| |
|
应用参考 |
 |
|
 |
| |
AT88SC153和AT88SC1608加密卡51单片机程序 |
AT88SC153和AT88SC1608加密卡
51单片机程序
（引自北京卡来通电子技术有限公司）
;--------------------------------------------------------------------
; ATMEL 88SC1608读写子程序
; P1.0--上电 P1.1--SCL P1.2--SDA P1.3--RES
; P1.4-- P1.5-- P1.6-- P1.7--
;--------------------------------------------------------------------
COUNT EQU 3AH
COUNT1 EQU 3BH
;AUTHENTICATION
RI EQU 3DH
SI EQU 3EH
TI EQU 3FHR_I_ADDRESS EQU 40H
S_I_ADDRESS EQU 40H
T_I_ADDRESS EQU 40H
R_0 EQU R_I_ADDRESS
R_1 EQU R_I_ADDRESS+1
R_2 EQU R_I_ADDRESS+2
R_3 EQU R_I_ADDRESS+3
R_4 EQU R_I_ADDRESS+4
R_5 EQU R_I_ADDRESS+5
R_6 EQU R_I_ADDRESS+6
R_7 EQU R_I_ADDRESS+7
KEY EQU 48H
TEMP EQU 49H
BIT0 EQU 4AH
SI_ EQU 4BH
LASTCALC EQU 4CH
Q1_T EQU 4DH
Q2_T EQU 4EH
NBRE EQU 4FH
R_I_O_ADDRESS EQU 0B0H
S_I_O_ADDRESS EQU 0B8H
T_I_O_ADDRESS EQU 0C0H
CRYPTO_ADDRESS EQU 0D0H ;CI
GC_ADDRESS EQU 0D8H ;GRAINE
Q0_ADDRESS EQU 0E0H ;HOST
Q1_ADDRESS EQU 0E8H
Q2_ADDRESS EQU 0F0H
;AUTHENTICATION SUBS=f2
;----------------------------------------------
;CALCULSTATE: IN: RI/SI/TI
; OUT: R_I(0-7)/S_i(0-7)/T_i(0-4)
;USED REGISTERS:R1 R0 R2 A TEMP
;----------------------------------------------
CALCULSTATE: MOV R1,#R_I_O_ADDRESS
MOV R0,#R_I_ADDRESS
MOV R2,#8
CALS001: MOV A,@R1
MOV @R0,A
INC R1
INC R0
DJNZ R2,CALS001 ;LOAD R_I_OUT MEMORY DATAMOV A,R_6
MOV R2,#4
CALS002: RR A
DJNZ R2,CALS002
ANL A,#1
MOV BIT0,A
MOV A,R_6
RL A ;R_6*2
ORL A,BIT0
ANL A,#1FH
MOV TEMP,A
MOV R_6,R_5
MOV R_5,R_4
MOV R_4,R_3
MOV A,R_2
XRL A,RI
MOV R_3,A
MOV R_2,R_1
MOV R_1,R_0 ;1998.4.8 加
MOV A,R_4
ADD A,TEMP
MOV R_0,A
CLR C
SUBB A,#32 ;IF R_0>31
JC CALS003
MOV B,#31
MOV A,R_0
DIV AB
MOV B,#31
MUL AB
MOV TEMP,A
MOV A,R_0
CLR C
SUBB A,TEMP
MOV R_0,A ;R_0%=31
JNZ CALS003
MOV R_0,#31
CALS003:
MOV R1,#R_I_O_ADDRESS
MOV R0,#R_I_ADDRESS
MOV R2,#8
