Commit graph

389 commits

Author SHA1 Message Date
Martin Holst Swende 39d3ce5dd6 Moved iclass crc to be based on a lookup table 2015-01-04 22:10:25 +01:00
Martin Holst Swende c8dd9b092e Some work on iclass dump and iclass list, now the dumping is a lot more stable. I think the comms should be measured and tuned a bit more, right now it kind of works thanks to retry-functionality, but the retries are probably not needed if we are a bit more careful about timing, so we don't send commands too fast for the tag to handle 2015-01-04 14:53:26 +01:00
Martin Holst Swende 2e9d4b3ff4 Some work on iclass, started on some better support in 'hf iclass list' and also fixes to 'hf iclass reader' so it exits better when the button is pressed 2015-01-03 15:11:48 +01:00
Martin Holst Swende 854b9a233f Removed unused variable 2015-01-03 14:29:07 +01:00
Martin Holst Swende ae8e8a4372 Corrected indentation to tabs only 2015-01-03 14:21:07 +01:00
Martin Holst Swende 6ca4c6463e Removed wrong size-count, sizeof(bigbuf) would always return 40000 in lfops 2015-01-03 14:17:59 +01:00
Iceman 7c5f70dd9f Merge pull request #1 from bforbort/master
Added DES AUTH command support
2015-01-01 23:02:23 +01:00
Blaine Forbort 23b80a7334 Merge remote-tracking branch 'origin/DESFireAuth' 2015-01-01 10:41:14 -08:00
iceman1001 6ff6ade2f5 ADD: midnitesnakes desfire, ultralight changes from Unstable branch.
ADD: Marshmellows fixes for the LF (demods) commands,  (LF SEACH)
ADD: Holimans changes with hash1_brute

