proxmark3/armsrc/lfzx.c

//-----------------------------------------------------------------------------
// Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// See LICENSE.txt for the text of the license.
//-----------------------------------------------------------------------------
// Low frequency ZX8211 funtions
//-----------------------------------------------------------------------------
#include "lfzx.h"
#include "zx8211.h"

#include "BigBuf.h"
#include "crc.h"        // CRC-8 / Hitag1 / ZX8211
#include "fpgaloader.h"
#include "dbprint.h"
#include "lfops.h"      // turn_read_lf_on / off
#include "lfadc.h"
#include "lfsampling.h" // getSamplingConfig
#include "pm3_cmd.h"    // struct
#include "ticks.h"

/*
ZX8211

RWE to tag
----------
ASK w 100% modulation index
When power field is:
   off, its considered LOW field
   on,  its considered HIGH field


Binary Pulse Length Coding (BPLC)

ZERO = 8 off,  8 on  (14-22)
ONE  = 8 off, 28 on  (26-32)
EOF  = 8 off, 30 on  (38 or more)

Protection
----------
32bit read password
32bit write password

Config bits
-------------

Timings
-------

Tx = 8us = 1fc
*/

#define ZX_START_GAP        170
#define ZX_WAIT_GAP         90
#define ZX_GAP              8    // 4 - 10
#define ZX_T0               18
#define ZX_T0_MIN           14
#define ZX_T0_MAX           22
#define ZX_T1               28
#define ZX_T1_MIN           26
#define ZX_T1_MAX           32
#define ZX_TEOF             38
#define ZX_RESET_GAP        35000 // 35ms
#define ZX_RESPONSE_GAP     208

#define ZX_PROG             716
#define ZX_PROG_CT          4470

// TTF switch to RTF
#define ZX_SWITCH_RTF 350

// ZX commands
#define LF_ZX_GET_UID  0b00110
#define LF_ZX_READ
#define LF_ZX_WRITE


static void zx8211_setup_read(void) {

    FpgaDownloadAndGo(FPGA_BITSTREAM_LF);

    // Make sure the tag is reset
    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

    // use lf config settings
    sample_config *sc = getSamplingConfig();
    LFSetupFPGAForADC(sc->divisor, true);

    FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_ADC_READER_FIELD);

    // 50ms for the resonant antenna to settle.
    WaitMS(50);

    // Now set up the SSC to get the ADC samples that are now streaming at us.
    FpgaSetupSsc(FPGA_MAJOR_MODE_LF_READER);

    FpgaSendCommand(FPGA_CMD_SET_DIVISOR, LF_DIVISOR_125);

    // Connect the A/D to the peak-detected low-frequency path.
    SetAdcMuxFor(GPIO_MUXSEL_LOPKD);

    // Start the timer
    StartTicks();

    // Watchdog hit
    WDT_HIT();
}

static void zx_send(uint8_t *cmd, uint8_t clen) {

    if (clen == 0)
        return;

    turn_read_lf_on(ZX_START_GAP);

    // now start writing with bitbanging the antenna.
    while (clen-- > 0) {

        turn_read_lf_off(ZX_GAP * 8);

        if (((*cmd++) & 1) == 1) {
            turn_read_lf_on(ZX_T1 * 8);
        } else {
            turn_read_lf_on(ZX_T0 * 8);
        }
    }

    // send eof
    turn_read_lf_off(ZX_GAP * 8);
    turn_read_lf_on(ZX_TEOF * 8);
}

static void zx_get(bool ledcontrol) {

    while (BUTTON_PRESS() == false) {

        WDT_HIT();

        if (ledcontrol && (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY)) {
            LED_D_ON();
        }

        if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
            volatile uint8_t sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
            (void)sample;

            // Test point 8 (TP8) can be used to trigger oscilloscope
            if (ledcontrol) LED_D_OFF();

        }
    }
}

int zx8211_read(zx8211_data_t *zxd, bool ledcontrol) {
    zx8211_setup_read();

    // clear buffer now so it does not interfere with timing later
    BigBuf_Clear_ext(false);

    if (ledcontrol) LED_A_ON();

    // send GET_UID
    zx_send(NULL, 0);

    FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_ADC_READER_FIELD);

    zx_get(ledcontrol);

    //uint32_t cs = CRC8Hitag1(uint8_t *buff, size_t size);

    if (ledcontrol) LEDsoff();

    StopTicks();
    lf_finalize(ledcontrol);

    reply_ng(CMD_LF_ZX_READ, PM3_SUCCESS, NULL, 0);
    return PM3_SUCCESS;
}

int zx8211_write(zx8211_data_t *zxd, bool ledcontrol) {
    zx8211_setup_read();

    StopTicks();
    lf_finalize(ledcontrol);
    //reply_ng(CMD_LF_ZX_WRITE, status, tag.data, sizeof(tag.data));
    return PM3_SUCCESS;
}