mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-05-12 11:18:11 -07:00
Merge pull request #1 from iceman1001/master
cross-merging fork to branch from Iceman's repository
This commit is contained in:
grauerfuchs
@@ -1,4 +1,6 @@
|
||||
# .gitattributes
|
||||
# prevent binary files from CRLF handling, diff and merge:
|
||||
fpga/fpga.bit -crlf -diff
|
||||
*.bin -crlf -diff
|
||||
*.z -crlf -diff
|
||||
|
||||
+29
-2
@@ -1,6 +1,7 @@
|
||||
# .gitignore
|
||||
# don't push these files to the repository
|
||||
|
||||
.history
|
||||
*.log
|
||||
*.eml
|
||||
*.o
|
||||
@@ -12,13 +13,25 @@
|
||||
*.bin
|
||||
*.dll
|
||||
*.moc.cpp
|
||||
*.z
|
||||
*.Td
|
||||
*.DS_Store
|
||||
*.exe
|
||||
proxmark
|
||||
*.dsym
|
||||
version.c
|
||||
|
||||
!client/hardnested/*.bin
|
||||
!client/hardnested/tables/*.z
|
||||
client/ui/ui_overlays.h
|
||||
|
||||
hardnested_stats.txt
|
||||
proxmark3
|
||||
flasher
|
||||
version.c
|
||||
lua
|
||||
luac
|
||||
fpga_compress
|
||||
mfkey32
|
||||
mfkey64
|
||||
|
||||
fpga/*
|
||||
!fpga/tests
|
||||
@@ -32,4 +45,18 @@ fpga/*
|
||||
!fpga/go.bat
|
||||
!fpga/sim.tcl
|
||||
|
||||
#client/*
|
||||
# my own traces folder
|
||||
client/traces/*
|
||||
*.ice
|
||||
*.new
|
||||
armsrc/TEMP EMV/*
|
||||
tools/mf_nonce_brute/*
|
||||
tools/andrew/*
|
||||
ppls patches/*
|
||||
*- Copy.*
|
||||
|
||||
client/lualibs/mf_default_keys.lua
|
||||
client/lualibs/usb_cmd.lua
|
||||
# recompiled
|
||||
fpga_version_info.c
|
||||
|
||||
+51
@@ -0,0 +1,51 @@
|
||||
# Travis-CI Build for IcemanFork/Proxmark3
|
||||
language: c
|
||||
|
||||
#default linux build env is: Ubuntu 14.04 trusty
|
||||
compiler: gcc
|
||||
|
||||
# Test on Linux and MacOS
|
||||
matrix:
|
||||
include:
|
||||
# - os: osx
|
||||
# osx_image: xcode7.3 # OS X 10.11
|
||||
# - os: osx
|
||||
# osx_image: xcode8.3 # OS X 10.12
|
||||
# - os: osx
|
||||
# osx_image: xcode9 # OS X 10.13
|
||||
- os: osx
|
||||
osx_image: xcode9.1 # OS X 10.13.1
|
||||
- os: linux
|
||||
dist: trusty
|
||||
sudo: required
|
||||
|
||||
before_install:
|
||||
## Install ARM toolchain on Linux.
|
||||
## add our homebrew tap for MacOS
|
||||
## Note: all dependencies on MacOS should be resolved by the brew install command
|
||||
if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then
|
||||
sudo apt-get update -qq;
|
||||
sudo apt-get install -y gcc-arm-none-eabi;
|
||||
elif [[ "$TRAVIS_OS_NAME" == "osx" ]]; then
|
||||
brew update;
|
||||
brew tap iceman1001/proxmark3;
|
||||
fi
|
||||
|
||||
install:
|
||||
if [[ "$TRAVIS_OS_NAME" == "osx" ]]; then
|
||||
brew info proxmark3;
|
||||
brew options proxmark3;
|
||||
brew install --HEAD proxmark3;
|
||||
elif [[ "$TRAVIS_OS_NAME" == "linux" ]]; then
|
||||
make all;
|
||||
fi
|
||||
|
||||
before_script:
|
||||
|
||||
script:
|
||||
## start and run a test script
|
||||
if [[ "$TRAVIS_OS_NAME" == "osx" ]]; then
|
||||
proxmark3 -h ;
|
||||
elif [[ "$TRAVIS_OS_NAME" == "linux" ]]; then
|
||||
./client/proxmark3 -h ;
|
||||
fi
|
||||
+333
@@ -0,0 +1,333 @@
|
||||
# Change Log
|
||||
All notable changes to this project will be documented in this file.
|
||||
This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
|
||||
|
||||
## [unreleased][unreleased]
|
||||
- Added more default keys (@j8048188) (@iceman)
|
||||
- Added 'sc list/info/raw/reader/upgrade' - (RDV40) smart card module functionality (@iceman)
|
||||
- Fix 'download eml buffer' (@drandreas)
|
||||
- Changed 'exclusion of floatingpoint lib' (@pwpiwi)
|
||||
- Changed 'lua scripts bit32 calls' (@iceman)
|
||||
- Changed 'hw version' (@pwpiwi), adapted to iceman fork ( @iceman)
|
||||
- Added 'amiibo functionality' (@jamchamb), adapted to iceman fork ( @iceman)
|
||||
- Fix 'hf legic' (RDV40) adaptations to FPGA HF enhanched reading distance (@iceman) Thanks to @drandreas!
|
||||
- Added 'script run mifare_acces' - script to decode Mifare classic accessbits (@Neuromancer)
|
||||
- Added 'mem load/save/wipe' - commands to upload / download to new RDV40 onboard flashmemory (@iceman)
|
||||
- Added 'script run mifareplus" - script to communicate with a mifare plus tag (@dceliano)
|
||||
- Added FlashMemory functionality (RDV40) (Thanks @willok)
|
||||
- Fix 'hf mfu dump' - partial reads lead to corrupt data (Thanks @elafargue for pointing it out)
|
||||
- Changed 'hf mfu dump / read' - now retries five times. (@jamchamb)
|
||||
- Added `hf list mf` - deciphers crypto1 stream and works with first authentication and weak nested authentications (@Merlok)
|
||||
- Adjusted `lf cmdread` to respond to client when complete and the client will then automatically call `data samples` (@marshmellow42)
|
||||
- Added a bitbang mode to `lf cmdread` if delay is 0 the cmd bits turn off and on the antenna with 0 and 1 respectively (@marshmellow42)
|
||||
- dump / restore now uses custom filenames (@brianpow)
|
||||
- Removed 'hf mf sniff' , (@iceman), use HF 14A SNIFF instead
|
||||
- Added 'hf iclass lookup' (@iceman)
|
||||
- Added 'hf iclass chk' (@iceman)
|
||||
- Fixed ADC mux all closed push-pull state (@iceman)
|
||||
- Fix 'hf mf darkside' - speed fixes (@pwpiwi)
|
||||
- Fix 'hw tune' - now compensates for 3% error in output, also measure full 140v using ADC channel 5 and 7. (@iceman)
|
||||
- Updated loclass gpl license (@holiman)
|
||||
- Fix Antenna on after changed FPGA Mode. (@iceman)
|
||||
- Added 'hf mf nack' - Mifare NACK bug detection (@iceman) (@doegox)
|
||||
- Fix 'hf mf mifare' - zero parity works, no more double runs for normal darkside (@iceman)
|
||||
- Added 'hf mf fchk' - the fastest check keys implementation tothisday (@iceman)
|
||||
- Fix 'hf iclass' - more stable demod (@iceman)
|
||||
- Added 'hf iclass chk' - check keys from default_iclass_keys.dic file (@iceman)
|
||||
- Fix 'hf 15 dump' - no more crc faults (@iceman)
|
||||
- Fix 'hf 15 read' - no more crc faults (@iceman)
|
||||
- Fix 'hf 15 readmulti' - no more crc faults (@iceman)
|
||||
- Changed proxmark command line parameter `flush` to `-f` or `-flush` (@merlokk)
|
||||
- Added to proxmark command line parameters `w` - wait 20s for serial port (@merlokk)
|
||||
- Added to proxmark command line parameters `c` and `l` - execute command and lua script from command line (@merlokk)
|
||||
- Added to proxmark ability to execute commands from stdin (pipe) ((@merlokk)
|
||||
- Added new standalone mode "HF Mifare ultra fast sniff/sim/clone - aka VIGIKPWN" (@cjbrigato)
|
||||
- Added to `hf 14a apdu` - exchange apdu via iso1443-4 (@merlokk)
|
||||
- Added to `hf 14a apdu` - apdu and tlv results parser (@merlokk)
|
||||
- Added 'hf emv' commands (@merlokk)
|
||||
- lots of bug fixes (many many)
|
||||
### Fixed
|
||||
- Changed driver file proxmark3.inf to support both old and new Product/Vendor IDs (piwi)
|
||||
- Changed start sequence in Qt mode (fix: short commands hangs main Qt thread) (Merlok)
|
||||
|
||||
## [ice.3.1.0][2017-09-26]
|
||||
- proxmark3 client can reconnect to device without restart (iceman)
|
||||
- lots of bug fixes (many many)
|
||||
- trace/securakey-64169.pm3 - trace of a scecurakey (atyppo)
|
||||
- 'hf mf decrypt' - got some longer input and helptext parameter (iceman)
|
||||
- Updated the Reveng 1.51 sourcecode to 1.52 from Reveng project homepage (iceman)
|
||||
- 'hf 14a read' - disconnects when failing to read tag (iceman)
|
||||
- 'hf mf csave' - renamed parameter 'i' to 'o' as in output (iceman)
|
||||
|
||||
## [3.0.0][2017-08-29]
|
||||
Notes on this release
|
||||
this version includes a merge with the PM3 offical v3.0.1 code, a.k.a the "Monster merge"
|
||||
There is a lot of changes, command breaking changes, which is the cause for the JUMP in version number.
|
||||
It is set to v3.0.0 to show that it is on par with PM3 Offical v3 release.
|
||||
|
||||
- Updated 'mkversion.pl' to write a date based on file when repo is downloaded as a zip file from github (iceman)
|
||||
- Update 'readme.md' to fit GitHubs markup(joanbono)
|
||||
- Added 'script run ul_uid', try to change UID on a magic UL-card. (iceman)
|
||||
- Fixed 'hf snoop' bug, of wrong bool value (ikarus23)
|
||||
- Fixed fullimage.s19, wrong offsets (doegox)
|
||||
- Updated '77-mm-usb-device-blacklist.rules' for the pid/vid (iceman)
|
||||
- 'hf 14a sim' now follows Mifare UL-EV1 protocol better (iceman)
|
||||
- Updated 'fpga_hf.bit' file (piwi)
|
||||
- Added more card detections to 'hf mfu info' (iceman)
|
||||
- Fixed 'hf mfu restore/dump' to use the right struct values in special data in dumpfile. (iceman)
|
||||
- Added 'hf mfu restore r' new parameter to use the new pwd for all further auths needed when executing (iceman)
|
||||
- Added 'default_keys_dic2lua.awk' script to generate default_keys file in client/lualibs (iceman)
|
||||
- Fixes to lots of lua scripts, among others
|
||||
- 'mifare_autopwn', now uses PRNG detection (iceman)
|
||||
- 'mfkeys', fixed bug which only tested the first key (iceman)
|
||||
- 'dumptoemul', removed last newline (iceman)
|
||||
- ...
|
||||
- Added USB/SERIAL communication enhancements (micolous)
|
||||
- Change 'hf 14a cuids', to be interrupted with keyboard press (iceman)
|
||||
- Change debugstatements for LF to show which function more unified (iceman)
|
||||
- Added 'script run calc_di' , to calculate some Mifare keys (iceman)
|
||||
- Fixed iclass commands never shut down antenna afterwards (iceman)
|
||||
- Change 512kb detection when flashing (iceman)
|
||||
- Fixed compilation GCC4.9 or higher detection (winguru)
|
||||
- Fixed compiler warnings in Ubuntu 17.04 (iceman)
|
||||
- Ripped out 'standalone' code into separete folder to be continued. (iceman)
|
||||
- 'hf mf nested', added key validation to entered key (merlokk)
|
||||
- 'hf mf hardnested', added key validation to enterd key (iceman)
|
||||
- Change a lot of help texts (iceman)
|
||||
- Fixed 'hf mf chk' - keyblock bug, limited keys to 256. (iceman)
|
||||
- Change 'hf mf dump' retries three times now before giving up (marshmellow)
|
||||
- Fixed 'mfu authentication', with pack-len error (iceman)
|
||||
- 'Script list', change sortorder to alphabetic order (iceman)
|
||||
- Change 'hf mfu gen' to read taguid (iceman)
|
||||
- Change 'hf mfu pwdgen' to read taguid (iceman)
|
||||
- Added 'hf mf setmod' sets Mifare Classic EV1 load modulation strength to card (angelsl)
|
||||
- Added 'hf 14a read' Mifare PRNG detection based on @doegox LIBNFC impl (iceman)
|
||||
- Added 'hf mf nonces', collects Mifare Classic nonces for analysing of PRNG (iceman)
|
||||
- Added new CSNS in 'hf iclass sim 2' attack (iceman)
|
||||
- Added more default keys (iceman)
|
||||
- Added analyse nuid, enable creation of Mifare NUID (iceman)
|
||||
- Updated the Reveng 1.44 sourcecode to 1.51 from Reveng project homepage (iceman)
|
||||
- script run formatMifare - got an option to execute the generate strings (iceman)
|
||||
- Fix 'hf mf cgetsc' (iceman)
|
||||
- Fix 'hf legic info' (iceman)
|
||||
- Change version output (iceman)
|
||||
- Added PAC/Stanley detection to lf search (marshmellow)
|
||||
- Added lf pac demod and lf pac read - extracts the raw blocks from a PAC/Stanley tag (marshmellow)
|
||||
- Added hf mf csave commands compatibity for 4k (Fl0-0)
|
||||
- Added data fsktonrz, a fsk cleaning/demodulating routine for weak fsk signal. Note: follow this up with a `data rawdemod nr` to finish demoding your signal. (marshmellow)
|
||||
- Added lf em 410xbrute, LF EM410x reader bruteforce attack by simulating UIDs from a file (Fl0-0)
|
||||
- Compiles on OS X
|
||||
- Compiles with gcc 4.9
|
||||
- Compiles for non-Intel CPUs
|
||||
- Added lf hitag write 24, the command writes a block to hitag2 tags in crypto mode (henjo)
|
||||
- Added the improved 'hf mf hardnested', an attack working for hardened Mifare cards (EV1, Mifare Plus SL1)
|
||||
- Added experimental testmode write option for t55xx (danger) (marshmellow)
|
||||
- Added t55xx p1detect to `lf search` chip detections (marshmellow)
|
||||
- Added lf t55xx p1detect, detect page 1 of a t55xx tag based on E015 mfg code (marshmellow)
|
||||
- Added lf noralsy demod, read, clone, sim commands (iceman)
|
||||
- Added lf jablotron demod, read, clone, sim commands (iceman)
|
||||
- Added lf nexwatch read - reads a nexwatch tag from the antenna
|
||||
- Added lf paradox read - reads a paradox tag from the antenna
|
||||
- Added lf fdx sim (iceman)
|
||||
- Added lf fdx clone - clones an fdx-b animal tag to t55x7 or q5 (iceman)
|
||||
- Added lf fdx read - reads a fdx-b tag from the antenna (iceman)
|
||||
- Added lf gproxii read - reads a gproxii tag from the antenna (marshmellow)
|
||||
- Added lf indala read - reads an indala tag from the antenna (marshmellow)
|
||||
- Added lf visa2000 demod, read, clone, sim commands (iceman)
|
||||
|
||||
## [1.7.0 iceman fork] [2017-03-07]
|
||||
- hf mf dump - added retry loops to try each read attempt up to 3 times. makes getting a complete dump easier with many antennas. (marshmellow)
|
||||
|
||||
- Added markers in the graph around found Sequence Terminator after askmandemod. (marshmellow)
|
||||
- Added data mtrim <start> <stop> command to trim out samples between start and stop. (marshmellow)
|
||||
- Added data setgraphmarkers <orange> <blue> command to set two extra markers on the graph (marshmellow)
|
||||
- added json support in lua (vitorio)
|
||||
- added a buspirate settings file for at91sam7s512 (adamlaurie)
|
||||
- `lf read` timeouts is now depended on what threshold level you set in `lf config` (marshmellow)
|
||||
- `hf mf sim` fixed a bug which made sim fail auths. (iceman)
|
||||
- `hf 14a read` added magic tag generation 1a and 1b detection (iceman)
|
||||
- correctly using stdtypes.h printf and scanf format string macros (PRIx64 et al) (pwpivi)
|
||||
- fix linker warning re missing entry point when linking fullimage.elf (pwpivi)
|
||||
- small changes to lf psk and fsk demods to improve results when the trace begins with noise or the chip isn't broadcasting yet (marshmellow)
|
||||
- NOTE CHANGED ALL `lf em4x em*` cmds to simpler `lf em ` - example: `lf em4x em410xdemod` is now `lf em 410xdemod`
|
||||
- Renamed and rebuilt `lf em readword` && readwordpwd to `lf em 4x05read` - it now demods and outputs the read block (marshmellow/iceman)
|
||||
- Renamed and rebuilt `lf em writeword` && writewordpwd to `lf em 4x05write` - it now also reads validation output from the tag (marshmellow/iceman)
|
||||
- Fixed bug in lf sim and continuous demods not turning off antenna when finished
|
||||
- Added lua script path fixes (pwpivi)
|
||||
- `lf search` - Added EM4x05/EM4x69 chip detection (marshmellow)
|
||||
- Added lf em 4x05dump command to read and output all the blocks of the chip (marshmellow)
|
||||
- Added lf em 4x05info command to read and display information about the chip (marshmellow)
|
||||
- `lf em4x em4x50***` refactoring of em4x50 commands. (iceman)
|
||||
|
||||
## [1.6.9 iceman fork] [2017-02-06]
|
||||
- Serial speedup, if possible 408600baud otherwise default to 115200baud (iceman)
|
||||
- `hf emv` - Added Peter Fillmore's EMV branch now compiles on iceman fork. See seperate issue. (iceman)
|
||||
- `hf 14a reader` - Aztek detection. (iceman)
|
||||
- `standalone mode` - added more detection of tags and refactored (iceman)
|
||||
- `script run ufodump` - dumps an Aztek tag. (iceman)
|
||||
- `script run hard_autopwn` - runs hardnested attack against all sectors on tag (iceman)
|
||||
- Added lf cotag read, and added it to lf search (iceman)
|
||||
- Added hitag2 read UID only and added that to lf search (marshmellow)
|
||||
- `lf search` - check for if signal is only noice (marshmellow)
|
||||
- `hf 14a reader` - fixed a bug when card has sak 0x00 but still is not UL/NTAG etc. (iceman)
|
||||
- `hf mf sim` / `hf 14a sim` - use random nonce. (micolous)
|
||||
- `hw tune` - only prints out if voltage is detected from antenna. (iceman)
|
||||
- `hf iclass decrypt` - only decrypt Application1 (iceman)
|
||||
- `lf t55xx detect` - when finding multiple possible config blocks, see if a known configblock exists and select. (iceman)
|
||||
|
||||
## [1.6.7 iceman fork] [2017-01-05]
|
||||
- `lf animal` - FDX-B animal commands (iceman)
|
||||
- Fixed bugs in `lf sim` and other lf continuous demods not turning off antenna when finished (marshmellow)
|
||||
- `hf iclass write` - fixed bugs, added crc. (?)
