int i;
uint32_t dwPar = 0;
- // Generate the encrypted data
+ // Generate the parity bits
for (i = 0; i < iLen; i++) {
- // Save the encrypted parity bit
+ // and save them to a 32Bit word
dwPar |= ((OddByteParity[pbtCmd[i]]) << i);
}
return dwPar;
}
//=============================================================================
-// ISO 14443 Type A - Manchester
+// ISO 14443 Type A - Manchester decoder
//=============================================================================
+// Basics:
+// The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
+// at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
+// ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
+// The Manchester decoder needs to identify the following sequences:
+// 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
+// 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
+// 8 ticks unmodulated: Sequence F = end of communication
+// 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
+// Note 1: the bitstream may start at any time (either in first or second nibble within the parameter bit). We therefore need to sync.
+// Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
static tDemod Demod;
-static RAMFUNC int ManchesterDecoding(int v)
+inline RAMFUNC bool IsModulation(byte_t b)
{
- int bit;
- int modulation;
- //int error = 0;
-
- if(!Demod.buff) {
- Demod.buff = 1;
- Demod.buffer = v;
- return FALSE;
- }
- else {
- bit = Demod.buffer;
- Demod.buffer = v;
- }
+ if (b >= 5 || b == 3) // majority decision: 2 or more bits are set
+ return true;
+ else
+ return false;
+
+}
- if(Demod.state==DEMOD_UNSYNCD) {
- Demod.output[Demod.len] = 0xfa;
- Demod.syncBit = 0;
- //Demod.samples = 0;
- Demod.posCount = 1; // This is the first half bit period, so after syncing handle the second part
+inline RAMFUNC bool IsModulationNibble1(byte_t b)
+{
+ return IsModulation((b & 0xE0) >> 5);
+}
- if(bit & 0x08) {
- Demod.syncBit = 0x08;
- }
+inline RAMFUNC bool IsModulationNibble2(byte_t b)
+{
+ return IsModulation((b & 0x0E) >> 1);
+}
- if(bit & 0x04) {
- if(Demod.syncBit) {
- bit <<= 4;
+static RAMFUNC int ManchesterDecoding(int bit, uint16_t offset)
+{
+
+ switch (Demod.state) {
+
+ case DEMOD_UNSYNCD: // not yet synced
+ Demod.len = 0; // initialize number of decoded data bytes
+ Demod.bitCount = offset; // initialize number of decoded data bits
+ Demod.shiftReg = 0; // initialize shiftreg to hold decoded data bits
+ Demod.parityBits = 0; // initialize parity bits
+ Demod.collisionPos = 0; // Position of collision bit
+
+ if (IsModulationNibble1(bit)
+ && !IsModulationNibble2(bit)) { // this is the start bit
+ Demod.samples = 8;
+ if(trigger) LED_A_OFF();
+ Demod.state = DEMOD_MANCHESTER_DATA;
+ } else if (!IsModulationNibble1(bit) && IsModulationNibble2(bit)) { // this may be the first half of the start bit
+ Demod.samples = 4;
+ Demod.state = DEMOD_HALF_SYNCD;
}
- Demod.syncBit = 0x04;
- }
+ break;
- if(bit & 0x02) {
- if(Demod.syncBit) {
- bit <<= 2;
- }
- Demod.syncBit = 0x02;
- }
- if(bit & 0x01 && Demod.syncBit) {
- Demod.syncBit = 0x01;
- }
-
- if(Demod.syncBit) {
- Demod.len = 0;
- Demod.state = DEMOD_START_OF_COMMUNICATION;
- Demod.sub = SUB_FIRST_HALF;
- Demod.bitCount = 0;
- Demod.shiftReg = 0;
- Demod.parityBits = 0;
- Demod.samples = 0;
- if(Demod.posCount) {
- if(trigger) LED_A_OFF();
- switch(Demod.syncBit) {
- case 0x08: Demod.samples = 3; break;
- case 0x04: Demod.samples = 2; break;
- case 0x02: Demod.samples = 1; break;
- case 0x01: Demod.samples = 0; break;
+ case DEMOD_HALF_SYNCD:
+ Demod.samples += 8;
+ if (IsModulationNibble1(bit)) { // error: this was not a start bit.
