Giter VIP home page Giter VIP logo

rfidresearchgroup / proxmark3 Goto Github PK

View Code? Open in Web Editor NEW
3.5K 125.0 953.0 78.35 MB

Iceman Fork - Proxmark3

Home Page: http://www.icedev.se

License: GNU General Public License v3.0

Makefile 0.51% C 91.60% Objective-C 0.01% Assembly 0.36% Awk 0.01% Shell 0.47% C++ 0.87% Lua 4.05% Python 0.69% Verilog 0.80% Batchfile 0.01% Tcl 0.01% Perl 0.13% CMake 0.42% Dockerfile 0.05% SWIG 0.01%
nfc rfid mifare proxmark3 proxmark iso15693 iso14443a iso14443b 125khz clone

proxmark3's Introduction

Iceman Fork - Proxmark3

The Proxmark3 is the swiss-army tool of RFID, allowing for interactions with the vast majority of RFID tags on a global scale. Originally built by Jonathan Westhues, the device is now the goto tool for RFID Analysis for the enthusiast. Iceman repository is considered to be the pinnacle of features and functionality, enabling a huge range of extremely useful and convenient commands and LUA scripts to automate chip identification, penetration testing, and programming

Latest Release Coverity Contributors
Latest release Coverity Status GitHub contributors
Actions OSX CI Actions Ubuntu CI Actions Windows CI
MacOS Build and Test Ubuntu Build and Test Windows Build and Test

Table of Contents

PROXMARK3 INSTALLATION AND OVERVIEW

Installation Use of the Proxmark3
Linux - Setup and Build Compilation Instructions
Linux - Important notes on ModemManager Validating Proxmark3 Client Functionality
macOS - Homebrew & Upgrading HomeBrew Tap Formula First Use and Verification
macOS - MacPorts Commands & Features
macOS - Setup and Build
Windows - Setup and Build
Termux / Android - Setup and Build
iOS - Setup and Build
Blue Shark Manual Command Cheat Sheet
Advanced Compilation Parameters More Cheat Sheets
Troubleshooting Complete Client Command Set
JTAG T5577 Introduction Guide

Notes / helpful documents

Notes
Notes on UART Notes on Termux / Android Notes on paths
Notes on frame format Notes on tracelog / wireshark Notes on EMV
Notes on external flash Notes on loclass Notes on Coverity Scan Config & Run
Notes on file formats used with Proxmark3 Notes on MFU binary format Notes on FPGA & ARM
Developing standalone mode Wiki about standalone mode Notes on Magic UID cards
Notes on Color usage Makefile vs CMake Notes on Cloner guns
Notes on cliparser usage Notes on clocks Notes on MIFARE DESFire
Notes on CIPURSE Notes on NDEF type4a Notes on downgrade attacks

How to build?

Proxmark3 RDV4

See the instruction links in the tables above to build, flash and run for your Proxmark3 RDV4 device.

Generic Proxmark3 platforms

In order to build this repo for generic Proxmark3 platforms we urge you to read Advanced compilation parameters

We define generic Proxmark3 platforms as following devices.

Supported

  • RDV1, RDV2, RDV3 easy
  • Ryscorp green PCB version
  • Radiowar black PCB version
  • numerous Chinese adapted versions of the RDV3 easy (kkmoon, PiSwords etc)
  • Proxmark3 SE (Special Edition) (BLE enabled)
  • Proxmark3 X
    • Note: Community tested
    • Note: unknown device hw

Not supported

  • ⚠ Proxmark Evolution (EVO)
    • Note: unknown pin assignments.
  • ⚠ Ryscorp Proxmark3 Pro
    • Note: device has different fpga and unknown pin assignments.
    • Note: Company have disappeared, leaving their customers in the dark.

Experimental support

  • ⚠ iCopy-X
    • Note: currently incompatible with iCopy-X GUI as Proxmark client commands using different syntax
    • Note: see also icopyx-community repos for upstream sources, reversed hw etc.
    • Note: Uses DRM to lock down tags, ignores the open source licences. Use on your own risk.

Unknown support status

  • ⚠ VX
    • Note: unknown device hw
  • ⚠ Proxmark3 Ultimate
    • Note: unknown device hw

When it comes to these new unknown models we are depending on the community to report in if this repo works and what they did to make it work.

256KB flash memory size of generic Proxmark3 platforms

Note: You need to keep a eye on how large your ARM chip built-in flash memory is. With 512KB you are fine but if its 256KB you need to compile this repo with even less functionality. When running the ./pm3-flash-all you can see which size your device have if you have the bootloader from this repo installed. Otherwise you will find the size reported in the start message when running the Proxmark3 client ./pm3.

OBS! Read the 256KB flash memory advisory

What has changed?

Proxmark3 RDV4 hardware modifications:

  • added flash memory 256KB
  • added smart card module
  • added FPC connector for peripherals such as Bluetooth+battery addon
  • improved antennas
    • swappable
    • LF Q factor switch
    • LF 125/134 frequency switch
  • tiny PCB form factor
  • ABS case

This repo vs official Proxmark3 repo:

See the Changelog file which we try to keep updated.

In short this repo gives you a completely different user experience when it comes to Proxmark3.

  • Supports command tab complete
  • Richer CLI with use of colors / emojis
  • Help text system implemented everywhere
  • Hints system
  • User preference settings
  • Extensive testing with continuous integration build systems on Linux, OSX and Windows, and regular usage of static analysis tools like
    • Coverity Scan
    • Cppcheck (v2.6)
    • GCC and Clang aggressive enforcement of diagnostic flags
  • Auto detection of serial ports and seamless integration with Bluetooth addon
  • Reconnect to device from inside client
  • Supports tearoff attacks
  • Supports NFC NDEF type1, type2, type4a, type4b, mifare, barcode
  • Supports pm3 client scripts, lua scripts, python scripts
  • Most comprehensive collection of scripts available
  • Wiegand encoding, decoding.
  • Supports EMV
  • Supports CIPURSE
  • Most standalone modes available with easy compilation
  • Extensive test script for client and external tools
  • Most comprehensive compiled known keys dictionaries
  • Slimed down usb communications with NG-frames
  • The most compiled public known key recovery software
  • The fastest implementations of said software
  • Support multiple fileformats for dump files (BIN/EML/JSON)
  • Interoperability of said fileformats with libnfc, MFC tool app etc
  • Supports more RFID based protocols than ever
  • Easy install for package maintainers, distro maintainers
  • Supports cmake, make
  • Builds without errors or warnings on more OS/platforms than ever
  • Available as package on known distros like Gentoo, Kali, Termux, Macports, Homebrew
  • Much more documentation

Development

Note: This is a bleeding edge repository. The maintainers actively is working out of this repository and will be periodically re-structuring the code to make it easier to comprehend, navigate, build, test, and contribute to, so DO expect significant changes to code layout on a regular basis.

👉 Remember! If you intend to contribute to the code, please read the coding style notes first. We usually merge your contributions fast since we do like the idea of getting a functionality in the Proxmark3 and weed out the bugs afterwards.

The public roadmap is an excellent start to read if you are interesting in contributing.

Supported operative systems

This repo compiles nicely on

Precompiled binaries

See Proxmark3 precompiled builds

Proxmark3 GUI

The official PM3-GUI from Gaucho will not work. Not to mention is quite old and not maintained any longer.

Official channels

Where do you find the community?

Maintainers

To all distro, package maintainers, we tried to make your life easier.

make install is now available and if you want to know more.

This document will be helpful for you

Citation

Use this bibtex to cite this repository globally:

@misc{proxmark3,
  author = {C. {Herrmann} and P. {Teuwen} and O. {Moiseenko} and M. {Walker} and others},
  title = {{Proxmark3 -- Iceman repo}},
  howpublished = {\url{https://github.com/RfidResearchGroup/proxmark3}},
  keywords = {rfid nfc iceman proxmark3 125khz 134khz 13.56mhz},
}

If you need to refer to a specific state of the repository, use a commit number or a date of access, e.g.:

  note = {Accessed: commit 12327f71a27da23831901847886aaf20e8ad3ca0}
  note = {Accessed: 2021-01-01}

Copyright and licensing terms

Each contribution is under the copyright of its author. See AUTHORS.

The Proxmark3 source code is covered by the following licensing terms, usually referred as GPLv3 or later.

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

A copy of the GPLv3 is available in LICENSE.

Some dependencies may be under other free licensing terms compatible with the Proxmark3 licensing terms, see their respective description.

proxmark3's People

Contributors

7homassutter avatar adamlaurie avatar aveao avatar bkerler avatar brianpow avatar darkmattermatt avatar dnet avatar doegox avatar drandreas avatar gator96100 avatar henrygab avatar henryk avatar holiman avatar iceman1001 avatar izsh avatar jmichelp avatar linuxgemini avatar lnv42 avatar marshmellow42 avatar matthiaskonrath avatar mceloff avatar merlokk avatar mwalker33 avatar nvx avatar pwpiwi avatar slurdge avatar tcprst avatar tharexde avatar uhei avatar wh201906 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

proxmark3's Issues

PIN of sim card

How can we able to clone or read the pin of A sim card with RDV4?!
Thanks

Mess with information about proxmark3 rdv40

Okay, I want to read more about proxmark3 rdv40 and make a decision wether it is worth buying or not.