|
||||
- `hf iclass dump` - changed layout in dump (iceman)
|
||||
- Changed - debug statements are more clear (iceman)
|
||||
- `lf search` - fixed the silent option when acquire data. (iceman)
|
||||
- `lf search` - added presco, visa2000, noralsy detection (iceman)
|
||||
- `lf precso` - fixed some bitsgeneration in precso bits (iceman)
|
||||
- Added `lf noralsy` - adds demod/clone/sime of Noralsy LF tags. (iceman)
|
||||
- Added `lf visa2000` - adds demod/clone/sim of Visa2000 lF tags. (iceman)
|
||||
- Added `hf mf key_brute` - adds J-Runs 2nd phase bruteforce ref: https://github.com/J-Run/mf_key_brute (iceman)
|
||||
- Added `lf jablotron` - adds demod/clone/sim of Jablotron LF tags. (iceman)
|
||||
- Added `lf t55xx recoverpw` - adds a new password recovery using bitflips and partial flips if password write went bad. (alexgrin)
|
||||
- `hf legic` - added improved legic data mapping. (jason)
|
||||
- `hf mf mifare` - added possibility to target key A|B (douniwan5788)
|
||||
- Added `analyse lcr` - added a new main command group, to help analysing bytes & bits & nibbles. (iceman)
|
||||
- Added `lf nedap` - added identification of a NEDAP tag. (iceman)
|
||||
- `lf viking clone` - fixed a bug. (iceman)
|
||||
- Added bitsliced bruteforce solver in `hf mf hardnested` (Aczid)
|
||||
- `hf mf chk` speedup (iceman)
|
||||
- `hf 14a/mf sim x` attack mode, now uses also moebius version of mfkey32 to try finding the key. (iceman)
|
||||
- `hf 14a sim` Added emulation of Mifare cards with 10byte UID length. (iceman)
|
||||
- `hf mf sim` Added emulation of Mifare cards with 10byte UID length. (iceman)
|
||||
- Added `lf guard clone/sim` (iceman)
|
||||
- Added `lf pyramd clone/sim` (iceman)
|
||||
- trying to fix `hf 14b` command to be able to read CALYPSO card. (iceman)
|
||||
- `hf legic load`, it now loads faster and a casting bug is gone. (iceman)
|
||||
- Added `hf legic calccrc8` added a method to calculate the legic crc-8 value (iceman)
|
||||
- `hf legic decode` fixed the output overflow bugs, better printing (iceman)
|
||||
- Coverity Scan fixes a lot of resource leaks, etc (iceman)
|
||||
- Added `lf presco *` commands started (iceman)
|
||||
- Added `lf hid wiegand` added a method to calculate WIEGAND in different formats, (iceman)
|
||||
- `hf mf chkkeys` better printing, same table output as nested, faster execution and added Adam Lauries "try to read Key B if Key A is found" (iceman)
|
||||
- `hf mf nested` better printing and added Adam Lauries "try to read Key B if Key A is found" (iceman)
|
||||
- `hf mf mifare` fixing the zero parity path, which doesn't got called. (iceman)
|
||||
- Updated the @blapost's Crapto1 implementation to v3.3 (blapost)
|
||||
- `hf mf c*` updated the calling structure and refactored of the chinese magic commands (iceman, marshmellow)
|
||||
- Started to add Peter Fillmore's EMV fork into Iceman fork. ref: https://github.com/peterfillmore/proxmark3 (peter fillmore, iceman)
|
||||
- Added Travis-CI automatic build integration with GitHub fork. (iceman)
|
||||
- Updated the Reveng 1.30 sourcecode to 1.31 from Reveng project homepage (iceman)
|
||||
- Updated the Reveng 1.31 sourcecode to 1.40 from Reveng project homepage (iceman)
|
||||
|
||||
- Added possibility to write direct to a Legic Prime Tag (MIM256/1024) without using values from the 'BigBuffer' -> 'hf legic writeRaw <addr> <value>' (icsom)
|
||||
- Added possibility to decrease DCF values at address 0x05 & 0x06 on a Legic Prime Tag
|
||||
DCF-value will be pulled from the BigBuffer (address 0x05 & 0x06) so you have to
|
||||
load the data into the BigBuffer before with 'hf legic load <path/to/legic.dump>' & then
|
||||
write the DCF-Values (both at once) with 'hf legic write 0x05 0x02' (icsom)
|
||||
- Added script `legic.lua` for display and edit Data of Legic-Prime Tags (icsom)
|
||||
- Added the experimental HITAG_S support (spenneb)
|
||||
- Added topaz detection to `hf search` (iceman)
|
||||
- Fixed the silent mode for 14b to be used inside `hf search` (iceman)
|
||||
|
||||
### Added
|
||||
- Added a LF ASK Sequence Terminator detection option to the standard ask demod - and applied it to `lf search u`, `lf t55xx detect`, and `data rawdemod am s` (marshmellow)
|
||||
- `lf awid bruteforce <facilitycode>` - Simple bruteforce attack against a AWID reader.
|
||||
- `lf t55xx bruteforce <start password> <end password> [i <*.dic>]` - Simple bruteforce attack to find password - (iceman and others)
|
||||
- `lf viking clone`- clone viking tag to t55x7 or Q5 from 4byte hex ID input
|
||||
- `lf viking sim` - sim full viking tag from 4byte hex ID input
|
||||
- `lf viking read` - read viking tag and output ID
|
||||
- `lf t55xx wipe` - sets t55xx back to factory defaults
|
||||
- Added viking demod to `lf search` (marshmellow)
|
||||
- `data askvikingdemod` demod viking id tag from graphbuffer (marshmellow)
|
||||
- `lf t55xx resetread` added reset then read command - should allow determining start of stream transmissions (marshmellow)
|
||||
- `lf t55xx wakeup` added wake with password (AOR) to allow lf search or standard lf read after (iceman, marshmellow)
|
||||
- `hf mf eload u` added an ultralight/ntag option. (marshmellow)
|
||||
- `hf iclass managekeys` to save, load and manage iclass keys. (adjusted most commands to accept a loaded key in memory) (marshmellow)
|
||||
- `hf iclass readblk` to select, authenticate, and read 1 block from an iclass card (marshmellow)
|
||||
- `hf iclass writeblk` to select, authenticate, and write 1 block to an iclass card (or picopass) (marshmellow + others)
|
||||
- `hf iclass clone` to take a saved dump file and clone selected blocks to a new tag (marshmellow + others)
|
||||
- `hf iclass calcnewkey` - to calculate the div_key change to change a key - (experimental) (marshmellow + others)
|
||||
- `hf iclass encryptblk` - to encrypt a data block hex to prep for writing that block (marshmellow)
|
||||
- ISO14443a stand-alone operation with ARM CFLAG="WITH_ISO14443a_StandAlone". This code can read & emulate two banks of 14a tag UIDs and write to "magic" cards (Craig Young)
|
||||
- AWID26 command context added as 'lf awid' containing realtime demodulation as well as cloning/simulation based on tag numbers (Craig Young)
|
||||
- Added 'hw status'. This command makes the ARM print out some runtime information. (holiman)
|
||||
- Added 'hw ping'. This command just sends a usb packets and checks if the pm3 is responsive. Can be used to abort certain operations which supports abort over usb. (holiman)
|
||||
- Added `data hex2bin` and `data bin2hex` for command line conversion between binary and hexadecimal (holiman)
|
||||
- Added 'hf snoop'. This command take digitalized signal from FPGA and put in BigBuffer. (pwpiwi + enio)
|
||||
- Added Topaz (NFC type 1) protocol support ('hf topaz reader', 'hf list topaz', 'hf 14a raw -T', 'hf topaz snoop'). (piwi)
|
||||
- Added option c to 'hf list' (mark CRC bytes) (piwi)
|
||||
|
||||
### Changed
|
||||
- Added `[l] <length>` option to data printdemodbuffer
|
||||
- Adjusted lf awid clone to optionally clone to Q5 tags
|
||||
- Adjusted lf t55xx detect to find Q5 tags (t5555) instead of just t55x7
|
||||
- Adjusted all lf NRZ demods - works more accurately and consistently (as long as you have strong signal)
|
||||
- Adjusted lf pskindalademod to reduce false positive reads.
|
||||
- Small adjustments to psk, nrz, and ask clock detect routines - more reliable.
|
||||
- Adjusted lf em410x em410xsim to accept a clock argument
|
||||
- Adjusted lf t55xx dump to allow overriding the safety check and warning text (marshmellow)
|
||||
- Adjusted lf t55xx write input variables (marshmellow)
|
||||
- Adjusted lf t55xx read with password safety check and warning text and adjusted the input variables (marshmellow & iceman)
|
||||
- Adjusted LF FSK demod to account for cross threshold fluctuations (898 count waves will adjust the 9 to 8 now...) more accurate. (marshmellow)
|
||||
- Adjusted timings for t55xx commands. more reliable now. (marshmellow & iceman)
|
||||
- `lf cmdread` adjusted input methods and added help text (marshmellow & iceman)
|
||||
- changed `lf config t <threshold>` to be 0 - 128 and will trigger on + or - threshold value (marshmellow)
|
||||
- `hf iclass dump` cli options - can now dump AA1 and AA2 with different keys in one run (does not go to multiple pages for the larger tags yet) (marshmellow)
|
||||
- Revised workflow for StandAloneMode14a (Craig Young)
|
||||
- EPA functions (`hf epa`) now support both ISO 14443-A and 14443-B cards (frederikmoellers)
|
||||
- 'hw version' only talks to ARM at startup, after that the info is cached. (pwpiwi)
|
||||
- Added `r` option to iclass functions - allows key to be provided in raw block 3/4 format
|
||||
|
||||
## [2.2.0][2015-07-12]
|
||||
|
||||
### Changed
|
||||
- Added `hf 14b raw -s` option to auto select a 14b std tag before raw command
|
||||
- Changed `hf 14b write` to `hf 14b sriwrite` as it only applied to sri tags (marshmellow)
|
||||
- Added `hf 14b info` to `hf search` (marshmellow)
|
||||
- Added compression of fpga config and data, *BOOTROM REFLASH REQUIRED* (piwi)
|
||||
- Implemented better detection of mifare-tags that are not vulnerable to classic attacks (`hf mf mifare`, `hf mf nested`) (piwi)
|
||||
|
||||
### Added
|
||||
- Add `hf 14b reader` to find and print general info about known 14b tags (marshmellow)
|
||||
- Add `hf 14b info` to find and print info about std 14b tags and sri tags (using 14b raw commands in the client) (marshmellow)
|
||||
- Add PACE replay functionality (frederikmoellers)
|
||||
|
||||
### Fixed
|
||||
- t55xx write timing (marshmellow)
|
||||
|
||||
|
||||
## [2.1.0][2015-06-23]
|
||||
|
||||
### Changed
|
||||
- Added ultralight/ntag tag type detection to `hf 14a read` (marshmellow)
|
||||
- Improved ultralight dump command to auto detect tag type, take authentication, and dump full memory (or subset specified) of known tag types (iceman1001 / marshmellow)
|
||||
- Combined ultralight read/write commands and added authentication (iceman1001)
|
||||
- Improved LF manchester and biphase demodulation and ask clock detection especially for reads with heavy clipping. (marshmellow)
|
||||
- Iclass read, `hf iclass read` now also reads tag config and prints configuration. (holiman)
|
||||
- *bootrom* needs to be flashed, due to new address boundaries between os and fpga, after a size optimization (piwi)
|
||||
|
||||
### Fixed
|
||||
- Fixed EM4x50 read/demod of the tags broadcasted memory blocks. 'lf em4x em4x50read' (not page read) (marshmellow)
|
||||
- Fixed issue #19, problems with LF T55xx commands (iceman1001, marshmellow)
|
||||
- Fixed various problems with iso14443b, issue #103 (piwi, marshmellow)
|
||||
|
||||
### Added
|
||||
- Added `hf search` - currently tests for 14443a tags, iclass tags, and 15693 tags (marshmellow)
|
||||
- Added `hf mfu info` Ultralight/NTAG info command - reads tag configuration and info, allows authentication if needed (iceman1001, marshmellow)
|
||||
- Added Mifare Ultralight C and Ultralight EV1/NTAG authentication. (iceman1001)
|
||||
- Added changelog
|
||||
- Added `data fdxbdemod` - Demodulate a FDX-B ISO11784/85 Biphase tag from GraphBuffer aka ANIMAL TAG (marshmellow, iceman1001)
|
||||
|
||||
## [2.0.0] - 2015-03-25
|
||||
### Changed
|
||||
- LF sim operations now abort when new commands arrive over the USB - not required to push the device button anymore.
