Proper LF tag emulation support

comparator that squares up cross_lo (ic5a, tlv3502) has 6 mv internal hysteresis per datasheet. but that's not enough to make carrier detect off that signal work. kind of a tricky way to do that anyways.

the loraw signal is no good as you say. i think the lopkd signal is what you want anyways, except it gets high pass filtered so it will always return to ~128 if there have been no transitions for a while, no matter what the absolute level. might be okay if the reader is doing manchester or something (so signal is zero-mean). signal will be really big compared to reader mode so everything will saturate but that's okay.

if it's not zero mean (or if period is slow vs. high pass time constant) then you could put some hysteresis on the lopkd signal in the fpga; should get big spikes up and down on the rising and falling edges of the signal from the reader. that's what they did for the hf tag simulation.

or do hysteresis in software i guess. the hf tags are too fast for that but should be okay for a few hundred k/s.

Ok, phew, I finally managed to get the Xilinx tools for Linux running. A few hints:

• The Proxmark3 uses a Spartan-II. Spartan-II support has been removed from ISE 11.1, you need to download 10.1. The Xilinx website will offer a link to the WebPack 10.1 download on the page for the 11.1 download. On http://www.xilinx.com/tools/webpack.htm click the "Download WebPack" link, jump through a few hoops and registrations until you've reached the entitlement center, then there's a link to download older versions in one of the corners.

• The WebPack does not support 64bit Linux, for unclear reasons. However, if you have some 32bit libraries installed (some 64bit distributions will offer them as compatibility packages), the installation works just fine if you have it believe to be running on a 32bit system:

$ linux32 ./setup

• After the installation is complete, in /opt/Xilinx/10.1/ by default, you get get /opt/Xilinx/10.1/ISE/settings32.sh and .../settings32.csh, you need to source these files before you can use the tools. Do not put them in your startup files, though. E.g. to run the main GUI use

$ . /opt/Xilinx/10.1/ISE/settings32.sh  # Note that there's a space between the . and the first /
$ ise

• I translated the shipped go.bat to a Makefile, for easier execution (you still need to source the settings32.sh before using the Makefile). It should even work on Windows, or if not should only need a few modifications to the defined variables to get to work (I can't test), with one exception: For some reason tools/rbt2c.pl has »local $/ = "\r\n";« from which the \r needs to be removed to work under Linux. I believe that it should still work without the \r under Windows, please advise.

UNAME := $(shell uname)

ifeq ($(UNAME), Linux)
WRAPPED_C_STREAM = ../armsrc/fpgaimg.c
TOOLS_DIR = ../tools/
XILINX_TOOLS_PREFIX =  
DELETE=rm -rf
else
WRAPPED_C_STREAM = ..\\armsrc\\fpgaimg.c
TOOLS_DIR = ..\\tools\\
XILINX_TOOLS_PREFIX=
DELETE=del /r
endif

all: fpga.ngc fpga.ngd fpga.ncd fpga-placed.ncd fpga.rbt $(WRAPPED_C_STREAM)
clean:
  $(DELETE) fpga.bgn  fpga.drc  fpga.ncd           fpga.ngd            fpga_par.xrpt    fpga-placed.pad      fpga-placed.par       fpga-placed.xpi   fpga_usage.xml  xlnx_auto_0.ise  xst.srp
  $(DELETE) fpga.bit  fpga.map  fpga.ngc           fpga_ngdbuild.xrpt  fpga.pcf         fpga-placed_pad.csv  fpga-placed.ptwx      fpga.rbt          xlnx_auto_0_xdb
  $(DELETE) fpga.bld  fpga.mrp  fpga.ngc_xst.xrpt  fpga.ngm            fpga-placed.ncd  fpga-placed_pad.txt  fpga-placed.unroutes  fpga_summary.xml  netlist.lst     xst

.PHONY: all clean

fpga.ngc: fpga.v fpga.ucf xst.scr util.v lo_simulate.v lo_read.v lo_passthru.v hi_simulate.v hi_read_tx.v hi_read_rx_xcorr.v hi_iso14443a.v
  $(DELETE) fpga.ngc
  $(XILINX_TOOLS_PREFIX)xst -ifn xst.scr

fpga.ngd: fpga.ngc
  $(DELETE) fpga.ngd
  $(XILINX_TOOLS_PREFIX)ngdbuild -aul -p xc2s30-6vq100 -nt timestamp -uc fpga.ucf fpga.ngc fpga.ngd

fpga.ncd: fpga.ngd
  $(DELETE) fpga.ncd
  $(XILINX_TOOLS_PREFIX)map -p xc2s30-6vq100 fpga.ngd

fpga-placed.ncd: fpga.ncd
  $(DELETE) fpga-placed.ncd
  $(XILINX_TOOLS_PREFIX)par fpga.ncd fpga-placed.ncd

fpga.rbt: fpga-placed.ncd
  $(DELETE) fpga.bit fpga.drc fpga.rbt
  $(XILINX_TOOLS_PREFIX)bitgen -b fpga-placed.ncd fpga.bit

$(WRAPPED_C_STREAM): fpga.rbt
  perl $(TOOLS_DIR)rbt2c.pl fpga.rbt > $(WRAPPED_C_STREAM)

Moin,

Yes, I saw that code, but since it's actively powering the tag (e.g. acting as a reader) it's not useful for tag emulation. Instead I'm now modifying the lo_simulate.v code to output the received demodulated signal on SSP_FRAME and should have a proper Hitag2 type tag emulation by tomorrow.

Ok, here's the patch: http://www.ploetzli.ch/forumtst/proxmar … idir.patch

This adds:

• Defines in at91sam7s128.h for the Timer/Counter peripheral

• A new USB command CMD_LF_SIMULATE_BIDIR

• A new prox tool command losimbidir

• A function in lfops.c, triggered by this command, that will receive data from a Hitag2 reader and is capable of responding (for now, only the two most important frames to get tag detection working, but it's trivially extendable)

It modifies:

• fpga.v and lo_simulate.v to give the divisor into the lo_simulate block as an argument

• lo_simulate.v to use the SSP_FRAME signal (PA15 on the AT91SAM7) to carry a version of the ADC value with threshold and hysteresis.

• fpgaimg.c with the compiled bitstream code with the above modifications. This bitstream is backwards compatible with the existing bitstream, e.g. everything should still work. Obviously, for the new emulation code you need the new bitstream.