X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/24c49d36ba3ea8acb9be21bdbb51503969a5a113..6df022667ddc1e827901913ad2afa9b7607c32ed:/armsrc/lfops.c?ds=sidebyside diff --git a/armsrc/lfops.c b/armsrc/lfops.c index ab86f931..1b922ca0 100644 --- a/armsrc/lfops.c +++ b/armsrc/lfops.c @@ -91,6 +91,7 @@ void ModThenAcquireRawAdcSamples125k(uint32_t delay_off, uint32_t periods, uint3 */ void ReadTItag(void) { + StartTicks(); // some hardcoded initial params // when we read a TI tag we sample the zerocross line at 2Mhz // TI tags modulate a 1 as 16 cycles of 123.2Khz @@ -216,6 +217,7 @@ void ReadTItag(void) DbpString("Info: CRC is good"); } } + StopTicks(); } void WriteTIbyte(uint8_t b) @@ -282,7 +284,7 @@ void AcquireTiType(void) HIGH(GPIO_SSC_DOUT); // Charge TI tag for 50ms. - SpinDelay(50); + WaitMS(50); // stop modulating antenna and listen LOW(GPIO_SSC_DOUT); @@ -322,6 +324,7 @@ void AcquireTiType(void) // if not provided a valid crc will be computed from the data and written. void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc) { + StartTicks(); FpgaDownloadAndGo(FPGA_BITSTREAM_LF); if(crc == 0) { crc = update_crc16(crc, (idlo)&0xff); @@ -360,7 +363,7 @@ void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc) // modulate antenna HIGH(GPIO_SSC_DOUT); - SpinDelay(50); // charge time + WaitMS(50); // charge time WriteTIbyte(0xbb); // keyword WriteTIbyte(0xeb); // password @@ -377,7 +380,7 @@ void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc) WriteTIbyte(0x00); // write frame lo WriteTIbyte(0x03); // write frame hi HIGH(GPIO_SSC_DOUT); - SpinDelay(50); // programming time + WaitMS(50); // programming time LED_A_OFF(); @@ -386,61 +389,80 @@ void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc) FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); DbpString("Now use `lf ti read` to check"); + StopTicks(); } void SimulateTagLowFrequency(int period, int gap, int ledcontrol) { int i = 0; - uint8_t *tab = BigBuf_get_addr(); + uint8_t *buf = BigBuf_get_addr(); + + FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT); + //FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_READER_FIELD); + //FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_TOGGLE_MODE ); - FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_READER_FIELD); + // set frequency, get values from 'lf config' command + sample_config *sc = getSamplingConfig(); + if ( (sc->divisor == 1) || (sc->divisor < 0) || (sc->divisor > 255) ) + FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz + else if (sc->divisor == 0) + FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz + else + FpgaSendCommand(FPGA_CMD_SET_DIVISOR, sc->divisor); + + SetAdcMuxFor(GPIO_MUXSEL_LOPKD); + AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK; AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK; + // power on antenna + // OPEN_COIL(); + // SpinDelay(50); + for(;;) { WDT_HIT(); if (ledcontrol) LED_D_ON(); - //wait until SSC_CLK goes HIGH + // wait until SSC_CLK goes HIGH + // used as a simple detection of a reader field? while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) { WDT_HIT(); - if ( usb_poll_validate_length() || BUTTON_PRESS() ) { - FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); - LED_D_OFF(); - return; - } + if ( usb_poll_validate_length() || BUTTON_PRESS() ) + goto OUT; } - if(tab[i]) + if(buf[i]) OPEN_COIL(); else SHORT_COIL(); - - if (ledcontrol) LED_D_OFF(); - + //wait until SSC_CLK goes LOW while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) { WDT_HIT(); - if ( usb_poll_validate_length() || BUTTON_PRESS() ) { - FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); - LED_D_OFF(); - return; - } + if ( usb_poll_validate_length() || BUTTON_PRESS() ) + goto OUT; } - + i++; if(i == period) { i = 0; if (gap) { WDT_HIT(); SHORT_COIL(); - WaitUS(gap); + SpinDelayUs(gap); } } + + if (ledcontrol) LED_D_OFF(); } +OUT: + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + LED_D_OFF(); + DbpString("Simulation stopped"); + return; } #define DEBUG_FRAME_CONTENTS 1 @@ -843,13 +865,14 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol) if (ledcontrol) LED_A_OFF(); *high = hi; *low = lo; - return; + break; } // reset } hi2 = hi = lo = idx = 0; WDT_HIT(); } + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); DbpString("Stopped"); if (ledcontrol) LED_A_OFF(); } @@ -946,13 +969,14 @@ void CmdAWIDdemodFSK(int findone, int *high, int *low, int ledcontrol) } break; } - if (findone){ - if (ledcontrol) LED_A_OFF(); - return; - } + if (findone) + break; + idx = 0; WDT_HIT(); } + + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); DbpString("Stopped"); if (ledcontrol) LED_A_OFF(); } @@ -1007,13 +1031,14 @@ void CmdEM410xdemod(int findone, int *high, int *low, int ledcontrol) if (ledcontrol) LED_A_OFF(); *high=lo>>32; *low=lo & 0xFFFFFFFF; - return; + break; } } WDT_HIT(); hi = lo = size = idx = 0; clk = invert = errCnt = 0; } + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); DbpString("Stopped"); if (ledcontrol) LED_A_OFF(); } @@ -1063,15 +1088,15 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol) // Checksum: 0x75 //XSF(version)facility:codeone+codetwo //Handle the data - if(findone){ //only print binary if we are doing one - Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx], dest[idx+1], dest[idx+2],dest[idx+3],dest[idx+4],dest[idx+5],dest[idx+6],dest[idx+7],dest[idx+8]); - Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+9], dest[idx+10],dest[idx+11],dest[idx+12],dest[idx+13],dest[idx+14],dest[idx+15],dest[idx+16],dest[idx+17]); - Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+18],dest[idx+19],dest[idx+20],dest[idx+21],dest[idx+22],dest[idx+23],dest[idx+24],dest[idx+25],dest[idx+26]); - Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+27],dest[idx+28],dest[idx+29],dest[idx+30],dest[idx+31],dest[idx+32],dest[idx+33],dest[idx+34],dest[idx+35]); - Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+36],dest[idx+37],dest[idx+38],dest[idx+39],dest[idx+40],dest[idx+41],dest[idx+42],dest[idx+43],dest[idx+44]); - Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+45],dest[idx+46],dest[idx+47],dest[idx+48],dest[idx+49],dest[idx+50],dest[idx+51],dest[idx+52],dest[idx+53]); - Dbprintf("%d%d%d%d%d%d%d%d %d%d",dest[idx+54],dest[idx+55],dest[idx+56],dest[idx+57],dest[idx+58],dest[idx+59],dest[idx+60],dest[idx+61],dest[idx+62],dest[idx+63]); - } + // if(findone){ //only print binary if we are doing one + // Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx], dest[idx+1], dest[idx+2],dest[idx+3],dest[idx+4],dest[idx+5],dest[idx+6],dest[idx+7],dest[idx+8]); + // Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+9], dest[idx+10],dest[idx+11],dest[idx+12],dest[idx+13],dest[idx+14],dest[idx+15],dest[idx+16],dest[idx+17]); + // Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+18],dest[idx+19],dest[idx+20],dest[idx+21],dest[idx+22],dest[idx+23],dest[idx+24],dest[idx+25],dest[idx+26]); + // Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+27],dest[idx+28],dest[idx+29],dest[idx+30],dest[idx+31],dest[idx+32],dest[idx+33],dest[idx+34],dest[idx+35]); + // Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+36],dest[idx+37],dest[idx+38],dest[idx+39],dest[idx+40],dest[idx+41],dest[idx+42],dest[idx+43],dest[idx+44]); + // Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+45],dest[idx+46],dest[idx+47],dest[idx+48],dest[idx+49],dest[idx+50],dest[idx+51],dest[idx+52],dest[idx+53]); + // Dbprintf("%d%d%d%d%d%d%d%d %d%d",dest[idx+54],dest[idx+55],dest[idx+56],dest[idx+57],dest[idx+58],dest[idx+59],dest[idx+60],dest[idx+61],dest[idx+62],dest[idx+63]); + // } code = bytebits_to_byte(dest+idx,32); code2 = bytebits_to_byte(dest+idx+32,32); version = bytebits_to_byte(dest+idx+27,8); //14,4 @@ -1092,7 +1117,7 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol) if (ledcontrol) LED_A_OFF(); *high=code; *low=code2; - return; + break; } code=code2=0; version=facilitycode=0; @@ -1101,6 +1126,7 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol) WDT_HIT(); } + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); DbpString("Stopped"); if (ledcontrol) LED_A_OFF(); } @@ -1116,10 +1142,10 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol) * Q5 tags seems to have issues when these values changes. */ -#define START_GAP 50*8 // was 250 // SPEC: 1*8 to 50*8 - typ 15*8 (or 15fc) -#define WRITE_GAP 20*8 // was 160 // SPEC: 1*8 to 20*8 - typ 10*8 (or 10fc) -#define WRITE_0 18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (or 24fc) -#define WRITE_1 50*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (or 56fc) 432 for T55x7; 448 for E5550 +#define START_GAP 50*8 // was 250 // SPEC: 1*8 to 50*8 - typ 15*8 (15fc) +#define WRITE_GAP 20*8 // was 160 // SPEC: 1*8 to 20*8 - typ 10*8 (10fc) +#define WRITE_0 18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (24fc) +#define WRITE_1 54*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (56fc) 432 for T55x7; 448 for E5550 #define READ_GAP 15*8 // VALUES TAKEN FROM EM4x function: SendForward @@ -1128,7 +1154,7 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol) // WRITE_1 = 256 32*8; (32*8) // These timings work for 4469/4269/4305 (with the 55*8 above) -// WRITE_0 = 23*8 , 9*8 SpinDelayUs(23*8); +// WRITE_0 = 23*8 , 9*8 // Sam7s has several timers, we will use the source TIMER_CLOCK1 (aka AT91C_TC_CLKS_TIMER_DIV1_CLOCK) // TIMER_CLOCK1 = MCK/2, MCK is running at 48 MHz, Timer is running at 48/2 = 24 MHz @@ -1136,7 +1162,10 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol) // T0 = TIMER_CLOCK1 / 125000 = 192 // 1 Cycle = 8 microseconds(us) == 1 field clock -void TurnReadLFOn(int delay) { +// new timer: +// = 1us = 1.5ticks +// 1fc = 8us = 12ticks +void TurnReadLFOn(uint32_t delay) { FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD); // measure antenna strength. @@ -1221,10 +1250,11 @@ void T55xxWriteBlockExt(uint32_t Data, uint8_t Block, uint32_t Pwd, uint8_t arg) // Perform write (nominal is 5.6 ms for T55x7 and 18ms for E5550, // so wait a little more) TurnReadLFOn(20 * 1000); - //could attempt to do a read to confirm write took - // as the tag should repeat back the new block - // until it is reset, but to confirm it we would - // need to know the current block 0 config mode + + //could attempt to do a read to confirm write took + // as the tag should repeat back the new block + // until it is reset, but to confirm it we would + // need to know the current block 0 config mode // turn field off FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); @@ -1253,7 +1283,7 @@ void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) { // Set up FPGA, 125kHz to power up the tag LFSetupFPGAForADC(95, true); - SpinDelay(3); + //SpinDelay(3); // Trigger T55x7 Direct Access Mode with start gap FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); @@ -1280,7 +1310,7 @@ void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) { TurnReadLFOn(READ_GAP); // Acquisition - doT55x7Acquisition(12000); + doT55x7Acquisition(7679); // Turn the field off FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off @@ -1513,9 +1543,9 @@ void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo) { //----------------------------------- // EM4469 / EM4305 routines //----------------------------------- -#define FWD_CMD_LOGIN 0xC //including the even parity, binary mirrored -#define FWD_CMD_WRITE 0xA -#define FWD_CMD_READ 0x9 +#define FWD_CMD_LOGIN 0xC //including the even parity, binary mirrored +#define FWD_CMD_WRITE 0xA +#define FWD_CMD_READ 0x9 #define FWD_CMD_DISABLE 0x5 uint8_t forwardLink_data[64]; //array of forwarded bits @@ -1534,7 +1564,7 @@ uint8_t * fwd_write_ptr; //forwardlink bit pointer // WRITE_1 = 256 32*8; (32*8) // These timings work for 4469/4269/4305 (with the 55*8 above) -// WRITE_0 = 23*8 , 9*8 SpinDelayUs(23*8); +// WRITE_0 = 23*8 , 9*8 uint8_t Prepare_Cmd( uint8_t cmd ) { @@ -1639,9 +1669,9 @@ void SendForward(uint8_t fwd_bit_count) { else { //These timings work for 4469/4269/4305 (with the 55*8 above) FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off - WaitUS(23*8); //16-4 cycles off (8us each) // ICEMAN: problem with (us) clock is 21.3us increments + WaitUS(16*8); //16-4 cycles off (8us each) // ICEMAN: problem with (us) clock is 21.3us increments FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);//field on - WaitUS(9*8); //16 cycles on (8us each) // ICEMAN: problem with (us) clock is 21.3us increments + WaitUS(16*8); //16 cycles on (8us each) // ICEMAN: problem with (us) clock is 21.3us increments } } } @@ -1649,22 +1679,20 @@ void SendForward(uint8_t fwd_bit_count) { void EM4xLogin(uint32_t Password) { uint8_t fwd_bit_count; - forward_ptr = forwardLink_data; fwd_bit_count = Prepare_Cmd( FWD_CMD_LOGIN ); fwd_bit_count += Prepare_Data( Password&0xFFFF, Password>>16 ); - SendForward(fwd_bit_count); //Wait for command to complete - SpinDelay(20); + WaitMS(20); } void EM4xReadWord(uint8_t Address, uint32_t Pwd, uint8_t PwdMode) { uint8_t fwd_bit_count; uint8_t *dest = BigBuf_get_addr(); - uint16_t bufsize = BigBuf_max_traceLen(); + uint16_t bufsize = BigBuf_max_traceLen(); // ICEMAN: this tries to fill up all tracelog space uint32_t i = 0; // Clear destination buffer before sending the command @@ -1677,14 +1705,10 @@ void EM4xReadWord(uint8_t Address, uint32_t Pwd, uint8_t PwdMode) { fwd_bit_count = Prepare_Cmd( FWD_CMD_READ ); fwd_bit_count += Prepare_Addr( Address ); - // Connect the A/D to the peak-detected low-frequency path. - SetAdcMuxFor(GPIO_MUXSEL_LOPKD); - // Now set up the SSC to get the ADC samples that are now streaming at us. - FpgaSetupSsc(); - SendForward(fwd_bit_count); // Now do the acquisition + // ICEMAN, change to the one in lfsampling.c i = 0; for(;;) { if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) { @@ -1717,7 +1741,7 @@ void EM4xWriteWord(uint32_t Data, uint8_t Address, uint32_t Pwd, uint8_t PwdMode SendForward(fwd_bit_count); //Wait for write to complete - SpinDelay(20); + WaitMS(20); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off LED_D_OFF(); }