//-----------------------------------------------------------------------------
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
// Miscellaneous routines for low frequency tag operations.
// Tags supported here so far are Texas Instruments (TI), HID
// Also routines for raw mode reading/simulating of LF waveform
-//
//-----------------------------------------------------------------------------
+
#include "proxmark3.h"
#include "apps.h"
+#include "util.h"
#include "hitag2.h"
#include "crc16.h"
+#include "string.h"
-void AcquireRawAdcSamples125k(BOOL at134khz)
+void AcquireRawAdcSamples125k(int at134khz)
{
if (at134khz)
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
// split into two routines so we can avoid timing issues after sending commands //
void DoAcquisition125k(void)
{
- BYTE *dest = (BYTE *)BigBuf;
+ uint8_t *dest = (uint8_t *)BigBuf;
int n = sizeof(BigBuf);
int i;
LED_D_ON();
}
if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
- dest[i] = (BYTE)AT91C_BASE_SSC->SSC_RHR;
+ dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
i++;
LED_D_OFF();
if (i >= n) break;
dest[0], dest[1], dest[2], dest[3], dest[4], dest[5], dest[6], dest[7]);
}
-void ModThenAcquireRawAdcSamples125k(int delay_off, int period_0, int period_1, BYTE *command)
+void ModThenAcquireRawAdcSamples125k(int delay_off, int period_0, int period_1, uint8_t *command)
{
- BOOL at134khz;
+ int at134khz;
/* Make sure the tag is reset */
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
// int n = GraphTraceLen;
// 128 bit shift register [shift3:shift2:shift1:shift0]
- DWORD shift3 = 0, shift2 = 0, shift1 = 0, shift0 = 0;
+ uint32_t shift3 = 0, shift2 = 0, shift1 = 0, shift0 = 0;
int i, cycles=0, samples=0;
// how many sample points fit in 16 cycles of each frequency
- DWORD sampleslo = (FSAMPLE<<4)/FREQLO, sampleshi = (FSAMPLE<<4)/FREQHI;
+ uint32_t sampleslo = (FSAMPLE<<4)/FREQLO, sampleshi = (FSAMPLE<<4)/FREQHI;
// when to tell if we're close enough to one freq or another
- DWORD threshold = (sampleslo - sampleshi + 1)>>1;
+ uint32_t threshold = (sampleslo - sampleshi + 1)>>1;
// TI tags charge at 134.2Khz
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
// i'm 99% sure the crc algorithm is correct, but it may need to eat the
// bytes in reverse or something
// calculate CRC
- DWORD crc=0;
+ uint32_t crc=0;
crc = update_crc16(crc, (shift0)&0xff);
crc = update_crc16(crc, (shift0>>8)&0xff);
}
}
-void WriteTIbyte(BYTE b)
+void WriteTIbyte(uint8_t b)
{
int i = 0;
{
int i, j, n;
// tag transmission is <20ms, sampling at 2M gives us 40K samples max
- // each sample is 1 bit stuffed into a DWORD so we need 1250 DWORDS
+ // each sample is 1 bit stuffed into a uint32_t so we need 1250 uint32_t
#define TIBUFLEN 1250
// clear buffer
// arguments: 64bit data split into 32bit idhi:idlo and optional 16bit crc
// if crc provided, it will be written with the data verbatim (even if bogus)
// if not provided a valid crc will be computed from the data and written.