First I go to rfidresearchgroup.com and what I see. It's an instagram with fashionable colourful PCB's?

Not a single line of text with specification. I see black, blue and red PCB's. Are these different models of device? Where should I click? Or should I click on every model and look for differences?
Okay, I click on random device that looks similar to proxmark3. And gallery carousel appears with PCB photos. What?!

Okay I finally find a menu on the top and click on Our Projects --> PROXMARK3 RDV4.0 and get to proxgrind.com. I click on Shop --> Hardware to read more information about proxmark3 RDV4.0

And here is what I see. Where is the proxmark3 RDV4.0?!

Okay, I found this page http://proxgrind.com/prototyping/proxmark3-rdv4-0-development/ and finally read some useful info.

Then I got to https://lab401.com/collections/hardware/products/proxmark-3-rdv4 to read more information. I still don't get what for the SIM card socket was made and what's the difference between external red HF antenna and assembly blue HF antenna even after watching a video. Which is the long and medium range?

So I look at Assembly Instructions link in resources section. Guess what I get?

I got this: proxmark elechouse RDV version assembly instruction.
Installation / Introduction manual opens elechouse documents too.

Conclusion

Proxmark3 is a highly specialized device for experts who are expecting to see schemes, accurate technical documents and so on. RDV4.0 looks very cool but it lacks a clear documentation and accurate structure of information on all affiliated sites. I want to see all necessary information on single page, without scrolling tons of slides from kickstarter presentation. I want to see a real comparisons with old revisions and real usage examples. Not a PCB photo gallery.

Here is the example of good product page, take a look for inspiration:

https://hydrabus.com/hydrabus-1-0-hw-detailed/

SIM: ATR wrongly captured

Describe the bug

[=] ISO7618-3 ATR : 3B 67 00 00 00 00 00 00 00 90 00           

Repeating sc reader multiple times:

[=] ISO7618-3 ATR : D5 00 00 3B 67 00 00 00 00 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00           
[=] ISO7618-3 ATR : 3B 67 00 00 00 00 00 00 00 90 00           
[=] ISO7618-3 ATR : 3B 67 00 00 00 00 00 00 00 90 00           
[=] ISO7618-3 ATR : 3B 67 00 00 00 00 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00           
[=] ISO7618-3 ATR : 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00           
[=] ISO7618-3 ATR : 2C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00           
[=] ISO7618-3 ATR : 3B 67 00 00 00 00 00 00 00 90 00           
[=] ISO7618-3 ATR : 3B 67 00 00 00 00 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00           
[=] ISO7618-3 ATR : 3B 67 00 00 00 00 00 00 00 90 00
[=] ISO7816-3 ATR : D5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3B 67 00 00 00 00 00 00 00 90           

pm3 --> sc list
[+] Recorded Activity (TraceLen = 41 bytes)          
[=]           
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer          
ISO7816-4 / Smartcard - Timings N/A yet          
          
      Start |        End | Src | Data (! denotes parity error)                                           | CRC | Annotation          
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------          
          0 |          0 | Tag |d5  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00   |     |           
            |            |     |00  3b  67  00  00  00  00  00  00  00  90                               |     |

Context:

  • Linux
  • Banking card on SIM extender
  • Smart card module v3.10

[Mifare] hf mf sim

Hi,

I start to work on hf mf sim to :

  • integrate some new Proxmark3 repo function
  • Extract all hf mf sim to a file => hfmfsim.c

This part is almost finish.
As @icemann said to me, maybe I will need to modify some files after philippe teuwen @doegox cleanning (thank for this !, I had a big mess with CRLF/LF files in the repo before)

Now, I'm working on Mifare mini, 1k and 4k simulation, as the current Mifare1ksim function only support 1k card.

Work in progress:

  • Client side configuration (add option, extend flags param)
  • arm side (ATQA / SAK managment), flags

I will start to do a PR quite soon (I hope) :)

iClass chk seems to be broken

Valid key is definitely in the dictionary but the command doesn't seem to work anymore as seen from the below output:

pm3 --> hf iclass chk f client/default_keys.dic
[+] Reading tag CSN
[+] Loaded 88 keys from client/default_keys.dic
[+] Generating diversified keys, MAC
[+] Searching for DEBIT key
[+] Tag info
[+] CSN | 97 AD 1E 01 F8 FF 12 E0
[+] CCNR | FE FF FF FF FF FF FF FF 00 00 00 00
-----+------------------+---------
#key | key | mac
-----+------------------+---------
[ 0] | 0000ffffffffffff | e341d798
[ 1] | 0000000000000000 | 2510f8ce
[ 2] | 0000a0a1a2a3a4a5 | faaed79d
[ 3] | 0000d3f7d3f7d3f7 | 332a78ae
[ 4] | 00005a1b85fce20a | 8d6603cd
[ 5] | 000000000ffe2488 | 0138fa4f
[ 6] | 00000297927c0f77 | 32d0e015
[ 7] | 000026940b21ff5d | 172dd122
[ 8] | 00002ba9621e0a36 | 7b594a4f
[ 9] | 0000434f4d4d4f41 | cbd798ff
[+] ... skip printing the rest
.....
[-] Chunk [0/88] : 11.7s [debit]

[+] Time in iclass checkkeys: 12 seconds

pm3 --> hf iclass dump k AEA684A6DAB23278
.------+--+-------------------------+

CSN |00| 97 AD 1E 01 F8 FF 12 E0 |

------+--+-------------------------+

  |01| 12 FF FF FF 7F 1F FF 3C | .......<

  |02| FE FF FF FF FF FF FF FF | ........

  |03| 99 0B 05 0E 84 A6 B3 0A | ........

  |04| FF FF FF FF FF FF FF FF | ........

  |05| FF FF FF FF FF FF FF FF | ........

  |06| 03 03 03 03 00 03 E0 17 | ........

  |07| 2E D7 86 81 51 19 7B 36 | ....Q.{6

  |08| 2A D4 C8 21 1F 99 68 71 | *..!..hq

  |09| 2A D4 C8 21 1F 99 68 71 | *..!..hq

  |0A| FF FF FF FF FF FF FF FF | ........

  |0B| FF FF FF FF FF FF FF FF | ........

  |0C| FF FF FF FF FF FF FF FF | ........

  |0D| FF FF FF FF FF FF FF FF | ........

  |0E| FF FF FF FF FF FF FF FF | ........

  |0F| FF FF FF FF FF FF FF FF | ........

  |10| FF FF FF FF FF FF FF FF | ........

  |11| FF FF FF FF FF FF FF FF | ........

  |12| FF FF FF FF FF FF FF FF | ........

------+--+-------------------------+

[+] saving dump file - 19 blocks read
[+] saved 152 bytes to binary file iclass_tagdump-97ad1e01f8ff12e0-1.bin
pm3 -->

[idea] script run iclass_autopwn

Is your feature request related to a problem? Please describe.
Running a simple dump/restore function for complete iclass legacy tags. Today it consists of running several commands and knowing what to do.

Describe the solution you'd like
creating a new lua script for easy autopwn functionality of iClass.

Additional context
think same style as mifare_autopwn, hard_autopwn scripts

lf visa read

Describe the bug
strange thing, lf search finds a t5577 cloned with visa2000, but lf visa read failes to decode it.

To Reproduce
Steps to reproduce the behavior:

  1. lf visa clone 1337
  2. lf search
  3. it should have found / identified the tag
  4. lf visa read
  5. and it fails to identify it.

Expected behavior
both lf search and lf visa read should find the tag

Desktop (please complete the following information):

  • OS: ubuntu 18.04
  • latest source

Additional context
could be related to the LF changes.

LF HITAG - fails

Describe the bug
the lf hitag commands fails to work

To Reproduce
Steps to reproduce the behavior:

  1. put hitag2 tag on pm3 antenna
  2. lf hitag reader 26
  3. fails...

Expected behavior
fully functional / verified working card operations with pm3 and a hitag card.

Desktop (please complete the following information):

  • rdv4
  • latest source
  • ubuntu / mingw

Additional context
This problem has existed for a while, @doegox brought this to my attention some days ago.
found a hitag2 card today and could verify that the hitag2 commands doesn't work.

make style - CRLF convertion

Describe the bug
The perl command wich convert CRLF is not working properly with proxspace
Loads of file are "convert" and backup.

To Reproduce
Run a make style or run command on proxspace env.

Expected behavior
A clear and concise description of what you expected to happen.

Desktop (please complete the following information):

  • OS: Windows 10

I propose to use something like this to force LF:

File: .gitattributes

# Force LF
*.c text=auto eol=lf
*.h text=auto eol=lf

No USB connection after update

Hi everyone,

I was running my proxmark3 rdv 4 for the second time and decided to follow the instructions for this repo, so I proceeded with the image upgrade.

