1 //-----------------------------------------------------------------------------
2 // Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
4 // This program is free software: you can redistribute it and/or modify
5 // it under the terms of the GNU General Public License as published by
6 // the Free Software Foundation, either version 3 of the License, or
7 // (at your option) any later version.
9 // This program is distributed in the hope that it will be useful,
10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 // GNU General Public License for more details.
14 // See LICENSE.txt for the text of the license.
15 //-----------------------------------------------------------------------------
16 // with optional support for iso15 2sc mode slected with compiler define WITH_HF_15
21 input [1:0] subcarrier_frequency
,
22 input [3:0] minor_mode
,
38 assign adc_clk
= ck_1356meg
; // sample frequency is 13,56 MHz
40 // When we're a reader, we just need to do the BPSK demod; but when we're an
41 // eavesdropper, we also need to pick out the commands sent by the reader,
42 // using AM. Do this the same way that we do it for the simulated tag.
43 reg after_hysteresis
, after_hysteresis_prev
, after_hysteresis_prev_prev
;
44 reg [11:0] has_been_low_for
;
45 always @(negedge adc_clk
)
47 `ifdef WITH_HF_15_LOWSIGNAL
48 if (& adc_d
[7:4]) after_hysteresis
<= 1'b1;
49 else if (~(| adc_d
[7:6])) after_hysteresis
<= 1'b0;
51 if (& adc_d
[7:0]) after_hysteresis
<= 1'b1;
52 else if (~(| adc_d
[7:0])) after_hysteresis
<= 1'b0;
57 has_been_low_for
<= 12'd0;
61 if (has_been_low_for
== 12'd4095)
63 has_been_low_for
<= 12'd0;
64 after_hysteresis
<= 1'b1;
67 has_been_low_for
<= has_been_low_for
+ 1;
71 // Let us report a correlation every 64 samples. I.e.
72 // one Q/I pair after 4 subcarrier cycles for the 848kHz subcarrier,
73 // one Q/I pair after 2 subcarrier cycles for the 424kHz subcarriers,
74 // one Q/I pair for each subcarrier cyle for the 212kHz subcarrier.
75 // We need a 6-bit counter for the timing.
77 always @(negedge adc_clk
)
78 corr_i_cnt
<= corr_i_cnt
+ 1;
81 reg [1:0] fskout
= 2'd0;
85 reg [127:0] avg128
= 128'd0;
86 reg [7:0] diff16
= 8'd0;
87 reg [7:0] diff28
= 8'd0;
88 reg [7:0] diff32
= 8'd0;
90 reg [11:0] match16
= 12'd0;
91 reg [11:0] match32
= 12'd0;
92 reg [11:0] match28
= 12'd0;
94 always @(negedge adc_clk
)
96 if (corr_i_cnt
[0] == 1'b0) // every 2 clock
100 avg
= avg
+ adc_d
[7:1];
101 if (corr_i_cnt
[0] == 1'b1) // every 2 clock
103 if (avg
> avg128
[63:56])
104 diff16
= avg
- avg128
[63:56];
106 diff16
= avg128
[63:56] - avg
;
108 if (avg
> avg128
[111:104])
109 diff28
= avg
- avg128
[111:104];
111 diff28
= avg128
[111:104] - avg
;
113 if (avg
> avg128
[127:120])
114 diff32
= avg
- avg128
[127:120];
116 diff32
= avg128
[127:120] - avg
;
118 avg128
[127:8] = avg128
[119:0];
121 if (corr_i_cnt
[4:1] == 4'b0000) // every 32 clock (8*4)
129 match16
= match16
+ diff16
;
130 match28
= match28
+ diff28
;
131 match32
= match32
+ diff32
;
133 if (corr_i_cnt
[4:1] == 4'b1111) // every 32 clock (8*4)
135 last0
= (fskout
== 2'b0);
136 if (match16
< 12'd64 && last0
)
137 fskout
= 2'b00; // not yet started
138 else if ((match16 | match28 | match32
) == 12'b0)
139 fskout
= 2'b00; // signal likely ended
140 else if (((match16
<= match28
+ 12'd16) && (match16
<= match32
+ 12'd16)) ||
141 (match28
<= 12'd16 && match32
<= 12'd16))
144 fskout
= 2'b11; // 16 match better than 28 or 32 but already started
148 if (match28
< match32
)
150 diff28
= match32
- match28
;
151 diff16
= match16
- match28
;
152 if (diff28
*2 > diff16
)
159 else //if (match32 <= match28)
161 diff32
= match28
- match32
;
162 diff16
= match16
- match32
;
163 if (diff32
*2 > diff16
)
178 // A couple of registers in which to accumulate the correlations. From the 64 samples
179 // we would add at most 32 times the difference between unmodulated and modulated signal. It should
180 // be safe to assume that a tag will not be able to modulate the carrier signal by more than 25%.
181 // 32 * 255 * 0,25 = 2040, which can be held in 11 bits. Add 1 bit for sign.
