armsrc/legicrf.c

   1 //-----------------------------------------------------------------------------
   2 // (c) 2009 Henryk Plötz <henryk@ploetzli.ch>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // LEGIC RF simulation code
   9 //-----------------------------------------------------------------------------
  10
  11 #include "proxmark3.h"
  12 #include "apps.h"
  13 #include "util.h"
  14 #include "string.h"
  15
  16 #include "legicrf.h"
  17 #include "legic_prng.h"
  18 #include "crc.h"
  19
  20 static struct legic_frame {
  21         int bits;
  22         uint32_t data;
  23 } current_frame;
  24
  25 static enum {
  26   STATE_DISCON,
  27   STATE_IV,
  28   STATE_CON,
  29 } legic_state;
  30
  31 static crc_t    legic_crc;
  32 static int      legic_read_count;
  33 static uint32_t legic_prng_bc;
  34 static uint32_t legic_prng_iv;
  35
  36 static int      legic_phase_drift;
  37 static int      legic_frame_drift;
  38 static int      legic_reqresp_drift;
  39
  40 AT91PS_TC timer;
  41 AT91PS_TC prng_timer;
  42
  43 static void setup_timer(void)
  44 {
  45         /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging
  46          * this it won't be terribly accurate but should be good enough.
  47          */
  48         AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1);
  49         timer = AT91C_BASE_TC1;
  50         timer->TC_CCR = AT91C_TC_CLKDIS;
  51         timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK;
  52         timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
  53
  54         /*
  55      * Set up Timer 2 to use for measuring time between frames in
  56      * tag simulation mode. Runs 4x faster as Timer 1
  57          */
  58     AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC2);
  59     prng_timer = AT91C_BASE_TC2;
  60     prng_timer->TC_CCR = AT91C_TC_CLKDIS;
  61         prng_timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV2_CLOCK;
  62     prng_timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
  63 }
  64
  65 /* At TIMER_CLOCK3 (MCK/32) */
  66 #define RWD_TIME_1 150     /* RWD_TIME_PAUSE off, 80us on = 100us */
  67 #define RWD_TIME_0 90      /* RWD_TIME_PAUSE off, 40us on = 60us */
  68 #define RWD_TIME_PAUSE 30  /* 20us */
  69 #define RWD_TIME_FUZZ 20   /* rather generous 13us, since the peak detector + hysteresis fuzz quite a bit */
  70 #define TAG_TIME_BIT 150   /* 100us for every bit */
  71 #define TAG_TIME_WAIT 490  /* time from RWD frame end to tag frame start, experimentally determined */
  72
  73 #define SIM_DIVISOR  586   /* prng_time/SIM_DIVISOR count prng needs to be forwared */
  74 #define SIM_SHIFT    900   /* prng_time+SIM_SHIFT shift of delayed start */
  75
  76 #define SESSION_IV 0x55
  77 #define OFFSET_LOG 1024
  78
  79 #define FUZZ_EQUAL(value, target, fuzz) ((value) > ((target)-(fuzz)) && (value) < ((target)+(fuzz)))
  80
  81 /* Generate Keystream */
  82 static uint32_t get_key_stream(int skip, int count)
  83 {
  84   uint32_t key=0; int i;
  85
  86   /* Use int to enlarge timer tc to 32bit */
  87   legic_prng_bc += prng_timer->TC_CV;
  88   prng_timer->TC_CCR = AT91C_TC_SWTRG;
  89
  90   /* If skip == -1, forward prng time based */
  91   if(skip == -1) {
  92      i  = (legic_prng_bc+SIM_SHIFT)/SIM_DIVISOR; /* Calculate Cycles based on timer */
  93      i -= legic_prng_count(); /* substract cycles of finished frames */
  94      i -= count; /* substract current frame length, rewidn to bedinning */
  95      legic_prng_forward(i);
  96   } else {
  97      legic_prng_forward(skip);
  98   }
  99
 100   /* Write Time Data into LOG */
 101   uint8_t *BigBuf = BigBuf_get_addr();
 102   if(count == 6) { i = -1; } else { i = legic_read_count; }
 103   BigBuf[OFFSET_LOG+128+i] = legic_prng_count();
 104   BigBuf[OFFSET_LOG+256+i*4]   = (legic_prng_bc >> 0) & 0xff;
 105   BigBuf[OFFSET_LOG+256+i*4+1] = (legic_prng_bc >> 8) & 0xff;
 106   BigBuf[OFFSET_LOG+256+i*4+2] = (legic_prng_bc >>16) & 0xff;
 107   BigBuf[OFFSET_LOG+256+i*4+3] = (legic_prng_bc >>24) & 0xff;
