rfidrig/proxmark3
0
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2026-05-12 11:18:11 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3125 from pingu2211/standalone-mode-docs

Browse Source 
Standalone mode Documentation
This commit is contained in:
Iceman
2026-03-11 16:00:20 +07:00
committed by GitHub
parent 89c10a4b06 3d5f1df093
commit 94ba21485d
41 changed files with 3210 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2 -1
View File
@@ -38,7 +38,7 @@ The Proxmark3 is the swiss-army tool of RFID, allowing for interactions with the
| [Linux - Important notes on ModemManager](/doc/md/Installation_Instructions/ModemManager-Must-Be-Discarded.md) | [Validating Proxmark3 Client Functionality](/doc/md/Use_of_Proxmark/1_Validation.md)|
| [macOS - Homebrew & Upgrading HomeBrew Tap Formula](/doc/md/Installation_Instructions/macOS-Homebrew-Installation-Instructions.md) | [First Use and Verification](/doc/md/Use_of_Proxmark/2_Configuration-and-Verification.md)|
| [macOS - MacPorts](/doc/md/Installation_Instructions/macOS-MacPorts-Installation-Instructions.md) | [Commands & Features](/doc/md/Use_of_Proxmark/3_Commands-and-Features.md)|
| [macOS - Setup and Build](/doc/md/Installation_Instructions/macOS-Compile-From-Source-Instructions.md) ||
| [macOS - Setup and Build](/doc/md/Installation_Instructions/macOS-Compile-From-Source-Instructions.md) |[Standalone Modes](/doc/standalone/)|
| [Windows - Setup and Build](/doc/md/Installation_Instructions/Windows-Installation-Instructions.md) ||
| [Termux / Android - Setup and Build](/doc/termux_notes.md) ||
| [iOS - Setup and Build](/doc/md/Installation_Instructions/iOS-Installation-Instructions.md)
@@ -49,6 +49,7 @@ The Proxmark3 is the swiss-army tool of RFID, allowing for interactions with the
## Notes / helpful documents
| Notes |||
armsrc/Standalone/readme.md
+63
View File
@@ -5,6 +5,9 @@
# Table of Contents
- [Standalone Modes](#standalone-modes)
- [Table of Contents](#table-of-contents)
- [What are standalone modes?](#what-are-standalone-modes)
- [Individual mode documentation](#individual-mode-documentation)
- [Developing Standalone Modes](#developing-standalone-modes)
- [Implementing a standalone mode](#implementing-a-standalone-mode)
- [Naming your standalone mode](#naming-your-standalone-mode)
- [Update MAKEFILE.HAL](#update-makefilehal)
@@ -14,7 +17,67 @@
- [Submitting your code](#submitting-your-code)
Standalone modes run directly on the Proxmark3 device without a connected host computer.
See [Developing Standalone Modes](#developing-standalone-modes) for how to build your own.
> Only one (1) mode can be compiled into the firmware at a time (except via [DANKARMULTI](../../doc/standalone/dankarmulti.md)).
## Individual Mode Documentation
### LF (Low Frequency — 125 kHz) Standalone Modes
| Mode ID | Document | Description | Hardware |
|---------|----------|-------------|----------|
| LF_SAMYRUN | [SamyRun](../../doc/standalone/lf_samyrun.md) | HID26 read/clone/simulate (Samy Kamkar) | Generic |
| LF_EM4100EMUL | [EM4100 Emulator](../../doc/standalone/lf_em4100emul.md) | Simulate predefined EM4100 tag IDs | Generic |
| LF_EM4100RSWB | [EM4100 RSWB](../../doc/standalone/lf_em4100rswb.md) | Read/simulate/write/brute EM4100 (4 slots) | RDV4 (flash) |
| LF_EM4100RSWW | [EM4100 RSWW](../../doc/standalone/lf_em4100rsww.md) | Read/simulate/write/wipe/validate EM4100 | RDV4 (flash) |
| LF_EM4100RWC | [EM4100 RWC](../../doc/standalone/lf_em4100rwc.md) | Read/simulate/clone EM4100 (16 slots) | RDV4 (flash) |
| LF_HIDBRUTE | [HID Corporate Brute](../../doc/standalone/lf_hidbrute.md) | HID Corporate 1000 card number bruteforce | Generic |
| LF_HIDFCBRUTE | [HID FC Brute](../../doc/standalone/lf_hidfcbrute.md) | HID facility code bruteforce (0–255) | RDV4 (flash) |
| LF_ICEHID | [IceHID Collector](../../doc/standalone/lf_icehid.md) | Multi-format LF credential collector to flash | RDV4 (flash) |
| LF_MULTIHID | [MultiHID](../../doc/standalone/lf_multihid.md) | HID 26-bit multi-card simulator | Generic |
| LF_NEDAP_SIM | [Nedap Simulator](../../doc/standalone/lf_nedap_sim.md) | Nedap RFID simple tag simulator | Generic |
| LF_NEXID | [NexID Collector](../../doc/standalone/lf_nexid.md) | Nexwatch credential collector to flash | RDV4 (flash) |
| LF_PROXBRUTE | [ProxBrute](../../doc/standalone/lf_proxbrute.md) | HID ProxII card number bruteforce | Generic |
| LF_PROX2BRUTE | [Prox2Brute](../../doc/standalone/lf_prox2brute.md) | HID ProxII bruteforce v2 (faster, configurable) | Generic |
| LF_THAREXDE | [Tharexde EM4x50](../../doc/standalone/lf_tharexde.md) | EM4x50 simulate/read/collect | RDV4 (flash) |
| LF_SKELETON | [Skeleton Template](../../doc/standalone/lf_skeleton.md) | Development template for new LF modes | Generic |
### HF (High Frequency — 13.56 MHz) Standalone Modes
| Mode ID | Document | Description | Hardware |
|---------|----------|-------------|----------|
| HF_14ASNIFF | [14A Sniffer](../../doc/standalone/hf_14asniff.md) | ISO14443A passive sniffer to flash | RDV4 (flash) |
| HF_14BSNIFF | [14B Sniffer](../../doc/standalone/hf_14bsniff.md) | ISO14443B passive sniffer to flash | RDV4 (flash) |
| HF_15SNIFF | [15693 Sniffer](../../doc/standalone/hf_15sniff.md) | ISO15693 sniffer to flash | RDV4 (flash) |
| HF_15SIM | [15693 Simulator](../../doc/standalone/hf_15sim.md) | ISO15693 dump and simulate | RDV4 (flash) |
| HF_AVEFUL | [Aveful UL Reader](../../doc/standalone/hf_aveful.md) | MIFARE Ultralight read and emulate | Generic |
