= the_bit;
+ }
+ the_bit <<= 1;
+ }
+
+ f->data = data;
+ f->bits = bits;
+
+ /* Reset the timer, to synchronize the next frame */
+ timer->TC_CCR = AT91C_TC_SWTRG;
+ while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
+}
+
+static void frame_append_bit(struct legic_frame * const f, int bit)
+{
+ if (f->bits >= 31)
+ return; /* Overflow, won't happen */
+
+ f->data |= (bit << f->bits);
+ f->bits++;
+}
+
+static void frame_clean(struct legic_frame * const f)
+{
+ f->data = 0;
+ f->bits = 0;
+}
+
+static uint32_t perform_setup_phase_rwd(int iv)
+{
+
+ /* Switch on carrier and let the tag charge for 1ms */
+ AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
+ SpinDelay(1);
+
+ legic_prng_init(0); /* no keystream yet */
+ frame_send_rwd(iv, 7);
+ legic_prng_init(iv);
+
+ frame_clean(¤t_frame);
+ frame_receive_rwd(¤t_frame, 6, 1);
+ legic_prng_forward(1); /* we wait anyways */
+ while(timer->TC_CV < 387) ; /* ~ 258us */
+ frame_send_rwd(0x19, 6);
+
+ return current_frame.data;
+}
+
+static void LegicCommonInit(void) {
+ FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
+ SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
+ FpgaSetupSsc();
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
+
+ /* Bitbang the transmitter */
projects / proxmark3-svn / blobdiff