 108   BigBuf[OFFSET_LOG+384+i] = count;
 109
 110   /* Generate KeyStream */
 111   for(i=0; i<count; i++) {
 112     key |= legic_prng_get_bit() << i;
 113     legic_prng_forward(1);
 114   }
 115   return key;
 116 }
 117
 118 /* Send a frame in tag mode, the FPGA must have been set up by
 119  * LegicRfSimulate
 120  */
 121 static void frame_send_tag(uint16_t response, int bits, int crypt)
 122 {
 123    /* Bitbang the response */
 124    AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 125    AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
 126    AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
 127
 128    /* Use time to crypt frame */
 129    if(crypt) {
 130       legic_prng_forward(2); /* TAG_TIME_WAIT -> shift by 2 */
 131       int i; int key = 0;
 132       for(i=0; i<bits; i++) {
 133          key |= legic_prng_get_bit() << i;
 134          legic_prng_forward(1);
 135       }
 136       //Dbprintf("key = 0x%x", key);
 137       response = response ^ key;
 138    }
 139
 140    /* Wait for the frame start */
 141    while(timer->TC_CV < (TAG_TIME_WAIT - 30)) ;
 142
 143    int i;
 144    for(i=0; i<bits; i++) {
 145       int nextbit = timer->TC_CV + TAG_TIME_BIT;
 146       int bit = response & 1;
 147       response = response >> 1;
 148       if(bit) {
 149          AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 150       } else {
 151          AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 152       }
 153       while(timer->TC_CV < nextbit) ;
 154    }
 155    AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 156 }
 157
 158 /* Send a frame in reader mode, the FPGA must have been set up by
 159  * LegicRfReader
 160  */
 161 static void frame_send_rwd(uint32_t data, int bits)
 162 {
 163         /* Start clock */
 164         timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
 165         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 166
 167         int i;
 168         for(i=0; i<bits; i++) {
 169                 int starttime = timer->TC_CV;
 170                 int pause_end = starttime + RWD_TIME_PAUSE, bit_end;
 171                 int bit = data & 1;
 172                 data = data >> 1;
 173
 174                 if(bit ^ legic_prng_get_bit()) {
 175                         bit_end = starttime + RWD_TIME_1;
 176                 } else {
 177                         bit_end = starttime + RWD_TIME_0;
 178                 }
 179
 180                 /* RWD_TIME_PAUSE time off, then some time on, so that the complete bit time is
 181                  * RWD_TIME_x, where x is the bit to be transmitted */
 182                 AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 183                 while(timer->TC_CV < pause_end) ;
 184                 AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 185                 legic_prng_forward(1); /* bit duration is longest. use this time to forward the lfsr */
 186
 187                 while(timer->TC_CV < bit_end) ;
 188         }
 189
 190         {
 191                 /* One final pause to mark the end of the frame */
 192                 int pause_end = timer->TC_CV + RWD_TIME_PAUSE;
 193                 AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 194                 while(timer->TC_CV < pause_end) ;
 195                 AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 196         }
 197
 198         /* Reset the timer, to measure time until the start of the tag frame */
 199         timer->TC_CCR = AT91C_TC_SWTRG;
 200         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 201 }
 202
 203 /* Receive a frame from the card in reader emulation mode, the FPGA and
 204  * timer must have been set up by LegicRfReader and frame_send_rwd.
 205  *
 206  * The LEGIC RF protocol from card to reader does not include explicit
 207  * frame start/stop information or length information. The reader must
 208  * know beforehand how many bits it wants to receive. (Notably: a card
 209  * sending a stream of 0-bits is indistinguishable from no card present.)