| HF_BOG | [BogitoRun Auth Sniffer](../../doc/standalone/hf_bog.md) | 14A sniff with ULC/ULEV1/NTAG auth capture | RDV4 (flash) |
| HF_CARDHOPPER | [CardHopper Relay](../../doc/standalone/hf_cardhopper.md) | Long-range 14A relay over serial/IP | RDV4 (BT) |
| HF_COLIN | [VIGIKPWN](../../doc/standalone/hf_colin.md) | MIFARE Classic ultra-fast sniff/sim/clone | RDV4 (flash) |
| HF_CRAFTBYTE | [CraftByte UID Stealer](../../doc/standalone/hf_craftbyte.md) | Scan and emulate ISO14443A UIDs | Generic |
| HF_DOEGOX_AUTH0 | [UL-C/UL-AES Unlocker](../../doc/standalone/hf_doegox_auth0.md) | Unlock password-protected Ultralight tags | Generic |
| HF_EMVPNG | [EMV Visa Reader/Emulator](../../doc/standalone/hf_emvpng.md) | Read Visa EMV cards and emulate transactions | RDV4 (flash) |
| HF_ICECLASS | [IceClass iCLASS](../../doc/standalone/hf_iceclass.md) | iCLASS multi-mode: sim/dump/attack/config | RDV4 (flash) |
| HF_LEGIC | [Legic Prime Reader](../../doc/standalone/hf_legic.md) | Read and simulate Legic Prime tags | Generic |
| HF_LEGICSIM | [Legic Prime Simulator](../../doc/standalone/hf_legicsim.md) | Simulate Legic Prime dumps from flash (15 slots) | RDV4 (flash) |
| HF_MATTYRUN | [MattyRun MFC Clone](../../doc/standalone/hf_mattyrun.md) | MIFARE Classic key check, dump, and emulate | Generic |
| HF_MFCSIM | [MFC Simulator](../../doc/standalone/hf_mfcsim.md) | Simulate MIFARE Classic 1K from flash (15 slots) | RDV4 (flash) |
| HF_MSDSAL | [MSD Visa Reader](../../doc/standalone/hf_msdsal.md) | Read and emulate Visa MSD cards | Generic |
| HF_REBLAY | [Reblay BT Relay](../../doc/standalone/hf_reblay.md) | ISO14443A relay over Bluetooth | RDV4 (BT) |
| HF_ST25_TEAROFF | [ST25TB Tear-off](../../doc/standalone/hf_st25_tearoff.md) | ST25TB store/restore with counter tear-off | RDV4 (flash) |
| HF_TCPRST | [IKEA Rothult](../../doc/standalone/hf_tcprst.md) | IKEA Rothult ST25TA master key dump/emulation | Generic |
| HF_TMUDFORD | [ISO15693 UID Emulator](../../doc/standalone/hf_tmudford.md) | Read and emulate ISO15693 UIDs | Generic |
| HF_UNISNIFF | [Universal Sniffer](../../doc/standalone/hf_unisniff.md) | Multi-protocol sniffer (14A/14B/15/iCLASS) | RDV4 (flash) |
| HF_YOUNG | [Young MFC Sniff/Sim](../../doc/standalone/hf_young.md) | MIFARE sniff/simulation with 2-bank storage | Generic |
### Multi-Mode Loader
| Mode ID | Document | Description |
|---------|----------|-------------|
| DANKARMULTI | [Dankarmulti Loader](../../doc/standalone/dankarmulti.md) | Combine multiple standalone modes into one firmware image |
# Developing Standalone Modes
This contains functionality for different StandAlone modes. The fullimage will be built given the correct compiler flags used. Build targets for these files are contained in `Makefile.inc` and `Makefile.hal`
If you want to implement a new standalone mode, you need to implement the methods provided in `standalone.h`.
doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
+1 -1
View File
@@ -111,7 +111,7 @@ You can also define multiple options like
^[Top](#top)
The Iceman repository gives you to easily choose which standalone mode to embed in the firmware.
Documentation for each standalone mode can be found in the [Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation).
Here are the supported values you can assign to `STANDALONE` in `Makefile.platform`:
| STANDALONE | DESCRIPTION |
doc/standalone/dankarmulti.md
+106
View File
@@ -0,0 +1,106 @@
# DANKARMULTI — Multi-Mode Standalone Loader
> **Author:** Daniel Karling (dankarmulti)
> **Frequency:** Multi (LF + HF)
> **Hardware:** Generic Proxmark3
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/dankarmulti.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
A meta-standalone mode that bundles **multiple** standalone modes into a single firmware image and lets you select which one to run at boot time using the button.
## Why
Normally the Proxmark3 can only have one standalone mode compiled in. If you want to switch modes, you must reflash the firmware. DANKARMULTI solves this by wrapping multiple standalone modes into one firmware — you cycle through them with button presses and hold to execute your chosen mode. This is ideal for field work where you need multiple capabilities without a laptop.
## How
1. **Boot**: On entering standalone mode, LEDs indicate the currently selected sub-mode.
2. **Cycle**: Press the button to cycle through available sub-modes. LEDs change to indicate the new selection.
3. **Execute**: Hold the button to launch the selected sub-mode. Once launched, that sub-mode takes full control (LEDs, button, etc.).
4. **Exit**: Exiting the sub-mode returns to the DANKARMULTI selector.
### Default Bundled Modes
By default, DANKARMULTI includes:
| Slot | Mode | Description |
|------|------|-------------|
| 1 | [HF_MATTYRUN](hf_mattyrun.md) | MIFARE Classic key check → nested → dump → emulate |
| 2 | [LF_EM4100RSWB](lf_em4100rswb.md) | EM4100 read/sim/write/brute |
| 3 | [HF_TCPRST](hf_tcprst.md) | IKEA Rothult / ST25TA password extractor |
> Modes can be customized by editing the `dankarmulti.c` source — add or remove `#include`s and update the mode array.
## LED Indicators
| LED | Meaning (Selector) |
|-----|---------------------|
| **A** only | Mode 1 selected |
| **B** only | Mode 2 selected |
| **C** only | Mode 3 selected |
| **D** only | Mode 4 selected (if present) |
| **A+B** | Mode 5 selected (if present) |
> Once a sub-mode is launched, that sub-mode's own LED scheme takes over.