+ Demod.state = DEMOD_UNSYNCD;
+ } else {
+ if (IsModulationNibble2(bit)) { // modulation in first half
+ Demod.state = DEMOD_MOD_FIRST_HALF;
+ } else { // no modulation in first half
+ Demod.state = DEMOD_NOMOD_FIRST_HALF;
}
}
- //error = 0;
- }
- }
- else {
- //modulation = bit & Demod.syncBit;
- modulation = ((bit << 1) ^ ((Demod.buffer & 0x08) >> 3)) & Demod.syncBit;
-
- Demod.samples += 4;
-
- if(Demod.posCount==0) {
- Demod.posCount = 1;
- if(modulation) {
- Demod.sub = SUB_FIRST_HALF;
+ break;
+
+
+ case DEMOD_MOD_FIRST_HALF:
+ Demod.samples += 8;
+ Demod.bitCount++;
+ if (IsModulationNibble1(bit)) { // modulation in both halfs - collision
+ if (!Demod.collisionPos) {
+ Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
+ }
+ } // modulation in first half only - Sequence D = 1
+ Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg
+ if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
+ Demod.parityBits <<= 1; // make room for the parity bit
+ Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
+ Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
+ Demod.bitCount = 0;
+ Demod.shiftReg = 0;
}
- else {
- Demod.sub = SUB_NONE;
+ if (IsModulationNibble2(bit)) { // modulation in first half
+ Demod.state = DEMOD_MOD_FIRST_HALF;
+ } else { // no modulation in first half
+ Demod.state = DEMOD_NOMOD_FIRST_HALF;
}
- }
- else {
- Demod.posCount = 0;
- if(modulation && (Demod.sub == SUB_FIRST_HALF)) {
- if(Demod.state!=DEMOD_ERROR_WAIT) {
- Demod.state = DEMOD_ERROR_WAIT;
- Demod.output[Demod.len] = 0xaa;
- //error = 0x01;
+ break;
+
+
+ case DEMOD_NOMOD_FIRST_HALF:
+ if (IsModulationNibble1(bit)) { // modulation in second half only - Sequence E = 0
+ Demod.bitCount++;
+ Demod.samples += 8;
+ Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
+ if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
+ Demod.parityBits <<= 1; // make room for the new parity bit
+ Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
+ Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
+ Demod.bitCount = 0;
+ Demod.shiftReg = 0;
}
+ } else { // no modulation in both halves - End of communication
+ Demod.samples += 4;
+ if(Demod.bitCount > 0) { // if we decoded bits
+ Demod.shiftReg >>= (9 - Demod.bitCount); // add the remaining decoded bits to the output
+ Demod.output[Demod.len++] = Demod.shiftReg & 0xff;
+ // No parity bit, so just shift a 0
+ Demod.parityBits <<= 1;
+ }
+ Demod.state = DEMOD_UNSYNCD; // start from the beginning
+ return TRUE; // we are finished with decoding the raw data sequence
}
- else if(modulation) {
- Demod.sub = SUB_SECOND_HALF;
+ if (IsModulationNibble2(bit)) { // modulation in first half
+ Demod.state = DEMOD_MOD_FIRST_HALF;
+ } else { // no modulation in first half
+ Demod.state = DEMOD_NOMOD_FIRST_HALF;
}
+ break;
+
- switch(Demod.state) {
- case DEMOD_START_OF_COMMUNICATION:
- if(Demod.sub == SUB_FIRST_HALF) {
- Demod.state = DEMOD_MANCHESTER_D;
- }
- else {
- Demod.output[Demod.len] = 0xab;
- Demod.state = DEMOD_ERROR_WAIT;
- //error = 0x02;
- }
- break;
-
- case DEMOD_MANCHESTER_D:
- case DEMOD_MANCHESTER_E:
- if(Demod.sub == SUB_FIRST_HALF) {
- Demod.bitCount++;
- Demod.shiftReg = (Demod.shiftReg >> 1) ^ 0x100;
- Demod.state = DEMOD_MANCHESTER_D;
+ case DEMOD_MANCHESTER_DATA:
+ Demod.samples += 8;
+ if (IsModulationNibble1(bit)) { // modulation in first half
+ if (IsModulationNibble2(bit) & 0x0f) { // ... and in second half = collision
+ if (!Demod.collisionPos) {
+ Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
}
- else if(Demod.sub == SUB_SECOND_HALF) {
- Demod.bitCount++;
- Demod.shiftReg >>= 1;
- Demod.state = DEMOD_MANCHESTER_E;
+ } // modulation in first half only - Sequence D = 1
+ Demod.bitCount++;
+ Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg
+ if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
+ Demod.parityBits <<= 1; // make room for the parity bit
+ Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
+ Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
+ Demod.bitCount = 0;
+ Demod.shiftReg = 0;
+ }
+ } else { // no modulation in first half
+ if (IsModulationNibble2(bit)) { // and modulation in second half = Sequence E = 0
+ Demod.bitCount++;
+ Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
+ if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
+ Demod.parityBits <<= 1; // make room for the new parity bit
+ Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
+ Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
+ Demod.bitCount = 0;
+ Demod.shiftReg = 0;
}
- else {
- Demod.state = DEMOD_MANCHESTER_F;
+ } else { // no modulation in both halves - End of communication
+ if(Demod.bitCount > 0) { // if we decoded bits
+ Demod.shiftReg >>= (9 - Demod.bitCount); // add the remaining decoded bits to the output
+ Demod.output[Demod.len++] = Demod.shiftReg & 0xff;
+ // No parity bit, so just shift a 0
+ Demod.parityBits <<= 1;
}
- break;
-
- case DEMOD_MANCHESTER_F:
- // Tag response does not need to be a complete byte!
- if(Demod.len > 0 || Demod.bitCount > 0) {
- if(Demod.bitCount > 0) {
- Demod.shiftReg >>= (9 - Demod.bitCount);
- Demod.output[Demod.len] = Demod.shiftReg & 0xff;
- Demod.len++;
- // No parity bit, so just shift a 0
- Demod.parityBits <<= 1;
- }
-
- Demod.state = DEMOD_UNSYNCD;
- return TRUE;
- }
- else {
- Demod.output[Demod.len] = 0xad;
- Demod.state = DEMOD_ERROR_WAIT;
- //error = 0x03;
- }
- break;
-
- case DEMOD_ERROR_WAIT:
- Demod.state = DEMOD_UNSYNCD;
- break;
-
- default:
- Demod.output[Demod.len] = 0xdd;
- Demod.state = DEMOD_UNSYNCD;
- break;
- }
-
- if(Demod.bitCount>=9) {
- Demod.output[Demod.len] = Demod.shiftReg & 0xff;
- Demod.len++;
-
- Demod.parityBits <<= 1;
- Demod.parityBits ^= ((Demod.shiftReg >> 8) & 0x01);
-
- Demod.bitCount = 0;
- Demod.shiftReg = 0;
+ Demod.state = DEMOD_UNSYNCD; // start from the beginning
+ return TRUE; // we are finished with decoding the raw data sequence
+ }
}
+
+ }
- /*if(error) {
- Demod.output[Demod.len] = 0xBB;
- Demod.len++;
- Demod.output[Demod.len] = error & 0xFF;
- Demod.len++;
- Demod.output[Demod.len] = 0xBB;
- Demod.len++;
- Demod.output[Demod.len] = bit & 0xFF;
- Demod.len++;
- Demod.output[Demod.len] = Demod.buffer & 0xFF;
- Demod.len++;
- Demod.output[Demod.len] = Demod.syncBit & 0xFF;
- Demod.len++;
- Demod.output[Demod.len] = 0xBB;
- Demod.len++;
- return TRUE;
- }*/
-
- }
-
- } // end (state != UNSYNCED)
-
- return FALSE;
+ return FALSE; // not finished yet, need more data
}
//=============================================================================
LED_B_OFF();
}
- if(ManchesterDecoding(data[0] & 0x0F)) {
+ if(ManchesterDecoding(data[0], 0)) {
LED_B_ON();
if (!LogTrace(receivedResponse, Demod.len, 0 - Demod.samples, Demod.parityBits, FALSE)) break;
while(GetCountMifare() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
}
- for(c = 0; c < 10;) { // standard delay for each transfer (allow tag to be ready after last transmission)
+ for(c = 0; c < 10;) { // standard delay for each transfer (allow tag to be ready after last transmission?)
