203 Commits
Author SHA1 Message Date
xilni 342cc37cca docs(bwm): fix stale hw bwm command references 2026-09-07 00:07:07 -04:00
Philippe Teuwen 519e0f6de9 pm5_battery_test: misc fixes 2026-08-30 14:11:47 +02:00
Philippe Teuwen aa052ca444 pm5_battery_test: fix missing arg 2026-08-30 13:58:20 +02:00
Philippe Teuwen bf32513d1b pm5_battery_test: merge nieldk version and add test scenarios 2026-08-30 13:44:46 +02:00
Philippe Teuwen 0197fe8484 Battery test graph: elapsed time 2026-08-30 00:06:13 +02:00
Philippe Teuwen 8017246fd5 Battery test scripts 2026-08-30 00:06:13 +02:00
iceman1001 35c098d489 make style 2026-08-29 17:42:29 +02:00
MsprgandClaude Fable 5 d852118de5 client: build the tab completion vocabulary at runtime from the command tree
Tab completion used a generated table (pm3line_vocabulary.h, refreshed by
hand via `make commands`) that drifted from the real command tables: new
commands were missing (e.g. `hw bwm*`), removed ones lingered, and the
"offline" flag depended on the platform of whoever regenerated it
(IfPm5() returns true offline on PM5 builds).

Build the vocabulary at startup instead:

- cmdparser: add walkCommandsRecursive(), a tree walk using a fourth
  internal sentinel (XX_internal_command_walk_XX) next to the dump ones.
  It hands each leaf to a visitor as its command_t chain (ancestors +
  leaf). A dispatch counter detects entries shown like a category but
  with their own parser (reveng) and reports them as leaves.
- pm3line_vocabulary: dynamic vocabulary holding the IsAvailable()
  predicates of every command and its ancestor categories, so completion
  applies exactly the rule CmdsHelp() uses, live, for both offline and
  connected devices. Script entries ("script run <relpath>") come from
  the same directories `script list` scans, sorted, including
  subdirectories with the path `script run` needs.
- pm3line: readline and linenoise completers consume the live vocabulary.
  The walk runs with output disabled so category handlers stay silent.
- Drop pm3_help2list.py and the header regeneration from `make commands`.

Behaviour change: entries whose category is hidden by `help` (e.g. `mem`,
`usart` offline) are no longer offered, matching `help`; when connected,
commands the device does not support are no longer offered either.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-28 14:29:04 +02:00
Henry Gabryjelski 075f353f98 More fixes based on CoPilot suggestions
* add a check to prevent multiple log handler additions.  Still a hack, but ok for this purpose.
* GuessKey_Statistics.__init__() now validates is_solved using same class validator as unpack()
* fix exception text to reflect allowed types for Hangman_State
* Also in Hangman_State, fix validation when input is bytes / bytearray
* In dc34_PlayHangman_validate_user_input(), strip the input before checking length.
2026-08-23 01:10:49 -07:00
Henry Gabryjelski 9a461daf96 Resolve additional issues that CoPilot found
1. remove hard-coded binary path
2. define TCP_PORT in fallback path
3. only detect device when not called from client
4. struct.pack() requires bytes / bytearray when packing a string.
5. fix typo "existing" -> "exiting"
6. remove unused imports
2026-08-23 00:44:27 -07:00
Henry GabryjelskiandCopilot Autofix powered by AI 0ff99b8762 Update python minimum version
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Henry Gabryjelski <henrygab@users.noreply.github.com>
2026-08-23 00:29:01 -07:00
Henry Gabryjelski 3f4eef9991 Add script to interact with DefCon34 passport cards
Works both from the command-line and from within the PM3 client:
* python3 ./client/pyscripts/dc34.py
* ./pm3 -c "script run dc34"

Supports all three games:
* TicTacToe
* Hangman
* GuessKey

See https://dc34.rfid.wtf/
2026-08-23 00:05:51 -07:00
iceman1001 2c6e607110 style 2026-07-15 16:39:15 +02:00
M35MAR 52ef29b282 Restore original author credits in mfuev1_counter_reset.py 2026-06-20 16:31:10 +02:00
M35MAR 0e814659c3 client/pyscripts: fix and stabilize mfuev1 counter reset 2026-06-20 11:39:01 +02:00
Philippe Teuwen 410769e463 counterfeit ULC: remove legacy poc 2026-06-10 08:05:15 +02:00
Philippe Teuwen 184a957436 counterfeit ULC: add support to auth with nonce pairs 2026-06-10 01:02:14 +02:00
Philippe Teuwen 607737e52e counterfeit ULC: need to merge nonce collection in auth logic for proper timings 2026-06-10 00:39:46 +02:00
Philippe Teuwen 6d8ed745fd counterfeit ULC: misc tuning 2026-06-10 00:39:46 +02:00
Philippe Teuwen ff04e1ea9a hf mfu cauth: add -c to collect nonces 2026-06-07 22:58:39 +02:00
orbisai0security 94c0fc2edd Hardening: explicitly set shell=False on all subprocess.run() calls in fm11rf08s_recovery.py.
All four call sites already pass `cmd` as a Python list, so Python's default of `shell=False` means there is no active command-injection risk. This change makes the security intent explicit, prevents accidental future regression if a call site is later changed to pass a string, and improves code clarity.

No functional behaviour is changed.
2026-06-02 17:12:31 +02:00
Philippe Teuwen fa8e200c5b mfulc_counterfeit_recovery: faster vuln check 2026-05-28 23:58:09 +02:00
Philippe Teuwen f22dd43cfc mfulc_counterfeit_recovery: faster writes 2026-05-28 23:37:29 +02:00
Philippe Teuwen b13a8ce1d5 mfulc_counterfeit_recovery --cuda: dummy call to wake up the GPU ahead 2026-05-28 23:24:14 +02:00
Philippe Teuwen 20aaf4c292 mfulc_counterfeit_recovery.py: add --get_frequent_chal and --unlock 2026-05-22 18:52:02 +02:00