Commit graph

128 commits

Author SHA1 Message Date
iceman1001
6a18e46fa6 FIX: finally I took the effort to finish the "hf mf c*" commands on device side... 2016-02-15 22:04:24 +01:00
iceman1001
65c2d21d05 CHG: Syntax suger 2016-01-25 20:19:15 +01:00
iceman1001
810f53792e ADD: added the possibility to choose which block num to attack with "hf mf mifare" Before it only worked on block 0. 2016-01-20 22:26:01 +01:00
iceman1001
5ebcb867a3 FIX: Some uninitialized variables, some syntax suger, and some extra WDT_HIT calls inside "ReaderMifare" to stop it from trigger when running multiple times in a row. 2016-01-20 19:53:58 +01:00
iceman1001
d798d31cbe FIX: Coverity scans, uninitialized variables,
CHG: unfolded some loops..
2016-01-20 17:44:51 +01:00
iceman1001
4a71da5a35 FIX: Coverity Scan complains about resourceleaks, array reads outside of index, uninitialized variables. 2016-01-20 17:13:25 +01:00
iceman1001
9332b857ff ADD: @marshmellow42 's fixes for Q5, t55xx, fskclock,
ADD:  got tired of always writing wrong "hf 14a list",  so I hooked it back up to call the "hf list" with argument. Things becomes smoother that way.
2015-12-16 11:01:46 +01:00
iceman1001
f8ada309e9 ADD: @pwpiwi 's latest code from his 'hardnested' branch. 2015-12-15 08:51:29 +01:00
iceman1001
c188b1b9b2 ADD: @go_tus simple bruteforce for t55xx, refactored a bit.
ADD: @pwpiwi 's implementation of Hardnested
2015-11-27 16:24:00 +01:00
iceman1001
0956e0dba5 FIX: an error that I introduced to the csetblock command with wrong length of crc calcs.
CHG:  variable name in csetblock change.  just trying to be consistant.
ADD:  code clean up in hf 14a,  added some help text methods.
2015-11-10 11:45:45 +01:00
iceman1001
c2731f37be CHG: a major remake of the "hf mf c*" commands. Ie chinese magic tags. Tried to make them consistent in parameter calls and simplified. And fixed the annoying gen1 tags that answers with a ACK/NACK on HALT commands.. 2015-11-09 21:46:15 +01:00
iceman1001
acd7ccdbc9 CHG: some magic generation1 tags is not following protocol and answers to the "halt" command. This gives an error and makes the users think something went wrong. This also affected the magic identification in "Hf 14a reader" command, where it in those moments stated "NO" even if the tag is indeed a generation1. 2015-11-01 22:16:16 +01:00
iceman1001
5ee53a0e75 ADD: There were lot of calls to enable tracing, but very few to turn it of afterwards in the methods.
Don't know if it has some influence but can't hurt calling  "set_tracing(FALSE);"  when method returns.
2015-10-11 19:14:17 +02:00
iceman1001
0de8e3874d A lot of changes...
.. ntag simulation stuff from @marshmellows branch "ntag/sim"
.. hf mf mifare fixes from @pwpivi.
.. hw status command
.. speedtest function from @pwpivi
.. Viking Functionalities,   (not a proper DEMOD, but a start)
.. GetCountUS  better precision from @pwpivi
.. bin2hex,  hex2bin  from @holiman

...
starting with getting the T55x7 CONFIGURATION_BLOCK for different clone situations. Ripped from Adam Lauries RFidler,   nothing working or finished..
...
Started working with the T55x7 read command with password actually performs a write block...  See Issue #136  https://github.com/Proxmark/proxmark3/issues/136    Not solved yet.

...
Started add SHA256..   not working yet..
2015-10-04 18:01:33 +02:00
iceman1001
0db6ed9a71 Merge some PM3 master commits. Had to re-make the StandAloneMode to work with flags in SimulateIso14443aTag 2015-07-29 01:10:06 +02:00
iceman1001
b10a759fef @PM3 master merges, Piwi fix for mfnested
@Marshmellow42 's fix for FDB
2015-07-12 22:58:16 +02:00
iceman1001
99cf19d9e8 ADD: @pwpivi 's latest fixes for bigbuff
ADD:  @marshmellow 14b changes.

