Merge pull request #5 from RfidResearchGroup/master

Update from upstream.
2026-05-12 11:18:11 -07:00 · 2020-10-13 14:06:07 +08:00
parent 64068ba430 782d36d312
commit 29d17dbe84
479 changed files with 802625 additions and 300627 deletions
@@ -0,0 +1,47 @@
+---
+name: Checklist for release
+about: A template when making a release (usage reserved to repo maintainers)
+title: "[RELEASE 4.x] Checklist"
+labels: Release
+assignees: doegox, iceman1001
+
+---
+
+# Checklist
+
+- [ ] CHANGELOG.md
+- [ ] `make style`
+- [ ] `make clean; make client CC=clang CXX=clang++ LD=clang++` on recent Debian or Ubuntu
+- [ ] `mymanualchecks.sh`
+- [ ] `mycppcheck.sh` no alarming warning?
+- [ ] `mymakeclang.sh` no alarming error/warning ?
+- [ ] `mystandalone_makes.sh` compile all standalone modes (linux only)
+- [ ] [Travis](https://travis-ci.org/github/RfidResearchGroup/proxmark3/builds) green (linux noqt / osx+qt ; with makefile (w/wo bt) / with cmake)
+- [ ] [Appveyor](https://ci.appveyor.com/project/RfidResearchGroup/proxmark3/history) green (PS)
+
+# OS compilation and tests
+
+```bash
+make clean && make -j PLATFORM=PM3OTHER && tools/pm3test.sh
+make clean && make -j PLATFORM=PM3RDV4 && tools/pm3test.sh
+make clean && make -j PLATFORM=PM3RDV4 PLATFORM_EXTRAS=BTADDON && tools/pm3test.sh
+make install; pushd /tmp; proxmark3 -c 'data load em4x05.pm3;lf search 1'; popd; make uninstall
+
+( cd client; rm -rf build; mkdir build;cd build;cmake .. && make -j PLATFORM=PM3OTHER && PM3BIN=./proxmark3 ../../tools/pm3test.sh client )
+( cd client; rm -rf build; mkdir build;cd build;cmake .. && make -j PLATFORM=PM3RDV4  && PM3BIN=./proxmark3 ../../tools/pm3test.sh client )
+( cd client; rm -rf build; mkdir build;cd build;cmake .. && make -j PLATFORM=PM3RDV4 PLATFORM_EXTRAS=BTADDON && PM3BIN=./proxmark3 ../../tools/pm3test.sh client )
+```
+
+- [ ] RPI Zero
+- [ ] WSL
+- [ ] PSv3.3
+- [ ] Kali
+- [ ] Debian
+- [ ] Ubuntu20
+- [ ] ParrotOS
+- [ ] Fedora
+- [ ] OpenSuse
+- [ ] OSX
+- [ ] Android
+- [ ] Termux
+
@@ -32,6 +32,7 @@ version.c
 *.swp
 *.json.bak
 *.pyc
+*.bmp

 # new build file for add-ons.
 Makefile.platform
@@ -41,6 +42,7 @@ Makefile.platform
 # cmake
 client/build/
 client/android/build/
+client/deps/bzip2/

 # Coverity
 cov-int/
@@ -65,6 +67,10 @@ tools/fpga_compress/fpga_compress
 tools/mfkey/mfkey32
 tools/mfkey/mfkey64
 tools/nonce2key/nonce2key
+tools/cryptorf/cm
+tools/cryptorf/sm
+tools/cryptorf/sma
+tools/cryptorf/sma_multi

 fpga/*
 !fpga/tests
@@ -77,17 +83,16 @@ fpga/*
 !fpga/xst_hf.scr
 !fpga/go.bat
 !fpga/sim.tcl
+
 # offcial dumps folder
 dumps/*
+traces/*

 #client/*
-# my own traces folder
 client/traces/*
-# my own dumps folder
 client/dumps/*
 *.ice
 *.new
-armsrc/TEMP EMV/*
 tools/mf_nonce_brute/mf_nonce_brute
 tools/andrew/*
 tools/jtag_openocd/openocd_configuration
@@ -0,0 +1 @@
+leak:libfontconfig.so
@@ -3,8 +3,27 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...

 ## [unreleased][unreleased]
- - Added lf em function: 4x50_sread (@tharexde)
- - Added lf em functions: 4x50_info, 4x50_write, 4x50_write_password (@tharexde)
+ - Add low level support for 14b' aka Innovatron (@doegox)
+ - Add doc/cliparser.md (@mwalker33)
+ - Add `hf 14b apdu` - send APDU over ISO14443B (@iceman1001)
+ - Add `lf t55xx chk e <EM4100> option` - Checks calculated password based on the EM4100 id from some white cloners forumla by paleopterix (@mwalker33)
+ - Add `lf t55xx sniff` to allow extracting commands and passwords used be cloners. (@mwalker33)
+ - Add options to `lf read`, `lf cmdread`, `lf sniff` for repeated acquisitions (@doegox)
+ - Change options of `lf read` to match `lf cmdread`, this affects historical `d` and `s` options (@doegox)
+ - Add `hf waveshare` to upload picture to Waveshare NFC-Powered e-Paper (@doegox)
+ - Add `hf 14a config` to deal with badly configured cards: invalid ATQA/BCC/SAK (@doegox)
+ - Mikron JSC Russia Ultralight EV1 41 pages tag type support (@McEloff)
+ - Add test for Ultralight gen2 magic 'hf search' (@McEloff)
+ - Add test for Ultralight EV1 gen2 magic 'hf search' (@McEloff)
+ - Added `hf mf gen3*`magic gen 3 card operations (@McEloff)
+ - Readded verichip command which seems missing (@iceman1001)
+ - Fix missing t55x7 config block detection (@iceman1001)
+ - Fix missing define on proxspace (@mwalker33)
+ - Added `lf em 4x50_dump` (@iceman1001)
+ - Added `lf em 4x50_read` (@tharexde)
+ - Added `lf em 4x50_info` (@tharexde)
+ - Added `4x50_write` (@tharexde)
+ - Added `4x50_write_password` (@tharexde)
 - Fix em4x50 demodulation error (@tharexde)  
 - Fix `hf mfdes` authentification issues, DES working (@bkerler)
 - Add Android cross-compilation to client cmake (@dxl, @doegox)
@@ -90,7 +109,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 - Change appveyor verbose (@doegox)
 - Change `lf nexwatch demod` - now detects type, and show parity /chksum (@iceman1001)
 - Change `lfsampling` - interruptible only when logging not yet triggered (@doegox)
- - Change `lf keri demod - more leanient when it comes to bits (@iceman1001)
+ - Change `lf keri demod` - more leanient when it comes to bits (@iceman1001)
 - fix, proper filtering of RL markers (@doegox)
 - Change, clean deps [compiler trials] (@doegox)
 - Change, remove c99 restrictions [compiler trials] (@doegox)
@@ -173,6 +173,9 @@ help:
 	@echo "+ .../check       - Run offline tests against specific target. See above."
 	@echo "+ miscchecks      - Detect various encoding issues in source code"
 	@echo
+	@echo "+ udev            - Sets udev rules on *nix"
+	@echo "+ accessrights    - Ensure user belongs to correct group on *nix"
+	@echo
 	@echo "Possible platforms: try \"make PLATFORM=\" for more info, default is PM3RDV4"
 	@echo "To activate verbose mode, use make V=1"