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
AT91C_BASE_SSC->SSC_THR = 0x00;
c++;
//-----------------------------------------------------------------------------
// Wait a certain time for tag response
// If a response is captured return TRUE
-// If it takes to long return FALSE
+// If it takes too long return FALSE
//-----------------------------------------------------------------------------
-static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed) //uint8_t *buffer
+static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint16_t offset, int maxLen, int *samples)
{
- // buffer needs to be 512 bytes
int c;
-
+
// Set FPGA mode to "reader listen mode", no modulation (listen
// only, since we are receiving, not transmitting).
// Signal field is on with the appropriate LED
Demod.state = DEMOD_UNSYNCD;
uint8_t b;
- if (elapsed) *elapsed = 0;
c = 0;
for(;;) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
if(c < iso14a_timeout) { c++; } else { return FALSE; }
b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
- if(ManchesterDecoding((b>>4) & 0xf)) {
- *samples = ((c - 1) << 3) + 4;
- return TRUE;
- }
- if(ManchesterDecoding(b & 0x0f)) {
- *samples = c << 3;
+ if(ManchesterDecoding(b, offset)) {
+ *samples = Demod.samples;
return TRUE;
}
}
CodeIso14443aBitsAsReaderPar(frame,bits,par);
- // Select the card
+ // Send command to tag
TransmitFor14443a(ToSend, ToSendMax, timing);
if(trigger)
LED_A_ON();
- // Store reader command in buffer
+ // Log reader command in trace buffer
if (tracing) LogTrace(frame,nbytes(bits),0,par,TRUE);
}
ReaderTransmitBitsPar(frame,len*8,par, timing);
}
+void ReaderTransmitBits(uint8_t* frame, int len, uint32_t *timing)
+{
+ // Generate parity and redirect
+ ReaderTransmitBitsPar(frame,len,GetParity(frame,len/8), timing);
+}
+
void ReaderTransmit(uint8_t* frame, int len, uint32_t *timing)
{
// Generate parity and redirect
ReaderTransmitBitsPar(frame,len*8,GetParity(frame,len), timing);
}
+int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset)
+{
+ int samples = 0;
+ if (!GetIso14443aAnswerFromTag(receivedAnswer,offset,160,&samples)) return FALSE;
+ if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);
+ if(samples == 0) return FALSE;
+ return Demod.len;
+}
+
int ReaderReceive(uint8_t* receivedAnswer)
{
- int samples = 0;
- if (!GetIso14443aAnswerFromTag(receivedAnswer,160,&samples,0)) return FALSE;
- if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);
- if(samples == 0) return FALSE;
- return Demod.len;
+ return ReaderReceiveOffset(receivedAnswer, 0);
}
-int ReaderReceivePar(uint8_t* receivedAnswer, uint32_t * parptr)
+int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr)
{
- int samples = 0;
- if (!GetIso14443aAnswerFromTag(receivedAnswer,160,&samples,0)) return FALSE;
- if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);
+ int samples = 0;
+ if (!GetIso14443aAnswerFromTag(receivedAnswer,0,160,&samples)) return FALSE;
+ if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);
*parptr = Demod.parityBits;
- if(samples == 0) return FALSE;
- return Demod.len;
+ if(samples == 0) return FALSE;
+ return Demod.len;
}
-/* performs iso14443a anticolision procedure
+/* performs iso14443a anticollision procedure
* fills the uid pointer unless NULL
* fills resp_data unless NULL */
int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, uint32_t* cuid_ptr) {
uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
uint8_t sel_all[] = { 0x93,0x20 };
- uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
+ uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
uint8_t* resp = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); // was 3560 - tied to other size changes
byte_t uid_resp[4];
ReaderTransmitBitsPar(wupa,7,0, NULL);
// Receive the ATQA
if(!ReaderReceive(resp)) return 0;
-// Dbprintf("atqa: %02x %02x",resp[0],resp[1]);
+ // Dbprintf("atqa: %02x %02x",resp[0],resp[1]);
if(p_hi14a_card) {
memcpy(p_hi14a_card->atqa, resp, 2);
ReaderTransmit(sel_all,sizeof(sel_all), NULL);
if (!ReaderReceive(resp)) return 0;
- // First backup the current uid
- memcpy(uid_resp,resp,4);
- uid_resp_len = 4;
+ if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
+ memset(uid_resp, 0, 4);
+ uint16_t uid_resp_bits = 0;
+ uint16_t collision_answer_offset = 0;
+ // anti-collision-loop:
+ while (Demod.collisionPos) {
+ Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
+ for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
+ uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
+ uid_resp[uid_resp_bits & 0xf8] |= UIDbit << (uid_resp_bits % 8);
+ }
+ uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
+ uid_resp_bits++;
+ // construct anticollosion command:
+ sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
+ for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
+ sel_uid[2+i] = uid_resp[i];
+ }
+ collision_answer_offset = uid_resp_bits%8;
+ ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
+ if (!ReaderReceiveOffset(resp, collision_answer_offset)) return 0;
+ }
+ // finally, add the last bits and BCC of the UID
+ for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
+ uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
+ uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
+ }
+
+ } else { // no collision, use the response to SELECT_ALL as current uid
+ memcpy(uid_resp,resp,4);
+ }
+ uid_resp_len = 4;
// Dbprintf("uid: %02x %02x %02x %02x",uid_resp[0],uid_resp[1],uid_resp[2],uid_resp[3]);
- // calculate crypto UID. Always use last 4 Bytes.