fix:  fixes to the timing inside iso14443b.c  sniff/sending.  Between TX & RX there should be a 151us pause.
2015-06-29 22:36:55 +02:00
iceman1001
c830303d7e FIX: @pwpiwi 's fixes for darkside / nested attack about the NACK/PRNG bugs. 2015-06-25 12:41:39 +02:00
iceman1001
2d2f7d1948 ADD: @marshmellow42 's changes / fixes. 2015-05-31 21:47:33 +02:00
iceman1001
95aeb706d7 CHG: @marshmellow42 changes on deviceside.
ADD: increase debuglevel for printing a statment in ul_ev1_auth
2015-05-27 23:23:46 +02:00
iceman1001
c068ebb78f Merge branch 'master' of https://github.com/Proxmark/proxmark3
Conflicts:
	armsrc/mifarecmd.c
	client/cmdhfmf.c
2015-05-25 13:13:06 +02:00
iceman1001
46cd801c5a FIX: dumptoemul.lua removed the extra linebreak in the end, making some load commands complain.
MOV: moved the try32/try64 attacks (mfkey32/mfkey64) into the nonce2key.c file
CHG: added @marshmellow42 changes to hf mfu dump layout.
ADD: an extra call to BigBuf_free in readcard..  just to make sure that it doesn't leak memory.
ADD: expermimental call to "try32" for "hf mf sim x".
2015-05-25 13:10:55 +02:00
iceman1001
7444d916c6 FIX: hf mfu dump, now reads correct memory from device-side.
CHG: hf mfu dump - output data styled :)
2015-05-24 21:51:44 +02:00
marshmellow42
0ce03d9ab0 fix mfu dump getbigbuffer bug
Thanks @iceman1001 for catching my oops, and fixing it :)
2015-05-23 22:35:50 -04:00
iceman1001
ce432659f2 Adjustments after the big merge from PM3 master. 2015-05-23 08:38:46 +02:00
iceman1001
bcf61bd34a Merge branch 'master' of https://github.com/Proxmark/proxmark3
Conflicts:
	README.txt
	armsrc/appmain.c
	armsrc/apps.h
	armsrc/des.c
	armsrc/iclass.c
	armsrc/mifarecmd.c
	armsrc/mifareutil.c
	armsrc/mifareutil.h
	client/cmddata.c
	client/cmdhf.c
	client/cmdhf14a.c
	client/cmdhficlass.c
	client/cmdhfmfu.c
	client/cmdhfmfu.h
	client/cmdscript.c
	client/lualibs/commands.lua
	client/lualibs/html_dumplib.lua
	client/scripting.c
	client/util.c
	common/protocols.h
	include/usb_cmd.h
2015-05-23 08:16:40 +02:00
iceman1001
fff69a1e34 CHG: Merged the "hf mfu rdbl" and "hf mfu crdbl" commands into "hf mfu rdbl". One read command.
CHG:  Merged the "hf mfu wrbl" and "hf mfu cwrbl" commands into "hf mfu wrbl". One write command.

Both new commands implement a help, authentication (0x1A/0x1B) for ULC and the rest,
2015-05-20 23:44:11 +02:00
iceman1001
0a0d9a5828 @Marshmellow42 's fixes for bigbuf. 2015-05-19 18:46:38 +02:00
marshmellow42
d7acc6403e hf mfu dump - bigbuf allocation fix
some larger nfc tags can get large so set the allocation to the 4k
CARD_MEMORY_SIZE buffersize.
2015-05-19 11:30:50 -04:00
iceman1001
e7e9508883 @Marshmellow42 's cleanup isn device-side "hf mfu" code. Looks nice. Dump uses bigbuffer now, and can dump NTAG216 :)
Consistency on the client-side code "hf mfu".  looks nice.
2015-05-18 20:58:33 +02:00
marshmellow42
9d87eb6650 MF ultralight code cleanup 2015-05-18 13:11:00 -04:00
marshmellow42
8258f40969 Iceman1001 s MFU clean up
cleaned up MF UL_C auth code device side.
2015-05-17 20:49:25 -04:00
iceman1001
4d2e4eea58 CHG: the "HF MFU" authentication changes.