@@ -248,8 +251,8 @@ print-%: ; @echo $* = $($*)
 style:
 	# Make sure astyle is installed
 	@which astyle >/dev/null || ( echo "Please install 'astyle' package first" ; exit 1 )
-	# Remove spaces & tabs at EOL, add LF at EOF if needed on *.c, *.h, *.cpp. *.lua, *.py, *.pl, Makefile
-	find . \( -not -path "./cov-int/*" -and \( -name "*.[ch]" -or \( -name "*.cpp" -and -not -name "*.moc.cpp" \) -or -name "*.lua" -or -name "*.py" -or -name "*.pl" -or -name "Makefile" -or -name "*.v" \) \) \
+	# Remove spaces & tabs at EOL, add LF at EOF if needed on *.c, *.h, *.cpp. *.lua, *.py, *.pl, Makefile, *.v
+	find . \( -not -path "./cov-int/*" -and -not -path "./fpga/xst/*" -and \( -name "*.[ch]" -or \( -name "*.cpp" -and -not -name "*.moc.cpp" \) -or -name "*.lua" -or -name "*.py" -or -name "*.pl" -or -name "Makefile" -or -name "*.v" \) \) \
 	    -exec perl -pi -e 's/[ \t]+$$//' {} \; \
 	    -exec sh -c "tail -c1 {} | xxd -p | tail -1 | grep -q -v 0a$$" \; \
 	    -exec sh -c "echo >> {}" \;
@@ -259,23 +262,32 @@ style:
 	    --keep-one-line-blocks --max-instatement-indent=60 \
 	    --style=google --pad-oper --unpad-paren --pad-header \
 	    --align-pointer=name {} \;
+	# Update commands.md
+	[ -x client/proxmark3 ] && client/proxmark3 -m > doc/commands.md

 # Detecting weird codepages and tabs.
+ifeq ($(platform),Darwin)
+miscchecks: TABSCMD=egrep -l  '\t' {}
+else
+miscchecks: TABSCMD=grep -lP '\t' {}
+endif
+ifneq (,$(EDIT))
+miscchecks: TABSCMD+= && vi {} -c ':set tabstop=4' -c ':set et|retab' -c ':wq'
+endif
 miscchecks:
-	# Make sure recode is installed
+# Make sure recode is installed
 	@which recode >/dev/null || ( echo "Please install 'recode' package first" ; exit 1 )
 	@echo "Files with suspicious chars:"
-	@find . \( -name "*.[ch]" -or -name "*.cpp" -or -name "*.lua" -or -name "*.py" -or -name "*.pl" -or -name "Makefile" -or -name "*.v" \) \
+	@find . \( -not -path "./cov-int/*" -and -not -path "./client/deps/*" -and \( -name "*.[ch]" -or -name "*.cpp" -or -name "*.lua" -or -name "*.py" -or -name "*.pl" -or -name "Makefile" -or -name "*.v" \) \) \
 	      -exec sh -c "cat {} |recode utf8.. >/dev/null || echo {}" \;
-	@echo "Files with tabs:"
-# to remove tabs within lines, one can try with: vi $file -c ':set tabstop=4' -c ':set et|retab' -c ':wq'
-ifeq ($(platform),Darwin)
-	@find . \( -name "*.[ch]" -or \( -name "*.cpp" -and -not -name "*.moc.cpp" \) -or -name "*.lua" -or -name "*.py" -or -name "*.pl" -or -name "*.md" -or -name "*.txt" -or -name "*.awk" -or -name "*.v" \) \
-	      -exec egrep -l '\t' {} \;
+ifneq (,$(EDIT))
+	@echo "Files with tabs: (EDIT enabled, files will be rewritten!)"
 else
-	@find . \( -name "*.[ch]" -or \( -name "*.cpp" -and -not -name "*.moc.cpp" \) -or -name "*.lua" -or -name "*.py" -or -name "*.pl" -or -name "*.md" -or -name "*.txt" -or -name "*.awk" -or -name "*.v" \) \
-	      -exec grep -lP '\t' {} \;
+	@echo "Files with tabs: (rerun with EDIT=1 if you want to convert them with vim)"
 endif
+# to remove tabs within lines, one can try with: vi $file -c ':set tabstop=4' -c ':set et|retab' -c ':wq'
+	@find . \( -not -path "./cov-int/*" -and -not -path "./client/deps/*" -and \( -name "*.[ch]" -or \( -name "*.cpp" -and -not -name "*.moc.cpp" \) -or -name "*.lua" -or -name "*.py" -or -name "*.pl" -or -name "*.md" -or -name "*.txt" -or -name "*.awk" -or -name "*.v" \) \) \
+	      -exec sh -c "$(TABSCMD)" \;
 #	@echo "Files with printf \\\\t:"
 #	@find . \( -name "*.[ch]" -or \( -name "*.cpp" -and -not -name "*.moc.cpp" \) -or -name "*.lua" -or -name "*.py" -or -name "*.pl" -or -name "*.md" -or -name "*.txt" -or -name "*.awk" -or -name "*.v" \) \
 #	      -exec grep -lP '\\t' {} \;
@@ -48,7 +48,15 @@ else
    RANLIB= ranlib
 endif

+DEFCXXFLAGS = -Wall -Werror -O3 -pipe
 DEFCFLAGS = -Wall -Werror -O3 -fstrict-aliasing -pipe
+DEFLDFLAGS =
+# Next ones are activated only if SANITIZE=1
+ifeq ($(SANITIZE),1)
+  DEFCFLAGS += -g -fsanitize=address -fno-omit-frame-pointer
+  DEFCXXFLAGS += -g -fsanitize=address -fno-omit-frame-pointer
+  DEFLDFLAGS += -g -fsanitize=address
+endif
 # Some more warnings we want as errors:
 DEFCFLAGS += -Wbad-function-cast -Wredundant-decls -Wmissing-prototypes -Wchar-subscripts -Wshadow -Wundef -Wwrite-strings -Wunused -Wuninitialized -Wpointer-arith -Winline -Wformat -Wformat-security -Winit-self -Wmissing-include-dirs -Wnested-externs -Wmissing-declarations -Wempty-body -Wignored-qualifiers -Wmissing-field-initializers -Wtype-limits -Wold-style-definition
 # Some more warnings we need first to eliminate, so temporarely tolerated:
@@ -17,6 +17,9 @@ endif

 CFLAGS ?= $(DEFCFLAGS)
 CFLAGS += $(MYDEFS) $(MYCFLAGS) $(MYINCLUDES)
+CXXFLAGS ?= $(DEFCXXFLAGS)
+CXXFLAGS += $(MYDEFS) $(MYCXXFLAGS) $(MYINCLUDES)
+LDFLAGS ?= $(DEFLDFLAGS)
 LDFLAGS += $(MYLDFLAGS)
 LDLIBS += $(MYLDLIBS)

@@ -31,6 +34,7 @@ BINDIR := .
 OBJDIR := obj

 MYOBJS ?= $(MYSRCS:%.c=$(OBJDIR)/%.o)
+MYCXXOBJS ?= $(MYCXXSRCS:%.cpp=$(OBJDIR)/%.o)
 CLEAN = $(foreach bin,$(MYLIBS) $(BINS) $(LIB_A),$(BINDIR)/$(bin))

 all: $(foreach bin,$(MYLIBS) $(BINS) $(LIB_A),$(BINDIR)/$(bin))
@@ -61,24 +65,31 @@ endif