+ // calculate crypto UID. Always use last 4 Bytes.
if(cuid_ptr) {
*cuid_ptr = bytes_to_num(uid_resp, 4);
}
// Construct SELECT UID command
- memcpy(sel_uid+2,resp,5);
- AppendCrc14443a(sel_uid,7);
+ sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
+ memcpy(sel_uid+2,uid_resp,4); // the UID
+ sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
+ AppendCrc14443a(sel_uid,7); // calculate and add CRC
ReaderTransmit(sel_uid,sizeof(sel_uid), NULL);
// Receive the SAK
sak = resp[0];
// Test if more parts of the uid are comming
- if ((sak & 0x04) && uid_resp[0] == 0x88) {
+ if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
// Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
// http://www.nxp.com/documents/application_note/AN10927.pdf
memcpy(uid_resp, uid_resp + 1, 3);
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
SpinDelay(7); // iso14443-3 specifies 5ms max.
+ Demod.state = DEMOD_UNSYNCD;
iso14a_timeout = 2048; //default
}
if(param & ISO14A_CONNECT) {
iso14a_clear_trace();
}
+
iso14a_set_tracing(true);
if(param & ISO14A_REQUEST_TRIGGER) {
//keep the card active
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
- // CodeIso14443aBitsAsReaderPar(mf_auth, sizeof(mf_auth)*8, GetParity(mf_auth, sizeof(mf_auth)*8));
-
sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
catch_up_cycles = 0;
Demod.state = DEMOD_UNSYNCD;
}
- if(ManchesterDecoding(data[0] & 0x0F)) {
+ if(ManchesterDecoding(data[0], 0)) {
LED_C_INV();
if (MfSniffLogic(receivedResponse, Demod.len, Demod.parityBits, Demod.bitCount, FALSE)) break;
#define CARD_MEMORY 6000
#define CARD_MEMORY_LEN 4096
-typedef struct nestedVector { uint32_t nt, ks1; } nestedVector;
-
typedef struct {
enum {
DEMOD_UNSYNCD,
- DEMOD_START_OF_COMMUNICATION,
- DEMOD_MANCHESTER_D,
- DEMOD_MANCHESTER_E,
- DEMOD_MANCHESTER_F,
- DEMOD_ERROR_WAIT
- } state;
- int bitCount;
- int posCount;
- int syncBit;
- int parityBits;
- uint16_t shiftReg;
- int buffer;
- int buff;
- int samples;
- int len;
- enum {
- SUB_NONE,
- SUB_FIRST_HALF,
- SUB_SECOND_HALF
- } sub;
- uint8_t *output;
+ DEMOD_HALF_SYNCD,
+ DEMOD_MOD_FIRST_HALF,
+ DEMOD_NOMOD_FIRST_HALF,
+ DEMOD_MANCHESTER_DATA
+ } state;
+ uint16_t bitCount;
+ uint16_t collisionPos;
+ uint16_t syncBit;
+ uint16_t parityBits;
+ uint16_t shiftReg;
+ uint16_t samples;
+ uint16_t len;
+ uint8_t *output;
} tDemod;
typedef struct {
extern byte_t oddparity (const byte_t bt);
-extern uint32_t GetParity(const uint8_t * pbtCmd, int iLen);
-extern void AppendCrc14443a(uint8_t* data, int len);
+extern uint32_t GetParity(const uint8_t *pbtCmd, int iLen);
+extern void AppendCrc14443a(uint8_t *data, int len);
-extern void ReaderTransmit(uint8_t* frame, int len, uint32_t *timing);
-extern void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par, uint32_t *timing);
-extern void ReaderTransmitPar(uint8_t* frame, int len, uint32_t par, uint32_t *timing);
-extern int ReaderReceive(uint8_t* receivedAnswer);
-extern int ReaderReceivePar(uint8_t* receivedAnswer, uint32_t * parptr);
+extern void ReaderTransmit(uint8_t *frame, int len, uint32_t *timing);
+extern void ReaderTransmitBitsPar(uint8_t *frame, int bits, uint32_t par, uint32_t *timing);
+extern void ReaderTransmitPar(uint8_t *frame, int len, uint32_t par, uint32_t *timing);
+extern int ReaderReceive(uint8_t *receivedAnswer);
+extern int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr);
extern void iso14443a_setup();
-extern int iso14_apdu(uint8_t * cmd, size_t cmd_len, void * data);
-extern int iso14443a_select_card(uint8_t * uid_ptr, iso14a_card_select_t * resp_data, uint32_t * cuid_ptr);
+extern int iso14_apdu(uint8_t *cmd, size_t cmd_len, void *data);
+extern int iso14443a_select_card(uint8_t *uid_ptr, iso14a_card_select_t *resp_data, uint32_t *cuid_ptr);
extern void iso14a_set_trigger(bool enable);
extern void iso14a_set_timeout(uint32_t timeout);
char *crc;
crc = "";
if (len > 2) {
- uint8_t b1, b2;
+ uint8_t b1, b2;
for (j = 0; j < (len - 1); j++) {
// gives problems... search for the reason..
