X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/be2d41b73a10f52c319dcf2c0664ff071fb753f1..refs/pull/148/head:/armsrc/lfops.c?ds=sidebyside

diff --git a/armsrc/lfops.c b/armsrc/lfops.c
index dd84aa8e..3acecd6e 100644
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -16,6 +16,7 @@
 #include "string.h"
 #include "lfdemod.h"
 #include "lfsampling.h"
+#include "protocols.h"
 #include "usb_cdc.h" //test
 
 /**
@@ -648,7 +649,6 @@ static void biphaseSimBit(uint8_t c, int *n, uint8_t clock, uint8_t *phase)
 		memset(dest+(*n), c ^ *phase, clock);
 		*phase ^= 1;
 	}
-
 }
 
 // args clock, ask/man or askraw, invert, transmission separator
@@ -1062,62 +1062,14 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
 }
 
 /*------------------------------
- * T5555/T5557/T5567 routines
+ * T5555/T5557/T5567/T5577 routines
  *------------------------------
  */
 
-/* T55x7 configuration register definitions */
-#define T55x7_POR_DELAY			0x00000001
-#define T55x7_ST_TERMINATOR		0x00000008
-#define T55x7_PWD			0x00000010
-#define T55x7_MAXBLOCK_SHIFT		5
-#define T55x7_AOR			0x00000200
-#define T55x7_PSKCF_RF_2		0
-#define T55x7_PSKCF_RF_4		0x00000400
-#define T55x7_PSKCF_RF_8		0x00000800
-#define T55x7_MODULATION_DIRECT		0
-#define T55x7_MODULATION_PSK1		0x00001000
-#define T55x7_MODULATION_PSK2		0x00002000
-#define T55x7_MODULATION_PSK3		0x00003000
-#define T55x7_MODULATION_FSK1		0x00004000
-#define T55x7_MODULATION_FSK2		0x00005000
-#define T55x7_MODULATION_FSK1a		0x00006000
-#define T55x7_MODULATION_FSK2a		0x00007000
-#define T55x7_MODULATION_MANCHESTER	0x00008000
-#define T55x7_MODULATION_BIPHASE	0x00010000
-#define T55x7_MODULATION_DIPHASE	0x00018000
-#define T55x7_BITRATE_RF_8		0
-#define T55x7_BITRATE_RF_16		0x00040000
-#define T55x7_BITRATE_RF_32		0x00080000
-#define T55x7_BITRATE_RF_40		0x000C0000
-#define T55x7_BITRATE_RF_50		0x00100000
-#define T55x7_BITRATE_RF_64		0x00140000
-#define T55x7_BITRATE_RF_100		0x00180000
-#define T55x7_BITRATE_RF_128		0x001C0000
-
-/* T5555 (Q5) configuration register definitions */
-#define T5555_ST_TERMINATOR		0x00000001
-#define T5555_MAXBLOCK_SHIFT		0x00000001
-#define T5555_MODULATION_MANCHESTER	0
-#define T5555_MODULATION_PSK1		0x00000010
-#define T5555_MODULATION_PSK2		0x00000020
-#define T5555_MODULATION_PSK3		0x00000030
-#define T5555_MODULATION_FSK1		0x00000040
-#define T5555_MODULATION_FSK2		0x00000050
-#define T5555_MODULATION_BIPHASE	0x00000060
-#define T5555_MODULATION_DIRECT		0x00000070
-#define T5555_INVERT_OUTPUT		0x00000080
-#define T5555_PSK_RF_2			0
-#define T5555_PSK_RF_4			0x00000100
-#define T5555_PSK_RF_8			0x00000200
-#define T5555_USE_PWD			0x00000400
-#define T5555_USE_AOR			0x00000800
-#define T5555_BITRATE_SHIFT		12
-#define T5555_FAST_WRITE		0x00004000
-#define T5555_PAGE_SELECT		0x00008000
+/* NOTE: T55x7/T5555 configuration register definitions moved to protocols.h */
 