FIXES:  minor fixes with some calls to "free" and redundant debug statement and code cleanup. removal of commented code.
2014-12-31 11:35:43 +01:00
marshmellow42 f822a063b3 lf demod code cleanup - added fskraw arguments
merged code and added arguments to data fskrawdemod to allow other fsk
mode demodulations (FSK2a = RF/10 & RF/8) another might be (RF/8 & RF/5)
2014-12-31 02:27:30 -05:00
marshmellow42 6bfa18eab4 Merge pull request #1 from Proxmark/master
Test
2014-12-29 16:14:23 -05:00
marshmellow42 66707a3b3c LF Demod bug fixes and add lf em em410xdemod
fixed a few bugs in lf demod that the streamlining added.  added new lf
em em410xdemod command that loops until button pressed. (similar to lf
hid fskdemod
2014-12-29 15:32:53 -05:00
marshmellow42 7db5f1ca25 slight adjustment to include
removed extra unneeded path
2014-12-28 21:29:33 -05:00
marshmellow42 eb191de615 LF Demod streamlining
one shared location for demoding lf for arm and client.  also added a
few raw demod commands.
2014-12-28 20:33:32 -05:00
iceman1001 9c7c222c03 FIX: minor fixes to the new feature in "hf 14a reader". Not turning off the field and the consequent changes to the define names. (CMD_MIFARE_EML_CGETBLO -> CMD_MIFARE_CGETBLO) 2014-12-26 22:38:23 +01:00
iceman1001 d52e4e8819 ADD: HF 14A READER is now able to see if a presented card responses to the chinese magic backdoor commands.
FIX: simple namechange of some defines where it hinted it was related to "eml" when it wasn't.
2014-12-26 21:32:58 +01:00
iceman1001 1b492a97af ADD: marshmellows new lf command and DetectClock. (works great!)
FIX: a suggested patch for "hf mf csetuid" (https://github.com/Proxmark/proxmark3/issues/35)
FIX: fixed a bug in iso14443a_select_card where the len variable wasnt set,  this made desfire/magic cards not work.
2014-12-26 20:02:59 +01:00
pwpiwi 52bfb95543 bugfixes in iso14443a.c and hf 14a reader
- introduced with the big frame and parity support (commit 6a1f2d82): tag responses with len%8 == 0 were dropped  - thanks iceman for testing and finding
- after unsuccessful hf 14a reader the field stayed on. Thanks to iceman for proposing the fix.
2014-12-23 11:21:42 +01:00
iceman1001 3bc3598e88 added the changes from PM3 master.
added some code for the AWID26
2014-12-22 15:14:05 +01:00
Blaine Forbort 082789c4df Using defined command code 2014-12-22 00:21:20 -08:00
Blaine Forbort 46e14b0f96 Minor formatting change 2014-12-21 23:54:29 -08:00
Blaine Forbort 4e2e4bcf9b Tested by changing the master key from the default to a custom value 2014-12-21 22:59:24 -08:00
Blaine Forbort 0673263230 code to check RndA' from PICC was unreachable 2014-12-20 19:25:31 -08:00
Blaine Forbort 6a1aa12df0 Called the OnSuccess() method for whatever reason that's there. 2014-12-20 19:15:48 -08:00
Blaine Forbort 3c05723ee2 Limit to single-DES operation and return session key to client. 2014-12-20 17:18:26 -08:00
Blaine Forbort 085b0e2ea9 Create session key 2014-12-20 00:10:59 -08:00
Blaine Forbort 6534821365 Accept key number from command line 2014-12-19 21:37:06 -08:00
Blaine Forbort a07a448220 Removed unneeded verbosity and checked for a 0x00 response from PICC after challenge response 2014-12-19 20:38:25 -08:00
Blaine Forbort 1051dee04a Challenge is now sent to PICC 2014-12-19 19:44:32 -08:00
Blaine Forbort 0127902ee6 Calculates response to PICC challenge 2014-12-19 19:36:19 -08:00
Blaine Forbort b6f41bfdfe Successfully decrypted RandB from PICC challenge 2014-12-19 12:15:45 -08:00
marshmellow42 b3b706693b Final touches on IO prox and HID prox demod
makes both more robust and handles various error situations.
2014-12-19 12:14:27 -05:00
iceman1001 f5ed4d12de ADD: started with adding a LF AWID26 write function. not done yet.
ADD: latest pwpiwi & holiman changes.
2014-12-19 13:46:02 +01:00
pwpiwi db4de4d82f Merge branch 'master' of https://github.com/Proxmark/proxmark3 2014-12-18 19:42:49 +01:00
pwpiwi 57642f63fa bugfixes hf epa cnonces
- extended length (more than 1 byte) not handled correctly
- nonces not printed on Windows due to type mismatch
2014-12-18 19:40:35 +01:00
Martin Holst Swende 7496d8d822 Merge pull request #32 from marshmellow42/master
Fixes and additions to lf io fskdemod  and addon parameter to lf hid fskdemod
2014-12-18 08:56:26 +01:00
iceman1001 d3499d369d minor fixes regaring the newly released patches from the pm3 community
plus removed old comments in cmdmain.c
2014-12-17 22:26:16 +01:00
pwpiwi 2bdd68c370 unify/refactor hw tune and data tune
- unified hw tune and Enio's great data tune
- don't use BigBuf (and hardcoded Offset)
- removed special handling of CMD_MEASURED_ANTENNA_TUNING
  in UsbCommandReceived()
2014-12-17 20:57:26 +01:00
iceman1001 a501c82b19 Applied Holiman's fixes for iclass.c and CSNs
Applied PwPiwi's new parity fix.
Applied Marshmellw's fixes for FSKdemod (HID, IO)

FIX: a potential bigbuffer fault given pwpiwi's change inside lfops.c CmdIOdemodFSK & CmdHIDdemodFSK
FIX: change some "int" parameters to uint's.
FIX: changed the lfops.c -  DoAcquisition125k_internal  to respect pwpiwi's definitions of FREE_BUFFER_OFFSET

