RfidResearchGroup/proxmark3
1
1
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-01-08 09:10:06 +08:00
Code Issues Projects Releases Packages Wiki Activity

FIX: the acknowledgement response in setup phase now deals with MIN22, MIN256, MIN1024 tag accordingly.

Browse source
This commit is contained in:
iceman1001 2016-09-03 12:18:02 +02:00
parent c71c5ee156
commit f7b4257301
1 changed files with 65 additions and 55 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

120
armsrc/legicrf.c
View file

@ -62,7 +62,7 @@ static void setup_timer(void) {
#define RWD_TIME_PAUSE 30 /* 20us */ #define RWD_TIME_PAUSE 30 /* 20us */
#define RWD_TIME_FUZZ 20 /* rather generous 13us, since the peak detector + hysteresis fuzz quite a bit */ #define RWD_TIME_FUZZ 20 /* rather generous 13us, since the peak detector + hysteresis fuzz quite a bit */
#define TAG_TIME_BIT 150 /* 100us for every bit */ #define TAG_TIME_BIT 150 /* 100us for every bit */
#define TAG_TIME_WAIT 490 /* time from RWD frame end to tag frame start, experimentally determined */ #define TAG_TIME_WAIT 490 /* 490 time from RWD frame end to tag frame start, experimentally determined */
#define SIM_DIVISOR 586 /* prng_time/SIM_DIVISOR count prng needs to be forwared */ #define SIM_DIVISOR 586 /* prng_time/SIM_DIVISOR count prng needs to be forwared */
#define SIM_SHIFT 900 /* prng_time+SIM_SHIFT shift of delayed start */ #define SIM_SHIFT 900 /* prng_time+SIM_SHIFT shift of delayed start */
@ -185,24 +185,24 @@ static void ResetClock(void){
/* Send a frame in reader mode, the FPGA must have been set up by /* Send a frame in reader mode, the FPGA must have been set up by
* LegicRfReader * LegicRfReader
*/ */
static void frame_send_rwd(uint32_t data, int bits){ static void frame_send_rwd(uint32_t data, uint8_t bits){
uint8_t bit = 0;
uint32_t starttime = 0, pause_end = 0, bit_end = 0, temp = data;
ResetClock(); ResetClock();
int starttime = 0, pause_end = 0, bit = 0, bit_end = 0;
for(int i = 0; i<bits; i++) { for(int i = 0; i < bits; i++) {
starttime = timer->TC_CV; starttime = timer->TC_CV;
pause_end = starttime + RWD_TIME_PAUSE; pause_end = starttime + RWD_TIME_PAUSE;
bit = data & 1; bit = temp & 1;
data >>= 1; temp >>= 1;
if(bit ^ legic_prng_get_bit()) if(bit ^ legic_prng_get_bit())
bit_end = starttime + RWD_TIME_1; bit_end = starttime + RWD_TIME_1;
else else
bit_end = starttime + RWD_TIME_0; bit_end = starttime + RWD_TIME_0;
/* RWD_TIME_PAUSE time off, then some time on, so that the complete bit time is /* RWD_TIME_PAUSE time off, then some time on, so that the complete bit time is
* RWD_TIME_x, where x is the bit to be transmitted */ * RWD_TIME_x, where x is the bit to be transmitted */
AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
@ -211,12 +211,13 @@ static void frame_send_rwd(uint32_t data, int bits){
AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
legic_prng_forward(1); /* bit duration is longest. use this time to forward the lfsr */ // bit duration is longest. use this time to forward the lfsr
legic_prng_forward(1);
WAIT( bit_end ) WAIT( bit_end )
} }
/* One final pause to mark the end of the frame */ // One final pause to mark the end of the frame
pause_end = timer->TC_CV + RWD_TIME_PAUSE; pause_end = timer->TC_CV + RWD_TIME_PAUSE;
AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
@ -225,6 +226,14 @@ static void frame_send_rwd(uint32_t data, int bits){
AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
// log
uint8_t cmdbytes[2] = { (data & 0xFF), 0 };
if ( bits > 8 ) {
cmdbytes[1] = (data >> 8 ) & 0xFF;
LogTrace(cmdbytes, 2, 0, timer->TC_CV, NULL, TRUE);
} else {
LogTrace(cmdbytes, 1, 0, timer->TC_CV, NULL, TRUE);
}
/* Reset the timer, to measure time until the start of the tag frame */ /* Reset the timer, to measure time until the start of the tag frame */
ResetClock(); ResetClock();
} }
@ -252,10 +261,13 @@ static void frame_send_rwd(uint32_t data, int bits){
*/ */
static void frame_receive_rwd(struct legic_frame * const f, int bits, int crypt) static void frame_receive_rwd(struct legic_frame * const f, int bits, int crypt)
{ {
uint32_t the_bit = 1; /* Use a bitmask to save on shifts */ uint32_t starttime = timer->TC_CV;
uint32_t data = 0;
uint32_t the_bit = 1;
uint32_t data = 0;/* Use a bitmask to save on shifts */
int i, old_level = 0, edges = 0; int i, old_level = 0, edges = 0;
int next_bit_at = TAG_TIME_WAIT; int next_bit_at = TAG_TIME_WAIT;
int level = 0;
if(bits > 32) bits = 32; if(bits > 32) bits = 32;
@ -273,6 +285,7 @@ static void frame_receive_rwd(struct legic_frame * const f, int bits, int crypt)
} }
} }
// QUESTION: how long did those extra calls to logtrace take?
