RfidResearchGroup/proxmark3
1
1
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2024-11-10 17:49:32 +08:00
Code Issues Projects Releases Packages Wiki Activity
2714 commits 3 branches 14 tags 86 MiB
Commit graph

184 commits

Author SHA1 Message Date
Timo Hirvonen
17ab9dcca0 Improved logic for determining the correct Frame Delay Time (FDT) value based on the last bit transmitted by the PCD 2017-03-06 11:39:12 +02:00
iceman1001
99136c6eef CHG: finalized the merge between peter filmoores 14atagfuzz branch (emv). I seriously doubt anything works. 2017-03-01 21:51:23 +01:00
iceman1001
d24026ade8 BUG: forgot to remove 2017-02-25 23:14:55 +01:00
iceman1001
d32691f1da FIX: hf mf sim - authentication works again. 
CHG: `lf em`- renamed.
CHG: removed functionality in whereami.c, not needed.
 2017-02-25 23:00:20 +01:00
iceman1001
60ca588725 syntax sugar 2017-02-06 00:51:06 +01:00
iceman1001
4401050bcc ADD: 'hf standalone 14a mode", added "mifare 4k" detection. 
ADD: 'hf 14a sim' - added mifare 4k simulation.
 2017-02-01 14:41:06 +01:00
iceman1001
16cfceb689 CHG: rename a local scope variable "data"->"cmd" 
CHG: call params to selectcard too few
CHG: 'standalone HF mode' - when copying second UID onto data array,  it should append after first one, not over the first one.
ref: https://github.com/iceman1001/proxmark3/issues/77    Lets see if this fixes the HF part of this issue
 2017-02-01 12:50:54 +01:00
iceman1001
84bdbc1917 FIX: 'hf 14a sim x' - adjusted and shows messages when verbose. 
FIX: 'hf mf sim x i' - same as above.

In general we only use Moebius attack for "sim x",  that means a clean up on device side code. simpler to understand. It still tries to gather 8 different collections of nonces combo. When one is complete, it get sent to client which runs moebius direct.
 2017-01-29 23:09:23 +01:00
iceman1001
7e735c1398 FIX: 'hf 14a sim x' - this fixes the error with using moebius attack and sim. Updating the nonce variable doesn't change the premodulated response. And it should update everytime it gets a command. One concering issue is that this takes time. Successfully works with two PM3. One acting reader, another sim. 2017-01-29 11:29:15 +01:00
iceman1001
e99acd00cc CHG: the mifare Auth command can make use of a random nonce aswell. 
CHG: since sim commands are timing critical, I'm testing a smaller prand prng function from Intel
 2017-01-29 10:41:48 +01:00
iceman1001
bf5d7992ce ADD: @micolous random nonce, adjusted to fit in. Icemanfork only uses Moebius attack, so no need for an extra parameter in client. 
ref: https://github.com/Proxmark/proxmark3/pull/209
 2017-01-26 14:21:51 +01:00
iceman1001
0f7279b22d syntax sugar 2017-01-21 11:33:14 +01:00
iceman1001
dd83c4572b CHG: coverity complains about not reading the value from mifare_send_short 
CHG: ubuntu 14.04 gcc4.8.4 complains about mem_avail still. Don't know why.
 2017-01-09 22:15:36 +01:00
iceman1001
5fba8581f4 CHG: the reset of pcb_num should be before untraditional tags return. 2016-11-16 17:43:08 +01:00
iceman1001
30daf914ce FIX: looping logic error, doesn't need to increase with 1, if we do 8 checks every turn... 2016-10-28 13:06:34 +02:00
Michael Farrell
b6e05350b2 hf mf sim: Multiple fixes (iceman1001/proxmark3 #45) 
- Fix `hf mf sim` to use nonce_t structures, so key recovery works
- Increases verbosity on the key recovery functionality
- Fix use-after-free for k_sector
- Add help info on `e` option to `hf mf sim`
 2016-10-22 21:53:53 +11:00
iceman1001
d5bded10e2 CHG: lowered the timout again, but re-added the spindelay since 14a requires 5ms powerup before entering the idle-state where tag starts to listen. 
CHG: fix the ticks compare xx > 1 into  xx >= 1
 2016-09-23 23:23:17 +02:00
iceman1001
f885043422 FIX: "hf 14a read" / "hf mf *" / "hf mfdes info" and failure when calling these commands serveral times in row. 
For long transactions the sspclock compare with >1 instead of >=1 ..   Now the timer resets properly.
CHG: use some #define constants for iso-commands.
 2016-09-23 21:28:07 +02:00
iceman1001
be818b1417 FIX: Forget that the prng was 0x8000 length and not 0xFFFF. Sorry. Also returned to the decomposed loop. Don't know if this armsrc optimises this at compilation time. Does someone know? 
CHG: returned the iso14443a_setup order, it might influence my older PM3 device.

