github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-21 05:43:48 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Merge pull request #2093 from d18c7db/master

Browse source 
Merged hi_reader and hi_reader_15 into one file, some minor tidy up in files
This commit is contained in:
Iceman 2023-08-24 20:38:09 +02:00 • committed by GitHub
commit aa0bd3ea17
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
22 changed files with 504 additions and 908 deletions
Download patch file Download diff file Expand all files Collapse all files

3
client/src/cmdhw.c
View file

@ -27,6 +27,7 @@
#include "comms.h"
#include "usart_defs.h"
#include "ui.h"
#include "fpga.h"
#include "cmdhw.h"
#include "cmddata.h"
#include "commonutil.h"
@ -1392,7 +1393,7 @@ void pm3_version(bool verbose, bool oneliner) {
}
}
PrintAndLogEx(NORMAL, payload->versionstr);
if (strstr(payload->versionstr, "2s30vq100") == NULL) {
if (strstr(payload->versionstr, FPGA_TYPE) == NULL) {
PrintAndLogEx(NORMAL, " FPGA firmware... %s", _RED_("chip mismatch"));
}

6
common_fpga/fpga.h
View file

@ -23,9 +23,11 @@
#define FPGA_BITSTREAM_FIXED_HEADER_SIZE sizeof(bitparse_fixed_header)
#define FPGA_INTERLEAVE_SIZE 288
#if defined XC3
#define FPGA_CONFIG_SIZE 72864L // our current fpga_[lh]f.bit files are 72742 bytes. Rounded up to next multiple of FPGA_INTERLEAVE_SIZE
#define FPGA_TYPE "3s100evq100"
#define FPGA_CONFIG_SIZE 72864L // FPGA .bit file rounded up to next multiple of FPGA_INTERLEAVE_SIZE
#else
#define FPGA_CONFIG_SIZE 42336L // our current fpga_[lh]f.bit files are 42175 bytes. Rounded up to next multiple of FPGA_INTERLEAVE_SIZE
#define FPGA_TYPE "2s30vq100"
#define FPGA_CONFIG_SIZE 42336L // FPGA .bit file rounded up to next multiple of FPGA_INTERLEAVE_SIZE
#endif
#define FPGA_RING_BUFFER_BYTES (1024 * 30)
#define FPGA_TRACE_SIZE 3072

1
fpga/Makefile
View file

@ -104,7 +104,6 @@ TARGET_COMMON_FILES += hi_flite.v
TARGET_COMMON_FILES += hi_get_trace.v
TARGET_COMMON_FILES += hi_iso14443a.v
TARGET_COMMON_FILES += hi_reader.v
TARGET_COMMON_FILES += hi_reader_15.v
TARGET_COMMON_FILES += hi_simulate.v
TARGET_COMMON_FILES += hi_sniffer.v
TARGET_COMMON_FILES += lf_edge_detect.v

2
fpga/clk_divider.v
View file

@ -22,7 +22,7 @@ module clk_divider(
);
reg [7:0] div_cnt_ = 0;
reg div_clk_;
reg div_clk_ = 0;
assign div_cnt = div_cnt_;
assign div_clk = div_clk_;

8
fpga/fpga_icopyx_hf.v
View file

@ -20,14 +20,6 @@
// frequency modes, the FPGA might perform some demodulation first, to
// reduce the amount of data that we must send to the ARM.
//-----------------------------------------------------------------------------
//`include "define.v"
//`include "hi_reader.v"
//`include "hi_simulate.v"
//`include "hi_iso14443a.v"
//`include "hi_flite.v"
//`include "hi_sniffer.v"
//`include "hi_get_trace.v"
module fpga_hf(
input spck,

15
fpga/fpga_icopyx_lf.v
View file

@ -20,13 +20,6 @@
// frequency modes, the FPGA might perform some demodulation first, to
// reduce the amount of data that we must send to the ARM.
//-----------------------------------------------------------------------------
//`include "define.v"
//`include "lo_read.v"
//`include "lo_passthru.v"
//`include "lo_edge_detect.v"
//`include "lo_adc.v"
//`include "clk_divider.v"
module fpga_lf(
input spck,
@ -78,7 +71,13 @@ reg [7:0] lf_ed_threshold;
wire [7:0] pck_cnt;
wire pck_divclk;
reg [7:0] divisor;
clk_divider div_clk(pck0, divisor, pck_cnt, pck_divclk);
clk_divider div_clk(
.clk (pck0),
.divisor (divisor),
.div_cnt (pck_cnt),
.div_clk (pck_divclk)
);
// We switch modes between transmitting to the 13.56 MHz tag and receiving
// from it, which means that we must make sure that we can do so without

5
fpga/fpga_icopyx_top.v
View file

@ -20,11 +20,6 @@
// frequency modes, the FPGA might perform some demodulation first, to
// reduce the amount of data that we must send to the ARM.
//-----------------------------------------------------------------------------
//`include "fpga_lf.v"
//`include "fpga_hf.v"
//`include "mux2_onein.v"
//`include "mux2_oneout.v"
//`include "util.v"
module fpga_top(
input spck,