WAIT(next_bit_at) WAIT(next_bit_at)
next_bit_at += TAG_TIME_BIT; next_bit_at += TAG_TIME_BIT;
@ -280,7 +293,7 @@ static void frame_receive_rwd(struct legic_frame * const f, int bits, int crypt)
for(i=0; i<bits; i++) { for(i=0; i<bits; i++) {
edges = 0; edges = 0;
while(timer->TC_CV < next_bit_at) { while(timer->TC_CV < next_bit_at) {
int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
if(level != old_level) if(level != old_level)
edges++; edges++;
old_level = level; old_level = level;
@ -296,7 +309,11 @@ static void frame_receive_rwd(struct legic_frame * const f, int bits, int crypt)
f->data = data; f->data = data;
f->bits = bits; f->bits = bits;
// log
uint8_t cmdbytes[] = { (data & 0xFF), (data >> 8) & 0xFF };
LogTrace(cmdbytes, 2, starttime, timer->TC_CV, NULL, FALSE);
// Reset the timer, to synchronize the next frame // Reset the timer, to synchronize the next frame
ResetClock(); ResetClock();
} }
@ -315,27 +332,36 @@ static void frame_clean(struct legic_frame * const f) {
} }
// Setup pm3 as a Legic Reader // Setup pm3 as a Legic Reader
static uint32_t perform_setup_phase_rwd(int iv) { static uint32_t perform_setup_phase_rwd(uint8_t iv) {
/* Switch on carrier and let the tag charge for 1ms */
// Switch on carrier and let the tag charge for 1ms
AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
SpinDelay(20); // was 1ms before. SpinDelay(20); // was 1ms before.
/* no keystream yet */ // no keystream yet
legic_prng_init(0); legic_prng_init(0);
// IV
frame_send_rwd(iv, 7); frame_send_rwd(iv, 7);
legic_prng_init(iv); legic_prng_init(iv);
frame_clean(&current_frame); frame_clean(&current_frame);
frame_receive_rwd(&current_frame, 6, 1); frame_receive_rwd(&current_frame, 6, 1);
// we wait anyways // we wait anyways
legic_prng_forward(3); legic_prng_forward(3);
WAIT_387 WAIT(387)
frame_send_rwd(0x39, 6); // Send obsfuscated acknowledgment frame.
// 0x19 = MIM22
// 0x39 = MIM256, MIM1024
if ( current_frame.data == 0x0D ){
frame_send_rwd(0x19, 6);
}else{
frame_send_rwd(0x39, 6);
}
return current_frame.data; return current_frame.data;
} }
@ -371,46 +397,35 @@ static void switch_off_tag_rwd(void) {
WDT_HIT(); WDT_HIT();
} }
/* calculate crc for a legic command */ // calculate crc4 for a legic READ command
static int LegicCRC(int byte_index, int value, int cmd_sz) { // 5,8,10 address size.
