Commit graph

751 commits

Author SHA1 Message Date
iceman1001 c66e781a9c annotation of the hitag2 protocol now properly identifies different parts without shifting of whole hex arrays. Took the idea from RFIdler (@adamLLaurie) where he treats it like a binary string instead. It works. Problem: We use whole bytes in our logging protocol and Hitag2 uses 5, 10, 32, 64 bits commands. START_AUTH is 11000, which as a MSB aligned byte is 0xC0. Now we shift it down to LSB centered and 11000 becomes 0x18. This reduces all issues with handing the rest of the array. \n\nTake note that our protocol uses whole bytes. I had to print out number of actually captured bits in the trace log now. Otherwise 65 or 71 bits would not look any different but will not work when used with other tools. This also means we abuse the logging protocol by using the parity byte arry to store number of "left over bits" in the par[0] position. 2024-03-26 15:04:39 +01:00
Henry Gabryjelski cc2bae2f4d lf em 4x70 writekey --> lf em 4x70 setkey 2024-03-13 09:38:35 -07:00
Henry Gabryjelski ba83ac065e lf em 4x70 writepin --> lf em 4x70 setpin 2024-03-13 09:25:43 -07:00
Henry Gabryjelski 0a598b254c make style changes 2024-03-11 17:28:05 -07:00
Henry Gabryjelski 160d61682b Add lf em 4x70 autorecover
Also:
* common.h: Increase safety of some of the macros.
  Parenthesizing the macro parameters ... a best practice.
* firmware: partially-tracked source of "extra bits" messages.
  Add a TODO comment for further study.
* Improve reliability of `lf em 4x70 writekey`
  Authenticate w/new key after it is written.
  Particularly important for glass modules,
  or other tags with weaker coupling.
2024-03-11 17:14:03 -07:00
Henry Gabryjelski 4ebd6d4bff Add id48lib and second half of key recovery. 2024-03-03 12:16:16 -08:00
francesco-scar 2ba0fbdcde Added led order parameter (for Proxmark3 Easy board) 2024-02-18 12:57:26 +01:00
iceman1001 c4c1601446 added rudimentary functions for doing AES authentication against MIFARE UL AES tags. (wip) 2024-02-15 16:20:47 +01:00
Iceman 6c726b9e21
Merge pull request #2284 from czietz/configurable_noise_level
Configurable detection levels in ISO14443A and Legic modes
2024-02-03 13:52:26 +01:00
iceman1001 c49a7c040b added a lf em 4x50 view command and lf em 4x50 dump now supports the nosave flag 2024-02-03 11:09:28 +01:00
Christian Zietz dbfd8b7a6d Make detection threshold for ISO14443A configurable
This adds a new command "hw sethfthresh" to configure the thresholds
used inside the FPGA while demodulating ISO14443A. The thresholds
need to be increased on particularly noisy hardware, such as certain
Chinese PM3 Easy clones.
2024-02-02 20:51:05 +01:00
iceman1001 81ce1fd4ab changed magic detection to use flags. Fixes previous problems with magic ntag, also renamed defines to seperate them better. 2024-02-02 15:53:57 +01:00
iceman1001 5de626992f extended read block and read block annotation. Adapt select_card to keep antenna on when dump/info 2024-01-26 22:09:37 +01:00
iceman1001 68d9fe3232 annotate xerox reads 2024-01-26 21:10:11 +01:00
iceman1001 d5b1ff013f annotate XEROX wup 2024-01-26 20:33:08 +01:00
iceman1001 98f64a4ca5 annotate XEROX a bit better 2024-01-26 20:26:43 +01:00
iceman1001 8e2fb4a6a7 increased the number of pages in the dumps to 160. 0xA0. Its should cover 128 / 0x80 and potential larger ones 2024-01-26 14:25:39 +01:00
iceman1001 303c6b6067 style 2024-01-26 12:45:23 +01:00
nvx e22776a7e0 style 2024-01-26 20:20:25 +10:00
nvx 49f7ae57dc Changed hf mf gdmcfg/gdmsetcfg commands to support Gen1a and GDM Alt magic wakeups
This was implemented with a new pair of RPCs CMD_HF_MIFARE_READBL_EX and CMD_HF_MIFARE_WRITEBL_EX
these RPCs support all combinations of read/write commands, wakeup, and auth options so
in time can replace the other MFC read/write commands too reduce armsrc code size
and complexity.

Also added config parsing for the gdm cfg block when reading with hf mf gdmcfg and
explicitly with hf mf gdmparsecfg.
2024-01-26 20:09:08 +10:00
iceman1001 ba578ee139 hf 15 sim, reverse uid and a shorter read from emul to get uid if none is user given 2024-01-25 00:34:05 +01:00
Iceman 769a0aa26b
Merge pull request #2270 from martian/rename-cmdreadmem-flag
Rename CMD_READ_MEM_DOWNLOAD flag.
2024-01-24 17:11:15 +01:00
Martijn Plak 1d14bc38c5 Rename CMD_READ_MEM_DOWNLOAD flag.
It got included in pm3_cmd.lua but shouldn't be because it's not a command.
Also, the bitshift in the value upsets some versions of lua.
2024-01-24 16:36:52 +01:00
Yann GASCUEL 05912ff130 iso15sim: rename, move and PACK iso15_tag struct to be usable in client 2024-01-24 13:59:13 +01:00
Martijn Plak e35385fde1 Adding processor flash memory reading, viewing and writing to file.
Works when the device is running either osimage or bootloader.