## Button Controls
| Action | Effect |
|--------|--------|
| **Single click** | Cycle to next sub-mode |
| **Long hold** | Launch selected sub-mode |
## State Machine
```mermaid
stateDiagram-v2
[*] --> Selector : Enter standalone
state Selector {
[*] --> Mode1
Mode1 --> Mode2 : Click
Mode2 --> Mode3 : Click
Mode3 --> Mode1 : Click\n(wraps)
}
Selector --> RunSubMode : Long hold
state RunSubMode {
[*] --> SubModeActive
SubModeActive --> SubModeActive : Sub-mode running\n(own LEDs/button)
}
RunSubMode --> Selector : Sub-mode exits
Selector --> [*] : USB connection
```
## Customising Bundled Modes
Edit `armsrc/Standalone/dankarmulti.c`:
1. Add `#include` for the desired standalone mode header
2. Add entry to the `modes[]` array with the mode's `RunMod()` and `ModInfo()` functions
3. Recompile:
```bash
make clean
make STANDALONE=DANKARMULTI -j
./pm3-flash-fullimage
```
## Compilation
```
make clean
make STANDALONE=DANKARMULTI -j
./pm3-flash-fullimage
```
## Related
- [Standalone Modes Overview](../../armsrc/Standalone/readme.md) — Full list of all standalone modes
- [Advanced Compilation](../md/Installation_Instructions/4_Advanced-compilation-parameters.md) — Compilation with STANDALONE= parameter
doc/standalone/hf_14asniff.md
+81
View File
@@ -0,0 +1,81 @@
# HF_14ASNIFF — ISO14443A Passive Sniffer
> **Author:** Micolous
> **Frequency:** HF (13.56 MHz)
> **Hardware:** RDV4 (flash and battery recommended)
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_14asniff.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
Passively sniffs ISO14443A (NFC Type A) communication between a reader and a card, storing captured frames to the RDV4's onboard flash memory (or RAM on generic hardware).
## Why
Many HF access control and payment systems use ISO14443A. By placing the Proxmark3 between a legitimate reader and card, you can capture the full communication — revealing authentication exchanges, data reads/writes, and protocol behavior. This is essential for:
- **Protocol reverse engineering**: Understand how a reader communicates with cards
- **Authentication capture**: Record authentication handshakes for later analysis
- **System documentation**: Capture real traffic to document proprietary protocols
## How
1. Position the Proxmark3 antenna between a reader and card
2. The device captures both reader-to-card and card-to-reader frames with timestamps
3. Frames are buffered in RAM and flushed to flash on button press
4. Retrieve the trace file from flash via the client for analysis with `hf 14a list`
## LED Indicators
| LED | Meaning |
|-----|---------|
| **1** (A) | Sniffing active |
| **2** (B) | Tag command detected (off when reader finishes) |
| **3** (C) | Reader command detected (off when tag finishes) |
| **4** (D) | Flash unmounting / sync |
## Button Controls
| Action | Effect |
|--------|--------|
| **Short press** | Stop sniffing, save trace to flash, exit |
| **USB command** | Exit standalone mode |
## State Machine
```mermaid
stateDiagram-v2
[*] --> Sniffing : Startup\nFPGA HF mode
Sniffing --> Sniffing : Capture frames\nLEDs show activity
Sniffing --> SaveToFlash : Button press
SaveToFlash --> [*] : Trace saved\nLED_D during unmount
```
## Retrieved Data
After sniffing, connect via client and retrieve the trace:
```
mem spiffs dump -s hf_14asniff.trace -d hf_14asniff.trace
trace load -f hf_14asniff.trace
hf 14a list
```
## Compilation
```
make clean
make STANDALONE=HF_14ASNIFF -j
./pm3-flash-fullimage
```
## Related
- [14B Sniffer](hf_14bsniff.md) — ISO14443B sniffer
- [15693 Sniffer](hf_15sniff.md) — ISO15693 sniffer
- [Universal Sniffer](hf_unisniff.md) — Multi-protocol sniffer with runtime selection
- [BogitoRun Auth Sniffer](hf_bog.md) — 14A sniffer with auth capture
- [Trace Notes](../trace_notes.md) — Working with trace files
doc/standalone/hf_14bsniff.md
+59
View File
@@ -0,0 +1,59 @@
# HF_14BSNIFF — ISO14443B Passive Sniffer
> **Author:** jacopo-j
> **Frequency:** HF (13.56 MHz)
> **Hardware:** RDV4 (flash recommended, optional)
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_14bsniff.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
Passively sniffs ISO14443B communication between a reader and card, saving captured frames to flash (or RAM).
## Why
ISO14443B is used by certain transit cards, national ID cards, and access control systems (e.g., CEPAS, Calypso). This sniffer captures the full communication exchange for protocol analysis.
## How
Identical workflow to [14A Sniffer](hf_14asniff.md) but tuned for the 14443B modulation scheme. Captured frames include both PICC (card) and PCD (reader) traffic.
## LED Indicators
| LED | Meaning |
|-----|---------|
| **1** (A) | Sniffing active |
| **2** (B) | Tag command |
| **3** (C) | Reader command |
| **4** (D) | Flash unmounting |
## Button Controls
| Action | Effect |
|--------|--------|
| **Short press** | Stop sniffing, save to flash, exit |
## State Machine
```mermaid
stateDiagram-v2
[*] --> Sniffing : Startup
Sniffing --> SaveToFlash : Button press
SaveToFlash --> [*] : Saved to hf_14bsniff.trace
```
## Compilation
```
make clean
make STANDALONE=HF_14BSNIFF -j
./pm3-flash-fullimage
```
## Related
- [14A Sniffer](hf_14asniff.md) — ISO14443A sniffer
- [Universal Sniffer](hf_unisniff.md) — Multi-protocol sniffer
doc/standalone/hf_15sim.md
+66
View File
@@ -0,0 +1,66 @@
# HF_15SIM — ISO15693 Dump and Simulate
> **Author:** lnv42
> **Frequency:** HF (13.56 MHz)
> **Hardware:** RDV4 (flash memory)
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_15sim.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
Dumps an ISO15693 tag's complete memory, then simulates it. Auto-detects tag type (MIM1024, etc.) and specific attributes like DSFID and AFI.
## Why
ISO15693 tags are used in libraries, laundry systems, industrial asset tracking, and some access control. This mode enables read-then-replay attacks: capture a tag's full contents and then emulate it at a reader without the original tag present.