CHG: name change from "hf 14a snoop"  ->  "hf 14a sniff"..
2015-05-16 15:34:01 +02:00
marshmellow42
cceabb79e6 mfu info / dump attempt at missing auths
NOT TESTED.  will test soon.  probably has bugs!
2015-05-16 01:00:31 -04:00
marshmellow42
75377d29d6 MFU - Icemans further improvements
add UL-C device side read card with authentication
add MF_UL-Annotations
add ntag, and more ul descriptions in hf mfu info
2015-05-06 00:55:29 -04:00
iceman1001
8d53ea1403 CHG: added 2k3des to ULC READCARD. 2015-05-05 00:33:07 +02:00
marshmellow42
b3125340f3 Icemans UL-C Auth dev side fix plus a few other ...
... small UL fixes
2015-05-03 15:41:11 -04:00
iceman1001
062b7cb956 FIX: the HF MFU CREAD command on deviceside now can do a proper ATUTHENTICATION request with 2KEY3DES. 2015-05-01 15:29:19 +02:00
marshmellow42
92690507ab Iceman's updates to MFU info and dump 2015-04-30 09:28:43 -04:00
iceman1001
1ec21089b2 CHG: the work in progress of making "HF MFU INFO" / "HF MFU DUMP" goes on.
ook @marshmellows changes and remade them a bit. TagTypeUL_t behaves like a flag-enum.
     "HF MFU DUMP" now autodetects tagtype, and the deviceside should report back proper length.
2015-04-30 10:15:52 +02:00
marshmellow42
f168b2633b MF Ultralight - Iceman's updates + mine
Beginning of Ultralight additions.
detection of Ultralight Types added
dump command now auto detects type
can authenticate Ultralight C
2015-04-29 18:27:31 -04:00
iceman1001
add0504dea ADD: Started a "collect nonces" concept to be able to analyse the tag generated nonces. 2015-04-24 18:41:49 +02:00
iceman1001
aa60d1560e NEW: HF MFU SETPWD - set password to a Ultralight C tag.
NEW: HF MFU SETUID - set UID to a magic UL / UL-C tag.   *not implemented*
CHG: minor alignment for "Hf list" output.
CHG: removed unneeded function parameters to the ultralight commands
CHG: the const MAX_MIFARE_FRAME_SIZE is changed to MAX_FRAME_SIZE in the ultralight commands since the UL-Ev1 can have bigger frames than 18bytes.
CHG: adding DES support for the Ultralight-c read commands on deviceside.
2015-03-30 16:24:03 +02:00
iceman1001
0ec548dc21 Merge branch 'master' of https://github.com/Proxmark/proxmark3
Conflicts:
	armsrc/lfops.c
	client/cmddata.c
	client/cmdlf.c
	client/cmdlft55xx.c
	client/cmdlft55xx.h
	client/scripts/test_t55x7_bi.lua
2015-03-24 11:45:31 +01:00
iceman1001
3ac59c7fed Merge branch 'master' of https://github.com/Proxmark/proxmark3
Conflicts:
	armsrc/crapto1.c
	armsrc/iclass.c
	client/nonce2key/crapto1.c
2015-03-06 09:02:15 +01:00
Martin Holst Swende
3000dc4e7e Generic tracing; removed iso14a_XX-functions, removed traceLen as global varible 2015-02-07 20:49:40 +01:00
pwpiwi
f71f4deb8f BigBuf and tracing rework: allow much longer traces in in hf commands
- provided a BigBuf_malloc() function to dynamically allocate parts of BigBuf
  e.g. for DMA-Buffers, Frame-Buffers, Emulator-Memory
- the whole rest of BigBuf is now available for traces (instead of a small fixed amount)
- send actual traceLen together with trace data
- changed client side to cope with varying traceLen
- changed small buffers to automatic variables instead of parts of BigBuf
2015-01-28 07:18:51 +01:00
iceman1001
c8b6da2295 Merge branch 'master' of https://github.com/holiman/proxmark3
Conflicts:
	armsrc/appmain.c
	armsrc/apps.h

Step 1 for the Ultralight / Ultralight-c
2015-01-20 20:59:24 +01:00
iceman1001
5149e37e66 Merge branch 'master' of https://github.com/Proxmark/proxmark3
Conflicts:
	armsrc/appmain.c
	armsrc/apps.h
2015-01-20 09:32:53 +01:00
Martin Holst Swende
f164662363 Merge branch 'master' of https://github.com/iceman1001/ForPm3
Conflicts:
	armsrc/appmain.c
	armsrc/apps.h
2015-01-15 21:50:03 +01:00
iceman1001
a631936e84 ADD: Midnitesnaks's & Pentura labs Ultralight-c modifications in ARMSRC.