 /*
- * Relevant times in microsecond
+ * Relevant communication times in microsecond
  * To compensate antenna falling times shorten the write times
  * and enlarge the gap ones.
  * Q5 tags seems to have issues when these values changes. 
@@ -1126,21 +1078,7 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
 #define WRITE_GAP 20*8 // was 160 // SPEC:  1*8 to 20*8 - typ 10*8 (or 10fc)
 #define WRITE_0   18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (or 24fc)
 #define WRITE_1   50*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (or 56fc)  432 for T55x7; 448 for E5550
-#define READ_GAP  52*8 
-
-//  VALUES TAKEN FROM EM4x function: SendForward
-//  START_GAP = 440;       (55*8) cycles at 125Khz (8us = 1cycle)
-//  WRITE_GAP = 128;       (16*8)
-//  WRITE_1   = 256 32*8;  (32*8) 
-
-//  These timings work for 4469/4269/4305 (with the 55*8 above)
-//  WRITE_0 = 23*8 , 9*8  SpinDelayUs(23*8); 
-
-// Sam7s has several timers, we will use the source TIMER_CLOCK1 (aka AT91C_TC_CLKS_TIMER_DIV1_CLOCK)
-// TIMER_CLOCK1 = MCK/2, MCK is running at 48 MHz, Timer is running at 48/2 = 24 MHz
-// Hitag units (T0) have duration of 8 microseconds (us), which is 1/125000 per second (carrier)
-// T0 = TIMER_CLOCK1 / 125000 = 192
-// 1 Cycle = 8 microseconds(us)  == 1 field clock
+#define READ_GAP  26*8 
 
 void TurnReadLFOn(int delay) {
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
@@ -1150,17 +1088,45 @@ void TurnReadLFOn(int delay) {
 
 // Write one bit to card
 void T55xxWriteBit(int bit) {
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
 	if (!bit)
-		SpinDelayUs(WRITE_0);
+		TurnReadLFOn(WRITE_0);
 	else
-		SpinDelayUs(WRITE_1);
+		TurnReadLFOn(WRITE_1);
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	SpinDelayUs(WRITE_GAP);
 }
 
+// Send T5577 reset command then read stream (see if we can identify the start of the stream)
+void T55xxResetRead(void) {
+	LED_A_ON();
+	//clear buffer now so it does not interfere with timing later
+	BigBuf_Clear_ext(false);
+
+	// Set up FPGA, 125kHz
+	LFSetupFPGAForADC(95, true);
+
+	// Trigger T55x7 in mode.
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	SpinDelayUs(START_GAP);
+
+	// reset tag - op code 00
+	T55xxWriteBit(0);
+	T55xxWriteBit(0);
+
+	// Turn field on to read the response
+	TurnReadLFOn(READ_GAP);
+
+	// Acquisition
+	doT55x7Acquisition(BigBuf_max_traceLen());
+
+	// Turn the field off
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
+	cmd_send(CMD_ACK,0,0,0,0,0);    
+	LED_A_OFF();
+}
+
 // Write one card block in page 0, no lock
-void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) {
+void T55xxWriteBlockExt(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) {
 	LED_A_ON();
 	bool PwdMode = arg & 0x1;
 	uint8_t Page = (arg & 0x2)>>1;
@@ -1202,11 +1168,16 @@ void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) {
 
 	// turn field off
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-	cmd_send(CMD_ACK,0,0,0,0,0);
 	LED_A_OFF();
 }
 
-// Read one card block in page 0
+// Write one card block in page 0, no lock
+void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) {
+	T55xxWriteBlockExt(Data, Block, Pwd, arg);
+	cmd_send(CMD_ACK,0,0,0,0,0);
+}
+
+// Read one card block in page [page]
 void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
 	LED_A_ON();
 	bool PwdMode = arg0 & 0x1;
@@ -1220,27 +1191,14 @@ void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
 	//make sure block is at max 7
 	Block &= 0x7;
 
-	// Set up FPGA, 125kHz
+	// Set up FPGA, 125kHz to power up the tag
 	LFSetupFPGAForADC(95, true);
-  /*
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
-
-	// Connect the A/D to the peak-detected low-frequency path.
-	SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
-
-	// Now set up the SSC to get the ADC samples that are now streaming at us.
-	FpgaSetpSsc();
 
-	// Give it a bit of time for the resonant antenna to settle.
-	//SpinDelayUs(8*200);  //192FC
-	SpinDelay(50);
-  */
-
-  // Trigger T55x7 Direct Access Mode
+	// Trigger T55x7 Direct Access Mode with start gap
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	SpinDelayUs(START_GAP);
 