*Note*  my Elechouse revisions PM3 works great with this but my older xpfga (green pcb) is hopeless.  It can't fix onto the nonces in 'hf mf mifare'  I think its too slow.
 2016-08-31 19:17:39 +02:00
iceman1001
ed8c2aeb63 CHG: forgot a semicolon... 2016-08-24 15:05:10 +02:00
iceman1001
bcacb3168b CHG: removed some extra time to sync, 
CHG: first_try ,  it must recalibrate all the times when it comes from the client.
 2016-08-24 15:01:36 +02:00
iceman1001
f38cfd6693 CHG: fixed the collapsing comments when opening this file in notepad++ Need spaces between // text or /* ... 2016-08-24 12:34:34 +02:00
iceman1001
6067df30c5 FIX: at least now the special zero parity attack, repeats and doesn't crash. However it doesn't find the key either :( 2016-08-10 10:55:29 +02:00
iceman1001
df007486f5 ADD: @donwan581 select keytype for the darkside attack. 2016-08-04 21:51:26 +02:00
iceman1001
6b23be6b7e CHG: cleaning up. 2016-08-04 21:37:43 +02:00
iceman1001
0a856e292a CHG: adjusted the debug message to the correct mfkey32v2 with right number of parameters. 2016-06-22 09:35:18 +02:00
iceman1001
b070f4e495 CHG: only need a byte in this loop 2016-04-29 22:24:37 +02:00
iceman1001
57850d9dfb CHG: FpgaSetupDMA, handle when it returns NULL. 2016-04-27 20:42:44 +02:00
iceman1001
72e6d4621a code clean up 2016-04-21 10:30:42 +02:00
iceman1001
bc9393715f CHG: "hf 14a sim" command , correct use of FLAGS 
CHG: "hf 14a sim" command, changed the data collection for the attackmode in SimulateIso14443aTag.  It now uses @holiman 's original implementation. But we can't change "NR", so we do next.
CHG: "hf 14a sim" command, nonce is increase with every new auth.  This is for the "mfkey32_moebius" attack to work.

CHG: "hf mf sim" command (function void Mifare1ksim ) now handles UID' with length 10.
CHG: "hf mf sim" command nonce is increase with every new auth.  This is for the "mfkey32_moebius" attack to work.
 2016-04-18 13:26:16 +02:00
iceman1001
0194ce8fc8 ADD: simulating can now handle triplesized UID (10b) 
CHG: moved some mifare #DEFINES into protocols.h  (ACK,NACK..)
 2016-04-14 11:09:17 +02:00
iceman1001
91c7a7ccb7 Syntaxt suger, 
and some clean up in the "hf mf mifare" code.  I removed the three strategies Pivi added to make the code easier and added a lot of comments to understand.
the WDT bug is still there in this code. Needs further testing yet, before I commit the fix.
So far the fix is quite stable on ubuntu, but on mingw/win is breaking still. Which at this point doesnt make any sense.
 2016-04-12 11:36:52 +02:00
iceman1001
ca5bad3d73 CHG: syntax suger, 
CHG: the nested call to readerreceive is not negated..
 2016-04-10 13:05:01 +02:00
iceman1001
6fc68747f6 ADD: well, starting with a luascript for reading calypso tags, made me remake the 14b raw command on client and device side. Sorry @marshmellow42 , but this one broke your "hf 14b info" implementation. I fixed the "hf 14b read" and the hf search. So not to bad, but still a bit broken. The 14b raw device side is now very similar to 14a raw. Which is good. There is a Standard 14b 0x050008 detection and STmicroelectronic 0x0600 detection on deviceside. This removes a lot of code client side. 
I also made the SRi read functions better by combining them.   The demodulation / uart code should be the same as last summers changes.  The device side code can now be even smaller.
 2016-03-20 19:33:07 +01:00
iceman1001
aaa1a9a2dc CHG: Added calling clear bigbuff to zero out it also, instead of just "free" it. 
ADD:  downloading the EML part from BigBuffer specially.
 2016-03-12 09:03:28 +01:00
iceman1001
b03006794f CHG: removing some time-debug statements. 
CHG:  increased the time-out message 2sec, in proxmark,  to make "hf mf chk" work better.
CHG:  still trying to solve the "hf mf mifare" WDT_HIT bug.