CALS004: MOV A,@R0
MOV @R1,A
INC R1
INC R0
DJNZ R2,CALS004MOV R1,#S_I_O_ADDRESS
MOV R0,#R_I_ADDRESS ;=S_I_ADDRESS
MOV R2,#8
CALS005: MOV A,@R1
MOV @R0,A
INC R1
INC R0
DJNZ R2,CALS005
MOV A,R_6
MOV R2,#6
CALS006: RR A
DJNZ R2,CALS006
ANL A,#1
MOV BIT0,A
MOV A,R_6
RL A
ORL A,BIT0
ANL A,#7FH
MOV TEMP,A
MOV R_6,R_5
MOV A,R_4
XRL A,SI
MOV R_5,A
MOV R_4,R_3
MOV R_3,R_2
MOV R_2,R_1
MOV R_1,R_0
MOV A,R_6
ADD A,TEMP
MOV R_0,A
CLR C
SUBB A,#128
JC CALS007
MOV B,#127
MOV A,R_0
DIV AB
MOV B,#127
MUL AB
MOV TEMP,A
MOV A,R_0
CLR C
SUBB A,TEMP
MOV R_0,A
JNZ CALS007
MOV R_0,#127
CALS007: MOV R1,#S_I_O_ADDRESS
MOV R0,#R_I_ADDRESS
MOV R2,#8
CALS008: MOV A,@R0
MOV @R1,A
INC R1
INC R0
DJNZ R2,CALS008
MOV R1,#T_I_O_ADDRESS ;
MOV R0,#R_I_ADDRESS ;=T_I_ADDRESS
MOV R2,#5
CALS009: MOV A,@R1
MOV @R0,A
INC R1
INC R0
DJNZ R2,CALS009
MOV TEMP,R_4
MOV R_4,R_3
MOV R_3,R_2
MOV A,R_1
XRL A,TI
MOV R_2,A
MOV R_1,R_0
MOV A,R_3
ADD A,TEMP
MOV R_0,A
CLR C
SUBB A,#32
JC CALS0010
MOV B,#31
MOV A,R_0
DIV AB
MOV B,#31
MUL AB
MOV TEMP,A
MOV A,R_0
CLR C
SUBB A,TEMP
MOV R_0,A
JNZ CALS0010
MOV R_0,#31
CALS0010: MOV R1,#T_I_O_ADDRESS
MOV R0,#R_I_ADDRESS
MOV R2,#5
CALS0011: MOV A,@R0
MOV @R1,A
INC R1
INC R0
DJNZ R2,CALS0011
RET
;---------------------------------------
;CALCUL(VOID) OUT: RI SI TI SI_ LASTCALC
;USED REGISTERS:RI SI TI SI_ R_I(0-7) TEMP R1
;---------------------------------------
CALCULV: MOV LASTCALC,#0
MOV SI,#0
MOV RI,#0
MOV TI,#0
LCALL CALCULSTATE
MOV R1,#R_I_O_ADDRESS
MOV A,@R1
MOV R_0,A
MOV R1,#R_I_O_ADDRESS+4
MOV A,@R1
MOV R_4,A
XRL A,R_0
ANL A,#1FH
MOV RI,A
MOV R1,#T_I_O_ADDRESS
MOV A,@R1
MOV R_0,A
MOV R1,#T_I_O_ADDRESS+3
MOV A,@R1
MOV R_3,A
XRL A,R_0
ANL A,#1FH
MOV TI,A
MOV R1,#S_I_O_ADDRESS
MOV A,@R1
MOV SI,A
;*********SI_=~S[0] ?
MOV A,#0FFH
CLR C
SUBB A,SI
MOV SI_,A
;*********SI_=~S[0] ?