182 // Temporary we might need more bits. For the 212kHz subcarrier we could possible add 32 times the
183 // maximum signal value before a first subtraction would occur. 32 * 255 = 8160 can be held in 13 bits.
184 // Add one bit for sign -> need 14 bit registers but final result will fit into 12 bits.
185 reg signed
[13:0] corr_i_accum
;
186 reg signed
[13:0] corr_q_accum
;
187 // we will report maximum 8 significant bits
188 reg signed
[7:0] corr_i_out
;
189 reg signed
[7:0] corr_q_out
;
191 // the amplitude of the subcarrier is sqrt(ci^2 + cq^2).
192 // approximate by amplitude = max(|ci|,|cq|) + 1/2*min(|ci|,|cq|)
193 reg [13:0] corr_amplitude
, abs_ci
, abs_cq
, max_ci_cq
;
194 reg [12:0] min_ci_cq_2
; // min_ci_cq / 2
198 if (corr_i_accum
[13] == 1'b0)
199 abs_ci
<= corr_i_accum
;
201 abs_ci
<= -corr_i_accum
;
203 if (corr_q_accum
[13] == 1'b0)
204 abs_cq
<= corr_q_accum
;
206 abs_cq
<= -corr_q_accum
;
211 min_ci_cq_2
<= abs_cq
/ 2;
216 min_ci_cq_2
<= abs_ci
/ 2;
219 corr_amplitude
<= max_ci_cq
+ min_ci_cq_2
;
223 // The subcarrier reference signals
229 if (subcarrier_frequency
== `FPGA_HF_READER_SUBCARRIER_848_KHZ)
231 subcarrier_I
= ~corr_i_cnt
[3];
232 subcarrier_Q
= ~(corr_i_cnt
[3] ^ corr_i_cnt
[2]);
234 else if (subcarrier_frequency
== `FPGA_HF_READER_SUBCARRIER_212_KHZ)
236 subcarrier_I
= ~corr_i_cnt
[5];
237 subcarrier_Q
= ~(corr_i_cnt
[5] ^ corr_i_cnt
[4]);
241 subcarrier_I
= ~corr_i_cnt
[4];
242 subcarrier_Q
= ~(corr_i_cnt
[4] ^ corr_i_cnt
[3]);
246 // ADC data appears on the rising edge, so sample it on the falling edge
247 always @(negedge adc_clk
)
249 // These are the correlators: we correlate against in-phase and quadrature
250 // versions of our reference signal, and keep the (signed) results or the
251 // resulting amplitude to send out later over the SSP.
252 if (corr_i_cnt
== 6'd0)
254 if (minor_mode
== `FPGA_HF_READER_MODE_SNIFF_AMPLITUDE)
257 if (subcarrier_frequency
== `FPGA_HF_READER_2SUBCARRIERS_424_484_KHZ)
259 // send amplitude + 2 bits fsk (2sc) signal + 2 bits reader signal
260 corr_i_out
<= corr_amplitude
[13:6];
261 corr_q_out
<= {corr_amplitude
[5:2], fskout
, after_hysteresis_prev_prev
, after_hysteresis_prev
};
266 // send amplitude plus 2 bits reader signal
267 corr_i_out
<= corr_amplitude
[13:6];
268 corr_q_out
<= {corr_amplitude
[5:0], after_hysteresis_prev_prev
, after_hysteresis_prev
};
271 else if (minor_mode
== `FPGA_HF_READER_MODE_SNIFF_IQ)
273 // Send 7 most significant bits of in phase tag signal (signed), plus 1 bit reader signal
274 if (corr_i_accum
[13:11] == 3'b000 || corr_i_accum
[13:11] == 3'b111)
275 corr_i_out
<= {corr_i_accum
[11:5], after_hysteresis_prev_prev
};
276 else // truncate to maximum value
277 if (corr_i_accum
[13] == 1'b0)
278 corr_i_out
<= {7'b0111111, after_hysteresis_prev_prev
};
280 corr_i_out
<= {7'b1000000, after_hysteresis_prev_prev
};
282 // Send 7 most significant bits of quadrature phase tag signal (signed), plus 1 bit reader signal
283 if (corr_q_accum
[13:11] == 3'b000 || corr_q_accum
[13:11] == 3'b111)
284 corr_q_out
<= {corr_q_accum
[11:5], after_hysteresis_prev
};
285 else // truncate to maximum value
286 if (corr_q_accum
[13] == 1'b0)
287 corr_q_out
<= {7'b0111111, after_hysteresis_prev
};
289 corr_q_out
<= {7'b1000000, after_hysteresis_prev
};
291 else if (minor_mode
== `FPGA_HF_READER_MODE_RECEIVE_AMPLITUDE)
294 if (subcarrier_frequency
== `FPGA_HF_READER_2SUBCARRIERS_424_484_KHZ)
296 // send 2 bits fsk (2sc) signal + amplitude
297 corr_i_out
<= {fskout
, corr_amplitude
[13:8]};
298 corr_q_out
<= corr_amplitude
[7:0];
304 corr_i_out
<= {2'b00, corr_amplitude
[13:8]};
305 corr_q_out
<= corr_amplitude
[7:0];
308 else if (minor_mode
== `FPGA_HF_READER_MODE_RECEIVE_IQ)
310 // Send 8 bits of in phase tag signal
311 if (corr_i_accum
[13:11] == 3'b000 || corr_i_accum
[13:11] == 3'b111)
312 corr_i_out
<= corr_i_accum
[11:4];
313 else // truncate to maximum value
314 if (corr_i_accum
[13] == 1'b0)
315 corr_i_out
<= 8'b01111111;
317 corr_i_out
<= 8'b10000000;
319 // Send 8 bits of quadrature phase tag signal
320 if (corr_q_accum
[13:11] == 3'b000 || corr_q_accum
[13:11] == 3'b111)
321 corr_q_out
<= corr_q_accum
[11:4];
322 else // truncate to maximum value
323 if (corr_q_accum
[13] == 1'b0)
324 corr_q_out
<= 8'b01111111;
326 corr_q_out
<= 8'b10000000;
329 // for each Q/I pair report two reader signal samples when sniffing. Store the 1st.