-	// Opcode 10
+	// Opcode 1[page]
 	T55xxWriteBit(1);
 	T55xxWriteBit(Page); //Page 0
 
@@ -1261,7 +1219,7 @@ void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
 	TurnReadLFOn(READ_GAP);
 
 	// Acquisition
-	doT55x7Acquisition();
+	doT55x7Acquisition(12000);
 
 	// Turn the field off
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
@@ -1269,37 +1227,6 @@ void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
 	LED_A_OFF();
 }
 
-/*
-// Read card traceability data (page 1)
-void T55xxReadTrace(void){
-	LED_A_ON();
-
-	//clear buffer now so it does not interfere with timing later
-	BigBuf_Clear_ext(false);
-
-	// Set up FPGA, 125kHz
-	LFSetupFPGAForADC(95, true);
-
-  // Trigger T55x7 Direct Access Mode
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-	SpinDelayUs(START_GAP);
-
-	// Opcode 11
-	T55xxWriteBit(1);
-	T55xxWriteBit(1); //Page 1
-
-	// Turn field on to read the response
-	TurnReadLFOn(READ_GAP);
-
-	// Acquisition
-	doT55x7Acquisition();
-
-	// Turn the field off
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-	cmd_send(CMD_ACK,0,0,0,0,0);
-	LED_A_OFF();
-}
-*/
 void T55xxWakeUp(uint32_t Pwd){
 	LED_B_ON();
 	uint32_t i = 0;
@@ -1324,13 +1251,22 @@ void T55xxWakeUp(uint32_t Pwd){
 }
 
 /*-------------- Cloning routines -----------*/
+
+void WriteT55xx(uint32_t *blockdata, uint8_t startblock, uint8_t numblocks) {
+	// write last block first and config block last (if included)
+	for (uint8_t i = numblocks+startblock; i > startblock; i--) {
+		//Dbprintf("write- Blk: %d, d:%08X",i-1,blockdata[i-1]);
+		T55xxWriteBlockExt(blockdata[i-1],i-1,0,0);
+	}
+}
+
 // Copy HID id to card and setup block 0 config
-void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT)
-{
-	int data1=0, data2=0, data3=0, data4=0, data5=0, data6=0; //up to six blocks for long format
-	int last_block = 0;
+void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT) {
+	uint32_t data[] = {0,0,0,0,0,0,0};
+	//int data1=0, data2=0, data3=0, data4=0, data5=0, data6=0; //up to six blocks for long format
+	uint8_t last_block = 0;
 