MOV A,RI
ANL A,SI_
MOV TEMP,A
MOV A,SI
ANL A,TI
ORL A,TEMP
ANL A,#0FH
MOV LASTCALC,A
RET
;-------------------------------------------
;CALCUL IN: NBRE OUT: LASTCALC
;-------------------------------------------
CALCUL: ACALL CALCULV
;CALC=LASTCALC
DJNZ NBRE,CALCUL
RET
;------------------------------------------
;CALCULKEY(KEY) USE TEMP KEY A
;IN:KEY OUT:R_I(0-7) S_I(0-7) T_I(0-4)
;------------------------------------------
CALCULKEY: MOV A,KEY
ANL A,#1FH
MOV RI,A
MOV A,KEY
RL A
RL A
RL A
ANL A,#78H
MOV TEMP,A
MOV A,KEY
RR A
RR A
RR A
RR A
RR A
ANL A,#7
ADD A,TEMP
MOV SI,A
MOV A,KEY
RR A
RR A
RR A
ANL A,#1fh
MOV TI,A
LCALL CALCULSTATE
RET
;------------------------------------------
;AUTHENTICATION IN CRYPTO0-7,GC0-7,Q0-7
;OUT Q1,Q2
;USED REGISTERS: A,R1,COUNT
;------------------------------------------
AUTHENTICATION: MOV COUNT,#0
AUT001: MOV A,COUNT
RL A ;*2
MOV R1,#CRYPTO_ADDRESS
ADD A,R1
MOV R1,A
MOV A,@R1
MOV KEY,A
ACALL CALCULKEY
AUT0011: MOV R1,#CRYPTO_ADDRESS
MOV A,COUNT
RL A
ADD A,R1
MOV R1,A
INC R1
MOV A,@R1
MOV KEY,A
ACALL CALCULKEY
AUT0012: MOV R1,#Q0_ADDRESS
MOV A,COUNT
ADD A,R1
MOV R1,A
MOV A,@R1
MOV KEY,A
ACALL CALCULKEY
INC COUNT
MOV A,COUNT
CJNE A,#4,AUT001
MOV COUNT,#0
AUT002: MOV A,COUNT
RL A
MOV R1,#GC_ADDRESS
ADD A,R1
MOV R1,A
MOV A,@R1
MOV KEY,A
ACALL CALCULKEY
MOV R1,#GC_ADDRESS
MOV A,COUNT
RL A
ADD A,R1
MOV R1,A
INC R1
MOV A,@R1
MOV KEY,A
ACALL CALCULKEY
MOV R1,#Q0_ADDRESS+4
MOV A,COUNT
ADD A,R1
MOV R1,A
MOV A,@R1
MOV KEY,A
ACALL CALCULKEY
INC COUNT
MOV A,COUNT
CJNE A,#4,AUT002
MOV COUNT,#0
AUT003: MOV NBRE,#2
LCALL CALCUL
MOV A,LASTCALC
RL A
RL A
RL A
RL A
MOV Q2_T,A
MOV NBRE,#2
LCALL CALCUL
MOV A,Q2_T
ORL A,LASTCALC
MOV Q2_T,A
MOV NBRE,#2
LCALL CALCUL
MOV A,LASTCALC
RL A
RL A
RL A
RL A
MOV Q1_T,A
MOV NBRE,#2
LCALL CALCUL
MOV A,Q1_T
ORL A,LASTCALC
MOV Q1_T,A
MOV R1,#Q1_ADDRESS
MOV A,R1
ADD A,COUNT
MOV R1,A
MOV A,Q1_T
MOV @R1,A
MOV R1,#Q2_ADDRESS
MOV A,R1
ADD A,COUNT
MOV R1,A
MOV A,Q2_T
MOV @R1,A
INC COUNT
MOV A,COUNT
CJNE A,#8,AUT003
RET
;--------------------------------------------------------------------
;AUTH: 密码认证子程序
; 功能:密码认证
; 输入:CI,GC,Q0
; 输出:
;--------------------------------------------------------------------
AUTH: MOV R1,#90H ;清内部RAM 90H--FFH
MOV R3,#70H
CLR A
AUTH01: MOV @R1,A
INC R1
DJNZ R3,AUTH01
MOV R1,#CRYPTO_ADDRESS ;保存CI,GC,Q0
MOV R3,#18H
MOV R0,#31H
AUTH02: MOV A,@R0
MOV @R1,A
INC R0
INC R1
DJNZ R3,AUTH02
LCALL AUTHENTICATION ;生成Q1,Q2
MOV R0,#40H
MOV R1,#Q0_ADDRESS
MOV R3,#18H
AUTH03: MOV A,@R1
MOV @R0,A
INC R0