 .PHONY: all clean install uninstall

-$(BINDIR)/$(LIB_A): $(MYOBJS)
+$(BINDIR)/$(LIB_A): $(MYOBJS) $(MYCXXOBJS)
 	$(info [=] AR $(notdir $@))
-	$(Q)$(AR) $@ $(MYOBJS)
+	$(Q)$(AR) $@ $(MYOBJS) $(MYCXXOBJS)
 	$(Q)$(RANLIB) $@

-$(BINDIR)/% : $(OBJDIR)/%.o $(MYOBJS) $(MYLIBS)
+$(BINDIR)/% : $(OBJDIR)/%.o $(MYOBJS) $(MYCXXOBJS) $(MYLIBS)
 	$(info [=] LD $(notdir $@))
-	$(Q)$(LD) $(LDFLAGS) $(MYOBJS) $< -o $@ $(MYLIBS) $(MYLDLIBS)
+	$(Q)$(LD) $(LDFLAGS) $(MYOBJS) $(MYCXXOBJS) $< -o $@ $(MYLIBS) $(MYLDLIBS)

-$(OBJDIR)/%.o : %.c | $(OBJDIR)
+%.o: %.c
+$(OBJDIR)/%.o : %.c $(OBJDIR)/%.d | $(OBJDIR)
 	$(info [-] CC $<)
 	$(Q)$(CC) $(DEPFLAGS) $(CFLAGS) -c -o $@ $<
 	$(Q)$(POSTCOMPILE)

+%.o: %.cpp
+$(OBJDIR)/%.o : %.cpp $(OBJDIR)/%.d | $(OBJDIR)
+	$(info [-] CXX $<)
+	$(Q)$(CXX) $(DEPFLAGS) $(CXXFLAGS) -c -o $@ $<
+	$(Q)$(POSTCOMPILE)
+
 $(OBJDIR):
 	$(Q)$(MKDIR) $(OBJDIR)

-DEPENDENCY_FILES = $(MYOBJS:%.o=%.d) $(BINS:%=$(OBJDIR)/%.d)
+DEPENDENCY_FILES = $(MYOBJS:%.o=%.d) $(MYCXXOBJS:%.o=%.d) $(BINS:%=$(OBJDIR)/%.d)

 $(DEPENDENCY_FILES): ;
 .PRECIOUS: $(DEPENDENCY_FILES)
@@ -3,9 +3,9 @@



-| Releases     | Linux & OSX CI       | Windows CI | Coverity    |
-| ------------------- |:-------------------:| -------------------:| -------------------:|
-| [![Latest release](https://img.shields.io/github/v/release/rfidresearchgroup/proxmark3)](https://github.com/RfidResearchGroup/proxmark3/releases/latest) | [![Build status](https://api.travis-ci.org/RfidResearchGroup/proxmark3.svg?branch=master)](https://travis-ci.org/RfidResearchGroup/proxmark3) | [![Build status](https://ci.appveyor.com/api/projects/status/b4gwrhq3nc876cuu/branch/master?svg=true)](https://ci.appveyor.com/project/RfidResearchGroup/proxmark3/branch/master) | [![Coverity Status](https://scan.coverity.com/projects/19334/badge.svg)](https://scan.coverity.com/projects/proxmark3-rrg-iceman-repo)|
+| Releases     | Linux & OSX CI       | Windows CI | Coverity    | Contributors |
+| ------------------- |:-------------------:| -------------------:| -------------------:| -------------------:|
+| [![Latest release](https://img.shields.io/github/v/release/rfidresearchgroup/proxmark3)](https://github.com/RfidResearchGroup/proxmark3/releases/latest) | [![Build status](https://api.travis-ci.com/RfidResearchGroup/proxmark3.svg?branch=master)](https://travis-ci.com/RfidResearchGroup/proxmark3) | [![Build status](https://ci.appveyor.com/api/projects/status/b4gwrhq3nc876cuu/branch/master?svg=true)](https://ci.appveyor.com/project/RfidResearchGroup/proxmark3/branch/master) | [![Coverity Status](https://scan.coverity.com/projects/19334/badge.svg)](https://scan.coverity.com/projects/proxmark3-rrg-iceman-repo)| ![GitHub contributors](https://img.shields.io/github/contributors/rfidresearchgroup/proxmark3) |



@@ -30,11 +30,11 @@
 | ------------------- |:-------------------:| -------------------:|
 |[Notes on UART](/doc/uart_notes.md)|[Notes on Termux / Android](/doc/termux_notes.md)|[Notes on paths](/doc/path_notes.md)|
 |[Notes on frame format](/doc/new_frame_format.md)|[Notes on tracelog / wireshark](/doc/trace_notes.md)|[Notes on EMV](/doc/emv_notes.md)|
-|[Notes on external flash](/doc/ext_flash_notes.md)|[Notes on loclass](/doc/loclass_notes.md)|[Notes on Coverity Scan Config & Run](/doc/md/Development/Coverity-Scan-Config-%26-Run.md)|
+|[Notes on external flash](/doc/ext_flash_notes.md)|[Notes on loclass](/doc/loclass_notes.md)|[Notes on Coverity Scan Config & Run](/doc/md/Development/Coverity-Scan-Config-and-Run.md)|
 |[Notes on file formats used with Proxmark3](/doc/extensions_notes.md)|[Notes on MFU binary format](/doc/mfu_binary_format_notes.md)|[Notes on FPGA & ARM](/doc/fpga_arm_notes.md)|
-|[Developing standalone mode](/armsrc/Standalone/readme.md)|[Wiki about standalone mode](https://github.com/RfidResearchGroup/proxmark3/wiki/Standalone-mode)||
-|[Notes on Color usage](/doc/colors_notes.md)|[Makefile vs CMake](/doc/md/Development/Makefile-vs-CMake.md)|
-
+|[Developing standalone mode](/armsrc/Standalone/readme.md)|[Wiki about standalone mode](https://github.com/RfidResearchGroup/proxmark3/wiki/Standalone-mode)|[Notes on Magic cards](/doc/magic_cards_notes.md)|
+|[Notes on Color usage](/doc/colors_notes.md)|[Makefile vs CMake](/doc/md/Development/Makefile-vs-CMake.md)|[Notes on Cloner guns](/doc/cloner_notes.md)|
+|[Notes on cliparser usage](/doc/cliparser.md)|||

 ## Build for non-RDV4 Proxmark3 platforms

@@ -57,14 +57,14 @@ On the software side: quite a lot, see the [Changelog file](CHANGELOG.md).