|
||||
|
||||
### Fixed
|
||||
- Mifare simulation, `hf mf sim` (was broken a long time) (pwpiwi)
|
||||
- Major improvements in LF area and data operations. (marshmellow, iceman1001)
|
||||
- Issues regarding LF simulation (pwpiwi)
|
||||
|
||||
### Added
|
||||
- iClass functionality: full simulation of iclass tags, so tags can be simulated with data (not only CSN). Not yet support for write/update, but readers don't seem to enforce update. (holiman).
|
||||
- iClass decryption. Proxmark can now decrypt data on an iclass tag, but requires you to have the HID decryption key locally on your computer, as this is not bundled with the sourcecode.
|
||||
|
||||
|
||||
+87
-8
@@ -1,12 +1,13 @@
|
||||
The project compiles on Linux, Mac OS X and Windows (MinGW/MSYS).
|
||||
|
||||
it requires:
|
||||
- gcc >= 4.4
|
||||
- gcc >= 4.8
|
||||
- libpthread
|
||||
- libreadline
|
||||
- libusb
|
||||
- perl
|
||||
- an ARM cross-compiler to compile the firmware
|
||||
- libncurses5-dev
|
||||
|
||||
and optionally QT for the GUI
|
||||
|
||||
@@ -16,7 +17,22 @@ To compile, just run "make".
|
||||
===========
|
||||
= Windows =
|
||||
===========
|
||||
The following is a complete list of packages required to setup the compile environment yourself. Alternatively you can download an archive of the full environment (see below).
|
||||
|
||||
Rather than download and install every one of these packages, a new ProxSpace
|
||||
environment archive file will be made available for download on the project
|
||||
page at @Gator96100's repo
|
||||
|
||||
Afterwards just clone the iceman repo or download someone elses. Read instructions on @Gator96100 repo page. (https://github.com/Gator96100/ProxSpace/)
|
||||
|
||||
Download the ProxSpace environment archive and extract it to C:\
|
||||
|
||||
Links
|
||||
https://github.com/Gator96100/ProxSpace/archive/master.zip
|
||||
|
||||
|
||||
-- OR --
|
||||
|
||||
Use the following list of packages required to setup the compile environment yourself.
|
||||
|
||||
1 - Install QT SDK for Windows [1]
|
||||
|
||||
@@ -71,17 +87,80 @@ Download links:
|
||||
[5] http://sourceforge.net/projects/devkitpro/files/Automated%20Installer/devkitProUpdater-1.5.0.exe/download
|
||||
[6] http://strawberry-perl.googlecode.com/files/strawberry-perl-5.10.1.1.msi
|
||||
|
||||
Rather than download and install every one of these packages, a new ProxSpace
|
||||
environment archive file will be made available for download on the project
|
||||
page at http://code.google.com/p/proxmark3/downloads/list
|
||||
|
||||
Download the ProxSpace environment archive and extract it to C:\
|
||||
|
||||
============
|
||||
= Mac OS X =
|
||||
============
|
||||
|
||||
macport stuff should do ;)
|
||||
Installing from HomeBrew tap
|
||||
---------------------------
|
||||
This method is recommended and tested on macOS Sierra 10.12.3
|
||||
|
||||
1. Install homebrew if you haven't yet already done so: http://brew.sh/
|
||||
|
||||
2. Tap proxmark repo:
|
||||
brew tap iceman1001/proxmark3
|
||||
|
||||
3. Install Proxmark3:
|
||||
|
||||
Stable release
|
||||
brew install proxmark3
|
||||
|
||||
Latest non-stable from GitHub (use this if previous command fails)
|
||||
brew install --HEAD proxmark3
|
||||
|
||||
For more information go to https://github.com/iceman1001/homebrew-proxmark3
|
||||
|
||||
Upgrading HomeBrew tap formula
|
||||
-----------------------------
|
||||
*This method is useful for those looking to run bleeding-edge versions of iceman's client. Keep this in mind when attempting to update your HomeBrew tap formula as this procedure could easily cause a build to break if an update is unstable on macOS.*
|
||||
|
||||
Tested on macOS Sierra 10.12.6
|
||||
|
||||
*Note: This assumes you have already installed iceman's fork from HomeBrew as mentioned above*
|
||||
|
||||
1. Force HomeBrew to pull the latest source from github
|
||||
`brew upgrade --fetch-HEAD iceman1001/proxmark3/proxmark3`
|
||||
|
||||
2. Flash the bootloader
|
||||
* With your Proxmark3 unplugged from your machine, press and hold the button on your Proxmark 3 as you plug it into a USB port. After about 5 seconds let go of the button and run this command
|
||||
`$ sudo proxmark3-flasher /dev/tty.usbmodem881 /usr/local/Cellar/proxmark3/HEAD-ccfdd60/share/firmware/fullimage.elf`
|
||||
* After the bootloader finishes flashing, unplug your Proxmark3 from your machine
|
||||
|
||||
3. Flash fullimage.elf
|
||||
* Press and hold the button on your Proxmark 3 and keep it held as you plug the Proxmark 3 back into the USB port; continue to hold the button until after this step is complete and the `proxmark3-flasher` command outputs "Have a nice day!"*
|
||||
|
||||
`$ sudo proxmark3-flasher /dev/tty.usbmodem881 /usr/local/Cellar/proxmark3/HEAD-ccfdd60/share/firmware/fullimage.elf`
|
||||
|
||||
4. Enjoy the update
|
||||
|
||||
Compilling from source manually (Legacy)
|
||||
---------------------------
|
||||
|
||||
Tested on OSX 10.10 Yosemite
|
||||
|
||||
1 - Install Xcode and Xcode Command Line Tools
|
||||
|
||||
2 - Install Homebrew and dependencies
|
||||
brew install readline libusb p7zip libusb-compat wget qt5 pkgconfig
|
||||
|
||||
3 - Download DevKitARM for OSX
|
||||
http://sourceforge.net/projects/devkitpro/files/devkitARM/devkitARM_r44/
|
||||
Unpack devkitARM_r44-osx.tar.bz2 to proxmark3 directory.
|
||||
|
||||
4 - Edit proxmark3/client/Makefile adding path to readline and qt5
|
||||
|
||||
LDLIBS = -L/usr/local/opt/readline/lib -L/usr/local/opt/qt5/lib -L/opt/local/lib -L/usr/local/lib ../liblua/liblua.a -lreadline -lpthread -lm
|
||||
CFLAGS = -std=c99 -I/usr/local/opt/qt5/include -I/usr/local/opt/readline/include -I. -I../include -I../common -I../zlib -I/opt/local/include -I../liblua -Wall $(COMMON_FLAGS) -g -O4
|
||||
|
||||
If your old brew intallation use /usr/local/Cellar/ path replace /usr/local/opt/readline/lib with your actuall readline and qt5 path. See homebrew manuals.
|
||||
|
||||
5 - Set Environment
|
||||
|
||||
export DEVKITPRO=$HOME/proxmark3/
|
||||
export DEVKITARM=$DEVKITPRO/devkitARM
|
||||
export PATH=${PATH}:${DEVKITARM}/bin
|
||||
|
||||
|
||||
============
|
||||
= Linux =
|
||||
|
||||
@@ -1,10 +1,34 @@
|
||||
include common/Makefile.common
|
||||
|
||||
GZIP=gzip
|
||||
# Windows' echo echos its input verbatim, on Posix there is some
|
||||
# amount of shell command line parsing going on. echo "" on
|
||||
# Windows yields literal "", on Linux yields an empty line
|
||||
ifeq ($(shell echo ""),)
|
||||
# This is probably a proper system, so we can use uname
|
||||
DELETE=rm -rf
|
||||
FLASH_TOOL=client/flasher
|
||||
platform=$(shell uname)
|
||||
ifneq (,$(findstring MINGW,$(platform)))
|
||||
FLASH_PORT=com3
|
||||
PATHSEP=\\#
|
||||
else
|
||||
FLASH_PORT=/dev/ttyACM0
|
||||
PATHSEP=/
|
||||
endif
|
||||
else
|
||||
# Assume that we are running on native Windows
|
||||
DELETE=del /q
|
||||
FLASH_TOOL=client/flasher.exe
|
||||
platform=Windows
|
||||
FLASH_PORT=com3
|
||||
PATHSEP=\\#
|
||||
endif
|
||||
|
||||
all clean: %: bootrom/% armsrc/% client/% recovery/%
|
||||
all clean: %: client/% bootrom/% armsrc/% recovery/% mfkey/% nonce2key/%
|
||||
|
||||
mfkey/%: FORCE
|
||||
$(MAKE) -C tools/mfkey $(patsubst mfkey/%,%,$@)
|
||||
nonce2key/%: FORCE
|
||||
$(MAKE) -C tools/nonce2key $(patsubst nonce2key/%,%,$@)
|
||||
bootrom/%: FORCE
|
||||
$(MAKE) -C bootrom $(patsubst bootrom/%,%,$@)
|
||||
armsrc/%: FORCE
|
||||
@@ -15,35 +39,29 @@ recovery/%: FORCE
|
||||
$(MAKE) -C recovery $(patsubst recovery/%,%,$@)
|
||||
FORCE: # Dummy target to force remake in the subdirectories, even if files exist (this Makefile doesn't know about the prerequisites)
|
||||
|
||||
.PHONY: all clean help _test flash-bootrom flash-os flash-all FORCE
|
||||
|
||||
.PHONY: all clean help _test flash-bootrom flash-os flash-fpga flash-both flash-all FORCE
|
||||
help:
|
||||
@echo Multi-OS Makefile, you are running on $(DETECTED_OS)
|
||||
@echo Possible targets:
|
||||
@echo + all - Make bootrom, armsrc and the OS-specific host directory
|
||||
@echo + client - Make only the OS-specific host directory
|
||||
@echo + flash-bootrom - Make bootrom and flash it
|
||||
@echo + flash-os - Make armsrc and flash os
|
||||
@echo + flash-fpga - Make armsrc and flash fpga
|
||||
@echo + flash-both - Make armsrc and flash os and fpga image
|
||||
@echo + flash-all - Make bootrom and armsrc and flash bootrom, os and fpga image
|
||||
@echo + flash-os - Make armsrc and flash os \(includes fpga\)
|
||||
@echo + flash-all - Make bootrom and armsrc and flash bootrom and os image
|
||||
@echo + mfkey - Make tools/mfkey
|
||||
@echo + nounce2key - Make tools/nounce2key
|
||||
@echo + clean - Clean in bootrom, armsrc and the OS-specific host directory
|
||||
|
||||
|
||||
client: client/all
|
||||
|
||||
flash-bootrom: bootrom/obj/bootrom.elf $(FLASH_TOOL)
|
||||
$(FLASH_TOOL) $(FLASH_PORT) -b $(subst /,$(PATHSEP),$<)
|
||||
|
||||
flash-os: armsrc/obj/osimage.elf $(FLASH_TOOL)
|
||||
flash-os: armsrc/obj/fullimage.elf $(FLASH_TOOL)
|
||||
$(FLASH_TOOL) $(FLASH_PORT) $(subst /,$(PATHSEP),$<)
|
||||
|
||||
flash-fpga: armsrc/obj/fpgaimage.elf $(FLASH_TOOL)
|
||||
$(FLASH_TOOL) $(FLASH_PORT) $(subst /,$(PATHSEP),$<)
|
||||
|
||||
flash-both: armsrc/obj/osimage.elf armsrc/obj/fpgaimage.elf $(FLASH_TOOL)
|
||||
$(FLASH_TOOL) $(FLASH_PORT) $(subst /,$(PATHSEP),$(filter-out $(FLASH_TOOL),$^))
|
||||
|
||||
flash-all: bootrom/obj/bootrom.elf armsrc/obj/osimage.elf armsrc/obj/fpgaimage.elf $(FLASH_TOOL)
|
||||
flash-all: bootrom/obj/bootrom.elf armsrc/obj/fullimage.elf $(FLASH_TOOL)
|
||||
$(FLASH_TOOL) $(FLASH_PORT) -b $(subst /,$(PATHSEP),$(filter-out $(FLASH_TOOL),$^))
|
||||
|
||||
newtarbin:
|
||||
@@ -53,5 +71,22 @@ newtarbin:
|
||||
tarbin: newtarbin client/tarbin armsrc/tarbin bootrom/tarbin
|
||||
$(GZIP) proxmark3-$(platform)-bin.tar
|
||||
|
||||
# configure system
|
||||
# - to ignore PM3 device as a modem (blacklist)
|
||||
# - add user to the dialout group
|
||||
# you may need to logout, relogin to get this access right correct.
|
||||
# Finally, you might need to run the proxmark3 client under SUDO on some systems
|
||||
udev:
|
||||
sudo cp -rf driver/77-mm-usb-device-blacklist.rules /etc/udev/rules.d/77-mm-usb-device-blacklist.rules
|
||||
sudo udevadm control --reload-rules
|
||||
ifneq ($(wildcard /etc/arch-release),) #If user is running ArchLinux
|
||||
sudo usermod -aG uucp $(USER) #Use specific command and group
|
||||
else
|
||||
sudo adduser $(USER) dialout
|
||||
endif
|
||||
|
||||
# easy printing of MAKE VARIABLES
|
||||
print-%: ; @echo $* = $($*)
|
||||
|
||||
# Dummy target to test for GNU make availability
|
||||
_test:
|
||||
|
||||
@@ -0,0 +1,225 @@
|
||||
Iceman fork
|
||||
===============
|
||||
[](https://travis-ci.org/iceman1001/proxmark3)[](https://scan.coverity.com/project/proxmark3_iceman_fork)[](https://github.com/iceman1001/proxmark3/releases/latest)
|
||||
|
||||
## This fork is HIGHLY experimental and bleeding edge
|
||||
|
||||
|
||||
The kickstarter for the latest revision of proxmark is out.
|
||||
[proxmark3 rdv4.0](https://www.kickstarter.com/projects/1408815241/proxmark3-rdv-40)
|
||||
|
||||
That one is a beauty!
|
||||
|
||||
|
||||
|
||||
|
||||
## Nothing says thank you as much as a donation
|
||||
https://paypal.me/iceman1001/ Feel free to donate. All support is welcome.
|
||||
|
||||
monereo: 43mNJLpgBVaTvyZmX9ajcohpvVkaRy1kbZPm8tqAb7itZgfuYecgkRF36rXrKFUkwEGeZedPsASRxgv4HPBHvJwyJdyvQuP
|
||||
|
||||
## Notice
|
||||
There is so much in this fork, with all fixes and additions its basically the most enhanced fork to this day for the Proxmark3 device. Which makes it so awesum to play with. Do please play with it. Get excited and experiment. As a side note with all coverity scan fixes this client is much more stable than PM3 Master even if I tend to break it sometimes. I'll try to make a release when this fork becomes stable between my experiments.
|
||||
|
||||
## Coverity Scan Config & Run
|
||||
Download the Coverity Scan Self-buld and install it.
|
||||
You will need to configure ARM-NON-EABI- Compiler for it to use:
|
||||
|
||||
- Configure
|
||||
|
||||
`cov-configure --comptype gcc --compiler /opt/devkitpro/devkitARM/bin/arm-none-eabi-gcc`
|
||||
|
||||
- Run it (I'm running on Ubuntu)
|
||||
|
||||
`cov-build --dir cov-int make all`
|
||||
|
||||
- Make a tarball
|
||||
|
||||
`tar czvf proxmark3.tgz cov-int`
|
||||
|
||||
- Upload it to coverity.com
|
||||
|
||||
|
||||
## Whats changed?
|
||||
Whats so special with this fork? I have scraped the web for different enhancements to the PM3 source code and not all of them ever found their way to the master branch.