INC R1
DJNZ R3,AUTH03
MOV R0,#40H
LCALL IA ;初始化认证
MOV A,30H
CJNE A,#03H,AUTH06
LCALL WAIT10 ;延时10MS
LCALL VA ;校验认证
MOV A,30H
CJNE A,#03H,AUTH06
LCALL WAIT10 ;延时10MS
MOV 32H,#20H
MOV 33H,#10H
MOV A,23H
CJNE A,#0A2H,AUTH031
LCALL RCZ ;读AAC及CI
MOV R0,#3AH ;比较CI及Q2
MOV R1,#50H
MOV R3,#08H
SJMP AUTH032
AUTH031: MOV 32H,#0E0H
MOV 33H,#10H
LCALL RD153
MOV R0,#33H ;比较CI及Q2
MOV R1,#51H
MOV R3,#07H
AUTH032: MOV A,32H
CJNE A,#0FFH,AUTH07
AUTH04: MOV A,@R0 ;比较CI及Q2
MOV B,A
MOV A,@R1
CJNE A,B,AUTH06
INC R0
INC R1
DJNZ R3,AUTH04
MOV 30H,#03H
MOV 31H,#00H
RET
AUTH06: MOV 30H,#04H
MOV 31H,#00H
RET
AUTH07: MOV 30H,#04H
MOV 31H,#01H
RET
;--------------------------------------------------------------------
; ATR: 复位响应子程序
; 功能:复位响应，输出32位应答信息,数据放入@R0
;--------------------------------------------------------------------
ATR:
CLR P1.3 ;IC的RST端低
SETB P1.2 ;SDA IS HIGH
NOP
CLR P1.1 ;SCL IS LOW
NOP
NOP
SETB P1.3 ;IC的RST端开始变高
NOP
MOV R4,#4 ;计数器赋值
MOV R0,#32H ;放数据地址
NOP
SETB P1.1 ;IC的SCL端开始变高
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
CLR P1.1 ;IC的SCL端开始变低
NOP
NOP
NOP
NOP
CLR P1.3 ;IC的RST端开始变低
NOP
NOP
NOP
ATR1: MOV R3,#8
ATR2: SETB P1.1 ;IC的SCL端开始变高
NOP
MOV C,P1.2
RRC A
NOP
NOP
NOP ;脉冲宽度10us
NOP
NOP
NOP
NOP
CLR P1.1 ;IC的SCL端开始变低
NOP
NOP
NOP
NOP ;脉冲宽度10us
NOP
NOP
NOP
NOP
DJNZ R3,ATR2
MOV @R0,A
INC R0
DJNZ R4,ATR1
MOV C,P1.2
JC ATR3 ;IO为高则复位完成
MOV 30H,#04H
MOV 31H,#00H
RET
ATR3: MOV 30H,#03H
MOV 31H,#04H
RET
;--------------------------------------------------------------------
; SUZA: 设置用户区地址 Set User Zone Address
; 31H: 用户区高位敌址
; 30H=#03H,正确 ; 30H=#04H,卡不反应
;--------------------------------------------------------------------
SUZA: LCALL START
MOV A,#0B2H
LCALL SPOUT
JC ER1
MOV A,31H
LCALL SPOUT
JC ER1
LCALL STOP
MOV 30H,#03H
RET
ER1: MOV 30H,#04H
RET
;--------------------------------------------------------------------
; RUZ: 读用户区数据 Read User Zone
; 32H: 用户区低位地址 33H: 用户区读数据字节数
; 30H=#03H,正确 ; 30H=#04H,卡不反应
; 数据放入@R0
;--------------------------------------------------------------------
RUZ: MOV 31H,33H
MOV R0,#32H
LCALL START
MOV A,#0B1H
LCALL SPOUT
JC ER2
MOV A,32H
LCALL SPOUT
JC ER2
MOV R3,33H
RUZ1: DEC R3
CJNE R3,#00H,RUZ2
SJMP RUZ3
RUZ2: LCALL SPIN ;读一个数据到A,有回答信号
MOV @R0,A
INC R0
SJMP RUZ1
RUZ3: LCALL SPIN2 ;读一个数据到A,没有回答信号
MOV @R0,A
LCALL STOP
MOV 30H,#03H
RET
ER2: MOV 30H,#04H
MOV 31H,#00H
RET
;--------------------------------------------------------------------
; RCZ: 读用户区数据 Read Configuration Zone
; 32H: 低位地址 33H: 读数据字节数
; 30H=#03H,正确 ; 30H=#04H,卡不反应
; 数据放入@R0