## How
1. **Wait**: Scans for an ISO15693 tag in the field
2. **Dump**: On detection, reads all memory blocks and tag system info (DSFID, AFI, block size)
3. **Simulate**: Begins emulating the captured tag with full memory contents
## LED Indicators
| LED | Meaning |
|-----|---------|
| **B** (solid) | Waiting for a dumpable tag |
| LEDs off | Dumping / simulating |
## Button Controls
| Action | Effect |
|--------|--------|
| **Hold 500ms** | Exit standalone mode |
| **USB command** | Exit standalone mode |
## State Machine
```mermaid
stateDiagram-v2
[*] --> WaitForTag : Startup\nLED_B on
WaitForTag --> DumpTag : ISO15693 tag found
WaitForTag --> WaitForTag : No tag / incompatible
DumpTag --> Simulate : Dump complete\n(all blocks read)
DumpTag --> WaitForTag : Dump failed
Simulate --> [*] : Button hold 500ms
WaitForTag --> [*] : Button hold 500ms
```
## Compilation
```
make clean
make STANDALONE=HF_15SIM -j
./pm3-flash-fullimage
```
## Related
- [ISO15693 UID Emulator](hf_tmudford.md) — Simpler 15693 UID emulation
- [15693 Sniffer](hf_15sniff.md) — ISO15693 protocol sniffer
doc/standalone/hf_15sniff.md
+66
View File
@@ -0,0 +1,66 @@
# HF_15SNIFF — ISO15693 Sniffer
> **Author:** Nathan Glaser
> **Frequency:** HF (13.56 MHz)
> **Hardware:** RDV4 (flash recommended)
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_15sniff.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
Passively sniffs ISO15693 communication between reader and tag, storing captured frames to flash.
## Why
Capture and analyze the communication protocol between ISO15693 readers and tags for reverse engineering or security assessment.
## How
Captures bidirectional 15693 frames with timestamps. Note: timestamp counter overflows after approximately 5 minutes 16 seconds of continuous sniffing.
## LED Indicators
| LED | Meaning |
|-----|---------|
| **1** (A) | Sniffing active |
| **2** (B) | Tag command |
| **3** (C) | Reader command |
| **4** (D) | Flash sync |
## Button Controls
| Action | Effect |
|--------|--------|
| **Short press** | Stop and save trace to flash |
## State Machine
```mermaid
stateDiagram-v2
[*] --> Sniffing : Startup
Sniffing --> SaveTrace : Button press
SaveTrace --> [*] : Saved
note right of Sniffing
Timestamp overflow
at ~5min 16sec
end note
```
## Compilation
```
make clean
make STANDALONE=HF_15SNIFF -j
./pm3-flash-fullimage
```
## Related
- [14A Sniffer](hf_14asniff.md) — ISO14443A sniffer
- [14B Sniffer](hf_14bsniff.md) — ISO14443B sniffer
- [Universal Sniffer](hf_unisniff.md) — Multi-protocol sniffer
- [15693 Simulator](hf_15sim.md) — ISO15693 dump and simulate
doc/standalone/hf_aveful.md
+84
View File
@@ -0,0 +1,84 @@
# HF_AVEFUL — MIFARE Ultralight Read/Simulation
> **Author:** Ave Ozkal
> **Frequency:** HF (13.56 MHz)
> **Hardware:** Generic Proxmark3
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_aveful.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
Reads MIFARE Ultralight family cards (UL, ULEV1, UL Nano, My-d Move) and then emulates the captured card. Auto-detects the card type and block count.
## Why
MIFARE Ultralight is widely used in transit systems, event tickets, and small-value tokens. This mode enables standalone read-and-replay for:
- **Transit fare evasion testing**: Capture a valid ticket and present it at a gate
- **Ticket cloning assessment**: Demonstrate that UL tickets can be replayed
- **NFC application testing**: Verify that applications properly validate UL tags
## How
1. **SEARCH**: Scans for MIFARE Ultralight cards using anticollision
2. **READ**: Upon finding a card, detects its type via the VERSION command and reads all accessible blocks
3. **EMULATE**: Loads the captured data into the emulator and broadcasts it as a MIFARE Ultralight tag
Supports auto-detection of: MIFARE Ultralight, Ultralight EV1, Ultralight Nano, and My-d Move.
## LED Indicators
| LED | Meaning |
|-----|---------|
| **D** (off during idle) | Blinks during tag search |
| LED patterns | Success/failure indication |
## Button Controls
| Action | Effect |
|--------|--------|
| **Hold 1000ms** | Cycle states or exit: SEARCH → READ → EMULATE → exit |
| **USB command** | Exit standalone mode |
## State Machine
```mermaid
stateDiagram-v2
[*] --> SEARCH : Startup
SEARCH --> READ : UL card found
SEARCH --> SEARCH : No card / incompatible
READ --> EMULATE : All blocks read
READ --> SEARCH : Read failed
EMULATE --> SEARCH : Button hold\n(cycle back)
EMULATE --> [*] : Button hold\n(exit)
SEARCH --> [*] : Button hold (exit)
```
## Supported Cards
| Card Type | Detection |
|-----------|-----------|
| MIFARE Ultralight | VERSION command response |
| MIFARE Ultralight EV1 | VERSION command response |
| MIFARE Ultralight Nano | VERSION command response |
| My-d Move | VERSION command response |
## Compilation
```
make clean
make STANDALONE=HF_AVEFUL -j
./pm3-flash-fullimage
```
## Related
- [UL-C/UL-AES Unlocker](hf_doegox_auth0.md) — Unlock password-protected UL cards
- [BogitoRun Auth Sniffer](hf_bog.md) — Capture UL authentication passwords
- [CraftByte UID Stealer](hf_craftbyte.md) — Generic 14A UID emulator
doc/standalone/hf_bog.md
+68
View File
@@ -0,0 +1,68 @@
# HF_BOG — 14A Sniffer with ULC/ULEV1/NTAG Auth Capture
> **Author:** Bogito
> **Frequency:** HF (13.56 MHz)
> **Hardware:** RDV4 (requires flash memory)
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_bog.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
An enhanced ISO14443A sniffer that specifically extracts and stores ULC, ULEV1, and NTAG authentication passwords from sniffed traffic.
## Why
Many MIFARE Ultralight deployments use password authentication (PWD_AUTH) to protect data. By sniffing the communication between a legitimate reader and card, you capture the authentication passwords in plaintext. This is more targeted than generic sniffing — it automatically extracts and logs just the passwords.