HEADS up:  The ultralight functions hasn't been verified since pwpiwi's changes.
2014-12-17 20:33:21 +01:00
marshmellow42 083ca3de73 LF HID & IO prox fixes/options 2014-12-17 09:51:40 -05:00
pwpiwi 471c514167 Merge branch 'master' of https://github.com/Proxmark/proxmark3 2014-12-16 07:47:02 +01:00
pwpiwi 6a1f2d82bb bugfixes iso14443a (hf 14a commands)
- buffers were too small to handle 256 byte frames
- parity bits were only handled for up to 32 byte frames
- trace format was inefficient
- removed parity calculation from decoders in iclass.c (parity not used on air anyway)
2014-12-16 07:41:07 +01:00
Martin Holst Swende 6116c79618 Reverted to original malicious CSNs from paper, it appears legit readers does not accept if they dont end with F7,FF,12,E0 2014-12-14 21:37:56 +01:00
Martin Holst Swende eabba3df7e Fix (iclass) 2014-12-14 18:07:12 +01:00
marshmellow42 4860172789 LF HID & IO prox demod translation addons
lf hid fskdemod - add bit format length, facility code and card numbers
for different formats
2014-12-13 20:23:59 -05:00
Martin Holst Swende d6a120a25b Added Enios cool tuning-trick (LF) from forum-post: http://www.proxmark.org/forum/viewtopic.php?pid=13060#p13060 2014-11-30 22:30:36 +01:00
iceman1001 02306bac2d ADD: Enio's intuative function for the command: "hw tune", where you plot the tuning-data :)
ADD:  added optional parameter to "hw tune" to show graf direct. Sample usage: "hw tune p"
2014-11-30 19:16:28 +01:00
iceman1001 06b58a94f0 BUG: don't try to fix things that ain't broken.. or not. My try for a fix ended up making the PrintAndLog function stop working. Just by calling a fclose.. fixed. 2014-11-27 22:16:17 +01:00
iceman1001 95e635947b ADD: the option to simulate tnp3xxx inthe command "hf mf sim"
ADD: found some new default keys
ADD: changed alot of memorys buffers to use constant values.  like usbbuffer sizes, tracelogs, etc etc
ADD: all changes Peter filmoore has in his pull request.
2014-11-26 13:52:39 +01:00
iceman1001 463ca973e7 FIX: hf mf eload - now supports specifying 0,1,2,4 in card memory for the file to be loaded.
FIX: hf mf esave - now supports specifying  0,1,2,4 in card memory for the file to be saved.
ADD: data.h -  added FILE_PATH_SIZE constant
ADD: hf legic load - a command help and checks for FILE_PATH_SIZE
ADD: hf legis save - now checks for FILE_PATH_SIZE
ADD: lf hitag - now checks for FILE_PATH_SIZE
ADD: util.c - AddLogLine now checks for FILE_PATH_SIZE
ADD: data load / save  - now checks for FILE_PATH_SIZE
FIX: ui.c - added a case of closing a filehandle
FIX: hf mf cload / csave now checks for FILE_PATH_SIZE
FIX: armsrc/mifarecmd.c - adjusted the buffersize in MifareEMemget from 48 to USB_CMD_DATA_SIZE
2014-11-16 11:22:06 +01:00
iceman1001 22f1c57786 Updated tnp3.lua
added some possibilities to abort the "hf mf nested" command
added a rudimentary items identification for tnp3xxx
2014-11-09 17:22:04 +01:00
iceman1001 8aa79dee20 FIX: added some tnp3xxx identification i formatMifare.lua
FIX: tnp3.lua is more or less finished. Needs testing.
2014-11-03 21:59:31 +01:00
iceman1001 c15d2bdc9b ADD: added identification for Mifare TNP3xxx tags.
ADD: MD5-lua functionality
ADD: AES 128 decrypt lua functionality