;--------------------------------------------------------------------
RCZ: MOV 31H,33H
MOV R0,#32H
LCALL START
MOV A,#0B5H
LCALL SPOUT
JC ER3
MOV A,32H
LCALL SPOUT
JC ER3
MOV R3,33H
RCZ1: DEC R3
CJNE R3,#00H,RCZ2
SJMP RCZ3
RCZ2: LCALL SPIN ;读一个数据到A,有回答信号
MOV @R0,A
INC R0
SJMP RCZ1
RCZ3: LCALL SPIN2 ;读一个数据到A,没有回答信号
MOV @R0,A
LCALL STOP
MOV 30H,#03H
RET
ER3: MOV 30H,#04H
MOV 31H,#00H
RET
;--------------------------------------------------------------------
;WR1608: 写数据子程序 Write data (ATMEL 1608/153)
; 31H: 写用户区和写Configuration区标志
; (01:写用户区地址;00:写Configuration区;02:写ATMEL 88SC153)
; 32H: 写地址; 33H: 用户区写数据字节数
; 30H=#03H,正确 ; 30H=#04H,卡不反应
; 数据放入@R0
;--------------------------------------------------------------------
WR1608:MOV R0,#34H
MOV A,33H
DEC A
ADD A,32H
JNC WR1
MOV 30H,#01H ;地址超出分区,返回错误代码
RET
WR1: MOV A,32H ;判断起始地址低4(3)位是否为全'0'
MOV R2,A
ANL A,25H
JZ WR2
SETB C
SUBB A,26H
CPL A
MOV B,A
CLR C
SUBB A,33H
JNC WR2
CLR C
MOV A,33H
SUBB A,B
MOV 33H,A
MOV R3,B
MOV A,31H
JZ WR10
CJNE A,#01H,WR13
ACALL WUZ
SJMP WR11
WR13: LCALL WR153
SJMP WR11
WR10: ACALL WCZ
WR11: MOV A,30H
CJNE A,#04H,WR12 ;卡不反应,返回
RET
WR12: LCALL WAIT10 ;调延时子程序10MS
MOV A,R2 ;计算EEPROM地址
ADD A,B
MOV R2,A
WR2: MOV A,33H
MOV B,26H
DIV AB
MOV R7,A ;R7--循环次数
JZ WR3
WR21: MOV R3,26H ;写字节数/页
MOV A,31H
JZ WR22
CJNE A,#01H,WR25
ACALL WUZ
SJMP WR23
WR25: ACALL WR153
SJMP WR23
WR22: ACALL WCZ
WR23: MOV A,30H
CJNE A,#04H,WR24 ;卡不反应,返回
RET
WR24: LCALL WAIT10 ;调延时子程序10MS
MOV A,R2 ;计算EEPROM地址
ADD A,26H
MOV R2,A
DJNZ R7,WR21
WR3: MOV A,B ;余数->A
JZ WR33
MOV R3,B
MOV A,31H
JZ WR31
CJNE A,#01H,WR34
ACALL WUZ
SJMP WR32
WR34: ACALL WR153
SJMP WR32
WR31: ACALL WCZ
WR32: LCALL WAIT10 ;调延时子程序10MS
WR33: RET
;--------------------------------------------------------------------
; WUZ: 写用户区数据 Write User Zone
; R2:写地址 R3: 写数据字节数
; 30H=#03H,正确 ; 30H=#04H,卡不反应
; 数据放入@R0
;--------------------------------------------------------------------
WUZ: LCALL START
MOV A,#0B0H
LCALL SPOUT
JC ER4
MOV A,R2
LCALL SPOUT
JC ER4
WUZ1: MOV A,@R0
LCALL SPOUT ;写一个数据
JC ER4
INC R0
DJNZ R3,WUZ1
LCALL STOP
MOV 30H,#03H
RET
ER4: MOV 30H,#04H
RET
;--------------------------------------------------------------------
; WCZ: 写用户区数据 Write Configuration Zone
; R2: 低位地址 R3: 写数据字节数
; 30H=#03H,正确 ; 30H=#04H,卡不反应
; 数据放入@R0
;--------------------------------------------------------------------
WCZ: LCALL START
MOV A,#0B4H
LCALL SPOUT
JC ER5
MOV A,R2
LCALL SPOUT
JC ER5
WCZ1: MOV A,@R0
LCALL SPOUT ;写一个数据
JC ER5
INC R0
DJNZ R3,WCZ1
LCALL STOP
MOV 30H,#03H
RET