 This repo compiles nicely on 
   - Proxspace v3.x
-     - [latest release v3.4](https://github.com/Gator96100/ProxSpace/releases)
+     - [latest release v3.7](https://github.com/Gator96100/ProxSpace/releases)
   - Windows/mingw environment with Qt5.6.1 & GCC 4.9
-   - Ubuntu 1604 -> 2004
+   - Ubuntu 16.04 -> 20.04
   - ParrotOS, Gentoo, Pentoo, Kali, Nethunter, Archlinux, Fedora, Debian
   - Rasbian
   - Android / Termux
   - Mac OS X / Homebrew
-   - WSL, WSL2  (Windows subsystem linux) on Windows 10
+   - WSL1  (Windows subsystem linux) on Windows 10
   - Docker container
      - [ RRG / Iceman repo based ubuntu 18.04 container ](https://hub.docker.com/r/secopsconsult/proxmark3)
      - [ Iceman fork based container v1.7 ](https://hub.docker.com/r/iceman1001/proxmark3/)
@@ -73,7 +73,7 @@ Hardware to run client on
   - PC
   - Android
   - Raspberry Pi & Raspberry Pi Zero
-   - Jetson Nano
+   - Nvidia Jetson Nano

 ## Precompiled binaries
 We don't maintain any precompiled binaries in this repo. There is community effort over at the Proxmark3 forum where @gator96100 has set up a google drive with many mingw binaries which is up-to-date. We link to these files here as to make it easier for users.
@@ -81,14 +81,15 @@ If you are having troubles with these files, contact the package maintainer @gat


 Ref:
-
+For Proxmark3 RDV4
 - [Precompiled builds for RDV40 dedicated x86](https://drive.google.com/open?id=13zUs-aiQkYaSl5KWrBtuW5IWCoHJPsue)
 - [Precompiled builds for RDV40 dedicated x64](https://drive.google.com/open?id=1SyPB8t5Vo8O0Lh7PjNm3Kv-mO4BNbxjX)

+For Proxmark3 RDV4 with blueshark addon
 - [Precompiled builds for RDV40 dedicated with Bluetooth addon x86](https://drive.google.com/open?id=1TqWYctkRvkLshQ1ZRBHPLDzYHR-asuMO)
 - [Precompiled builds for RDV40 dedicated with Bluetooth addon x64](https://drive.google.com/open?id=17ful7u2QyYmMQzQzc5fAf8nJvyoDJfSL)

-Generice Proxmark3 devices (non RDV4)
+Generice Proxmark3 devices (non RDV4),  for Proxmark3 Easy,  RDV1, RDV2, RDV3, etc etc
 - [Precompiled builds for RRG / Iceman repository x86](https://drive.google.com/open?id=1PI3Xr1mussPBPnYGu4ZjWzGPARK4N7JR)
 - [Precompiled builds for RRG / Iceman repository x64](https://drive.google.com/open?id=1uX9RtYGinuFrpHybu4xq_BE3HrobI20e)

@@ -101,16 +102,18 @@ We usually merge your contributions fast since we do like the idea of getting a


 ## Issues & Troubleshooting
-Please search the [issues](https://github.com/rfidresearchgroup/proxmark3/issues) page here and see if your issue is listed in the first instance.  Next place to visit is the [Proxmark Forum](http://www.proxmark.org/forum/index.php). Learn to search it well and finally Google / duckduckgo is your friend :)    You will find many blogposts, youtube videos, tweets, reddit
-
+Please search the [issues](https://github.com/rfidresearchgroup/proxmark3/issues) page here and see if your issue is listed in the first instance.
 Read the [Troubleshooting](/doc/md/Installation_Instructions/Troubleshooting.md) guide to weed out most known problems.

-Offical channels
+Next place to visit is the [Proxmark Forum](http://www.proxmark.org/forum/index.php). Learn to search it well and finally Google / duckduckgo is your friend :)    You will find many blogposts, youtube videos, tweets, reddit
+
+### Offical channels
   - [Proxmark3 IRC channel](http://webchat.freenode.net/?channels=#proxmark3)
   - [Proxmark3 sub reddit](https://www.reddit.com/r/proxmark3/)
   - [Twitter](https://twitter.com/proxmark3/)
-   
- _no discord or slack channel_
+   - [Proxmark3 community discord server](https://discord.gg/zjxc8ZB)
+ 
+ _no slack channel_

 Iceman has quite a few videos on his [youtube channel](https://www.youtube.com/c/ChrisHerrmann1001)

@@ -130,7 +133,7 @@ The separation from official Proxmark3 repo gives us a lot of freedom to create
 ## Proxmark3 GUI

 The official PM3-GUI from Gaucho will not work.
-The new universal GUI will work. [Proxmark3 Universal GUI](https://github.com/burma69/PM3UniversalGUI) Almost, change needed in order to show helptext when client isn't connected to a device.
+The new [Proxmark3 Universal GUI](https://github.com/burma69/PM3UniversalGUI) will work more or less. Change is needed in order to show helptext when client isn't connected to a device.  We don't know how active the maintainers.

 ## The end

@@ -22,29 +22,56 @@ extern uint8_t _stack_start, __bss_end__;
 static uint8_t *BigBuf = &__bss_end__;

 /* BigBuf memory layout:
-Pointer to highest available memory: BigBuf_hi
-    high BigBuf_size
-    reserved = BigBuf_malloc()  subtracts amount from BigBuf_hi,
+Pointer to highest available memory: s_bigbuf_hi
+    high s_bigbuf_size
+    reserved = BigBuf_malloc()  subtracts amount from s_bigbuf_hi,
    low  0x00
 */

-static uint32_t BigBuf_size = 0;
+static uint32_t s_bigbuf_size = 0;

 // High memory mark
-static uint32_t BigBuf_hi = 0;
+static uint32_t s_bigbuf_hi = 0;

 // pointer to the emulator memory.
 static uint8_t *emulator_memory = NULL;

+//=============================================================================
+// The ToSend buffer.
+// A buffer where we can queue things up to be sent through the FPGA, for
+// any purpose (fake tag, as reader, whatever). We go MSB first, since that
+// is the order in which they go out on the wire.
+//=============================================================================
+static tosend_t toSend = {
+    .max = -1,
+    .bit = 8,
+    .buf = NULL
+};
+//=============================================================================
+// The dmaBuf 16bit buffer.
+// A buffer where we recive IQ samples sent from the FPGA, for demodulating
+//=============================================================================
+static dmabuf16_t dma_16 = {
+    .size = DMA_BUFFER_SIZE,
+    .buf = NULL
+};
+// dmaBuf 8bit buffer
+static dmabuf8_t dma_8 = {
+    .size = DMA_BUFFER_SIZE,
+    .buf = NULL
+};
+
+
+
 // trace related variables
-static uint32_t traceLen = 0;
+static uint32_t trace_len = 0;
 static bool tracing = true;

 // compute the available size for BigBuf
 void BigBuf_initialize(void) {
-    BigBuf_size = (uint32_t)&_stack_start - (uint32_t)&__bss_end__;
-    BigBuf_hi = BigBuf_size;
-    traceLen = 0;
+    s_bigbuf_size = (uint32_t)&_stack_start - (uint32_t)&__bss_end__;
+    s_bigbuf_hi = s_bigbuf_size;
+    trace_len = 0;
 }

 // get the address of BigBuf
@@ -53,7 +80,7 @@ uint8_t *BigBuf_get_addr(void) {
 }

 uint32_t BigBuf_get_size(void) {
-    return BigBuf_size;
+    return s_bigbuf_size;
 }

 // get the address of the emulator memory. Allocate part of Bigbuf for it, if not yet done
@@ -64,6 +91,11 @@ uint8_t *BigBuf_get_EM_addr(void) {

    return emulator_memory;
 }
+/*
+uint32_t BigBuf_get_EM_size(void) {
+    return CARD_MEMORY_SIZE;
+}
+*/

 // clear ALL of BigBuf
 void BigBuf_Clear(void) {
@@ -72,9 +104,10 @@ void BigBuf_Clear(void) {