/*if(frame[j] == 0xAA) {
crc = (isResponse & (len < 6)) ? "" : " !crc";
} else {
crc = "";
- }
- }
+ }
+ }
} else {
crc = ""; // SHORT
}
PrintAndLog(" +%7d: %s: %s %s %s",
(prev < 0 ? 0 : (timestamp - prev)),
metricString,
- (isResponse ? "TAG" : " "), line, crc);
+ (isResponse ? "TAG " : " "), line, crc);
prev = timestamp;
i += (len + 9);
case 0x00: PrintAndLog("TYPE : NXP MIFARE Ultralight | Ultralight C"); break;
case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
- case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k"); break;
+ case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1"); break;
case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break;
- case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k"); break;
- case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k"); break;
- case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k"); break;
- case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k | JCOP 31/41"); break;
+ case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k SL2"); break;
+ case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k SL2"); break;
+ case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k SL1"); break;
+ case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41"); break;
case 0x24: PrintAndLog("TYPE : NXP MIFARE DESFire | DESFire EV1"); break;
case 0x28: PrintAndLog("TYPE : JCOP31 or JCOP41 v2.3.1"); break;
case 0x38: PrintAndLog("TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break;
fpga.ngd: fpga.ngc
$(DELETE) fpga.ngd
- $(XILINX_TOOLS_PREFIX)ngdbuild -aul -p xc2s30-6vq100 -nt timestamp -uc fpga.ucf fpga.ngc fpga.ngd
+ $(XILINX_TOOLS_PREFIX)ngdbuild -aul -p xc2s30-5-vq100 -nt timestamp -uc fpga.ucf fpga.ngc fpga.ngd
fpga.ncd: fpga.ngd
$(DELETE) fpga.ncd
- $(XILINX_TOOLS_PREFIX)map -p xc2s30-6vq100 fpga.ngd
+ $(XILINX_TOOLS_PREFIX)map -p xc2s30-5-vq100 fpga.ngd
fpga-placed.ncd: fpga.ncd
$(DELETE) fpga-placed.ncd
#PACE: Start of PACE Prohibit Constraints
#PACE: End of Constraints generated by PACE
+
+# definition of Clock nets:
+NET "ck_1356meg" TNM_NET = "clk_net_1356" ;
+NET "ck_1356megb" TNM_NET = "clk_net_1356b" ;
+NET "pck0" TNM_NET = "clk_net_pck0" ;
+NET "spck" TNM_NET = "clk_net_spck" ;
+
+# Timing specs of clock nets:
+TIMEGRP "clk_net_1356_all" = "clk_net_1356" "clk_net_1356b" ;
+TIMESPEC "TS_1356MHz" = PERIOD "clk_net_1356_all" 74 ns HIGH 37 ns ;
+TIMESPEC "TS_24MHz" = PERIOD "clk_net_pck0" 42 ns HIGH 21 ns ;
+TIMESPEC "TS_4MHz" = PERIOD "clk_net_spck" 250 ns HIGH 125 ns ;
+
`include "util.v"
module fpga(
- spcki, miso, mosi, ncs,
- pck0i, ck_1356meg, ck_1356megb,
+ spck, miso, mosi, ncs,
+ pck0, ck_1356meg, ck_1356megb,
pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4,
adc_d, adc_clk, adc_noe,
ssp_frame, ssp_din, ssp_dout, ssp_clk,
cross_hi, cross_lo,
dbg
);
- input spcki, mosi, ncs;
+ input spck, mosi, ncs;
output miso;
- input pck0i, ck_1356meg, ck_1356megb;
+ input pck0, ck_1356meg, ck_1356megb;
output pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4;
input [7:0] adc_d;
output adc_clk, adc_noe;
output dbg;
//assign pck0 = pck0i;
- IBUFG #(.IOSTANDARD("DEFAULT") ) pck0b(
- .O(pck0),
- .I(pck0i)
- );
+// IBUFG #(.IOSTANDARD("DEFAULT") ) pck0b(
+// .O(pck0),
+// .I(pck0i)
+// );
//assign spck = spcki;
- IBUFG #(.IOSTANDARD("DEFAULT") ) spckb(
- .O(spck),
- .I(spcki)
- );
+// IBUFG #(.IOSTANDARD("DEFAULT") ) spckb(
+ // .O(spck),
+ // .I(spcki)
+// );
+
+
//-----------------------------------------------------------------------------
// The SPI receiver. This sets up the configuration word, which the rest of
// the logic looks at to determine how to connect the A/D and the coil
always @(posedge ncs)
begin
case(shift_reg[15:12])
- 4'b0001: conf_word <= shift_reg[7:0];
- 4'b0010: divisor <= shift_reg[7:0];
+ 4'b0001: conf_word <= shift_reg[7:0]; // FPGA_CMD_SET_CONFREG
+ 4'b0010: divisor <= shift_reg[7:0]; // FPGA_CMD_SET_DIVISOR
endcase
end
mux8 mux_ssp_clk (major_mode, ssp_clk, lr_ssp_clk, ls_ssp_clk, ht_ssp_clk, hrxc_ssp_clk, hs_ssp_clk, hisn_ssp_clk, lp_ssp_clk, 1'b0);
mux8 mux_ssp_din (major_mode, ssp_din, lr_ssp_din, ls_ssp_din, ht_ssp_din, hrxc_ssp_din, hs_ssp_din, hisn_ssp_din, lp_ssp_din, 1'b0);
-mux8 mux_ssp_frame (major_mode, ssp_frame, lr_ssp_frame, ls_ssp_frame, ht_ssp_frame, hrxc_ssp_frame, hs_ssp_frame, hisn_ssp_frame, lp_ssp_frame, 1'b0);
+mux8 mux_ssp_frame (major_mode, ssp_frame, lr_ssp_frame, ls_ssp_frame, ht_ssp_frame, hrxc_ssp_frame, hs_ssp_frame, hisn_ssp_frame, lp_ssp_frame, 1'b0);
mux8 mux_pwr_oe1 (major_mode, pwr_oe1, lr_pwr_oe1, ls_pwr_oe1, ht_pwr_oe1, hrxc_pwr_oe1, hs_pwr_oe1, hisn_pwr_oe1, lp_pwr_oe1, 1'b0);
mux8 mux_pwr_oe2 (major_mode, pwr_oe2, lr_pwr_oe2, ls_pwr_oe2, ht_pwr_oe2, hrxc_pwr_oe2, hs_pwr_oe2, hisn_pwr_oe2, lp_pwr_oe2, 1'b0);
mux8 mux_pwr_oe3 (major_mode, pwr_oe3, lr_pwr_oe3, ls_pwr_oe3, ht_pwr_oe3, hrxc_pwr_oe3, hs_pwr_oe3, hisn_pwr_oe3, lp_pwr_oe3, 1'b0);
mux8 mux_pwr_lo (major_mode, pwr_lo, lr_pwr_lo, ls_pwr_lo, ht_pwr_lo, hrxc_pwr_lo, hs_pwr_lo, hisn_pwr_lo, lp_pwr_lo, 1'b0);
mux8 mux_pwr_hi (major_mode, pwr_hi, lr_pwr_hi, ls_pwr_hi, ht_pwr_hi, hrxc_pwr_hi, hs_pwr_hi, hisn_pwr_hi, lp_pwr_hi, 1'b0);
mux8 mux_adc_clk (major_mode, adc_clk, lr_adc_clk, ls_adc_clk, ht_adc_clk, hrxc_adc_clk, hs_adc_clk, hisn_adc_clk, lp_adc_clk, 1'b0);
-mux8 mux_dbg (major_mode, dbg, lr_dbg, ls_dbg, ht_dbg, hrxc_dbg, hs_dbg, hisn_dbg, lp_dbg, 1'b0);
+mux8 mux_dbg (major_mode, dbg, lr_dbg, ls_dbg, ht_dbg, hrxc_dbg, hs_dbg, hisn_dbg, lp_dbg, 1'b0);
// In all modes, let the ADC's outputs be enabled.