- New memory reading command in osimage and bootloader.
- Extended 'hw readmem' command with length parameter, file writing and hex viewer.
- Introduced '--dumpmem' option to proxmark3 executable to support dumping from bootloader.

Simple interactive examples:
  hw readmem -f flashdump
  hw readmem -l 1024
CLI example:
  ./pm3 --dumpmem flashdump.bin

Reading from arbitrary memory ranges can be unlocked using the 'raw' option.
2024-01-22 16:40:05 +01:00
iceman1001 14ad94e4a0 missed is 2024-01-16 15:44:42 +01:00
iceman1001 61573a014e fix decoding of info in view command and turning off at select card 2024-01-14 20:26:56 +01:00
iceman1001 0b022e3c7e text 2024-01-14 16:17:40 +01:00
iceman1001 8d0b41a911 this commit fixes #2244 #2246 #1596 #2101. Its kind of a big refactoring and I most likely broke something. With that said. Now: HF 15 commands now uses NG packets, hf 15 raw support -k keepfield on and -s select, hf 15 dump/rdbl/rdmulti should handle blocksizes of 4 or 8, the error messages are unified and error handling the same. Some understanding how add_option impacts response message from card. A more clear separation between PM3 flags and ISO15693 protocol flags. 2024-01-14 14:23:51 +01:00
iceman1001 82aa6ac08c gave 14b commands some serious love and overhaul. package handling for APDU and different selects is improved. return codes now consequent 2024-01-08 21:17:42 +01:00
iceman1001 a6c1d90ba8 forgot one 2024-01-01 21:40:48 +01:00
nvx 8f577ad963 Improved magic detection
Magic detection no longer stops when a single type is found as cards may support multiple types of magic, so all detected types will be reported now.
GDM/USCUID chips are now detected when GDM magic auth is disabled but magic WUP (40 or 20) is enabled.
Gen2/CUID/DirectWrite is now detected when default keys and ACLs are used by attempting to write to block 0 but aborting before actually completing the write.
2023-12-30 19:53:23 +10:00
wh201906 ecec001fdd
Put uart_bind() into uart_common.c 2023-12-26 17:56:14 +08:00
merlokk 91892bc1bf add static encrypted nonce detection 2023-12-11 21:24:26 +02:00
wh201906 bb529a9077
Fix corrupted data caused by CMD_WTX
No need to wait for 2.5s (1s + FPGA_LOAD_WAIT_TIME) if the real-time
sampling stops.
Make sure the LF bitstream is loaded before real-time sampling so the
response of CMD_WTX won't appear.
2023-12-02 17:04:03 +08:00
iceman1001 a913b2c662 style 2023-12-01 10:59:18 +01:00
Iceman 17a93a3b1b
Merge pull request #2173 from wh201906/lf_sniff_clean
Real-time LF sampling
2023-12-01 10:54:10 +01:00
wh201906 ab9f49f86e
Some minor fixes
Use longer timeout in WaitForRawDataTimeout() to handle CMD_WTX
Fix a wrong type
Apply changes to other similar part
Remove unused instructions
2023-11-14 10:46:45 +08:00
wh201906 b4cc7c02cd
Real-time LF sampling mode on armsrc 2023-11-14 01:43:20 +08:00
wh201906 9e8b1ceda7
Reduce duplicate payload structure for lf read/sniff 2023-11-14 01:05:27 +08:00
Philippe Teuwen ba8e90edfd make style 2023-11-11 18:24:34 +01:00
iceman1001 21fa3331b5 set array pointer to end of struct. Otherwise we will have some issues 2023-11-11 15:47:58 +01:00
iceman1001 094882454d missing structs 2023-10-30 22:23:07 +01:00
wh201906 de7b6f35bc
Clean up the code for timeout
Rename UART_TCP_CLIENT_RX_TIMEOUT_MS to UART_NET_CLIENT_RX_TIMEOUT_MS
Add UART_UDP_LOCAL_CLIENT_RX_TIMEOUT_MS for shorter timeout
Check if the target address is local in uart_open()
2023-10-25 23:45:23 +08:00
iceman1001 0442e04e05 text 2023-10-15 13:19:33 +02:00
iceman1001 fc6feea0d4 experimental UDP support. Doesnt quite work yet 2023-10-14 20:30:13 +02:00
iceman1001 0ff41fa652 style 2023-10-12 14:53:26 +02:00
iceman1001 7b3e84c0d6 better fix for the PAGEMAP issue 2023-10-09 15:14:53 +02:00
iceman1001 d41f0c394e hf iclass wrbl - the pagemap bit maps isnt the best to handle all four cases. This atleast fixes one issue with them 2023-10-09 15:04:49 +02:00
iceman1001 4f96d3eb46 style 2023-10-03 17:10:39 +02:00