ADD:  des.c  ,  aes.c  in ARMSRC
2015-01-13 23:18:04 +01:00
Martin Holst Swende
31d1caa526 Reverted some minor things, altered other things to get it to compile cleanly 2015-01-08 17:51:52 +01:00
iceman1001
787b5bd8a4 CHG: minor code clean up in ArmSrc.
ADD: added some more default keys in Hf mf nested,  maybe it runs faster :)
2015-01-08 00:08:33 +01:00
iceman1001
52ab55ab0d ADD: added a lot of ic ids to cmdhf15.c Thanks to Asper for the list.
ADD: added a manufacturer list in "hf 14a reader",  only viable when UID is double or triple size.  Thanks to Asper for the list.
ADD: detect chinese magic backdoor commands in "hf 14a reader"
CHG: minor code clean up.
2015-01-07 21:06:15 +01:00
iceman1001
3fe4ff4f03 CHG: generic code clean up. Removal of commented code.
CHG: USB_CMD_DATA_SIZE is now used as maxsize for transfer of data between client and pm3device
CHG: suggested a fix for the underscore problem in ioclass\fileutils.c
ADD:  tnp3xx support
ADD:  nxp tag idents.
ADD:  identifiction of chinese backdoor commands to hf 14a reader.
2015-01-05 15:51:27 +01:00
pwpiwi
6a1f2d82bb bugfixes iso14443a (hf 14a commands)
- buffers were too small to handle 256 byte frames
- parity bits were only handled for up to 32 byte frames
- trace format was inefficient
- removed parity calculation from decoders in iclass.c (parity not used on air anyway)
2014-12-16 07:41:07 +01:00
pwpiwi
baeaf57950 fix/add support for 4K (and other non 1K) card sizes in hf mf commands
- hf mf rdsc (fix): didn't account for 16 block sectors, allowed max sector 63 instead of 39
- hf mf ecfill (add): added (optional) card size parameter and support for non 1K cards
- hf mf dump (add): added (optional) card size parameter and support for non 1K cards
- hf mf dump (fix): Access Condition 011 not handled correctly (tried to access with key A)
- hf mf restore (add): added (optional) card size parameter and support for non 1K cards
- hf mf nested (fix): didn't account for 16 block sectors, allowed max sector 63 instead of 39
- hf mf nested (fix): always dumped 16 keys to dumpkeys.bin instead of correct number
- hf mf chk (fix): always dumped 16 keys to dumpkeys.bin instead of correct number
- hf mf eget (fix): displayed three instead of one block
- hf mf eload (add): load 4K .eml files (but accepts 1K .eml files for backwards compatibility)
- hf mf esave (add): always save the whole emulator memory (4K) instead of 1K only
- hf mf ecfill (add): added (optional) card size parameter and support for non 1K cards
2014-09-10 19:04:50 +02:00
iZsh
7cc204bff8 THIS REQUIRES A BOOTROM UPDATE!! To save FPGA area, split the LF and HF bitstreams and load them on-demand. 2014-06-20 01:02:59 +02:00
micki.held@gmx.de
7bc95e2e43 - fixed iso1443a ManchesterDecoder in order to fix broken Snoop/Sniff
- enhanced tracing: hf 14a list now shows meaningful timing information. With new option f it also shows the frame delay times (fdt)
- small fix for hf 14b list - it used to run into the trace trailer
- hf 14a sim now obeys iso14443 timing (fdt of 1172 or 1234 resp.)
Note: you need to flash FPGA as well.