 210  *
 211  * Receive methodology: There is a fancy correlator in hi_read_rx_xcorr, but
 212  * I'm not smart enough to use it. Instead I have patched hi_read_tx to output
 213  * the ADC signal with hysteresis on SSP_DIN. Bit-bang that signal and look
 214  * for edges. Count the edges in each bit interval. If they are approximately
 215  * 0 this was a 0-bit, if they are approximately equal to the number of edges
 216  * expected for a 212kHz subcarrier, this was a 1-bit. For timing we use the
 217  * timer that's still running from frame_send_rwd in order to get a synchronization
 218  * with the frame that we just sent.
 219  *
 220  * FIXME: Because we're relying on the hysteresis to just do the right thing
 221  * the range is severely reduced (and you'll probably also need a good antenna).
 222  * So this should be fixed some time in the future for a proper receiver.
 223  */
 224 static void frame_receive_rwd(struct legic_frame * const f, int bits, int crypt)
 225 {
 226         uint32_t the_bit = 1;  /* Use a bitmask to save on shifts */
 227         uint32_t data=0;
 228         int i, old_level=0, edges=0;
 229         int next_bit_at = TAG_TIME_WAIT;
 230
 231         if(bits > 32) {
 232                 bits = 32;
 233     }
 234
 235         AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
 236         AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
 237
 238         /* we have some time now, precompute the cipher
 239      * since we cannot compute it on the fly while reading */
 240         legic_prng_forward(2);
 241
 242         if(crypt)
 243         {
 244                 for(i=0; i<bits; i++) {
 245                         data |= legic_prng_get_bit() << i;
 246                         legic_prng_forward(1);
 247                 }
 248         }
 249
 250         while(timer->TC_CV < next_bit_at) ;
 251
 252         next_bit_at += TAG_TIME_BIT;
 253
 254         for(i=0; i<bits; i++) {
 255                 edges = 0;
 256                 while(timer->TC_CV < next_bit_at) {
 257                         int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
 258                         if(level != old_level)
 259                                 edges++;
 260                         old_level = level;
 261                 }
 262                 next_bit_at += TAG_TIME_BIT;
 263
 264                 if(edges > 20 && edges < 60) { /* expected are 42 edges */
 265                         data ^= the_bit;
 266                 }
 267                 the_bit <<= 1;
 268         }
 269
 270         f->data = data;
 271         f->bits = bits;
 272
 273         /* Reset the timer, to synchronize the next frame */
 274         timer->TC_CCR = AT91C_TC_SWTRG;
 275         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 276 }
 277
 278 static void frame_append_bit(struct legic_frame * const f, int bit)
 279 {
 280    if(f->bits >= 31) {
 281        return; /* Overflow, won't happen */
 282    }
 283    f->data |= (bit<<f->bits);
 284    f->bits++;
 285 }
 286
 287 static void frame_clean(struct legic_frame * const f)
 288 {
 289         f->data = 0;
 290         f->bits = 0;
 291 }
 292
 293 static uint32_t perform_setup_phase_rwd(int iv)
 294 {
 295
 296         /* Switch on carrier and let the tag charge for 1ms */
 297         AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
 298         SpinDelay(1);
 299
 300         legic_prng_init(0); /* no keystream yet */
 301         frame_send_rwd(iv, 7);
 302         legic_prng_init(iv);
 303
 304         frame_clean(&current_frame);
 305         frame_receive_rwd(&current_frame, 6, 1);
 306         legic_prng_forward(1); /* we wait anyways */
 307         while(timer->TC_CV < 387) ; /* ~ 258us */
 308         frame_send_rwd(0x19, 6);
 309
 310         return current_frame.data;
 311 }
 312
 313 static void LegicCommonInit(void) {
 314         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 315         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 316         FpgaSetupSsc();