ADD: test luc script for reading TNP3xxx tags
CHG: testing some changes for "hf 14b sim" / "lf em4x 410xsim"
2014-11-03 13:49:19 +01:00
iceman1001 a25d5c1cde test: hf 15 sim.. 2014-10-31 09:26:35 +01:00
Martin Holst Swende ca4714cd23 More coverity fixes 2014-10-30 21:49:18 +01:00
iceman1001 3649b640e6 CHG: added possiblity to send <UID> into the "HF 15 SIM" 2014-10-30 14:11:37 +01:00
iceman1001 a61b4976bd FIXED: Merged all Holimans code-review issues which should fix a lot of memoryleaks. 2014-10-30 00:09:01 +01:00
Martin Holst Swende 2ed270a854 Coverity-fixes in armsrc 2014-10-28 21:44:17 +01:00
iceman1001 7c756d6892 FIX: Another try to see if the "lf em4x 410xsim" becomes better, added the clock in the calls since the auto detection of the clock seems to be wrong. I get 67, instead of 64...
FIX:  changes the transfersize from sim -> pm3,  was 48, now USB_CMD_DATA_SIZE (512) Much faster!
2014-10-27 21:42:41 +01:00
iceman1001 2ae8a312e0 Inital test for the "lf em4x 410xsim / lf em4x 410xwatch" which I try to verify that the sim works.
Something about speed,  the clock detection is not so good.  should be 64,  usually 67..
2014-10-27 19:46:21 +01:00
iceman1001 1010aacca0 Minor corrections in fskdemod i lfops.c , see Holimans branch.
BUG: fixed a variablename, that didn't get changed.
2014-10-27 09:56:18 +01:00
Martin Holst Swende 9cc8a1e588 Some more docs, also made lf hid fskdemod a bit more stable. Should be no more false readings now 2014-10-25 22:42:27 +02:00
Martin Holst Swende b225678574 Some minor changes and some documentation 2014-10-24 21:12:31 +02:00
Martin Holst Swende 1a5a0d7590 Fixed compilation issues, but functionality not tested 2014-10-24 20:53:43 +02:00
Martin Holst Swende f97d4e2378 First try att merging with head 2014-10-24 20:46:02 +02:00
iceman1001 72e930ef32 FIXED: lf t55xx fsk now demods but only to binary.
ADD:  holimans lf io / hid fskdemod  changes.
2014-10-23 18:36:44 +02:00
iceman1001 7bd30f12ac Small fixes,
Fix: removed a call to free,  which I think made linux people unhappy during "lf t55xx rd 0"...
Add: "lf t55xx fsk"  now kind of outputs binary from "FSK2a R/40 R/50"..
2014-10-16 15:05:27 +02:00
iceman1001 f6c18637ca chg: LF t55xx trace
new:  LF t55xx info
2014-10-06 19:42:50 +02:00
iceman1001 75465377b9 Merge branch 'master' of https://github.com/Proxmark/proxmark3
Conflicts:
	armsrc/appmain.c
	armsrc/apps.h
	armsrc/iclass.c
	client/Makefile
	client/cmdhficlass.c
	client/loclass/cipher.c
	client/loclass/fileutils.c
	client/loclass/ikeys.h
	include/usb_cmd.h
2014-09-19 10:50:34 +02:00
Martin Holst Swende e6ee6c4cd1 Merge remote-tracking branch 'origin/master' into PenturaLabs-iclass-research 2014-09-19 09:45:38 +02:00
iceman1001 3d93d4f940 Add: simple Application enum.
Fix:  Minor overflows found by Holiman.
2014-09-18 14:15:48 +02:00
iceman1001 313ee67ea2 Fixed: "hf mfdes info" 2014-09-18 12:38:31 +02:00
iceman1001 b44e523300 LF t55xx and LF em4x commands now should manchester decode data. However t55xx can have other settings and different encodings. 2014-09-16 13:56:06 +02:00
iceman1001 f38a152863 First check in. 2014-09-11 23:23:46 +02:00
iceman1001 4a79e52c0b Added piwis patch,
first version of finding out the card size. Experimental.
