mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-05-12 11:18:11 -07:00
Merge pull request #27 from RfidResearchGroup/master
Resync from Master
This commit is contained in:
mwalker33
@@ -20,12 +20,15 @@
|
||||
*.dll
|
||||
*.moc.cpp
|
||||
*.z
|
||||
*.gz
|
||||
*.Td
|
||||
*.DS_Store
|
||||
*.exe
|
||||
*.dsym
|
||||
version.c
|
||||
*.json
|
||||
*.old
|
||||
*.swp
|
||||
|
||||
# new build file for add-ons.
|
||||
Makefile.platform
|
||||
|
||||
@@ -33,9 +33,11 @@ addons:
|
||||
packages:
|
||||
- gcc-arm-none-eabi
|
||||
- libnewlib-dev
|
||||
- libsndfile1-dev
|
||||
homebrew:
|
||||
packages:
|
||||
- readline
|
||||
- libsndfile
|
||||
- qt5
|
||||
- RfidResearchGroup/proxmark3/arm-none-eabi-gcc
|
||||
taps: RfidResearchGroup/proxmark3
|
||||
|
||||
+157
-112
@@ -3,201 +3,244 @@ All notable changes to this project will be documented in this file.
|
||||
This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
|
||||
|
||||
## [unreleased][unreleased]
|
||||
- Fix hf list felica and hf felica sniff (@7homasSutter)
|
||||
- Added hf felica wrunencrypted (@7homasSutter)
|
||||
- Added hf felica rdunencrypted (@7homasSutter)
|
||||
- Added hf felica rqresponse (@7homasSutter)
|
||||
- Added hf felica rqservice (@7homasSutter)
|
||||
- Added `hf lto restore` - restore LTO cartridge memory from dump file [.bin|.eml] (@Kevin-Nakamoto)
|
||||
- Added `LF_ICEHID` standalone mode which searches for lf HID credentials and store to RDV4 flashmem (@iceman1001)
|
||||
- Added `HF_14ASNIFF` standalone mode with storing trace to RDV4 flashmem (@micolous)
|
||||
- Added `hf lto dump` - dump 8160 bytes of data from LTO cartridge memory and save to file (@Kevin-Nakamoto)
|
||||
- Change `data plot` - write serial port name in window title for plot / slider window (@iceman1001)
|
||||
- Added `hf lto wrbl` - write block support for LTO Cartridge memory (@Kevin-Nakamoto)
|
||||
- Fix compilation under openSUSE (@hsanjuan)
|
||||
- Added `lf nexwatch sim` - use raw hex to simulate (@iceman1001)
|
||||
- Fix `lf indala read` - long id 224bits preamble identification less strict (@iceman1001)
|
||||
- Added `hf mf staticnested` - useful when targeting the strange cards with a static nonce. (@iceman100) Thanks to @xtigmh @uzlonewolf for their solutions.
|
||||
- Added `hf plot` (@pwpiwi)
|
||||
- Fix `lf config` - when called with no params, it no longer mess up all device lf config settings. (@iceman1001)
|
||||
- Change `lf indala clone` - new option `--Q5` writes to q5/T5555 tags. (@iceman1001)
|
||||
- Change `lf indala clone` - new option `-c <card id>` allows cloning INDALA tag from Heden2L/Hedengren ID format (@iceman1001) - Thanks to @randomdude42 for solution
|
||||
- Change `lf indala demod` - added decode Heden2L/Hedengren format (@iceman1001) - Thanks to @randomdude42 for solution
|
||||
- Added `commands.md` - document with all proxmark client commands. Generated with XX_internal_command_dump_markdown_XX. (@iceman1001)
|
||||
- Change `lf pac clone` - new option `c <card id>` to allow cloning PAC/Stanley tag from card ID (@danshuk)
|
||||
- Change `lf pac read` - decoded PAC/Stanley card ID (@danshuk)
|
||||
- Change mifare classic keytable output refactored and uses colors (@iceman1001)
|
||||
- Fix `hf mf nested` - now writes the correct blockno (@iceman1001)
|
||||
- Change `lf t55xx dump` - now supports saving to JSON (@iceman1001)
|
||||
- Change `hf mf chk | fchk` faster authentication by lower timeout limit. (@pwpiwi)
|
||||
- Change `hf mf hardnested` - now detects "static / fixed" nonce tags and exits (@iceman1001)
|
||||
- Change `hf mf csave` - now uses UID in filename (@iceman1001)
|
||||
- Fix `hf mf chk` - read block B logical error. #489 (@iceman1001)
|
||||
- Added `hf mf ekeyprn d` - new parameter to save keys to file (@iceman1001)
|
||||
- Added `mfu_magic.lua` - script to interact with your magic NTAG tag. (@iceman1001)
|
||||
- Added `hf_bruteforce.lua` - script bruteforces uid for 14a using hf 14a sim (@keld)
|
||||
- Added `tools\pm3_cs8.pl` - convert .pm3 files to wave format (@samyk)
|
||||
- Added `tools\pm3_amii_bin2eml.pl` - amiibo convering script (@samyk)
|
||||
- Change `hf 14a info` - now detects "static / fixed" nonce tags (@iceman1001)
|
||||
- Change `data save f <filename> w` - params reworked. (@iceman1001)
|
||||
- Change `hf search` - now should detect LTO-CM tags (@iceman1001)
|
||||
- Added `hf lto info` - skeleton support for LTO Cartridge memory (@iceman1001)
|
||||
- Added saving as wave format (@anon)
|
||||
- Added ISO15_WRITE annotation (@pwipiw)
|
||||
- Added `lto_dump.lua` @kevin
|
||||
- Added `hf mf cwipe` magic chinese card (gen1a) wipe to default state (@merlokk)
|
||||
- Added `pm3_mf7b_wipe.py` python script. Wipes magic S70 7B Gen2 card. (@vulnersCom)
|
||||
- Added `hf mfp chk` Mifare plus command for check keys from public keys list, from dictionary or 1 and 2-byte bruteforce (@merlokk)
|
||||
- Change `hf 15` - some refactoring (@grspy)
|
||||
- Added `hf 15 writeafi` and `hf 15 writedsfid` (@grspy)
|
||||
- Added detailed info for SLIX2 tags in `hf 15 info` (@grspy)
|
||||
- Fix `hf list felica` and `hf felica sniff` (@7homasSutter)
|
||||
- Added `hf felica wrunencrypted` (@7homasSutter)
|
||||
- Added `hf felica rdunencrypted` (@7homasSutter)
|
||||
- Added `hf felica rqresponse` (@7homasSutter)
|
||||
- Added `hf felica rqservice` (@7homasSutter)
|
||||
- Added polling for felica standard (@7homasSutter)
|
||||
- Added lf t55xx dump save and lf t55xx restore for .bin and .eml files (@mwalker33)
|
||||
- Added lf t55xx detected to try without password first (@mwalker33)
|
||||
- Chg `lf indala read` - added indala 26bit decoding (@martinbeier)
|
||||
- Chg `lf t55xx detect` to try without password first (@mwalker33)
|
||||
- Added `lf t55xx dump save` and `lf t55xx restore` for .bin and .eml files (@mwalker33)
|
||||
- Added `lf t55xx detected` to try without password first (@mwalker33)
|
||||
- Change `lf indala read` - added indala 26bit decoding (@martinbeier)
|
||||
- Change `lf t55xx detect` to try without password first (@mwalker33)
|
||||
- Display high bit for detected Kastle HIDs to allow `lf hid clone [id]` to work properly (@swg0101)
|
||||
- Add option `-n` to scripts pm3* (@doegox)
|
||||
- Add `wiegand list/encode/decode` - wiegand format manipulation. Adapted to fit here. (@grauerfuchs)
|
||||
- Added option `-n` to scripts pm3* (@doegox)
|
||||
- Added `wiegand list/encode/decode` - wiegand format manipulation. Adapted to fit here. (@grauerfuchs)
|
||||
- Added support for color text on windows 10 (@mwalker33)
|
||||
- Added `s` <samples to skip> to `lf config` / `lf sniff` to skip samples when sniffing based on same option in Proxmark/proxmark3 by @marshmellow42. (@mwalker33)
|
||||
- Added save to .eml and .bin for `em 4x05_dump` (@mwalker33)
|
||||
- Add option `-n` to scripts pm3* (@doegox)
|
||||
- Added option `-n` to scripts pm3* (@doegox)
|
||||
- Fix `em 4x05_dump` to print all blocks read (@mwalker33)
|
||||
- Fix T55xx config getting displayed when using password when no password needed on read. (@mwalker33)
|
||||
- Added T55x7 downlink mode auto usage via mode detected (lf t55 detect) (@mwalker33)
|
||||
- Add `lf t55xx protect` - sets password and enables password protection on t55x7 tag (@iceman1001)
|
||||
- Chg `lf t55xx wipe` - now accepts user provided configuration block (@iceman1001)
|
||||
- Added `lf t55xx protect` - sets password and enables password protection on t55x7 tag (@iceman1001)
|
||||
- Change `lf t55xx wipe` - now accepts user provided configuration block (@iceman1001)
|
||||
- Added T55x7 downlink mode support r <mode> 0 Default, 1 Long Leading 0, 2 Leading 0, 3 1 of 4 and 4 (in some commands) try all. (@mwalker33)
|
||||
- Chg proxmark3-flasher is now merged into proxmark3 client. Add pm3-flash (@doegox)
|
||||
- Chg `hf iclass clone\dump\rdbl\wrbl` - now uses NG (@iceman1001)
|
||||
- Change proxmark3-flasher is now merged into proxmark3 client. Add pm3-flash (@doegox)
|
||||
- Change `hf iclass clone\dump\rdbl\wrbl` - now uses NG (@iceman1001)
|
||||
- Fix `hf iclass clone` - last block always fails (@iceman1001)
|
||||
- Chg `hf iclass clone` - retries ten times, less output (honor verbose) (@iceman1001)
|
||||
- Chg `hf iclass dump` - retries ten times, less output (honor verbose) (@iceman1001)
|
||||
- Change `hf iclass clone` - retries ten times, less output (honor verbose) (@iceman1001)
|
||||
- Change `hf iclass dump` - retries ten times, less output (honor verbose) (@iceman1001)
|
||||
- Rename `hf iclass writeblk` -> `hf iclass wrbl` to match hf mf wrbl (@iceman1001)
|
||||
- Rename `hf iclass readblk` -> `hf iclass rdbl` to match hf mf rdbl (@iceman1001)
|
||||
- Add cmdscript example and show usage with shebang (@doegox)
|
||||
- Add instructions for Fedora (@doegox)
|
||||
- Chg reduce the list of requirements to the minimum and move to QT5 (@doegox)
|
||||
- Add `make install` and reorganize/rename stuffs accordingly (@doegox)
|
||||
- Add searchFile for several types of files (@doegox / @iceman1001)
|
||||
- Chg posix sh version of mkversion (@doegox)
|
||||
- Chg remove entirely ncurses, not needed nowadays (@doegox)
|
||||
- Chg remove deprecated termcap, use ncurses instead (@ZeroChaos-)
|
||||
- Chg `hf iclass encrypt` - now takes transport key as param. (@iceman1001)
|
||||
- Chg `hf iclass decrypt` - now takes transport key as param. (@iceman1001)
|
||||
- Chg `hf mf fchk m` - now secretly dumps card to emul, if all keys are found (@iceman1001)
|
||||
- Chg history and logfile are now saved into $HOME/.proxmark3/ (@doegox)
|
||||
- Chg optimization of iclass mac calculations on deviceside (@pwpiwi)
|
||||
- Add `hf mf autopwn` - Autopwn function for Mifare Classic, extract all keys and dump card memory (@matthiaskonrath)
|
||||
- Add Lua paths: look for scripts also in ~/.proxmark/lua{scripts,libs} and /usr/local/share/proxmark3/lua{scripts,libs} (@doegox)
|
||||
- Added cmdscript example and show usage with shebang (@doegox)
|
||||
- Added instructions for Fedora (@doegox)
|
||||
- Change reduce the list of requirements to the minimum and move to QT5 (@doegox)
|
||||
- Added `make install` and reorganize/rename stuffs accordingly (@doegox)
|
||||
- Added searchFile for several types of files (@doegox / @iceman1001)
|
||||
- Change posix sh version of mkversion (@doegox)
|
||||
- Change remove entirely ncurses, not needed nowadays (@doegox)
|
||||
- Change remove deprecated termcap, use ncurses instead (@ZeroChaos-)
|
||||
- Change `hf iclass encrypt` - now takes transport key as param. (@iceman1001)
|
||||
- Change `hf iclass decrypt` - now takes transport key as param. (@iceman1001)
|
||||
- Change `hf mf fchk m` - now secretly dumps card to emul, if all keys are found (@iceman1001)
|
||||
- Change history and logfile are now saved into $HOME/.proxmark3/ (@doegox)
|
||||
- Change optimization of iclass mac calculations on deviceside (@pwpiwi)
|
||||
- Added `hf mf autopwn` - Autopwn function for Mifare Classic, extract all keys and dump card memory (@matthiaskonrath)
|
||||
- Added Lua paths: look for scripts also in ~/.proxmark/lua{scripts,libs} and /usr/local/share/proxmark3/lua{scripts,libs} (@doegox)
|
||||
- Change Lua directory scripts/ to luascript/ (@doegox)
|
||||
- Change non-rdv4 PLATFORM must now use the generic PM3OTHER, simpler (@doegox)
|
||||
- Fix reveng integration for all platforms else than WIN32 (@doegox)
|
||||
- Add cheat sheet for easy operations of the Proxmark3 (scund00r)
|
||||
- Added cheat sheet for easy operations of the Proxmark3 (scund00r)
|
||||
- Chg commands are now in green in the helptext list (@iceman1001)
|
||||
- Fix `script run ndefdump` - better exit messages when failing (@iceman1001)
|
||||
- Fix `hf iclass dump` - now also saves in EML format (@iceman1001)
|
||||
- Fix `hf iclass sim 3` - now works on legacy readers and legacy SE readers (@iceman1001)
|
||||
