From b816886806bc301aad60573e9ba6c35c1bfe4ea5 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 7 Oct 2016 19:11:38 +0200
Subject: [PATCH] FIX: one send command bug fixed. Turns out that uint16_t is
too small for 21/23bits size. Who figured?
---
armsrc/legicrf.c | 112 ++++++++++++++++++++++----------------------
armsrc/legicrf.h | 2 +-
client/cmdhflegic.c | 2 +-
3 files changed, 59 insertions(+), 57 deletions(-)
diff --git a/armsrc/legicrf.c b/armsrc/legicrf.c
index c14b92c8..6a1c3bae 100644
--- a/armsrc/legicrf.c
+++ b/armsrc/legicrf.c
@@ -92,11 +92,7 @@ static void setup_timer(void) {
# define OPEN_COIL HIGH(GPIO_SSC_DOUT);
#endif
#ifndef LINE_IN
-# define LINE_IN \
- do { \
- AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; \
- AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; \
- } while (0);
+# define LINE_IN AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
#endif
// Pause pulse, off in 20us / 30ticks,
// ONE / ZERO bit pulse,
@@ -205,8 +201,7 @@ void frame_send_tag(uint16_t response, uint8_t bits) {
*/
void frame_sendAsReader(uint32_t data, uint8_t bits){
- uint32_t starttime = GET_TICKS, send = 0;
- uint16_t mask = 1;
+ uint32_t starttime = GET_TICKS, send = 0, mask = 1;
// xor lsfr onto data.
send = data ^ legic_prng_get_bits(bits);
@@ -222,7 +217,7 @@ void frame_sendAsReader(uint32_t data, uint8_t bits){
COIL_PULSE(0);
// log
- uint8_t cmdbytes[] = {bits, BYTEx(data, 0), BYTEx(data, 1), BYTEx(send, 0), BYTEx(send, 1)};
+ uint8_t cmdbytes[] = {cmd_sz, BYTEx(cmd, 0), BYTEx(cmd, 1), BYTEx(cmd, 2), BYTEx(send, 0), BYTEx(send, 1) };
LogTrace(cmdbytes, sizeof(cmdbytes), starttime, GET_TICKS, NULL, TRUE);
}
@@ -258,9 +253,6 @@ static void frame_receiveAsReader(struct legic_frame * const f, uint8_t bits) {
frame_clean(f);
- /* Bitbang the receiver */
- LINE_IN;
-
// calibrate the prng.
legic_prng_forward(2);
data = legic_prng_get_bits(bits);
@@ -348,10 +340,11 @@ static void LegicCommonInit(void) {
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
/* Bitbang the transmitter */
- LOW(GPIO_SSC_DOUT);
+ SHORT_COIL;
AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
-
+ AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
+
// reserve a cardmem, meaning we can use the tracelog function in bigbuff easier.
cardmem = BigBuf_get_EM_addr();
memset(cardmem, 0x00, LEGIC_CARD_MEMSIZE);
@@ -365,7 +358,7 @@ static void LegicCommonInit(void) {
// Switch off carrier, make sure tag is reset
static void switch_off_tag_rwd(void) {
- LOW(GPIO_SSC_DOUT);
+ SHORT_COIL;
WaitUS(20);
WDT_HIT();
}
@@ -396,7 +389,7 @@ int legic_read_byte( uint16_t index, uint8_t cmd_sz) {
calcCrc = legic4Crc(LEGIC_READ, index, byte, cmd_sz);
if( calcCrc != crc ) {
- Dbprintf("!!! crc mismatch: expected %x but got %x !!!", calcCrc, crc);
+ Dbprintf("!!! crc mismatch: %x != %x !!!", calcCrc, crc);
return -1;
}
@@ -409,66 +402,77 @@ int legic_read_byte( uint16_t index, uint8_t cmd_sz) {
* - wait until the tag sends back an ACK ('1' bit unencrypted)
* - forward the prng based on the timing
*/
-int legic_write_byte(uint16_t index, uint8_t byte, uint8_t addr_sz) {
+bool legic_write_byte(uint16_t index, uint8_t byte, uint8_t addr_sz) {
+
+ bool isOK = false;
+ uint8_t i = 80, edges = 0;
+ uint8_t cmd_sz = addr_sz+1+8+4; //crc+data+cmd;
+ uint32_t steps = 0, next_bit_at, start, crc, old_level = 0;
- // crc
+ /*
crc_clear(&legic_crc);
- crc_update(&legic_crc, 0, 1); /* CMD_WRITE */
+ crc_update(&legic_crc, 0, 1); // CMD_WRITE
crc_update(&legic_crc, index, addr_sz);
crc_update(&legic_crc, byte, 8);
uint32_t crc = crc_finish(&legic_crc);
- /*
- uint32_t crc2 = legic4Crc(LEGIC_WRITE, index, byte, addr_sz+1);
- if ( crc != crc2 ) {
- Dbprintf("crc is missmatch");
- return 1;
- }
*/
+ crc = legic4Crc(LEGIC_WRITE, index, byte, addr_sz+1);
+
// send write command
- uint32_t cmd = ((crc <<(addr_sz+1+8)) //CRC
- |(byte <<(addr_sz+1)) //Data
- |(index <<1) //index
- | LEGIC_WRITE); //CMD = Write
-
- uint32_t cmd_sz = addr_sz+1+8+4; //crc+data+cmd
-
- legic_prng_forward(2);
+ uint32_t cmd;
+ cmd = ((crc & 0xF ) << (addr_sz+1+8)); // CRC
+ cmd |= byte << (addr_sz+1); // Data
+ cmd |= ((index & 0xFF) << 1); // index
+ cmd |= LEGIC_WRITE; // CMD
+
+ /* Bitbang the response */
+ SHORT_COIL;
+ AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
WaitTicks(330);
frame_sendAsReader(cmd, cmd_sz);
-
- /* Bitbang the receiver */
+
LINE_IN;
- int t, old_level = 0, edges = 0;
- int next_bit_at = 0;
+ start = GET_TICKS;
- // ACK 3.6ms = 3600us * 1.5 = 5400ticks.