[ 6552.518021] cdc_acm 1-3:1.0: ttyACM1: USB ACM device
[ 6570.767352] usb 1-3: USB disconnect, device number 77
[ 6573.085096] usb 1-3: new full-speed USB device number 78 using xhci_hcd
[ 6578.237065] usb 1-3: device descriptor read/64, error -110
[ 6583.493272] usb 1-3: New USB device found, idVendor=9ac4, idProduct=4b8f
[ 6583.493274] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 6583.493276] usb 1-3: Product: PM3 Device
[ 6583.493277] usb 1-3: Manufacturer: proxmark.org
[ 6583.493278] usb 1-3: SerialNumber: 888
[ 6583.493814] cdc_acm 1-3:1.0: ttyACM1: USB ACM device
[ 6689.121873] usb 1-3: USB disconnect, device number 78
[ 6691.348203] usb 1-3: new full-speed USB device number 79 using xhci_hcd
[ 6696.712160] usb 1-3: new full-speed USB device number 80 using xhci_hcd
[ 6702.020367] usb 1-3: New USB device found, idVendor=9ac4, idProduct=4b8f
[ 6702.020370] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 6702.020371] usb 1-3: Product: PM3 Device
[ 6702.020372] usb 1-3: Manufacturer: proxmark.org
[ 6702.020373] usb 1-3: SerialNumber: 888
[ 6702.020907] cdc_acm 1-3:1.0: ttyACM1: USB ACM device
root@kali:~/proxmark3RDV4# client/flasher /dev/ttyACM1 -b bootrom/obj/bootrom.elf armsrc/obj/fullimage.elf
Loading ELF file bootrom/obj/bootrom.elf
Loading usable ELF segments:
0: V 0x00100000 P 0x00100000 (0x00000200->0x00000200) [R X] @0x94
1: V 0x00200000 P 0x00100200 (0x00000d60->0x00000d60) [R X] @0x298

Loading ELF file armsrc/obj/fullimage.elf
Loading usable ELF segments:
0: V 0x00102000 P 0x00102000 (0x00037900->0x00037900) [R X] @0x94
1: V 0x00200000 P 0x00139900 (0x000012bc->0x000012bc) [RW ] @0x37994
Note: Extending previous segment from 0x37900 to 0x38bbc bytes

[+] Waiting for Proxmark to appear on /dev/ttyACM1           
..........................................[=] UART Setting serial baudrate 115200 [FPC enabled]
.Found 
Entering bootloader... 
(Press and release the button only to abort)
[+] Waiting for Proxmark to appear on /dev/ttyACM1           
......................[=] UART Setting serial baudrate 115200 [FPC enabled]
. Found 

Flashing... 
Writing segments for file: bootrom/obj/bootrom.elf
 0x00100000..0x001001ff [0x200 / 1 blocks].OK 
 0x00100200..0x00100f5f [0xd60 / 7 blocks].......OK 

Writing segments for file: armsrc/obj/fullimage.elf
 0x00102000..0x0013abbb [0x38bbc / 454 blocks].......................................................Foo 128 | 128 (will loop)          
Waiting for a response from the proxmark...          
You can cancel this operation by pressing the pm3 button          

And then I waited for about 10 minutes with no change. After reconnecting, all I can see with dmesg | grep -i usb

[ 6949.214132] usb 1-3: new full-speed USB device number 88 using xhci_hcd
[ 6966.117994] usb 1-3: new full-speed USB device number 89 using xhci_hcd
[ 6983.021859] usb 1-3: new full-speed USB device number 90 using xhci_hcd
[ 6999.929716] usb 1-3: new full-speed USB device number 91 using xhci_hcd
[ 7016.833577] usb 1-3: new full-speed USB device number 92 using xhci_hcd
[ 7033.737437] usb 1-3: new full-speed USB device number 93 using xhci_hcd

I did received some warnings at first for a armsrc file
screenshot from 2018-09-14 18-32-46

Any help is apreciated

[idea] link in amiibo tool software

Is your feature request related to a problem? Please describe.
socrams amiibo tool is already added to the repo, however it is not used anywere.

Describe the solution you'd like
a nice integration with pm3 client, like from identify a amiibo tag, being able to dump decrypted and restore encrypted.

Describe alternatives you've considered
or it can be added like reveng which has its own parameter style / cli.

chk keys not returning anything

issuing hf mf chk keys returns nothing

No output from hf mf chk command, "hf mf chk *1 ?" returns no keys and executes in no time and returns: Time in checkkeys: 0 seconds

RDV3 and pm3-easy board, same issue.

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

OS X High Sierra

pm3 --> hw ver

Proxmark3 RFID instrument

[ CLIENT ]
client: iceman build for RDV40 with flashmem; smartcard;

[ ARM ]
bootrom: iceman/master/ 2018-08-13 21:53:19
os: iceman/master/ 2018-08-13 21:53:22

[ FPGA ]
LF image built for 2s30vq100 on 2017/10/25 at 19:50:50
HF image built for 2s30vq100 on 2018/ 8/10 at 11:48:34

[ Hardware ]
--= uC: AT91SAM7S512 Rev B
--= Embedded Processor: ARM7TDMI
--= Nonvolatile Program Memory Size: 512K bytes, Used: 235171 bytes (45) Free: 289117 bytes (55)
--= Second Nonvolatile Program Memory Size: None
--= Internal SRAM Size: 64K bytes
--= Architecture Identifier: AT91SAM7Sxx Series
--= Nonvolatile Program Memory Type: Embedded Flash Memory

pm3 --> hw status
#db# Memory
#db# BIGBUF_SIZE.............40000
#db# Available memory........40000
#db# Tracing
#db# tracing ................0
#db# traceLen ...............103
#db# Currently loaded FPGA image
#db# mode.................... LF image built for 2s30vq100 on 2017/10/25 at 19:50:50
#db# Flash memory
#db# init....................FAIL
#db# Smart card module (ISO 7816)
#db# version.................FAILED
#db# LF Sampling config
#db# [q] divisor.............95 (125 KHz)
#db# [b] bps.................8
#db# [d] decimation..........1
#db# [a] averaging...........Yes
#db# [t] trigger threshold...0
#db# USB Speed
#db# Sending USB packets to client...
hw tune
#db# Time elapsed............1500ms
#db# Bytes transferred.......806400
#db# USB Transfer Speed PM3 -> Client = 537600 Bytes/s
#db# Various
#db# MF_DBGLEVEL.............1
#db# ToSendMax...............39
#db# ToSendBit...............8
#db# ToSend BUFFERSIZE.......2308
#db# Installed StandAlone Mods
#db# LF HID26 standalone - aka SamyRun (Samy Kamkar)
pm3 --> hw tune

[=] measuring antenna characteristics, please wait...

...

[+] LF antenna: 46.17 V - 125.00 kHz
[+] LF antenna: 28.32 V - 134.00 kHz
[+] LF optimal: 49.43 V - 126.32 kHz
[+] LF antenna is OK

[+] HF antenna: 33.85 V - 13.56 MHz
[+] HF antenna is OK

[+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

Additional context
Add any other context about the problem here.

Bug and partial Fix - update.sh for OS X users

Update.sh does not find pm3 ion osx due to the "?" switch not working

Along with the above we have no symlink in place and I think it may be good to put one in.

Original:

function wait4proxmark {
echo >&2 "Waiting for Proxmark to appear..."
while [ ! -c /dev/ttyACM? -a ! -L /dev/pm3-? ]; do
sleep .1
done
local PM3=ls -1 /dev/pm3-? /dev/ttyACM? 2>/dev/null | head -1
echo >&2 -e "Found proxmark on ${PM3}\n"
echo $PM3
}

The following works fine but line 5 also throws a missing ']' error. Not sure about linux yet. Maybe it could be formatted better?

function wait4proxmark {
echo >&2 "Waiting for Proxmark to appear..."
while [ ! -c /dev/ttyACM? || /dev/tty.usbmodem* -a ! -L /dev/pm3-? || /dev/pm3* ]; do
sleep .1
done
local PM3=ls -1 /dev/pm3-? /dev/ttyACM? dev/tty.usbmodem* /dev/pm3* 2>/dev/null | head -1
echo >&2 -e "Found proxmark on ${PM3}\n"
echo $PM3
}

Also I think somewhere it would be good to check OS, detect OS X and put some symlinks in place. Working code:

if [[ $OSTYPE == darwin* ]]; then
	echo "I am a Mac - creating symlink to /dev/pm3"
		ln -s $PM3 /dev/pm3
	;fi

Power up my RDV4 by a smartphone USB/OTG

I don't manage to power up my PM3 RDV4 with my phone (in order to use it with walrus app). I've an One Plus 6T smartphone and it seems that some people dit manage to with smartphones.
TBH, i've already opened an issue here in walrus repository.
My questions are :

  • Well, did anyone succeed in powering up RDV4 with a smartphone?
  • If so, with wich smartphone/cable models?
  • Anyway to increase my OP 6T OTG power?

Regards

LF FSK demodulation of strong / clipped signals

Describe the bug
the signal generated the current dual antenna for FSK signal is very strong, a.k.a clipped.
This makes the FSK modulation to fail if tag is direct on antenna. If you have some distance between tag / antenna the FSK modulation works.