- Rework hitag2 read/write help (@ViRb3)
|
||||
- Add `lf nedap` - encoding / decoding (anon)
|
||||
- Add client option `-i` to stay in interactive mode after a script or command (@DidierStevens/@doegox)
|
||||
- Add VSCode tasks (@ViRb3)
|
||||
- Added `lf nedap` - encoding / decoding (anon)
|
||||
- Added client option `-i` to stay in interactive mode after a script or command (@DidierStevens/@doegox)
|
||||
- Added VSCode tasks (@ViRb3)
|
||||
- Better warn user of hardcoded hitag info (@ViRb3)
|
||||
- Format and docs hitag (@ViRb3)
|
||||
- Fix hitag password write offset by 1 (@ViRb3)
|
||||
- Fix momentarily flash read/write of dicts (@doegox/@cjbrigato)
|
||||
- Add some more default keys (@anon)
|
||||
- Add `hf thinfilm sim` simulating Thinfilm NFC barcode tags (@doegox)
|
||||
- Add `hf thinfilm list` specific trace decoding (Thinfilm NFC barcode tags) (@doegox)
|
||||
- Added some more default keys (@anon)
|
||||
- Added `hf thinfilm sim` simulating Thinfilm NFC barcode tags (@doegox)
|
||||
- Added `hf thinfilm list` specific trace decoding (Thinfilm NFC barcode tags) (@doegox)
|
||||
- Fix `hf topaz reader` - don't crash when trying to read a Thinfilm tag (@iceman1001)
|
||||
- Add `hf thinfilm info` - read / decode Kovio Thinfilm NFC barcode tags (@iceman1001)
|
||||
- Add FPGA LF adc path (@anon)
|
||||
- Add ECC support / check for NID_secp128r1 (@pwpiwi)
|
||||
- Add some more default keys (ollibolli)
|
||||
- Added `hf thinfilm info` - read / decode Kovio Thinfilm NFC barcode tags (@iceman1001)
|
||||
- Added FPGA LF adc path (@anon)
|
||||
- Added ECC support / check for NID_secp128r1 (@pwpiwi)
|
||||
- Added some more default keys (ollibolli)
|
||||
- Fix T55x7 Downlink timings backward compatible (@mwalker33)
|
||||
- Add proper Makefile halting when using incompatible STANDALONE and PLATFORM vars (@doegox)
|
||||
- Add T55x7 Downlink mode support (@mwalker33)
|
||||
- Add SPIFFS Flash filesystem support (@cjbrigato)
|
||||
- Added proper Makefile halting when using incompatible STANDALONE and PLATFORM vars (@doegox)
|
||||
- Added T55x7 Downlink mode support (@mwalker33)
|
||||
- Added SPIFFS Flash filesystem support (@cjbrigato)
|
||||
- Fix support for flashing 512K units with old bootrom (@slurdge/@doegox)
|
||||
- Fix `hf mf sim` - wrong access rights to write key B in trailer (@McEloff)
|
||||
- Add option -i to flasher to query Pm3 for its memory size (@doegox)
|
||||
- Add support for flashing 512K units (@slurdge)
|
||||
- Add a simple python tool to check the elf sizes (@slurdge)
|
||||
- Added option -i to flasher to query Pm3 for its memory size (@doegox)
|
||||
- Added support for flashing 512K units (@slurdge)
|
||||
- Added a simple python tool to check the elf sizes (@slurdge)
|
||||
- Change: new keys for Vigik badges in default_keys.dict (@luminouw)
|
||||
- Add `hw standalone` to jump to standalone mode from command line or script (@doegox)
|
||||
- Add to `hf 14a apdu` print apdu and compose apdu (@merlokk)
|
||||
- Added `hw standalone` to jump to standalone mode from command line or script (@doegox)
|
||||
- Added to `hf 14a apdu` print apdu and compose apdu (@merlokk)
|
||||
- Change: buggy `mem read` removed, `mem save` renamed `mem dump`, can now display too (@doegox)
|
||||
- Fix: timeout for mem wipe was too short, thanks @cjbrigato (@doegox)
|
||||
- Fix `hf mf sim` - Mifare Classic simulation more flexible anti-collision check (@McEloff)
|
||||
- Change: `hf mf sim` - Mifare Classic simulation not respond NACK on invalid authentication request (@McEloff)
|
||||
- Change: `read_pwd_mem.lua` now handles Mifare Classic dictionaries large than 4096 bytes (@iceman1001)
|
||||
- Change: Do not clear trace log during `hf mf chk`, to save whole process history (@McEloff)
|
||||
- Add `msleep` command, for pauses in scripts (@doegox)
|
||||
- Add support for WSL in proxmark.sh (@doegox)
|
||||
- Add documentation for usage of Proxmark3 under WSL (@doegox)
|
||||
- Added `msleep` command, for pauses in scripts (@doegox)
|
||||
- Added support for WSL in proxmark.sh (@doegox)
|
||||
- Added documentation for usage of Proxmark3 under WSL (@doegox)
|
||||
- Change: replace aes.c with mbedtls version (@slurdge)
|
||||
- Change: replace ukbhit by kbd_enter_pressed, not requiring tcgetattr (@xianglin1998/@doegox)
|
||||
- Add config for RaspberryPi in JTAG tools (@doegox)
|
||||
- Add config for FTDI C232HM-DDHSL-0 in JTAG tools (@doegox)
|
||||
- Added config for RaspberryPi in JTAG tools (@doegox)
|
||||
- Added config for FTDI C232HM-DDHSL-0 in JTAG tools (@doegox)
|
||||
- Fix compilation under MacOSX with binutils (@matrix)
|
||||
- Add dynamic report of the chipID for flashing purposes (@slurdge)
|
||||
- Added dynamic report of the chipID for flashing purposes (@slurdge)
|
||||
- Fix Clang warnings (@matrix)
|
||||
- Fix EMVGPO bug (@matrix)
|
||||
- Add hitag2 write password auth (@ViRb3)
|
||||
- Add check if bootloader segment is within bounds (@slurdge)
|
||||
- Add `hf 15 csetuid` - set UID on ISO-15693 Magic tags (@t0m4-null)
|
||||
- Added hitag2 write password auth (@ViRb3)
|
||||
- Added check if bootloader segment is within bounds (@slurdge)
|
||||
- Added `hf 15 csetuid` - set UID on ISO-15693 Magic tags (@t0m4-null)
|
||||
- Change: Print help if unknown arg for hitag reader/writer (@ViRb3)
|
||||
- Fix clock deadlock in hitag sniff (@ViRb3)
|
||||
- Add compiler info in client & ARM sections (@slurdge)
|
||||
- Add support for automatic COM detection on Windows (@slurdge)
|
||||
- Add support for compilation on RaspberryPiZero (armv6) (@doegox)
|
||||
- Added compiler info in client & ARM sections (@slurdge)
|
||||
- Added support for automatic COM detection on Windows (@slurdge)
|
||||
- Added support for compilation on RaspberryPiZero (armv6) (@doegox)
|
||||
- Change: updates to README (@iceman1001)
|
||||
- Change: `hf mf/mfu dbg` => `hw dbg` (@doegox)
|
||||
- Change: replace usb_poll_validate_length() by data_available() that supports USART too (@doegox)
|
||||
- Make sure standalone modes can be launched when connected on USB without client (@doegox)
|
||||
- Change: cleaner makefile execution, use `make V=1` if you want to see full lines (@doegox)
|
||||
- Change: automate make clean when platform definitions are changed (@doegox)
|
||||
- Add STANDALONE option to Makefile.hal (@Fl0-0)
|
||||
- Added STANDALONE option to Makefile.hal (@Fl0-0)
|
||||
- Change: mem info - production public key to verify rdv4.0 flash signature (@iceman1001)
|
||||
- Fix specify that we need TCP and not UDP connection (@phcoder)
|
||||
- Change: lf cotag demod - adjusted error trigger (@iceman1001)
|
||||
- Add documentation on BT add-on (@iceman1001/@doegox)
|
||||
- Added documentation on BT add-on (@iceman1001/@doegox)
|
||||
- Change: new button behaviour in bootloader mode, no need to keep it pressed, press again to interrupt (@doegox)
|
||||
- Change: new keys in dicts, new mem layout to accomodate them (@iceman1001/various)
|
||||
- Fix lf sim - if called with empty graphbuffer all strange things happend, like turning on HF field (@iceman1001)
|
||||
- Change: hf 14a sim / hf mf sim - check buttonpress/usb frame fewer times in order not to disrupt simulation (@McEloff)
|
||||
- Change: data convertbitstream - converts bit to max/min in order to facilitate demodulation of simulation data (@iceman1001)
|
||||
- Change: lf em 410x_demod - now can demod the simulation data (@iceman1001)
|
||||
- Add HC-06 scripts for BT add-on (@doegox)
|
||||
- Added HC-06 scripts for BT add-on (@doegox)
|
||||
- Fix lf nedap sim - error when adding parity (@iceman1001)
|
||||
- Add documentation on UART and baudrates (@doegox/@iceman1001)
|
||||
- Added documentation on UART and baudrates (@doegox/@iceman1001)
|
||||
- Change: prompt now shows which channel is used (@iceman1001)
|
||||
- Change: USART baudrates computation, up to 6Mbps (@iceman1001/@doegox)
|
||||
- Change: hf mf nack - keep sync if started without card over antenna
|
||||
- Add usart btfactory - to reset a misconfigured BT add-on (@doegox)
|
||||
- Added usart btfactory - to reset a misconfigured BT add-on (@doegox)
|
||||
- Change: hw status - now prints number of dictionary keys loaded (@iceman1001)
|
||||
- Add home, end, pageup, and pagedown keybinds to the plot GUI. Also fix paged movement in GUI. (@mcd1992)
|
||||
- Added home, end, pageup, and pagedown keybinds to the plot GUI. Also fix paged movement in GUI. (@mcd1992)
|
||||
- Change legic.lua saves data in EML and BIN formats (@iceman1001)
|
||||
- Change hf tune - is now synchronous (for BT add-on) and can be interrupted by kbd (@doegox)
|
||||
- Change: update macOS install instruction (@ Uli Heilmeier)
|
||||
- Add trace ouput in hexdump format for Wireshark import (@ Uli Heilmeier)
|
||||
- Add usart btpin - to change BT add-on PIN (@doegox)
|
||||
- Add reconnection support (@iceman1001/@doegox)
|
||||
- Add usart tx/rx/... - USART developer commands (@doegox)
|
||||
- Add PLATFORM_EXTRAS, WITH_FPC_USART_HOST, BTADDON Makefile configuration (@doegox)
|
||||
- Added trace ouput in hexdump format for Wireshark import (@ Uli Heilmeier)
|
||||
- Added usart btpin - to change BT add-on PIN (@doegox)
|
||||
- Added reconnection support (@iceman1001/@doegox)
|
||||
- Added usart tx/rx/... - USART developer commands (@doegox)
|
||||
- Added PLATFORM_EXTRAS, WITH_FPC_USART_HOST, BTADDON Makefile configuration (@doegox)
|
||||
- Fix slow reconfigure on mingw of serial port (@iceman1001)
|
||||
- Fix cross thread communictions of timeout variable (@iceman1001)
|
||||
- Change: client is now "universal", adapting to Proxmark3 capabilities (@doegox)
|
||||
- Add disconnect support to Lua (@iceman1001)
|
||||
- Added disconnect support to Lua (@iceman1001)
|
||||
- Change: handles FPC/FLASH FW more gracefully on non-RDV4 pm3 (@doegox)
|
||||
- Add JTAG support for Shikra (@NinjaStyle82)
|
||||
- Added JTAG support for Shikra (@NinjaStyle82)
|
||||
- Change: smart color handling: only if linux and on real term (@doegox)
|
||||
- Change: reconfigure uart timeouts when compiled for FPC and connecting over USB (@iceman1001)
|
||||
- Change: fast push for many commands (@iceman1001/@doegox)
|
||||
- Add: fast push for Lua (@iceman1001)
|
||||
- Add NDEF parser in Lua (@iceman1001)
|
||||
- Added: fast push for Lua (@iceman1001)
|
||||
- Added NDEF parser in Lua (@iceman1001)
|
||||
- Change: improve NDEF parser (@iceman1001)
|
||||
- Change: all commands got migrated to MIX/NG packet format (@iceman1001/@doegox)
|
||||
- Fix: Mifare Ultralight read block missing bytes (@doegox)
|
||||
- Add support new frame format in all Lua scripts (@iceman1001)
|
||||
- Add CMD_CAPABILITIES for pm3 to inform dynamically the client (@doegox)
|
||||
- Added support new frame format in all Lua scripts (@iceman1001)
|
||||
- Added CMD_CAPABILITIES for pm3 to inform dynamically the client (@doegox)
|
||||
- Change baudrate handling, make it clear it is only indicative for USB-CDC & BT (@doegox)
|
||||
- Change: new progressive light scheme for `hw detectreader` (@doegox)
|
||||
- Add common error definitions system for retvals (@doegox)
|
||||
- Added common error definitions system for retvals (@doegox)
|
||||
- Change USART RX & TX code and fix delays handling to make it more robust, especially over BT (@doegox)
|
||||
- Add support for new frames format, speedup & huge changes, see doc/new_frame_format.txt (@doegox)
|
||||
- Added support for new frames format, speedup & huge changes, see doc/new_frame_format.txt (@doegox)
|
||||
- Change: loadFile* & saveFile* accept filenames with (or still without) extension (@doegox)
|
||||
- Fix LoadEML to accept final "\n", e.g. from pm3_mfd2eml.py (@doegox)
|
||||
- Change: rework shell scripts for easy client or flasher (@doegox)
|
||||
- Fix: stop poking Internet when compiling (@doegox)
|
||||
- Add support for multiple commands to "-c", e.g. proxmark3 -c "hw ping;hw version" (@doegox)