assign adc_noe = 1'b0;
reg deep_modulation;
always @(negedge adc_clk)
begin
- if(& adc_d[7:6]) after_hysteresis <= 1'b1;
- else if(~(| adc_d[7:4])) after_hysteresis <= 1'b0;
+ if(& adc_d[7:6]) after_hysteresis <= 1'b1; // if adc_d >= 196
+ else if(~(| adc_d[7:4])) after_hysteresis <= 1'b0; // if adc_d <= 15
if(~(| adc_d[7:0]))
begin
reg bit1, bit2, bit3;
reg [3:0] count_ones;
reg [3:0] count_zeros;
-wire [7:0] avg;
-reg [7:0] lavg;
-reg signed [12:0] step1;
-reg signed [12:0] step2;
-reg [7:0] stepsize;
+// wire [7:0] avg;
+// reg [7:0] lavg;
+// reg signed [12:0] step1;
+// reg signed [12:0] step2;
+// reg [7:0] stepsize;
+reg [7:0] rx_mod_edge_threshold;
reg curbit;
-reg [12:0] average;
-wire signed [9:0] dif;
+// reg [12:0] average;
+// wire signed [9:0] dif;
+
+// storage for two previous samples:
+reg [7:0] adc_d_1;
+reg [7:0] adc_d_2;
+reg [7:0] adc_d_3;
+reg [7:0] adc_d_4;
+
+// the filtered signal (filter performs noise reduction and edge detection)
+// (gaussian derivative)
+wire signed [10:0] adc_d_filtered;
+assign adc_d_filtered = (adc_d_4 << 1) + adc_d_3 - adc_d_1 - (adc_d << 1);
+
+// Registers to store steepest edges detected:
+reg [7:0] rx_mod_falling_edge_max;
+reg [7:0] rx_mod_rising_edge_max;
// A register to send the results to the arm
reg signed [7:0] to_arm;
-assign avg[7:0] = average[11:4];
-assign dif = lavg - avg;
reg bit_to_arm;
reg fdt_indicator, fdt_elapsed;
// ADC data appears on the rising edge, so sample it on the falling edge
always @(negedge adc_clk)
begin
-
- // last bit = 0 then fdt = 1172, in case of 0x26 (7-bit command, LSB first!)
- // last bit = 1 then fdt = 1236, in case of 0x52 (7-bit command, LSB first!)
- if(fdt_counter == 11'd740) fdt_indicator = 1'b1;
+ // ------------------------------------------------------------------------------------------------------------------------------------------------------------------
+ // relevant for TAGSIM_MOD only. Timing of Tag's answer to a command received from a reader
+ // ISO14443-3 specifies:
+ // fdt = 1172, if last bit was 0.
+ // fdt = 1236, if last bit was 1.
+ // the FPGA takes care for the 1172 delay. To achieve the additional 1236-1172=64 ticks delay, the ARM must send an additional correction bit (before the start bit).
+ // The correction bit will be coded as 00010000, i.e. it adds 4 bits to the transmission stream, causing the required delay.
+ if(fdt_counter == 11'd740) fdt_indicator = 1'b1; // fdt_indicator is true for 740 <= fdt_counter <= 1148. Ready to buffer data. (?)
+ // Shouldn' this be 1236 - 720 = 516? (The mod_sig_buf can buffer 46 data bits,
+ // i.e. a maximum delay of 46 * 16 = 720 adc_clk ticks)
- if(fdt_counter == 11'd1148)
+ if(fdt_counter == 11'd1148) // additional 16 (+ eventual n*128) adc_clk_ticks delay will be added by the mod_sig_buf below
+ // the remaining 8 ticks delay comes from the 8 ticks timing difference between reseting fdt_counter and the mod_sig_buf clock.
begin
if(fdt_elapsed)
begin
- if(negedge_cnt[3:0] == mod_sig_flip[3:0]) mod_sig_coil <= mod_sig;
+ if(negedge_cnt[3:0] == mod_sig_flip[3:0]) mod_sig_coil <= mod_sig; // start modulating (if mod_sig is already set)
end
else
begin
- mod_sig_flip[3:0] <= negedge_cnt[3:0];
- mod_sig_coil <= mod_sig;
+ mod_sig_flip[3:0] <= negedge_cnt[3:0]; // exact timing of modulation
+ mod_sig_coil <= mod_sig; // modulate (if mod_sig is already set)
fdt_elapsed = 1'b1;
fdt_indicator = 1'b0;
- if(~(| mod_sig_ptr[5:0])) mod_sig_ptr <= 6'b001001;
- else temp_buffer_reset = 1'b1; // fix position of the buffer pointer
+ if(~(| mod_sig_ptr[5:0])) mod_sig_ptr <= 6'b001001; // didn't receive a 1 yet. Delay next 1 by n*128 ticks.