## How
1. Passively sniffs ISO14443A traffic
2. Parses captured frames looking for authentication commands (PWD_AUTH, 3DES AUTH for ULC)
3. Extracts up to 64 authentication attempts per session
4. Saves extracted passwords to `hf_bog.log` on flash
## LED Indicators
| LED | Meaning |
|-----|---------|
| **A** (solid) | Sniffing activity |
## Button Controls
| Action | Effect |
|--------|--------|
| **Short press** | Stop sniffing, save auth data to flash |
## State Machine
```mermaid
stateDiagram-v2
[*] --> Sniffing : Startup
Sniffing --> Sniffing : Parse frames\nExtract auth attempts
Sniffing --> SaveAuth : Button press
SaveAuth --> [*] : Saved to hf_bog.log\n(up to 64 auth attempts)
```
## Flash Storage
- **Log file**: `hf_bog.log`
- Stores extracted authentication passwords/keys
- Up to 64 auth attempts per session
## Compilation
```
make clean
make STANDALONE=HF_BOG -j
./pm3-flash-fullimage
```
## Related
- [14A Sniffer](hf_14asniff.md) — Generic 14A sniffer (captures all frames)
- [Aveful UL Reader](hf_aveful.md) — Read and emulate UL cards
- [UL-C/UL-AES Unlocker](hf_doegox_auth0.md) — Unlock password-protected UL cards
doc/standalone/hf_cardhopper.md
+90
View File
@@ -0,0 +1,90 @@
# HF_CARDHOPPER — Long-Range 14A Relay over IP
> **Author:** Sam Haskins
> **Frequency:** HF (13.56 MHz)
> **Hardware:** RDV4 with Bluetooth (BlueShark) or serial add-on
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_cardhopper.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
A relay attack framework that tunnels ISO14443A communication over a serial/IP backbone. One Proxmark3 sits near the target reader (CARD mode), another near the victim's card (READER mode), and the relayed data bridges any distance.
## Why
Relay attacks demonstrate that proximity-based access control can be defeated remotely. Even "tap to pay" and "tap to enter" systems are vulnerable when the communication can be tunneled over the internet. CardHopper demonstrates this in a practical, standalone way without requiring a laptop at either end.
Use cases:
- **Relay attacks on NFC payments**: Demonstrate contactless payment relay risks
- **Access control relay**: Bypass door readers by relaying a badge from another location
- **Security awareness**: Show stakeholders that NFC proximity offers limited protection
## How
1. **CARD mode** (at reader): Emulates an ISO14443A card and forwards all reader commands over serial/BT
2. **READER mode** (at card): Receives forwarded commands, sends them to the real card, and returns responses
3. The two devices communicate via serial/Bluetooth/IP, transparently relaying the full ISO14443A session
## LED Indicators
| LED | Meaning |
|-----|---------|
| **A + D** (solid) | Alive / running indicator |
## Button Controls
| Action | Effect |
|--------|--------|
| **Button press** | Exit mode |
| **USB command** | Exit standalone mode |
## State Machine
```mermaid
stateDiagram-v2
[*] --> Init : Startup
state Init {
[*] --> READER : Config = Reader mode
[*] --> CARD : Config = Card mode
}
state READER {
WaitCommand --> SendToCard : Command from serial
SendToCard --> SendResponse : Card responds
SendResponse --> WaitCommand : Response sent to serial
}
state CARD {
WaitReaderCmd --> ForwardToRemote : Reader command received
ForwardToRemote --> ForwardToReader : Remote card response
ForwardToReader --> WaitReaderCmd : Response forwarded
}
READER --> [*] : Button / Reset
CARD --> [*] : Button / Reset
```
## Setup
Requires two Proxmark3 RDV4 devices:
1. **Near reader**: Running in CARD mode with BT/serial connection
2. **Near card**: Running in READER mode with BT/serial connection
3. Both connected via serial link (direct, Bluetooth, or TCP/IP bridge)
## Compilation
```
make clean
make STANDALONE=HF_CARDHOPPER -j
./pm3-flash-fullimage
```
Requires `PLATFORM_EXTRAS=BTADDON` or FPC serial connection.
## Related
- [Reblay BT Relay](hf_reblay.md) — Similar 14A relay over Bluetooth
- [14A Sniffer](hf_14asniff.md) — Passive capture instead of active relay
doc/standalone/hf_colin.md
+71
View File
@@ -0,0 +1,71 @@
# HF_COLIN — VIGIKPWN MIFARE Classic Ultra-Fast Sniff/Sim/Clone
> **Author:** Colin Brigato
> **Frequency:** HF (13.56 MHz)
> **Hardware:** RDV4 (requires flash memory)
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_colin.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
A specialized MIFARE Classic attack mode designed for French VIGIK access control systems. It performs fast authentication attempts using ~37 hardcoded VIGIK keys, dumps the card, and can simulate or clone it.
## Why
VIGIK is a widely deployed intercom/access control system in French apartment buildings. It uses MIFARE Classic with a known set of keys. This mode automates the entire VIGIK attack chain — from key discovery to cloning — entirely on-device.
## How
1. **SEARCH**: Scans for MIFARE Classic cards
2. **READ**: Attempts authentication with hardcoded VIGIK keys, reads accessible sectors
3. **LOAD**: Loads captured data for simulation via JSON schema
4. **EMULATE**: Simulates the captured card
The mode uses a terminal-style UI with cursor positioning for status display.
## LED Indicators
| LED | Meaning |
|-----|---------|
| Complex terminal UI | Uses debug output for status rather than traditional LED patterns |
## Button Controls
| Action | Effect |
|--------|--------|
| Various presses | Trigger different functions in the UI |
## State Machine
```mermaid
stateDiagram-v2
[*] --> SEARCH : Startup
SEARCH --> READ : MFC card found
READ --> LOAD : Keys found,\nsectors dumped
LOAD --> EMULATE : Data loaded
EMULATE --> SEARCH : Cycle back
READ --> SEARCH : No valid keys
SEARCH --> [*] : Exit
```
## Compilation
```
make clean
make STANDALONE=HF_COLIN -j
./pm3-flash-fullimage
```
## Related
- [MattyRun MFC Clone](hf_mattyrun.md) — Generic MIFARE Classic attack
- [MFC Simulator](hf_mfcsim.md) — MFC simulation from flash
- [Young MFC Sniff/Sim](hf_young.md) — MFC sniff and simulation
- [MIFARE Classic Notes](../mfc_notes.md) — Key recovery techniques
- [Magic Cards Notes](../magic_cards_notes.md) — Writable magic card types
doc/standalone/hf_craftbyte.md
+67
View File
@@ -0,0 +1,67 @@
# HF_CRAFTBYTE — ISO14443A UID Stealer/Emulator
> **Author:** Anze Jensterle
> **Frequency:** HF (13.56 MHz)
> **Hardware:** Generic Proxmark3
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_craftbyte.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
Continuously scans for ISO14443A cards, captures their UIDs, and emulates them. Auto-detects card type (MFC 1K/4K, MIFARE Ultralight, DESFire).
## Why
Many access control systems rely primarily (or solely) on the UID of an NFC card for identification, without performing proper cryptographic authentication. CraftByte exploits this by capturing and replaying UIDs — demonstrating that UID-based access control is trivially defeated.