|
||||
Among the stuff is
|
||||
|
||||
* Jonor's hf 14a raw timing patch
|
||||
* Piwi's updates. (usually gets into the master)
|
||||
* Piwi's "topaz" branch
|
||||
* Piwi's "hardnested" branch
|
||||
* Holiman's iclass, (usually gets into the master)
|
||||
* Marshmellow's fixes (usually gets into the master)
|
||||
* Midnitesnake's Ultralight, Ultralight-c enhancements
|
||||
* Izsh's lf peak modification / iir-filtering
|
||||
* Aspers's tips and tricks from inside the PM3-gui-tool, settings.xml and other stuff.
|
||||
* My own desfire, Ultralight extras, LF T55xx enhancements, bugs fixes (filelength, hf mf commands ), TNP3xxx lua scripts, Awid26, skidata scripts (will come)
|
||||
* other obscure patches like for the sammy-mode, (offline you know), tagidentifications, defaultkeys.
|
||||
* Minor textual changes here and there.
|
||||
* Simulation of Ultralight/Ntag.
|
||||
* Marshmellow's and my "RevEng" addon for the client. Ref: http://reveng.sourceforge.net/ Now using reveng1.44
|
||||
* J-Run alternative bruteforce Mifare nested auths.. (you need one other exe to make it work)
|
||||
* A Bruteforce for T55XX passwords against tag.
|
||||
* A Bruteforce for AWID 26, starting w a facilitycode then trying all 0xFFFF cardnumbers via simulation. To be used against a AWID Reader.
|
||||
* A Bruteforce for HID, starting w a facilitycode then trying all 0xFFFF cardnumbers via simulation. To be used against a HID Reader.
|
||||
* Blaposts Crapto1 v3.3
|
||||
* Icsom's legic script and legic enhancements
|
||||
* Aczid's bitsliced bruteforce solver in 'hf mf hardnested'
|
||||
|
||||
---
|
||||
## Why don't you merged with offical PM3 Master?
|
||||
Me fiddling with the code so much, there is a nightmare in merging a PR. I will never find time to do PR because of it. Much of what you find here is not in the interest for offical PM3. However and luckily I have @marshmellow42 who takes some stuff and push PR's back. The separation from offical pm3 repo gives me very much freedom to create a firmware/client in the way I want to use the PM3.
|
||||
|
||||
## Why don't you add this or that functionality?
|
||||
Give me a hint, and I'll see if I can't merge in the stuff you have.
|
||||
|
||||
## PM3 GUI
|
||||
I do tend to rename and move stuff around, the official PM3-GUI from Gaucho will not work so well. *sorry*
|
||||
|
||||
## Development
|
||||
This fork now compiles just fine on
|
||||
- Windows/mingw environment with Qt5.6.1 & GCC 4.8
|
||||
- Ubuntu 1404, 1510, 1604
|
||||
- Mac OS X / Homebrew
|
||||
- Docker container
|
||||
|
||||
## Setup and build for UBUNTU
|
||||
GC made updates to allow this to build easily on Ubuntu 14.04.2 LTS, 15.10 or 16.04
|
||||
See https://github.com/Proxmark/proxmark3/wiki/Ubuntu%20Linux
|
||||
|
||||
A nice and cool install script made by @daveio is found here:
|
||||
https://github.com/daveio/attacksurface/blob/master/proxmark3/pm3-setup.sh
|
||||
I have also added this script to the fork.
|
||||
https://github.com/iceman1001/proxmark3/blob/master/install.sh
|
||||
|
||||
- Run
|
||||
`sudo apt-get install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev gcc-arm-none-eabi`
|
||||
|
||||
- Clone iceman fork
|
||||
`git clone https://github.com/iceman1001/proxmark3.git`
|
||||
|
||||
- Get the latest commits
|
||||
`git pull`
|
||||
|
||||
- Install the blacklist rules and add user to dialout group (if you on a Linux/ubuntu/debian). If you do this one, you need to logout and login in again to make sure your rights got changed.
|
||||
`make udev`
|
||||
|
||||
- Clean and complete compilation
|
||||
`make clean && make all`
|
||||
|
||||
- Flash the BOOTROM & FULLIMAGE
|
||||
`client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf armsrc/obj/fullimage.elf`
|
||||
|
||||
- Change into the client folder
|
||||
`cd client`
|
||||
|
||||
- Run the client
|
||||
`./proxmark3 /dev/ttyACM0`
|
||||
|
||||
## Setup and build for ArchLinux
|
||||
- Run
|
||||
`sudo pacman -Sy base-devel p7zip libusb readline ncurses arm-none-eabi-newlib --needed`
|
||||
`yaourt -S termcap`
|
||||
|
||||
- Clone iceman fork
|
||||
`git clone https://github.com/iceman1001/proxmark3.git`
|
||||
|
||||
- Get the latest commits
|
||||
`git pull`
|
||||
|
||||
- Install the blacklist rules and add user to dialout group (if you on a Linux/ubuntu/debian). If you do this one, you need to logout and login in again to make sure your rights got changed.
|
||||
`make udev`
|
||||
|
||||
- Clean and complete compilation
|
||||
`make clean && make all`
|
||||
|
||||
- Flash the BOOTROM & FULLIMAGE
|
||||
`client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf armsrc/obj/fullimage.elf`
|
||||
|
||||
- Change into the client folder
|
||||
`cd client`
|
||||
|
||||
- Run the client
|
||||
`./proxmark3 /dev/ttyACM0`
|
||||
|
||||
## Homebrew (Mac OS X)
|
||||
These instructions comes from @Chrisfu, where I got the proxmark3.rb scriptfile from.
|
||||
Further questions about Mac & Homebrew, contact @Chrisfu (https://github.com/chrisfu/)
|
||||
|
||||
1. Install homebrew if you haven't yet already done so: http://brew.sh/
|
||||
|
||||
2. Tap this repo: `brew tap iceman1001/proxmark3`
|
||||
|
||||
3. Install Proxmark3: `brew install proxmark3` for stable release or `brew install --HEAD proxmark3` for latest non-stable from GitHub.
|
||||
|
||||
Upgrading HomeBrew tap formula
|
||||
-----------------------------
|
||||
*This method is useful for those looking to run bleeding-edge versions of iceman's client. Keep this in mind when attempting to update your HomeBrew tap formula as this procedure could easily cause a build to break if an update is unstable on macOS.*
|
||||
|
||||
Tested on macOS High Sierra 10.13.2
|
||||
|
||||
*Note: This assumes you have already installed iceman's fork from HomeBrew as mentioned above*
|
||||
|
||||
1. Force HomeBrew to pull the latest source from github
|
||||
`brew upgrade --fetch-HEAD iceman1001/proxmark3/proxmark3`
|
||||
|
||||
2. Flash the bootloader & fullimage.elf
|
||||
* With your Proxmark3 unplugged from your machine, press and hold the button on your Proxmark 3 as you plug it into a USB port. Continue to hold the button until after this step is complete and the `proxmark3-flasher` command outputs "Have a nice day!"*
|
||||
`$ sudo proxmark3-flasher /dev/tty.usbmodem881 -b /usr/local/Cellar/proxmark3/HEAD-6a710ef/share/firmware/bootrom.elf /usr/local/Cellar/proxmark3/HEAD-6a710ef/share/firmware/fullimage.elf`
|
||||
|
||||
|
||||
`$ sudo proxmark3-flasher /dev/tty.usbmodem881 `
|
||||
|
||||
4. Enjoy the update
|
||||
|
||||
## Docker container
|
||||
I recently added a docker container on Docker HUB. You find it here: https://hub.docker.com/r/iceman1001/proxmark3/
|
||||
Follow those instructions to get it up and running. No need for the old proxspace-environment anymore.
|
||||
|
||||
-[1.6.0] How to start: https://www.youtube.com/watch?v=b5Zta89Cf6Q
|
||||
-[1.6.0] How to connect: https://youtu.be/0ZS2t5C-caI
|
||||
-[1.6.1] How to flash: https://www.youtube.com/watch?v=WXouhuGYEiw
|
||||
|
||||
Recommendations: Use only latest container.
|
||||
|
||||
|
||||
## Building on Windows
|
||||
|
||||
### Gator96100 distro
|
||||
Rather than download and install every one of these packages, a new ProxSpace
|
||||
environment archive file will be made available for download on the project
|
||||
page at @Gator96100's repo
|
||||
|
||||
Afterwards just clone the iceman repo or download someone elses.
|
||||
Read instructions on @Gator96100 repo page. (https://github.com/Gator96100/ProxSpace/)
|
||||
|
||||
Links
|
||||
- https://github.com/Gator96100/ProxSpace/archive/master.zip
|
||||
- https://github.com/Gator96100/ProxSpace/releases/tag/v2.2 (release v2.2 with gcc v5.3.0 arm-none-eabi-gcc v7.1.0)
|
||||
- https://github.com/Gator96100/ProxSpace/releases/tag/v2.1 (release v2.1 with gcc v5.3.0)
|
||||
|
||||
|
||||
### 7. Build and run
|
||||
|
||||
- Clone iceman fork
|
||||
`git clone https://github.com/iceman1001/proxmark3.git`
|
||||
|
||||
- Get the latest commits
|
||||
`git pull`
|
||||
|
||||
- CLEAN COMPILE
|
||||
`make clean && make all`
|
||||
|
||||
Assuming you have Proxmark3 Windows drivers installed you can run the Proxmark software where "X" is the com port number assigned to proxmark3 under Windows.
|
||||
|
||||
- Flash the BOOTROM & FULLIMAGE
|
||||
`client/flasher.exe comX -b bootrom/obj/bootrom.elf armsrc/obj/fullimage.elf`
|
||||
|
||||
- Change into the client folder
|
||||
`cd client`
|
||||
|
||||
- Run the client
|
||||
`proxmark3.exe comX`
|
||||
|
||||
iceman at host iuse.se
|
||||
January 2015, Sweden
|
||||
-88
@@ -1,88 +0,0 @@
|
||||
NOTICE:
|
||||
(2014-03-26)
|
||||
This is now the official Proxmark repository!
|
||||
|
||||
INTRODUCTION:
|
||||
|
||||
The proxmark3 is a powerful general purpose RFID tool, the size of a deck
|
||||
of cards, designed to snoop, listen and emulate everything from
|
||||
Low Frequency (125kHz) to High Frequency (13.56MHz) tags.
|
||||
|
||||
This repository contains enough software, logic (for the FPGA), and design
|
||||
documentation for the hardware that you could, at least in theory,
|
||||
do something useful with a proxmark3.
|
||||
|
||||
RESOURCES:
|
||||
|
||||
* This repository!
|
||||
https://github.com/Proxmark/proxmark3
|
||||
|
||||
* The Wiki
|
||||
https://github.com/Proxmark/proxmark3/wiki
|
||||
|
||||
* The GitHub page
|
||||
http://proxmark.github.io/proxmark3/
|
||||
|
||||
* The Forum
|
||||
http://www.proxmark.org/forum
|
||||
|
||||
* The IRC chanel
|
||||
irc.freenode.org #proxmark3
|
||||
-or-
|
||||
http://webchat.freenode.net/?channels=#proxmark3
|
||||
|
||||
DEVELOPMENT:
|
||||
|
||||
The tools required to build or run the project will vary depending on
|
||||
your operating system. Please refer to the Wiki for details.
|
||||
|
||||
* https://github.com/Proxmark/proxmark3/wiki
|
||||
|
||||
OBTAINING HARDWARE:
|
||||
|
||||
The Proxmark 3 is available for purcahse (assembled and tested) from the
|
||||
following locations:
|
||||
|
||||
* http://proxmark3.com/
|
||||
* http://www.xfpga.com/
|
||||
|
||||
Most of the ultra-low-volume contract assemblers could put
|
||||
something like this together with a reasonable yield. A run of around
|
||||
a dozen units is probably cost-effective. The BOM includes (possibly-
|
||||
outdated) component pricing, and everything is available from Digikey
|
||||
and the usual distributors.
|
||||
|
||||
If you've never assembled a modern circuit board by hand, then this is
|
||||
not a good place to start. Some of the components (e.g. the crystals)
|
||||
must not be assembled with a soldering iron, and require hot air.
|
||||
|
||||
The schematics are included; the component values given are not
|
||||
necessarily correct for all situations, but it should be possible to do
|
||||
nearly anything you would want with appropriate population options.
|
||||
|
||||
The printed circuit board artwork is also available, as Gerbers and an
|
||||
Excellon drill file.
|
||||
|
||||
|
||||
LICENSING:
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 2 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program; if not, write to the Free Software
|
||||
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
|
||||
|
||||
Jonathan Westhues
|
||||
user jwesthues, at host cq.cx
|
||||
|
||||
May 2007, Cambridge MA
|
||||
|
||||
+290
@@ -0,0 +1,290 @@
|
||||
version: 3.0.1.{build}
|
||||
image: Visual Studio 2017
|
||||
clone_folder: C:\ProxSpace\pm3
|
||||
init:
|
||||
- ps: >-
|
||||
$psversiontable
|
||||
|
||||
#Get-ChildItem Env:
|
||||
|
||||
|
||||
$releasename=""
|
||||
|
||||
$env:APPVEYOR_REPO_COMMIT_SHORT = $env:APPVEYOR_REPO_COMMIT.Substring(0, 8)
|
||||
|
||||
if ($env:appveyor_repo_tag -match "true"){
|
||||
$releasename=$env:APPVEYOR_REPO_TAG_NAME + "/"
|
||||
}
|
||||
|
||||
$releasename+=$env:APPVEYOR_BUILD_VERSION + " [" + $env:APPVEYOR_REPO_COMMIT_SHORT + "]"
|
||||
|
||||
|
||||
Write-Host "repository: $env:appveyor_repo_name branch:$env:APPVEYOR_REPO_BRANCH release: $releasename" -ForegroundColor Yellow
|
||||
|
||||
Add-AppveyorMessage -Message "[$env:APPVEYOR_REPO_COMMIT_SHORT]$env:appveyor_repo_name($env:APPVEYOR_REPO_BRANCH)" -Category Information -Details "repository: $env:appveyor_repo_name branch: $env:APPVEYOR_REPO_BRANCH release: $releasename"
|
||||
|
||||
|
||||
iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
|
||||
clone_script:
|
||||
- ps: >-
|
||||
Write-Host "Removing ProxSpace..." -NoNewLine
|
||||
|
||||
cd \
|
||||
|
||||
Remove-Item -Recurse -Force -Path c:\ProxSpace\*
|
||||
|
||||
Write-Host "[ OK ]" -ForegroundColor Green
|
||||
|
||||
|
||||
Write-Host "Git clone ProxSpace..." -NoNewLine
|
||||
|
||||
git clone -q https://github.com/Gator96100/ProxSpace c:\ProxSpace
|
||||
|
||||
Write-Host "[ OK ]" -ForegroundColor Green
|
||||
|
||||
|
||||
Write-Host "Removing pm3 dir..." -NoNewLine
|
||||
|
||||
Remove-Item -Recurse -Force -Path c:\ProxSpace\pm3\*
|
||||
|
||||
Write-Host "[ OK ]" -ForegroundColor Green
|
||||
|
||||
|
||||
Write-Host "Cloning repository <$env:appveyor_repo_name> to $env:appveyor_build_folder ..." -NoNewLine
|
||||
|
||||
if(-not $env:appveyor_pull_request_number) {
|
||||
git clone -q --branch=$env:appveyor_repo_branch https://github.com/$env:appveyor_repo_name.git $env:appveyor_build_folder
|
||||
cd $env:appveyor_build_folder
|
||||
git checkout -qf $env:appveyor_repo_commit
|
||||
} else {
|
||||
git clone -q https://github.com/$env:appveyor_repo_name.git $env:appveyor_build_folder
|
||||
cd $env:appveyor_build_folder
|
||||
git fetch -q origin +refs/pull/$env:appveyor_pull_request_number/merge:
|
||||
git checkout -qf FETCH_HEAD
|
||||
}
|
||||
|
||||
Write-Host "[ OK ]" -ForegroundColor Green
|
||||
|
||||
|
||||
Write-Host "Fill msys\etc\fstab file..." -NoNewLine
|
||||
|
||||
New-Item c:\ProxSpace\msys\etc\fstab -type file -force -value "#Win32_Path Mount_Point`nc:\ProxSpace\devkitARM /devkitARM`nc:\ProxSpace\Qt\5.6 /qt `nc:\ProxSpace\pm3 /pm3`n"
|
||||
|
||||
Write-Host "[ OK ]" -ForegroundColor Green
|
||||
install:
|
||||
- ps: >-
|
||||
function Exec-External {
|
||||
param(
|
||||
[Parameter(Position=0,Mandatory=1)][scriptblock] $command
|
||||
)
|
||||
& $command
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
throw ("Command returned non-zero error-code ${LASTEXITCODE}: $command")
|
||||
}
|
||||
}
|
||||
build_script:
|
||||
- ps: >-
|
||||
$env:Path = "C:\ProxSpace\msys\bin;$env:Path"
|
||||
|
||||
|
||||
#make
|
||||
|
||||
bash -lc -i "pwd;make all"
|
||||
|
||||
|
||||
#some checks
|
||||
|
||||
if(!(Test-Path C:\ProxSpace\pm3\client\proxmark3.exe)){
|
||||
|
||||
throw "Main file proxmark3.exe not exists."