+ else temp_buffer_reset = 1'b1; // else fix the buffer size at current position
end
end
else
begin
- fdt_counter <= fdt_counter + 1;
+ fdt_counter <= fdt_counter + 1; // Count until 1148
end
- if(& negedge_cnt[3:0])
+
+ //-------------------------------------------------------------------------------------------------------------------------------------------
+ // Relevant for READER_LISTEN only
+ // look for steepest falling and rising edges:
+ if (adc_d_filtered > 0)
+ begin
+ if (adc_d_filtered > rx_mod_falling_edge_max)
+ rx_mod_falling_edge_max <= adc_d_filtered;
+ end
+ else
+ begin
+ if (-adc_d_filtered > rx_mod_rising_edge_max)
+ rx_mod_rising_edge_max <= -adc_d_filtered;
+ end
+
+ // store previous samples for filtering and edge detection:
+ adc_d_4 <= adc_d_3;
+ adc_d_3 <= adc_d_2;
+ adc_d_2 <= adc_d_1;
+ adc_d_1 <= adc_d;
+
+
+
+ if(& negedge_cnt[3:0]) // == 0xf == 15
begin
- // When there is a dip in the signal and not in reader mode
+ // Relevant for TAGSIM_MOD only (timing Tag's answer. See above)
+ // When there is a dip in the signal and not in (READER_MOD, READER_LISTEN, TAGSIM_MOD)
if(~after_hysteresis && mod_sig_buf_empty && ~((mod_type == 3'b100) || (mod_type == 3'b011) || (mod_type == 3'b010))) // last condition to prevent reset
begin
fdt_counter <= 11'd0;
mod_sig_ptr <= 6'b000000;
end
- lavg <= avg;
-
- if(stepsize<16) stepsize = 8'd16;
-
- if(dif>0)
- begin
- step1 = dif*3;
- step2 = stepsize*2; // 3:2
- if(step1>step2)
- begin
- curbit = 1'b0;
- stepsize = dif;
- end
- end
- else
- begin
- step1 = dif*3;
- step1 = -step1;
- step2 = stepsize*2;
- if(step1>step2)
- begin
- curbit = 1'b1;
- stepsize = -dif;
- end
- end
-
- if(curbit)
- begin
- count_zeros <= 4'd0;
- if(& count_ones[3:2])
- begin
- curbit = 1'b0; // suppressed signal
- stepsize = 8'd24; // just a fine number
- end
+ // Relevant for READER_LISTEN only
+ // detect modulation signal: if modulating, there must be a falling and a rising edge ... and vice versa
+ if (rx_mod_falling_edge_max > 6 && rx_mod_rising_edge_max > 6)
+ curbit = 1'b1; // modulation
else
- begin
- count_ones <= count_ones + 1;
- end
- end
- else
- begin
- count_ones <= 4'd0;
- if(& count_zeros[3:0])
- begin
- stepsize = 8'd24;
- end
- else
- begin
- count_zeros <= count_zeros + 1;
- end
- end
-
+ curbit = 1'b0; // no modulation
+
+ // prepare next edge detection:
+ rx_mod_rising_edge_max <= 0;
+ rx_mod_falling_edge_max <= 0;
+
+
// What do we communicate to the ARM
- if(mod_type == 3'b001) sendbit = after_hysteresis;
- else if(mod_type == 3'b010)
+ if(mod_type == 3'b001) sendbit = after_hysteresis; // TAGSIM_LISTEN
+ else if(mod_type == 3'b010) // TAGSIM_MOD
begin
if(fdt_counter > 11'd772) sendbit = mod_sig_coil;
else sendbit = fdt_indicator;
end
- else if(mod_type == 3'b011) sendbit = curbit;
- else sendbit = 1'b0;
+ else if(mod_type == 3'b011) sendbit = curbit; // READER_LISTEN
+ else sendbit = 1'b0; // READER_MOD, SNIFFER
end
- if(~(| negedge_cnt[3:0])) average <= adc_d;
- else average <= average + adc_d;
-
- if(negedge_cnt == 7'd63)
+ //------------------------------------------------------------------------------------------------------------------------------------------
+ // Relevant for SNIFFER mode only. Prepare communication to ARM.
+ if(negedge_cnt == 7'd63)
begin
if(deep_modulation)
begin
negedge_cnt <= 0;
- end
+ end
else
begin
negedge_cnt <= negedge_cnt + 1;
bit3 <= curbit;
end
-
- if(mod_type != 3'b000)
+ //--------------------------------------------------------------------------------------------------------------------------------------------------------------
+ // Relevant in TAGSIM_MOD only. Delay-Line to buffer data and send it at the correct time
+ // Note: Data in READER_MOD is fed through this delay line as well.
+ if(mod_type != 3'b000) // != SNIFFER
begin
- if(negedge_cnt[3:0] == 4'b1000)
+ if(negedge_cnt[3:0] == 4'b1000) // == 0x8
begin
- // The modulation signal of the tag
- mod_sig_buf[47:0] <= {mod_sig_buf[46:1], ssp_dout, 1'b0};
- if((ssp_dout || (| mod_sig_ptr[5:0])) && ~fdt_elapsed)
- if(mod_sig_ptr == 6'b101110)
+ // The modulation signal of the tag. The delay line is only relevant for TAGSIM_MOD, but used in other modes as well.
+ // Note: this means that even in READER_MOD, there will be an arbitrary delay depending on the time of a previous reset of fdt_counter and the time and
+ // content of the next bit to be transmitted.
+ mod_sig_buf[47:0] <= {mod_sig_buf[46:1], ssp_dout, 1'b0}; // shift in new data starting at mod_sig_buf[1]. mod_sig_buf[0] = 0 always.
