Merge branch 'master' of https://github.com/Proxmark/proxmark3

Conflicts: armsrc/Makefile armsrc/iso14443b.c armsrc/lfops.c client/cmdhf14b.c client/cmdhfmfu.c fpga/fpga_hf.bit fpga/hi_read_rx_xcorr.v
2015-06-23 23:02:29 +02:00
parent 62f0edfb8e dd3d1b7012
commit f53020e729
10 changed files with 114 additions and 218 deletions
--- a/armsrc/epa.c
+++ b/armsrc/epa.c
@@ -127,7 +127,7 @@ size_t EPA_Parse_CardAccess(uint8_t *data,
                            pace_version_info_t *pace_info)
 {
 	size_t index = 0;
-	
+
 	while (index <= length - 2) {
 		// determine type of element
 		// SET or SEQUENCE
@@ -184,7 +184,7 @@ size_t EPA_Parse_CardAccess(uint8_t *data,
 			index += 2 + data[index + 1];
 		}
 	}
-	
+
 	// TODO: We should check whether we reached the end in error, but for that
 	//       we need a better parser (e.g. with states like IN_SET or IN_PACE_INFO)
 	return 0;
@@ -202,7 +202,7 @@ int EPA_Read_CardAccess(uint8_t *buffer, size_t max_length)
 	// we reserve 262 bytes here just to be safe (256-byte APDU + SW + ISO frame)
 	uint8_t response_apdu[262];
 	int rapdu_length = 0;
-	
+
 	// select the file EF.CardAccess
 	rapdu_length = iso14_apdu((uint8_t *)apdu_select_binary_cardaccess,
 	                          sizeof(apdu_select_binary_cardaccess),
@@ -214,7 +214,7 @@ int EPA_Read_CardAccess(uint8_t *buffer, size_t max_length)
 		Dbprintf("epa - no select cardaccess");
 		return -1;
 	}
-	
+
 	// read the file
 	rapdu_length = iso14_apdu((uint8_t *)apdu_read_binary,
 	                          sizeof(apdu_read_binary),
@@ -226,7 +226,7 @@ int EPA_Read_CardAccess(uint8_t *buffer, size_t max_length)
 		Dbprintf("epa - no read cardaccess");
 		return -1;
 	}
-	
+
 	// copy the content into the buffer
 	// length of data available: apdu_length - 4 (ISO frame) - 2 (SW)
 	size_t to_copy = rapdu_length - 6;
@@ -243,7 +243,7 @@ static void EPA_PACE_Collect_Nonce_Abort(uint8_t step, int func_return)
 {
 	// power down the field
 	EPA_Finish();
-	
+
 	// send the USB packet
 	cmd_send(CMD_ACK,step,func_return,0,0,0);
 }
@@ -294,11 +294,11 @@ void EPA_PACE_Collect_Nonce(UsbCommand *c)
 		EPA_PACE_Collect_Nonce_Abort(3, func_return);
 		return;
 	}
-	
+
 	// initiate the PACE protocol
 	// use the CAN for the password since that doesn't change
 	func_return = EPA_PACE_MSE_Set_AT(pace_version_info, 2);
-	
+
 	// now get the nonce
 	uint8_t nonce[256] = {0};
 	uint8_t requested_size = (uint8_t)c->arg[0];
@@ -309,10 +309,10 @@ void EPA_PACE_Collect_Nonce(UsbCommand *c)
 		EPA_PACE_Collect_Nonce_Abort(4, func_return);
 		return;
 	}
-  
-  // all done, return
+
+	// all done, return
 	EPA_Finish();
-	
+
 	// save received information
 	cmd_send(CMD_ACK,0,func_return,0,nonce,func_return);
 }
@@ -335,7 +335,7 @@ int EPA_PACE_Get_Nonce(uint8_t requested_length, uint8_t *nonce)
 	       sizeof(apdu_general_authenticate_pace_get_nonce));
 	// append Le (requested length + 2 due to tag/length taking 2 bytes) in RAPDU
 	apdu[sizeof(apdu_general_authenticate_pace_get_nonce)] = requested_length + 4;
-	
+
 	// send it
 	uint8_t response_apdu[262];
 	int send_return = iso14_apdu(apdu,
@@ -348,7 +348,7 @@ int EPA_PACE_Get_Nonce(uint8_t requested_length, uint8_t *nonce)
 	{
 		return -1;
 	}
-	
+
 	// if there is no nonce in the RAPDU, return here
 	if (send_return < 10)
 	{
@@ -363,7 +363,7 @@ int EPA_PACE_Get_Nonce(uint8_t requested_length, uint8_t *nonce)
 	}
 	// copy the nonce
 	memcpy(nonce, response_apdu + 6, nonce_length);
-	
+
 	return nonce_length;
 }