ER5: MOV 30H,#04H
RET
;--------------------------------------------------------------------
; RD153: 读数据 Read Data (ATMEL 88SC153)
; 32H: 用户区低位地址 33H: 用户区读数据字节数
; 30H=#03H,正确 ; 30H=#04H,卡不反应
; 数据放入@R0
;--------------------------------------------------------------------
RD153: MOV 31H,33H
MOV R0,#32H
LCALL START
MOV A,32H
ANL A,#0C0H
SWAP A
ORL A,#0B1H
LCALL SPOUT
JC ER21
MOV A,32H
LCALL SPOUT
JC ER21
MOV R3,33H
RD153_1: DEC R3
CJNE R3,#00H,RD153_2
SJMP RD153_3
RD153_2: LCALL SPIN ;读一个数据到A,有回答信号
MOV @R0,A
INC R0
SJMP RD153_1
RD153_3: LCALL SPIN2 ;读一个数据到A,没有回答信号
MOV @R0,A
LCALL STOP
MOV 30H,#03H
RET
ER21: MOV 30H,#04H
MOV 31H,#00H
RET
;--------------------------------------------------------------------
; WR153: 写用户区数据 Write Data
; R2: 低位地址 R3: 写数据字节数
; 30H=#03H,正确 ; 30H=#04H,卡不反应
; 数据放入@R0
;--------------------------------------------------------------------
WR153: LCALL START
MOV A,R2
ANL A,#0C0H
SWAP A
ORL A,#0B0H
LCALL SPOUT
JC ER51
MOV A,R2
LCALL SPOUT
JC ER51
WR153_1: MOV A,@R0
LCALL SPOUT ;写一个数据
JC ER51
INC R0
DJNZ R3,WR153_1
LCALL STOP
MOV 30H,#03H
RET
ER51: MOV 30H,#04H
RET
;--------------------------------------------------------------------
; RF: 读熔断丝 Read Fuses
; 30H=#03H,正确 ; 30H=#04H,卡不反应
; 数据放入@R0
;--------------------------------------------------------------------
RF: MOV R0,#32H
LCALL START
MOV A,#0B5H
LCALL SPOUT
JC ER6
MOV A,#80H ;Fuses Address
LCALL SPOUT
JC ER6
LCALL SPIN2 ;读一个数据到A,没有回答信号
MOV @R0,A
LCALL STOP
MOV 30H,#03H
MOV 31H,#01H
RET
ER6: MOV 30H,#04H
MOV 31H,#00H
RET
;--------------------------------------------------------------------
; RF153:读熔断丝 Read Fuses (AT88SC153)
; 30H=#03H,正确 ; 30H=#04H,卡不反应
; 数据放入@R0
;--------------------------------------------------------------------
RF153: MOV R0,#32H
LCALL START
MOV A,#0BEH
LCALL SPOUT
JC ER61
LCALL SPIN2 ;读一个数据到A,没有回答信号
MOV @R0,A
LCALL STOP
MOV 30H,#03H
MOV 31H,#01H
RET
ER61: MOV 30H,#04H
MOV 31H,#00H
RET
;--------------------------------------------------------------------
; WF: 写熔断丝 Write Fuses
; 30H=#00H,正确 ; 30H=#04H,卡不反应
;
;--------------------------------------------------------------------
WF: LCALL START
MOV A,#0B4H
LCALL SPOUT
JC ER7
MOV A,#80H ;Fuses Address
LCALL SPOUT
JC ER7
LCALL STOP
MOV 30H,#03H
RET
ER7: MOV 30H,#04H
RET
;--------------------------------------------------------------------
; WF153:写熔断丝 Write Fuses (AT88SC153)
; 30H=#00H,正确 ; 30H=#04H,卡不反应
; @R0:熔断数据(01H:Blow FAB;02H:Blow CMA;04H:Blow PER)
;--------------------------------------------------------------------