23
fpga/fpga_pm3_top.v
View file

@ -20,18 +20,8 @@
// frequency modes, the FPGA might perform some demodulation first, to
// reduce the amount of data that we must send to the ARM.
//-----------------------------------------------------------------------------
/*
Once upon a time the FPGA had a 16 input mux so we could have all LF and HF modules enabled and selectable
As the functionality grew, we run out of space in the FPGA and we had to split into an "LF only" and an "HF only" FPGA bitstream
But even then after a while it was not possible to fit all the HF functions at the same time so now we have multiple "HF only" bitstreams
For example "Felica but without ISO14443", or "ISO14443 but without Felica" or "HF_15 but without Felica and ISO14443"
Because of all of the above, you can not enable both HF and LF modes at the same time, because some LF modules outputs
map to the same mux inputs as some HF modules outputs (thanks to reducing the mux from 16 to 8 inputs) and you can not have
multiple outputs connected together therefore leading to a failed compilation
*/
// These defines are meant to be passed by the Makefile so do not uncomment them here
// These defines are for reference only, they are passed by the Makefile so do not uncomment them here
// Proxmark3 RDV4 target
//`define PM3RDV4
// Proxmark3 generic target
@ -64,20 +54,13 @@ multiple outputs connected together therefore leading to a failed compilation
// WITH_HF5 enables module get trace
//`define WITH_HF5
//`include "define.v"
//`include "util.v"
//
//`ifdef WITH_LF `include "clk_divider.v" `endif
//`ifdef WITH_LF0 `include "lo_read.v" `endif
//`ifdef WITH_LF1 `include "lo_edge_detect.v" `endif
//`ifdef WITH_LF2 `include "lo_passthru.v" `endif
//`ifdef WITH_LF3 `include "lo_adc.v" `endif
//
//`ifdef WITH_HF_15
//`ifdef WITH_HF0 `include "hi_reader_15.v" `endif
//`else
//`ifdef WITH_HF0 `include "hi_reader.v" `endif
//`endif
//`ifdef WITH_HF1 `include "hi_simulate.v" `endif
//`ifdef WITH_HF2 `include "hi_iso14443a.v" `endif
//`ifdef WITH_HF3 `include "hi_sniffer.v" `endif
@ -277,11 +260,7 @@ assign mux6_pwr_lo = 1'b1;
// HF reader
`ifdef WITH_HF0
`ifdef WITH_HF_15
hi_reader_15 hr(
`else
hi_reader hr(
`endif
.ck_1356meg (ck_1356megb),
.adc_d (adc_d),
.subcarrier_frequency (conf_word[5:4]),

6
fpga/hi_flite.v
View file

@ -144,7 +144,6 @@ reg[7:0] mid = 8'd128;
// reg sending = 1'b0; // are we actively modulating?
reg [11:0] bit_counts = 12'd0; // for timeslots. only support ts=0 for now, at 212 speed -512 fullbits from end of frame. One hopes. might remove those?
//we need some way to flush bit_counts triggers on mod_type changes don't compile
reg dlay;
always @(negedge adc_clk) // every data ping?
@ -276,7 +275,6 @@ begin
end
end
if (try_sync && tsinceedge < 128)
begin
//detect bits in their middle ssp sampling is in sync, so it would sample all bits in order
@ -309,7 +307,6 @@ begin
mid <= 8'd127;
end
end
end
else
begin
@ -340,9 +337,6 @@ begin
end
end
end
else
begin
end
// sending <= 0;
end

3
fpga/hi_get_trace.v
View file

@ -13,7 +13,6 @@
//
// See LICENSE.txt for the text of the license.
//-----------------------------------------------------------------------------
//`include "define.v"
module hi_get_trace(
input ck_1356megb,
@ -112,7 +111,6 @@ begin
end
end
// (2+1)k RAM
reg [7:0] D_out1, D_out2;
reg [7:0] ram1 [2047:0]; // 2048 u8
@ -136,7 +134,6 @@ begin
D_out2 <= ram2[addr[9:0]];
end
reg [7:0] shift_out;
always @(negedge ck_1356megb)