 317         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
 318
 319         /* Bitbang the transmitter */
 320         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 321         AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
 322         AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
 323
 324         setup_timer();
 325
 326         crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0);
 327 }
 328
 329 static void switch_off_tag_rwd(void)
 330 {
 331         /* Switch off carrier, make sure tag is reset */
 332         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
 333         SpinDelay(10);
 334
 335         WDT_HIT();
 336 }
 337 /* calculate crc for a legic command */
 338 static int LegicCRC(int byte_index, int value, int cmd_sz) {
 339         crc_clear(&legic_crc);
 340         crc_update(&legic_crc, 1, 1); /* CMD_READ */
 341         crc_update(&legic_crc, byte_index, cmd_sz-1);
 342         crc_update(&legic_crc, value, 8);
 343         return crc_finish(&legic_crc);
 344 }
 345
 346 int legic_read_byte(int byte_index, int cmd_sz) {
 347         int byte;
 348
 349         legic_prng_forward(4); /* we wait anyways */
 350         while(timer->TC_CV < 387) ; /* ~ 258us + 100us*delay */
 351
 352         frame_send_rwd(1 | (byte_index << 1), cmd_sz);
 353         frame_clean(&current_frame);
 354
 355         frame_receive_rwd(&current_frame, 12, 1);
 356
 357         byte = current_frame.data & 0xff;
 358         if( LegicCRC(byte_index, byte, cmd_sz) != (current_frame.data >> 8) ) {
 359                 Dbprintf("!!! crc mismatch: expected %x but got %x !!!",
 360            LegicCRC(byte_index, current_frame.data & 0xff, cmd_sz), current_frame.data >> 8);
 361                 return -1;
 362         }
 363
 364         return byte;
 365 }
 366
 367 /* legic_write_byte() is not included, however it's trivial to implement
 368  * and here are some hints on what remains to be done:
 369  *
 370  *  * assemble a write_cmd_frame with crc and send it
 371  *  * wait until the tag sends back an ACK ('1' bit unencrypted)
 372  *  * forward the prng based on the timing
 373  */
 374 int legic_write_byte(int byte, int addr, int addr_sz) {
 375     //do not write UID, CRC, DCF
 376     if(addr <= 0x06) {
 377                 return 0;
 378         }
 379
 380         //== send write command ==============================
 381         crc_clear(&legic_crc);
 382         crc_update(&legic_crc, 0, 1); /* CMD_WRITE */
 383         crc_update(&legic_crc, addr, addr_sz);
 384         crc_update(&legic_crc, byte, 8);
 385
 386         uint32_t crc = crc_finish(&legic_crc);
 387         uint32_t cmd = ((crc     <<(addr_sz+1+8)) //CRC
 388                    |(byte    <<(addr_sz+1))   //Data
 389                    |(addr    <<1)             //Address
 390                    |(0x00    <<0));           //CMD = W
 391     uint32_t cmd_sz = addr_sz+1+8+4;          //crc+data+cmd
 392
 393     legic_prng_forward(2); /* we wait anyways */
 394     while(timer->TC_CV < 387) ; /* ~ 258us */
 395         frame_send_rwd(cmd, cmd_sz);
 396
 397         //== wait for ack ====================================
 398     int t, old_level=0, edges=0;
 399     int next_bit_at =0;
 400         while(timer->TC_CV < 387) ; /* ~ 258us */
 401     for(t=0; t<80; t++) {
 402         edges = 0;
 403                 next_bit_at += TAG_TIME_BIT;
 404         while(timer->TC_CV < next_bit_at) {
 405             int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
 406             if(level != old_level) {
 407                 edges++;
 408                         }
 409             old_level = level;
 410         }
 411         if(edges > 20 && edges < 60) { /* expected are 42 edges */
 412                         int t = timer->TC_CV;
 413                         int c = t/TAG_TIME_BIT;
 414                         timer->TC_CCR = AT91C_TC_SWTRG;
 415                         while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 416                         legic_prng_forward(c);
 417                 return 0;