WF153: LCALL START
MOV A,#0BAH
LCALL SPOUT
JC ER71
MOV A,31H ;Fuses Index
LCALL SPOUT
JC ER71
LCALL STOP
MOV 30H,#03H
RET
ER71: MOV 30H,#04H
RET
;--------------------------------------------------------------------
; VP: 校验密码 Verify Password
; 31H: 密码索引 @R0:密码
;--------------------------------------------------------------------
VP: MOV R0,#32H
LCALL START
MOV A,#0B3H
LCALL SPOUT
JC ER8
MOV A,31H
LCALL SPOUT
JC ER8
MOV R3,#03H
VP1: MOV A,@R0
LCALL SPOUT
JC ER8
INC R0
DJNZ R3,VP1
LCALL STOP
LCALL WAIT10 ;延时10MS
MOV A,31H ;计算该密码的错误计数器地址
ANL A,#07H ;
RL A ;*8
RL A
RL A
ADD A,#40H
MOV 32H,A
MOV A,31H
ANL A,#08H
JZ VP2 ;写密码,转VP2
MOV A,32H ;写密码地址+4=读密码地址
ADD A,#04H
MOV 32H,A
VP2: MOV 33H,#01H ;读字节数
LCALL RCZ
MOV A,30H
CJNE A,#03H,ER8
MOV A,32H
CJNE A,#0FFH,VP3
MOV 30H,#03H ;密码校验正确
MOV 31H,#00H
RET
VP3: MOV 30H,#04H
MOV 31H,#01H
RET
ER8: MOV 30H,#04H
MOV 31H,#00H
RET
;--------------------------------------------------------------------
; VP153: 校验密码 Verify Password (ATMEL 88SC153)
; 31H: 密码索引 @R0:密码
; 31H: 000000rp
; r=0: Write password
; r=1: Read password
; p : Password set number
;--------------------------------------------------------------------
VP153: MOV R2,#02H
VP153_0: MOV R0,#32H
LCALL START
MOV A,31H
RL A
RL A
ORL A,#0B3H
LCALL SPOUT
JC ER81
MOV R3,#03H
VP153_1: MOV A,@R0
LCALL SPOUT
JC ER81
INC R0
DJNZ R3,VP153_1
LCALL STOP
LCALL WAIT10 ;延时10MS
DJNZ R2,VP153_0
MOV A,31H ;计算该密码的错误计数器地址
ANL A,#01H ;
RL A ;*8
RL A
RL A
ADD A,#0F0H
MOV 32H,A
MOV A,31H
ANL A,#02H
JZ VP153_2 ;写密码,转VEP2
MOV A,32H ;写密码地址+4=读密码地址
ADD A,#04H
MOV 32H,A
VP153_2: MOV 33H,#01H ;读字节数
LCALL RD153
MOV A,30H
CJNE A,#03H,ER81
MOV A,32H
CJNE A,#0FFH,VP153_3
MOV 30H,#03H ;密码校验正确
MOV 31H,#00H
RET
VP153_3: MOV 30H,#04H
MOV 31H,#01H
RET
ER81: MOV 30H,#04H
MOV 31H,#00H
RET
;--------------------------------------------------------------------
; IA: 初始认证 Initialize Authentication
; @R0: 8字节Q0
;--------------------------------------------------------------------
IA: ACALL START
MOV A,23H
CJNE A,#0A2H,IA0
MOV A,#0B6H
SJMP IA01
IA0: CJNE A,#0A3H,ER9
MOV A,#0B2H
IA01: ACALL SPOUT
JC ER9
MOV R3,#08H
IA1: MOV A,@R0
ACALL SPOUT
JC ER9
INC R0DJNZ R3,IA1
ACALL STOP
MOV 30H,#03H
RET
ER9: MOV 30H,#04H
RET
;--------------------------------------------------------------------
; VA: 校验认证 Verify Authentication
; @R0: 8字节校验密码 Ci+1(Q1)
;--------------------------------------------------------------------
VA: ACALL START
MOV A,23H
CJNE A,#0A2H,VA0
MOV A,#0B7H
SJMP VA01
VA0: CJNE A,#0A3H,ER10