-	if (longFMT){
+	if (longFMT) {
 		// Ensure no more than 84 bits supplied
 		if (hi2>0xFFFFF) {
 			DbpString("Tags can only have 84 bits.");
@@ -1338,140 +1274,91 @@ void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT)
 		}
 		// Build the 6 data blocks for supplied 84bit ID
 		last_block = 6;
-		data1 = 0x1D96A900; // load preamble (1D) & long format identifier (9E manchester encoded)
-		for (int i=0;i<4;i++) {
-			if (hi2 & (1<<(19-i)))
-				data1 |= (1<<(((3-i)*2)+1)); // 1 -> 10
-			else
-				data1 |= (1<<((3-i)*2)); // 0 -> 01
-		}
-
-		data2 = 0;
-		for (int i=0;i<16;i++) {
-			if (hi2 & (1<<(15-i)))
-				data2 |= (1<<(((15-i)*2)+1)); // 1 -> 10
-			else
-				data2 |= (1<<((15-i)*2)); // 0 -> 01
-		}
-
-		data3 = 0;
-		for (int i=0;i<16;i++) {
-			if (hi & (1<<(31-i)))
-				data3 |= (1<<(((15-i)*2)+1)); // 1 -> 10
-			else
-				data3 |= (1<<((15-i)*2)); // 0 -> 01
-		}
-
-		data4 = 0;
-		for (int i=0;i<16;i++) {
-			if (hi & (1<<(15-i)))
-				data4 |= (1<<(((15-i)*2)+1)); // 1 -> 10
-			else
-				data4 |= (1<<((15-i)*2)); // 0 -> 01
-		}
-
-		data5 = 0;
-		for (int i=0;i<16;i++) {
-			if (lo & (1<<(31-i)))
-				data5 |= (1<<(((15-i)*2)+1)); // 1 -> 10
-			else
-				data5 |= (1<<((15-i)*2)); // 0 -> 01
-		}
-
-		data6 = 0;
-		for (int i=0;i<16;i++) {
-			if (lo & (1<<(15-i)))
-				data6 |= (1<<(((15-i)*2)+1)); // 1 -> 10
-			else
-				data6 |= (1<<((15-i)*2)); // 0 -> 01
-		}
-	}
-	else {
+		// load preamble (1D) & long format identifier (9E manchester encoded)
+		data[1] = 0x1D96A900 | (manchesterEncode2Bytes((hi2 >> 16) & 0xF) & 0xFF);
+		// load raw id from hi2, hi, lo to data blocks (manchester encoded)
+		data[2] = manchesterEncode2Bytes(hi2 & 0xFFFF);
+		data[3] = manchesterEncode2Bytes(hi >> 16);
+		data[4] = manchesterEncode2Bytes(hi & 0xFFFF);
+		data[5] = manchesterEncode2Bytes(lo >> 16);
+		data[6] = manchesterEncode2Bytes(lo & 0xFFFF);
+	}	else {
 		// Ensure no more than 44 bits supplied
 		if (hi>0xFFF) {
 			DbpString("Tags can only have 44 bits.");
 			return;
 		}
-
 		// Build the 3 data blocks for supplied 44bit ID
 		last_block = 3;
-
-		data1 = 0x1D000000; // load preamble
-
-		for (int i=0;i<12;i++) {
-			if (hi & (1<<(11-i)))
-				data1 |= (1<<(((11-i)*2)+1)); // 1 -> 10
-			else
-				data1 |= (1<<((11-i)*2)); // 0 -> 01
-		}
-
-		data2 = 0;
-		for (int i=0;i<16;i++) {
-			if (lo & (1<<(31-i)))
-				data2 |= (1<<(((15-i)*2)+1)); // 1 -> 10
-			else
-				data2 |= (1<<((15-i)*2)); // 0 -> 01
-		}
-
-		data3 = 0;
-		for (int i=0;i<16;i++) {
-			if (lo & (1<<(15-i)))
-				data3 |= (1<<(((15-i)*2)+1)); // 1 -> 10
-			else
-				data3 |= (1<<((15-i)*2)); // 0 -> 01
-		}
+		// load preamble
+		data[1] = 0x1D000000 | (manchesterEncode2Bytes(hi) & 0xFFFFFF);
+		data[2] = manchesterEncode2Bytes(lo >> 16);
+		data[3] = manchesterEncode2Bytes(lo & 0xFFFF);
 	}
+	// load chip config block
+	data[0] = T55x7_BITRATE_RF_50 | T55x7_MODULATION_FSK2a | last_block << T55x7_MAXBLOCK_SHIFT;
+
+	//TODO add selection of chip for Q5 or T55x7
+	// data[0] = (((50-2)/2)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | last_block << T5555_MAXBLOCK_SHIFT;
 
 	LED_D_ON();
 	// Program the data blocks for supplied ID
 	// and the block 0 for HID format
-	T55xxWriteBlock(data1,1,0,0);
-	T55xxWriteBlock(data2,2,0,0);
-	T55xxWriteBlock(data3,3,0,0);
-
-	if (longFMT) { // if long format there are 6 blocks
-		T55xxWriteBlock(data4,4,0,0);
-		T55xxWriteBlock(data5,5,0,0);
-		T55xxWriteBlock(data6,6,0,0);
-	}
-
-	// Config for HID (RF/50, FSK2a, Maxblock=3 for short/6 for long)
-	T55xxWriteBlock(T55x7_BITRATE_RF_50    |
-					T55x7_MODULATION_FSK2a |
-					last_block << T55x7_MAXBLOCK_SHIFT,
-					0,0,0);
+	WriteT55xx(data, 0, last_block+1);
 
 	LED_D_OFF();
 
 	DbpString("DONE!");
 }
 
-void CopyIOtoT55x7(uint32_t hi, uint32_t lo, uint8_t longFMT)
-{
-	int data1=0, data2=0; //up to six blocks for long format
-
-	data1 = hi;  // load preamble
-	data2 = lo;
+void CopyIOtoT55x7(uint32_t hi, uint32_t lo) {
+	uint32_t data[] = {T55x7_BITRATE_RF_64 | T55x7_MODULATION_FSK2a | (2 << T55x7_MAXBLOCK_SHIFT), hi, lo};
+	//TODO add selection of chip for Q5 or T55x7
+	// data[0] = (((64-2)/2)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | 2 << T5555_MAXBLOCK_SHIFT;
 