More details in http://www.proxmark.org/forum/viewtopic.php?pid=9721#p9721
2014-02-19 20:35:04 +00:00
roel@libnfc.org
981bd4292e integrated MIFARE ultralight features, contributed by 'midnitesnake' 2013-10-11 08:43:23 +00:00
douniwan5788@gmail.com
b19bd5d689 Add support in 'hf mf mifare' for some unlicensed/compatible mifare card which always answer NACK.
Change the 'nttmp' start from nt distance 500 to 100 in mifarecmd.c to compatible some unlicensed/compatible mifare card.
2013-09-29 11:44:07 +00:00
micki.held@gmx.de
9492e0b098 Major rework of hf mf nested:
- PM: used GetCountMifare in MifareNested() for improved timing accuracy and to deliver better quality nonces
- PM: MifareNested now delivers exactly two different nonces to avoid time consuming multiple lfsr_recovery32() on client side
- Client: replaced quicksort by bucketsort in crapto1.c which is faster 
- Client: use multithreading (two parallel calls to lfsr_recovery32())
- Client: fixed a small bug in mfnested() (always showed trgkey=0)
- Client: introduced a mutex for PrintAndLog() to avoid interlaced printing
Minor rework of hf mf chk:
- Avoid time consuming off/on cycles. Send a "halt" instead.
2013-09-15 09:33:17 +00:00
micki.held@gmx.de
1c611bbd26 2013-07-08 17:56:05 +00:00
dn337t@gmail.com
79c3611cf3 fixed Mifare nested by activating commented SpinDelay()s 2013-05-30 14:48:27 +00:00
martin.holst@gmail.com
9836a77f97 Fixed a third issue where a buffer was filled with 0x44, affecting chinese cards-commands.(csetblk) 2013-05-11 12:23:31 +00:00
martin.holst@gmail.com
354d3a33fd Fixed another issue where a buffer was filled with 0x44, affecting chinese cards-commands. see http://www.proxmark.org/forum/viewtopic.php?id=1467&p=6 2013-05-11 12:22:11 +00:00
dn337t@gmail.com
0beed8fc67 fixed hf mf rdbl response data (broken since r634) 2013-04-24 10:59:47 +00:00
roel@libnfc.org
dfc3c5053c removed another redundant function to compose reader short frame 2013-04-03 11:18:01 +00:00
roel@libnfc.org
6e82300dda removed all old usb calls 2012-12-05 16:14:10 +00:00
roel@libnfc.org
d19929cbe8 MAJOR update, added hitag2 reader, emulation and eavesdropping, lots of new code, including FPGA tweaks, part 2 2012-09-18 13:53:17 +00:00
Merlokbr@gmail.com
b62a5a8444 small improvements, added new command hf mf sniff (there will be cool sniffer). But now... here is optimized hf 14a snoop. As I see it works the same as th old version. 2012-07-06 16:19:05 +00:00
Merlokbr@gmail.com
545a1f385c another "magic card" backdoor - command "read block". Added several commands to manipulate card data. 2012-07-05 14:05:01 +00:00
Merlokbr@gmail.com
208a0166b9 magic Chinese card fully supported. Added commands:csetuid-set card uid and wipe it, csetblk-set 16 byte block, cload-load dump from emulator memory or emulator file 2012-07-05 10:59:15 +00:00
Merlokbr@gmail.com
0675f200e6 Added work with "magic Chinese" card (card from: ouyangweidaxian@live.cn) with wipe support). Change UID and wipe only. 2012-07-05 07:31:56 +00:00
dn337t@gmail.com
7431536de7 optimized loop in MifareNested (issue 36) 2012-05-29 13:23:07 +00:00
Merlokbr@gmail.com
23487cd23c 1. update SAK
2. ratte's fix. http://www.proxmark.org/forum/viewtopic.php?id=979
2011-11-04 12:35:00 +00:00
Merlokbr@gmail.com
ab8b654efa added functionality: dump card memory, save|load card memory.
50% fixed problem with readline lib
2011-06-22 01:25:16 +00:00
Merlokbr@gmail.com
8556b852ed 1. updated usb commands
2. added abilities to: clear, get, set, load from card, load from nested card emulator dump
3. tried to fix proxmark promt have seen everywhere (not so good)
4. reorganized arm code
2011-06-17 18:39:54 +00:00