330 after_hysteresis_prev_prev
<= after_hysteresis
;
332 // Initialize next correlation.
333 // Both I and Q reference signals are high when corr_i_nct == 0. Therefore need to accumulate.
334 corr_i_accum
<= $signed({1'b0, adc_d
});
335 corr_q_accum
<= $signed({1'b0, adc_d
});
340 corr_i_accum
<= corr_i_accum
+ $signed({1'b0, adc_d
});
342 corr_i_accum
<= corr_i_accum
- $signed({1'b0, adc_d
});
345 corr_q_accum
<= corr_q_accum
+ $signed({1'b0, adc_d
});
347 corr_q_accum
<= corr_q_accum
- $signed({1'b0, adc_d
});
350 // for each Q/I pair report two reader signal samples when sniffing. Store the 2nd.
351 if (corr_i_cnt
== 6'd32)
352 after_hysteresis_prev
<= after_hysteresis
;
354 // Then the result from last time is serialized and send out to the ARM.
355 // We get one report each cycle, and each report is 16 bits, so the
356 // ssp_clk should be the adc_clk divided by 64/16 = 4.
357 // ssp_clk frequency = 13,56MHz / 4 = 3.39MHz
359 if (corr_i_cnt
[1:0] == 2'b00)
361 // Don't shift if we just loaded new data, obviously.
362 if (corr_i_cnt
!= 6'd0)
364 corr_i_out
[7:0] <= {corr_i_out
[6:0], corr_q_out
[7]};
365 corr_q_out
[7:1] <= corr_q_out
[6:0];
371 // ssp clock and frame signal for communication to and from ARM
372 // _____ _____ _____ _
373 // ssp_clk | |_____| |_____| |_____|
375 // ssp_frame ___| |____________________________
376 // ___________ ___________ ___________ _
377 // ssp_d_in X___________X___________X___________X_
379 // corr_i_cnt 0 1 2 3 4 5 6 7 8 9 10 11 12 ...
381 always @(negedge adc_clk
)
383 if (corr_i_cnt
[1:0] == 2'b00)
386 if (corr_i_cnt
[1:0] == 2'b10)
389 // set ssp_frame signal for corr_i_cnt = 1..3
390 // (send one frame with 16 Bits)
391 if (corr_i_cnt
== 6'd1)
394 if (corr_i_cnt
== 6'd3)
398 assign ssp_din
= corr_i_out
[7];
402 reg [3:0] jam_counter
;
404 always @(negedge adc_clk
)
406 if (corr_i_cnt
== 6'd0)
408 jam_counter
<= jam_counter
+ 1;
409 jam_signal
<= jam_counter
[1] ^ jam_counter
[3];
418 if (minor_mode
== `FPGA_HF_READER_MODE_SEND_SHALLOW_MOD)
423 else if (minor_mode
== `FPGA_HF_READER_MODE_SEND_SHALLOW_MOD_RDV4)
428 else if (minor_mode
== `FPGA_HF_READER_MODE_SEND_FULL_MOD)
430 pwr_hi
= ck_1356meg
& ~ssp_dout
;
433 else if (minor_mode
== `FPGA_HF_READER_MODE_SEND_JAM)
435 pwr_hi
= ck_1356meg
& jam_signal
;
438 else if (minor_mode
== `FPGA_HF_READER_MODE_SNIFF_IQ
439 || minor_mode
== `FPGA_HF_READER_MODE_SNIFF_AMPLITUDE
440 || minor_mode
== `FPGA_HF_READER_MODE_SNIFF_PHASE)
445 else // receiving from tag
453 assign pwr_oe2
= 1'b0;
454 assign pwr_oe3
= 1'b0;
455 assign pwr_lo
= 1'b0;
458 assign debug
= corr_i_cnt
[3];