-void WriteTItag(DWORD idhi, DWORD idlo, WORD crc)
+void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc)
{
if(crc == 0) {
crc = update_crc16(crc, (idlo)&0xff);
void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
{
int i;
- BYTE *tab = (BYTE *)BigBuf;
+ uint8_t *tab = (uint8_t *)BigBuf;
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR);
AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1);
AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME;
AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
- AT91C_BASE_TC1->TC_CMR = TC_CMR_TCCLKS_TIMER_CLOCK1 |
+ AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK |
AT91C_TC_ETRGEDG_RISING |
AT91C_TC_ABETRG |
AT91C_TC_LDRA_RISING |
// compose fc/8 fc/10 waveform
static void fc(int c, int *n) {
- BYTE *dest = (BYTE *)BigBuf;
+ uint8_t *dest = (uint8_t *)BigBuf;
int idx;
// for when we want an fc8 pattern every 4 logical bits
// loop to capture raw HID waveform then FSK demodulate the TAG ID from it
void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
{
- BYTE *dest = (BYTE *)BigBuf;
+ uint8_t *dest = (uint8_t *)BigBuf;
int m=0, n=0, i=0, idx=0, found=0, lastval=0;
- DWORD hi=0, lo=0;
+ uint32_t hi=0, lo=0;
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
LED_D_ON();
}
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
- dest[i] = (BYTE)AT91C_BASE_SSC->SSC_RHR;
+ dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
// we don't care about actual value, only if it's more or less than a
// threshold essentially we capture zero crossings for later analysis
if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;
WDT_HIT();
}
}
+
+//----------------------
+// T5557/T5567 routines
+
+// Relevant times in microsecond
+// To compensate antenna falling times shorten the write times
+// and enlarge the gap ones.
+#define start_gap 250
+#define write_gap 160
+#define write_0 144 //192
+#define write_1 400 //432 for T55x7; 448 for E5550
+
+//Write one bit to card
+void T5567WriteBit(int bit)
+{
+ FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
+ if (bit == 0) SpinDelayUs(write_0);
+ else SpinDelayUs(write_1);
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ SpinDelayUs(write_gap);
+}
+
+//Write one card block in page 0, no lock
+void T5567WriteBlock(int Data, int Block)
+{
+
+ /* Make sure the tag is reset */
+// FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+// SpinDelay(2500);
+
+ FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
+
+ // Give it a bit of time for the resonant antenna to settle.
+ // And for the tag to fully power up
+ SpinDelay(150);
+
+ // now start writting
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ SpinDelayUs(start_gap);
+
+ //Opcode
+ T5567WriteBit(1);
+ T5567WriteBit(0); //Page 0
+ //Lock bit
+ T5567WriteBit(0);
+
+ //Data
+ for (int i=0;i<32;i++){
+ T5567WriteBit(Data&(1<<(31-i)));
+ }
+
+ //Page
+ for (int i=0;i<3;i++){
+ T5567WriteBit(Block&(1<<(2-i)));
+ }
+
+ //Now perform write (nominal is 5.6 ms for T55x7 and 18ms for E5550,
+ // so wait a little more)
+ FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
+ SpinDelay(20);
+
+}
+
+//Copy HID id to card and setup block 0 config
+void CopyHIDtoT5567(int hi, int lo)
+{
+ int data1, data2, data3;
+
+ // ensure no more than 44 bits supplied
+ if (hi>0xFFF) {
+ DbpString("Tags can only have 44 bits.");
+ return;
+ }
+
+ //Build the 3 data blocks for supplied 44bit ID
+ data1 = 0x1D000000; //load preamble
+ for (int i=0;i<12;i++){
+ if (hi & (1<<(11-i))) data1 |= (1<<(((11-i)*2)+1)); // 1 -> 10
+ else data1 |= (1<<((11-i)*2)); // 0 -> 01
+ }
+ data2 = 0;
+ for (int i=0;i<16;i++){
+ if (lo & (1<<(31-i))) data2 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+ else data2 |= (1<<((15-i)*2)); // 0 -> 01
+ }
+ data3 = 0;
+ for (int i=0;i<16;i++){
+ if (lo & (1<<(15-i))) data3 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+ else data3 |= (1<<((15-i)*2)); // 0 -> 01
+ }
+
+ //Program the 3 data blocks for supplied 44bit ID
+ // and the block 0 for HID format
+ T5567WriteBlock(data1,1);
+ T5567WriteBlock(data2,2);
+ T5567WriteBlock(data3,3);
+ //Config for HID (RF/50;FSK2a;Maxblock=3)
+ T5567WriteBlock(0x00107060,0);
+
+ DbpString("DONE!");
+
+}
+
projects / proxmark3-svn / blobdiff