|
||||
- Added support for multiple commands to "-c", e.g. proxmark3 -c "hw ping;hw version" (@doegox)
|
||||
- Fix external flash writing bitflips issues at 24MHz (@doegox)
|
||||
- Add color support to Dbprintf & alike and rework Dbprintf flags (@doegox)
|
||||
- Added color support to Dbprintf & alike and rework Dbprintf flags (@doegox)
|
||||
- Change: archive (and fix) hid-flasher (@doegox)
|
||||
- Add standalone placeholder to simplify new standalone integration (@doegox)
|
||||
- Added standalone placeholder to simplify new standalone integration (@doegox)
|
||||
- Change: refactor standalone mode info string (@iceman1001)
|
||||
- Add iceman skeleton standalone mode for ppl to use as base for their new modes (@iceman1001)
|
||||
- Added iceman skeleton standalone mode for ppl to use as base for their new modes (@iceman1001)
|
||||
- Change: move compilation options to Makefile.hal (@doegox)
|
||||
- Fix compilation under OSX (@iceman1001)
|
||||
- Add openocd config files for JLink (@doegox)
|
||||
- Added openocd config files for JLink (@doegox)
|
||||
- Fix compilation dependencies for recovery (@doegox)
|
||||
- Fix segfault when loading a file (@doegox)
|
||||
- Change/Add new dump format for Ultralight/NTAG, counters support, simulation (@mceloff)
|
||||
- Add `hf mf sim` full-byte split anticollision support (@mceloff)
|
||||
- Added `hf mf sim` full-byte split anticollision support (@mceloff)
|
||||
- Fix/Add `hf mf sim` bugs fix, RATS support, etc (@mceloff)
|
||||
- Fix serial of FPC. (@ryan)
|
||||
- Fix `data shiftgraphzero` corrupting end of GraphBuffer (@doegox)
|
||||
- Fix `hf legic info` - unsegmented card now uses card size to calc remaining length (@iceman1001)
|
||||
- Add 36bit HID format, extend calcWiegand() to include oem bits (@davidbeauchamp)
|
||||
- Added 36bit HID format, extend calcWiegand() to include oem bits (@davidbeauchamp)
|
||||
- Fix `hf mf hardnested` - not verify key when reading nonce file (@iceman1001)
|
||||
- Change optimizations for ask/bi (@iceman1001)
|
||||
- Fix `hf mf sim` - bugs fix, refactoring (@mceloff)
|
||||
- Add WRITE and COMPATIBLE_WRITE support to Mifare Ultralight/NTAG simulation (@mceloff)
|
||||
- Added WRITE and COMPATIBLE_WRITE support to Mifare Ultralight/NTAG simulation (@mceloff)
|
||||
- Change installation instructions and add video links (@5w0rdfish)
|
||||
- Change `hf mf sim` to support more types (@vratiskol)
|
||||
- Change better strong wave detection for biphase (@iceman1001)
|
||||
- Add `script run test_t55x7` (@iceman1001)
|
||||
- Add new lua scripting support for some t55xx commands (@iceman1001)
|
||||
- Add FPC USART for BT add-on with pm3 client. (@doegox)
|
||||
- Add `-b baudrate` option to the pm3 client. (@doegox)
|
||||
- Added `script run test_t55x7` (@iceman1001)
|
||||
- Added new lua scripting support for some t55xx commands (@iceman1001)
|
||||
- Added FPC USART for BT add-on with pm3 client. (@doegox)
|
||||
- Added `-b baudrate` option to the pm3 client. (@doegox)
|
||||
- Change `lf t55xx info`: tell if known configuration block0. (@iceman1001)
|
||||
- Fix/Add FPC usart: fix TX, bring RX, full speed. (@doegox)
|
||||
- Change `lf t55xx config` options: allow to toggle on/off i/q5/st
|
||||
@@ -207,7 +250,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
||||
- Fix Indala 64 on T55xx: use PSK1. (@doegox)
|
||||
- Force proper Linefeed (LF) handling in ProxSpace. (@vratiskol)
|
||||
- Fix Makefiles race conditions to allow parallel compilation, e.g. `make -j8`. (@doegox)
|
||||
- Add - dictionary key file for MFU. (not in use at the moment) (@mazodude)
|
||||
- Added - dictionary key file for MFU. (not in use at the moment) (@mazodude)
|
||||
- Change `lf fdx demod` - better biphase maxerrors. (@MalteHillmann)
|
||||
- Change `hf mf sim` - now works better against android (@mceloff)
|
||||
- Fix `lf t55xx brute` - now works after aquiredata adaptations (@iceman1001)
|
||||
@@ -215,7 +258,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
||||
- Fix `lf t55xx recoverpwd` - now works after aquiredata adaptations (@iceman1001)
|
||||
- Fix `data detect p` - reverted bad clock detection (@iceman1001)
|
||||
- Change `data detect a` - better clock detection (@iceman1001)
|
||||
- Add `hf 14a info` - now detects some magic card Gen2 (@iceman1001)
|
||||
- Added `hf 14a info` - now detects some magic card Gen2 (@iceman1001)
|
||||
- Removed `LCD` code in armsrc compilation (@iceman1001)
|
||||
- Change - Generic fixes of codestyle (@doegox) (@iceman1001)
|
||||
- Change `lf indala demod` - refactoring (@iceman1001)
|
||||
@@ -225,7 +268,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
||||
- Fix `data rawdemod am` - last bit was missing (@doegox)
|
||||
- Fix `hf 15 dump f` - also selects tag first (@iceman1001)
|
||||
- Fix `hf iclass clone` - missing fileclose (@iceman1001)
|
||||
- Add `trace list hitag` - old hitag annotations now use the new trace (@iceman1001)
|
||||
- Added `trace list hitag` - old hitag annotations now use the new trace (@iceman1001)
|
||||
- Change `lf hitag sim` - loads bin/eml/json (@iceman1001)
|
||||
- Change `lf hitag reader 21` - saves in bin/eml/json (@iceman1001)
|
||||
- Change `lf hitag` - refactoring (@iceman1001)
|
||||
@@ -244,12 +287,12 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
||||
- Fix `mem write` - added extra check (@doegox)
|
||||
- Fix `iso15693` - bad string cpy (@doegox)
|
||||
- Fix `make style` - EOF LF support (@doegox)
|
||||
- Add `hf 14b raw` - added -t for timeout (@iceman1001)
|
||||
- Added `hf 14b raw` - added -t for timeout (@iceman1001)
|
||||
- Rename `lf hitag snoop` - renamed to `lf hitag sniff` (@iceman1001)
|
||||
- Rename `lf snoop` - renamed to `lf sniff` (@iceman1001)
|
||||
- Rename `hf snoop` - renamed to `hf sniff` (@iceman1001)
|
||||
- Fix `hf mfp wrbl` - more blocks available (@merlokk)
|
||||
- Add `make platform` - compile for non-rdv4 devices made simpler (@doegox)
|
||||
- Added `make platform` - compile for non-rdv4 devices made simpler (@doegox)
|
||||
- Change Makefiles optimizations when recompiling (@doegox)
|
||||
- Fix `data load` - loads TITEST.txt again (@iceman1001)
|
||||
- Change `lf search` - now detects TI (@iceman1001)
|
||||
@@ -257,25 +300,25 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
||||
- Fix `lf paradox demod` - wrong check (@iceman1001)
|
||||
- Change `lf t55xx` - aquiredata uses getsamples (@iceman1001)
|
||||
- Fix `lf search` - chipset detection restore demod buffer again (@iceman1001)
|
||||
- Add `make style` (@doegox)
|
||||
- Added `make style` (@doegox)
|
||||
- Fix mixed tabs vs spaces. Now only use 4 space as tab. (@doegox)
|
||||
- Fix `lf visa2000 read` - too few samples (@iceman1001)
|
||||
- Fix `lf t55xx bruteforce` - infinity loop (@doegox)
|
||||
- Fix `analyse nuid` - correct crc (@doegox)
|
||||
- Add command history not repeating logged commands (@doegox)
|
||||
- Added command history not repeating logged commands (@doegox)
|
||||
- Fix path for aidjson (@doegox)
|
||||
- Fix missing init i2x (@doegox)
|
||||
- Fix `14b select card` - (@doegox)
|
||||
- Add `hf mf ndef` - parsing of NDEF messages (@merlokk)
|
||||
- Add `hf mf mad` - parsing of Mifare Application Directory (@merlokk)
|
||||
- Added `hf mf ndef` - parsing of NDEF messages (@merlokk)
|
||||
- Added `hf mf mad` - parsing of Mifare Application Directory (@merlokk)
|
||||
- Rename `lf snoop` -> `lf sniff` (@iceman1001)
|
||||
- Rename `hf snoop` -> `hf sniff` (@iceman1001)
|
||||
- Change generally added more colors (@iceman1001)
|
||||
- Change `sc upgrade` updated firmware v3.11 (RDV40) (@sentiprox)
|
||||
- Change `data autocorrelate` - better visual representation and added extra peak detection (@iceman1001)
|
||||
- Fix `lf search` - false positive indala identification fixed (@iceman1001)
|
||||
- Add `lf keri` - basic support for Keri tags (@iceman1001)
|
||||
- Add `hf mf list` - re-added it again (@iceman1001)
|
||||
- Added `lf keri` - basic support for Keri tags (@iceman1001)
|
||||
- Added `hf mf list` - re-added it again (@iceman1001)
|
||||
- Fix - A lot of bugfixes, like memory leaks (@iceman1001)
|
||||
- Change `hf 14a antifuzz` - original implementation (@asfabw), reworked a bit
|
||||
- Fix `hf mf fchk` (@iceman1001)
|
||||
@@ -283,9 +326,9 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
||||
- Change `lf pcf7931` - improved read code (@sguerrini97)
|
||||
- Change `hf felica list` - started with some FeliCa annotations (@iceman1001)
|
||||
- Fix `hf tune` - now works as expected (@iceman1001)
|
||||
- Add `option to use flash memory to upload dictionary files` (RDV40) (@iceman1001)
|
||||
- Added `option to use flash memory to upload dictionary files` (RDV40) (@iceman1001)
|
||||
- Fix `printing percentage now standard compliant` (@fabled)
|
||||
- Add `emv roca` - command to test for ROCA vuln in public RSA modulus (@merlokk / @iceman1001)
|
||||
- Added `emv roca` - command to test for ROCA vuln in public RSA modulus (@merlokk / @iceman1001)
|
||||
- Added TCP ports support (on linux) (@phcoder)
|
||||
- Added HF sniff standalone mode with optional storing of ULC/NTAG/ULEV1 authentication attempts (@bogiton)
|
||||
- Fix `Lining up plot and control window` (@anticat)
|
||||
@@ -303,7 +346,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
||||
- Fix `stand-alone Colin` - remake to benefit from flashmem for persistence. (@cjbrigato)
|
||||
- Fix `LEGIC SIM` - remake of legic sim (@drandreas)
|
||||
- Changed `proxmark3 client threading` - remake from official repo (@micolous)
|
||||
- Add `rem` - new command that adds a line to the log file (@didierStevens)
|
||||
- Added `rem` - new command that adds a line to the log file (@didierStevens)
|
||||
- Fix `EM410xdemod empty tag id in lfops.c` (@Defensor7)
|
||||
- Fix `usb device descriptor` - some android phones will enumerate better when iSerialnumber is not a multiple of 8 (@micolous, @megabug)
|
||||
- Fix `StandaloneMode LF` - when collecting signal, justNoise detection is needed (@didierStevens, @Megabug)
|
||||
@@ -372,6 +415,8 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
||||
- Added `hf fido` `assert` and `make` commands from fido2 protocol (authenticatorMakeCredential and authenticatorGetAssertion) (@merlokk)
|
||||
- Added trailer block decoding to `hf mf rdbl` and `hf mf cgetbl` (@merlokk)
|
||||
- Added `hf mf mad` and `hf mfp mad` MAD decode, check and print commands (@merlokk)
|
||||
- Added `script run luxeodump` (@0xdrrb)
|
||||
- Fix `lf hitag reader 02` - print all bytes (@bosb)
|
||||
|
||||
|
||||
### Fixed
|
||||
@@ -613,9 +658,9 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
||||
- Implemented better detection of mifare-tags that are not vulnerable to classic attacks (`hf mf mifare`, `hf mf nested`) (@pwpiwi)
|
||||
|
||||
### Added
|
||||
- Add `hf 14b reader` to find and print general info about known 14b tags (@marshmellow42)
|
||||
- Add `hf 14b info` to find and print info about std 14b tags and sri tags (using 14b raw commands in the client) (@marshmellow42)
|
||||
- Add PACE replay functionality (@frederikmoellers)
|
||||
- Added `hf 14b reader` to find and print general info about known 14b tags (@marshmellow42)
|
||||
- Added `hf 14b info` to find and print info about std 14b tags and sri tags (using 14b raw commands in the client) (@marshmellow42)
|
||||
- Added PACE replay functionality (@frederikmoellers)
|
||||
|
||||
### Fixed
|
||||
- t55xx write timing (@marshmellow42)
|
||||
|
||||
@@ -8,6 +8,9 @@ endif
|
||||
ifeq ($(DEFSBEENHERE),)
|
||||
-include ../../Makefile.defs
|
||||
endif
|
||||
ifeq ($(DEFSBEENHERE),)
|
||||
-include ../../../Makefile.defs
|
||||
endif
|
||||
ifeq ($(DEFSBEENHERE),)
|
||||
$(error Can't find Makefile.defs)
|
||||
endif
|
||||
|
||||
@@ -1,14 +1,11 @@
|
||||
# RRG / Iceman repo - Proxmark3
|
||||
|
||||
This repo is based on iceman fork for Proxmark3.