 // clear ALL of BigBuf
 void BigBuf_Clear_ext(bool verbose) {
-    memset(BigBuf, 0, BigBuf_size);
+    memset(BigBuf, 0, s_bigbuf_size);
+    clear_trace();
    if (verbose)
-        Dbprintf("Buffer cleared (%i bytes)", BigBuf_size);
+        Dbprintf("Buffer cleared (%i bytes)", s_bigbuf_size);
 }

 void BigBuf_Clear_EM(void) {
@@ -82,57 +115,66 @@ void BigBuf_Clear_EM(void) {
 }

 void BigBuf_Clear_keep_EM(void) {
-    memset(BigBuf, 0, BigBuf_hi);
+    memset(BigBuf, 0, s_bigbuf_hi);
 }

 // allocate a chunk of memory from BigBuf. We allocate high memory first. The unallocated memory
 // at the beginning of BigBuf is always for traces/samples
 uint8_t *BigBuf_malloc(uint16_t chunksize) {
-    if (BigBuf_hi < chunksize)
+    if (s_bigbuf_hi < chunksize)
        return NULL; // no memory left

    chunksize = (chunksize + 3) & 0xfffc; // round to next multiple of 4
-    BigBuf_hi -= chunksize;  // aligned to 4 Byte boundary
-    return (uint8_t *)BigBuf + BigBuf_hi;
+    s_bigbuf_hi -= chunksize;  // aligned to 4 Byte boundary
+    return (uint8_t *)BigBuf + s_bigbuf_hi;
 }

 // free ALL allocated chunks. The whole BigBuf is available for traces or samples again.
 void BigBuf_free(void) {
-    BigBuf_hi = BigBuf_size;
+    s_bigbuf_hi = s_bigbuf_size;
    emulator_memory = NULL;
    // shouldn't this empty BigBuf also?
+    toSend.buf = NULL;
+    dma_16.buf = NULL;
+    dma_8.buf = NULL;
 }

 // free allocated chunks EXCEPT the emulator memory
 void BigBuf_free_keep_EM(void) {
    if (emulator_memory != NULL)
-        BigBuf_hi = emulator_memory - (uint8_t *)BigBuf;
+        s_bigbuf_hi = emulator_memory - (uint8_t *)BigBuf;
    else
-        BigBuf_hi = BigBuf_size;
+        s_bigbuf_hi = s_bigbuf_size;

-    // shouldn't this empty BigBuf also?
+    toSend.buf = NULL;
+    dma_16.buf = NULL;
+    dma_8.buf = NULL;
 }

 void BigBuf_print_status(void) {
    DbpString(_CYAN_("Memory"));
-    Dbprintf("  BigBuf_size.............%d", BigBuf_size);
-    Dbprintf("  Available memory........%d", BigBuf_hi);
+    Dbprintf("  BigBuf_size.............%d", s_bigbuf_size);
+    Dbprintf("  Available memory........%d", s_bigbuf_hi);
    DbpString(_CYAN_("Tracing"));
    Dbprintf("  tracing ................%d", tracing);
-    Dbprintf("  traceLen ...............%d", traceLen);
+    Dbprintf("  traceLen ...............%d", trace_len);
+
+    Dbprintf("  dma8 memory.............%d", dma_8.buf - BigBuf_get_addr());
+    Dbprintf("  dma16 memory............%d", (uint8_t *)dma_16.buf - BigBuf_get_addr());
+    Dbprintf("  toSend memory...........%d", toSend.buf - BigBuf_get_addr());
 }

 // return the maximum trace length (i.e. the unallocated size of BigBuf)
 uint16_t BigBuf_max_traceLen(void) {
-    return BigBuf_hi;
+    return s_bigbuf_hi;
 }

 void clear_trace(void) {
-    traceLen = 0;
+    trace_len = 0;
 }

 void set_tracelen(uint32_t value) {
-    traceLen = value;
+    trace_len = value;
 }

 void set_tracing(bool enable) {
@@ -148,7 +190,7 @@ bool get_tracing(void) {
 * @return
 */
 uint32_t BigBuf_get_traceLen(void) {
-    return traceLen;
+    return trace_len;
 }

 /**
@@ -158,16 +200,18 @@ uint32_t BigBuf_get_traceLen(void) {
  annotation of commands/responses.
 **/
 bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t iLen, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag) {
-    if (!tracing) return false;
+    if (tracing == false) {
+        return false;
+    }

    uint8_t *trace = BigBuf_get_addr();
-    tracelog_hdr_t *hdr = (tracelog_hdr_t *)(trace + traceLen);
+    tracelog_hdr_t *hdr = (tracelog_hdr_t *)(trace + trace_len);

    uint32_t num_paritybytes = (iLen - 1) / 8 + 1; // number of valid paritybytes in *parity

    // Return when trace is full
-    if (TRACELOG_HDR_LEN + iLen + num_paritybytes >= BigBuf_max_traceLen() - traceLen) {
-        tracing = false; // don't trace any more
+    if (TRACELOG_HDR_LEN + iLen + num_paritybytes >= BigBuf_max_traceLen() - trace_len) {
+        tracing = false;
        return false;
    }

@@ -178,39 +222,48 @@ bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t iLen, uint32_t timestamp_
        duration = (UINT32_MAX - timestamp_start) + timestamp_end;
    }

-    if (duration > 0x7FFF) {
+    if (duration > 0xFFFF) {
+        /*
        if (DBGLEVEL >= DBG_DEBUG) {
-            Dbprintf("Error in LogTrace: duration too long for 15 bits encoding: 0x%08x start:0x%08x end:0x%08x", duration, timestamp_start, timestamp_end);
-            Dbprintf("Forcing duration = 0");
+            Dbprintf("Error in LogTrace: duration too long for 16 bits encoding: 0x%08x   start: 0x%08x end: 0x%08x", duration, timestamp_start, timestamp_end);
        }
+        */
        duration = 0;
    }

    hdr->timestamp = timestamp_start;
-    hdr->duration = duration;
+    hdr->duration = duration & 0xFFFF;
    hdr->data_len = iLen;
    hdr->isResponse = !readerToTag;
-    traceLen += TRACELOG_HDR_LEN;
+    trace_len += TRACELOG_HDR_LEN;

    // data bytes
    if (btBytes != NULL && iLen != 0) {
-        memcpy(trace + traceLen, btBytes, iLen);
+        memcpy(hdr->frame, btBytes, iLen);
+        trace_len += iLen;
    }
-    traceLen += iLen;

    // parity bytes
    if (num_paritybytes != 0) {
        if (parity != NULL) {
-            memcpy(trace + traceLen, parity, num_paritybytes);
+            memcpy(trace + trace_len, parity, num_paritybytes);
        } else {
-            memset(trace + traceLen, 0x00, num_paritybytes);
+            memset(trace + trace_len, 0x00, num_paritybytes);
        }
+        trace_len += num_paritybytes;
    }
-    traceLen += num_paritybytes;
-
    return true;
 }