- WaitTicks(5300);
- ResetTicks();
+ // ACK, - one single "1" bit after 3.6ms
+ // 3.6ms = 3600us * 1.5 = 5400ticks.
+ WaitTicks(5000);
+ //WaitTicks(330);
- for( t = 0; t < 80; ++t) {
+ next_bit_at = GET_TICKS + TAG_BIT_PERIOD;
+
+ while ( i-- ) {
+ WDT_HIT();
edges = 0;
- next_bit_at += TAG_BIT_PERIOD;
while ( GET_TICKS < next_bit_at) {
+
volatile uint32_t level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
- if(level != old_level)
- edges++;
+
+ if (level != old_level)
+ ++edges;
old_level = level;
}
-
- /* expected are 42 edges (ONE) */
+
+ next_bit_at += TAG_BIT_PERIOD;
+
+ // We expect 42 edges (ONE)
if(edges > 20 ) {
-
- uint32_t c = (GET_TICKS / TAG_BIT_PERIOD);
- legic_prng_forward(c);
- return 0;
+ steps = ( (GET_TICKS - start) / TAG_BIT_PERIOD);
+ legic_prng_forward(steps);
+ isOK = true;
+ goto OUT;
}
}
- return -1;
+OUT: ;
+ // log
+ uint8_t cmdbytes[] = {cmd_sz, isOK, BYTEx(steps, 0), BYTEx(steps, 1) };
+ LogTrace(cmdbytes, sizeof(cmdbytes), start, GET_TICKS, NULL, FALSE);
+ return isOK;
}
int LegicRfReader(uint16_t offset, uint16_t len, uint8_t iv) {
@@ -534,17 +538,15 @@ void LegicRfWriter(uint16_t offset, uint16_t len, uint8_t iv, uint8_t *data) {
LED_B_ON();
while( len > 0 ) {
-
- int r = legic_write_byte( len + offset + LOWERLIMIT, data[len], card.addrsize);
- if ( r == -1 ) {
- Dbprintf("operation aborted @ 0x%03.3x", len);
+
+ if ( !legic_write_byte( len + offset + LOWERLIMIT, data[len-1], card.addrsize) ) {
+ Dbprintf("operation failed @ 0x%03.3x", len-1);
isOK = 0;
goto OUT;
}
--len;
WDT_HIT();
}
-
OUT:
cmd_send(CMD_ACK, isOK, 0,0,0,0);
switch_off_tag_rwd();
diff --git a/armsrc/legicrf.h b/armsrc/legicrf.h
index 8a51ebcd..6b2f8560 100644
--- a/armsrc/legicrf.h
+++ b/armsrc/legicrf.h
@@ -30,7 +30,7 @@ void frame_send_tag(uint16_t response, uint8_t bits);
void frame_sendAsReader(uint32_t data, uint8_t bits);
int legic_read_byte( uint16_t index, uint8_t cmd_sz);
-int legic_write_byte(uint16_t index, uint8_t byte, uint8_t addr_sz);
+bool legic_write_byte(uint16_t index, uint8_t byte, uint8_t addr_sz);
int legic_select_card(legic_card_select_t *p_card);
int legic_select_card_iv(legic_card_select_t *p_card, uint8_t iv);
diff --git a/client/cmdhflegic.c b/client/cmdhflegic.c
index 50c2976f..88994243 100644
--- a/client/cmdhflegic.c
+++ b/client/cmdhflegic.c
@@ -732,7 +732,7 @@ int CmdLegicRfWrite(const char *Cmd) {
clearCommandBuffer();
SendCommand(&c);
UsbCommand resp;
- if (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
+ if (!WaitForResponseTimeout(CMD_ACK, &resp, 4000)) {
PrintAndLog("command execution time out");
return 1;
}
--
2.39.5