|
||||
|
||||
It supports RDV4.0 and other Proxmark3 platforms as well.
|
||||
|
||||
|
||||
| Releases | Linux & OSX CI | Windows CI | Coverity |
|
||||
| ------------------- |:-------------------:| -------------------:| -------------------:|
|
||||
| [](https://github.com/RfidResearchGroup/proxmark3/releases/latest) | [](https://travis-ci.org/RfidResearchGroup/proxmark3) | [](https://ci.appveyor.com/project/RfidResearchGroup/proxmark3/branch/master) | [](https://scan.coverity.com/projects/proxmark3-rrg-iceman-repo)|
|
||||
---
|
||||
|
||||
|
||||
|
||||
# PROXMARK INSTALLATION AND OVERVIEW
|
||||
|
||||
@@ -24,15 +21,17 @@ It supports RDV4.0 and other Proxmark3 platforms as well.
|
||||
|[Notes on external flash](/doc/ext_flash_notes.md)||[EMV](/doc/emv_notes.md)|
|
||||
|[Notes on Termux / Android](/doc/termux_notes.md)||[Troubleshooting](/doc/md/Installation_Instructions/Troubleshooting.md)|
|
||||
|[Notes on wireshark / tracedata](/doc/trace_wireshark_notes.md)||[JTAG](/doc/jtag_notes.md)|
|
||||
|[Notes on loclass](/doc/loclass_notes.md)|||
|
||||
|[Notes on loclass](/doc/loclass_notes.md)||[Complete client command set](/doc/commands.md)|
|
||||
|[Notes on paths](/doc/path_notes.md)|||
|
||||
|[Developing standalone mode](/armsrc/Standalone/readme.md)|[Wiki about standalone mode](https://github.com/RfidResearchGroup/proxmark3/wiki/Standalone-mode) ||
|
||||
|[Donations](#Donations)|||
|
||||
|
||||
## Support on other Proxmark3 platforms
|
||||
|
||||
## Build for non-RDV4 Proxmark3 platforms
|
||||
|
||||
In order to build this repo for other Proxmark3 platforms we urge you to read [Advanced compilation parameters](/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md)
|
||||
|
||||
|
||||
## What has changed?
|
||||
|
||||
On the hardware side:
|
||||
@@ -62,17 +61,17 @@ The [public roadmap](https://github.com/RfidResearchGroup/proxmark3/wiki/Public-
|
||||
We usually merge your contributions fast since we do like the idea of getting a functionality in the Proxmark3 and weed out the bugs afterwards.
|
||||
|
||||
## Notes / helpful documents
|
||||
- Internal notes on [Coverity Scan Config & Run](/doc/md/Development/Coverity-Scan-Config-%26-Run.md).
|
||||
- Internal notes on [UART](/doc/uart_notes.md)
|
||||
- Internal notes on [Frame format](/doc/new_frame_format.md)
|
||||
- Internal notes on [external flash](/doc/ext_flash_notes.md)
|
||||
- Internal notes on [standalone mode](https://github.com/RfidResearchGroup/proxmark3/wiki/Standalone-mode)
|
||||
- Internal notes on [Termux / Android](/doc/termux_notes.md)
|
||||
- Internal notes on [Wireshark / tracedata](/doc/trace_wireshark_notes.md)
|
||||
- Internal notes on [loclass](/doc/loclass_notes.md)
|
||||
- Internal notes on [EMV](/doc/emv_notes.md)
|
||||
- Internal notes on [Paths](/doc/path_notes.md)
|
||||
|
||||
- notes on [Coverity Scan Config & Run](/doc/md/Development/Coverity-Scan-Config-%26-Run.md).
|
||||
- notes on [UART](/doc/uart_notes.md)
|
||||
- notes on [Frame format](/doc/new_frame_format.md)
|
||||
- notes on [external flash](/doc/ext_flash_notes.md)
|
||||
- notes on [standalone mode](https://github.com/RfidResearchGroup/proxmark3/wiki/Standalone-mode)
|
||||
- notes on [Termux / Android](/doc/termux_notes.md)
|
||||
- notes on [Wireshark / tracedata](/doc/trace_wireshark_notes.md)
|
||||
- notes on [loclass](/doc/loclass_notes.md)
|
||||
- notes on [EMV](/doc/emv_notes.md)
|
||||
- notes on [Paths](/doc/path_notes.md)
|
||||
- notes on [file formats used with Proxmark3](/doc/extensions_notes.md)
|
||||
## Cheat sheet
|
||||
|
||||
Thanks to Alex Dibs, you can enjoy a [command cheat sheet](/doc/cheatsheet.md)
|
||||
@@ -110,4 +109,3 @@ Nothing says thank you as much as a donation. So if you feel the love, do feel f
|
||||
|
||||
https://www.patreon.com/iceman1001
|
||||
|
||||
All support is welcome!
|
||||
|
||||
+12
-1
@@ -43,6 +43,12 @@ clone_script:
|
||||
Write-Host "[ OK ]" -ForegroundColor Green
|
||||
|
||||
|
||||
if(!(Test-Path -Path C:\ProxSpace\pm3)){
|
||||
|
||||
New-Item -ItemType Directory -Force -Path C:\ProxSpace\pm3
|
||||
|
||||
}
|
||||
|
||||
Write-Host "Removing pm3 dir..." -NoNewLine
|
||||
|
||||
Remove-Item -Recurse -Force -Path c:\ProxSpace\pm3\*
|
||||
@@ -137,11 +143,15 @@ clone_script:
|
||||
|
||||
Remove-Job -Force $Job
|
||||
}
|
||||
|
||||
cd C:\ProxSpace\
|
||||
|
||||
C:\ProxSpace\msys2\ps\setup.cmd
|
||||
|
||||
ExecUpdate "update1" "C:\ProxSpace\msys2\msys2_shell.cmd -mingw32 -defterm -no-start /dev/null" "terminate?MSYS2"
|
||||
|
||||
ExecUpdate "update2" "C:\ProxSpace\msys2\msys2_shell.cmd -mingw32 -defterm -no-start /dev/null" "terminate?MSYS2"
|
||||
|
||||
|
||||
Write-Host "Update " -NoNewLine
|
||||
|
||||
Write-Host "[ OK ]" -ForegroundColor Green
|
||||
@@ -173,6 +183,7 @@ build_script:
|
||||
|
||||
$env:MSYSTEM_CHOST="i686-w64-mingw32"
|
||||
|
||||
cd C:\ProxSpace\pm3
|
||||
|
||||
#make
|
||||
|
||||
|
||||
@@ -115,9 +115,11 @@ uint16_t BigBuf_max_traceLen(void) {
|
||||
void clear_trace(void) {
|
||||
traceLen = 0;
|
||||
}
|
||||
|
||||
void set_tracelen(uint32_t value) {
|
||||
traceLen = value;
|
||||
}
|
||||
|
||||
void set_tracing(bool enable) {
|
||||
tracing = enable;
|
||||
}
|
||||
|
||||
+1
-1
@@ -23,7 +23,7 @@ APP_CFLAGS = $(PLATFORM_DEFS) \
|
||||
-DON_DEVICE \
|
||||
-fno-strict-aliasing -ffunction-sections -fdata-sections
|
||||
|
||||
SRC_LF = lfops.c lfsampling.c pcf7931.c lfdemod.c
|
||||
SRC_LF = lfops.c lfsampling.c pcf7931.c lfdemod.c lfadc.c
|
||||
SRC_ISO15693 = iso15693.c iso15693tools.c
|
||||
SRC_ISO14443a = iso14443a.c mifareutil.c mifarecmd.c epa.c mifaresim.c
|
||||
#UNUSED: mifaresniff.c desfire_crypto.c
|
||||
|
||||
@@ -35,13 +35,18 @@ define KNOWN_STANDALONE_DEFINITIONS
|
||||
| HF_BOG | 14a sniff with ULC/ULEV1/NTAG auth |
|
||||
| (RDV4 only) | storing in flashmem - Bogito |
|
||||
+----------------------------------------------------------+
|
||||
|
||||
| HF_14ASNIFF | 14a sniff to flashmem |
|
||||
| (RDV4 only) | |
|
||||
+----------------------------------------------------------+
|
||||
| LF_ICEHID | LF HID collector to flashmem |
|
||||
| (RDV4 only) | |
|
||||
+----------------------------------------------------------+
|
||||
endef
|
||||
|
||||
STANDALONE_MODES := LF_SAMYRUN LF_ICERUN LF_PROXBRUTE LF_HIDBRUTE
|
||||
STANDALONE_MODES += HF_YOUNG HF_MATTYRUN HF_COLIN HF_BOG
|
||||
STANDALONE_MODES := LF_SAMYRUN LF_ICERUN LF_PROXBRUTE LF_HIDBRUTE LF_ICEHID
|
||||
STANDALONE_MODES += HF_YOUNG HF_MATTYRUN HF_COLIN HF_BOG HF_14ASNIFF
|
||||
STANDALONE_MODES_REQ_SMARTCARD :=
|
||||
STANDALONE_MODES_REQ_FLASH := HF_COLIN HF_BOG
|
||||
STANDALONE_MODES_REQ_FLASH := HF_COLIN HF_BOG HF_14ASNIFF LF_ICEHID
|
||||
ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES)),)
|
||||
STANDALONE_PLATFORM_DEFS += -DWITH_STANDALONE_$(STANDALONE)
|
||||
ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES_REQ_SMARTCARD)),)
|
||||
|
||||
@@ -33,4 +33,11 @@ endif
|
||||
ifneq (,$(findstring WITH_STANDALONE_HF_BOG,$(APP_CFLAGS)))
|
||||
SRC_STANDALONE = hf_bog.c
|
||||
endif
|
||||
|
||||
# WITH_STANDALONE_HF_14ASNIFF
|
||||
ifneq (,$(findstring WITH_STANDALONE_HF_14ASNIFF,$(APP_CFLAGS)))
|
||||
SRC_STANDALONE = hf_14asniff.c
|
||||
endif
|
||||
# WITH_STANDALONE_LF_ICEHID
|
||||
ifneq (,$(findstring WITH_STANDALONE_LF_ICEHID,$(APP_CFLAGS)))
|
||||
SRC_STANDALONE = lf_icehid.c
|
||||
endif
|
||||
@@ -0,0 +1,124 @@
|
||||
//-----------------------------------------------------------------------------
|
||||
// Copyright 2020 Michael Farrell <micolous+git@gmail.com>
|
||||
//
|
||||
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||
// the license.
|
||||
//-----------------------------------------------------------------------------
|
||||
// main code for standalone HF/iso14a Sniff to flash
|
||||
//-----------------------------------------------------------------------------
|
||||
|
||||
/*
|
||||
* `hf_14asniff` passively sniffs ISO14a frames, and stores them in internal
|
||||
* flash. It requires RDV4 hardware (for flash and battery).
|
||||
*
|
||||
* This module is similar to hf_bog (which only logs ULC/NTAG/ULEV1 auth).
|
||||
*
|
||||
* On entering stand-alone mode, this module will start sniffing ISO14a frames.
|
||||
* This will be stored in the normal trace buffer (ie: in RAM -- will be lost
|
||||
* at power-off).
|
||||
*
|
||||
* Short-pressing the button again will stop sniffing, and at _this_ point
|
||||
* append trace data from RAM to a file in flash (hf_14asniff.trc) and unmount.
|
||||
*
|
||||
* Once the data is saved, standalone mode will exit.
|
||||
*
|
||||
* LEDs:
|
||||
* - LED1: sniffing
|
||||
* - LED2: sniffed tag command, turns off when finished sniffing reader command
|
||||
* - LED3: sniffed reader command, turns off when finished sniffing tag command
|
||||
* - LED4: unmounting/sync'ing flash (normally < 100ms)
|
||||
*
|
||||
* To retrieve trace data from flash:
|
||||
*
|
||||
* 1. mem spiffs dump o hf_14asniff.trc f trace.trc
|
||||
* Copies trace data file from flash to your PC.
|
||||
*
|
||||
* 2. trace load trace.trc
|
||||
* Loads trace data from a file into PC-side buffers.
|
||||
*
|
||||
* 3. For ISO14a: trace list 14a 1
|
||||
* For MIFARE Classic: trace list mf 1
|
||||
*
|
||||
* Lists trace data from buffer without requesting it from PM3.
|
||||
*
|
||||
* This module emits debug strings during normal operation -- so try it out in
|
||||
* the lab connected to PM3 client before taking it into the field.
|
||||
*
|
||||
* To delete the trace data from flash:
|
||||
*
|
||||
* Caveats / notes:
|
||||
* - Trace buffer will be cleared on starting stand-alone mode. Data in flash
|
||||
* will remain unless explicitly deleted.
|
||||
* - This module will terminate if the trace buffer is full (and save data to
|
||||
* flash).
|
||||
* - Like normal sniffing mode, timestamps overflow after 5 min 16 sec.
|
||||
* However, the trace buffer is sequential, so will be in the correct order.