With these changes,  the "hf mf chk" / "Hf mf nested" looks similar and should be a bit faster.
 2016-02-19 22:34:39 +01:00
iceman1001
7504dc50d5 Merge branch 'master' of https://github.com/iceman1001/proxmark3 
Conflicts:
	armsrc/crypto1.c
 2016-02-16 21:43:45 +01:00
iceman1001
4b78d6b317 CHG: having a go at finding the WDT death second time we run "hf mf mifare"... 2016-02-10 21:46:52 +01:00
iceman1001
4c0cf2d215 Experimeting with finding the "WDT_HIT" bug in "Hf mf mifare", which not shows if "hf mf dbg" is set to 3 or more... 2016-01-25 20:21:11 +01:00
iceman1001
810f53792e ADD: added the possibility to choose which block num to attack with "hf mf mifare" Before it only worked on block 0. 2016-01-20 22:26:01 +01:00
iceman1001
5ebcb867a3 FIX: Some uninitialized variables, some syntax suger, and some extra WDT_HIT calls inside "ReaderMifare" to stop it from trigger when running multiple times in a row. 2016-01-20 19:53:58 +01:00
iceman1001
4a71da5a35 FIX: Coverity Scan complains about resourceleaks, array reads outside of index, uninitialized variables. 2016-01-20 17:13:25 +01:00
iceman1001
495d7f1326 FIX: Coverity scan, forgot one fread ... 
CHG: Syntax suger
 2016-01-19 22:25:34 +01:00
iceman1001
02a405967e CHG: The nonce from "hf mf nested" is fixed to this one, why is that one selected? Why not just all zeros or ones? 2016-01-19 16:32:29 +01:00
iceman1001
2b1f4228c2 ADD: @marshmellow42 's changes to "hf mfu *" , 
ADD: @marshmellow42 's changes to "hf mf sim",
ADD: @pwpiwi 's parity files was missing.
 2015-12-15 09:34:55 +01:00
iceman1001
f8ada309e9 ADD: @pwpiwi 's latest code from his 'hardnested' branch. 2015-12-15 08:51:29 +01:00
iceman1001
c188b1b9b2 ADD: @go_tus simple bruteforce for t55xx, refactored a bit. 
ADD: @pwpiwi 's implementation of Hardnested
 2015-11-27 16:24:00 +01:00
iceman1001
e9a92fe237 FIX: the read counter in "hf 14a sim" (for ntag/ev) should work better now. Instead of always returning zero, it increases aswell. 
--Started to add the TI demod into the 'LF SEARCH"
 2015-11-22 21:48:15 +01:00
iceman1001
a126332a7b ADD: @marshmellow's fixes to awid, viking and T55x7 
ADD: 'lf t55xx detect' now can be called with a password.
ADD: trying to add the read counter and increase counter commands for ntag sim.
 2015-11-22 17:33:41 +01:00
iceman1001
94422fa23f ADD: @marshmellow42 's fixex and resetread t55x7 2015-11-02 20:46:17 +01:00