## How
1. **READ**: Performs ISO14443A anticollision to read the card's UID, ATQA, and SAK
2. **EMULATE**: Uses the captured UID to emulate the card at a reader
The mode detects the card type from ATQA/SAK and configures emulation accordingly.
## LED Indicators
| LED | Meaning |
|-----|---------|
| Minimal LED usage | Focus on read/emulate cycle |
## Button Controls
| Action | Effect |
|--------|--------|
| **Hold 1000ms** | Cycle: READ → EMULATE, or exit if held continuously |
| **USB command** | Exit standalone mode |
## State Machine
```mermaid
stateDiagram-v2
[*] --> READ : Startup
READ --> EMULATE : UID captured\n(button hold)
EMULATE --> READ : Button hold\n(scan new card)
READ --> READ : Scanning...
EMULATE --> EMULATE : Emulating...
READ --> [*] : Long hold / USB data
EMULATE --> [*] : Long hold / USB data
```
## Compilation
```
make clean
make STANDALONE=HF_CRAFTBYTE -j
./pm3-flash-fullimage
```
## Related
- [Aveful UL Reader](hf_aveful.md) — Full UL read/emulate (not just UID)
- [MattyRun MFC Clone](hf_mattyrun.md) — Full MFC attack (keys + data)
- [Young MFC Sniff/Sim](hf_young.md) — MFC UID capture with 2-bank storage
doc/standalone/hf_doegox_auth0.md
+77
View File
@@ -0,0 +1,77 @@
# HF_DOEGOX_AUTH0 — Ultralight C / Ultralight AES Unlocker
> **Author:** Philippe Teuwen (doegox)
> **Frequency:** HF (13.56 MHz)
> **Hardware:** Generic Proxmark3 (RDV4 with 9V antenna recommended)
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_doegox_auth0.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
Performs a relay-style attack to unlock password-protected MIFARE Ultralight C or Ultralight AES tags by rewriting the AUTH0 configuration byte during an authenticated session.
## Why
MIFARE Ultralight C and AES variants can password-protect their memory by setting an AUTH0 byte that specifies the first page requiring authentication. If AUTH0 itself is writable during an authenticated session, this mode exploits that window — during a legitimate reader's auth handshake — to rewrite AUTH0 to a higher page number, effectively unlocking all previously protected pages.
This is a sophisticated attack that requires precise timing and makes protected data permanently accessible.
## How
1. **LOOK**: Search for an Ultralight C or AES tag
2. **SNIFF**: Position the Proxmark3 to sniff the authentication exchange between the legitimate reader and the card
3. **WAIT**: Press button when ready to attempt the AUTH0 rewrite
4. **WRITE**: During the next auth session, inject a write command to AUTH0 that unlocks the card
5. **Result**: LED indicates success (solid) or failure (blink)
## LED Indicators
| LED | Meaning |
|-----|---------|
| **A** (solid) | Looking for card / preparing |
| **B** (solid) | Card found |
| **C** (solid) | Sniffing for auth exchange |
| **D** (solid) | Write successful |
| **D** (blinking) | Write failed |
## Button Controls
| Action | Effect |
|--------|--------|
| **Press (1 sec)** | Initiate AUTH0 write during next auth sniff |
| **Button press** | Exit mode (from other states) |
## State Machine
```mermaid
stateDiagram-v2
[*] --> LOOK_FOR_CARD : Startup\nLED_A
LOOK_FOR_CARD --> SNIFF_AUTH : ULC/ULAES found\nLED_B → LED_C
LOOK_FOR_CARD --> LOOK_FOR_CARD : No compatible card
SNIFF_AUTH --> WAIT_BUTTON : Auth detected
WAIT_BUTTON --> WAIT_RELEASE : Button pressed\n(ready to write)
WAIT_RELEASE --> WRITE_AUTH0 : Button released
WRITE_AUTH0 --> EXIT_SUCCESS : AUTH0 rewritten\nLED_D solid
WRITE_AUTH0 --> EXIT_FAIL : Write failed\nLED_D blink
EXIT_SUCCESS --> [*]
EXIT_FAIL --> [*]
```
## Compilation
```
make clean
make STANDALONE=HF_DOEGOX_AUTH0 -j
./pm3-flash-fullimage
```
## Related
- [BogitoRun Auth Sniffer](hf_bog.md) — Capture UL auth passwords
- [Aveful UL Reader](hf_aveful.md) — Read/emulate UL cards
doc/standalone/hf_emvpng.md
+72
View File
@@ -0,0 +1,72 @@
# HF_EMVPNG — EMV Visa Card Reader/Emulator
> **Author:** Davi Mikael (Penegui)
> **Frequency:** HF (13.56 MHz)
> **Hardware:** RDV4 (flash memory)
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_emvpng.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
Reads Visa EMV contactless payment cards and emulates the captured transaction data with a fixed ARQC (Authorization Request Cryptogram). **For educational and lab use only.**
## Why
Demonstrates the theoretical vulnerability of contactless payment cards to replay attacks when terminals don't properly validate cryptograms. This mode is designed for controlled lab environments to:
- **Educate**: Show how EMV contactless transactions work at the protocol level
- **Research**: Study EMV protocol behavior and terminal validation
- **Test terminals**: Verify that terminals properly reject replayed transactions
> ⚠ **Warning**: This mode uses a fixed ARQC. Modern payment terminals will reject these transactions. This is for educational purposes only.
## How
1. **READ**: Select the Visa application (PPSE/AID), read Track 2 data
2. **EMULATE**: Present captured Track 2 data with a fixed ARQC when queried by a terminal
## LED Indicators
| LED | Meaning |
|-----|---------|
| **A** (solid) | Reading mode |
| **B** (solid) | Activity indicator |
| **C** (solid) | Emulation mode |
## Button Controls
| Action | Effect |
|--------|--------|
| **Single click** | Toggle between READ and EMULATE modes |
| **Long hold** | Exit standalone mode |
## State Machine
```mermaid
stateDiagram-v2
[*] --> READ : Startup
READ --> EMULATE : Card read\n+ button click
EMULATE --> READ : Button click
READ --> READ : Waiting for Visa card
EMULATE --> EMULATE : Emulating with fixed ARQC
READ --> [*] : Long hold / USB data
EMULATE --> [*] : Long hold / USB data
```
## Compilation
```
make clean
make STANDALONE=HF_EMVPNG -j
./pm3-flash-fullimage
```
## Related
- [MSD Visa Reader](hf_msdsal.md) — Visa MSD (older format) reader/emulator
- [EMV Notes](../emv_notes.md) — EMV protocol documentation
doc/standalone/hf_iceclass.md
+105
View File
@@ -0,0 +1,105 @@
# HF_ICECLASS — iCLASS Multi-Mode Standalone
> **Author:** Iceman
> **Frequency:** HF (13.56 MHz)
> **Hardware:** RDV4 (requires flash memory)
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_iceclass.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
A multi-mode iCLASS standalone with **7 selectable modes** for different operations: full simulation, reader attack, dump-and-simulate, read-and-simulate, and configuration card creation. Only one mode is active per compile.