To Reproduce
use a t5577 card direct on lf antenna.

  1. lf awid clone 123
  2. data plot
  3. lf search
  4. lift tag 1cm
  5. lf search

Expected behavior
the demodulation of FSK should work for both strong vs weak signals.

Desktop (please complete the following information):

  • latest source from github

make style

Describe the bug
running make style will generate lots of rows "no such file or directory".

To Reproduce

  1. make style

Expected behavior
No repeating lines

Screenshots

find . \( -name "*.[ch]" -or -name "*.cpp" \) -exec astyle --formatted --mode=c --suffix=none \
            --indent=spaces=4 --indent-switches --indent-preprocessor \
            --keep-one-line-blocks --max-instatement-indent=60 \
            --style=google --pad-oper --unpad-paren --pad-header \
            --align-pointer=name {} \;
find: astyle: No such file or directory
find: astyle: No such file or directory
find: astyle: No such file or directory
find: astyle: No such file or directory

Desktop (please complete the following information):

  • OS: ubuntu 18.04

Additional context

Unable to build on MacOS

While installing to Mac, it throws this error based on the commit added 20 minutes ago.

gcc -MT obj/cmdhflegic.o -MMD -MP -MF obj/cmdhflegic.Td  -std=c99 -D_ISOC99_SOURCE -DPRESETS -I. -I../include -I../common -I../common/polarssl -I../zlib -I../uart -I/opt/local/include -I../liblua -Wall -g -O3 -DHAVE_GUI -DWITH_FLASH -DWITH_SMARTCARD -DWITH_FPC -DZ_SOLO -DZ_PREFIX -DNO_GZIP -DZLIB_PM3_TUNED -c -o obj/cmdhflegic.o cmdhflegic.c
cmdhflegic.c:506:25: error: expected expression
        if ( strlen(Cmd) = 0 | |cmdp == 'h' ) return usage_legic_sim();
                               ^
1 error generated.
make[1]: *** [obj/cmdhflegic.o] Error 1
make: *** [client/all] Error 2

b7d0786#diff-4a54e359a85cf26ddb848e4b65dd2cd3R506

hf snoop looks like unusable.

always show "Trigger kicked!" when using "hf snoop". i try to snoop a key from m1 card and reader by using pm3. when i type hf snoop command then put pm3 near the reader i will receive "Trigger kicked!" immediately. And i got no valuable data by look the hex using "hf list". it do not need a RFID card, just put pm3 near a reader and you will see this .

image

card reader tried: android8.1 phone with NFC, PN532, a reader in an elevator

  • OS: windows 10 pro x64
    `pm3 --> hw version

Proxmark3 RFID instrument

[ CLIENT ]
client: iceman build for RDV40 with flashmem; smartcard;

[ ARM ]
bootrom: iceman/master/75d0b0b0 2019-01-01 20:27:24
os: iceman/master/75d0b0b0 2019-01-01 20:28:17

[ FPGA ]
LF image built for 2s30vq100 on 2018/ 9/ 8 at 13:57:51
HF image built for 2s30vq100 on 2018/ 9/ 3 at 21:40:23

[ Hardware ]
--= uC: AT91SAM7S512 Rev B
--= Embedded Processor: ARM7TDMI
--= Nonvolatile Program Memory Size: 512K bytes, Used: 240818 bytes (46%) Free: 283470 bytes (54%)
--= Second Nonvolatile Program Memory Size: None
--= Internal SRAM Size: 64K bytes
--= Architecture Identifier: AT91SAM7Sxx Series
--= Nonvolatile Program Memory Type: Embedded Flash Memory

pm3 --> hw status
#db# Memory
#db# BIGBUF_SIZE.............40000
#db# Available memory........40000
#db# Tracing
#db# tracing ................1
#db# traceLen ...............40000
#db# Currently loaded FPGA image
#db# mode.................... HF image built for 2s30vq100 on 2018/ 9/ 3 at 21:40:23
#db# Flash memory
#db# Baudrate................24MHz
#db# Init....................OK
#db# Memory size.............2 mbits / 256kb
#db# Unique ID...............0xd567a882a76ec526
#db# Smart card module (ISO 7816)
#db# version.................v2.06
#db# LF Sampling config
#db# [q] divisor.............95 (125 KHz)
#db# [b] bps.................8
#db# [d] decimation..........1
#db# [a] averaging...........Yes
#db# [t] trigger threshold...0
#db# LF T55XX config
#db# [a] startgap............298 (232)
#db# [b] writegap............17
8 (136)
#db# [c] write_0.............158 (120)
#db# [d] write_1.............47
8 (376)
#db# [e] readgap.............15*8 (120)
#db# USB Speed
#db# Sending USB packets to client...
#db# Time elapsed............1500ms
#db# Bytes transferred.......740352
#db# USB Transfer Speed PM3 -> Client = 493568 Bytes/s
#db# Various
#db# MF_DBGLEVEL.............1
#db# ToSendMax...............-1
#db# ToSendBit...............0
#db# ToSend BUFFERSIZE.......2308
#db# Installed StandAlone Mode
#db# LF HID26 standalone - aka SamyRun (Samy Kamkar)
pm3 --> data tune

[=] measuring antenna characteristics, please wait...

....

[!] LF antenna is UNUSABLE

[+] HF antenna: 36.18 V - 13.56 MHz
[+] HF antenna is OK

[-] Not showing LF tuning graph since all values is zero.`

Reader Attack

1- How can we have a reader attack with RDV4!?Is it like Rebooted!?
2- Is there any way to add a battery to the RDV4 like rebooted or chameleon REV-G!?
3- Dose a Reader Attack is just for Mifire card or we can have a same attack for ultralight or etc!?

[idea] implement json/bin everywhere

Is your feature request related to a problem? Please describe.
As of now only parts of the commands has implemented BIN/JSON formats.

Describe the solution you'd like
All commands that involves files, should support BIN/JSON formats.

Describe alternatives you've considered
as an alternative, lua scripts can be made. No more python scripts.

Additional context
All formats we support helps when other tools needs to import/export from a proxmark generated file.
Today we have Chameleon Mini GUI, MCT tool interoperability, and hopefully also Project Walrus in the near future.

Compile Errors with latest pull

lfops.c: In function 'setT55xxConfig':
lfops.c:83:5: error: this 'if' clause does not guard... [-Werror=misleading-indentation]
if (!FlashInit())
^~
lfops.c:86:2: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the 'if'
Flash_CheckBusy(BUSY_TIMEOUT);
^~~~~~~~~~~~~~~
lfops.c: In function 'loadT55xxConfig':
lfops.c:103:5: error: this 'if' clause does not guard... [-Werror=misleading-indentation]
if (!FlashInit())
^~
lfops.c:106:2: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the 'if'
Flash_CheckBusy(BUSY_TIMEOUT);
^~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [obj/lfops.o] Error 1
make: *** [armsrc/all] Error 2

[idea] hf 14b raw - add timeout

Is your feature request related to a problem? Please describe.
Running raw commands which takes long time to execute the response will be cut.
Don't really know if this is a bug or a feature request :)

Describe the solution you'd like
Adding a timeout option like in hf 14a raw this would become a non-issue.

Additional context
brought to my attention by @doegox

HF Antenna Unusable

I am getting HF Antenna Unusable error. I am using the latest version of this repo and have flash the firmware too. bdw, I am doing this for windows. LF Antenna works fine. Please check the attached file:
image

LF broken - not rdv4 specific, all hardware.

Only happening with this firmware. original and iceman are ok. See below:

pm3 --> hw tune

[=] measuring antenna characteristics, please wait...

....

[+] LF antenna: 67.13 V - 125.00 kHz
[+] LF antenna: 41.50 V - 134.00 kHz
[+] LF optimal: 69.11 V - 126.32 kHz
[+] LF antenna is OK

