Commit graph

4063 commits

Author SHA1 Message Date
iceman1001
2d610b8dc0 text & style 2025-06-08 10:02:00 +02:00
Antiklesys
80e1c7f0d4 Implemented hf iclass sim -t 7
Implemented an iclass sim function that prevents simulated card responses after updating block 3.
Block 3 gets updated with the XOR key as if it was in personalization mode.
2025-06-07 23:12:21 +08:00
iceman1001
6fbb13ba41 style 2025-06-07 11:50:03 +02:00
Antiklesys
f49bc8ebaa
Update iclass.c
Signed-off-by: Antiklesys <syselkitna@gmail.com>
2025-06-07 17:00:28 +08:00
Antiklesys
606f65496c
Update iclass.c
Signed-off-by: Antiklesys <syselkitna@gmail.com>
2025-06-07 16:46:44 +08:00
Antiklesys
9c672d8289
Update iclass.c
Signed-off-by: Antiklesys <syselkitna@gmail.com>
2025-06-07 16:42:49 +08:00
Antiklesys
b4edcb9510 Updated hf iclass sim -t 6
Updates to the functionality of iclass sim -t 6 to specifically target the last SIO block and to do it automatically.
It now checks the AIA to determine if the card is SR or SE and adjust the block to jam based on the SIO length declared in block 6 (if SE) or fixed length if SR.
2025-06-07 13:46:19 +08:00
Antiklesys
94794f7519 Implemented a hf iclass sim variation
hf iclass sim -t 3 variation that glitches specific block responses during read/write operations based on the value of the last byte of block 31.
2025-06-07 02:15:01 +08:00
iceman1001
f41d6fad53 style 2025-06-06 13:27:02 +02:00
Antiklesys
e68be39a41 Updated hf iclass legrec to be able to use shorter delays
Added an option for hf iclass legrec to further increase speeds by using a shorter delay of 1500 vs the default of 3390.
This seems to be stable on new silicon especially now that we're keeping the field always on.
It may be more risky for the --fast operation.
2025-06-06 16:06:53 +08:00
Antiklesys
fd098ba12f Update iclass.c 2025-06-05 21:29:01 +08:00
Antiklesys
7acf507826 Update iclass.c
Minor optimizations to remove duplicate code
2025-06-05 21:18:03 +08:00
Antiklesys
083a9ce945 Updated hf iclass legrec with a fast option and improved AA2 selection
1- Added a --fast option for hf iclass legrec that further increases the speed from 4.6 key updates/second to 7.4 key updates/second. This is achieved by skipping some safety checks and is a very fast but more risky operation.
2- Automated AA2 block selection based on the values in the config block
3- Other minor code cleanups
2025-06-05 20:44:58 +08:00
iceman1001
186ed6fb07 make style 2025-06-04 18:05:30 +02:00
Antiklesys
7225ea6ac4
Update iclass.c
Removed unused value of blockno

Signed-off-by: Antiklesys <syselkitna@gmail.com>
2025-06-04 22:46:44 +08:00
Antiklesys
81d7ac1f59
Update iclass.c
Re-added stop tracing in main loop to avoid crashes

Signed-off-by: Antiklesys <syselkitna@gmail.com>
2025-06-04 22:41:30 +08:00
Antiklesys
d654f6e78f Improved hf iclass legrec speed
Improved the speed of hficlass legrec from 7200 keys / hrs to 17800 keys / hr by removing the need to drop the field and re-select, re-authenticate with the card at every loop.
Re-select and re-authenticate will still happen if there's a read error and a loop needs to be repeated.
2025-06-04 22:34:28 +08:00
Antiklesys
2b2a1cc0a2 Updated hf iclass legrec
Updated hf iclass legrec to support pm3 button interrupt for user abort
Cleaned up messaging to look more neat and tidy during the process
2025-05-31 14:09:00 +08:00
iceman1001
749c23a6b5 iclass tear on device side , moved around debug printing not to disturb timings between reading and writing tag during stabilize weak bit phase 2025-05-30 20:46:27 +02:00
Antiklesys
23d9783b26 Updated hf iclass legrec
Updated hf iclass legrec:
1- Fixed communication timing inconsistencies by moving away from iclass_writeblock_ext to iclass_writeblock_sp which supports start_time and end_time
2- Reduced number of debug messages being printed

Overall this reduces slightly the speed of the process, but it should make it more stable as the timings are now all correctly being accounted for.
2025-05-31 02:15:13 +08:00
Antiklesys
2105dbc379
Update iclass.c
Clarified what tear success means

Signed-off-by: Antiklesys <syselkitna@gmail.com>
2025-05-30 13:05:25 +08:00
Antiklesys
c32f655023 Improved hf iclass tear erase phase readability
Improved readability of erase phase during iclass tear (client and arm side).
It is redundant to see a list of FF during the erase phase (which can be pretty lengthy), so it will only show it once when all bits are FF and then will resume printing the moment bits start changing again post erase phase.
2025-05-30 13:00:35 +08:00
Antiklesys
04cfe2a43e Modified iclass recover operations
1- Renamed legreclookup to legbrute to be in line with the command name
2- Updated estimate values with speed increase gains
3- Improved some if statements readability in iclass.c and added start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; to increase speed by ~8% (1.86 loops per second to 2.01 loops per second = ~560 more loops per hour).