 418         }
 419     }
 420     timer->TC_CCR = AT91C_TC_SWTRG;
 421     while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
 422         return -1;
 423 }
 424
 425 int LegicRfReader(int offset, int bytes) {
 426         int byte_index=0, cmd_sz=0, card_sz=0;
 427
 428         LegicCommonInit();
 429
 430         uint8_t *BigBuf = BigBuf_get_addr();
 431         memset(BigBuf, 0, 1024);
 432
 433         DbpString("setting up legic card");
 434         uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV);
 435         switch_off_tag_rwd(); //we lose to mutch time with dprintf
 436         switch(tag_type) {
 437                 case 0x1d:
 438                         DbpString("MIM 256 card found, reading card ...");
 439             cmd_sz = 9;
 440                         card_sz = 256;
 441                         break;
 442                 case 0x3d:
 443                         DbpString("MIM 1024 card found, reading card ...");
 444             cmd_sz = 11;
 445                         card_sz = 1024;
 446                         break;
 447                 default:
 448                         Dbprintf("Unknown card format: %x",tag_type);
 449                         return -1;
 450         }
 451         if(bytes == -1) {
 452                 bytes = card_sz;
 453         }
 454         if(bytes+offset >= card_sz) {
 455                 bytes = card_sz-offset;
 456         }
 457
 458         perform_setup_phase_rwd(SESSION_IV);
 459
 460         LED_B_ON();
 461         while(byte_index < bytes) {
 462                 int r = legic_read_byte(byte_index+offset, cmd_sz);
 463                 if(r == -1 ||BUTTON_PRESS()) {
 464                 DbpString("operation aborted");
 465                         switch_off_tag_rwd();
 466                 LED_B_OFF();
 467                 LED_C_OFF();
 468                 return -1;
 469                 }
 470                 BigBuf[byte_index] = r;
 471         WDT_HIT();
 472                 byte_index++;
 473                 if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF();
 474         }
 475         LED_B_OFF();
 476     LED_C_OFF();
 477         switch_off_tag_rwd();
 478         Dbprintf("Card read, use 'hf legic decode' or");
 479     Dbprintf("'data hexsamples %d' to view results", (bytes+7) & ~7);
 480     return 0;
 481 }
 482
 483 void LegicRfWriter(int bytes, int offset) {
 484         int byte_index=0, addr_sz=0;
 485         uint8_t *BigBuf = BigBuf_get_addr();
 486
 487         LegicCommonInit();
 488
 489         DbpString("setting up legic card");
 490         uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV);
 491         switch_off_tag_rwd();
 492         switch(tag_type) {
 493                 case 0x1d:
 494                         if(offset+bytes > 0x100) {
 495                                 Dbprintf("Error: can not write to 0x%03.3x on MIM 256", offset+bytes);
 496                                 return;
 497                         }
 498                         addr_sz = 8;
 499                         Dbprintf("MIM 256 card found, writing 0x%02.2x - 0x%02.2x ...", offset, offset+bytes);
 500                         break;
 501                 case 0x3d:
 502                         if(offset+bytes > 0x400) {
 503                         Dbprintf("Error: can not write to 0x%03.3x on MIM 1024", offset+bytes);
 504                         return;
 505                 }
 506                         addr_sz = 10;
 507                         Dbprintf("MIM 1024 card found, writing 0x%03.3x - 0x%03.3x ...", offset, offset+bytes);
 508                         break;
 509                 default:
 510                         Dbprintf("No or unknown card found, aborting");
 511             return;
 512         }
 513
 514     LED_B_ON();
 515         perform_setup_phase_rwd(SESSION_IV);
 516     legic_prng_forward(2);
 517         while(byte_index < bytes) {
 518                 int r = legic_write_byte(BigBuf[byte_index+offset], byte_index+offset, addr_sz);
 519                 if((r != 0) || BUTTON_PRESS()) {