16
fpga/hi_iso14443a.v
View file

@ -14,7 +14,6 @@
// See LICENSE.txt for the text of the license.
//-----------------------------------------------------------------------------
// ISO14443-A support for the Proxmark III
//`include "define.v"
module hi_iso14443a(
input ck_1356meg,
@ -105,8 +104,6 @@ begin
end
end
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// Tag -> PM3
// filter the input for a tag's signal. The filter box needs the 4 previous input values and is a gaussian derivative filter
@ -133,7 +130,6 @@ wire [9:0] tmp2 = adc_d_times_2 + input_prev_1;
// convert intermediate signals to signed and calculate the filter output
wire signed [10:0] adc_d_filtered = {1'b0, tmp1} - {1'b0, tmp2};
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// internal FPGA timing. Maximum required period is 128 carrier clock cycles for a full 8 Bit transfer to ARM. (i.e. we need a
// 7 bit counter). Adjust its frequency to external reader's clock when simulating a tag or sniffing.
@ -177,7 +173,6 @@ begin
end
end
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// Tag -> PM3:
// determine best possible time for starting/resetting the modulation detector.
@ -209,7 +204,6 @@ begin
end
end
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// Tag -> PM3:
// modulation detector. Looks for the steepest falling and rising edges within a 16 clock period. If there is both a significant
@ -265,7 +259,6 @@ begin
end
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// Tag+Reader -> PM3
// sample 4 bits reader data and 4 bits tag data for sniffing
@ -281,7 +274,6 @@ begin
end
end
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// PM3 -> Reader:
// a delay line to ensure that we send the (emulated) tag's answer at the correct time according to ISO14443-3
@ -304,7 +296,6 @@ begin
end
end
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// PM3 -> Reader, internal timing:
// a timer for the 1172 cycles fdt (Frame Delay Time). Start the timer with a rising edge of the reader's signal.
@ -367,7 +358,6 @@ begin
if(fdt_counter == `FDT_INDICATOR_COUNT) fdt_indicator <= 1'b1;
end
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// PM3 -> Reader or Tag
// assign a modulation signal to the antenna. This signal is either a delayed signal (to achieve fdt when sending to a reader)
@ -396,7 +386,6 @@ begin
end
end
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// PM3 -> Reader
// determine the required delay in the mod_sig_buf (set mod_sig_ptr).
@ -439,7 +428,6 @@ begin
end
end
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// FPGA -> ARM communication:
// buffer 8 bits data to be sent to ARM. Shift them out bit by bit.
@ -483,10 +471,8 @@ begin
to_arm[7:1] <= to_arm[6:0];
end
end
end
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// FPGA <-> ARM communication:
// generate a ssp clock and ssp frame signal for the synchronous transfer from/to the ARM
@ -521,7 +507,6 @@ begin
end
end
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// FPGA -> ARM communication:
// select the data to be sent to ARM
@ -566,7 +551,6 @@ assign sub_carrier = ~sub_carrier_cnt[3];
// in FPGA_HF_ISO14443A_READER_LISTEN: carrier always on; in other modes: carrier always off
assign pwr_hi = (ck_1356meg & (((mod_type == `FPGA_HF_ISO14443A_READER_MOD) & ~mod_sig_coil) || (mod_type == `FPGA_HF_ISO14443A_READER_LISTEN)));
// Enable HF antenna drivers:
assign pwr_oe1 = 1'b0;
assign pwr_oe3 = 1'b0;

