mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-09-26 09:28:22 +00:00
iceman1001
ace5d63ff9
Simulation now completes the full exchange with a genuine Paxton reader in password mode, and crypto mode read/write passes Proxmark-to-Proxmark. Firmware: - SOF was one bit period short. The lead-in that compensated for the lost head half bit was removed and nothing replaced it, so readers rejected every answer with a second START_AUTH. Default is now 6. - The edge-detect threshold was latched before being measured, so the value chosen depended on whether the Proxmark was in a field when sim started. It is now measured on field entry and re-armed when the reader leaves. - The percentile walk latched on run-scoped variables, so one attempt made outside a field poisoned every later one. - Field loss was detected from TIMESTAMP, which is free-running MCU time and never stalls. Detect it from receive silence instead. - Frames of a length the protocol does not have no longer reach the state machine; our own modulation tail was resetting the session and breaking every write. - A dropped edge merges two or three reader bit periods into one gap. Those bits were discarded; they are now recovered by decomposition, which is what made crypto mode work (AUTH decode 15% -> 100%). - Threshold selection is limited to 20 and 32 and settles in under 25 ms. Client: - lf hitag info printed a hardcoded 0x06 and reported 'Password mode' for every tag. It now reads page 3, takes -k (4 bytes password, 6 bytes crypto), and says so when the config cannot be read. - lf hitag restore: writes a dump back in dependency order - user pages, then key material, then config last - validates the config byte, and prints the credential the tag will require afterwards. - lf hitag crack2 now reports why it failed instead of a bare 'fail'. - trace list: bit count moved to its own column, relative mode shows a Frame Delay Time row rather than renaming Start/End, --frame and -r rejected together.
89 lines
3.1 KiB
Verilog
89 lines
3.1 KiB
Verilog
//-----------------------------------------------------------------------------
|
|
// Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU General Public License for more details.
|
|
//
|
|
// See LICENSE.txt for the text of the license.
|
|
//-----------------------------------------------------------------------------
|
|
//
|
|
// track min and max peak values (envelope follower)
|
|
//
|
|
// NB: the min value (resp. max value) is updated only when the next high peak
|
|
// (resp. low peak) is reached/detected, since you can't know it isn't a
|
|
// local minima (resp. maxima) until then.
|
|
// This also means the peaks are detected with an unpredictable delay.
|
|
// This algorithm therefore can't be used directly for realtime peak detections,
|
|
// but it can be used as a simple envelope follower.
|
|
|
|
module min_max_tracker(
|
|
input clk,
|
|
input [7:0] adc_d,
|
|
input [7:0] threshold,
|
|
input freeze,
|
|
output [7:0] min,
|
|
output [7:0] max
|
|
);
|
|
|
|
reg [7:0] min_val = 255;
|
|
reg [7:0] max_val = 0;
|
|
reg [7:0] cur_min_val = 255;
|
|
reg [7:0] cur_max_val = 0;
|
|
reg [1:0] state = 0;
|
|
|
|
// `freeze` holds every register still. A tag simulator's own load modulation
|
|
// is far deeper than the reader's, so letting it into this follower drags min and
|
|
// max to the extremes and the slicing levels derived from them no longer bracket
|
|
// the reader's much shallower signal - measured on a Proxmark simulating Hitag 2,
|
|
// that left the receiver deaf for ~1200 T0 after every answer. Holding the
|
|
// follower across our own transmission keeps it converged on the reader.
|
|
always @(posedge clk)
|
|
if (!freeze)
|
|
begin
|
|
case (state)
|
|
0: // initialize
|
|
begin
|
|
if (cur_max_val >= ({1'b0, adc_d} + threshold))
|
|
state <= 2;
|
|
else if (adc_d >= ({1'b0, cur_min_val} + threshold))
|
|
state <= 1;
|
|
if (cur_max_val <= adc_d)
|
|
cur_max_val <= adc_d;
|
|
else if (adc_d <= cur_min_val)
|
|
cur_min_val <= adc_d;
|
|
end
|
|
1: // high phase
|
|
begin
|
|
if (cur_max_val <= adc_d)
|
|
cur_max_val <= adc_d;
|
|
else if (({1'b0, adc_d} + threshold) <= cur_max_val) begin
|
|
state <= 2;
|
|
cur_min_val <= adc_d;
|
|
max_val <= cur_max_val;
|
|
end
|
|
end
|
|
2: // low phase
|
|
begin
|
|
if (adc_d <= cur_min_val)
|
|
cur_min_val <= adc_d;
|
|
else if (adc_d >= ({1'b0, cur_min_val} + threshold)) begin
|
|
state <= 1;
|
|
cur_max_val <= adc_d;
|
|
min_val <= cur_min_val;
|
|
end
|
|
end
|
|
endcase
|
|
end
|
|
|
|
assign min = min_val;
|
|
assign max = max_val;
|
|
|
|
endmodule
|