static int LegicCRC(uint16_t byte_index, uint8_t value, uint8_t cmd_sz) {
crc_clear(&legic_crc); crc_clear(&legic_crc);
crc_update(&legic_crc, 1, 1); /* CMD_READ */ crc_update(&legic_crc, LEGIC_READ, 1);
crc_update(&legic_crc, byte_index, cmd_sz-1); crc_update(&legic_crc, byte_index, cmd_sz-1);
crc_update(&legic_crc, value, 8); crc_update(&legic_crc, value, 8);
return crc_finish(&legic_crc); return crc_finish(&legic_crc);
} }
#define LEGIC_READ 0x01
#define LEGIC_WRITE 0x00
int legic_read_byte(int byte_index, int cmd_sz) { int legic_read_byte(int byte_index, int cmd_sz) {
int byte = 0, calcCrc = 0, crc = 0; int calcCrc = 0, crc = 0;
int cmd = 1 | (byte_index << 1); uint8_t byte = 0;
uint32_t cmd = (byte_index << 1) | LEGIC_READ;
uint8_t cmdbytes[2] = {cmd && 0xff, (cmd >> 8 ) & 0xFF};
uint32_t starttime = timer->TC_CV, endtime = 0;
WAIT_387 WAIT_387
// send // send read command
frame_send_rwd(cmd, cmd_sz); frame_send_rwd(cmd, cmd_sz);
// log
endtime = timer->TC_CV;
LogTrace(cmdbytes, 2, starttime, endtime, NULL, TRUE);
// clean
frame_clean(&current_frame); frame_clean(&current_frame);
starttime = timer->TC_CV; // receive
// read
frame_receive_rwd(&current_frame, 12, 1); frame_receive_rwd(&current_frame, 12, 1);
// log
endtime = timer->TC_CV;
cmdbytes[0] = current_frame.data & 0xff;
cmdbytes[1] = (current_frame.data >> 8) & 0xFF;
LogTrace(cmdbytes, 2, starttime, endtime, NULL, FALSE);
byte = current_frame.data & 0xff; byte = current_frame.data & 0xff;
calcCrc = LegicCRC(byte_index, byte, cmd_sz); calcCrc = LegicCRC(byte_index, byte, cmd_sz);
crc = (current_frame.data >> 8); crc = (current_frame.data >> 8);
@ -495,10 +510,7 @@ int LegicRfReader(int offset, int bytes, int iv) {
// ice_legic_setup(); // ice_legic_setup();
// ice_legic_select_card(); // ice_legic_select_card();
// return 0; // return 0;
int byte_index = 0, cmd_sz = 0, card_sz = 0;
int byte_index = 0, cmd_sz = 0, card_sz = 0;
iv = (iv <= 0 ) ? SESSION_IV : iv;
LegicCommonInit(); LegicCommonInit();
@ -1203,18 +1215,16 @@ static struct {
// } // }
static void UartReset() static void UartReset() {
{ Uart.byteCntMax = 3;
Uart.byteCntMax = MAX_FRAME_SIZE;
Uart.state = STATE_UNSYNCD; Uart.state = STATE_UNSYNCD;
Uart.byteCnt = 0; Uart.byteCnt = 0;
Uart.bitCnt = 0; Uart.bitCnt = 0;
Uart.posCnt = 0; Uart.posCnt = 0;
memset(Uart.output, 0x00, MAX_FRAME_SIZE); memset(Uart.output, 0x00, 3);
} }
// static void UartInit(uint8_t *data) // static void UartInit(uint8_t *data) {
// {
// Uart.output = data; // Uart.output = data;
// UartReset(); // UartReset();
// } // }
@ -1450,7 +1460,7 @@ static void DemodReset() {
Demod.bitCount = 0; Demod.bitCount = 0;
Demod.thisBit = 0; Demod.thisBit = 0;
Demod.shiftReg = 0; Demod.shiftReg = 0;
memset(Demod.output, 0x00, MAX_FRAME_SIZE); memset(Demod.output, 0x00, 3);
} }
static void DemodInit(uint8_t *data) { static void DemodInit(uint8_t *data) {
@ -1710,7 +1720,7 @@ void ice_legic_setup() {
// Signal field is on with the appropriate LED // Signal field is on with the appropriate LED
LED_D_ON(); LED_D_ON();
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
SpinDelay(200); SpinDelay(20);
// Start the timer // Start the timer
//StartCountSspClk(); //StartCountSspClk();