[+] HF antenna: 47.02 V - 13.56 MHz
[+] HF antenna is OK

[+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

No GUI in this build!
pm3 --> lf sear
#db# transfer to client failed :: | bytes between 0 - 512 (512)
#db# transfer to client failed :: | bytes between 512 - 1024 (512)
#db# transfer to client failed :: | bytes between 1024 - 1536 (512)
#db# transfer to client failed :: | bytes between 1536 - 2048 (512)
#db# transfer to client failed :: | bytes between 2048 - 2560 (512)
#db# transfer to client failed :: | bytes between 2560 - 3072 (512)
#db# transfer to client failed :: | bytes between 3072 - 3584 (512)
#db# transfer to client failed :: | bytes between 3584 - 4096 (512)
#db# transfer to client failed :: | bytes between 4096 - 4608 (512)
#db# transfer to client failed :: | bytes between 4608 - 5120 (512)
#db# transfer to client failed :: | bytes between 5120 - 5632 (512)
#db# transfer to client failed :: | bytes between 5632 - 6144 (512)
#db# transfer to client failed :: | bytes between 6144 - 6656 (512)
#db# transfer to client failed :: | bytes between 6656 - 7168 (512)
#db# transfer to client failed :: | bytes between 7168 - 7680 (512)
#db# transfer to client failed :: | bytes between 7680 - 8192 (512)
#db# transfer to client failed :: | bytes between 8192 - 8704 (512)
#db# transfer to client failed :: | bytes between 8704 - 9216 (512)
#db# transfer to client failed :: | bytes between 9216 - 9728 (512)
#db# transfer to client failed :: | bytes between 9728 - 10240 (512)
#db# transfer to client failed :: | bytes between 10240 - 10752 (512)
#db# transfer to client failed :: | bytes between 10752 - 11264 (512)
#db# transfer to client failed :: | bytes between 11264 - 11776 (512)
#db# transfer to client failed :: | bytes between 11776 - 12288 (512)
#db# transfer to client failed :: | bytes between 12288 - 12800 (512)
#db# transfer to client failed :: | bytes between 12800 - 13312 (512)
#db# transfer to client failed :: | bytes between 13312 - 13824 (512)
#db# transfer to client failed :: | bytes between 13824 - 14336 (512)
#db# transfer to client failed :: | bytes between 14336 - 14848 (512)
#db# transfer to client failed :: | bytes between 14848 - 15360 (512)
#db# transfer to client failed :: | bytes between 15360 - 15872 (512)
#db# transfer to client failed :: | bytes between 15872 - 16384 (512)
#db# transfer to client failed :: | bytes between 16384 - 16896 (512)
#db# transfer to client failed :: | bytes between 16896 - 17408 (512)
#db# transfer to client failed :: | bytes between 17408 - 17920 (512)
#db# transfer to client failed :: | bytes between 17920 - 18432 (512)
#db# transfer to client failed :: | bytes between 18432 - 18944 (512)
#db# transfer to client failed :: | bytes between 18944 - 19456 (512)
#db# transfer to client failed :: | bytes between 19456 - 19968 (512)
#db# transfer to client failed :: | bytes between 19968 - 20480 (512)
#db# transfer to client failed :: | bytes between 20480 - 20992 (512)
#db# transfer to client failed :: | bytes between 20992 - 21504 (512)
#db# transfer to client failed :: | bytes between 21504 - 22016 (512)
#db# transfer to client failed :: | bytes between 22016 - 22528 (512)
#db# transfer to client failed :: | bytes between 22528 - 23040 (512)
#db# transfer to client failed :: | bytes between 23040 - 23552 (512)
#db# transfer to client failed :: | bytes between 23552 - 24064 (512)
#db# transfer to client failed :: | bytes between 24064 - 24576 (512)
#db# transfer to client failed :: | bytes between 24576 - 25088 (512)
#db# transfer to client failed :: | bytes between 25088 - 25600 (512)
#db# transfer to client failed :: | bytes between 25600 - 26112 (512)
#db# transfer to client failed :: | bytes between 26112 - 26624 (512)
#db# transfer to client failed :: | bytes between 26624 - 27136 (512)
#db# transfer to client failed :: | bytes between 27136 - 27648 (512)
#db# transfer to client failed :: | bytes between 27648 - 28160 (512)
#db# transfer to client failed :: | bytes between 28160 - 28672 (512)
#db# transfer to client failed :: | bytes between 28672 - 29184 (512)
#db# transfer to client failed :: | bytes between 29184 - 29696 (512)
#db# transfer to client failed :: | bytes between 29696 - 30000 (304)
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible

Checking for known tags:

HID Prox TAG ID: 20041400cd (102) - Format Len: 26bit - FC: 10 - Card: 102

[+] Valid HID Prox ID Found!

#db# transfer to client failed :: | bytes between 0 - 512 (512)
#db# transfer to client failed :: | bytes between 512 - 1024 (512)
#db# transfer to client failed :: | bytes between 1024 - 1536 (512)
#db# transfer to client failed :: | bytes between 1536 - 2048 (512)
#db# transfer to client failed :: | bytes between 2048 - 2560 (512)
#db# transfer to client failed :: | bytes between 2560 - 3072 (512)
#db# transfer to client failed :: | bytes between 3072 - 3584 (512)
#db# transfer to client failed :: | bytes between 3584 - 4096 (512)
#db# transfer to client failed :: | bytes between 4096 - 4608 (512)
#db# transfer to client failed :: | bytes between 4608 - 5120 (512)
#db# transfer to client failed :: | bytes between 5120 - 5632 (512)
#db# transfer to client failed :: | bytes between 5632 - 6000 (368)
#db# transfer to client failed :: | bytes between 0 - 512 (512)
#db# transfer to client failed :: | bytes between 512 - 1024 (512)
#db# transfer to client failed :: | bytes between 1024 - 1536 (512)
#db# transfer to client failed :: | bytes between 1536 - 2048 (512)
#db# transfer to client failed :: | bytes between 2048 - 2560 (512)
#db# transfer to client failed :: | bytes between 2560 - 3072 (512)
#db# transfer to client failed :: | bytes between 3072 - 3584 (512)
#db# transfer to client failed :: | bytes between 3584 - 4096 (512)
#db# transfer to client failed :: | bytes between 4096 - 4608 (512)
#db# transfer to client failed :: | bytes between 4608 - 5120 (512)
#db# transfer to client failed :: | bytes between 5120 - 5632 (512)
#db# transfer to client failed :: | bytes between 5632 - 6144 (512)
#db# transfer to client failed :: | bytes between 6144 - 6656 (512)
#db# transfer to client failed :: | bytes between 6656 - 7168 (512)
#db# transfer to client failed :: | bytes between 7168 - 7679 (511)
pm3 -->

pm3 --> lf t5 det
#db# transfer to client failed :: | bytes between 0 - 512 (512)
#db# transfer to client failed :: | bytes between 512 - 1024 (512)
#db# transfer to client failed :: | bytes between 1024 - 1536 (512)
#db# transfer to client failed :: | bytes between 1536 - 2048 (512)
#db# transfer to client failed :: | bytes between 2048 - 2560 (512)
#db# transfer to client failed :: | bytes between 2560 - 3072 (512)
#db# transfer to client failed :: | bytes between 3072 - 3584 (512)
#db# transfer to client failed :: | bytes between 3584 - 4096 (512)
#db# transfer to client failed :: | bytes between 4096 - 4608 (512)
#db# transfer to client failed :: | bytes between 4608 - 5120 (512)
#db# transfer to client failed :: | bytes between 5120 - 5632 (512)
#db# transfer to client failed :: | bytes between 5632 - 6144 (512)
#db# transfer to client failed :: | bytes between 6144 - 6656 (512)
#db# transfer to client failed :: | bytes between 6656 - 7168 (512)
#db# transfer to client failed :: | bytes between 7168 - 7679 (511)
Chip Type : T55x7
Modulation : FSK2a
Bit Rate : 4 - RF/50
Inverted : Yes
Offset : 32
Seq. Term. : No
Block0 : 0x00107060

pm3 -->

[idea] Mifare Classic with fixed nonce

Is your feature request related to a problem? Please describe.
There has been in the wild some clones, like Fudan and some uid changeable card which doesn't have the NACK bug and they use somewhat odd a fixed nonce. Rendering all current Mifare classic attacks useless.

Describe the solution you'd like
A new command hf mf fixednonce that can recover the keys from such a card

Describe alternatives you've considered
Some progress has been done with Fudan cards but they involve sniffing traffic and reuse.

MacOS Install Instructions

I followed the MacOS instructions, and they did not work.

$ brew tap RfidResearchGroup/proxmark3
Updating Homebrew...
==> Auto-updated Homebrew!
Updated 1 tap (homebrew/core).
==> Updated Formulae
openssl ✔                  azure-cli                  beast                      cquery                     geoipupdate                influxdb                   lxc                        protobuf-c                 wtf

==> Tapping rfidresearchgroup/proxmark3
Cloning into '/usr/local/Homebrew/Library/Taps/rfidresearchgroup/homebrew-proxmark3'...
remote: Counting objects: 5, done.
remote: Compressing objects: 100% (5/5), done.
remote: Total 5 (delta 0), reused 0 (delta 0), pack-reused 0
Unpacking objects: 100% (5/5), done.
Tapped 1 formula (30 files, 28KB).
$ brew install proxmark3
Error: rfidresearchgroup/proxmark3/proxmark3 is a head-only formula
Install with `brew install --HEAD rfidresearchgroup/proxmark3/proxmark3`
$ brew install --HEAD proxmark3
==> Installing proxmark3 from rfidresearchgroup/proxmark3
Error: No available formula with the name "rfidresearchgroup/proxmark3/arm-none-eabi-gcc" (dependency of rfidresearchgroup/proxmark3/proxmark3)
==> Searching for a previously deleted formula (in the last month)...
Error: No previously deleted formula found.
==> Searching for similarly named formulae...
Error: No similarly named formulae found.