+ if((ssp_dout || (| mod_sig_ptr[5:0])) && ~fdt_elapsed) // buffer a 1 (and all subsequent data) until fdt_counter = 1148 adc_clk ticks.
+ if(mod_sig_ptr == 6'b101110) // buffer overflow at 46 - this would mean data loss
begin
mod_sig_ptr <= 6'b000000;
end
- else mod_sig_ptr <= mod_sig_ptr + 1;
- else if(fdt_elapsed && ~temp_buffer_reset)
+ else mod_sig_ptr <= mod_sig_ptr + 1; // increase buffer (= increase delay by 16 adc_clk ticks). ptr always points to first 1.
+ else if(fdt_elapsed && ~temp_buffer_reset)
+ // fdt_elapsed. If we didn't receive a 1 yet, ptr will be at 9 and not yet fixed. Otherwise temp_buffer_reset will be 1 already.
begin
- if(ssp_dout) temp_buffer_reset = 1'b1;
- if(mod_sig_ptr == 6'b000010) mod_sig_ptr <= 6'b001001;
- else mod_sig_ptr <= mod_sig_ptr - 1;
+ // wait for the next 1 after fdt_elapsed before fixing the delay and starting modulation. This ensures that the response can only happen
+ // at intervals of 8 * 16 = 128 adc_clk ticks intervals (as defined in ISO14443-3)
+ if(ssp_dout) temp_buffer_reset = 1'b1;
+ if(mod_sig_ptr == 6'b000010) mod_sig_ptr <= 6'b001001; // still nothing received, need to go for the next interval
+ else mod_sig_ptr <= mod_sig_ptr - 1; // decrease buffer.
end
else
+ // mod_sig_ptr and therefore the delay is now fixed until fdt_counter is reset (this can happen in SNIFFER and TAGSIM_LISTEN mode only. Note that SNIFFER
+ // mode (3'b000) is the default and is active in FPGA_MAJOR_MODE_OFF if no other minor mode is explicitly requested.
begin
- // side effect: when ptr = 1 it will cancel the first 1 of every block of ones
+ // don't modulate with the correction bit (which is sent as 00010000, all other bits will come with at least 2 consecutive 1s)
+ // side effect: when ptr = 1 it will cancel the first 1 of every block of ones. Note: this would only be the case if we received a 1 just before fdt_elapsed.
if(~mod_sig_buf[mod_sig_ptr-1] && ~mod_sig_buf[mod_sig_ptr+1]) mod_sig = 1'b0;
- else mod_sig = mod_sig_buf[mod_sig_ptr] & fdt_elapsed; // & fdt_elapsed was for direct relay to oe4
+ // finally, do the modulation:
+ else mod_sig = mod_sig_buf[mod_sig_ptr] & fdt_elapsed;
end
end
end
- // SSP Clock and data
+ //-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
+ // Communication to ARM (SSP Clock and data)
+ // SNIFFER mode (ssp_clk = adc_clk / 8, ssp_frame clock = adc_clk / 64)):
if(mod_type == 3'b000)
begin
if(negedge_cnt[2:0] == 3'b100)
bit_to_arm = to_arm[7];
end
else
+ //-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
+ // Communication to ARM (SSP Clock and data)
+ // all other modes (ssp_clk = adc_clk / 16, ssp_frame clock = adc_clk / 128):
begin
if(negedge_cnt[3:0] == 4'b1000) ssp_clk <= 1'b0;
assign ssp_din = bit_to_arm;
-// Modulating carrier frequency is fc/16
+
+// Modulating carrier (adc_clk/16, for TAGSIM_MOD only). Will be 0 for other modes.
wire modulating_carrier;
-assign modulating_carrier = (mod_sig_coil & negedge_cnt[3] & (mod_type == 3'b010));
-assign pwr_hi = (ck_1356megb & (((mod_type == 3'b100) & ~mod_sig_coil) || (mod_type == 3'b011)));
+assign modulating_carrier = (mod_sig_coil & negedge_cnt[3] & (mod_type == 3'b010)); // in TAGSIM_MOD only. Otherwise always 0.
+
+// for READER_MOD only: drop carrier for mod_sig_coil==1 (pause), READER_LISTEN: carrier always on, others: carrier always off
+assign pwr_hi = (ck_1356megb & (((mod_type == 3'b100) & ~mod_sig_coil) || (mod_type == 3'b011)));
-// This one is all LF, so doesn't matter
-//assign pwr_oe2 = modulating_carrier;
-assign pwr_oe2 = 1'b0;
-// Toggle only one of these, since we are already producing much deeper
-// modulation than a real tag would.
-//assign pwr_oe1 = modulating_carrier;
+// Enable HF antenna drivers:
assign pwr_oe1 = 1'b0;
+assign pwr_oe3 = 1'b0;
+
+// TAGSIM_MOD: short circuit antenna with different resistances (modulated by modulating_carrier)
+// for pwr_oe4 = 1 (tristate): antenna load = 10k || 33 = 32,9 Ohms
+// for pwr_oe4 = 0 (active): antenna load = 10k || 33 || 33 = 16,5 Ohms
assign pwr_oe4 = modulating_carrier;
-//assign pwr_oe4 = 1'b0;
-// This one is always on, so that we can watch the carrier.
-//assign pwr_oe3 = modulating_carrier;
-assign pwr_oe3 = 1'b0;
+// This is all LF, so doesn't matter.
+assign pwr_oe2 = 1'b0;
+assign pwr_lo = 1'b0;
assign dbg = negedge_cnt[3];
-// Unused.
-assign pwr_lo = 1'b0;
-
endmodule
-run -ifn fpga.v -ifmt Verilog -ofn fpga.ngc -ofmt NGC -p xc2s30-6vq100 -opt_mode Speed -opt_level 1 -ent fpga
+run -ifn fpga.v -ifmt Verilog -ofn fpga.ngc -ofmt NGC -p xc2s30-5-vq100 -opt_mode Speed -opt_level 1 -ent fpga
projects / proxmark3-svn / commitdiff