 520                         Dbprintf("operation aborted @ 0x%03.3x", byte_index);
 521                         switch_off_tag_rwd();
 522                         LED_B_OFF();
 523                         LED_C_OFF();
 524                         return;
 525                 }
 526         WDT_HIT();
 527                 byte_index++;
 528         if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF();
 529         }
 530     LED_B_OFF();
 531     LED_C_OFF();
 532     DbpString("write successful");
 533 }
 534
 535 int timestamp;
 536
 537 /* Handle (whether to respond) a frame in tag mode */
 538 static void frame_handle_tag(struct legic_frame const * const f)
 539 {
 540         uint8_t *BigBuf = BigBuf_get_addr();
 541
 542    /* First Part of Handshake (IV) */
 543    if(f->bits == 7) {
 544      if(f->data == SESSION_IV) {
 545         LED_C_ON();
 546         prng_timer->TC_CCR = AT91C_TC_SWTRG;
 547         legic_prng_init(f->data);
 548         frame_send_tag(0x3d, 6, 1); /* 0x3d^0x26 = 0x1b */
 549         legic_state = STATE_IV;
 550         legic_read_count = 0;
 551         legic_prng_bc = 0;
 552         legic_prng_iv = f->data;
 553
 554         /* TIMEOUT */
 555         timer->TC_CCR = AT91C_TC_SWTRG;
 556         while(timer->TC_CV > 1);
 557         while(timer->TC_CV < 280);
 558         return;
 559       } else if((prng_timer->TC_CV % 50) > 40) {
 560         legic_prng_init(f->data);
 561         frame_send_tag(0x3d, 6, 1);
 562         SpinDelay(20);
 563         return;
 564      }
 565    }
 566
 567    /* 0x19==??? */
 568    if(legic_state == STATE_IV) {
 569       if((f->bits == 6) && (f->data == (0x19 ^ get_key_stream(1, 6)))) {
 570          legic_state = STATE_CON;
 571
 572          /* TIMEOUT */
 573          timer->TC_CCR = AT91C_TC_SWTRG;
 574          while(timer->TC_CV > 1);
 575          while(timer->TC_CV < 200);
 576          return;
 577       } else {
 578          legic_state = STATE_DISCON;
 579          LED_C_OFF();
 580          Dbprintf("0x19 - Frame: %03.3x", f->data);
 581          return;
 582       }
 583    }
 584
 585    /* Read */
 586    if(f->bits == 11) {
 587       if(legic_state == STATE_CON) {
 588          int key   = get_key_stream(-1, 11); //legic_phase_drift, 11);
 589          int addr  = f->data ^ key; addr = addr >> 1;
 590          int data = BigBuf[addr];
 591          int hash = LegicCRC(addr, data, 11) << 8;
 592          BigBuf[OFFSET_LOG+legic_read_count] = (uint8_t)addr;
 593          legic_read_count++;
 594
 595          //Dbprintf("Data:%03.3x, key:%03.3x, addr: %03.3x, read_c:%u", f->data, key, addr, read_c);
 596          legic_prng_forward(legic_reqresp_drift);
 597
 598          frame_send_tag(hash | data, 12, 1);
 599
 600          /* SHORT TIMEOUT */
 601          timer->TC_CCR = AT91C_TC_SWTRG;
 602          while(timer->TC_CV > 1);
 603          legic_prng_forward(legic_frame_drift);
 604          while(timer->TC_CV < 180);
 605          return;
 606       }
 607    }
 608
 609    /* Write */
 610    if(f->bits == 23) {
 611       int key   = get_key_stream(-1, 23); //legic_frame_drift, 23);
 612       int addr  = f->data ^ key; addr = addr >> 1; addr = addr & 0x3ff;
 613       int data  = f->data ^ key; data = data >> 11; data = data & 0xff;
 614
 615       /* write command */
 616       legic_state = STATE_DISCON;
 617       LED_C_OFF();
 618       Dbprintf("write - addr: %x, data: %x", addr, data);
 619       return;
 620    }
 621
 622    if(legic_state != STATE_DISCON) {
 623       Dbprintf("Unexpected: sz:%u, Data:%03.3x, State:%u, Count:%u", f->bits, f->data, legic_state, legic_read_count);
 624       int i;
 625       Dbprintf("IV: %03.3x", legic_prng_iv);
 626       for(i = 0; i<legic_read_count; i++) {
 627          Dbprintf("Read Nb: %u, Addr: %u", i, BigBuf[OFFSET_LOG+i]);
 628       }
 629
 630       for(i = -1; i<legic_read_count; i++) {
 631          uint32_t t;
 632          t  = BigBuf[OFFSET_LOG+256+i*4];
 633          t |= BigBuf[OFFSET_LOG+256+i*4+1] << 8;
 634          t |= BigBuf[OFFSET_LOG+256+i*4+2] <<16;