132
fpga/hi_reader.v
View file

@ -13,7 +13,7 @@
//
// See LICENSE.txt for the text of the license.
//-----------------------------------------------------------------------------
//`include "define.v"
// with optional support for iso15 2sc mode slected with compiler define WITH_HF_15
module hi_reader(
input ck_1356meg,
@ -63,7 +63,6 @@ begin
end
end
// Let us report a correlation every 64 samples. I.e.
// one Q/I pair after 4 subcarrier cycles for the 848kHz subcarrier,
// one Q/I pair after 2 subcarrier cycles for the 424kHz subcarriers,
@ -71,10 +70,105 @@ end
// We need a 6-bit counter for the timing.
reg [5:0] corr_i_cnt;
always @(negedge adc_clk)
begin
corr_i_cnt <= corr_i_cnt + 1;
end
`ifdef WITH_HF_15
reg [1:0] fskout = 2'd0;
reg last0 = 1'b0;
reg [7:0] avg = 8'd0;
reg [127:0] avg128 = 128'd0;
reg [7:0] diff16 = 8'd0;
reg [7:0] diff28 = 8'd0;
reg [7:0] diff32 = 8'd0;
reg [11:0] match16 = 12'd0;
reg [11:0] match32 = 12'd0;
reg [11:0] match28 = 12'd0;
always @(negedge adc_clk)
begin
if (corr_i_cnt[0] == 1'b0) // every 2 clock
avg = adc_d[7:1];
else
begin
avg = avg + adc_d[7:1];
if (corr_i_cnt[0] == 1'b1) // every 2 clock
begin
if (avg > avg128[63:56])
diff16 = avg - avg128[63:56];
else
diff16 = avg128[63:56] - avg;
if (avg > avg128[111:104])
diff28 = avg - avg128[111:104];
else
diff28 = avg128[111:104] - avg;
if (avg > avg128[127:120])
diff32 = avg - avg128[127:120];
else
diff32 = avg128[127:120] - avg;
avg128[127:8] = avg128[119:0];
avg128[7:0] = avg;
if (corr_i_cnt[4:1] == 4'b0000) // every 32 clock (8*4)
begin
match16 = diff16;
match28 = diff28;
match32 = diff32;
end
else
begin
match16 = match16 + diff16;
match28 = match28 + diff28;
match32 = match32 + diff32;
if (corr_i_cnt[4:1] == 4'b1111) // every 32 clock (8*4)
begin
last0 = (fskout == 2'b0);
if (match16 < 12'd64 && last0)
fskout = 2'b00; // not yet started
else if ((match16 | match28 | match32) == 12'b0)
fskout = 2'b00; // signal likely ended
else if (((match16 <= match28 + 12'd16) && (match16 <= match32+ 12'd16)) ||
(match28 <= 12'd16 && match32 <= 12'd16))
begin
if (!last0)
fskout = 2'b11; // 16 match better than 28 or 32 but already started
end
else
begin
if (match28 < match32)
begin
diff28 = match32 - match28;
diff16 = match16 - match28;
if (diff28*2 > diff16)
fskout = 2'b01;
else if (!last0)
begin
fskout = 2'b01;
end
end
else //if (match32 <= match28)
begin
diff32 = match28 - match32;
diff16 = match16 - match32;
if (diff32*2 > diff16)
fskout = 2'b10;
else if (!last0)
begin
fskout = 2'b10;
end
end
end
end
end
end
end
end
`endif
// A couple of registers in which to accumulate the correlations. From the 64 samples
// we would add at most 32 times the difference between unmodulated and modulated signal. It should
@ -89,7 +183,6 @@ reg signed [13:0] corr_q_accum;
reg signed [7:0] corr_i_out;
reg signed [7:0] corr_q_out;
// the amplitude of the subcarrier is sqrt(ci^2 + cq^2).
// approximate by amplitude = max(|ci|,|cq|) + 1/2*min(|ci|,|cq|)
reg [13:0] corr_amplitude, abs_ci, abs_cq, max_ci_cq;
@ -122,7 +215,6 @@ begin
end
// The subcarrier reference signals
reg subcarrier_I;
reg subcarrier_Q;
@ -146,7 +238,6 @@ begin
end
end
// ADC data appears on the rising edge, so sample it on the falling edge
always @(negedge adc_clk)
begin
@ -157,10 +248,21 @@ begin
begin
if (minor_mode == `FPGA_HF_READER_MODE_SNIFF_AMPLITUDE)
begin
`ifdef WITH_HF_15
if (subcarrier_frequency == `FPGA_HF_READER_2SUBCARRIERS_424_484_KHZ)
begin
// send amplitude + 2 bits fsk (2sc) signal + 2 bits reader signal
corr_i_out <= corr_amplitude[13:6];
corr_q_out <= {corr_amplitude[5:2], fskout, after_hysteresis_prev_prev, after_hysteresis_prev};
end
else
`endif
begin
// send amplitude plus 2 bits reader signal
corr_i_out <= corr_amplitude[13:6];
corr_q_out <= {corr_amplitude[5:0], after_hysteresis_prev_prev, after_hysteresis_prev};
end
end
else if (minor_mode == `FPGA_HF_READER_MODE_SNIFF_IQ)
begin
// Send 7 most significant bits of in phase tag signal (signed), plus 1 bit reader signal
@ -183,13 +285,23 @@ begin
end
else if (minor_mode == `FPGA_HF_READER_MODE_RECEIVE_AMPLITUDE)
begin
`ifdef WITH_HF_15
if (subcarrier_frequency == `FPGA_HF_READER_2SUBCARRIERS_424_484_KHZ)
begin
// send 2 bits fsk (2sc) signal + amplitude
corr_i_out <= {fskout, corr_amplitude[13:8]};
corr_q_out <= corr_amplitude[7:0];
end
else
`endif
begin
// send amplitude
corr_i_out <= {2'b00, corr_amplitude[13:8]};
corr_q_out <= corr_amplitude[7:0];
end
end
else if (minor_mode == `FPGA_HF_READER_MODE_RECEIVE_IQ)
begin
// Send 8 bits of in phase tag signal
if (corr_i_accum[13:11] == 3'b000 || corr_i_accum[13:11] == 3'b111)
corr_i_out <= corr_i_accum[11:4];
@ -251,7 +363,6 @@ begin
end
// ssp clock and frame signal for communication to and from ARM
// _____ _____ _____ _
// ssp_clk | |_____| |_____| |_____|
@ -262,7 +373,6 @@ end
//
// corr_i_cnt 0 1 2 3 4 5 6 7 8 9 10 11 12 ...
//
always @(negedge adc_clk)
begin
if (corr_i_cnt[1:0] == 2'b00)
@ -280,10 +390,8 @@ begin
ssp_frame <= 1'b0;
end
assign ssp_din = corr_i_out[7];
// a jamming signal
reg jam_signal;
reg [3:0] jam_counter;