I'm not sure what to do here.

lf t55xx detect failing IF t55 is set to EM modulation

When writing an EM ID to a t55 the command "lf t55 detect" no longer detects the modulation automatically

Command output below:

pm3 --> lf sear
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible

Checking for known tags:

HID Prox TAG ID: 1122334455 (41514) - Format Len: 37bit - FC: 4643 - Card: 107050

[+] Valid HID Prox ID Found!

pm3 --> lf t5 det
Chip Type : T55x7
Modulation : FSK2a
Bit Rate : 4 - RF/50
Inverted : Yes
Offset : 31
Seq. Term. : No
Block0 : 0x00107060

pm3 --> lf em 410x_write 0F0368568B 1
Writing T55x7 tag with UID 0x0f0368568b (clock rate: 64)
pm3 --> #db# Started writing T55x7 tag ...
#db# Clock rate: 64
#db# Tag T55x7 written with 0xff83c03322a646e4

pm3 --> lf sear
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible

Checking for known tags:

EM410x pattern found

EM TAG ID : 0F0368568B

Possible de-scramble patterns
Unique TAG ID : F0C0166AD1
HoneyWell IdentKey {
DEZ 8 : 06837899
DEZ 10 : 0057169547
DEZ 5.5 : 00872.22155
DEZ 3.5A : 015.22155
DEZ 3.5B : 003.22155
DEZ 3.5C : 104.22155
DEZ 14/IK2 : 00064481678987
DEZ 15/IK3 : 001034014845649
DEZ 20/ZK : 15001200010606101301
}
Other : 22155_104_06837899
Pattern Paxton : 259822731 [0xF7C948B]
Pattern 1 : 9750181 [0x94C6A5]
Pattern Sebury : 22155 104 6837899 [0x568B 0x68 0x68568B]

[+] Valid EM410x ID Found!

pm3 --> lf t5 det
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
pm3 -->

Latest pull, clean build, RDV3 hardware.

Consider recreating repo as a fork of iceman1001/proxmark3

Since this repo wasn't created via the "fork" button on the iceman1001 (or even the proxmark/proxmark3 repo) you can't easily create a PR for the upstream or iceman1001 repo and this repo with just a click. It's a minor thing, but it means that the first time someone wants to contribute a patch to iceman1001 and this repo that they need to fork both repos and create a PR in both of their forks.

Since the commit hashes will be the same you should be able to delete this repo, fork iceman1001 here again, and then git push -f the correct state back in with nobody being the wiser.

EMV with contactless card: fail + unresponsive + no typeB

I've used the new compile option make PLATFORM=PM3OLD512 for my old proxmark3 with 512k memory. However, I get the following errors with the emv function:

[=] UART Setting serial baudrate 460800

 [ Proxmark3 RFID instrument ]
          

 [ CLIENT ]          
  client: iceman  
          
 [ ARM ]
 bootrom: master/v3.0.1-401-g53edb04-suspect 2018-09-13 18:14:59
      os: iceman/master/9f9ee2f1 2019-03-16 12:49:18

 [ FPGA ]
 LF image built for 2s30vq100 on 2018/ 9/ 8 at 13:57:51
 HF image built for 2s30vq100 on 2018/ 9/ 3 at 21:40:23          

 [ Hardware ]           
  --= uC: AT91SAM7S512 Rev A          
  --= Embedded Processor: ARM7TDMI          
  --= Nonvolatile Program Memory Size: 512K bytes, Used: 230598 bytes (44%) Free: 293690 bytes (56%)          
  --= Second Nonvolatile Program Memory Size: None          
  --= Internal SRAM Size: 64K bytes          
  --= Architecture Identifier: AT91SAM7Sxx Series          
  --= Nonvolatile Program Memory Type: Embedded Flash Memory          

          
pm3 --> emv search
[=] Channel: CONTACTLESS          
[!!] APDU: Reply timeout.          
[!!] APDU: Reply timeout.          
UART:: write time-out
[!] sending bytes to proxmark failed          
[!!] APDU: Reply timeout.          
[-] Retry failed [A00000000305076010]. Skipped...          
UART:: write time-out
[!] sending bytes to proxmark failed          
[!!] APDU: Reply timeout.          
UART:: write time-out
[!] sending bytes to proxmark failed  
...

EDIT: Same behavior with or without tag.

hf legic sim / Legic Simulation does not work properly

I have the Proxmark 3 RDV4 and tried simulation of a legic prime card.
I used the steps

  • hf legic dump (I used a MIM1024 card and had to increase timeouts in the client, otherwise reads would fail)
  • hf legic eload 2
  • hf legic sim 2
    If i recall correctly, at this point LED A is activated and as soon as I get close to the reader LED B and C flash fast, they appear in different intensities. The reader does not react at all.

From older forum posts and issues I saw "timing errors" mentioned, but I thought with #25 this has been fixed.

Can I somehow help with the debugging/development of this feature? I have experience with programming and electronics as well as some tools like oscilloscope.
I do not know where to start or what to check because I'm not familiar with the project yet. Maybe someone has an idea?

Broken Proxmark3 Rv4.0 after initial flash (Kickstarter Edition)

I was redirected here by Dennis from the Kickstarter messaging board.

My original Message from 2018/7/31:

I do have have problem with my proxmark. I followed the update instructions at https://github.com/Proxmark/proxmark3/wiki/Kali-Linux

When flashing the new bootrom the following output was produced:

andy@CargoCult:~/Tools/proxmark3/client$ sudo ./flasher /dev/ttyACM0 ../armsrc/obj/fullimage.elf
Loading ELF file '../armsrc/obj/fullimage.elf'...
Loading usable ELF segments:
0: V 0x00102000 P 0x00102000 (0x0002c398->0x0002c398) [R X] @0x94
1: V 0x00200000 P 0x0012e398 (0x00001938->0x00001938) [RW ] @0x2c42c
Note: Extending previous segment from 0x2c398 to 0x2dcd0 bytes

Waiting for Proxmark to appear on /dev/ttyACM0 .
Found.
#db# unknown command:: 0xc20d540d
Entering bootloader...
(Press and release the button only to abort)
Waiting for Proxmark to appear on /dev/ttyACM0 ............
Found.

Flashing...
Writing segments for file: ../armsrc/obj/fullimage.elf
0x00102000..0x0012fccf [0x2dcd0 / 367 blocks]....................Waiting for a response from the proxmark...
You can cancel this operation by pressing the pm3 button

After half an hour I canceled the operation. now the proxmark is not detected when plugging in (the A and C lights are red, all four blue lights are lit).

Error-wise I get the following dmesg output:

[ 413.180442] usb 3-4: new full-speed USB device number 26 using xhci_hcd
[ 413.584453] usb 3-4: device descriptor read/64, error -71
[ 416.404493] usb 3-4: New USB device found, idVendor=9ac4, idProduct=4b8f, bcdDevice= 1.00
[ 416.404501] usb 3-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 416.404504] usb 3-4: Product: PM3 Device
[ 416.404506] usb 3-4: Manufacturer: proxmark.org
[ 416.405276] usb 3-4: can't set config #1, error -71
[ 416.405346] usb 3-4: USB disconnect, device number 26

After that Dennis told me on 2018/8/16:

Sorry for delay. Change the cable as we realise there is 1% faulty cables within this KS shipment

As well as (on 2018/9/18):

https://github.com/RfidResearchGroup/proxmark3

Try the new one.

I think your issue is the jumping ports ?

Hold the white button when flashing so the ports will not jump. As I can see now, the proxmark3 is in brick mode.

This was my answer when I tried the suggested fix:

still the same (initially all red and blue lights were blinking), now the A/C lights are red.

Output during flashing:

~/Tools/proxmark3$ sudo client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf armsrc/obj/fullimage.elf
Loading ELF file 'bootrom/obj/bootrom.elf'...
Loading usable ELF segments:
0: V 0x00100000 P 0x00100000 (0x00000200->0x00000200) [R X] @0x94
1: V 0x00200000 P 0x00100200 (0x00000c8c->0x00000c8c) [R X] @0x298

Loading ELF file 'armsrc/obj/fullimage.elf'...
Loading usable ELF segments:
0: V 0x00102000 P 0x00102000 (0x0002bb98->0x0002bb98) [R X] @0x94
1: V 0x00200000 P 0x0012db98 (0x00001964->0x00001964) [RW ] @0x2bc2c
Note: Extending previous segment from 0x2bb98 to 0x2d4fc bytes

Waiting for Proxmark to appear on /dev/ttyACM0 ................
Found.
Waiting for a response from the proxmark...
You can cancel this operation by pressing the pm3 button

This will not finish. Dmesg shows, that the USB device disconnects:

[ 1997.250509] usb 3-4: New USB device found, idVendor=9ac4, idProduct=4b8f, bcdDevice= 1.00
[ 1997.250513] usb 3-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1997.250515] usb 3-4: Product: PM3 Device
[ 1997.250517] usb 3-4: Manufacturer: proxmark.org
[ 1997.250519] usb 3-4: SerialNumber: 888
[ 1997.251321] cdc_acm 3-4:1.0: ttyACM0: USB ACM device
[ 2015.077421] cdc_acm 3-4:1.0: failed to set dtr/rts
[ 2015.319739] usb 3-4: USB disconnect, device number 11
[ 2015.734344] usb 3-4: new full-speed USB device number 12 using xhci_hcd

To this Dennis answered (2018/9/18):

https://github.com/RfidResearchGroup/proxmark3

Test it on a windows computer first.