 635          t |= BigBuf[OFFSET_LOG+256+i*4+3] <<24;
 636
 637          Dbprintf("Cycles: %u, Frame Length: %u, Time: %u",
 638             BigBuf[OFFSET_LOG+128+i],
 639             BigBuf[OFFSET_LOG+384+i],
 640             t);
 641       }
 642    }
 643    legic_state = STATE_DISCON;
 644    legic_read_count = 0;
 645    SpinDelay(10);
 646    LED_C_OFF();
 647    return;
 648 }
 649
 650 /* Read bit by bit untill full frame is received
 651  * Call to process frame end answer
 652  */
 653 static void emit(int bit)
 654 {
 655   if(bit == -1) {
 656      if(current_frame.bits <= 4) {
 657         frame_clean(&current_frame);
 658      } else {
 659         frame_handle_tag(&current_frame);
 660         frame_clean(&current_frame);
 661      }
 662      WDT_HIT();
 663   } else if(bit == 0) {
 664     frame_append_bit(&current_frame, 0);
 665   } else if(bit == 1) {
 666     frame_append_bit(&current_frame, 1);
 667   }
 668 }
 669
 670 void LegicRfSimulate(int phase, int frame, int reqresp)
 671 {
 672   /* ADC path high-frequency peak detector, FPGA in high-frequency simulator mode,
 673    * modulation mode set to 212kHz subcarrier. We are getting the incoming raw
 674    * envelope waveform on DIN and should send our response on DOUT.
 675    *
 676    * The LEGIC RF protocol is pulse-pause-encoding from reader to card, so we'll
 677    * measure the time between two rising edges on DIN, and no encoding on the
 678    * subcarrier from card to reader, so we'll just shift out our verbatim data
 679    * on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear,
 680    * seems to be 300us-ish.
 681    */
 682
 683    if(phase < 0) {
 684       int i;
 685       for(i=0; i<=reqresp; i++) {
 686          legic_prng_init(SESSION_IV);
 687          Dbprintf("i=%u, key 0x%3.3x", i, get_key_stream(i, frame));
 688       }
 689       return;
 690    }
 691
 692    legic_phase_drift = phase;
 693    legic_frame_drift = frame;
 694    legic_reqresp_drift = reqresp;
 695
 696    FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 697    SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 698    FpgaSetupSsc();
 699    FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_212K);
 700
 701    /* Bitbang the receiver */
 702    AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
 703    AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
 704
 705    setup_timer();
 706    crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0);
 707
 708    int old_level = 0;
 709    int active = 0;
 710    legic_state = STATE_DISCON;
 711
 712    LED_B_ON();
 713    DbpString("Starting Legic emulator, press button to end");
 714    while(!BUTTON_PRESS()) {
 715       int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
 716       int time = timer->TC_CV;
 717
 718       if(level != old_level) {
 719          if(level == 1) {
 720             timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
 721             if(FUZZ_EQUAL(time, RWD_TIME_1, RWD_TIME_FUZZ)) {
 722                /* 1 bit */
 723                emit(1);
 724                active = 1;
 725                LED_A_ON();
 726             } else if(FUZZ_EQUAL(time, RWD_TIME_0, RWD_TIME_FUZZ)) {
 727                /* 0 bit */
 728                emit(0);
 729                active = 1;
 730                LED_A_ON();
 731             } else if(active) {
 732                /* invalid */
 733                emit(-1);
 734                active = 0;
 735                LED_A_OFF();
 736             }
 737          }
 738       }
 739
 740       if(time >= (RWD_TIME_1+RWD_TIME_FUZZ) && active) {
 741          /* Frame end */
 742          emit(-1);
 743          active = 0;
 744          LED_A_OFF();
 745       }
 746
 747       if(time >= (20*RWD_TIME_1) && (timer->TC_SR & AT91C_TC_CLKSTA)) {
 748          timer->TC_CCR = AT91C_TC_CLKDIS;
 749       }
 750
 751       old_level = level;
 752       WDT_HIT();
 753    }
 754    DbpString("Stopped");
 755    LED_B_OFF();
 756    LED_A_OFF();
 757    LED_C_OFF();
 758 }
 759