459
fpga/hi_reader_15.v
View file

@ -1,459 +0,0 @@
//-----------------------------------------------------------------------------
// Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// See LICENSE.txt for the text of the license.
//-----------------------------------------------------------------------------
// modified to add support for iso15 2sc mode
module hi_reader_15(
input ck_1356meg,
input [7:0] adc_d,
input [1:0] subcarrier_frequency,
input [3:0] minor_mode,
input ssp_dout,
output ssp_din,
output reg ssp_frame,
output reg ssp_clk,
output adc_clk,
output pwr_lo,
output reg pwr_hi,
output pwr_oe1,
output pwr_oe2,
output pwr_oe3,
output reg pwr_oe4,
output debug
);
assign adc_clk = ck_1356meg; // sample frequency is 13,56 MHz
// When we're a reader, we just need to do the BPSK demod; but when we're an
// eavesdropper, we also need to pick out the commands sent by the reader,
// using AM. Do this the same way that we do it for the simulated tag.
reg after_hysteresis, after_hysteresis_prev, after_hysteresis_prev_prev;
reg [11:0] has_been_low_for;
always @(negedge adc_clk)
begin
if (& adc_d[7:0]) after_hysteresis <= 1'b1;
else if (~(| adc_d[7:0])) after_hysteresis <= 1'b0;
if (after_hysteresis)
begin
has_been_low_for <= 12'd0;
end
else
begin
if (has_been_low_for == 12'd4095)
begin
has_been_low_for <= 12'd0;
after_hysteresis <= 1'b1;
end
else
has_been_low_for <= has_been_low_for + 1;
end
end
// Let us report a correlation every 64 samples. I.e.
// one Q/I pair after 4 subcarrier cycles for the 848kHz subcarrier,
// one Q/I pair after 2 subcarrier cycles for the 424kHz subcarriers,
// one Q/I pair for each subcarrier cyle for the 212kHz subcarrier.
// We need a 6-bit counter for the timing.
reg [5:0] corr_i_cnt;
always @(negedge adc_clk)
begin
corr_i_cnt <= corr_i_cnt + 1;
end
reg [1:0] fskout = 2'd0;
reg last0 = 1'b0;
reg [7:0] avg = 8'd0;
reg [127:0] avg128 = 128'd0;
reg [7:0] diff16 = 8'd0;
reg [7:0] diff28 = 8'd0;
reg [7:0] diff32 = 8'd0;
reg [11:0] match16 = 12'd0;
reg [11:0] match32 = 12'd0;
reg [11:0] match28 = 12'd0;
always @(negedge adc_clk)
begin
if (corr_i_cnt[0] == 1'b0) // every 2 clock
begin
avg = adc_d[7:1];
end
else
begin
avg = avg + adc_d[7:1];
if (corr_i_cnt[0] == 1'b1) // every 2 clock
begin
if (avg > avg128[63:56])
diff16 = avg - avg128[63:56];
else
diff16 = avg128[63:56] - avg;
if (avg > avg128[111:104])
diff28 = avg - avg128[111:104];
else
diff28 = avg128[111:104] - avg;
if (avg > avg128[127:120])
diff32 = avg - avg128[127:120];
else
diff32 = avg128[127:120] - avg;
avg128[127:8] = avg128[119:0];
avg128[7:0] = avg;
if (corr_i_cnt[4:1] == 4'b0000) // every 32 clock (8*4)
begin
match16 = diff16;
match28 = diff28;
match32 = diff32;
end
else
begin
match16 = match16 + diff16;
match28 = match28 + diff28;
match32 = match32 + diff32;
if (corr_i_cnt[4:1] == 4'b1111) // every 32 clock (8*4)
begin
last0 = (fskout == 2'b0);
if (match16 < 12'd64 && last0)
fskout = 2'b00; // not yet started
else if ((match16 | match28 | match32) == 12'b0)
fskout = 2'b00; // signal likely ended
else if (((match16 <= match28 + 12'd16) && (match16 <= match32+ 12'd16)) ||
(match28 <= 12'd16 && match32 <= 12'd16))
begin
if (!last0)
fskout = 2'b11; // 16 match better than 28 or 32 but already started
end
else
begin
if (match28 < match32)
begin
diff28 = match32 - match28;
diff16 = match16 - match28;
if (diff28*2 > diff16)
fskout = 2'b01;
else if (!last0)
begin
fskout = 2'b01;
end
end
else //if (match32 <= match28)
begin
diff32 = match28 - match32;
diff16 = match16 - match32;
if (diff32*2 > diff16)
fskout = 2'b10;
else if (!last0)
begin
fskout = 2'b10;
end
end
end
end
end
end
end
end
// A couple of registers in which to accumulate the correlations. From the 64 samples