+// specific LogTrace function for ISO15693: the duration needs to be scaled because otherwise it won't fit into a uint16_t
+bool LogTrace_ISO15693(const uint8_t *bytes, uint16_t len, uint32_t ts_start, uint32_t ts_end, uint8_t *parity, bool reader2tag) {
+    uint32_t duration = ts_end - ts_start;
+    duration /= 32;
+    ts_end = ts_start + duration;
+    return LogTrace(bytes, len, ts_start, ts_end, parity, reader2tag);
+}
+
+
 // Emulator memory
 uint8_t emlSet(uint8_t *data, uint32_t offset, uint32_t length) {
    uint8_t *mem = BigBuf_get_EM_addr();
@@ -221,3 +274,57 @@ uint8_t emlSet(uint8_t *data, uint32_t offset, uint32_t length) {
    Dbprintf("Error, trying to set memory outside of bounds! %d  > %d", (offset + length), CARD_MEMORY_SIZE);
    return 1;
 }
+
+
+
+// get the address of the ToSend buffer. Allocate part of Bigbuf for it, if not yet done
+tosend_t *get_tosend(void) {
+
+    if (toSend.buf == NULL)
+        toSend.buf = BigBuf_malloc(TOSEND_BUFFER_SIZE);
+
+    return &toSend;
+}
+
+void tosend_reset(void) {
+    toSend.max = -1;
+    toSend.bit = 8;
+}
+
+void tosend_stuffbit(int b) {
+
+    if (toSend.max >= TOSEND_BUFFER_SIZE - 1) {
+        Dbprintf(_RED_("toSend overflow"));
+        return;
+    }
+
+    if (toSend.bit >= 8) {
+        toSend.max++;
+        toSend.buf[toSend.max] = 0;
+        toSend.bit = 0;
+    }
+
+    if (b)
+        toSend.buf[toSend.max] |= (1 << (7 - toSend.bit));
+
+    toSend.bit++;
+
+    if (toSend.max >= TOSEND_BUFFER_SIZE) {
+        toSend.bit = 0;
+    }
+}
+
+dmabuf16_t *get_dma16(void) {
+    if (dma_16.buf == NULL)
+        dma_16.buf = (uint16_t *)BigBuf_malloc(DMA_BUFFER_SIZE * sizeof(uint16_t));
+
+    return &dma_16;
+}
+
+dmabuf8_t *get_dma8(void) {
+    if (dma_8.buf == NULL)
+        dma_8.buf = BigBuf_malloc(DMA_BUFFER_SIZE);
+
+    return &dma_8;
+}
+
@@ -19,7 +19,10 @@
 #define MAX_MIFARE_FRAME_SIZE   18  // biggest Mifare frame is answer to a read (one block = 16 Bytes) + 2 Bytes CRC
 #define MAX_MIFARE_PARITY_SIZE  3   // need 18 parity bits for the 18 Byte above. 3 Bytes are enough to store these
 #define CARD_MEMORY_SIZE        4096
-#define DMA_BUFFER_SIZE         256 //128  (how big is the dma?!?
+#define DMA_BUFFER_SIZE         256
+
+// 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
+#define TOSEND_BUFFER_SIZE (9 * MAX_FRAME_SIZE + 1 + 1 + 2)

 uint8_t *BigBuf_get_addr(void);
 uint32_t BigBuf_get_size(void);
@@ -39,7 +42,34 @@ void clear_trace(void);
 void set_tracing(bool enable);
 void set_tracelen(uint32_t value);
 bool get_tracing(void);
+
 bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t iLen, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag);
+bool LogTrace_ISO15693(const uint8_t *bytes, uint16_t len, uint32_t ts_start, uint32_t ts_end, uint8_t *parity, bool reader2tag);
+
+
 uint8_t emlSet(uint8_t *data, uint32_t offset, uint32_t length);

+
+typedef struct {
+    int max;
+    int bit;
+    uint8_t *buf;
+} tosend_t;
+
+tosend_t *get_tosend(void);
+void tosend_reset(void);
+void tosend_stuffbit(int b);
+
+typedef struct {
+    uint16_t size;
+    uint8_t *buf;
+} dmabuf8_t;
+
+typedef struct {
+    uint16_t size;
+    uint16_t *buf;
+} dmabuf16_t;
+
+dmabuf8_t *get_dma8(void);
+dmabuf16_t *get_dma16(void);
 #endif /* __BIGBUF_H */
@@ -30,7 +30,7 @@ SRC_ISO14443b = iso14443b.c
 SRC_FELICA = felica.c
 SRC_CRAPTO1 = crypto1.c des.c desfire_crypto.c mifaredesfire.c aes.c platform_util.c
 SRC_CRC = crc.c crc16.c crc32.c
-SRC_ICLASS = iclass.c optimized_cipher.c
+SRC_ICLASS = iclass.c optimized_cipherutils.c optimized_ikeys.c optimized_elite.c optimized_cipher.c
 SRC_LEGIC = legicrf.c legicrfsim.c legic_prng.c
 SRC_NFCBARCODE = thinfilm.c

@@ -79,7 +79,7 @@ endif
 include Standalone/Makefile.inc

 #the FPGA bitstream files. Note: order matters!
-FPGA_BITSTREAMS = fpga_lf.bit fpga_hf.bit
+FPGA_BITSTREAMS = fpga_lf.bit fpga_hf.bit fpga_felica.bit

 #the lz4 source files required for decompressing the fpga config at run time
 SRC_LZ4 = lz4.c
@@ -38,12 +38,18 @@ define KNOWN_STANDALONE_DEFINITIONS
 | HF_14ASNIFF     | 14a sniff to flashmem                  |
 | (RDV4 only)     |                                        |
 +----------------------------------------------------------+
+| HF_AVEFUL       | Mifare ultralight read/simulation      |
+|                 | - Ave Ozkal                            |
+----------------------------------------------------------+
 | HF_BOG          | 14a sniff with ULC/ULEV1/NTAG auth     |
 | (RDV4 only)     | storing in flashmem - Bogito           |
 +----------------------------------------------------------+
 | HF_COLIN        | Mifare ultra fast sniff/sim/clone      |
 | (RDV4 only)     | - Colin Brigato                        |
 +----------------------------------------------------------+
+| HF_ICECLASS     | Simulate HID iCLASS legacy ags         |
+| (RDV4 only)     | storing in flashmem                    |
+----------------------------------------------------------+
 | HF_LEGIC        | Read/simulate Legic Prime tags         |
 |                 | storing in flashmem                    |
 +----------------------------------------------------------+
@@ -59,9 +65,9 @@ define KNOWN_STANDALONE_DEFINITIONS
 endef

 STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN
-STANDALONE_MODES += HF_14ASNIFF HF_BOG HF_COLIN HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_YOUNG
+STANDALONE_MODES += HF_14ASNIFF HF_AVEFUL HF_BOG HF_COLIN HF_ICECLASS HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_YOUNG
 STANDALONE_MODES_REQ_SMARTCARD :=
-STANDALONE_MODES_REQ_FLASH := LF_ICEHID HF_14ASNIFF HF_BOG HF_COLIN
+STANDALONE_MODES_REQ_FLASH := LF_ICEHID HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS
 ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES)),)
    STANDALONE_PLATFORM_DEFS += -DWITH_STANDALONE_$(STANDALONE)
    ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES_REQ_SMARTCARD)),)
@@ -37,6 +37,10 @@ endif
 ifneq (,$(findstring WITH_STANDALONE_HF_14ASNIFF,$(APP_CFLAGS)))
    SRC_STANDALONE = hf_14asniff.c
 endif
+# WITH_STANDALONE_HF_AVEFUL
+ifneq (,$(findstring WITH_STANDALONE_HF_AVEFUL,$(APP_CFLAGS)))
+    SRC_STANDALONE = hf_aveful.c
+endif
 # WITH_STANDALONE_LF_ICEHID
 ifneq (,$(findstring WITH_STANDALONE_LF_ICEHID,$(APP_CFLAGS)))
    SRC_STANDALONE = lf_icehid.c
@@ -57,7 +61,11 @@ endif
 ifneq (,$(findstring WITH_STANDALONE_HF_LEGIC,$(APP_CFLAGS)))
   SRC_STANDALONE = hf_legic.c
 endif
-# WITH_STANDALONE_LF_MSDSAL
+# WITH_STANDALONE_HF_MSDSAL
 ifneq (,$(findstring WITH_STANDALONE_HF_MSDSAL,$(APP_CFLAGS)))
    SRC_STANDALONE = hf_msdsal.c
 endif
+# WITH_STANDALONE_HF_ICECLASS
+ifneq (,$(findstring WITH_STANDALONE_HF_ICECLASS,$(APP_CFLAGS)))
+    SRC_STANDALONE = hf_iceclass.c
+endif
@@ -0,0 +1,258 @@
+//-----------------------------------------------------------------------------
+// A. Ozkal, 2020
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// main code for HF Mifare Ultralight read/simulation by Ave Ozkal
+//-----------------------------------------------------------------------------
+
+// Several parts of this code is based on code by Craig Young from HF_YOUNG
+
+// This code does not:
+// - Account for cards with non-default keys on authentication (MFU EV1 etc)
+
+// This code is designed to work with:
+// - MIFARE Ultralight
+// - MIFARE Ultralight EV1 (default keys)
+// - MIFARE Ultralight Nano (untested, but should work)
+// - Infineon My-d Move (without password set)
+// - Infineon My-d Move Lean
+// - Any other Ultralight clones that have no auth and MAX_DEFAULT_BLOCKS (16) blocks
+
+#include "standalone.h" // standalone definitions
+#include "proxmark3_arm.h"
+#include "appmain.h"
+#include "fpgaloader.h"
+#include "util.h"
+#include "dbprint.h"
+
+#include "ticks.h"  // SpinDelay
+#include "protocols.h"  // MIFARE_ULEV1_VERSION, MIFARE_ULEV1_READSIG, MIFARE_ULEV1_READ_CNT, MIFARE_ULEV1_CHECKTEAR
+#include <string.h>  // memcmp
+#include "mifareutil.h"
+#include "iso14443a.h"
+
+#define SAK 0x00
+#define ATQA0 0x44
+#define ATQA1 0x00
+
+#define STATE_SEARCH 0
+#define STATE_READ 1
+#define STATE_EMUL 2
+
+// Taken from cmdhfmfu.c, increased by 01h to be 1 indexed
+#define MAX_UL_BLOCKS       0x10
+#define MAX_UL_NANO_40      0x0B
+#define MAX_ULEV1a_BLOCKS   0x14
+#define MAX_ULEV1b_BLOCKS   0x29
+#define MAX_MY_D_MOVE       0x26
+#define MAX_MY_D_MOVE_LEAN  0x10
+#define MAX_DEFAULT_BLOCKS  0x10
+
+typedef struct {
+    uint8_t uid[10];
+    uint8_t uidlen;
+    uint8_t atqa[2];
+    uint8_t sak;
+} PACKED card_clone_t;
+
+int get_block_count(iso14a_card_select_t card, uint8_t version[], uint16_t version_len);
+uint16_t get_ev1_version(iso14a_card_select_t card, uint8_t *version);
+uint16_t get_ev1_signature(iso14a_card_select_t card, uint8_t *signature);
+uint16_t get_ev1_counter(iso14a_card_select_t card, uint8_t counter, uint8_t *response);
+uint16_t get_ev1_tearing(iso14a_card_select_t card, uint8_t counter, uint8_t *response);
+
+uint16_t get_ev1_version(iso14a_card_select_t card, uint8_t *version) {
+    return mifare_sendcmd(MIFARE_ULEV1_VERSION, NULL, 0, version, NULL, NULL);
+}
+
+uint16_t get_ev1_signature(iso14a_card_select_t card, uint8_t *response) {
+    uint8_t cmd[4] = {MIFARE_ULEV1_READSIG, 0x00, 0x00, 0x00};
+    AddCrc14A(cmd, 2);
+    ReaderTransmit(cmd, sizeof(cmd), NULL);
+    return ReaderReceive(response, NULL);
+}
+
+uint16_t get_ev1_counter(iso14a_card_select_t card, uint8_t counter, uint8_t *response) {
+    uint8_t cmd[4] = {MIFARE_ULEV1_READ_CNT, counter, 0x00, 0x00};
+    AddCrc14A(cmd, 2);
+    ReaderTransmit(cmd, sizeof(cmd), NULL);
+    return ReaderReceive(response, NULL);
+}
+
+uint16_t get_ev1_tearing(iso14a_card_select_t card, uint8_t counter, uint8_t *response) {
+    uint8_t cmd[4] = {MIFARE_ULEV1_CHECKTEAR, counter, 0x00, 0x00};
+    AddCrc14A(cmd, 2);
+    ReaderTransmit(cmd, sizeof(cmd), NULL);
+    return ReaderReceive(response, NULL);
+}
+
+int get_block_count(iso14a_card_select_t card, uint8_t version[], uint16_t version_len) {
+    // Default to MAX_DEFAULT_BLOCKS blocks
+    int block_count = MAX_DEFAULT_BLOCKS;
+    // Most of this code is from cmdhfmfu.c
+    // Infineon manufacturer ID
+    if (card.uid[0] == 0x05) {
+        // Infinition MY-D tests   Exam high nibble
+        uint8_t nib = (card.uid[1] & 0xf0) >> 4;
+        switch (nib) {
+            case 3:
+                block_count = MAX_MY_D_MOVE;
+                break; // or SLE 66R01P // 38 pages of 4 bytes
+            case 7:
+                block_count = MAX_MY_D_MOVE_LEAN;
+                break; // or SLE 66R01L  // 16 pages of 4 bytes
+        }
+    } else {
+        // Moved this from case to if as I only care about non-ultralight ev0.
+        if (version_len == 0x0A) {
+            if (memcmp(version, "\x00\x04\x03\x01\x01\x00\x0B", 7) == 0)      { block_count = MAX_ULEV1a_BLOCKS; }
+            else if (memcmp(version, "\x00\x04\x03\x01\x02\x00\x0B", 7) == 0) { block_count = MAX_UL_NANO_40; }
+            else if (memcmp(version, "\x00\x04\x03\x02\x01\x00\x0B", 7) == 0) { block_count = MAX_ULEV1a_BLOCKS; }
+            else if (memcmp(version, "\x00\x04\x03\x01\x01\x00\x0E", 7) == 0) { block_count = MAX_ULEV1b_BLOCKS; }
+            else if (memcmp(version, "\x00\x04\x03\x02\x01\x00\x0E", 7) == 0) { block_count = MAX_ULEV1b_BLOCKS; }
+            else if (memcmp(version, "\x00\x34\x21\x01\x01\x00\x0E", 7) == 0) { block_count = MAX_ULEV1b_BLOCKS; } // Mikron JSC Russia EV1 41 pages tag
+            else if (memcmp(version, "\x00\x34\x21\x01\x01\x00\x0E", 7) == 0) { block_count = MAX_UL_BLOCKS; }
+            else if (version[2] == 0x03) { block_count = MAX_ULEV1a_BLOCKS; }
+        }
+    }
+
+    return block_count;
+}
+
+void ModInfo(void) {
+    DbpString("  HF Mifare Ultralight read/simulation by Ave Ozkal");
+}
+
+void RunMod(void) {
+    StandAloneMode();
+    Dbprintf("AveFUL (MF Ultralight read/emul) started");
+    FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
+
+    // the main loop for your standalone mode
+    for (;;) {
+        WDT_HIT();
+
+        // exit from RunMod,   send a usbcommand.
+        if (data_available()) break;
+
+        iso14a_card_select_t card;
+
+        SpinDelay(500);
+        iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
+
+        // 0 = search, 1 = read, 2 = emul
+        int state = STATE_SEARCH;
+
+        DbpString("Scanning...");
+        int button_pressed = BUTTON_NO_CLICK;
+        for (;;) {
+            // Was our button held down or pressed?
+            button_pressed = BUTTON_HELD(1000);
+
+            if (button_pressed != BUTTON_NO_CLICK || data_available())
+                break;
+            else if (state == STATE_SEARCH) {
+                if (!iso14443a_select_card(NULL, &card, NULL, true, 0, true)) {
+                    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+                    LED_D_OFF();
+                    SpinDelay(500);
+                    continue;
+                } else {
+                    if (card.sak == SAK && card.atqa[0] == ATQA0 && card.atqa[1] == ATQA1 && card.uidlen == 7) {
+                        DbpString("Found ultralight with UID: ");
+                        Dbhexdump(card.uidlen, card.uid, 0);
+                        state = STATE_READ;
+                    } else {
+                        DbpString("Found non-ultralight card, ignoring.");
+                    }
+                }
+            } else if (state == STATE_READ) {
+                iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
+                iso14443a_select_card(NULL, NULL, NULL, true, 0, true);
+                bool read_successful = true;
+
+                // Get version and re-select card as UL EV0s like to shut off after a 0x60
+                uint8_t version[10] = {0x00};
+                uint16_t version_len = 0;
+                version_len = get_ev1_version(card, version);
+                iso14443a_select_card(NULL, NULL, NULL, true, 0, true);
+
+                int block_count = get_block_count(card, version, version_len);
+                Dbprintf("Card was determined as having %d blocks.", block_count);
+                Dbprintf("Contents:");
+
+                for (int i = 0; i < block_count; i++) {
+                    uint8_t dataout[16] = {0x00};
+                    if (mifare_ultra_readblock(i, dataout)) {
+                        // If there's an error reading, go back to search state
+                        read_successful = false;
+                        break;
+                    }
+                    // We're skipping 14 blocks (56 bytes) here, as that "[...] has version/signature/counter data here" according to comments on hf_mfu_dumptoemulator
+                    // When converting a bin, it's almost all 0 other than one 0x0F byte, and functionality seems to be unaffected if that byte is set to 0x00.
+                    emlSetMem_xt(dataout, 14 + i, 1, 4);
+                    Dbhexdump(4, dataout, 0);
+                }
+
+                // It's not the best way to determine this,
+                // but with what I'm trying to support It Should Be Okay
+                bool is_ev1 = (version_len != 0) && (block_count != 16);
+
+                if (read_successful) {
+                    uint8_t signature[34] = {0x00};
+                    if (is_ev1) {
+                        get_ev1_signature(card, signature);
+                    }
+                    Dbprintf("Preparing emulator memory with:");
+                    // Fill first 14 blocks with 0x00 (see comment above)
+                    for (int i = 0; i < 14; i++) {
+                        uint8_t dataout[4] = {0x00, 0x00, 0x00, 0x00};
+
+                        if (is_ev1 && (i == 0 || i == 1)) {
+                            // On block 0 and 1, set version on EV1
+                            memcpy(dataout, version + (i * 4), 4);
+                        } else if (i == 2) {
+                            // On block 2, set last byte to the card's block count
+                            dataout[3] = block_count;
+                        } else if (is_ev1 && ((i > 2 && i < 11))) {
+                            // On 3-10 add signature on EV1
+                            memcpy(dataout, signature + ((i - 3) * 4), 4);
+                        } else if (is_ev1 && (i > 10)) {
+                            // On 11-14 read and set counter and tearing on EV1
+                            uint8_t counter[5];
+                            uint8_t tearing[3];
+                            get_ev1_counter(card, i - 11, counter);
+                            get_ev1_tearing(card, i - 11, tearing);
+                            memcpy(dataout, counter, 3);
+                            memcpy(dataout + 3, tearing, 1);
+                        }
+
+                        Dbhexdump(4, dataout, 0);
+                        emlSetMem_xt(dataout, i, 1, 4);
+                    }
+                    Dbprintf("Successfully loaded into emulator memory...");
+                    state = STATE_EMUL;
+                } else {
+                    Dbprintf("Read failure, going back to search state.");
+                    state = STATE_SEARCH;
+                }
+            } else if (state == STATE_EMUL) {
+                uint8_t flags = FLAG_7B_UID_IN_DATA;
+
+                Dbprintf("Starting simulation, press pm3-button to stop and go back to search state.");
+                SimulateIso14443aTag(7, flags, card.uid);
+
+                // Go back to search state if user presses pm3-button
+                state = STATE_SEARCH;
+            }
+        }
+        if (button_pressed  == BUTTON_HOLD)        //Holding down the button
+            break;
+    }
+
+    DbpString("exiting");
+    LEDsoff();
+}
@@ -15,7 +15,7 @@ The retrieved sniffing session can be acquired by connecting the device
 to a client that supports the reconnect capability and issue 'hf 14a list'.