|
||||
|
||||
}
|
||||
|
||||
if(!(Test-Path C:\ProxSpace\pm3\armsrc\obj\fullimage.elf)){
|
||||
|
||||
throw "ARM file fullimage.elf not exists."
|
||||
|
||||
}
|
||||
|
||||
if(!(Test-Path C:\ProxSpace\pm3\client\hardnested\tables\*.bin.z)){
|
||||
|
||||
throw "Files in hardnested\tables not exists."
|
||||
|
||||
}
|
||||
|
||||
|
||||
#copy
|
||||
|
||||
Write-Host "Copy release files..." -NoNewLine -ForegroundColor Yellow
|
||||
|
||||
New-Item -ItemType Directory -Force -Path C:\ProxSpace\Release
|
||||
|
||||
Copy-Item C:\ProxSpace\pm3\client\*.exe C:\ProxSpace\Release
|
||||
|
||||
New-Item -ItemType Directory -Force -Path C:\ProxSpace\Release\arm
|
||||
|
||||
Copy-Item C:\ProxSpace\pm3\armsrc\obj\*.elf C:\ProxSpace\Release\arm
|
||||
|
||||
Copy-Item C:\ProxSpace\pm3\bootrom\obj\*.elf C:\ProxSpace\Release\arm
|
||||
|
||||
New-Item -ItemType Directory -Force -Path C:\ProxSpace\Release\scripts
|
||||
|
||||
Copy-Item C:\ProxSpace\pm3\client\scripts\*.lua C:\ProxSpace\Release\scripts
|
||||
|
||||
New-Item -ItemType Directory -Force -Path C:\ProxSpace\Release\hardnested\tables
|
||||
|
||||
Copy-Item C:\ProxSpace\pm3\client\hardnested\*.bin C:\ProxSpace\Release\hardnested
|
||||
|
||||
Copy-Item C:\ProxSpace\pm3\client\hardnested\tables\*.bin.z C:\ProxSpace\Release\hardnested\tables
|
||||
|
||||
Write-Host "[ OK ]" -ForegroundColor Green
|
||||
|
||||
|
||||
#archive and push
|
||||
|
||||
$releasename=""
|
||||
|
||||
if ($env:appveyor_repo_tag -match "true"){
|
||||
|
||||
$releasename=$env:APPVEYOR_REPO_TAG_NAME + "/"
|
||||
|
||||
}
|
||||
|
||||
$releasename+=$env:APPVEYOR_BUILD_VERSION + " [" + $env:APPVEYOR_REPO_COMMIT.Substring(0, 7) + "]"
|
||||
|
||||
|
||||
Write-Host "Archive and publish release files ($releasename)..." -NoNewLine -ForegroundColor Yellow
|
||||
|
||||
cd C:\ProxSpace
|
||||
|
||||
7z a release.zip C:\ProxSpace\Release
|
||||
|
||||
Push-AppveyorArtifact release.zip -DeploymentName "$releasename"
|
||||
|
||||
Write-Host "[ OK ]" -ForegroundColor Green
|
||||
|
||||
|
||||
Write-Host "Builded..." -ForegroundColor Yellow
|
||||
test_script:
|
||||
- ps: >-
|
||||
$env:Path = "C:\ProxSpace\msys\bin;$env:Path"
|
||||
|
||||
cd c:\ProxSpace\pm3
|
||||
|
||||
|
||||
$global:TestsPassed=$true
|
||||
|
||||
|
||||
Function ExecTest($Name, $File, $Cmd, $CheckResult) {
|
||||
|
||||
#--- begin Job
|
||||
|
||||
$Job = Start-Job -ScriptBlock {
|
||||
[bool]$res=$false
|
||||
$TestTime=[System.Environment]::TickCount
|
||||
$env:Path = "C:\ProxSpace\msys\bin;$env:Path"
|
||||
Set-Location $using:PWD
|
||||
|
||||
$sb=[scriptblock]::Create("$using:Cmd")
|
||||
#execute scriptblock
|
||||
Write-host "Test [$using:Name] job: $using:Cmd"
|
||||
$Cond=&$sb
|
||||
|
||||
if ($Cond -eq $null){
|
||||
} ElseIf($using:CheckResult -ne $null) {
|
||||
[String]$searchstr=""
|
||||
if ($Cond -is [Object]){
|
||||
ForEach($line in $Cond){
|
||||
Write-host $line -ForegroundColor Gray
|
||||
$searchstr += $line
|
||||
}
|
||||
}else{
|
||||
Write-host "$Cond" -ForegroundColor Gray
|
||||
$searchstr = $Cond
|
||||
}
|
||||
If($searchstr -like "*$using:CheckResult*") {
|
||||
$res=$true
|
||||
}
|
||||
$Cond="*$using:CheckResult*"
|
||||
} Else {
|
||||
If (!($Cond -is [bool] -or $Cond -is [byte] -or $Cond -is [int16] -or $Cond -is [int32] -or $Cond -is [int64] -or $Cond -is [float])){
|
||||
if ($Cond -is "String" -and $Cond -like "*passed*"){
|
||||
$res= $true
|
||||
}
|
||||
if ($Cond -is "String" -and $Cond -like "*true*"){
|
||||
$res= $true
|
||||
}
|
||||
} Else {
|
||||
$res=$Cond
|
||||
}
|
||||
}
|
||||
|
||||
If ($res) {
|
||||
Write-host "Result[$using:Name]: $Cond" -ForegroundColor Green
|
||||
Add-AppveyorTest -Name "$using:Name" -Framework NUnit -Filename "$using:File" -Outcome Passed -Duration "$([System.Environment]::TickCount-$TestTime)"
|
||||
}Else {
|
||||
Write-host "Result[$using:Name]: $Cond" -ForegroundColor Red
|
||||
Add-AppveyorTest -Name "$using:Name" -Framework NUnit -Filename "$using:File" -Outcome Failed -Duration "$([System.Environment]::TickCount-$TestTime)" -ErrorMessage "command:$using:Cmd`nresult:$Cond"
|
||||
}
|
||||
return $res
|
||||
}
|
||||
|
||||
#--- end Job
|
||||
|
||||
[bool]$res=$false
|
||||
# Wait 60 sec timeout for Job
|
||||
if(Wait-Job $Job -Timeout 60){
|
||||
$Results = $Job | Receive-Job
|
||||
if($Results -like "true"){
|
||||
$res=$true
|
||||
}
|
||||
} else {
|
||||
Write-host "Test [$Name] timeout" -ForegroundColor Red
|
||||
Add-AppveyorTest -Name "$Name" -Framework NUnit -Filename "$File" -Outcome Failed -Duration 60000 -ErrorMessage "timeout"
|
||||
}
|
||||
Remove-Job -Force $Job
|
||||
|
||||
if(!$res){
|
||||
$global:TestsPassed=$false
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Write-Host "Running tests..." -ForegroundColor Yellow
|
||||
|
||||
|
||||
#file test
|
||||
|
||||
ExecTest "proxmark3 exists" "proxmark3.exe" {Test-Path C:\ProxSpace\Release\proxmark3.exe}
|
||||
|
||||
ExecTest "arm image exists" "\arm\fullimage1.elf" {Test-Path C:\ProxSpace\Release\arm\fullimage.elf}
|
||||
|
||||
ExecTest "bootrom exists" "bootrom.elf" {Test-Path C:\ProxSpace\Release\arm\bootrom.elf}
|
||||
|
||||
ExecTest "hardnested tables exists" "hardnested" {Test-Path C:\ProxSpace\Release\hardnested\tables\*.z}
|
||||
|
||||
ExecTest "release exists" "release.zip" {Test-Path C:\ProxSpace\release.zip}
|
||||
|
||||
|
||||
#proxmark logic tests
|
||||
|
||||
ExecTest "proxmark help" "proxmark3 -h" {bash -lc 'cd ~/client;proxmark3 -h | grep -q Execute && echo Passed || echo Failed'}
|
||||
|
||||
ExecTest "proxmark help hardnested" "proxmark3 -h" {bash -lc 'cd ~/client;proxmark3 -h | grep -q hardnested && echo Passed || echo Failed'}
|
||||
|
||||
ExecTest "hf mf offline text" "hf mf" {bash -lc "cd ~/client;proxmark3 comx -c 'hf mf'"} "at_enc"
|
||||
|
||||
ExecTest "hf mf hardnested" "hf mf hardnested" {bash -lc "cd ~/client;proxmark3 comx -c 'hf mf hardnested t 1 000000000000'"} "found:"
|
||||
|
||||
if ($global:TestsPassed) {
|
||||
Write-Host "Tests [ OK ]" -ForegroundColor Green
|
||||
} else {
|
||||
Write-Host "Tests [ ERROR ]" -ForegroundColor Red
|
||||
throw "Tests error."
|
||||
}
|
||||
on_success:
|
||||
- ps: Write-Host "Build success..." -ForegroundColor Green
|
||||
on_failure:
|
||||
- ps: Write-Host "Build error." -ForegroundColor Red
|
||||
on_finish:
|
||||
- ps: $blockRdp = $false; iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
|
||||
+266
@@ -0,0 +1,266 @@
|
||||
//-----------------------------------------------------------------------------
|
||||
// Jonathan Westhues, Aug 2005
|
||||
// Gerhard de Koning Gans, April 2008, May 2011
|
||||
//
|
||||
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||
// the license.
|
||||
//-----------------------------------------------------------------------------
|
||||
// BigBuf and functions to allocate/free parts of it.
|
||||
//-----------------------------------------------------------------------------
|
||||
#include "BigBuf.h"
|
||||
|
||||
// BigBuf is the large multi-purpose buffer, typically used to hold A/D samples or traces.
|
||||
// Also used to hold various smaller buffers and the Mifare Emulator Memory.
|
||||
// declare it as uint32_t to achieve alignment to 4 Byte boundary
|
||||
static uint32_t BigBuf[BIGBUF_SIZE/sizeof(uint32_t)];
|
||||
|
||||
/* BigBuf memory layout:
|
||||
Pointer to highest available memory: BigBuf_hi
|
||||
|
||||
high BIGBUF_SIZE
|
||||
reserved = BigBuf_malloc() subtracts amount from BigBuf_hi,
|
||||
low 0x00
|
||||
*/
|
||||
|
||||
// High memory mark
|
||||
static uint16_t BigBuf_hi = BIGBUF_SIZE;
|
||||
|
||||
// pointer to the emulator memory.
|
||||
static uint8_t *emulator_memory = NULL;
|
||||
|
||||
// trace related variables
|
||||
static uint16_t traceLen = 0;
|
||||
int tracing = 1; //Last global one.. todo static?
|
||||
|
||||
// get the address of BigBuf
|
||||
uint8_t *BigBuf_get_addr(void)
|
||||
{
|
||||
return (uint8_t *)BigBuf;
|
||||
}
|
||||
|
||||
// get the address of the emulator memory. Allocate part of Bigbuf for it, if not yet done
|
||||
uint8_t *BigBuf_get_EM_addr(void)
|
||||
{
|
||||
// not yet allocated
|
||||
if (emulator_memory == NULL)
|
||||
emulator_memory = BigBuf_malloc(CARD_MEMORY_SIZE);
|
||||
|
||||
return emulator_memory;
|
||||
}
|
||||
|
||||
// clear ALL of BigBuf
|
||||
void BigBuf_Clear(void)
|
||||
{
|
||||
BigBuf_Clear_ext(true);
|
||||
}
|
||||
|
||||
// clear ALL of BigBuf
|
||||
void BigBuf_Clear_ext(bool verbose)
|
||||
{
|
||||
memset(BigBuf, 0, BIGBUF_SIZE);
|
||||
if (verbose)
|
||||
Dbprintf("Buffer cleared (%i bytes)", BIGBUF_SIZE);
|
||||
}
|
||||
|
||||
void BigBuf_Clear_EM(void){
|
||||
memset(BigBuf_get_EM_addr(), 0, CARD_MEMORY_SIZE);
|
||||
}
|
||||
|
||||
void BigBuf_Clear_keep_EM(void)
|
||||
{
|
||||
memset(BigBuf, 0, BigBuf_hi);
|
||||
}
|
||||
|
||||
// allocate a chunk of memory from BigBuf. We allocate high memory first. The unallocated memory
|
||||
// at the beginning of BigBuf is always for traces/samples
|
||||
uint8_t *BigBuf_malloc(uint16_t chunksize)
|
||||
{
|
||||
if (BigBuf_hi - chunksize < 0) {
|
||||
return NULL; // no memory left
|
||||
} else {
|
||||
chunksize = (chunksize + 3) & 0xfffc; // round to next multiple of 4
|
||||
BigBuf_hi -= chunksize; // aligned to 4 Byte boundary
|
||||
return (uint8_t *)BigBuf + BigBuf_hi;
|
||||
}
|
||||
}
|
||||
|
||||
// free ALL allocated chunks. The whole BigBuf is available for traces or samples again.
|
||||
void BigBuf_free(void)
|
||||
{
|
||||
BigBuf_hi = BIGBUF_SIZE;
|
||||
emulator_memory = NULL;
|
||||
|
||||
// shouldn't this empty BigBuf also?
|
||||
}
|
||||
|
||||
// free allocated chunks EXCEPT the emulator memory
|
||||
void BigBuf_free_keep_EM(void)
|
||||
{
|
||||
if (emulator_memory != NULL)
|
||||
BigBuf_hi = emulator_memory - (uint8_t *)BigBuf;
|
||||
else
|
||||
BigBuf_hi = BIGBUF_SIZE;
|
||||
|
||||
// shouldn't this empty BigBuf also?
|
||||
}
|
||||
|
||||
void BigBuf_print_status(void)
|
||||
{
|
||||
Dbprintf("Memory");
|
||||
Dbprintf(" BIGBUF_SIZE.............%d", BIGBUF_SIZE);
|
||||
Dbprintf(" Available memory........%d", BigBuf_hi);
|
||||
Dbprintf("Tracing");
|
||||
Dbprintf(" tracing ................%d", tracing);
|
||||
Dbprintf(" traceLen ...............%d", traceLen);
|
||||
}
|
||||
|
||||
// return the maximum trace length (i.e. the unallocated size of BigBuf)
|
||||
uint16_t BigBuf_max_traceLen(void)
|
||||
{
|
||||
return BigBuf_hi;
|
||||
}
|
||||
|
||||
void clear_trace() {
|
||||
traceLen = 0;
|
||||
}
|
||||
void set_tracelen(uint16_t value) {
|
||||
traceLen = value;
|
||||
}
|
||||
void set_tracing(bool enable) {
|
||||
tracing = enable;
|
||||
}
|
||||
|
||||
bool get_tracing(void) {
|
||||
return tracing;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the number of bytes traced
|
||||
* @return
|
||||
*/
|
||||
uint16_t BigBuf_get_traceLen(void)
|
||||
{
|
||||
return traceLen;
|
||||
}
|
||||
|
||||
/**
|
||||
This is a function to store traces. All protocols can use this generic tracer-function.