## Why
HID iCLASS is a widely deployed access control system. This mode provides a comprehensive toolkit for iCLASS assessment:
- **Credential recovery**: Capture authentication data for offline key recovery (loclass attack)
- **Badge simulation**: Emulate captured iCLASS credentials at readers
- **Reader configuration**: Create config cards that can reconfigure iCLASS readers (e.g., downgrade attacks)
## How
The mode selected at compile time (`ICE_USE` macro) determines behavior:
| ICE_USE Value | Mode | Description |
|---------------|------|-------------|
| ICE_USE_FULLSIM | Full Simulation | Emulate a complete iCLASS card from EEPROM dump |
| ICE_USE_READER_ATTACK | Reader Attack | Capture authentication MACs for loclass recovery |
| ICE_USE_DUMP_SIM | Dump & Simulate | Dump a card then immediately simulate it |
| ICE_USE_READ_SIM | Read & Simulate | Read credential blocks and simulate |
| ICE_USE_CONFIG_CARD | Config Card | Create configuration cards for reader reprogramming |
The reader attack mode is particularly powerful: it captures the authentication exchange between a reader and cards, producing MAC pairs that feed into the loclass attack for key recovery.
## LED Indicators
| LED | Meaning |
|-----|---------|
| **B** (solid/blink) | Attack mode activity |
| **D** (solid) | General operation indicator |
| Mode-specific patterns | Vary by selected ICE_USE mode |
## Button Controls
Vary by selected mode. Generally:
| Action | Effect |
|--------|--------|
| **Button press** | Mode-specific action |
| **Hold** | Exit standalone mode |
## State Machine (Reader Attack Mode)
```mermaid
stateDiagram-v2
[*] --> WaitCard : Startup\n(Reader Attack mode)
WaitCard --> Authenticate : iCLASS card detected
Authenticate --> CaptureMAC : Auth exchange\ncaptured
CaptureMAC --> SaveFlash : MAC pair logged
SaveFlash --> WaitCard : Continue collecting
WaitCard --> [*] : Button hold / USB data
note right of CaptureMAC
MAC pairs used for
loclass key recovery
end note
```
## State Machine (Dump & Simulate Mode)
```mermaid
stateDiagram-v2
[*] --> ScanCard : Startup
ScanCard --> DumpCard : iCLASS card found
DumpCard --> LoadEmulator : Dump complete
LoadEmulator --> Simulate : Data loaded
Simulate --> [*] : Button hold / USB data
DumpCard --> ScanCard : Dump failed
```
## Flash Storage
- Captured MAC pairs stored on SPI flash for later retrieval
- EEPROM dumps stored for simulation modes
- Configuration card templates
## Compilation
```
make clean
make STANDALONE=HF_ICECLASS -j
./pm3-flash-fullimage
```
## Related
- [Loclass Notes](../loclass_notes.md) — Loclass attack documentation
- [HID Downgrade Attacks](../hid_downgrade.md) — Reader downgrade techniques
- [IceHID Collector](lf_icehid.md) — LF HID credential collection (different protocol)
doc/standalone/hf_legic.md
+66
View File
@@ -0,0 +1,66 @@
# HF_LEGIC — Legic Prime Read/Simulate
> **Author:** uhei
> **Frequency:** HF (13.56 MHz)
> **Hardware:** Generic Proxmark3
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_legic.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
Reads Legic Prime tags and simulates them. Auto-detects card type (MIM256, MIM512, MIM1024).
## Why
Legic Prime is a proprietary HF contactless technology used in European access control, time & attendance, and vending systems. This mode provides standalone read-and-replay capability.
## How
1. **Search**: Continuously scans for Legic Prime tags
2. **Read**: On detection, dumps the tag memory (auto-detects size)
3. **Simulate**: Broadcasts the captured tag data
## LED Indicators
| LED | Meaning |
|-----|---------|
| **C** (solid) | Searching for tag |
| **A + B + C** (solid) | Reading tag |
| **A + D** (solid) | Simulating tag |
## Button Controls
| Action | Effect |
|--------|--------|
| **Hold 280ms** | Exit standalone mode |
| **USB command** | Exit standalone mode |
## State Machine
```mermaid
stateDiagram-v2
[*] --> Search : Startup\nLED_C
Search --> Read : Legic Prime found\nLED_A+B+C
Read --> Simulate : Tag dumped\nLED_A+D
Simulate --> Search : Loop back
Read --> Search : Read failed
Search --> [*] : Button hold / USB data
Simulate --> [*] : Button hold / USB data
```
## Compilation
```
make clean
make STANDALONE=HF_LEGIC -j
./pm3-flash-fullimage
```
## Related
- [Legic Prime Simulator](hf_legicsim.md) — Multi-slot Legic simulation from flash
doc/standalone/hf_legicsim.md
+81
View File
@@ -0,0 +1,81 @@
# HF_LEGICSIM — Legic Prime Multi-Slot Simulator
> **Author:** uhei
> **Frequency:** HF (13.56 MHz)
> **Hardware:** RDV4 (requires flash memory)
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_legicsim.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
Simulates Legic Prime MIM1024 dumps stored on flash memory. Supports up to **15 dump slots** that can be cycled through. Changes made by readers during simulation are written back to the dump.
## Why
When you need to emulate multiple Legic Prime cards on-site — for example, testing which credentials grant access to different areas. The 15-slot capacity and flash persistence means dumps survive power cycles.
## How
1. On startup, loads the first dump from flash (`hf_legicsim_dump_01.bin`)
2. Simulates the loaded dump as a Legic Prime MIM1024 tag
3. Short press cycles to the next slot
4. After simulation, any changes written by readers are saved back to the dump file
## LED Indicators
| LED | Meaning |
|-----|---------|
| LEDs (1–15) | Current slot number indication |
## Button Controls
| Action | Effect |
|--------|--------|
| **Short press** | Next dump slot |
| **Hold 500ms** | Exit standalone mode |
## State Machine
```mermaid
stateDiagram-v2
[*] --> LoadSlot1 : Startup
LoadSlot1 --> Simulate : Dump loaded
Simulate --> WriteBack : Simulation stopped
WriteBack --> LoadSlot2 : Short press\nSave changes, next slot
LoadSlot2 --> Simulate : Dump loaded
Simulate --> [*] : Hold 500ms
note right of Simulate
Slots 01-15
Files: hf_legicsim_dump_XX.bin
Each 1024 bytes (MIM1024)
end note
```
## Flash Files
Upload dumps before use:
```
mem spiffs load -s hf_legicsim_dump_01.bin -d hf_legicsim_dump_01.bin
mem spiffs load -s hf_legicsim_dump_02.bin -d hf_legicsim_dump_02.bin
...