2014-09-11 22:33:43 +02:00
pwpiwi baeaf57950 fix/add support for 4K (and other non 1K) card sizes in hf mf commands
- hf mf rdsc (fix): didn't account for 16 block sectors, allowed max sector 63 instead of 39
- hf mf ecfill (add): added (optional) card size parameter and support for non 1K cards
- hf mf dump (add): added (optional) card size parameter and support for non 1K cards
- hf mf dump (fix): Access Condition 011 not handled correctly (tried to access with key A)
- hf mf restore (add): added (optional) card size parameter and support for non 1K cards
- hf mf nested (fix): didn't account for 16 block sectors, allowed max sector 63 instead of 39
- hf mf nested (fix): always dumped 16 keys to dumpkeys.bin instead of correct number
- hf mf chk (fix): always dumped 16 keys to dumpkeys.bin instead of correct number
- hf mf eget (fix): displayed three instead of one block
- hf mf eload (add): load 4K .eml files (but accepts 1K .eml files for backwards compatibility)
- hf mf esave (add): always save the whole emulator memory (4K) instead of 1K only
- hf mf ecfill (add): added (optional) card size parameter and support for non 1K cards
2014-09-10 19:04:50 +02:00
pwpiwi bfb6a143ea bugfix hf mf sim
- an additional erronous byte was sent after SAK
2014-08-05 18:40:19 +02:00
pwpiwi b03c0f2d86 bugfixes hf mf sim
- output of debug messages caused communication failures due to timing issues.
  hf mf dbg 4 now required to see these debug messages.
- changed help text for hf mf dbg
- fixed minor bugs in help texts for hf mf sim and hf mf ecset
- display "key A" or "key B" instead of "key=0" or "key=1 in hf mf sim
2014-07-30 21:23:02 +02:00
pwpiwi 991f13f27d minor bugfixes to hf mf sniff and hf 14a snoop
- tracing was not always enabled when starting hf mf sniff or hf 14a snoop
- ATQA was displayed in wrong byte order in hf mf sniff
- 4 Byte UIDs were displayed as 7 Byte UIDs (padded with 0x000000) in hf mf sniff
- same for logfile names.
- assignment (=) had been used instead of == in comparisons (shouldn't have been relevant though)
2014-07-15 08:39:56 +02:00
pwpiwi c7324bef28 Bugfix hf 14a raw:
number of bits sent was wrong when option -c was used without option -b
2014-07-01 08:28:28 +02:00
Martin Holst Swende 9b82de75f4 more work towards iclass elite dumping.. not quite finished yet though :( 2014-06-30 00:20:40 +02:00
Martin Holst Swende aa41c6058a Merged two iclass-reader functions into one to remove duplicated code, update loclass library with hash2 algo 2014-06-29 23:34:24 +02:00
Martin Holst Swende dbf732ee41 Minor 2014-06-29 13:48:13 +02:00
Martin Holst Swende 26c0d833ac Some minor changes [iclass-related] 2014-06-28 22:57:48 +02:00
Martin Holst Swende 3ad48540d4 Merge branch 'iclass-research' of https://github.com/PenturaLabs/proxmark3 into PenturaLabs-iclass-research
Conflicts:
	README.txt
	armsrc/apps.h
	client/Makefile
	client/cmdhficlass.c
	client/cmdhficlass.h
2014-06-28 20:52:37 +02:00
Martin Holst Swende 6db28145ea Merge remote-tracking branch 'origin/master' into iclass-fixes 2014-06-28 12:47:40 +02:00
iZsh 3b2fee43ea New LF edge detection algorithm + lowpass filter
This is a new LF edge detection algorithm for the FPGA.