--- a/armsrc/iso14443b.c
+++ b/armsrc/iso14443b.c
@@ -17,6 +17,7 @@
 #include "iso14443crc.h"

 #define RECEIVE_SAMPLES_TIMEOUT 2000
+#define ISO14443B_DMA_BUFFER_SIZE 256

 //=============================================================================
 // An ISO 14443 Type B tag. We listen for commands from the reader, using
@@ -234,7 +235,7 @@ static RAMFUNC int Handle14443bUartBit(uint8_t bit)
 						Uart.posCnt = 0;
 						Uart.state = STATE_AWAITING_START_BIT;
 					}
-				} else if(Uart.shiftReg == 0x000) {
+				} else if (Uart.shiftReg == 0x000) {
 					// this is an EOF byte
 					LED_A_OFF(); // Finished receiving
 					Uart.state = STATE_UNSYNCD;
@@ -244,7 +245,7 @@ static RAMFUNC int Handle14443bUartBit(uint8_t bit)
 				} else {
 					// this is an error
 					LED_A_OFF();
-				Uart.state = STATE_UNSYNCD;
+					Uart.state = STATE_UNSYNCD;
 				}
 			}
 			break;
@@ -486,8 +487,8 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
 {
 	int v;

-	// The soft decision on the bit uses an estimate of just the
-	// quadrant of the reference angle, not the exact angle.
+// The soft decision on the bit uses an estimate of just the
+// quadrant of the reference angle, not the exact angle.
 #define MAKE_SOFT_DECISION() { \
 		if(Demod.sumI > 0) { \
 			v = ci; \
@@ -717,16 +718,16 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
 	uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
 	
 	// The DMA buffer, used to stream samples from the FPGA
-	int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE);
+	int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);

 	// Set up the demodulator for tag -> reader responses.
 	DemodInit(receivedResponse);

 	// Setup and start DMA.
-	FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE);
+	FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);

 	int8_t *upTo = dmaBuf;
-	lastRxCounter = DMA_BUFFER_SIZE;
+	lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;

 	// Signal field is ON with the appropriate LED:
 	LED_D_ON();
@@ -737,25 +738,25 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
 		int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
 		if(behindBy > max) max = behindBy;

-		while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (DMA_BUFFER_SIZE-1)) > 2) {
+		while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) {
 			ci = upTo[0];
 			cq = upTo[1];
 			upTo += 2;
-			if(upTo >= dmaBuf + DMA_BUFFER_SIZE) {
+			if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
 				upTo = dmaBuf;
 				AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
-				AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
+				AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
 			}
 			lastRxCounter -= 2;
 			if(lastRxCounter <= 0) {
-				lastRxCounter += DMA_BUFFER_SIZE;
+				lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
 			}

 			samples += 2;

 			if(Handle14443bSamplesDemod(ci, cq)) {
 				gotFrame = TRUE;
-			break;
+				break;
 		}
 	}

@@ -770,7 +771,6 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
 	//Tracing
 	if (tracing && Demod.len > 0) {
 		uint8_t parity[MAX_PARITY_SIZE];
-		//GetParity(Demod.output, Demod.len, parity);
 		LogTrace(Demod.output, Demod.len, 0, 0, parity, FALSE);
 	}
 }
@@ -892,7 +892,6 @@ static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len)
 	TransmitFor14443b();
 	if (tracing) {
 		uint8_t parity[MAX_PARITY_SIZE];
-		GetParity(cmd, len, parity);
 		LogTrace(cmd,len, 0, 0, parity, TRUE);
 	}
 }
@@ -931,30 +930,25 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
 	SpinDelay(200);