|
||||
The traces produced by calling this function can be fetched on the client-side
|
||||
by 'hf list raw', alternatively 'hf list <proto>' for protocol-specific
|
||||
annotation of commands/responses.
|
||||
**/
|
||||
bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t iLen, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag)
|
||||
{
|
||||
if (!tracing) return false;
|
||||
|
||||
uint8_t *trace = BigBuf_get_addr();
|
||||
|
||||
uint16_t num_paritybytes = (iLen-1)/8 + 1; // number of valid paritybytes in *parity
|
||||
uint16_t duration = timestamp_end - timestamp_start;
|
||||
|
||||
// Return when trace is full
|
||||
if (traceLen + sizeof(iLen) + sizeof(timestamp_start) + sizeof(duration) + num_paritybytes + iLen >= BigBuf_max_traceLen()) {
|
||||
tracing = false; // don't trace any more
|
||||
return false;
|
||||
}
|
||||
// Traceformat:
|
||||
// 32 bits timestamp (little endian)
|
||||
// 16 bits duration (little endian)
|
||||
// 16 bits data length (little endian, Highest Bit used as readerToTag flag)
|
||||
// y Bytes data
|
||||
// x Bytes parity (one byte per 8 bytes data)
|
||||
|
||||
// timestamp (start)
|
||||
trace[traceLen++] = ((timestamp_start >> 0) & 0xff);
|
||||
trace[traceLen++] = ((timestamp_start >> 8) & 0xff);
|
||||
trace[traceLen++] = ((timestamp_start >> 16) & 0xff);
|
||||
trace[traceLen++] = ((timestamp_start >> 24) & 0xff);
|
||||
|
||||
// duration
|
||||
trace[traceLen++] = ((duration >> 0) & 0xff);
|
||||
trace[traceLen++] = ((duration >> 8) & 0xff);
|
||||
|
||||
// data length
|
||||
trace[traceLen++] = ((iLen >> 0) & 0xff);
|
||||
trace[traceLen++] = ((iLen >> 8) & 0xff);
|
||||
|
||||
// readerToTag flag
|
||||
if (!readerToTag) {
|
||||
trace[traceLen - 1] |= 0x80;
|
||||
}
|
||||
|
||||
// data bytes
|
||||
if (btBytes != NULL && iLen != 0) {
|
||||
memcpy(trace + traceLen, btBytes, iLen);
|
||||
}
|
||||
traceLen += iLen;
|
||||
|
||||
// parity bytes
|
||||
if (num_paritybytes != 0) {
|
||||
if (parity != NULL) {
|
||||
memcpy(trace + traceLen, parity, num_paritybytes);
|
||||
} else {
|
||||
memset(trace + traceLen, 0x00, num_paritybytes);
|
||||
}
|
||||
}
|
||||
traceLen += num_paritybytes;
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
int LogTraceHitag(const uint8_t * btBytes, int iBits, int iSamples, uint32_t dwParity, int readerToTag)
|
||||
{
|
||||
/**
|
||||
Todo, rewrite the logger to use the generic functionality instead. It should be noted, however,
|
||||
that this logger takes number of bits as argument, not number of bytes.
|
||||
**/
|
||||
|
||||
if (!tracing) return false;
|
||||
|
||||
uint8_t *trace = BigBuf_get_addr();
|
||||
uint16_t iLen = nbytes(iBits);
|
||||
// Return when trace is full
|
||||
if (traceLen + sizeof(rsamples) + sizeof(dwParity) + sizeof(iBits) + iLen > BigBuf_max_traceLen()) return false;
|
||||
|
||||
//Hitag traces appear to use this traceformat:
|
||||
// 32 bits timestamp (little endian,Highest Bit used as readerToTag flag)
|
||||
// 32 bits parity
|
||||
// 8 bits size (number of bits in the trace entry, not number of bytes)
|
||||
// y Bytes data
|
||||
|
||||
rsamples += iSamples;
|
||||
trace[traceLen++] = ((rsamples >> 0) & 0xff);
|
||||
trace[traceLen++] = ((rsamples >> 8) & 0xff);
|
||||
trace[traceLen++] = ((rsamples >> 16) & 0xff);
|
||||
trace[traceLen++] = ((rsamples >> 24) & 0xff);
|
||||
|
||||
if (!readerToTag) {
|
||||
trace[traceLen - 1] |= 0x80;
|
||||
}
|
||||
|
||||
trace[traceLen++] = ((dwParity >> 0) & 0xff);
|
||||
trace[traceLen++] = ((dwParity >> 8) & 0xff);
|
||||
trace[traceLen++] = ((dwParity >> 16) & 0xff);
|
||||
trace[traceLen++] = ((dwParity >> 24) & 0xff);
|
||||
trace[traceLen++] = iBits;
|
||||
|
||||
memcpy(trace + traceLen, btBytes, iLen);
|
||||
traceLen += iLen;
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
// Emulator memory
|
||||
uint8_t emlSet(uint8_t *data, uint32_t offset, uint32_t length){
|
||||
uint8_t* mem = BigBuf_get_EM_addr();
|
||||
if(offset+length < CARD_MEMORY_SIZE) {
|
||||
memcpy(mem+offset, data, length);
|
||||
return 0;
|
||||
} else {
|
||||
Dbprintf("Error, trying to set memory outside of bounds! %d > %d", (offset+length), CARD_MEMORY_SIZE);
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
//-----------------------------------------------------------------------------
|
||||
// Jonathan Westhues, Aug 2005
|
||||
// Gerhard de Koning Gans, April 2008, May 2011
|
||||
//
|
||||
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||
// the license.
|
||||
//-----------------------------------------------------------------------------
|
||||
// BigBuf and functions to allocate/free parts of it.
|
||||
//-----------------------------------------------------------------------------
|
||||
|
||||
#ifndef __BIGBUF_H
|
||||
#define __BIGBUF_H
|
||||
|
||||
#include <stdbool.h> // for bool
|
||||
#include "proxmark3.h"
|
||||
#include "string.h"
|
||||
#include "ticks.h"
|
||||
|
||||
#define BIGBUF_SIZE 40000
|
||||
#define MAX_FRAME_SIZE 256 // maximum allowed ISO14443 frame
|
||||
#define MAX_PARITY_SIZE ((MAX_FRAME_SIZE + 7) / 8)
|
||||
#define MAX_MIFARE_FRAME_SIZE 18 // biggest Mifare frame is answer to a read (one block = 16 Bytes) + 2 Bytes CRC
|
||||
#define MAX_MIFARE_PARITY_SIZE 3 // need 18 parity bits for the 18 Byte above. 3 Bytes are enough to store these
|
||||
#define CARD_MEMORY_SIZE 4096
|
||||
#define DMA_BUFFER_SIZE 256 //128 (how big is the dma?!?
|
||||
|
||||
extern uint8_t *BigBuf_get_addr(void);
|
||||
extern uint8_t *BigBuf_get_EM_addr(void);
|
||||
extern uint16_t BigBuf_max_traceLen(void);
|
||||
extern void BigBuf_Clear(void);
|
||||
extern void BigBuf_Clear_ext(bool verbose);
|
||||
extern void BigBuf_Clear_keep_EM(void);
|
||||
extern void BigBuf_Clear_EM(void);
|
||||
extern uint8_t *BigBuf_malloc(uint16_t);
|
||||
extern void BigBuf_free(void);
|
||||
extern void BigBuf_free_keep_EM(void);
|
||||
extern void BigBuf_print_status(void);
|
||||
extern uint16_t BigBuf_get_traceLen(void);
|
||||
extern void clear_trace(void);
|
||||
extern void set_tracing(bool enable);
|
||||
extern void set_tracelen(uint16_t value);
|
||||
extern bool get_tracing(void);
|
||||
extern bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t iLen, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag);
|
||||
extern int LogTraceHitag(const uint8_t * btBytes, int iBits, int iSamples, uint32_t dwParity, int bReader);
|
||||
extern uint8_t emlSet(uint8_t *data, uint32_t offset, uint32_t length);
|
||||
#endif /* __BIGBUF_H */
|
||||
@@ -5,11 +5,7 @@
|
||||
//-----------------------------------------------------------------------------
|
||||
// LCD code
|
||||
//-----------------------------------------------------------------------------
|
||||
|
||||
#include "proxmark3.h"
|
||||
#include "apps.h"
|
||||
#include "LCD.h"
|
||||
#include "fonts.h"
|
||||
|
||||
void LCDSend(unsigned int data)
|
||||
{
|
||||
|
||||
@@ -9,6 +9,10 @@
|
||||
#ifndef __LCD_H
|
||||
#define __LCD_H
|
||||
|
||||
#include "proxmark3.h"
|
||||
#include "apps.h"
|
||||
#include "fonts.h"
|
||||
|
||||
// The resolution of the LCD
|
||||
#define LCD_XRES 132
|
||||
#define LCD_YRES 132
|
||||
|
||||
+141
-44
@@ -9,82 +9,179 @@
|
||||
APP_INCLUDES = apps.h
|
||||
|
||||
#remove one of the following defines and comment out the relevant line
|
||||
#in the next section to remove that particular feature from compilation
|
||||
APP_CFLAGS = -DWITH_LF -DWITH_ISO15693 -DWITH_ISO14443a -DWITH_ISO14443b -DWITH_ICLASS -DWITH_LEGICRF -DWITH_HITAG
|
||||
#-DWITH_LCD
|
||||
#in the next section to remove that particular feature from compilation.
|
||||
# NO space,TABs after the "\" sign.
|
||||
APP_CFLAGS = -DWITH_CRC \
|
||||
-DON_DEVICE \
|
||||
-DWITH_LF \
|
||||
-DWITH_HITAG \
|
||||
-DWITH_ISO15693 \
|
||||
-DWITH_LEGICRF \
|
||||
-DWITH_ISO14443b \
|
||||
-DWITH_ISO14443a \
|
||||
-DWITH_ICLASS \
|
||||
-DWITH_FELICA \
|
||||
-DWITH_FLASH \
|
||||
-DWITH_SMARTCARD \
|
||||
-DWITH_HFSNOOP \
|
||||
-DWITH_LF_SAMYRUN \
|
||||
-fno-strict-aliasing -ffunction-sections -fdata-sections
|
||||
|
||||
#SRC_LCD = fonts.c LCD.c
|
||||
SRC_LF = lfops.c hitag2.c
|
||||
SRC_ISO15693 = iso15693.c iso15693tools.c
|
||||
SRC_ISO14443a = epa.c iso14443a.c mifareutil.c mifarecmd.c mifaresniff.c
|
||||
SRC_ISO14443b = iso14443.c
|
||||
SRC_CRAPTO1 = crapto1.c crypto1.c
|
||||
### IMPORTANT - move the commented variable below this line
|
||||
# -DWITH_LCD \
|
||||
# -DWITH_EMV \
|
||||
# -DWITH_FPC \
|
||||
#
|
||||
# Standalone Mods
|
||||
#-------------------------------------------------------
|
||||
# -DWITH_LF_ICERUN
|
||||
# -DWITH_LF_SAMYRUN
|
||||
# -DWITH_LF_PROXBRUTE
|
||||
# -DWITH_LF_HIDBRUTE
|
||||
# -DWITH_HF_YOUNG
|
||||
# -DWITH_HF_MATTYRUN
|
||||
# -DWITH_HF_COLIN
|
||||
|
||||
THUMBSRC = start.c \
|
||||
$(SRC_LCD) \
|
||||
$(SRC_ISO15693) \
|
||||
$(SRC_LF) \
|
||||
appmain.c printf.c \
|
||||
util.c \
|
||||
string.c \
|
||||
usb_cdc.c \
|
||||
cmd.c
|
||||
|
||||
# These are to be compiled in ARM mode
|
||||
ARMSRC = fpgaloader.c \
|
||||
legicrf.c \
|
||||
iso14443crc.c \
|
||||
crc16.c \
|
||||
$(SRC_ISO14443a) \
|
||||
$(SRC_ISO14443b) \
|
||||
$(SRC_CRAPTO1) \
|
||||
legic_prng.c \
|
||||
iclass.c \
|
||||
crc.c
|
||||
SRC_LCD = fonts.c LCD.c
|
||||
SRC_LF = lfops.c hitag2.c hitagS.c lfsampling.c pcf7931.c lfdemod.c
|
||||
SRC_ISO15693 = iso15693.c iso15693tools.c
|
||||
#SRC_ISO14443a = iso14443a.c mifareutil.c mifarecmd.c epa.c mifaresim.c
|
||||
SRC_ISO14443a = iso14443a.c mifareutil.c mifarecmd.c epa.c
|
||||
SRC_ISO14443b = iso14443b.c
|
||||
SRC_FELICA = felica.c
|
||||
SRC_CRAPTO1 = crypto1.c des.c aes.c desfire_key.c desfire_crypto.c mifaredesfire.c
|
||||
SRC_CRC = crc.c crc16.c crc32.c
|
||||
SRC_ICLASS = iclass.c optimized_cipher.c
|
||||
SRC_LEGIC = legicrf.c legic_prng.c
|
||||
SRC_FLASH = flashmem.c
|
||||
SRC_SMARTCARD = i2c.c
|
||||
#SRC_FPC = usart.c
|
||||
SRC_BEE = bee.c
|
||||
|
||||
#the FPGA bitstream files. Note: order matters!
|
||||
FPGA_BITSTREAMS = fpga_lf.bit fpga_hf.bit
|
||||
|
||||
#the zlib source files required for decompressing the fpga config at run time
|
||||
SRC_ZLIB = inflate.c inffast.c inftrees.c adler32.c zutil.c
|
||||
#additional defines required to compile zlib
|
||||
ZLIB_CFLAGS = -DZ_SOLO -DZ_PREFIX -DNO_GZIP -DZLIB_PM3_TUNED
|
||||
APP_CFLAGS += $(ZLIB_CFLAGS)
|
||||
# zlib includes:
|
||||
APP_CFLAGS += -I../zlib
|
||||
|
||||
# stdint.h provided locally until GCC 4.5 becomes C99 compliant
|
||||
APP_CFLAGS += -I.