|
||||
*/
|
||||
|
||||
#include "standalone.h" // standalone definitions
|
||||
#include "proxmark3_arm.h"
|
||||
#include "iso14443a.h"
|
||||
#include "util.h"
|
||||
#include "spiffs.h"
|
||||
#include "appmain.h"
|
||||
#include "dbprint.h"
|
||||
#include "ticks.h"
|
||||
#include "BigBuf.h"
|
||||
|
||||
#define HF_14ASNIFF_LOGFILE "hf_14asniff.trc"
|
||||
|
||||
void DownloadTraceInstructions() {
|
||||
Dbprintf("");
|
||||
Dbprintf("To get the trace from flash and display it:");
|
||||
Dbprintf("1. mem spiffs dump o "HF_14ASNIFF_LOGFILE" f trace.trc");
|
||||
Dbprintf("2. trace load trace.trc");
|
||||
Dbprintf("3. trace list 14a 1");
|
||||
}
|
||||
|
||||
void ModInfo(void) {
|
||||
DbpString("hf_14asniff: standalone 'hf 14a sniff', storing in flashmem");
|
||||
DownloadTraceInstructions();
|
||||
}
|
||||
|
||||
void RunMod() {
|
||||
StandAloneMode();
|
||||
|
||||
Dbprintf("Starting standalone mode: hf_14asniff");
|
||||
rdv40_spiffs_lazy_mount();
|
||||
|
||||
SniffIso14443a(0);
|
||||
|
||||
Dbprintf("Stopped sniffing");
|
||||
SpinDelay(200);
|
||||
|
||||
// Write stuff to spiffs logfile
|
||||
uint32_t trace_len = BigBuf_get_traceLen();
|
||||
if (trace_len > 0) {
|
||||
Dbprintf("[!] Trace length (bytes) = %u", trace_len);
|
||||
|
||||
uint8_t* trace_buffer = BigBuf_get_addr();
|
||||
if (!exists_in_spiffs(HF_14ASNIFF_LOGFILE)) {
|
||||
rdv40_spiffs_write(
|
||||
HF_14ASNIFF_LOGFILE, trace_buffer, trace_len, RDV40_SPIFFS_SAFETY_SAFE);
|
||||
Dbprintf("[!] Wrote trace to "HF_14ASNIFF_LOGFILE);
|
||||
} else {
|
||||
rdv40_spiffs_append(
|
||||
HF_14ASNIFF_LOGFILE, trace_buffer, trace_len, RDV40_SPIFFS_SAFETY_SAFE);
|
||||
Dbprintf("[!] Appended trace to "HF_14ASNIFF_LOGFILE);
|
||||
}
|
||||
} else {
|
||||
Dbprintf("[!] Trace buffer is empty, nothing to write!");
|
||||
}
|
||||
|
||||
LED_D_ON();
|
||||
rdv40_spiffs_lazy_unmount();
|
||||
LED_D_OFF();
|
||||
|
||||
SpinErr(LED_A, 200, 5);
|
||||
SpinDelay(100);
|
||||
|
||||
LEDsoff();
|
||||
SpinDelay(300);
|
||||
DownloadTraceInstructions();
|
||||
}
|
||||
@@ -1059,7 +1059,7 @@ int saMifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *data
|
||||
};
|
||||
}
|
||||
|
||||
if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) ||
|
||||
if ((mifare_sendcmd_short(NULL, CRYPT_NONE, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) ||
|
||||
(receivedAnswer[0] != 0x0a)) {
|
||||
DbprintfEx(FLAG_NEWLINE, "write block send command error");
|
||||
break;
|
||||
|
||||
@@ -136,7 +136,7 @@ static int saMifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_
|
||||
};
|
||||
}
|
||||
|
||||
if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
|
||||
if ((mifare_sendcmd_short(NULL, CRYPT_NONE, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
|
||||
DbprintfEx(FLAG_NEWLINE, "write block send command error");
|
||||
break;
|
||||
};
|
||||
|
||||
@@ -0,0 +1,389 @@
|
||||
//-----------------------------------------------------------------------------
|
||||
// Christian Herrmann, 2020
|
||||
//
|
||||
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||
// the license.
|
||||
//-----------------------------------------------------------------------------
|
||||
// main code for HID collector aka IceHID by Iceman
|
||||
//-----------------------------------------------------------------------------
|
||||
#include "standalone.h" // standalone definitions
|
||||
#include "proxmark3_arm.h"
|
||||
#include "appmain.h"
|
||||
#include "lfops.h"
|
||||
#include "lfsampling.h"
|
||||
#include "BigBuf.h"
|
||||
#include "fpgaloader.h"
|
||||
#include "util.h"
|
||||
#include "dbprint.h"
|
||||
#include "printf.h"
|
||||
#include "spiffs.h"
|
||||
#include "ticks.h"
|
||||
#include "lfdemod.h"
|
||||
/*
|
||||
* `lf_hidcollect` sniffs after LF HID credentials, and stores them in internal
|
||||
* flash. It requires RDV4 hardware (for flash and battery).
|
||||
*
|
||||
* On entering stand-alone mode, this module will start reading/record HID credentials.
|
||||
* Every found / collected credential will be written/appended to the logfile in flash
|
||||
* as a text string.
|
||||
*
|
||||
* LEDs:
|
||||
* - LED A: reading / record
|
||||
* - LED B: writing to flash
|
||||
* - LED C: unmounting/sync'ing flash (normally < 100ms)
|
||||
*
|
||||
* To retrieve log file from flash:
|
||||
*
|
||||
* 1. mem spiffs dump o lf_hidcollect.log f lf_hidcollect.log
|
||||
* Copies log file from flash to your PC.
|
||||
*
|
||||
* 2. exit the Proxmark3 client
|
||||
*
|
||||
* 3. more lf_hidcollect.log
|
||||
*
|
||||
* This module emits debug strings during normal operation -- so try it out in
|
||||
* the lab connected to PM3 client before taking it into the field.
|
||||
*
|
||||
* To delete the log file from flash:
|
||||
*
|
||||
* 1. mem spiffs remove lf_hidcollect.log
|
||||
*/
|
||||
|
||||
#define LF_HIDCOLLECT_LOGFILE "lf_hidcollect.log"
|
||||
|
||||
|
||||
void DownloadLogInstructions() {
|
||||
Dbprintf("");
|
||||
Dbprintf("[=] To get the logfile from flash and display it:");
|
||||
Dbprintf("[=] " _YELLOW_("1.") "mem spiffs dump o "LF_HIDCOLLECT_LOGFILE" f "LF_HIDCOLLECT_LOGFILE);
|
||||
Dbprintf("[=] " _YELLOW_("2.") "exit proxmark3 client");
|
||||
Dbprintf("[=] " _YELLOW_("3.") "cat "LF_HIDCOLLECT_LOGFILE);
|
||||
}
|
||||
|
||||
bool log_exists;
|
||||
|
||||
void append(uint8_t* entry, size_t entry_len) {
|
||||
|
||||
LED_B_ON();
|
||||
if (log_exists == false) {
|
||||
rdv40_spiffs_write(LF_HIDCOLLECT_LOGFILE, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
|
||||
log_exists = true;
|
||||
} else {
|
||||
rdv40_spiffs_append(LF_HIDCOLLECT_LOGFILE, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
|
||||
}
|
||||
LED_B_OFF();
|
||||
}
|
||||
|
||||
uint32_t IceEM410xdemod() {
|
||||
|
||||
uint8_t *dest = BigBuf_get_addr();
|
||||
size_t idx = 0;
|
||||
int clk = 0, invert = 0, maxErr = 20;
|
||||
uint32_t hi = 0;
|
||||
uint64_t lo = 0;
|
||||
|
||||
size_t size = MIN(16385, BigBuf_max_traceLen());
|
||||
|
||||
//askdemod and manchester decode
|
||||
int errCnt = askdemod(dest, &size, &clk, &invert, maxErr, 0, 1);
|
||||
|
||||
WDT_HIT();
|
||||
|
||||
if (errCnt > 50) {
|
||||
BigBuf_free();
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
errCnt = Em410xDecode(dest, &size, &idx, &hi, &lo);
|
||||
if (errCnt != 1) {
|
||||
BigBuf_free();
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
uint8_t entry[81];
|
||||
memset(entry, 0, sizeof(entry));
|
||||
|
||||
if (size == 128) {
|
||||
sprintf((char *)entry, "EM XL TAG ID: %06lx%08lx%08lx - (%05ld_%03ld_%08ld)\n",
|
||||
hi,
|
||||
(uint32_t)(lo >> 32),
|
||||
(uint32_t)lo,
|
||||
(uint32_t)(lo & 0xFFFF),
|
||||
(uint32_t)((lo >> 16LL) & 0xFF),
|
||||
(uint32_t)(lo & 0xFFFFFF));
|
||||
} else {
|
||||
sprintf((char *)entry, "EM TAG ID: %02lx%08lx - (%05ld_%03ld_%08ld)\n",
|
||||
(uint32_t)(lo >> 32),
|
||||
(uint32_t)lo,
|
||||
(uint32_t)(lo & 0xFFFF),
|
||||
(uint32_t)((lo >> 16LL) & 0xFF),
|
||||
(uint32_t)(lo & 0xFFFFFF));
|
||||
}
|
||||
|
||||
append(entry, strlen((char*)entry));
|
||||
Dbprintf("%s", entry);
|
||||
BigBuf_free();
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
uint32_t IceAWIDdemod() {
|
||||
|
||||
uint8_t *dest = BigBuf_get_addr();
|
||||
size_t size = MIN(12800, BigBuf_max_traceLen());
|
||||
int dummyIdx = 0;
|
||||
|
||||
//askdemod and manchester decode
|
||||
int idx = detectAWID(dest, &size, &dummyIdx);
|
||||
|
||||
if (idx <= 0 || size != 96) {
|
||||
BigBuf_free();
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
//get raw ID before removing parities
|
||||
uint32_t rawLo = bytebits_to_byte(dest + idx + 64, 32);
|
||||
uint32_t rawHi = bytebits_to_byte(dest + idx + 32, 32);
|
||||
uint32_t rawHi2 = bytebits_to_byte(dest + idx, 32);
|
||||
|
||||
size = removeParity(dest, idx + 8, 4, 1, 88);
|
||||
if (size != 66) {
|
||||
BigBuf_free();
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
uint8_t entry[110];
|
||||
memset(entry, 0, sizeof(entry));
|
||||
|
||||
uint8_t fmtLen = bytebits_to_byte(dest, 8);
|
||||
if (fmtLen == 26) {
|
||||
uint8_t fac = bytebits_to_byte(dest + 9, 8);
|
||||
uint32_t cardnum = bytebits_to_byte(dest + 17, 16);
|
||||
uint32_t code1 = bytebits_to_byte(dest + 8, fmtLen);
|
||||
sprintf((char *)entry, "AWID bit len: %d, FC: %d, Card: %ld - Wiegand: %lx, Raw: %08lx%08lx%08lx\n", fmtLen, fac, cardnum, code1, rawHi2, rawHi, rawLo);
|
||||
} else {
|
||||
uint32_t cardnum = bytebits_to_byte(dest + 8 + (fmtLen - 17), 16);
|
||||
if (fmtLen > 32) {
|
||||
uint32_t code1 = bytebits_to_byte(dest + 8, fmtLen - 32);
|
||||
uint32_t code2 = bytebits_to_byte(dest + 8 + (fmtLen - 32), 32);
|
||||
sprintf((char *)entry, "AWID bit len: %d -unk bit len - Card: %ld - Wiegand: %lx%08lx, Raw: %08lx%08lx%08lx\n", fmtLen, cardnum, code1, code2, rawHi2, rawHi, rawLo);
|
||||
} else {
|
||||
uint32_t code1 = bytebits_to_byte(dest + 8, fmtLen);
|
||||
sprintf((char *)entry, "AWID bit len: %d -unk bit len - Card: %ld - Wiegand: %lx, Raw: %08lx%08lx%08lx\n", fmtLen, cardnum, code1, rawHi2, rawHi, rawLo);
|
||||
}
|
||||
}
|
||||
|
||||
append(entry, strlen((char*)entry));
|
||||
Dbprintf("%s", entry);
|
||||
BigBuf_free();
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
uint32_t IceIOdemod() {
|
||||
|
||||
int dummyIdx = 0;
|
||||
uint8_t version = 0, facilitycode = 0;
|
||||
uint16_t number = 0;
|
||||
uint32_t hi = 0, lo = 0;
|
||||
|
||||
size_t size = MIN(12000, BigBuf_max_traceLen());
|
||||
|
||||
// uint8_t *dest = BigBuf_malloc(size);
|
||||
uint8_t *dest = BigBuf_get_addr();
|
||||
|
||||
//fskdemod and get start index
|
||||
int idx = detectIOProx(dest, &size, &dummyIdx);
|
||||
|
||||
if (idx < 0) {
|
||||
BigBuf_free();
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
hi = bytebits_to_byte(dest + idx, 32);
|
||||
lo = bytebits_to_byte(dest + idx + 32, 32);
|
||||
|
||||
version = bytebits_to_byte(dest + idx + 27, 8); //14,4
|
||||
facilitycode = bytebits_to_byte(dest + idx + 18, 8);
|
||||
number = (bytebits_to_byte(dest + idx + 36, 8) << 8) | (bytebits_to_byte(dest + idx + 45, 8)); //36,9
|
||||
|
||||
uint8_t entry[64];
|
||||
memset(entry, 0, sizeof(entry));
|
||||
|
||||
sprintf((char *)entry, "IO Prox XSF(%02d)%02x:%05d (%08lx%08lx)\n"
|
||||
, version
|
||||
, facilitycode
|
||||
, number
|
||||
, hi
|
||||
, lo
|
||||
);
|
||||
|
||||
append(entry, strlen((char*)entry));
|
||||
Dbprintf("%s", entry);
|
||||
BigBuf_free();
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
uint32_t IceHIDDemod() {
|
||||
|
||||
int dummyIdx = 0;
|
||||
|
||||
uint32_t hi2 = 0, hi = 0, lo = 0;
|
||||
|
||||
// large enough to catch 2 sequences of largest format
|
||||
size_t size = 50 * 128 * 2; // 12800 bytes
|
||||
//uint8_t *dest = BigBuf_malloc(size);
|
||||
uint8_t *dest = BigBuf_get_addr();
|
||||
|
||||
// FSK demodulator
|
||||
int idx = HIDdemodFSK(dest, &size, &hi2, &hi, &lo, &dummyIdx);
|
||||
if (idx < 0) {
|
||||
BigBuf_free();
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
if ((size == 96 || size == 192)) {
|
||||
|
||||
uint8_t entry[80];
|
||||
memset(entry, 0, sizeof(entry));
|
||||
|
||||
// go over previously decoded manchester data and decode into usable tag ID
|
||||
if (hi2 != 0) { //extra large HID tags 88/192 bits
|
||||
|
||||
sprintf((char *)entry, "HID large: %lx%08lx%08lx (%ld)\n",
|
||||
hi2,
|
||||
hi,
|
||||
lo,
|
||||
(lo >> 1) & 0xFFFF
|
||||
);
|
||||
|
||||
append(entry, strlen((char*)entry));
|
||||
|
||||
} else { //standard HID tags 44/96 bits
|
||||
uint8_t bitlen = 0;
|
||||
uint32_t fac = 0;
|
||||
uint32_t cardnum = 0;
|
||||
|
||||
if (((hi >> 5) & 1) == 1) { //if bit 38 is set then < 37 bit format is used
|
||||
uint32_t lo2 = 0;
|
||||
lo2 = (((hi & 31) << 12) | (lo >> 20)); //get bits 21-37 to check for format len bit
|
||||
uint8_t idx3 = 1;
|
||||
while (lo2 > 1) { //find last bit set to 1 (format len bit)
|
||||
lo2 >>= 1;
|
||||
idx3++;
|
||||
}
|
||||
bitlen = idx3 + 19;
|
||||
fac = 0;
|
||||
cardnum = 0;
|
||||
if (bitlen == 26) {
|
||||
cardnum = (lo >> 1) & 0xFFFF;
|
||||
fac = (lo >> 17) & 0xFF;
|
||||
}
|
||||
if (bitlen == 37) {
|
||||
cardnum = (lo >> 1) & 0x7FFFF;
|
||||
fac = ((hi & 0xF) << 12) | (lo >> 20);
|
||||
}
|
||||
if (bitlen == 34) {
|
||||
cardnum = (lo >> 1) & 0xFFFF;
|
||||
fac = ((hi & 1) << 15) | (lo >> 17);
|
||||
}
|
||||
if (bitlen == 35) {
|
||||
cardnum = (lo >> 1) & 0xFFFFF;
|
||||
fac = ((hi & 1) << 11) | (lo >> 21);
|
||||
}
|
||||
} else { //if bit 38 is not set then 37 bit format is used
|
||||
bitlen = 37;
|
||||
cardnum = (lo >> 1) & 0x7FFFF;
|
||||
fac = ((hi & 0xF) << 12) | (lo >> 20);
|
||||
}
|
||||
|
||||
sprintf((char *)entry, "HID: %lx%08lx (%ld) Format: %d bit FC: %ld Card: %ld\n",
|
||||
hi,
|
||||
lo,
|
||||
(lo >> 1) & 0xFFFF,
|
||||
bitlen,
|
||||
fac,
|
||||
cardnum
|
||||
);
|
||||
|
||||
append(entry, strlen((char*)entry));
|
||||
}
|
||||
|
||||
Dbprintf("%s", entry);
|
||||
}
|
||||
|
||||
BigBuf_free();
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
void ModInfo(void) {
|
||||
DbpString(_YELLOW_(" LF HID / IOprox / AWID / EM4100 collector mode") " - a.k.a IceHID (Iceman)");
|
||||
}
|
||||
|
||||
void RunMod() {
|
||||
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
|
||||
LFSetupFPGAForADC(LF_DIVISOR_125, true);
|
||||
BigBuf_Clear();
|
||||
|
||||
StandAloneMode();
|
||||
|
||||
Dbprintf(_YELLOW_("[=] Standalone mode IceHID started"));
|
||||
|
||||
rdv40_spiffs_lazy_mount();
|
||||
|
||||
log_exists = exists_in_spiffs(LF_HIDCOLLECT_LOGFILE);
|
||||
|
||||
// the main loop for your standalone mode
|
||||
for (;;) {
|
||||
WDT_HIT();
|
||||
|
||||
// exit from IceHID, send a usbcommand.