 	// First command: wake up the tag using the INITIATE command
-	uint8_t cmd1[] = { 0x06, 0x00, 0x97, 0x5b};
-
+	uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b};
 	CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
-//    LED_A_ON();
 	GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
-//    LED_A_OFF();

 	if (Demod.len == 0) {
 		DbpString("No response from tag");
 		return;
 	} else {
-		Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %02x %02x %02x",
-		Demod.output[0], Demod.output[1],Demod.output[2]);
+		Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x",
+				Demod.output[0], Demod.output[1], Demod.output[2]);
 	}
+
 	// There is a response, SELECT the uid
 	DbpString("Now SELECT tag:");
 	cmd1[0] = 0x0E; // 0x0E is SELECT
 	cmd1[1] = Demod.output[0];
 	ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
 	CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
-
-//    LED_A_ON();
 	GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
-//    LED_A_OFF();
 	if (Demod.len != 3) {
 		Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
 		return;
@@ -970,34 +964,30 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
 		Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]);
 		return;
 	}
+
 	// Tag is now selected,
 	// First get the tag's UID:
 	cmd1[0] = 0x0B;
 	ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
 	CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one
-
-//    LED_A_ON();
 	GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
-//    LED_A_OFF();
 	if (Demod.len != 10) {
 		Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
 		return;
 	}
 	// The check the CRC of the answer (use cmd1 as temporary variable):
 	ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
-   if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
+	if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
 		Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
-		(cmd1[2]<<8)+cmd1[3],
-		(Demod.output[8]<<8)+Demod.output[9]
-		);
+				(cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
 	// Do not return;, let's go on... (we should retry, maybe ?)
 	}
 	Dbprintf("Tag UID (64 bits): %08x %08x",
-		(Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
-		(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
+			(Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
+			(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);

 	// Now loop to read all 16 blocks, address from 0 to last block
-	Dbprintf("Tag memory dump, block 0 to %d",dwLast);
+	Dbprintf("Tag memory dump, block 0 to %d", dwLast);
 	cmd1[0] = 0x08;
 	i = 0x00;
 	dwLast++;
@@ -1009,10 +999,7 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
 		cmd1[1] = i;
 		ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
 		CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
-
-//	    LED_A_ON();
 		GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
-//	    LED_A_OFF();
 		if (Demod.len != 6) { // Check if we got an answer from the tag
 		DbpString("Expected 6 bytes from tag, got less...");
 		return;
@@ -1020,15 +1007,13 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
 		// The check the CRC of the answer (use cmd1 as temporary variable):
 		ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
 			if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
-				Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
-					(cmd1[2]<<8)+cmd1[3],
-					(Demod.output[4]<<8)+Demod.output[5]
-				);
+			Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
+					(cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
 		// Do not return;, let's go on... (we should retry, maybe ?)
 		}
 		// Now print out the memory location:
 		Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i,
-			(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
+				(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
 			(Demod.output[4]<<8)+Demod.output[5]
 		);
 		if (i == 0xff) break;
@@ -1051,7 +1036,7 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
 * Memory usage for this function, (within BigBuf)
 * Last Received command (reader->tag) - MAX_FRAME_SIZE
 * Last Received command (tag->reader) - MAX_FRAME_SIZE
- * DMA Buffer - DMA_BUFFER_SIZE
+ * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE
 * Demodulated samples received - all the rest
 */
 void RAMFUNC SnoopIso14443b(void)
@@ -1068,7 +1053,7 @@ void RAMFUNC SnoopIso14443b(void)
 	set_tracing(TRUE);

 	// The DMA buffer, used to stream samples from the FPGA
-	int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE);
+	int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
 	int lastRxCounter;
 	int8_t *upTo;
 	int ci, cq;
@@ -1086,7 +1071,7 @@ void RAMFUNC SnoopIso14443b(void)
 	Dbprintf("  Trace: %i bytes", BigBuf_max_traceLen());
 	Dbprintf("  Reader -> tag: %i bytes", MAX_FRAME_SIZE);
 	Dbprintf("  tag -> Reader: %i bytes", MAX_FRAME_SIZE);
-	Dbprintf("  DMA: %i bytes", DMA_BUFFER_SIZE);
+	Dbprintf("  DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE);

 	// Signal field is off, no reader signal, no tag signal
 	LEDsoff();
@@ -1098,9 +1083,12 @@ void RAMFUNC SnoopIso14443b(void)
 	// Setup for the DMA.
 	FpgaSetupSsc();
 	upTo = dmaBuf;
-	lastRxCounter = DMA_BUFFER_SIZE;
-	FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE);
+	lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
+	FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
 	uint8_t parity[MAX_PARITY_SIZE];
+
+	bool TagIsActive = FALSE;
+	bool ReaderIsActive = FALSE;
 		