If not, post an issue here on github.

Sorry for delay.

I did test it under Windows (also on 2018/9/18), found out the following:

Hi, just tested it with Windows: problem is, that the proxmark is not even detected by windows (so no driver is installed). Should I post my Linux findings (and the windows problem) to github or should I test something else before?

I'm still very disturbed that my proxmark seems to be in a bricked state (and I was following the gitlab instructions to the point).

As there was no feedback in the month since I'm moving this to github. I'm still very disturbed that my proxmark3 seems to be bricked after I was using your supplied cable and your instructions to the letter. Not very happy about this.

hf 15: possible truncations

Describe the bug

The compiler warns us of two potential truncations in CmdHF15Restore when creating new commands internally:

cmdhf15.c: In function ‘CmdHF15Restore’:
cmdhf15.c:825:25: warning: ‘strncat’ output may be truncated copying 254 bytes from a string of length 999 [-Wstringop-truncation]
                         strncat(newCmdPrefix, param, sizeof(newCmdPrefix) - 1);
                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

So in newCmdPrefix (255) we may have to squeeze 1000b (FILE_PATH_SIZE)

cmdhf15.c:900:9: note: ‘snprintf’ output between 6 and 516 bytes into a destination of size 255
         snprintf(tmpCmd, sizeof(tmpCmd), "%s u %u %s", newCmdPrefix, i, hex);
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

So in tmpCmd (255) we may have to squeeze 4b + 255b (newCommandPrefix, itself a truncated version of FILE_PATH_SIZE, see above) + 2b + 255b (hex)

I'm not sure yet which buffers can be extended or not or if user must be warned of too long paths / too long hex.

compiler errors

@merlokk ...yours :)

Describe the bug
compiler warning GCC7.3.0

To Reproduce

  • git pull
  • make clean; make

Expected behavior
no compiler warnings

Screenshots
If applicable, add screenshots to help explain your problem.
image

Desktop (please complete the following information):

  • OS: UBUNTU 18.04 64b

hf mf cload

Describe the bug
Since the name template change of filenames when saving dump files etc, the template starts with h , as in "hf-mf-UID.bin" or similar. All older commands still not adapted, they assume if first char is 'h' its a request for helptext.

To Reproduce
Steps to reproduce the behavior:

  1. create a dump, hf mf dump
  2. convert from bin to emul, script run dumptoemul -h
  3. try restoring onto magic card, hf mf cload hf-mf-ZZZZ

the help text is shown..

Expected behavior
Expected behavior is to load the file

Additional context
All older commands should have a param 'f' as for indicating a filename entry.
this is a breaking change from old style command which uses without a param but only filename.

Also all commands should be able to load eml/bin without having to choose. in fileutils.c should have support for auto-detect and load of those two kinds of formats. In the future I see also support for reading json,

#db# unknown command:: 0xd32d410d

Describe the bug
Get #db#messages at first start of client:
[=] UART Setting serial baudrate 460800
#db# unknown command:: 0xd32d410d
If I exit client next time this message doesn't appear

To Reproduce

  1. Compiled and flashed fresh RDV4
  2. Connect it
  3. Start client
  4. Message appears

Expected behavior
#db# unknown command will not be shown.

Screenshots
sh_pm3

Desktop (please complete the following information):

  • OS: ubuntu 18.04.1 LTS x64
  • inside proxmark3 client run the following commands and paste the output here.
  • hw version
    Proxmark3 RFID instrument

[ CLIENT ]
client: iceman build for RDV40 with flashmem; smartcard;

 [ ARM ]
 bootrom: iceman/master/259dbadb 2018-12-04 13:30:56
      os: iceman/master/259dbadb 2018-12-04 13:30:58
 [ FPGA ]
 LF image built for 2s30vq100 on 2018/ 9/ 8 at 13:57:51
 HF image built for 2s30vq100 on 2018/ 9/ 3 at 21:40:23    
 [ Hardware ]           
  --= uC: AT91SAM7S512 Rev A          
  --= Embedded Processor: ARM7TDMI          
  --= Nonvolatile Program Memory Size: 512K bytes, Used: 241920 bytes (46%) Free: 282368 bytes (54%)          
  --= Second Nonvolatile Program Memory Size: None          
  --= Internal SRAM Size: 64K bytes          
  --= Architecture Identifier: AT91SAM7Sxx Series          
  --= Nonvolatile Program Memory Type: Embedded Flash Memory
  • hw status
#db# Memory          
#db#   BIGBUF_SIZE.............40000          
#db#   Available memory........40000          
#db# Tracing          
#db#   tracing ................1          
#db#   traceLen ...............0          
#db# Currently loaded FPGA image          
#db#   mode.................... HF image built for 2s30vq100 on 2018/ 9/ 3 at 21:40:23          
#db# Flash memory          
#db#   Baudrate................24MHz          
#db#   Init....................OK          
#db#   Memory size.............2 mbits / 256kb          
#db#   Unique ID...............0xd567a882a70f7f26          
#db# Smart card module (ISO 7816)          
#db#   version.................v2.06          
#db# LF Sampling config          
#db#   [q] divisor.............95 (125 KHz)          
#db#   [b] bps.................8          
#db#   [d] decimation..........1          
#db#   [a] averaging...........Yes          
#db#   [t] trigger threshold...0          
#db# LF T55XX config          
#db#   [a] startgap............29*8 (232)          
#db#   [b] writegap............17*8 (136)          
#db#   [c] write_0.............15*8 (120)          
#db#   [d] write_1.............47*8 (376)          
#db#   [e] readgap.............15*8 (120)          
#db# USB Speed          
#db#   Sending USB packets to client...          
#db#   Time elapsed............1500ms          
#db#   Bytes transferred.......809984          
#db#   USB Transfer Speed PM3 -> Client = 539989 Bytes/s          
#db# Various          
#db#   MF_DBGLEVEL.............1          
#db#   ToSendMax...............-1          
#db#   ToSendBit...............0          
#db#   ToSend BUFFERSIZE.......2308          
#db# Installed StandAlone Mode          
#db#    LF HID26 standalone - aka SamyRun (Samy Kamkar)   
  • data tune
pm3 --> data tune
          
[=] measuring antenna characteristics, please wait...
          
....
          
[+] LF antenna: 72,94 V - 125.00 kHz          
[+] LF antenna: 39,23 V - 134.00 kHz          
[+] LF optimal: 72,94 V - 125,00 kHz          
[+] LF antenna is OK  
          
[+] HF antenna: 48,15 V - 13.56 MHz          
[+] HF antenna is OK           
          
[+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

Additional context
n/a

hf mf hardnested.. broken?

When I try to do a hardnested attack, I get:
Apply bit flip properties | nan | nand

I am not sure if it has something to to with the os, but I am using OSX. The nan|nand, goes on forever.

The iceman repo does not have this problem.

I didn't have to to dive into this yet. But I thought it might be good to share the issue.

Possible double free

After last changes with resolving memory leaks I'm unable to preform fully hardnested attack - using modified version of iceman old hardnested script :)
When script runs key checking sometimes there is a nasty suprise:



> [+] Using AVX SIMD core.          
> 
> 
>           
>  time    | #nonces | Activity                                                | expected to brute force          
>          |         |                                                         | #states         | time           
> ------------------------------------------------------------------------------------------------------          
>        0 |       0 | Start using 4 threads and AVX SIMD core                 |                 |          
>        0 |       0 | Brute force benchmark: 262 million (2^28,0) keys/s      | 140737488355328 |    6d          
>        1 |       0 | Using 235 precalculated bitflip state tables            | 140737488355328 |    6d          
> #db# AcquireNonces: Auth1 error          
>        5 |     112 | Apply bit flip properties                               |  10142311514112 |   11h          
>        6 |     224 | Apply bit flip properties                               |   8605346562048 |    9h          
>        7 |     335 | Apply bit flip properties                               |   8444816916480 |    9h          
>        9 |     445 | Apply bit flip properties                               |   8386506129408 |    9h          
>       10 |     555 | Apply bit flip properties                               |   8378623459328 |    9h          
>       11 |     666 | Apply bit flip properties                               |   8378623459328 |    9h          
>       11 |     777 | Apply bit flip properties                               |   8378623459328 |    9h          
>       12 |     887 | Apply bit flip properties                               |   8378623459328 |    9h          
>       13 |     997 | Apply bit flip properties                               |   8378623459328 |    9h          
>       13 |    1108 | Apply bit flip properties                               |   8378623459328 |    9h          
>       14 |    1216 | Apply bit flip properties                               |   8378623459328 |    9h          
>       15 |    1326 | Apply bit flip properties                               |   8378623459328 |    9h          
>       17 |    1437 | Apply Sum property. Sum(a0) = 0                         |    680740257792 | 43min          
>       17 |    1545 | Apply bit flip properties                               |    299168268288 | 19min          
>       18 |    1655 | Apply bit flip properties                               |    299165908992 | 19min          
>       19 |    1764 | Apply bit flip properties                               |    299168268288 | 19min          
>       20 |    1875 | Apply bit flip properties                               |    299168268288 | 19min          
>       21 |    1982 | Apply bit flip properties                               |    299168268288 | 19min          
>       22 |    2090 | Apply bit flip properties                               |    299168268288 | 19min          
>       22 |    2090 | (1. guess: Sum(a8) = 0)                                 |    299168268288 | 19min          
>       24 |    2090 | Apply Sum(a8) and all bytes bitflip properties          |    256709115904 | 16min          
>       26 |    2090 | (2. guess: Sum(a8) = 64)                                |    978981879808 | 62min          
>       31 |    2090 | Apply Sum(a8) and all bytes bitflip properties          |    917501706240 | 58min          
>       38 |    2090 | Brute force phase:  11,99%	                             |    917216165888 | 58min          
>       43 |    2090 | Brute force phase completed. Key found: <censored>   |               0 |    0s          
> ###	check_found_keys
> #db# ChkKeys: Can't select card (ALL)          
> ###	target key B - Sector 1 block: 4 [0x04]
> [+] Using AVX SIMD core.          
> 
> 
>           
>  time    | #nonces | Activity                                                | expected to brute force          
>          |         |                                                         | #states         | time           
> ------------------------------------------------------------------------------------------------------          
>        0 |       0 | Start using 4 threads and AVX SIMD core                 |                 |          
>        0 |       0 | Brute force benchmark: 262 million (2^28,0) keys/s      | 140737488355328 |    6d          
>        1 |       0 | Using 235 precalculated bitflip state tables            | 140737488355328 |    6d          
>        5 |     112 | Apply bit flip properties                               |    102006292480 |  6min          
>        6 |     223 | Apply bit flip properties                               |     26656464896 |  2min          
>        7 |     334 | Apply bit flip properties                               |     26204344320 |  2min          
>        8 |     444 | Apply bit flip properties                               |     23270062080 |   89s          
>        9 |     555 | Apply bit flip properties                               |     23270062080 |   89s          
>       10 |     664 | Apply bit flip properties                               |     23155558400 |   88s          
>       11 |     775 | Apply bit flip properties                               |     21135179776 |   81s          
>       12 |     886 | Apply bit flip properties                               |     21135179776 |   81s          
>       13 |     997 | Apply bit flip properties                               |     21135179776 |   81s          
>       13 |    1104 | Apply bit flip properties                               |     21135179776 |   81s          
> #db# AcquireNonces: Auth1 error          
>       14 |    1212 | Apply bit flip properties                               |     21135179776 |   81s          
>       15 |    1322 | Apply bit flip properties                               |     21135179776 |   81s          
>       16 |    1433 | Apply bit flip properties                               |     21135179776 |   81s          
>       18 |    1544 | Apply Sum property. Sum(a0) = 128                       |      2343664640 |    9s          
>       19 |    1653 | Apply bit flip properties                               |      1892741888 |    7s          
>       20 |    1762 | Apply bit flip properties                               |      1892741888 |    7s          
> #db# AcquireNonces: Auth1 error          
>       20 |    1868 | Apply bit flip properties                               |      1892741888 |    7s          
>       21 |    1868 | (Ignoring Sum(a8) properties)                           |      1892741888 |    7s          
>       27 |    1868 | Brute force phase completed. Key found: <censored>    |               0 |    0s          
> double free or corruption (out)
> Segmentation fault (core dumped)

I guess its because my shitty card is having some truble with keys checking at sector 4, key B with faster uart path, and memory is freed even if there is timeout
This message "normally" shows, when check_keys function is unable to determine newly found key:


###	check_found_keys
UART:: write time-out
[!] sending bytes to proxmark failed

Meanwhile i checkouted to 956899b839e3a3ec35b1f5167ec1d1bde9cb4c5c and its working perfectly :)

[idea] megamos / aut64

Is your feature request related to a problem? Please describe.
Seeing there has been research into these crypton and no implementations (well hitag2 exists )in the pm3 client.

Describe the solution you'd like
The standard command set, like info, read, write, dump, restore inside pm3 client

Additional context
links to documentation is available.

Compiling issue for RDV20 target board

Hello,

Following instruction :

    In order for  PM3 RDV20,  PM3 RDV30 etc to be flashed with RRG Repo ,  you must edit  these two Makefiles.  You need to remove 

    1. client/Makefile    (comment out one line   WITH_FPC etc )
    2. armsrc/Makefile   (comment out three line and move out.  WITH_FPC, WITH_SMARTCARD,  WITH_FLASH)

    recompile and your older device will work nicely

It fail on cmdflashmem.c compilation error, I guess cmdsources should also contain ifdef instruction to include or not fpc, smartcard and flash sources.

Side question: I flashed RDV40 HEAD on a RDV20 (without the mod above), the board doesn't appear anymore after the flash (bootroom and fullimage) in /dev. Is it normal? (I reverted to HEAD of main line in the meantime don't worry).

Thanks,

EM Marine card read is broken

Describe the bug
EM Marine card read is broken after last commits.

Without card attached:
pm3 --> lf em 410x_read
LF Signal properties:
high..........15
low...........-7
mean..........2
amplitude.....13
is Noise......No
THRESHOLD noice amplitude......10
[#] DEBUG: (setClockGrid) demodoffset 0, clk 0
[#] DEBUG: (ASKDemod_ext) Bitlen from grphbuff: 8192
getHiLo fuzzed: High 37 | Low 20
getHiLo fuzzed: High 43 | Low 26
getHiLo fuzzed: High 43 | Low 26
DEBUG: (askdemod_ext) CLEAN: startIdx 0, alignPos 0
[#] DEBUG: (ASKDemod_ext) No data found errors:-1, invert:0, bitlen:0, clock:8

With card attached:
pm3 --> lf em 410x_read
LF Signal properties:
high..........125
low...........-128
mean..........-5
amplitude.....130
is Noise......No
THRESHOLD noice amplitude......10
[#] DEBUG: (setClockGrid) demodoffset 0, clk 0
[#] DEBUG: (ASKDemod_ext) Bitlen from grphbuff: 8192
getHiLo fuzzed: High 125 | Low -76
getHiLo fuzzed: High 125 | Low -64
getHiLo fuzzed: High 125 | Low -64
DEBUG: (askdemod_ext) CLEAN: startIdx 0, alignPos 0
[#] DEBUG: (ASKDemod_ext) No data found errors:-1, invert:0, bitlen:0, clock:32

pm3 --> hw version

Proxmark3 RFID instrument

[ CLIENT ]
client: iceman build for RDV40 with flashmem; smartcard;

[ ARM ]
bootrom: iceman/master/ 2018-09-05 14:29:59
os: iceman/master/ 2018-09-06 10:17:49

[ FPGA ]
LF image built for 2s30vq100 on 2017/10/25 at 19:50:50
HF image built for 2s30vq100 on 2018/ 8/10 at 11:48:34

[ Hardware ]
--= uC: AT91SAM7S512 Rev B
--= Embedded Processor: ARM7TDMI
--= Nonvolatile Program Memory Size: 512K bytes, Used: 242267 bytes (46) Free: 282021 bytes (54)
--= Second Nonvolatile Program Memory Size: None
--= Internal SRAM Size: 64K bytes
--= Architecture Identifier: AT91SAM7Sxx Series
--= Nonvolatile Program Memory Type: Embedded Flash Memory

pm3 --> hw status
#db# Memory
#db# BIGBUF_SIZE.............40000
#db# Available memory........40000
#db# Tracing
#db# tracing ................1
#db# traceLen ...............0
#db# Currently loaded FPGA image
#db# mode.................... LF image built for 2s30vq100 on 2017/10/25 at 19:50:50
#db# Flash memory
#db# init....................OK
#db# Memory size.............2 mbits / 256kb
#db# Unique ID...............0xd567a882a7bb8e25
#db# Smart card module (ISO 7816)
#db# version.................v2.06
#db# LF Sampling config
#db# [q] divisor.............95 (125 KHz)
#db# [b] bps.................8
#db# [d] decimation..........1
#db# [a] averaging...........Yes
#db# [t] trigger threshold...0
#db# USB Speed
#db# Sending USB packets to client...
#db# Time elapsed............1500ms
#db# Bytes transferred.......780800
#db# USB Transfer Speed PM3 -> Client = 520533 Bytes/s
#db# Various
#db# MF_DBGLEVEL.............1
#db# ToSendMax...............-1
#db# ToSendBit...............0
#db# ToSend BUFFERSIZE.......2308
#db# Installed StandAlone Mods
#db# LF HID26 standalone - aka SamyRun (Samy Kamkar)

pm3 --> data tune

[=] measuring antenna characteristics, please wait...

...

[+] LF antenna: 57.64 V - 125.00 kHz
[+] LF antenna: 42.77 V - 134.00 kHz
[+] LF optimal: 61.47 V - 127.66 kHz
[+] LF antenna is OK

[+] HF antenna: 48.01 V - 13.56 MHz
[+] HF antenna is OK

[+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

Creation of symlink for OS X - location ?

As the title suggests. In either install.sh or update.sh, I want to create a symlink that points the /dev/cu.usbmodem*** to /dev/pm3.

Where should this function be placed?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.