 	LED_D_ON();
 	// Program the data blocks for supplied ID
-	// and the block 0 for HID format
-	T55xxWriteBlock(data1,1,0,0);
-	T55xxWriteBlock(data2,2,0,0);
+	// and the block 0 config
+	WriteT55xx(data, 0, 3);
 
-	//Config Block
-	T55xxWriteBlock(0x00147040,0,0,0);
 	LED_D_OFF();
 
 	DbpString("DONE!");
 }
 
+// Clone Indala 64-bit tag by UID to T55x7
+void CopyIndala64toT55x7(uint32_t hi, uint32_t lo) {
+	//Program the 2 data blocks for supplied 64bit UID
+	// and the Config for Indala 64 format (RF/32;PSK1 with RF/2;Maxblock=2)
+	uint32_t data[] = { T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK1 | (2 << T55x7_MAXBLOCK_SHIFT), hi, lo};
+	//TODO add selection of chip for Q5 or T55x7
+	// data[0] = (((32-2)/2)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_PSK1 | 2 << T5555_MAXBLOCK_SHIFT;
+
+	WriteT55xx(data, 0, 3);
+	//Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=2;Inverse data)
+	//	T5567WriteBlock(0x603E1042,0);
+	DbpString("DONE!");
+}
+// Clone Indala 224-bit tag by UID to T55x7
+void CopyIndala224toT55x7(uint32_t uid1, uint32_t uid2, uint32_t uid3, uint32_t uid4, uint32_t uid5, uint32_t uid6, uint32_t uid7) {
+	//Program the 7 data blocks for supplied 224bit UID
+	uint32_t data[] = {0, uid1, uid2, uid3, uid4, uid5, uid6, uid7};
+	// and the block 0 for Indala224 format	
+	//Config for Indala (RF/32;PSK1 with RF/2;Maxblock=7)
+	data[0] = T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK1 | (7 << T55x7_MAXBLOCK_SHIFT);
+	//TODO add selection of chip for Q5 or T55x7
+	// data[0] = (((32-2)/2)<<T5555_BITRATE_SHIFT) | T5555_MODULATION_PSK1 | 7 << T5555_MAXBLOCK_SHIFT;
+	WriteT55xx(data, 0, 8);
+	//Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=7;Inverse data)
+	//	T5567WriteBlock(0x603E10E2,0);
+	DbpString("DONE!");
+}
+
 // Define 9bit header for EM410x tags
-#define EM410X_HEADER		0x1FF
+#define EM410X_HEADER		  0x1FF
 #define EM410X_ID_LENGTH	40
 
-void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo)
-{
+void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo) {
 	int i, id_bit;
 	uint64_t id = EM410X_HEADER;
 	uint64_t rev_id = 0;	// reversed ID
@@ -1531,98 +1418,30 @@ void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo)
 	LED_D_ON();
 