MOV A,#0B6H
VA01: ACALL SPOUT
JC ER10
MOV R3,#08H
VA1: MOV A,@R0
ACALL SPOUT
JC ER10
INC R0
DJNZ R3,VA1
ACALL STOP
MOV 30H,#03H
RET
ER10: MOV 30H,#04H
RET
;--------------------------------------------------------------------
; 输出子程序
; A: 输出数据 R4:循环次数
; P1.1: SCL P1.2: SDA P1.0: 上电
;--------------------------------------------------------------------
SPOUT: MOV R4,#08H ;设置循环次数
SETB C ;C=0
SPOUT1: RLC A ;A 循环左移
MOV P1.2,C ;SDA=P1.X(OUTPUT)
NOP
NOP
SETB P1.1 ;SCL=1
NOP
NOP
NOP
NOP
CLR P1.1 ;SCL=0
DJNZ R4,SPOUT1 ;R4<>0,循环
RLC A
SETB P1.2 ;SDA=1
NOP
SETB P1.1 ;SCL=1
NOP
NOP
MOV C,P1.2 ;接收回答信号到C
NOP
CLR P1.1 ;SCL=0
NOP
RET
;--------------------------------------------------------------------
; 输入子程序
; A: 输入数据 R4:循环次数
; P1.1: SCL P1.2: SDA P1.0: 上电
;--------------------------------------------------------------------
SPIN: MOV R4,#08H ;设置循环次数
SETB P1.2 ;SDA=1
SPIN1: NOP
NOP
SETB P1.1 ;SCL=1
NOP
NOP
MOV C,P1.2 ;输入1位数据到C
RLC A ;A 循环左移
CLR P1.1 ;SCL=0
DJNZ R4,SPIN1 ;R4<>0,循环
CLR P1.2 ;SDA=0,发送回答信号
NOP
NOP
SETB P1.1 ;SCL=1
NOP
NOP
NOP
NOP
CLR P1.1 ;SCL=0
SETB P1.2 ;SDA=1
RET
;--------------------------------------------------------------------
; 输入子程序
; A: 输入数据 R4:循环次数
; P1.1: SCL P1.2: SDA P1.0: 上电
;--------------------------------------------------------------------
SPIN2: MOV R4,#08H ;设置循环次数
SETB P1.2 ;SDA=1
SPIN3: NOP
NOP
SETB P1.1 ;SCL=1
NOP
NOP
MOV C,P1.2 ;输入1位数据到C
RLC A ;A 循环左移
CLR P1.1 ;SCL=0
DJNZ R4,SPIN3 ;R4<>0,循环
SETB P1.2 ;SDA=1,没有回答信号
NOP
NOP
SETB P1.1 ;SCL=1
NOP
NOP
NOP
NOP
CLR P1.1 ;SCL=0
RET
;--------------------------------------------------------------------
; START: 开始信号子程序
; 功能:
;--------------------------------------------------------------------
START: CLR P1.2 ;SDA IS LOW
CLR P1.1 ;SCL IS LOW
NOP
NOP
SETB P1.2 ;SDA IS HIGH
NOP
NOP
SETB P1.1 ;SCL IS HIGH ,START
NOP
NOP
CLR P1.2 ;SDA IS LOW
NOP
NOP
CLR P1.1 ;SCL IS LOW
RET
;--------------------------------------------------------------------
; STOP: 停止信号子程序
; 功能:
;--------------------------------------------------------------------
STOP: CLR P1.2 ;SDA IS LOW
SETB P1.1 ;SCL IS HIGH
NOP
NOP
SETB P1.2 ;SDA IS HIGH
NOP
NOP
CLR P1.1 ;SCL IS LOW ,STOP
NOP
NOP
CLR P1.2 ;SDA IS LOW
RET
;--------------------------------------------------------------------
; WAIT10: 延时子程序
; R5: 毫秒数
;--------------------------------------------------------------------
WAIT10: MOV R5,#0AH
WAIT101: MOV R6,#0FAH
WAIT102: NOP
NOP
DJNZ R6,WAIT102
DJNZ R5,WAIT101
RET
|
|
|
|
|
|
|
 |
 |
 |
|
|
|
信息纽扣密码破解（DS1991和DS1425型TM卡）装置研制成功