```
Each file is 1024 bytes (Legic Prime MIM1024 dump).
## Compilation
```
make clean
make STANDALONE=HF_LEGICSIM -j
./pm3-flash-fullimage
```
## Related
- [Legic Prime Reader](hf_legic.md) — Read and simulate Legic tags (single shot)
doc/standalone/hf_mattyrun.md
+88
View File
@@ -0,0 +1,88 @@
# HF_MATTYRUN — MIFARE Classic Key Check/Dump/Emulate
> **Author:** Matías A. Ré Medina
> **Frequency:** HF (13.56 MHz)
> **Hardware:** Generic Proxmark3
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_mattyrun.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
A full MIFARE Classic attack chain: discovers MFC cards, checks keys from a built-in dictionary, dumps the card using ecfill, then emulates it. Supports MIFARE Classic 1K and 4K.
## Why
MIFARE Classic is the most widely deployed contactless smart card worldwide — used in transit, access control, and loyalty systems. MattyRun automates the complete attack pipeline on-device:
1. Find the card
2. Recover the keys (from dictionary)
3. Dump all data
4. Emulate the full card at a reader
No laptop required at any step.
## How
1. **READ**: Scans for MIFARE Classic cards (anticollision, ATQA/SAK check)
2. **ATTACK**: Checks keys from the built-in dictionary against all sectors. Uses nested authentication attack if partial keys are found
3. **LOAD**: Performs ecfill to dump the card data into the emulator memory
4. **EMULATE**: Simulates the complete MIFARE Classic card including all sector keys and data
LED D lit during emulation indicates a partial dump (some sectors couldn't be read).
## LED Indicators
| LED | Meaning |
|-----|---------|
| **C + D** (solid) | Idle / searching for card |
| **C + D** (blinking) | Authenticating / checking keys |
| **B** (solid) | Attack mode (nested) |
| **A + B + C** (solid) | Loading data to emulator |
| **A + B + C + D** (solid) | Emulating (D = partial dump warning) |
## Button Controls
| Action | Effect |
|--------|--------|
| **Hold 280ms** | Exit standalone mode |
| **Short press** | No effect (purely state-machine driven) |
## State Machine
```mermaid
stateDiagram-v2
[*] --> READ : Startup\nLED_C+D
READ --> ATTACK : MFC card found\nLED_C+D blink
READ --> READ : No card found
ATTACK --> LOAD : Keys recovered\nLED_B
ATTACK --> READ : No keys found\n(retry with new card)
LOAD --> EMULATE : ecfill complete\nLED_A+B+C
EMULATE --> [*] : Button hold\nLED_A+B+C+D
note right of EMULATE
LED_D lit = partial dump
(some sectors unreadable)
end note
```
## Compilation
```
make clean
make STANDALONE=HF_MATTYRUN -j
./pm3-flash-fullimage
```
## Related
- [VIGIKPWN](hf_colin.md) — MIFARE Classic with VIGIK-specific keys
- [MFC Simulator](hf_mfcsim.md) — Simulate MFC from flash dumps
- [Young MFC Sniff/Sim](hf_young.md) — UID-based MFC sniff and sim
- [MIFARE Classic Notes](../mfc_notes.md) — Key recovery and attack techniques
- [Magic Cards Notes](../magic_cards_notes.md) — Writing to magic/CUID cards
doc/standalone/hf_mfcsim.md
+84
View File
@@ -0,0 +1,84 @@
# HF_MFCSIM — MIFARE Classic 1K Multi-Slot Simulator
> **Author:** Ray Lee
> **Frequency:** HF (13.56 MHz)
> **Hardware:** RDV4 (requires flash memory)
[Back to Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation) | [Source Code](../../armsrc/Standalone/hf_mfcsim.c) | [Development Guide](../../armsrc/Standalone/readme.md#developing-standalone-modes)
---
## What
Simulates MIFARE Classic 1K cards from dump files stored on flash. Supports up to **15 dump slots**. Changes written by readers during simulation are saved back to the dump file.
## Why
When you have multiple MIFARE Classic card dumps (from `hf mf dump` or other tools) and need to emulate them on-site without a laptop. The 15-slot capacity covers multiple credentials, and the write-back feature preserves any reader-induced changes.
## How
1. Loads dump number 1 from flash (`hf_mfcsim_dump_01.bin`)
2. Configures the emulator with full card data including all sector keys
3. Begins simulation
4. Cycle through slots for different cards
5. Any writes from readers are saved back to the dump file
## LED Indicators
| LED | Meaning |
|-----|---------|
| LEDs | Indicate current dump slot number (1–15) |
## Button Controls
| Action | Effect |
|--------|--------|
| **Short press** | Next dump slot |
| **Hold 500ms** | Exit standalone mode |
## State Machine
```mermaid
stateDiagram-v2
[*] --> LoadSlot : Startup
LoadSlot --> Simulate : Dump loaded into emulator
Simulate --> WriteBack : Simulation stopped
WriteBack --> LoadNext : Short press\nSave, advance slot
LoadNext --> LoadSlot : Load next dump
Simulate --> [*] : Hold 500ms
note right of Simulate
Slots 01-15
Files: hf_mfcsim_dump_XX.bin
Each 1024 bytes (MFC 1K)
end note
```
## Flash Files
Upload dumps before use:
```
mem spiffs load -s hf_mfcsim_dump_01.bin -d hf_mfcsim_dump_01.bin
mem spiffs load -s hf_mfcsim_dump_02.bin -d hf_mfcsim_dump_02.bin
...
```
Each file is 1024 bytes (MIFARE Classic 1K dump including sector keys).
## Compilation
```
make clean
make STANDALONE=HF_MFCSIM -j
./pm3-flash-fullimage
```
## Related
- [MattyRun MFC Clone](hf_mattyrun.md) — Full MFC attack chain (discover → dump → emulate)
- [VIGIKPWN](hf_colin.md) — VIGIK-specific MFC attacks
- [MIFARE Classic Notes](../mfc_notes.md) — Key recovery techniques

Some files were not shown because too many files have changed in this diff Show More