|
||||
if (data_available()) break;
|
||||
|
||||
// Was our button held down or pressed?
|
||||
int button_pressed = BUTTON_HELD(280);
|
||||
if (button_pressed == BUTTON_HOLD)
|
||||
break;
|
||||
|
||||
LED_A_ON();
|
||||
|
||||
uint32_t res;
|
||||
|
||||
// since we steal 12800 from bigbuffer, no need to sample it.
|
||||
DoAcquisition_config(false, 28000);
|
||||
res = IceHIDDemod();
|
||||
if (res == PM3_SUCCESS) {
|
||||
LED_A_OFF();
|
||||
continue;
|
||||
}
|
||||
|
||||
DoAcquisition_config(false, 28000);
|
||||
res = IceAWIDdemod();
|
||||
if (res == PM3_SUCCESS) {
|
||||
LED_A_OFF();
|
||||
continue;
|
||||
}
|
||||
|
||||
DoAcquisition_config(false, 20000);
|
||||
res = IceEM410xdemod();
|
||||
if (res == PM3_SUCCESS) {
|
||||
LED_A_OFF();
|
||||
continue;
|
||||
}
|
||||
|
||||
DoAcquisition_config(false, 28000);
|
||||
res = IceIOdemod();
|
||||
if (res == PM3_SUCCESS) {
|
||||
LED_A_OFF();
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
LED_C_ON();
|
||||
rdv40_spiffs_lazy_unmount();
|
||||
LED_C_OFF();
|
||||
|
||||
LEDsoff();
|
||||
DownloadLogInstructions();
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
}
|
||||
+83
-39
@@ -17,6 +17,7 @@
|
||||
#include "dbprint.h"
|
||||
#include "pmflash.h"
|
||||
#include "fpga.h"
|
||||
#include "fpga.h"
|
||||
#include "fpgaloader.h"
|
||||
#include "string.h"
|
||||
#include "legicrf.h"
|
||||
@@ -175,7 +176,7 @@ void MeasureAntennaTuning(void) {
|
||||
*/
|
||||
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_ADC_READER_FIELD);
|
||||
SpinDelay(50);
|
||||
|
||||
for (uint8_t i = 255; i >= 19; i--) {
|
||||
@@ -207,12 +208,11 @@ void MeasureAntennaTuning(void) {
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
|
||||
SpinDelay(50);
|
||||
|
||||
#if defined RDV4
|
||||
payload.v_hf = (MAX_ADC_HF_VOLTAGE_RDV40 * AvgAdc(ADC_CHAN_HF_RDV40)) >> 10;
|
||||
#else
|
||||
payload.v_hf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
|
||||
|
||||
// RDV40 will hit the roof, try other ADC channel used in that hardware revision.
|
||||
if (payload.v_hf > MAX_ADC_HF_VOLTAGE - 300) {
|
||||
payload.v_hf = (MAX_ADC_HF_VOLTAGE_RDV40 * AvgAdc(ADC_CHAN_HF_RDV40)) >> 10;
|
||||
}
|
||||
#endif
|
||||
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
reply_ng(CMD_MEASURE_ANTENNA_TUNING, PM3_SUCCESS, (uint8_t *)&payload, sizeof(payload));
|
||||
@@ -221,16 +221,13 @@ void MeasureAntennaTuning(void) {
|
||||
|
||||
// Measure HF in milliVolt
|
||||
uint16_t MeasureAntennaTuningHfData(void) {
|
||||
uint16_t volt = 0;
|
||||
uint16_t avg = AvgAdc(ADC_CHAN_HF);
|
||||
volt = (MAX_ADC_HF_VOLTAGE * avg) >> 10;
|
||||
bool use_high = (volt > MAX_ADC_HF_VOLTAGE - 300);
|
||||
|
||||
if (use_high) {
|
||||
volt = (MAX_ADC_HF_VOLTAGE_RDV40 * AvgAdc(ADC_CHAN_HF_RDV40)) >> 10;
|
||||
// volt = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
|
||||
}
|
||||
return volt;
|
||||
#if defined RDV4
|
||||
return (MAX_ADC_HF_VOLTAGE_RDV40 * AvgAdc(ADC_CHAN_HF_RDV40)) >> 10;
|
||||
#else
|
||||
return (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
|
||||
#endif
|
||||
|
||||
}
|
||||
|
||||
// Measure LF in milliVolt
|
||||
@@ -440,6 +437,11 @@ void SendCapabilities(void) {
|
||||
#else
|
||||
capabilities.compiled_with_hfsniff = false;
|
||||
#endif
|
||||
#ifdef WITH_HFPLOT
|
||||
capabilities.compiled_with_hfplot = true;
|
||||
#else
|
||||
capabilities.compiled_with_hfplot = false;
|
||||
#endif
|
||||
#ifdef WITH_ISO14443a
|
||||
capabilities.compiled_with_iso14443a = true;
|
||||
#else
|
||||
@@ -526,7 +528,6 @@ void ListenReaderField(uint8_t limit) {
|
||||
uint16_t lf_av = 0, lf_av_new, lf_baseline = 0, lf_max = 0;
|
||||
uint16_t hf_av = 0, hf_av_new, hf_baseline = 0, hf_max = 0;
|
||||
uint16_t mode = 1, display_val, display_max;
|
||||
bool use_high = false;
|
||||
|
||||
// switch off FPGA - we don't want to measure our own signal
|
||||
// 20180315 - iceman, why load this before and then turn off?
|
||||
@@ -543,15 +544,12 @@ void ListenReaderField(uint8_t limit) {
|
||||
|
||||
if (limit == HF_ONLY) {
|
||||
|
||||
hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
|
||||
|
||||
#if defined RDV4
|
||||
// iceman, useless, since we are measuring readerfield, not our field. My tests shows a max of 20v from a reader.
|
||||
// RDV40 will hit the roof, try other ADC channel used in that hardware revision.
|
||||
use_high = (((MAX_ADC_HF_VOLTAGE * hf_max) >> 10) > MAX_ADC_HF_VOLTAGE - 300);
|
||||
if (use_high) {
|
||||
hf_av = hf_max = AvgAdc(ADC_CHAN_HF_RDV40);
|
||||
}
|
||||
|
||||
hf_av = hf_max = AvgAdc(ADC_CHAN_HF_RDV40);
|
||||
#else
|
||||
hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
|
||||
#endif
|
||||
Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
|
||||
hf_baseline = hf_av;
|
||||
}
|
||||
@@ -602,8 +600,11 @@ void ListenReaderField(uint8_t limit) {
|
||||
LED_B_OFF();
|
||||
}
|
||||
|
||||
hf_av_new = (use_high) ? AvgAdc(ADC_CHAN_HF_RDV40) : AvgAdc(ADC_CHAN_HF);
|
||||
|
||||
#if defined RDV4
|
||||
hf_av_new = AvgAdc(ADC_CHAN_HF_RDV40);
|
||||
#else
|
||||
hf_av_new = AvgAdc(ADC_CHAN_HF);
|
||||
#endif
|
||||
// see if there's a significant change
|
||||
if (ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
|
||||
Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
|
||||
@@ -696,6 +697,8 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
*/
|
||||
|
||||
switch (packet->cmd) {
|
||||
case CMD_BREAK_LOOP:
|
||||
break;
|
||||
case CMD_QUIT_SESSION: {
|
||||
reply_via_fpc = false;
|
||||
reply_via_usb = false;
|
||||
@@ -728,11 +731,11 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
}
|
||||
case CMD_LF_ACQ_RAW_ADC: {
|
||||
struct p {
|
||||
uint8_t silent;
|
||||
uint8_t verbose;
|
||||
uint32_t samples;
|
||||
} PACKED;
|
||||
struct p *payload = (struct p *)packet->data.asBytes;
|
||||
uint32_t bits = SampleLF(payload->silent, payload->samples);
|
||||
uint32_t bits = SampleLF(payload->verbose, payload->samples);
|
||||
reply_ng(CMD_LF_ACQ_RAW_ADC, PM3_SUCCESS, (uint8_t *)&bits, sizeof(bits));
|
||||
break;
|
||||
}
|
||||
@@ -773,7 +776,12 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
}
|
||||
case CMD_LF_PSK_SIMULATE: {
|
||||
lf_psksim_t *payload = (lf_psksim_t *)packet->data.asBytes;
|
||||
CmdPSKsimTag(payload->carrier, payload->invert, payload->clock, packet->length - sizeof(lf_psksim_t), payload->data, true);
|
||||
CmdPSKsimTAG(payload->carrier, payload->invert, payload->clock, packet->length - sizeof(lf_psksim_t), payload->data, true);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_NRZ_SIMULATE: {
|
||||
lf_nrzsim_t *payload = (lf_nrzsim_t *)packet->data.asBytes;
|
||||
CmdNRZsimTAG(payload->invert, payload->separator, payload->clock, packet->length - sizeof(lf_nrzsim_t), payload->data, true);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_HID_CLONE: {
|
||||
@@ -917,11 +925,12 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
|
||||
#ifdef WITH_HITAG
|
||||
case CMD_LF_HITAG_SNIFF: { // Eavesdrop Hitag tag, args = type
|
||||
SniffHitag();
|
||||
SniffHitag2();
|
||||
// SniffHitag2(packet->oldarg[0]);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_HITAG_SIMULATE: { // Simulate Hitag tag, args = memory content
|
||||
SimulateHitagTag((bool)packet->oldarg[0], packet->data.asBytes);
|
||||
SimulateHitag2((bool)packet->oldarg[0], packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_HITAG_READER: { // Reader for Hitag tags, args = type and function
|
||||
@@ -1142,6 +1151,18 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
MifareNested(payload->block, payload->keytype, payload->target_block, payload->target_keytype, payload->calibrate, payload->key);
|
||||
break;
|
||||
}
|
||||
case CMD_HF_MIFARE_STATIC_NESTED: {
|
||||
struct p {
|
||||
uint8_t block;
|
||||
uint8_t keytype;
|
||||
uint8_t target_block;
|
||||
uint8_t target_keytype;
|
||||
uint8_t key[6];
|
||||
} PACKED;
|
||||
struct p *payload = (struct p *) packet->data.asBytes;
|
||||
MifareStaticNested(payload->block, payload->keytype, payload->target_block, payload->target_keytype, payload->key);
|
||||
break;
|
||||
}
|
||||
case CMD_HF_MIFARE_CHKKEYS: {
|
||||
MifareChkKeys(packet->data.asBytes);
|
||||
break;
|
||||
@@ -1150,6 +1171,14 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
MifareChkKeys_fast(packet->oldarg[0], packet->oldarg[1], packet->oldarg[2], packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
case CMD_HF_MIFARE_CHKKEYS_FILE: {
|
||||
struct p {
|
||||
uint8_t filename[32];
|
||||
} PACKED;
|
||||
struct p *payload = (struct p *) packet->data.asBytes;
|
||||
MifareChkKeys_file(payload->filename);
|
||||
break;
|
||||
}
|
||||
case CMD_HF_MIFARE_SIMULATE: {
|
||||
struct p {
|
||||
uint16_t flags;
|
||||
@@ -1249,6 +1278,10 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
MifareU_Otp_Tearoff();
|
||||
break;
|
||||
}
|
||||
case CMD_HF_MIFARE_STATIC_NONCE: {
|
||||
MifareHasStaticNonce();
|
||||
break;
|
||||
}
|
||||
#endif
|
||||
|
||||
#ifdef WITH_NFCBARCODE
|