 	// Write EM410x ID
-	T55xxWriteBlock((uint32_t)(id >> 32), 1, 0, 0);
-	T55xxWriteBlock((uint32_t)id, 2, 0, 0);
-
-	// Config for EM410x (RF/64, Manchester, Maxblock=2)
-	if (card) {
-		// Clock rate is stored in bits 8-15 of the card value
-		clock = (card & 0xFF00) >> 8;
-		Dbprintf("Clock rate: %d", clock);
-		switch (clock) {
-		case 50:
-			clock = T55x7_BITRATE_RF_50;
-		case 40:
-			clock = T55x7_BITRATE_RF_40;
-		case 32:
-			clock = T55x7_BITRATE_RF_32;
-			break;
-		case 16:
-			clock = T55x7_BITRATE_RF_16;
-			break;
-		case 0:
-			// A value of 0 is assumed to be 64 for backwards-compatibility
-			// Fall through...
-		case 64:
-			clock = T55x7_BITRATE_RF_64;
-			break;
-		default:
+	uint32_t data[] = {0, id>>32, id & 0xFFFFFFFF};
+
+	clock = (card & 0xFF00) >> 8;
+	clock = (clock == 0) ? 64 : clock;
+	Dbprintf("Clock rate: %d", clock);
+	if (card & 0xFF) { //t55x7
+		clock = GetT55xxClockBit(clock);			
+		if (clock == 0) {
 			Dbprintf("Invalid clock rate: %d", clock);
 			return;
 		}
-
-		// Writing configuration for T55x7 tag
-		T55xxWriteBlock(clock	    |
-						T55x7_MODULATION_MANCHESTER |
-						2 << T55x7_MAXBLOCK_SHIFT,
-						0, 0, 0);
+		data[0] = clock | T55x7_MODULATION_MANCHESTER | (2 << T55x7_MAXBLOCK_SHIFT);
+	} else { //t5555 (Q5)
+		clock = (clock-2)>>1;  //n = (RF-2)/2
+		data[0] = (clock << T5555_BITRATE_SHIFT) | T5555_MODULATION_MANCHESTER | (2 << T5555_MAXBLOCK_SHIFT);
 	}
-	else
-		// Writing configuration for T5555(Q5) tag
-		T55xxWriteBlock(0x1F << T5555_BITRATE_SHIFT |
-						T5555_MODULATION_MANCHESTER |
-						2 << T5555_MAXBLOCK_SHIFT,
-						0, 0, 0);
+
+	WriteT55xx(data, 0, 3);
 
 	LED_D_OFF();
 	Dbprintf("Tag %s written with 0x%08x%08x\n", card ? "T55x7":"T5555",
 			 (uint32_t)(id >> 32), (uint32_t)id);
 }
 
-// Clone Indala 64-bit tag by UID to T55x7
-void CopyIndala64toT55x7(int hi, int lo)
-{
-
-	//Program the 2 data blocks for supplied 64bit UID
-	// and the block 0 for Indala64 format
-	T55xxWriteBlock(hi,1,0,0);
-	T55xxWriteBlock(lo,2,0,0);
-	//Config for Indala (RF/32;PSK1 with RF/2;Maxblock=2)
-	T55xxWriteBlock(T55x7_BITRATE_RF_32    |
-					T55x7_MODULATION_PSK1 |
-					2 << T55x7_MAXBLOCK_SHIFT,
-					0, 0, 0);
-	//Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=2;Inverse data)
-	//	T5567WriteBlock(0x603E1042,0);
-
-	DbpString("DONE!");
-
-}
-
-void CopyIndala224toT55x7(int uid1, int uid2, int uid3, int uid4, int uid5, int uid6, int uid7)
-{
-
-	//Program the 7 data blocks for supplied 224bit UID
-	// and the block 0 for Indala224 format
-	T55xxWriteBlock(uid1,1,0,0);
-	T55xxWriteBlock(uid2,2,0,0);
-	T55xxWriteBlock(uid3,3,0,0);
-	T55xxWriteBlock(uid4,4,0,0);
-	T55xxWriteBlock(uid5,5,0,0);
-	T55xxWriteBlock(uid6,6,0,0);
-	T55xxWriteBlock(uid7,7,0,0);
-	//Config for Indala (RF/32;PSK1 with RF/2;Maxblock=7)
-	T55xxWriteBlock(T55x7_BITRATE_RF_32    |
-					T55x7_MODULATION_PSK1 |
-					7 << T55x7_MAXBLOCK_SHIFT,
-					0,0,0);
-	//Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=7;Inverse data)
-	//	T5567WriteBlock(0x603E10E2,0);
-
-	DbpString("DONE!");
-
-}
-
 //-----------------------------------
 // EM4469 / EM4305 routines
 //-----------------------------------
@@ -1642,6 +1461,14 @@ uint8_t * fwd_write_ptr; //forwardlink bit pointer
 // see EM4469 spec
 //====================================================================
 //--------------------------------------------------------------------
+//  VALUES TAKEN FROM EM4x function: SendForward
+//  START_GAP = 440;       (55*8) cycles at 125Khz (8us = 1cycle)
+//  WRITE_GAP = 128;       (16*8)
+//  WRITE_1   = 256 32*8;  (32*8) 
+
+//  These timings work for 4469/4269/4305 (with the 55*8 above)
+//  WRITE_0 = 23*8 , 9*8  SpinDelayUs(23*8); 
+
 uint8_t Prepare_Cmd( uint8_t cmd ) {
 	//--------------------------------------------------------------------