 	bool TagIsActive = FALSE;
 	bool ReaderIsActive = FALSE;
@@ -1108,7 +1096,7 @@ void RAMFUNC SnoopIso14443b(void)
 	// And now we loop, receiving samples.
 	for(;;) {
 		int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
-								(DMA_BUFFER_SIZE-1);
+								(ISO14443B_DMA_BUFFER_SIZE-1);
 		if(behindBy > maxBehindBy) {
 			maxBehindBy = behindBy;
 		}
@@ -1119,11 +1107,15 @@ void RAMFUNC SnoopIso14443b(void)
 		cq = upTo[1];
 		upTo += 2;
 		lastRxCounter -= 2;
-		if(upTo >= dmaBuf + DMA_BUFFER_SIZE) {
+		if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
 			upTo = dmaBuf;
-			lastRxCounter += DMA_BUFFER_SIZE;
+			lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
 			AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
-			AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
+			AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
+			WDT_HIT();
+			if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
+				Dbprintf("blew circular buffer! behindBy=%d", behindBy);
+				break;
 			WDT_HIT();
 			if(behindBy > (9*DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
 				Dbprintf("blew circular buffer! behindBy=%d", behindBy);
@@ -1144,8 +1136,7 @@ void RAMFUNC SnoopIso14443b(void)
 		if (!TagIsActive) {							// no need to try decoding reader data if the tag is sending
 			if(Handle14443bUartBit(ci & 0x01)) {
 			if(triggered && tracing) {
-					//GetParity(Uart.output, Uart.byteCnt, parity);
-				LogTrace(Uart.output,Uart.byteCnt,samples, samples,parity,TRUE);
+					LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE);
 			}
 			/* And ready to receive another command. */
 			UartReset();
@@ -1155,8 +1146,7 @@ void RAMFUNC SnoopIso14443b(void)
 		}
 			if(Handle14443bUartBit(cq & 0x01)) {
 			if(triggered && tracing) {
-					//GetParity(Uart.output, Uart.byteCnt, parity);
-				LogTrace(Uart.output,Uart.byteCnt,samples, samples, parity, TRUE);
+					LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE);
 			}
 			/* And ready to receive another command. */
 			UartReset();
@@ -1174,8 +1164,7 @@ void RAMFUNC SnoopIso14443b(void)
 			if(tracing)
 			{
 				uint8_t parity[MAX_PARITY_SIZE];
-					//GetParity(Demod.output, Demod.len, parity);
-				LogTrace(Demod.output, Demod.len,samples, samples, parity, FALSE);
+					LogTrace(Demod.output, Demod.len, samples, samples, parity, FALSE);
 			}
 			triggered = TRUE;

@@ -1217,30 +1206,14 @@ void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, u
 	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 	FpgaSetupSsc();

-		set_tracing(TRUE);
+	set_tracing(TRUE);
 	
-/* 	if(!powerfield) {
-		// Make sure that we start from off, since the tags are stateful;
-		// confusing things will happen if we don't reset them between reads.
-		FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-		LED_D_OFF();
-		SpinDelay(200);
-	}
- */
-
-	// if(!GETBIT(GPIO_LED_D))	{	// if field is off
-		// FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
-		// // Signal field is on with the appropriate LED
-		// LED_D_ON();
-		// SpinDelay(200);
-	// }
-
 	CodeAndTransmit14443bAsReader(data, datalen);

 	if(recv) {
 		GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
-		uint16_t iLen = MIN(Demod.len,USB_CMD_DATA_SIZE);
-		cmd_send(CMD_ACK,iLen,0,0,Demod.output,iLen);
+		uint16_t iLen = MIN(Demod.len, USB_CMD_DATA_SIZE);
+		cmd_send(CMD_ACK, iLen, 0, 0, Demod.output, iLen);
 	}
 	
 	if(!powerfield) {
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -1043,10 +1043,10 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
 * To compensate antenna falling times shorten the write times
 * and enlarge the gap ones.
 */
-#define START_GAP 31*8 // was 250 // SPEC:   8 - 50fc [15fc]
-#define WRITE_GAP 20*8 // was 160 // SPEC:   8 - 20fc [10fc]
-#define WRITE_0   18*8 // was 144 // SPEC:  16 - 32fc [24fc]  192
-#define WRITE_1   50*8 // was 400 // SPEC:  48 - 64fc [56fc]  432 for T55x7; 448 for E5550
+#define START_GAP 31*8 // was 250 // SPEC:  1*8 to 50*8 - typ 15*8 (or 15fc)
+#define WRITE_GAP 20*8 // was 160 // SPEC:  1*8 to 20*8 - typ 10*8 (or 10fc)
+#define WRITE_0   18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (or 24fc)
+#define WRITE_1   50*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (or 56fc)  432 for T55x7; 448 for E5550

 //  VALUES TAKEN FROM EM4x function: SendForward
 //  START_GAP = 440;       (55*8) cycles at 125Khz (8us = 1cycle)