||||
@@ -1347,6 +1380,13 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
}
|
||||
#endif
|
||||
|
||||
#ifdef WITH_HFPLOT
|
||||
case CMD_FPGAMEM_DOWNLOAD: {
|
||||
HfPlotDownload();
|
||||
break;
|
||||
}
|
||||
#endif
|
||||
|
||||
#ifdef WITH_SMARTCARD
|
||||
case CMD_SMART_ATR: {
|
||||
SmartCardAtr();
|
||||
@@ -1512,7 +1552,7 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
case 1: // MEASURE_ANTENNA_TUNING_LF_START
|
||||
// Let the FPGA drive the low-frequency antenna around 125kHz
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_ADC_READER_FIELD);
|
||||
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, packet->data.asBytes[1]);
|
||||
reply_ng(CMD_MEASURE_ANTENNA_TUNING_LF, PM3_SUCCESS, NULL, 0);
|
||||
break;
|
||||
@@ -1592,6 +1632,8 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
BigBuf_Clear_ext(false);
|
||||
BigBuf_free();
|
||||
}
|
||||
|
||||
// 40 000 - (512-3) 509 = 39491
|
||||
uint16_t offset = MIN(BIGBUF_SIZE - PM3_CMD_DATA_SIZE - 3, payload->offset);
|
||||
|
||||
// need to copy len bytes of data, not PM3_CMD_DATA_SIZE - 3 - offset
|
||||
@@ -1599,6 +1641,8 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
uint16_t len = MIN(BIGBUF_SIZE - offset, PM3_CMD_DATA_SIZE - 3);
|
||||
|
||||
uint8_t *mem = BigBuf_get_addr();
|
||||
|
||||
// x + 394
|
||||
memcpy(mem + offset, &payload->data, len);
|
||||
// memcpy(mem + offset, &payload->data, PM3_CMD_DATA_SIZE - 3 - offset);
|
||||
reply_ng(CMD_LF_UPLOAD_SIM_SAMPLES, PM3_SUCCESS, NULL, 0);
|
||||
@@ -1622,7 +1666,7 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
Dbprintf("transfer to client failed :: | bytes between %d - %d (%d) | result: %d", i, i + len, len, result);
|
||||
}
|
||||
// Trigger a finish downloading signal with an ACK frame
|
||||
reply_old(CMD_ACK, 1, 0, 0, 0, 0);
|
||||
reply_mix(CMD_ACK, 1, 0, 0, 0, 0);
|
||||
LED_B_OFF();
|
||||
break;
|
||||
}
|
||||
@@ -1683,7 +1727,7 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
Dbprintf("transfer to client failed :: | bytes between %d - %d (%d) | result: %d", i, i + len, len, result);
|
||||
}
|
||||
// Trigger a finish downloading signal with an ACK frame
|
||||
reply_old(CMD_ACK, 1, 0, 0, 0, 0);
|
||||
reply_mix(CMD_ACK, 1, 0, 0, 0, 0);
|
||||
LED_B_OFF();
|
||||
break;
|
||||
}
|
||||
@@ -1765,7 +1809,7 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
} else {
|
||||
rdv40_spiffs_append((char *) filename, (uint8_t *)data, size, RDV40_SPIFFS_SAFETY_SAFE);
|
||||
}
|
||||
reply_old(CMD_ACK, 1, 0, 0, 0, 0);
|
||||
reply_mix(CMD_ACK, 1, 0, 0, 0, 0);
|
||||
LED_B_OFF();
|
||||
break;
|
||||
}
|
||||
@@ -1807,7 +1851,7 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
res = Flash_Write(startidx, data, len);
|
||||
isok = (res == len) ? 1 : 0;
|
||||
|
||||
reply_old(CMD_ACK, isok, 0, 0, 0, 0);
|
||||
reply_mix(CMD_ACK, isok, 0, 0, 0, 0);
|
||||
LED_B_OFF();
|
||||
break;
|
||||
}
|
||||
@@ -1818,14 +1862,14 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
bool isok = false;
|
||||
if (initalwipe) {
|
||||
isok = Flash_WipeMemory();
|
||||
reply_old(CMD_ACK, isok, 0, 0, 0, 0);
|
||||
reply_mix(CMD_ACK, isok, 0, 0, 0, 0);
|
||||
LED_B_OFF();
|
||||
break;
|
||||
}
|
||||
if (page < 3)
|
||||
isok = Flash_WipeMemoryPage(page);
|
||||
|
||||
reply_old(CMD_ACK, isok, 0, 0, 0, 0);
|
||||
reply_mix(CMD_ACK, isok, 0, 0, 0, 0);
|
||||
LED_B_OFF();
|
||||
break;
|
||||
}
|
||||
@@ -1856,7 +1900,7 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||
}
|
||||
FlashStop();
|
||||
|
||||
reply_old(CMD_ACK, 1, 0, 0, 0, 0);
|
||||
reply_mix(CMD_ACK, 1, 0, 0, 0, 0);
|
||||
BigBuf_free();
|
||||
LED_B_OFF();
|
||||
break;
|
||||
|
||||
+3
-3
@@ -43,10 +43,10 @@ bool reply_via_fpc = false;
|
||||
bool reply_via_usb = false;
|
||||
|
||||
int reply_old(uint64_t cmd, uint64_t arg0, uint64_t arg1, uint64_t arg2, void *data, size_t len) {
|
||||
PacketResponseOLD txcmd;
|
||||
PacketResponseOLD txcmd = {CMD_UNKNOWN, {0, 0, 0}, {{0}}};
|
||||
|
||||
for (size_t i = 0; i < sizeof(PacketResponseOLD); i++)
|
||||
((uint8_t *)&txcmd)[i] = 0x00;
|
||||
// for (size_t i = 0; i < sizeof(PacketResponseOLD); i++)
|
||||
// ((uint8_t *)&txcmd)[i] = 0x00;
|
||||
|
||||
// Compose the outgoing command frame
|
||||
txcmd.cmd = cmd;
|
||||
|
||||
+1
-1
@@ -272,7 +272,7 @@ uint8_t substitute(uint8_t a, uint8_t *sbp) {
|
||||
uint32_t des_f(uint32_t r, uint8_t *kr) {
|
||||
uint8_t i;
|
||||
uint32_t t = 0, ret;
|
||||
uint64_t data;
|
||||
uint64_t data = 0;
|
||||
uint8_t *sbp; /* sboxpointer */
|
||||
permute((uint8_t *)e_permtab, (uint8_t *)&r, (uint8_t *)&data);
|
||||
for (i = 0; i < 6; ++i)
|
||||
|
||||
+15
-16
@@ -26,9 +26,7 @@
|
||||
#ifndef DELAY_ARM2AIR_AS_READER
|
||||
#define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1) // 209
|
||||
#endif
|
||||
|
||||
// CRC skips two first sync bits in data buffer
|
||||
#define AddCrc(data, len) compute_crc(CRC_FELICA, (data)+2, (len),(data)+(len)+2, (data)+(len)+3)
|
||||
#define AddCrc(data, len) compute_crc(CRC_FELICA, (data), (len), (data)+(len)+1, (data)+(len))
|
||||
|
||||
static uint32_t felica_timeout;
|
||||
static uint32_t felica_nexttransfertime;
|
||||
@@ -285,12 +283,12 @@ static uint8_t felica_select_card(felica_card_select_t *card) {
|
||||
// 8-byte IDm, number of blocks, blocks numbers
|
||||
// number of blocks limited to 4 for FelicaLite(S)
|
||||
static void BuildFliteRdblk(uint8_t *idm, int blocknum, uint16_t *blocks) {
|
||||
|
||||
if (blocknum > 4 || blocknum <= 0)
|
||||
Dbprintf("Invalid number of blocks, %d != 4", blocknum);
|
||||
|
||||
uint8_t c = 0, i = 0;
|
||||
|
||||
// Sync bytes
|
||||
frameSpace[c++] = 0xb2;
|
||||
frameSpace[c++] = 0x4d;
|
||||
|
||||
@@ -333,11 +331,12 @@ static void BuildFliteRdblk(uint8_t *idm, int blocknum, uint16_t *blocks) {
|
||||
|
||||
//set length
|
||||
frameSpace[2] = c - 2;
|
||||
AddCrc(frameSpace, c - 2);
|
||||
//Add CRC
|
||||
AddCrc(frameSpace + 2, c - 2);
|
||||
}
|
||||
|
||||
static void TransmitFor18092_AsReader(uint8_t *frame, int len, uint32_t *timing, uint8_t power, uint8_t highspeed) {
|
||||
uint8_t flags = FPGA_MAJOR_MODE_ISO18092;
|
||||
uint8_t flags = FPGA_MAJOR_MODE_HF_ISO18092;
|
||||
if (power)
|
||||
flags |= FPGA_HF_ISO18092_FLAG_READER;
|
||||
if (highspeed)
|
||||
@@ -404,11 +403,13 @@ bool WaitForFelicaReply(uint16_t maxbytes) {
|
||||
Dbprintf("WaitForFelicaReply Start");
|
||||
uint32_t c = 0;
|
||||
// power, no modulation
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_ISO18092 | FPGA_HF_ISO18092_FLAG_READER | FPGA_HF_ISO18092_FLAG_NOMOD);
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO18092 | FPGA_HF_ISO18092_FLAG_READER | FPGA_HF_ISO18092_FLAG_NOMOD);
|
||||
FelicaFrameReset();
|
||||
|
||||
// clear RXRDY:
|
||||
uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
|
||||
(void)b;
|
||||
|
||||
uint32_t timeout = iso18092_get_timeout();
|
||||
|
||||
for (;;) {
|
||||
@@ -469,7 +470,7 @@ static void iso18092_setup(uint8_t fpga_minor_mode) {
|
||||
AT91C_BASE_SSC->SSC_RFMR = SSC_FRAME_MODE_BITS_IN_WORD(8) | SSC_FRAME_MODE_WORDS_PER_TRANSFER(0);
|
||||
|
||||
// Signal field is on with the appropriate LED
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_ISO18092 | fpga_minor_mode);
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO18092 | fpga_minor_mode);
|
||||
|
||||
//20.4 ms generate field, start sending polling command afterwars.
|
||||
SpinDelay(100);
|
||||
@@ -586,7 +587,7 @@ void felica_sniff(uint32_t samplesToSkip, uint32_t triggersToSkip) {
|
||||
if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
|
||||
uint8_t dist = (uint8_t)(AT91C_BASE_SSC->SSC_RHR);
|
||||
Process18092Byte(dist);
|
||||
if ((MAX(dist & 0xff, dist >> 8) >= 178) && (++trigger_cnt > triggersToSkip)) {
|
||||
if ((dist >= 178) && (++trigger_cnt > triggersToSkip)) {
|
||||
Dbprintf("triggersToSkip kicked %d", dist);
|
||||
break;
|
||||
}
|
||||
@@ -718,7 +719,7 @@ void felica_sim_lite(uint64_t uid) {
|
||||
TransmitFor18092_AsReader(curresp, curlen, NULL, 0, 0);
|
||||
|
||||
//switch back
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_ISO18092 | FPGA_HF_ISO18092_FLAG_NOMOD);
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO18092 | FPGA_HF_ISO18092_FLAG_NOMOD);
|
||||
|
||||
FelicaFrameReset();
|
||||
listenmode = true;
|
||||
@@ -751,28 +752,26 @@ void felica_dump_lite_s() {
|
||||
uint8_t *dest = BigBuf_get_addr();
|
||||
|
||||
while (!BUTTON_PRESS() && !data_available()) {
|
||||
|
||||
WDT_HIT();
|
||||
|
||||
// polling?
|
||||
//TransmitFor18092_AsReader(poll, 10, GetCountSspClk()+512, 1, 0);
|
||||
TransmitFor18092_AsReader(poll, 10, NULL, 1, 0);
|
||||
|
||||
if (WaitForFelicaReply(512) && FelicaFrame.framebytes[3] == FELICA_POLL_ACK) {
|
||||
|
||||
// copy 8bytes to ndef.
|
||||
memcpy(ndef, FelicaFrame.framebytes + 4, 8);
|
||||
// for (c=0; c < 8; c++)
|
||||
// ndef[c] = FelicaFrame.framebytes[c+4];
|
||||
|
||||
for (blknum = 0; blknum < ARRAYLEN(liteblks);) {
|
||||
|
||||
// block to read.