// we would add at most 32 times the difference between unmodulated and modulated signal. It should
// be safe to assume that a tag will not be able to modulate the carrier signal by more than 25%.
// 32 * 255 * 0,25 = 2040, which can be held in 11 bits. Add 1 bit for sign.
// Temporary we might need more bits. For the 212kHz subcarrier we could possible add 32 times the
// maximum signal value before a first subtraction would occur. 32 * 255 = 8160 can be held in 13 bits.
// Add one bit for sign -> need 14 bit registers but final result will fit into 12 bits.
reg signed [13:0] corr_i_accum;
reg signed [13:0] corr_q_accum;
// we will report maximum 8 significant bits
reg signed [7:0] corr_i_out;
reg signed [7:0] corr_q_out;
// the amplitude of the subcarrier is sqrt(ci^2 + cq^2).
// approximate by amplitude = max(|ci|,|cq|) + 1/2*min(|ci|,|cq|)
reg [13:0] corr_amplitude, abs_ci, abs_cq, max_ci_cq;
reg [12:0] min_ci_cq_2; // min_ci_cq / 2
always @(*)
begin
if (corr_i_accum[13] == 1'b0)
abs_ci <= corr_i_accum;
else
abs_ci <= -corr_i_accum;
if (corr_q_accum[13] == 1'b0)
abs_cq <= corr_q_accum;
else
abs_cq <= -corr_q_accum;
if (abs_ci > abs_cq)
begin
max_ci_cq <= abs_ci;
min_ci_cq_2 <= abs_cq / 2;
end
else
begin
max_ci_cq <= abs_cq;
min_ci_cq_2 <= abs_ci / 2;
end
corr_amplitude <= max_ci_cq + min_ci_cq_2;
end
// The subcarrier reference signals
reg subcarrier_I;
reg subcarrier_Q;
always @(*)
begin
if (subcarrier_frequency == `FPGA_HF_READER_SUBCARRIER_848_KHZ)
begin
subcarrier_I = ~corr_i_cnt[3];
subcarrier_Q = ~(corr_i_cnt[3] ^ corr_i_cnt[2]);
end
else if (subcarrier_frequency == `FPGA_HF_READER_SUBCARRIER_212_KHZ)
begin
subcarrier_I = ~corr_i_cnt[5];
subcarrier_Q = ~(corr_i_cnt[5] ^ corr_i_cnt[4]);
end
else
begin // 424 kHz
subcarrier_I = ~corr_i_cnt[4];
subcarrier_Q = ~(corr_i_cnt[4] ^ corr_i_cnt[3]);
end
end
// ADC data appears on the rising edge, so sample it on the falling edge
always @(negedge adc_clk)
begin
// These are the correlators: we correlate against in-phase and quadrature
// versions of our reference signal, and keep the (signed) results or the
// resulting amplitude to send out later over the SSP.
if (corr_i_cnt == 6'd0)
begin
if (minor_mode == `FPGA_HF_READER_MODE_SNIFF_AMPLITUDE)
begin
if (subcarrier_frequency == `FPGA_HF_READER_2SUBCARRIERS_424_484_KHZ)
begin
// send amplitude + 2 bits fsk (2sc) signal + 2 bits reader signal
corr_i_out <= corr_amplitude[13:6];
corr_q_out <= {corr_amplitude[5:2], fskout, after_hysteresis_prev_prev, after_hysteresis_prev};
end
else
begin
// send amplitude plus 2 bits reader signal
corr_i_out <= corr_amplitude[13:6];
corr_q_out <= {corr_amplitude[5:0], after_hysteresis_prev_prev, after_hysteresis_prev};
end
end
else if (minor_mode == `FPGA_HF_READER_MODE_SNIFF_IQ)
begin
// Send 7 most significant bits of in phase tag signal (signed), plus 1 bit reader signal
if (corr_i_accum[13:11] == 3'b000 || corr_i_accum[13:11] == 3'b111)
corr_i_out <= {corr_i_accum[11:5], after_hysteresis_prev_prev};
else // truncate to maximum value
if (corr_i_accum[13] == 1'b0)
corr_i_out <= {7'b0111111, after_hysteresis_prev_prev};
else
corr_i_out <= {7'b1000000, after_hysteresis_prev_prev};
// Send 7 most significant bits of quadrature phase tag signal (signed), plus 1 bit reader signal
if (corr_q_accum[13:11] == 3'b000 || corr_q_accum[13:11] == 3'b111)
corr_q_out <= {corr_q_accum[11:5], after_hysteresis_prev};
else // truncate to maximum value
if (corr_q_accum[13] == 1'b0)
corr_q_out <= {7'b0111111, after_hysteresis_prev};
else
corr_q_out <= {7'b1000000, after_hysteresis_prev};
end
else if (minor_mode == `FPGA_HF_READER_MODE_RECEIVE_AMPLITUDE)
begin
if (subcarrier_frequency == `FPGA_HF_READER_2SUBCARRIERS_424_484_KHZ)
begin
// send 2 bits fsk (2sc) signal + amplitude
