Commit Graph
23096 Commits
Author SHA1 Message Date
Matthew CarrollandClaude Opus 5 1ebcf225f1 lf nrz demod: start the bitstream at the first edge
The samples before the first level change were counted as bits, and where no
edge arrives inside ten clocks the long-run flush fired first and invented ten
of them out of the quiet lead-in. The count sat on a rounding boundary, so one
sample of jitter in that edge added or dropped a leading bit and rotated the
rest of the word - while startIdx, derived from the same count, held i % clk and
could name no sample.

A level change can only fall on a bit boundary, so start there and report it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-10 14:57:11 -07:00
Iceman 0884083530 Merge pull request #3610 from innocentbystanderproxmark/pm5-documentation-update
Add verbiage to make flashing the BWM clearer
2026-09-10 15:34:53 +07:00
iceman1001 82c726dd9b fix t55xx_config.lua script with scoring of psk2/3 to write a proper text 2026-09-10 10:05:10 +02:00
Innocent Bystander 1457a5d827 Add verbage to make flashing the BWM clearer 2026-09-10 01:17:06 -04:00
iceman1001 78b4d4ef00 fix psk1 detection. now scores 24/24 tests 2026-09-10 05:45:13 +02:00
iceman1001 e121e3f0a8 fixing FSK / t5577 2026-09-10 05:28:06 +02:00
iceman1001 d54ae662ce fix lua scripts grabbing return text. mimics the python binding way now 2026-09-10 04:31:47 +02:00
Iceman 7342737139 Merge pull request #3609 from innocentbystanderproxmark/pm5-bmw-flashing-instructions
Adding BWM Flashing instructions to PM5 Documentation
2026-09-10 09:10:48 +07:00
iceman1001 bef7f3752a another entry 2026-09-10 04:03:57 +02:00
iceman1001andClaude Opus 5 (1M context) ea2909702f lf t55xx: anchor the block read offset in samples, not demod bits
GetT55xxBlockData extracted every block at config.offset, a bit index into a
demod buffer cached by the last detect - a different capture. Demodulators do
not all start on the same bit, so a later read could return a rotation of the
block with nothing marking it as wrong: psk1 by four or five bits, fsk2a and
nrz by one, manchester and biphase never.

Record the boundary where it is stable instead. Every demodulator reports the
graph sample its first bit sits on, and turn_read_lf_on(137 * 8) makes the
firmware open each read acquisition at the same point, so the word boundary
lands on the same sample every time. Convert back per demodulation.

Block 0 re-anchors from its known value, and a write is now verified by the
value being anywhere in the repeating stream rather than at one cached offset -
which also fixes correct writes reporting as validation failures. A block 0
verify re-detects on a mismatch, not only on a decode failure: the pre-write
config can decode the post-write signal into garbage rather than failing.

Also fixes a -1 password sentinel truncated to 32 bits by a ternary, which made
that detect report a password that was never supplied.

Measured on a T5577 across psk1, fsk2a and direct/nrz: three consecutive dumps
agree field for field, against a baseline where psk1 corrupted 22 of 24.

Co-Authored-By: Claude Opus 5 (1M context)
2026-09-10 03:58:14 +02:00
Innocent Bystander b3123d153f Adding BWM Flashing instructions to PM5 Documentation 2026-09-09 21:14:26 -04:00
iceman1001 253e0d148a hf emrtd info - did not identify and mapped OID for algorithms in PACE. Now we keep a list and pretty print it 2026-09-10 02:55:16 +02:00
Iceman 9ec11eda2a Merge pull request #3605 from Actu4l-Human/testy-earwig
fix(pm5): terminate packet-aligned AT32 USB CDC writes with ZLP
2026-09-10 02:16:40 +07:00
Young, Nathen C 186c72eefd fix(usb): terminate packet-aligned CDC transfers with ZLP
Send a synchronous zero-length packet after CDC responses whose length is
an exact multiple of the endpoint packet size, preventing oversized host
reads from remaining pending.
2026-09-09 08:57:09 -07:00
Iceman a38ab20b53 Merge pull request #3604 from ry4000/master
R&Y: Updated `MEGACASH` AID in `aid_desfire.json`
2026-09-09 14:51:41 +07:00
ry4000 ef23d014eb R&Y: Updated MEGACASH AID in aid_desfire.json
# Updates
1. Updated `MEGACASH` vendor name from `Bank Mega` to `PT Bank Mega Tbk` *which is the vendor's full name*.

-r&y.

Signed-off-by: ry4000 <154689120+ry4000@users.noreply.github.com>
2026-09-09 16:15:03 +10:00
Iceman 23d6f67dc8 Merge pull request #3603 from kormax/new-aid-desfire-entries
Add new ISO7816 & DESFire AID values
2026-09-08 22:57:50 +07:00
Iceman a9ac330040 Merge pull request #3602 from nieldk/esp32-c2
Esp32 app descriptor check
2026-09-08 22:57:17 +07:00
kormax 6c8cf5bdcf Add new ISO7816 AID values 2026-09-08 18:24:09 +03:00
kormax a4b1dd0ee7 Add new DESFire AID entries 2026-09-08 18:23:15 +03:00
Niel Nielsen 6e84d4ca8b Refactor chip ID and app signature checks
Signed-off-by: Niel Nielsen <nieldk@gmail.com>
2026-09-08 13:35:48 +02:00
Niel Nielsen b0aa484eba Fix comment for app descriptor in cmdhw.c
Signed-off-by: Niel Nielsen <nieldk@gmail.com>
2026-09-08 12:17:34 +02:00
Niel Nielsen c9fe1dd891 Merge branch 'RfidResearchGroup:master' into esp32-c2 2026-09-08 12:11:52 +02:00
Niel Nielsen 14ab313ca7 Implement firmware image validation for ESP32-C2
Add checks for firmware image validity before flashing.

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
2026-09-08 12:11:32 +02:00
Iceman 4031fb8cf1 Merge pull request #3601 from sophiel-meow/master
Fix `hf mf sen` abort with wrong frame size
2026-09-08 16:36:48 +07:00