|
||||
BuildFliteRdblk(ndef, 1, &liteblks[blknum]);
|
||||
|
||||
//TransmitFor18092_AsReader(frameSpace, frameSpace[2]+4, GetCountSspClk()+512, 1, 0);
|
||||
TransmitFor18092_AsReader(frameSpace, frameSpace[2] + 4, NULL, 1, 0);
|
||||
|
||||
|
||||
|
||||
TransmitFor18092_AsReader(frameSpace, frameSpace[2] + 4, NULL, 1, 0);
|
||||
// read block
|
||||
if (WaitForFelicaReply(1024) && FelicaFrame.framebytes[3] == FELICA_RDBLK_ACK) {
|
||||
|
||||
@@ -801,11 +800,11 @@ void felica_dump_lite_s() {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
isOK = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
switch_off();
|
||||
|
||||
//Resetting Frame mode (First set in fpgaloader.c)
|
||||
|
||||
+23
-8
@@ -124,8 +124,8 @@ void SetupSpi(int mode) {
|
||||
}
|
||||
|
||||
//-----------------------------------------------------------------------------
|
||||
// Set up the synchronous serial port, with the one set of options that we
|
||||
// always use when we are talking to the FPGA. Both RX and TX are enabled.
|
||||
// Set up the synchronous serial port with the set of options that fits
|
||||
// the FPGA mode. Both RX and TX are always enabled.
|
||||
//-----------------------------------------------------------------------------
|
||||
void FpgaSetupSsc(void) {
|
||||
// First configure the GPIOs, and get ourselves a clock.
|
||||
@@ -141,16 +141,16 @@ void FpgaSetupSsc(void) {
|
||||
// Now set up the SSC proper, starting from a known state.
|
||||
AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
|
||||
|
||||
// RX clock comes from TX clock, RX starts when TX starts, data changes
|
||||
// on RX clock rising edge, sampled on falling edge
|
||||
// RX clock comes from TX clock, RX starts on Transmit Start,
|
||||
// data and frame signal is sampled on falling edge of RK
|
||||
AT91C_BASE_SSC->SSC_RCMR = SSC_CLOCK_MODE_SELECT(1) | SSC_CLOCK_MODE_START(1);
|
||||
|
||||
// 8 bits per transfer, no loopback, MSB first, 1 transfer per sync
|
||||
// pulse, no output sync
|
||||
AT91C_BASE_SSC->SSC_RFMR = SSC_FRAME_MODE_BITS_IN_WORD(8) | AT91C_SSC_MSBF | SSC_FRAME_MODE_WORDS_PER_TRANSFER(0);
|
||||
|
||||
// clock comes from TK pin, no clock output, outputs change on falling
|
||||
// edge of TK, sample on rising edge of TK, start on positive-going edge of sync
|
||||
// TX clock comes from TK pin, no clock output, outputs change on falling
|
||||
// edge of TK, frame sync is sampled on rising edge of TK, start TX on rising edge of TF
|
||||
AT91C_BASE_SSC->SSC_TCMR = SSC_CLOCK_MODE_SELECT(2) | SSC_CLOCK_MODE_START(5);
|
||||
|
||||
// tx framing is the same as the rx framing
|
||||
@@ -400,8 +400,10 @@ static int bitparse_find_section(int bitstream_version, char section_name, uint3
|
||||
void FpgaDownloadAndGo(int bitstream_version) {
|
||||
|
||||
// check whether or not the bitstream is already loaded
|
||||
if (downloaded_bitstream == bitstream_version)
|
||||
if (downloaded_bitstream == bitstream_version) {
|
||||
FpgaEnableTracing();
|
||||
return;
|
||||
}
|
||||
|
||||
// Send waiting time extension request as this will take a while
|
||||
send_wtx(1500);
|
||||
@@ -437,6 +439,8 @@ void FpgaDownloadAndGo(int bitstream_version) {
|
||||
// Send a 16 bit command/data pair to the FPGA.
|
||||
// The bit format is: C3 C2 C1 C0 D11 D10 D9 D8 D7 D6 D5 D4 D3 D2 D1 D0
|
||||
// where C is the 4 bit command and D is the 12 bit data
|
||||
//
|
||||
// @params cmd and v gets or over eachother. Take careful note of overlapping bits.
|
||||
//-----------------------------------------------------------------------------
|
||||
void FpgaSendCommand(uint16_t cmd, uint16_t v) {
|
||||
SetupSpi(SPI_FPGA_MODE);
|
||||
@@ -449,10 +453,21 @@ void FpgaSendCommand(uint16_t cmd, uint16_t v) {
|
||||
// vs. clone vs. etc.). This is now a special case of FpgaSendCommand() to
|
||||
// avoid changing this function's occurence everywhere in the source code.
|
||||
//-----------------------------------------------------------------------------
|
||||
void FpgaWriteConfWord(uint8_t v) {
|
||||
void FpgaWriteConfWord(uint16_t v) {
|
||||
FpgaSendCommand(FPGA_CMD_SET_CONFREG, v);
|
||||
}
|
||||
|
||||
//-----------------------------------------------------------------------------
|
||||
// enable/disable FPGA internal tracing
|
||||
//-----------------------------------------------------------------------------
|
||||
void FpgaEnableTracing(void) {
|
||||
FpgaSendCommand(FPGA_CMD_TRACE_ENABLE, 1);
|
||||
}
|
||||
|
||||
void FpgaDisableTracing(void) {
|
||||
FpgaSendCommand(FPGA_CMD_TRACE_ENABLE, 0);
|
||||
}
|
||||
|
||||
//-----------------------------------------------------------------------------
|
||||
// Set up the CMOS switches that mux the ADC: four switches, independently
|
||||
// closable, but should only close one at a time. Not an FPGA thing, but
|
||||
|
||||
+65
-32
@@ -20,40 +20,72 @@
|
||||
// definitions for multiple FPGA config files support
|
||||
#define FPGA_BITSTREAM_LF 1
|
||||
#define FPGA_BITSTREAM_HF 2
|
||||
//#define FPGA_BITSTREAM_FELICA 3
|
||||
|
||||
/*
|
||||
Communication between ARM / FPGA is done inside armsrc/fpgaloader.c (function FpgaSendCommand)
|
||||
Send 16 bit command / data pair to FPGA
|
||||
The bit format is: C3 C2 C1 C0 D11 D10 D9 D8 D7 D6 D5 D4 D3 D2 D1 D0
|
||||
where
|
||||
C is 4bit command
|
||||
D is 12bit data
|
||||
|
||||
-----+--------- frame layout --------------------
|
||||
bit | 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
|
||||
-----+-------------------------------------------
|
||||
cmd | x x x x
|
||||
major| x x x
|
||||
opt | x x
|
||||
divi | x x x x x x x x
|
||||
thres| x x x x x x x x
|
||||
-----+-------------------------------------------
|
||||
*/
|
||||
|
||||
// Definitions for the FPGA commands.
|
||||
#define FPGA_CMD_SET_CONFREG (1<<12)
|
||||
#define FPGA_CMD_SET_DIVISOR (2<<12)
|
||||
#define FPGA_CMD_SET_USER_BYTE1 (3<<12)
|
||||
// BOTH HF / LF
|
||||
#define FPGA_CMD_SET_CONFREG (1<<12) // C
|
||||
|
||||
// LF
|
||||
#define FPGA_CMD_SET_DIVISOR (2<<12) // C
|
||||
#define FPGA_CMD_SET_USER_BYTE1 (3<<12) // C
|
||||
|
||||
// HF
|
||||
#define FPGA_CMD_TRACE_ENABLE (2<<12) // C
|
||||
|
||||
// Definitions for the FPGA configuration word.
|
||||
// LF
|
||||
#define FPGA_MAJOR_MODE_LF_ADC (0<<5)
|
||||
#define FPGA_MAJOR_MODE_LF_READER (0<<5)
|
||||
#define FPGA_MAJOR_MODE_LF_EDGE_DETECT (1<<5)
|
||||
#define FPGA_MAJOR_MODE_LF_PASSTHRU (2<<5)
|
||||
#define FPGA_MAJOR_MODE_LF_ADC (3<<5)
|
||||
|
||||
// HF
|
||||
#define FPGA_MAJOR_MODE_HF_READER_TX (0<<5)
|
||||
#define FPGA_MAJOR_MODE_HF_READER_RX_XCORR (1<<5)
|
||||
#define FPGA_MAJOR_MODE_HF_SIMULATOR (2<<5)
|
||||
#define FPGA_MAJOR_MODE_HF_ISO14443A (3<<5)
|
||||
#define FPGA_MAJOR_MODE_HF_SNOOP (4<<5)
|
||||
#define FPGA_MAJOR_MODE_HF_FELICA (5<<5)
|
||||
// BOTH
|
||||
#define FPGA_MAJOR_MODE_OFF_LF (6<<5)
|
||||
#define FPGA_MAJOR_MODE_OFF (7<<5)
|
||||
#define FPGA_MAJOR_MODE_HF_READER_TX (0<<5) // D
|
||||
#define FPGA_MAJOR_MODE_HF_READER_RX_XCORR (1<<5) // D
|
||||
#define FPGA_MAJOR_MODE_HF_SIMULATOR (2<<5) // D
|
||||
#define FPGA_MAJOR_MODE_HF_ISO14443A (3<<5) // D
|
||||
#define FPGA_MAJOR_MODE_HF_SNOOP (4<<5) // D
|
||||
#define FPGA_MAJOR_MODE_HF_ISO18092 (5<<5) // D
|
||||
#define FPGA_MAJOR_MODE_HF_GET_TRACE (6<<5) // D
|
||||
|
||||
// BOTH HF / LF
|
||||
#define FPGA_MAJOR_MODE_OFF (7<<5) // D
|
||||
|
||||
// Options for LF_READER
|
||||
#define FPGA_LF_ADC_READER_FIELD 0x1
|
||||
|
||||
// Options for LF_ADC
|
||||
#define FPGA_LF_ADC_READER_FIELD (1<<0)
|
||||
// Options for LF_EDGE_DETECT
|
||||
#define FPGA_CMD_SET_EDGE_DETECT_THRESHOLD FPGA_CMD_SET_USER_BYTE1
|
||||
#define FPGA_LF_EDGE_DETECT_READER_FIELD (1<<0)
|
||||
#define FPGA_LF_EDGE_DETECT_TOGGLE_MODE (1<<1)
|
||||
#define FPGA_LF_EDGE_DETECT_READER_FIELD 0x1
|
||||
#define FPGA_LF_EDGE_DETECT_TOGGLE_MODE 0x2
|
||||
|
||||
// Options for the HF reader, tx to tag
|
||||
#define FPGA_HF_READER_TX_SHALLOW_MOD (1<<0)
|
||||
#define FPGA_HF_READER_TX_SHALLOW_MOD 0x1
|
||||
|
||||
// Options for the HF reader, correlating against rx from tag
|
||||
#define FPGA_HF_READER_RX_XCORR_848_KHZ (1<<0)
|
||||
#define FPGA_HF_READER_RX_XCORR_SNOOP (1<<1)
|
||||
#define FPGA_HF_READER_RX_XCORR_QUARTER (1<<2)
|
||||
#define FPGA_HF_READER_RX_XCORR_848_KHZ 0x1
|
||||
#define FPGA_HF_READER_RX_XCORR_SNOOP 0x2
|
||||
#define FPGA_HF_READER_RX_XCORR_QUARTER 0x4
|
||||
|
||||
// Options for the HF simulated tag, how to modulate
|
||||
#define FPGA_HF_SIMULATOR_NO_MODULATION 0x0 // 0000
|
||||
#define FPGA_HF_SIMULATOR_MODULATE_BPSK 0x1 // 0001
|
||||
@@ -63,20 +95,21 @@
|
||||
// no 848K
|
||||
|
||||
// Options for ISO14443A
|
||||
#define FPGA_HF_ISO14443A_SNIFFER (0<<0)
|
||||
#define FPGA_HF_ISO14443A_TAGSIM_LISTEN (1<<0)
|
||||
#define FPGA_HF_ISO14443A_TAGSIM_MOD (2<<0)
|
||||
#define FPGA_HF_ISO14443A_READER_LISTEN (3<<0)
|
||||
#define FPGA_HF_ISO14443A_READER_MOD (4<<0)
|
||||
#define FPGA_HF_ISO14443A_SNIFFER 0x0
|
||||
#define FPGA_HF_ISO14443A_TAGSIM_LISTEN 0x1
|
||||
#define FPGA_HF_ISO14443A_TAGSIM_MOD 0x2
|
||||
#define FPGA_HF_ISO14443A_READER_LISTEN 0x3
|
||||
#define FPGA_HF_ISO14443A_READER_MOD 0x4
|
||||
|
||||
//options for Felica.
|
||||
#define FPGA_MAJOR_MODE_ISO18092 (5<<5) // 01010 0000
|
||||
#define FPGA_HF_ISO18092_FLAG_NOMOD (1<<0) // 0001 disable modulation module
|
||||
#define FPGA_HF_ISO18092_FLAG_424K (2<<0) // 0010 should enable 414k mode (untested). No autodetect
|
||||
#define FPGA_HF_ISO18092_FLAG_READER (4<<0) // 0100 enables antenna power, to act as a reader instead of tag
|
||||
#define FPGA_HF_ISO18092_FLAG_NOMOD 0x1 // 0001 disable modulation module
|
||||
#define FPGA_HF_ISO18092_FLAG_424K 0x2 // 0010 should enable 414k mode (untested). No autodetect
|
||||
#define FPGA_HF_ISO18092_FLAG_READER 0x4 // 0100 enables antenna power, to act as a reader instead of tag
|
||||
|
||||
void FpgaSendCommand(uint16_t cmd, uint16_t v);
|
||||
void FpgaWriteConfWord(uint8_t v);
|
||||
void FpgaWriteConfWord(uint16_t v);
|
||||
void FpgaEnableTracing(void);
|
||||
void FpgaDisableTracing(void);
|
||||
void FpgaDownloadAndGo(int bitstream_version);
|
||||
// void FpgaGatherVersion(int bitstream_version, char *dst, int len);
|
||||
void FpgaSetupSsc(void);
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user