corr_i_out <= {fskout, corr_amplitude[13:8]};
corr_q_out <= corr_amplitude[7:0];
end
else
begin
// send amplitude
corr_i_out <= {2'b00, corr_amplitude[13:8]};
corr_q_out <= corr_amplitude[7:0];
end
end
else if (minor_mode == `FPGA_HF_READER_MODE_RECEIVE_IQ)
begin
// Send 8 bits of in phase tag signal
if (corr_i_accum[13:11] == 3'b000 || corr_i_accum[13:11] == 3'b111)
corr_i_out <= corr_i_accum[11:4];
else // truncate to maximum value
if (corr_i_accum[13] == 1'b0)
corr_i_out <= 8'b01111111;
else
corr_i_out <= 8'b10000000;
// Send 8 bits of quadrature phase tag signal
if (corr_q_accum[13:11] == 3'b000 || corr_q_accum[13:11] == 3'b111)
corr_q_out <= corr_q_accum[11:4];
else // truncate to maximum value
if (corr_q_accum[13] == 1'b0)
corr_q_out <= 8'b01111111;
else
corr_q_out <= 8'b10000000;
end
// for each Q/I pair report two reader signal samples when sniffing. Store the 1st.
after_hysteresis_prev_prev <= after_hysteresis;
// Initialize next correlation.
// Both I and Q reference signals are high when corr_i_nct == 0. Therefore need to accumulate.
corr_i_accum <= $signed({1'b0, adc_d});
corr_q_accum <= $signed({1'b0, adc_d});
end
else
begin
if (subcarrier_I)
corr_i_accum <= corr_i_accum + $signed({1'b0, adc_d});
else
corr_i_accum <= corr_i_accum - $signed({1'b0, adc_d});
if (subcarrier_Q)
corr_q_accum <= corr_q_accum + $signed({1'b0, adc_d});
else
corr_q_accum <= corr_q_accum - $signed({1'b0, adc_d});
end
// for each Q/I pair report two reader signal samples when sniffing. Store the 2nd.
if (corr_i_cnt == 6'd32)
after_hysteresis_prev <= after_hysteresis;
// Then the result from last time is serialized and send out to the ARM.
// We get one report each cycle, and each report is 16 bits, so the
// ssp_clk should be the adc_clk divided by 64/16 = 4.
// ssp_clk frequency = 13,56MHz / 4 = 3.39MHz
if (corr_i_cnt[1:0] == 2'b00)
begin
// Don't shift if we just loaded new data, obviously.
if (corr_i_cnt != 6'd0)
begin
corr_i_out[7:0] <= {corr_i_out[6:0], corr_q_out[7]};
corr_q_out[7:1] <= corr_q_out[6:0];
end
end
end
// ssp clock and frame signal for communication to and from ARM
// _____ _____ _____ _
// ssp_clk | |_____| |_____| |_____|
// _____
// ssp_frame ___| |____________________________
// ___________ ___________ ___________ _
// ssp_d_in X___________X___________X___________X_
//
// corr_i_cnt 0 1 2 3 4 5 6 7 8 9 10 11 12 ...
//
always @(negedge adc_clk)
begin
if (corr_i_cnt[1:0] == 2'b00)
ssp_clk <= 1'b1;
if (corr_i_cnt[1:0] == 2'b10)
ssp_clk <= 1'b0;
// set ssp_frame signal for corr_i_cnt = 1..3
// (send one frame with 16 Bits)
if (corr_i_cnt == 6'd1)
ssp_frame <= 1'b1;
if (corr_i_cnt == 6'd3)
ssp_frame <= 1'b0;
end
assign ssp_din = corr_i_out[7];
// a jamming signal
reg jam_signal;
reg [3:0] jam_counter;
always @(negedge adc_clk)
begin
if (corr_i_cnt == 6'd0)
begin
jam_counter <= jam_counter + 1;
jam_signal <= jam_counter[1] ^ jam_counter[3];
end
end
always @(*)
begin
if (minor_mode == `FPGA_HF_READER_MODE_SEND_SHALLOW_MOD)
begin
pwr_hi = ck_1356meg;
pwr_oe4 = ssp_dout;
end
else if (minor_mode == `FPGA_HF_READER_MODE_SEND_FULL_MOD)
begin
pwr_hi = ck_1356meg & ~ssp_dout;
pwr_oe4 = 1'b0;
end
else if (minor_mode == `FPGA_HF_READER_MODE_SEND_JAM)
begin
pwr_hi = ck_1356meg & jam_signal;
pwr_oe4 = 1'b0;
end
else if (minor_mode == `FPGA_HF_READER_MODE_SNIFF_IQ
|| minor_mode == `FPGA_HF_READER_MODE_SNIFF_AMPLITUDE
|| minor_mode == `FPGA_HF_READER_MODE_SNIFF_PHASE)
begin // all off
pwr_hi = 1'b0;
pwr_oe4 = 1'b0;
end
else // receiving from tag
begin
pwr_hi = ck_1356meg;
pwr_oe4 = 1'b0;
end
end
// always on
assign pwr_oe1 = 1'b0;
assign pwr_oe3 = 1'b0;
// Unused.
assign pwr_lo = 1'b0;
assign pwr_oe2 = 1'b0;
// Debug Output
assign debug = corr_i_cnt[3];
endmodule