 In order to view the grabbed authentication attempts in the flash mem,
-you can simply run 'script run read_pwd_mem' or just 'mem dump p l 256'
+you can simply run 'script run mem_readpwd' or just 'mem dump p l 256'
 from the client to view the stored quadlets.
 */

@@ -249,5 +249,5 @@ void RunMod(void) {
    LEDsoff();
    SpinDelay(300);
    Dbprintf("- [ End ] -> You can take shell back ...");
-    Dbprintf("- [  !  ] -> use 'script run read_pwd_mem_spiffs' to print passwords");
+    Dbprintf("- [  !  ] -> use 'script run data_read_pwd_mem_spiffs' to print passwords");
 }
@@ -484,22 +484,18 @@ failtag:
    iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
    SpinOff(50);
    LED_A_ON();
-    uint8_t ticker = 0;

    while (!iso14443a_select_card(cjuid, &p_card, &cjcuid, true, 0, true)) {
        WDT_HIT();
-
-        ticker++;
-        if (ticker % 64 == 0) {
-            LED_A_INV();
-        }
-
        if (BUTTON_HELD(10) == BUTTON_HOLD) {
            WDT_HIT();
            DbprintfEx(FLAG_NEWLINE, "\t\t\t[    READING FLASH   ]");
            ReadLastTagFromFlash();
            goto readysim;
        }
+        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+        SpinDelay(500);
+        LED_A_INV();
    }

    SpinOff(50);
@@ -22,7 +22,6 @@
 #include "legic.h"          // legic_card_select_t struct
 #include "spiffs.h"         // flashmem

-
 /*
 * To list all dump files from flash:
 *
@@ -106,6 +105,7 @@ void RunMod(void) {
    FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
    Dbprintf("[=] >>  HF Legic Prime Read/Simulate Started  <<");
    DbpString("[=] press and HOLD button to exit standalone mode");
+
    for (;;) {
        WDT_HIT();

@@ -163,7 +163,7 @@ void RunMod(void) {
            }

            // The read data is migrated to a MIM1024 card
-            LegicRfSimulate(ct);
+            LegicRfSimulate(ct, false);
        }
    }

@@ -575,4 +575,5 @@ void RunMod(void) {
            }
        }
    }
+    LEDsoff();
 }
--- a/Show More
+++ b/Show More