|
||||
|
||||
# Compile these in thumb mode (small size)
|
||||
THUMBSRC = start.c \
|
||||
protocols.c \
|
||||
$(SRC_LCD) \
|
||||
$(SRC_ISO15693) \
|
||||
$(SRC_LF) \
|
||||
$(SRC_ZLIB) \
|
||||
$(SRC_LEGIC) \
|
||||
$(SRC_FLASH) \
|
||||
$(SRC_SMARTCARD) \
|
||||
$(SRC_FPC) \
|
||||
appmain.c \
|
||||
printf.c \
|
||||
util.c \
|
||||
string.c \
|
||||
BigBuf.c \
|
||||
ticks.c \
|
||||
random.c \
|
||||
hfsnoop.c
|
||||
|
||||
|
||||
# These are to be compiled in ARM mode
|
||||
ARMSRC = fpgaloader.c \
|
||||
$(SRC_ISO14443a) \
|
||||
$(SRC_ISO14443b) \
|
||||
$(SRC_CRAPTO1) \
|
||||
$(SRC_ICLASS) \
|
||||
$(SRC_EMV) \
|
||||
$(SRC_CRC) \
|
||||
$(SRC_FELICA) \
|
||||
parity.c \
|
||||
usb_cdc.c \
|
||||
cmd.c \
|
||||
lf_samyrun.c \
|
||||
vtsend.c
|
||||
# lf_samyrun.c \
|
||||
# lf_hidbrute.c \
|
||||
# lf_proxbrute.c \
|
||||
# hf_mattyrun.c \
|
||||
|
||||
VERSIONSRC = version.c \
|
||||
fpga_version_info.c
|
||||
|
||||
# Do not move this inclusion before the definition of {THUMB,ASM,ARM}SRC
|
||||
include ../common/Makefile.common
|
||||
|
||||
OBJS = $(OBJDIR)/osimage.s19 $(OBJDIR)/fpgaimage.s19
|
||||
COMMON_FLAGS = -Os
|
||||
|
||||
OBJS = $(OBJDIR)/fullimage.s19
|
||||
FPGA_COMPRESSOR = ../client/fpga_compress
|
||||
|
||||
all: $(OBJS)
|
||||
|
||||
$(OBJDIR)/fpga_lf.o: fpga_lf.bit
|
||||
$(OBJCOPY) -O elf32-littlearm -I binary -B arm --redefine-sym _binary____fpga_fpga_lf_bit_start=_binary_fpga_lf_bit_start --redefine-sym _binary____fpga_fpga_lf_bit_end=_binary_fpga_lf_bit_end --prefix-sections=fpga_lf_bit $^ $@
|
||||
.DELETE_ON_ERROR:
|
||||
|
||||
$(OBJDIR)/fpga_hf.o: fpga_hf.bit
|
||||
$(OBJCOPY) -O elf32-littlearm -I binary -B arm --redefine-sym _binary____fpga_fpga_hf_bit_start=_binary_fpga_hf_bit_start --redefine-sym _binary____fpga_fpga_hf_bit_end=_binary_fpga_hf_bit_end --prefix-sections=fpga_hf_bit $^ $@
|
||||
# version.c should be remade on every compilation
|
||||
.PHONY: version.c
|
||||
version.c: default_version.c
|
||||
perl ../tools/mkversion.pl .. > $@ || $(COPY) $^ $@
|
||||
|
||||
$(OBJDIR)/fullimage.elf: $(VERSIONOBJ) $(OBJDIR)/fpga_lf.o $(OBJDIR)/fpga_hf.o $(THUMBOBJ) $(ARMOBJ)
|
||||
fpga_version_info.c: $(FPGA_BITSTREAMS) $(FPGA_COMPRESSOR)
|
||||
$(FPGA_COMPRESSOR) -v $(filter %.bit,$^) $@
|
||||
|
||||
$(OBJDIR)/fpga_all.o: $(OBJDIR)/fpga_all.bit.z
|
||||
$(OBJCOPY) -O elf32-littlearm -I binary -B arm --prefix-sections=fpga_all_bit $^ $@
|
||||
|
||||
$(OBJDIR)/fpga_all.bit.z: $(FPGA_BITSTREAMS) $(FPGA_COMPRESSOR)
|
||||
$(FPGA_COMPRESSOR) $(filter %.bit,$^) $@
|
||||
|
||||
$(FPGA_COMPRESSOR):
|
||||
make -C ../client $(notdir $(FPGA_COMPRESSOR))
|
||||
|
||||
$(OBJDIR)/fullimage.stage1.elf: $(VERSIONOBJ) $(OBJDIR)/fpga_all.o $(THUMBOBJ) $(ARMOBJ)
|
||||
$(CC) $(LDFLAGS) -Wl,-T,ldscript,-Map,$(patsubst %.elf,%.map,$@) -o $@ $^ $(LIBS)
|
||||
|
||||
$(OBJDIR)/fpgaimage.elf: $(OBJDIR)/fullimage.elf
|
||||
$(OBJCOPY) -F elf32-littlearm --only-section .fpgaimage $^ $@
|
||||
$(OBJDIR)/fullimage.nodata.bin: $(OBJDIR)/fullimage.stage1.elf
|
||||
$(OBJCOPY) -O binary -I elf32-littlearm --remove-section .data $^ $@
|
||||
|
||||
$(OBJDIR)/fullimage.nodata.o: $(OBJDIR)/fullimage.nodata.bin
|
||||
$(OBJCOPY) -O elf32-littlearm -I binary -B arm --rename-section .data=stage1_image $^ $@
|
||||
|
||||
$(OBJDIR)/osimage.elf: $(OBJDIR)/fullimage.elf
|
||||
$(OBJCOPY) -F elf32-littlearm --remove-section .fpgaimage $^ $@
|
||||
$(OBJDIR)/fullimage.data.bin: $(OBJDIR)/fullimage.stage1.elf
|
||||
$(OBJCOPY) -O binary -I elf32-littlearm --only-section .data $^ $@
|
||||
|
||||
$(OBJDIR)/fullimage.data.bin.z: $(OBJDIR)/fullimage.data.bin $(FPGA_COMPRESSOR)
|
||||
$(FPGA_COMPRESSOR) $(filter %.bin,$^) $@
|
||||
|
||||
$(OBJDIR)/fullimage.data.o: $(OBJDIR)/fullimage.data.bin.z
|
||||
$(OBJCOPY) -O elf32-littlearm -I binary -B arm --rename-section .data=compressed_data $^ $@
|
||||
|
||||
$(OBJDIR)/fullimage.elf: $(OBJDIR)/fullimage.nodata.o $(OBJDIR)/fullimage.data.o
|
||||
$(CC) $(LDFLAGS) -Wl,-T,ldscript,-e,_osimage_entry,-Map,$(patsubst %.elf,%.map,$@) -o $@ $^
|
||||
|
||||
tarbin: $(OBJS)
|
||||
$(TAR) $(TARFLAGS) ../proxmark3-$(platform)-bin.tar $(OBJS:%=armsrc/%) $(OBJS:%.s19=armsrc/%.elf)
|
||||
|
||||
|
||||
clean:
|
||||
$(DELETE) $(OBJDIR)$(PATHSEP)*.o
|
||||
$(DELETE) $(OBJDIR)$(PATHSEP)*.elf
|
||||
$(DELETE) $(OBJDIR)$(PATHSEP)*.s19
|
||||
$(DELETE) $(OBJDIR)$(PATHSEP)*.map
|
||||
$(DELETE) $(OBJDIR)$(PATHSEP)*.d
|
||||
$(DELETE) $(OBJDIR)$(PATHSEP)*.z
|
||||
$(DELETE) $(OBJDIR)$(PATHSEP)*.bin
|
||||
$(DELETE) version.c
|
||||
|
||||
.PHONY: all clean help
|
||||
help:
|
||||
@echo Multi-OS Makefile, you are running on $(DETECTED_OS)
|
||||
@echo Possible targets:
|
||||
@echo + all - Make both:
|
||||
@echo + $(OBJDIR)/osimage.s19 - The OS image
|
||||
@echo + $(OBJDIR)/fpgaimage.s19 - The FPGA image
|
||||
@echo + all - Build the full image $(OBJDIR)/fullimage.s19
|
||||
@echo + clean - Clean $(OBJDIR)
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,286 @@
|
||||
//-----------------------------------------------------------------------------
|
||||
// Matías A. Ré Medina 2016
|
||||
// Christian Herrmann, 2018
|
||||
//
|
||||
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||
// the license.
|
||||
//-----------------------------------------------------------------------------
|
||||
// main code for HF aka MattyRun by Matías A. Ré Medina
|
||||
//-----------------------------------------------------------------------------
|
||||
/*
|
||||
### What I did:
|
||||
I've personally recoded the image of the ARM in order to automate
|
||||
the attack and simulation on Mifare cards. I've moved some of the
|
||||
implementation on the client side to the ARM such as *chk*, *ecfill*, *sim*
|
||||
and *clone* commands.
|
||||
|
||||
### What it does now:
|
||||
It will check if the keys from the attacked tag are a subset from
|
||||
the hardcoded set of keys inside of the FPGA. If this is the case
|
||||
then it will load the keys into the emulator memory and also the
|
||||
content of the victim tag, to finally simulate it and make a clone
|
||||
on a blank card.
|
||||
|
||||
#### TODO:
|
||||
- Nested attack in the case not all keys are known.
|
||||
- Dump into magic card in case of needed replication.
|
||||
|
||||
#### ~ Basically automates commands without user intervention.
|
||||
#### ~ No need of interface.
|
||||
#### ~ Just a portable battery or an OTG usb cable for power supply.
|
||||
|
||||
## Spanish full description of the project [here](http://bit.ly/2c9nZXR).
|
||||
*/
|
||||
|
||||
#include "hf_mattyrun.h"
|
||||
|
||||
void RunMod() {
|
||||
StandAloneMode();
|
||||
|
||||
/*
|
||||
It will check if the keys from the attacked tag are a subset from
|
||||
the hardcoded set of keys inside of the ARM. If this is the case
|
||||
then it will load the keys into the emulator memory and also the
|
||||
content of the victim tag, to finally simulate it.
|
||||
|
||||
Alternatively, it can be dumped into a blank card.
|
||||
|
||||
This source code has been tested only in Mifare 1k.
|
||||
|
||||
If you're using the proxmark connected to a device that has an OS, and you're not using the proxmark3 client to see the debug
|
||||
messages, you MUST uncomment usb_disable().
|
||||
*/
|
||||
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
|
||||
// usb_disable(); // Comment this line if you want to see debug messages.
|
||||
|
||||
|
||||
/*
|
||||
Pseudo-configuration block.
|
||||
*/
|
||||
char keyTypec = '?'; // 'A'/'B' or both keys '?'
|
||||
bool printKeys = false; // Prints keys
|
||||
bool transferToEml = true; // Transfer keys to emulator memory
|
||||
bool ecfill = true; // Fill emulator memory with cards content.
|
||||
bool simulation = true; // Simulates an exact copy of the target tag
|
||||
bool fillFromEmulator = false; // Dump emulator memory.
|
||||
|
||||
|
||||
uint16_t mifare_size = 1024; // Mifare 1k (only 1k supported for now)
|
||||
uint8_t sectorSize = 64; // 1k's sector size is 64 bytes.
|
||||
uint8_t blockNo = 3; // Security block is number 3 for each sector.
|
||||
uint8_t sectorsCnt = (mifare_size/sectorSize);
|
||||
uint8_t keyType; // Keytype buffer
|
||||
uint64_t key64; // Defines current key
|
||||
uint8_t *keyBlock = NULL; // Where the keys will be held in memory.
|
||||
uint8_t stKeyBlock = 20; // Set the quantity of keys in the block.
|
||||
uint8_t filled = 0; // Used to check if the memory was filled with success.
|
||||
bool keyFound = false;
|
||||
|
||||
/*
|
||||
Set of keys to be used.
|
||||
*/
|
||||
uint64_t mfKeys[] = {
|
||||
0xffffffffffff, // Default key
|
||||
0x000000000000, // Blank key
|
||||
0xa0a1a2a3a4a5, // NFCForum MAD key
|
||||
0xb0b1b2b3b4b5,
|
||||
0xaabbccddeeff,
|
||||
0x4d3a99c351dd,
|
||||
0x1a982c7e459a,
|
||||
0xd3f7d3f7d3f7,
|
||||
0x714c5c886e97,
|
||||
0x587ee5f9350f,
|
||||
0xa0478cc39091,
|
||||
0x533cb6c723f6,
|
||||
0x8fd0a4f256e9,
|
||||
};
|
||||
|
||||
/*
|
||||
This part allocates the byte representation of the
|
||||
keys in keyBlock's memory space .
|
||||
*/
|
||||
keyBlock = BigBuf_malloc(stKeyBlock * 6);
|
||||
int mfKeysCnt = sizeof(mfKeys) / sizeof(uint64_t);
|
||||
|
||||
for (int mfKeyCounter = 0; mfKeyCounter < mfKeysCnt; mfKeyCounter++) {
|
||||
num_to_bytes(mfKeys[mfKeyCounter], 6, (uint8_t*)(keyBlock + mfKeyCounter * 6));
|
||||
}
|
||||
|
||||
/*
|
||||
Simple switch just to handle keytpes.
|
||||
*/
|
||||
switch (keyTypec) {
|
||||
case 'a': case 'A':
|
||||
keyType = !0;
|
||||
break;
|
||||
case 'b': case 'B':
|
||||
keyType = !1;
|
||||
break;
|
||||
case '?':
|
||||
keyType = 2;
|
||||
break;
|
||||
default:
|
||||
Dbprintf("[!] Key type must be A , B or ?");
|
||||
keyType = 2;
|
||||
}
|
||||
|
||||
/*
|
||||
Pretty print of the keys to be checked.
|
||||
*/
|
||||
if (printKeys) {
|
||||
Dbprintf("[+] Printing mf keys");
|
||||
for (uint8_t keycnt = 0; keycnt < mfKeysCnt; keycnt++)
|
||||
Dbprintf("[-] chk mf key[%2d] %02x%02x%02x%02x%02x%02x", keycnt,
|
||||
(keyBlock + 6*keycnt)[0],(keyBlock + 6*keycnt)[1], (keyBlock + 6*keycnt)[2],
|
||||
(keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4], (keyBlock + 6*keycnt)[5], 6);
|
||||
DbpString("--------------------------------------------------------");
|
||||
}
|
||||
|
||||
/*
|
||||
Initialization of validKeys and foundKeys storages.
|
||||
- validKey will store whether the sector has a valid A/B key.
|
||||
- foundKey will store the found A/B key for each sector.
|
||||
*/
|
||||
bool validKey[2][40];
|
||||
uint8_t foundKey[2][40][6];
|
||||
for (uint16_t t = 0; t < 2; t++) {
|
||||
for (uint16_t sectorNo = 0; sectorNo < sectorsCnt; sectorNo++) {
|
||||
validKey[t][sectorNo] = false;
|
||||
for (uint16_t i = 0; i < 6; i++) {
|
||||
foundKey[t][sectorNo][i] = 0xff;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
Iterates through each sector checking if there is a correct key.
|
||||
*/
|
||||
int key = -1;
|
||||
int block = 0;
|
||||
bool err = 0;
|
||||
bool allKeysFound = true;
|
||||
uint32_t size = mfKeysCnt;
|
||||
for (int type = !keyType; type < 2 && !err; keyType == 2 ? (type++) : (type = 2)) {
|
||||
block = blockNo;
|
||||
for (int sec = 0; sec < sectorsCnt && !err; ++sec) {
|
||||
Dbprintf("\tCurrent sector:%3d, block:%3d, key type: %c, key count: %i ", sec, block, type ? 'B':'A', mfKeysCnt);
|
||||
key = saMifareChkKeys(block, type, true, size, &keyBlock[0], &key64);
|
||||
if (key == -1) {
|
||||
LED(LED_RED, 50); //red
|
||||
Dbprintf("\t✕ Key not found for this sector!");
|
||||
allKeysFound = false;
|
||||
// break;
|
||||
} else if (key == -2) {
|
||||
err = 1; // Can't select card.
|
||||
break;
|
||||
} else {
|
||||
num_to_bytes(key64, 6, foundKey[type][sec]);
|
||||
validKey[type][sec] = true;
|
||||
keyFound = true;
|
||||
Dbprintf("\t✓ Found valid key: [%02x%02x%02x%02x%02x%02x]\n", (keyBlock + 6*key)[0],(keyBlock + 6*key)[1], (keyBlock + 6*key)[2],(keyBlock + 6*key)[3], (keyBlock + 6*key)[4], (keyBlock + 6*key)[5], 6);
|
||||
}
|
||||
block < 127 ? (block += 4) : (block += 16);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
TODO: This.
|
||||
|
||||
If at least one key was found, start a nested attack based on that key, and continue.
|
||||
*/
|
||||
if (!allKeysFound && keyFound) {
|
||||
Dbprintf("\t✕ There's currently no nested attack in MattyRun, sorry!");
|
||||
LED_C_ON(); //red
|
||||
LED_A_ON(); //yellow
|
||||
// Do nested attack, set allKeysFound = true;
|
||||
// allKeysFound = true;
|
||||
} else {
|
||||
Dbprintf("\t✕ There's nothing I can do without at least a one valid key, sorry!");
|
||||
LED_C_ON(); //red
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
If enabled, transfers found keys to memory and loads target content in emulator memory. Then it simulates to be the tag it has basically cloned.