6
fpga/hi_simulate.v
View file

@ -30,7 +30,6 @@
//
// Jonathan Westhues, October 2006
//-----------------------------------------------------------------------------
//`include "define.v"
module hi_simulate(
input ck_1356meg,
@ -89,7 +88,6 @@ begin
end
end
// Divide 13.56 MHz to produce various frequencies for SSP_CLK
// and modulation.
reg [8:0] ssp_clk_divider;
@ -110,7 +108,6 @@ begin
ssp_clk <= ~ssp_clk_divider[4];
end
// Produce the byte framing signal; the phase of this signal
// is arbitrary, because it's just a bit stream in this module.
always @(negedge adc_clk)
@ -131,7 +128,6 @@ begin
end
end
// Synchronize up the after-hysteresis signal, to produce DIN.
always @(posedge ssp_clk)
ssp_din = after_hysteresis;
@ -150,8 +146,6 @@ always @(*)
else
modulating_carrier <= 1'b0; // yet unused
// Load modulation. Toggle only one of these, since we are already producing much deeper
// modulation than a real tag would.
assign pwr_oe1 = 1'b0; // 33 Ohms Load

7
fpga/lf_edge_detect.v
View file

@ -1,4 +1,3 @@
//-----------------------------------------------------------------------------
// Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
//
@ -15,9 +14,6 @@
// See LICENSE.txt for the text of the license.
//-----------------------------------------------------------------------------
// input clk is 24MHz
//`include "min_max_tracker.v"
module lf_edge_detect(
input clk,
input [7:0] adc_d,
@ -85,7 +81,8 @@ module lf_edge_detect(
begin
output_edge <= ~output_edge;
trigger_enabled <= 0;
end else
end
else
trigger_enabled <= trigger_enabled | is_zero;
end

3
fpga/lo_edge_detect.v
View file

@ -25,9 +25,6 @@
// - ssp_frame (wired to TIOA1 on the arm) for the edge detection/state
// - ssp_clk: cross_lo
//`include "lp20khz_1MSa_iir_filter.v"
//`include "lf_edge_detect.v"
module lo_edge_detect(
input pck0,
input pck_divclk,

5
fpga/lo_read.v
View file

@ -73,14 +73,15 @@ end
// _ _ _ _ _ _ _ _ _ _
// ssp_clk |_| |_| |_| |_| |_| |_| |_| |_| |_| |_
// serialized SSP data is gated by ant_lo to suppress unwanted signal
// serialized SSP data is gated by pck_divclk to suppress unwanted signal
assign ssp_din = to_arm_shiftreg[7] && !pck_divclk;
// SSP clock always runs at 24MHz
assign ssp_clk = pck0;
// SSP frame is gated by ant_lo and goes high when pck_divider=8..15
// SSP frame is gated by pck_divclk and goes high when pck_cnt=8..15
assign ssp_frame = (pck_cnt[7:3] == 5'd1) && !pck_divclk;
// unused signals tied low
assign pwr_hi = 1'b0;
// always on outputs, unused
assign pwr_oe1 = 1'b0;
assign pwr_oe2 = 1'b0;
assign pwr_oe3 = 1'b0;

3
fpga/mux16.v
View file

@ -13,9 +13,6 @@
//
// See LICENSE.txt for the text of the license.
//-----------------------------------------------------------------------------
//
// General-purpose miscellany.
//
// 16 inputs to 1 output multiplexer
module mux16(

15
fpga/mux2_onein.v
View file

@ -1,9 +1,20 @@
//-----------------------------------------------------------------------------
// Two way MUX.
// Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
//
// kombi, 2020.05
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// See LICENSE.txt for the text of the license.
//-----------------------------------------------------------------------------
// 2 inputs to 1 output multiplexer
module mux2_one(
input [1:0] sel,
output reg y,

15
fpga/mux2_oneout.v
View file

@ -1,9 +1,20 @@
//-----------------------------------------------------------------------------
// Two way MUX.
// Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
//
// kombi, 2020.05
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// See LICENSE.txt for the text of the license.
//-----------------------------------------------------------------------------
// 1 input to 2 outputs multiplexer
module mux2_oneout(
input [1:0] sel,
input y,

3
fpga/mux8.v
View file

@ -13,9 +13,6 @@
//
// See LICENSE.txt for the text of the license.
//-----------------------------------------------------------------------------
//
// General-purpose miscellany.
//
// 8 inputs to 1 output multiplexer
module mux8(