- It uses a low-pass IIR filter to clean the signal
(see https://fail0verflow.com/blog/2014/proxmark3-fpga-iir-filter.html)
- The algorithm is able to detect consecutive peaks in the same
  direction
- It uses an envelope follower to dynamically adjust the peak thresholds
- The main threshold used in the envelope follower can be set from the ARM side

fpga/lf_edge_detect.v,
fpga/lp20khz_1MSa_iir_filter.v,
fpga/min_max_tracker.v: New file.

fpga/lo_edge_detect.v, fpga/fpga_lf.v: Modify accordingly.

armsrc/apps.h (FPGA_CMD_SET_USER_BYTE1,
FPGA_CMD_SET_EDGE_DETECT_THRESHOLD): New FPGA command.
fpga/fpga_lf.v: Modify accordingly/Add a 8bit user register.

fpga/fpga_lf.bit: Update accordingly.

fpga/tests: New directory for testbenches

fpga/tests/Makefile: New file. It compiles the testbenches
and runs all the tests by default (comparing with the golden output)

fpga/tests/tb_lp20khz_1MSa_iir_filter.v,
fpga/tests/tb_min_max_tracker.v,
fpga/tests/tb_lf_edge_detect.v: New testbenches

fpga/tests/plot_edgedetect.py: New script to plot the results from
the edge detection tests.

fpga/tests/tb_data: New directory for data and golden outputs
2014-06-27 14:27:03 +02:00
Martin Holst Swende 42f57e0294 Merged with master 2014-06-27 13:16:31 +02:00
iZsh b014c96d68 new command "lf snoop" to snoop raw ADC values
fpga/lo_read.v (lf_field): new argument.
fpga/fpga_lf.v: modify accordingly.

armsrc/apps.h (FPGA_MAJOR_MODE_LF_READER): Rename as FPGA_MAJOR_MODE_LF_ADC.
armsrc/apps.h (FPGA_LF_ADC_READER_FIELD): New LF option.
armsrc/lfops.c: Modify accordingly.

client/cmdlf.c (CmdLFSnoop): New command.
armsrc/appmain.c, armsrc/lfops.c, client/cmdlf.h, include/usb_cmd.h: Modify accordingly.
2014-06-21 21:33:54 +02:00
iZsh 62638f87db armsrc/fpgaloader.c: forgot the copyright notice 2014-06-20 12:29:58 +02:00
iZsh 7cc204bff8 THIS REQUIRES A BOOTROM UPDATE!! To save FPGA area, split the LF and HF bitstreams and load them on-demand. 2014-06-20 01:02:59 +02:00
penturalabs fecd8202a5 implemented 'hf iclass dump xxxx',
all you need is the magic key to dump contents of an iclass card
2014-06-17 10:55:37 +01:00
Martin Holst Swende 9f6e9d1575 More work on iclass simulation attack 2014-06-16 21:27:12 +02:00
Martin Holst Swende fa541aca96 Minor changes, it may actually work now, need to test with a credentialed reader 2014-06-07 22:16:57 +02:00
Martin Holst Swende 94ad01bfba Merged with head 2014-06-07 22:04:27 +02:00
Martin Holst Swende 81012e670b debug in progress 2014-06-07 22:00:31 +02:00
Martin Holst Swende e3dc1e4cf5 Minor changes in iclass.c 2014-06-07 21:49:56 +02:00
Martin Holst Swende 83fd67ba0b Added mode for 424k modulation (iso 15693) 2014-06-07 21:40:47 +02:00
Martin Holst Swende fdcd43eb15 Fixed (?) http://www.proxmark.org/forum/viewtopic.php?id=1967, two bytes are discarded when adding crc and sending raw iso14443a commands 2014-04-26 16:15:16 +02:00
Martin Holst Swende f83cc12613 More work on iclass 2014-04-24 15:48:00 +02:00