|
||||
*/
|
||||
if ((transferToEml) && (allKeysFound)) {
|
||||
emlClearMem();
|
||||
uint8_t mblock[16];
|
||||
for (uint16_t sectorNo = 0; sectorNo < sectorsCnt; sectorNo++) {
|
||||
if (validKey[0][sectorNo] || validKey[1][sectorNo]) {
|
||||
emlGetMem(mblock, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1); // data, block num, blocks count (max 4)
|
||||
for (uint16_t t = 0; t < 2; t++) {
|
||||
if (validKey[t][sectorNo]) {
|
||||
memcpy(mblock + t*10, foundKey[t][sectorNo], 6);
|
||||
}
|
||||
}
|
||||
emlSetMem(mblock, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1);
|
||||
}
|
||||
}
|
||||
Dbprintf("\t✓ Found keys have been transferred to the emulator memory.");
|
||||
if (ecfill) {
|
||||
Dbprintf("\tFilling in with key A.");
|
||||
MifareECardLoad(sectorsCnt, 0, 0, &filled);
|
||||
if (filled != 1) {
|
||||
Dbprintf("\t✕ Failed filling with A.");
|
||||
}
|
||||
Dbprintf("\tFilling in with key B.");
|
||||
MifareECardLoad(sectorsCnt, 1, 0, &filled);
|
||||
if (filled != 1) {
|
||||
Dbprintf("\t✕ Failed filling with B.");
|
||||
}
|
||||
if ((filled == 1) && simulation) {
|
||||
Dbprintf("\t✓ Filled, simulation started.");
|
||||
// This will tell the fpga to emulate using previous keys and current target tag content.
|
||||
Dbprintf("\t Press button to abort simulation at anytime.");
|
||||
LED_B_ON(); //green
|
||||
Mifare1ksim(0, 0, 0, NULL);
|
||||
LED_B_OFF();
|
||||
|
||||
/*
|
||||
Needs further testing.
|
||||
*/
|
||||
if (fillFromEmulator) {
|
||||
uint8_t retry = 5, cnt;
|
||||
Dbprintf("\t Trying to dump into blank card.");
|
||||
int flags = 0;
|
||||
LED_A_ON(); //yellow
|
||||
for (int blockNum = 0; blockNum < 16 * 4; blockNum += 1) {
|
||||
cnt = 0;
|
||||
emlGetMem(mblock, blockNum, 1);
|
||||
// switch on field and send magic sequence
|
||||
if (blockNum == 0) flags = 0x08 + 0x02;
|
||||
|
||||
// just write
|
||||
if (blockNum == 1) flags = 0;
|
||||
|
||||
// Done. Magic Halt and switch off field.
|
||||
if (blockNum == 16 * 4 - 1) flags = 0x04 + 0x10;
|
||||
|
||||
while (!saMifareCSetBlock(0, flags & 0xFE, blockNum, mblock) && cnt <= retry) {
|
||||
cnt++;
|
||||
Dbprintf("\t! Could not write block. Retrying.");
|
||||
}
|
||||
if (cnt == retry) {
|
||||
Dbprintf("\t✕ Retries failed. Aborting.");
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (!err) {
|
||||
LED_B_ON();
|
||||
} else {
|
||||
LED_C_ON();
|
||||
}
|
||||
|
||||
}
|
||||
} else if (filled != 1) {
|
||||
Dbprintf("\t✕ Memory could not be filled due to errors.");
|
||||
LED_C_ON();
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
//-----------------------------------------------------------------------------
|
||||
// Matías A. Ré Medina 2016
|
||||
// Christian Herrmann, 2018
|
||||
//
|
||||
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||
// the license.
|
||||
//-----------------------------------------------------------------------------
|
||||
// StandAlone Mod
|
||||
//-----------------------------------------------------------------------------
|
||||
|
||||
#ifndef __HF_MATTYRUN_H
|
||||
#define __HF_MATTYRUN_H
|
||||
|
||||
//#include <stdbool.h> // for bool
|
||||
#include "standalone.h" // standalone definitions
|
||||
#include "apps.h" // debugstatements, lfops?
|
||||
|
||||
|
||||
#define OPTS 2
|
||||
|
||||
#endif /* __HF_MATTYRUN_H */
|
||||
@@ -0,0 +1,261 @@
|
||||
//-----------------------------------------------------------------------------
|
||||
// Craig Young, 2014
|
||||
// Christian Herrmann, 2017
|
||||
//
|
||||
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||
// the license.
|
||||
//-----------------------------------------------------------------------------
|
||||
// main code for HF standalone mode Mifare /sniff/emulation by Craig Young
|
||||
//-----------------------------------------------------------------------------
|
||||
#include "hf_young.h"
|
||||
|
||||
typedef struct {
|
||||
uint8_t uid[10];
|
||||
uint8_t uidlen;
|
||||
uint8_t atqa[2];
|
||||
uint8_t sak;
|
||||
} __attribute__((__packed__)) card_clone_t;
|
||||
|
||||
|
||||
void RunMod() {
|
||||
StandAloneMode();
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
|
||||
|
||||
int selected = 0, playing = 0, iGotoRecord = 0, iGotoClone = 0;
|
||||
int cardRead[OPTS] = {0};
|
||||
|
||||
card_clone_t uids[OPTS];
|
||||
iso14a_card_select_t card[OPTS];
|
||||
uint8_t params = (MAGIC_SINGLE | MAGIC_DATAIN);
|
||||
|
||||
LED(selected + 1, 0);
|
||||
|
||||
for (;;) {
|
||||
WDT_HIT();
|
||||
// exit from Standalone Mode, send a usbcommand.
|
||||
if (usb_poll_validate_length()) return;
|
||||
|
||||
SpinDelay(300);
|
||||
|
||||
if (iGotoRecord == 1 || cardRead[selected] == 0) {
|
||||
iGotoRecord = 0;
|
||||
LEDsoff();
|
||||
LED(selected + 1, 0);
|
||||
LED(LED_RED2, 0);
|
||||
|
||||
// record
|
||||
Dbprintf("Enabling iso14443a reader mode for [Bank: %d]...", selected);
|
||||
/* need this delay to prevent catching some weird data */
|
||||
SpinDelay(500);
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
|
||||
|
||||
for (;;) {
|
||||
// exit from Standalone Mode, send a usbcommand.
|
||||
if (usb_poll_validate_length()) return;
|
||||
|
||||
if (BUTTON_PRESS()) {
|
||||
if (cardRead[selected]) {
|
||||
Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
|
||||
break;
|
||||
} else if (cardRead[(selected+1) % OPTS]) {
|
||||
Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
|
||||
selected = (selected+1) % OPTS;
|
||||
break; // playing = 1;
|
||||
} else {
|
||||
Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
|
||||
SpinDelay(300);
|
||||
}
|
||||
}
|
||||
|
||||
if (!iso14443a_select_card(NULL, &card[selected], NULL, true, 0, true)) {
|
||||
continue;
|
||||
} else {
|
||||
Dbprintf("Read UID:");
|
||||
Dbhexdump(card[selected].uidlen, card[selected].uid, 0);
|
||||
|
||||
if (memcmp(uids[(selected+1)%OPTS].uid, card[selected].uid, card[selected].uidlen ) == 0 ) {
|
||||
Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
|
||||
} else {
|
||||
uids[selected].sak = card[selected].sak;
|
||||
uids[selected].uidlen = card[selected].uidlen;
|
||||
memcpy(uids[selected].uid , card[selected].uid, uids[selected].uidlen);
|
||||
memcpy(uids[selected].atqa, card[selected].atqa, 2);
|
||||
|
||||
if (uids[selected].uidlen > 4)
|
||||
Dbprintf("Bank[%d] received a 7-byte UID", selected);
|
||||
else
|
||||
Dbprintf("Bank[%d] received a 4-byte UID", selected);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Dbprintf("ATQA = %02X%02X", uids[selected].atqa[0], uids[selected].atqa[1]);
|
||||
Dbprintf("SAK = %02X", uids[selected].sak);
|
||||
LEDsoff();
|
||||
LED(LED_GREEN, 200);
|
||||
LED(LED_ORANGE, 200);
|
||||
LED(LED_GREEN, 200);
|
||||
LED(LED_ORANGE, 200);
|
||||
|
||||
LEDsoff();
|
||||
LED(selected + 1, 0);
|
||||
|
||||
// Next state is replay:
|
||||
playing = 1;
|
||||
|
||||
cardRead[selected] = 1;
|
||||
}
|
||||
|
||||
/* MF Classic UID clone */
|
||||
else if (iGotoClone==1) {
|
||||
iGotoClone=0;
|
||||
LEDsoff();
|
||||
LED(selected + 1, 0);
|
||||
LED(LED_ORANGE, 250);
|
||||
|
||||
// magiccards holds 4bytes uid. *usually*
|
||||
uint32_t tmpuid = bytes_to_num(uids[selected].uid, 4);
|
||||
|
||||
// record
|
||||
Dbprintf("Preparing to Clone card [Bank: %d]; uid: %08x", selected, tmpuid);
|
||||
|
||||
// wait for button to be released
|
||||
// Delay cloning until card is in place
|
||||
while (BUTTON_PRESS())
|
||||
WDT_HIT();
|
||||
|
||||
Dbprintf("Starting clone. [Bank: %d]", selected);
|
||||
// need this delay to prevent catching some weird data
|
||||
SpinDelay(500);
|
||||
// Begin clone function here:
|
||||
/* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
|
||||
UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params & (0xFE | (uid == NULL ? 0:1)), blockNo, 0}};
|
||||
memcpy(c.d.asBytes, data, 16);
|
||||
SendCommand(&c);
|
||||
|
||||
Block read is similar:
|
||||
UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}};
|
||||
We need to imitate that call with blockNo 0 to set a uid.
|
||||
|
||||
The get and set commands are handled in this file:
|
||||
// Work with "magic Chinese" card
|
||||
case CMD_MIFARE_CSETBLOCK:
|
||||
MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
|
||||
break;
|
||||
case CMD_MIFARE_CGETBLOCK:
|
||||
MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
|
||||
break;
|
||||
|
||||
mfCSetUID provides example logic for UID set workflow:
|
||||
-Read block0 from card in field with MifareCGetBlock()
|
||||
-Configure new values without replacing reserved bytes
|
||||
memcpy(block0, uid, 4); // Copy UID bytes from byte array
|
||||
// Mifare UID BCC
|
||||
block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
|
||||
Bytes 5-7 are reserved SAK and ATQA for mifare classic
|
||||
-Use mfCSetBlock(0, block0, oldUID, wantWipe, MAGIC_SINGLE) to write it
|
||||
*/
|
||||
uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
|
||||
// arg0 = Flags, arg1=blockNo
|
||||
MifareCGetBlock(params, 0, oldBlock0);
|
||||
if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
|
||||
Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
|
||||
playing = 1;
|
||||
} else {
|
||||
Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0], oldBlock0[1], oldBlock0[2], oldBlock0[3]);
|
||||
memcpy(newBlock0, oldBlock0, 16);
|
||||
|
||||
// Copy uid for bank (2nd is for longer UIDs not supported if classic)
|
||||
memcpy(newBlock0, uids[selected].uid, 4);
|
||||
newBlock0[4] = newBlock0[0] ^ newBlock0[1] ^ newBlock0[2] ^ newBlock0[3];
|
||||
|
||||
// arg0 = workFlags, arg1 = blockNo, datain
|
||||
MifareCSetBlock(params, 0, newBlock0);
|
||||
MifareCGetBlock(params, 0, testBlock0);
|
||||
|
||||
if (memcmp(testBlock0, newBlock0, 16)==0) {
|
||||
DbpString("Cloned successfull!");
|
||||
cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
|
||||
playing = 0;
|
||||
iGotoRecord = 1;
|
||||
selected = (selected + 1) % OPTS;
|
||||
} else {
|
||||
Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
|
||||
playing = 1;
|
||||
}
|
||||
}
|
||||
LEDsoff();
|
||||
LED(selected + 1, 0);
|
||||
}
|
||||
|
||||
// Change where to record (or begin playing)
|
||||
// button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
|
||||
else if (playing==1) {
|
||||
LEDsoff();
|
||||
LED(selected + 1, 0);
|
||||
|
||||
// Begin transmitting
|
||||
LED(LED_GREEN, 0);
|
||||
DbpString("Playing");
|
||||
for ( ; ; ) {
|
||||
// exit from Standalone Mode, send a usbcommand.
|
||||
if (usb_poll_validate_length()) return;
|
||||
|
||||
int button_action = BUTTON_HELD(1000);
|
||||
if ( button_action == 0) { // No button action, proceed with sim
|
||||
|
||||
uint8_t flags = FLAG_4B_UID_IN_DATA;
|
||||
uint8_t data[USB_CMD_DATA_SIZE] = {0}; // in case there is a read command received we shouldn't break
|
||||
|
||||
memcpy(data, uids[selected].uid, uids[selected].uidlen);
|
||||
|
||||
uint64_t tmpuid = bytes_to_num(uids[selected].uid, uids[selected].uidlen);
|
||||
|
||||
if ( uids[selected].uidlen == 7 ) {
|
||||
flags = FLAG_7B_UID_IN_DATA;
|
||||
Dbprintf("Simulating ISO14443a tag with uid: %014" PRIx64 " [Bank: %d]", tmpuid, selected);
|
||||
} else {
|
||||
Dbprintf("Simulating ISO14443a tag with uid: %08" PRIx64 " [Bank: %d]", tmpuid, selected);
|
||||
}
|
||||
|
||||
if (uids[selected].sak == 0x08 && uids[selected].atqa[0] == 0x04 && uids[selected].atqa[1] == 0) {
|
||||
DbpString("Mifare Classic 1k");
|
||||
SimulateIso14443aTag(1, flags, data);
|
||||
} else if (uids[selected].sak == 0x18 && uids[selected].atqa[0] == 0x02 && uids[selected].atqa[1] == 0) {
|
||||
DbpString("Mifare Classic 4k (4b uid)");
|
||||
SimulateIso14443aTag(8, flags, data);
|
||||
} else if (uids[selected].sak == 0x08 && uids[selected].atqa[0] == 0x44 && uids[selected].atqa[1] == 0) {
|
||||
DbpString("Mifare Classic 4k (7b uid)");
|
||||
SimulateIso14443aTag(8, flags, data);
|
||||
} else if (uids[selected].sak == 0x00 && uids[selected].atqa[0] == 0x44 && uids[selected].atqa[1] == 0) {
|
||||
DbpString("Mifare Ultralight");
|
||||
SimulateIso14443aTag(2, flags, data);
|
||||
} else if (uids[selected].sak == 0x20 && uids[selected].atqa[0] == 0x04 && uids[selected].atqa[1] == 0x03) {
|
||||
DbpString("Mifare DESFire");
|
||||
SimulateIso14443aTag(3, flags, data);
|
||||
} else {
|
||||
Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
|
||||
SimulateIso14443aTag(1, flags, data);
|
||||
}
|
||||
|
||||
} else if (button_action == BUTTON_SINGLE_CLICK) {
|
||||
selected = (selected + 1) % OPTS;
|
||||
Dbprintf("Done playing. Switching to record mode on bank %d", selected);
|
||||
iGotoRecord = 1;
|
||||
break;
|
||||
} else if (button_action == BUTTON_HOLD) {
|
||||
Dbprintf("Playtime over. Begin cloning...");
|
||||
iGotoClone = 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
/* We pressed a button so ignore it here with a delay */
|
||||
SpinDelay(300);
|
||||
LEDsoff();
|
||||
LED(selected + 1, 0);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
//-----------------------------------------------------------------------------
|
||||
// Craig Young 2014
|
||||
// Christian Herrmann, 2017
|
||||
//
|
||||
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||
// the license.
|
||||
//-----------------------------------------------------------------------------
|
||||
// StandAlone Mod
|
||||
//-----------------------------------------------------------------------------
|
||||
|
||||
#ifndef __HF_YOUNG_H
|
||||
#define __HF_YOUNG_H
|
||||
|
||||
#include <stdbool.h> // for bool
|
||||
#include "standalone.h" // standalone definitions
|
||||
#include "iso14443a.h"
|
||||
#include "protocols.h"
|
||||
|
||||
#define OPTS 2
|
||||
|
||||
#endif /* __HF_YOUNG_H */
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user