Tried disabling some arm communications/comments but the speed increase was negligible (~1 sec / 1000 updates).
2025-05-30 12:36:42 +08:00
iceman1001
804acfbefa the device side of iclass tear off is implemented. The base was done by @antiklesys. This version differs by the concept of trying to stabilize weak bits by performing a write operation in conjuction with the detected tear. Its untested but I can replicate most of the tears we performed client side. You will need to call the proxmark3 client with -f , ./pm3 -f to force flush out text which is needed for the inplace printing. I thought this was done automatically but it wasnt. hf iclass tear --arm + all the normal params to run on device side 2025-05-30 01:37:13 +02:00
Iceman
90210fe588
Merge pull request #2853 from sup3rgiu/mfu-counters
Fixed SimulateIso14443aTag() to make MFU counter increments persistent in emulator memory.
2025-05-29 14:44:13 +02:00
iceman1001
b2e587afa5 missing break, migth lead to strange behavior 2025-05-28 20:51:51 +02:00
iceman1001
4e07fc2b31 if enabled but no delay, then disable tear off just in case. enforce user to set a delay. if not this function will be triggered over and over which might confuse users normal operation 2025-05-27 09:43:11 +02:00
iceman1001
4b92118f1f clear trace log before starting to run hf iclass tear 2025-05-25 11:29:43 +02:00
iceman1001
74f1936132 convert to our calloc instead since we prefer to know allocated shared memory is empty. Also removed a malloc(1) which is just a waste of bytes just like @NVX said a year ago at DefCon 2025-05-25 09:55:32 +02:00
iceman1001
b6a39768a1 text 2025-05-24 21:30:23 +02:00
iceman1001
c716467a7e fixed output for hf iclass trbl to not have tear off debug message and its more compact now 2025-05-23 10:52:09 +02:00
sup3rgiu
d5beb66508 Fixed SimulateIso14443aTag() to make MFU counter increments persistent in emulator memory.
- Fixed arguments for `SimulateIso14443aInit` in `hf_msdsal.c`, `hf_cardhopper.c`, `hf_reblay.c` and `hf_tcprst.c`.
2025-05-22 19:57:30 +02:00
iceman1001
84b565bec4 style 2025-05-19 22:31:41 +02:00
iceman1001
c847896a15 fix #2835 due to wrong variable used to calculate the size of the emulator memory to download , all get memory from emulator memory failed with a block no larger that 30-ish 2025-05-01 08:34:39 +02:00
iceman1001
42cdd34e59 fix #2834 refactored to use local pointer, no modification of input polling_parameters pointer is done. The compilation error error: initializer element is not constant .frames should be fixed. Using defines and removed some global vars 2025-04-30 18:55:07 +02:00
iceman1001
cb4a0e2333 rename struct to follow code style 2025-04-30 13:27:41 +02:00
nvx
812c58f601 cardhopper fixes
make usart write buffer const
sub out magic numbers with defines
fix edge case handling 255/256 byte frames (including crc)
add sanity checks to avoid buffer overrun on some "should never happen" edge cases
don't wait for rats reply from card before listening to next reader frame
cap fsci to 8 (256 bytes) as that's the most the proxmark3 codebase currently handles
eliminate 1k of ram usage by tweaking how emulation responses are sent
2025-04-21 23:17:47 +10:00
Iceman
430d5cd3b9
Merge pull request #2824 from kormax/magsafe-polling-config
Move `mag`safe polling argument to `hf 14a config`
2025-04-21 04:34:53 +02:00
kormax
3550f11726 Remove mag argument from commands; Add support for magsafe polling via 14a config 2025-04-20 17:55:55 +03:00
Philippe Teuwen
49521078e5 fix mf aes key length and typo in make help 2025-04-20 11:20:14 +02:00
SecLabz
0970558491
Edit hf_st25_tearoff.c comment
Signed-off-by: SecLabz <85152038+SecLabz@users.noreply.github.com>
2025-04-16 15:47:52 +02:00
seclabz
19789381df Added new standalone mode HF_ST25_TEAROFF to store/restore ST25TB tags with tearoff for counters (@seclabz) 2025-04-16 14:05:10 +02:00
iceman1001
bc1c47e81b style 2025-04-13 12:25:14 +02:00
Philippe Teuwen
926fbe5354 Fixed hf mf fchk --mem to actually use flash dict 2025-04-12 13:22:27 +02:00
kormax
56336d9d82 Add support for polling loop annotations 2025-04-09 12:31:21 +03:00
John de Kroon
ec4dccb12b
Define dump_file
Signed-off-by: John de Kroon <mail@johndekroon.nl>
2025-03-29 12:57:53 +01:00
John de Kroon
59839f1107
Store card in spiff memory
Signed-off-by: John de Kroon <mail@johndekroon.nl>
2025-03-29 12:55:09 +01:00
iceman1001
6ed1853320 Revert "Release v4.20142 - Blue Ice"
This reverts commit a657dbda9b.
2025-03-25 16:18:49 +01:00
iceman1001
a657dbda9b Release v4.20142 - Blue Ice 2025-03-25 16:18:49 +01:00
iceman1001
875b3c44b4 unify text - step 1 2025-03-25 10:12:16 +01:00