- provided a BigBuf_malloc() function to dynamically allocate parts of BigBuf
e.g. for DMA-Buffers, Frame-Buffers, Emulator-Memory
- the whole rest of BigBuf is now available for traces (instead of a small fixed amount)
- send actual traceLen together with trace data
- changed client side to cope with varying traceLen
- changed small buffers to automatic variables instead of parts of BigBuf
added data fskparadoxdemod
added data setdebugmode (for demods)
added data shiftgraphzero (to help clean weak reads)
fixed a few bugs with the data detectaskclock
added data fskfcdetect to detect FSK clocks
adjusted most of my demods to put raw tag binary to demod buffer for
future sim and clone commands (psk still needs work)
ADD: added a manufacturer list in "hf 14a reader", only viable when UID is double or triple size. Thanks to Asper for the list.
ADD: detect chinese magic backdoor commands in "hf 14a reader"
CHG: minor code clean up.
CHG: refactored the "hf mfu rdbl/wrbl/crdbl/wrbl" commands.
CHG: added a cauth test to "hf mfu info" command to see if the tag is a Ultralight-C tag or not.
REM: removed old comments in bootrom.c
CHG: mifare ultralight & desfire commands inside arm has been cleaned up. Next step is to refactor it into armsrc/mifaredesfire.c
ADD: added a HF MFU INFO commmand, where you can see some tag info. Used to be in the readcard command.
FIX: minor code clean up for ultralight & desfire commands in armsrc/mifarecmd.c, armsrc/mifaredesfire.c, armsrc/mifareutil.c
CHG: Lowered the default MF_DBGLEVEL, it set to MF_DBG_ERROR.
CHG: lowered a testing value for timeout in cmdhf14a.c
ADD: added a manufacturer list for hf 14a reader, only viable when UID is double or triple size. Thanks to Asper for the list.
ADD: Some changes from Holimans commits.
CHG: some more code clean up.
CHG: USB_CMD_DATA_SIZE is now used as maxsize for transfer of data between client and pm3device
CHG: suggested a fix for the underscore problem in ioclass\fileutils.c
ADD: tnp3xx support
ADD: nxp tag idents.
ADD: identifiction of chinese backdoor commands to hf 14a reader.
FIX: changed the DetectASKClock in lfdemod.c to correct detect all clocks in the array.
CHG: I like code with more spaces inside of it and tried change some stuff according to our codestyle in HACKING.txt
ADD: some zero checks and overflows, god knows where it was.
The T55XX commands will be rewritten to use Marshmellows lfdemod.c instead.
CHG: Made the graph window smaller.
CHG: lf read now does a "data samples" also. (less writing commands)
CHG: data samples now defaults to samples size of 20000
ADD: Marshmellows fixes for the LF (demods) commands, (LF SEACH)
ADD: Holimans changes with hash1_brute
FIXES: minor fixes with some calls to "free" and redundant debug statement and code cleanup. removal of commented code.
fixed a few bugs in lf demod that the streamlining added. added new lf
em em410xdemod command that loops until button pressed. (similar to lf
hid fskdemod
FIX: a suggested patch for "hf mf csetuid" (https://github.com/Proxmark/proxmark3/issues/35)
FIX: fixed a bug in iso14443a_select_card where the len variable wasnt set, this made desfire/magic cards not work.
- introduced with the big frame and parity support (commit 6a1f2d82): tag responses with len%8 == 0 were dropped - thanks iceman for testing and finding
- after unsuccessful hf 14a reader the field stayed on. Thanks to iceman for proposing the fix.
- unified hw tune and Enio's great data tune
- don't use BigBuf (and hardcoded Offset)
- removed special handling of CMD_MEASURED_ANTENNA_TUNING
in UsbCommandReceived()
Applied PwPiwi's new parity fix.
Applied Marshmellw's fixes for FSKdemod (HID, IO)
FIX: a potential bigbuffer fault given pwpiwi's change inside lfops.c CmdIOdemodFSK & CmdHIDdemodFSK
FIX: change some "int" parameters to uint's.
FIX: changed the lfops.c - DoAcquisition125k_internal to respect pwpiwi's definitions of FREE_BUFFER_OFFSET
HEADS up: The ultralight functions hasn't been verified since pwpiwi's changes.
- buffers were too small to handle 256 byte frames
- parity bits were only handled for up to 32 byte frames
- trace format was inefficient
- removed parity calculation from decoders in iclass.c (parity not used on air anyway)
ADD: found some new default keys
ADD: changed alot of memorys buffers to use constant values. like usbbuffer sizes, tracelogs, etc etc
ADD: all changes Peter filmoore has in his pull request.
FIX: hf mf esave - now supports specifying 0,1,2,4 in card memory for the file to be saved.
ADD: data.h - added FILE_PATH_SIZE constant
ADD: hf legic load - a command help and checks for FILE_PATH_SIZE
ADD: hf legis save - now checks for FILE_PATH_SIZE
ADD: lf hitag - now checks for FILE_PATH_SIZE
ADD: util.c - AddLogLine now checks for FILE_PATH_SIZE
ADD: data load / save - now checks for FILE_PATH_SIZE
FIX: ui.c - added a case of closing a filehandle
FIX: hf mf cload / csave now checks for FILE_PATH_SIZE
FIX: armsrc/mifarecmd.c - adjusted the buffersize in MifareEMemget from 48 to USB_CMD_DATA_SIZE
Fix: removed a call to free, which I think made linux people unhappy during "lf t55xx rd 0"...
Add: "lf t55xx fsk" now kind of outputs binary from "FSK2a R/40 R/50"..
- hf mf rdsc (fix): didn't account for 16 block sectors, allowed max sector 63 instead of 39
- hf mf ecfill (add): added (optional) card size parameter and support for non 1K cards
- hf mf dump (add): added (optional) card size parameter and support for non 1K cards
- hf mf dump (fix): Access Condition 011 not handled correctly (tried to access with key A)
- hf mf restore (add): added (optional) card size parameter and support for non 1K cards
- hf mf nested (fix): didn't account for 16 block sectors, allowed max sector 63 instead of 39
- hf mf nested (fix): always dumped 16 keys to dumpkeys.bin instead of correct number
- hf mf chk (fix): always dumped 16 keys to dumpkeys.bin instead of correct number
- hf mf eget (fix): displayed three instead of one block
- hf mf eload (add): load 4K .eml files (but accepts 1K .eml files for backwards compatibility)
- hf mf esave (add): always save the whole emulator memory (4K) instead of 1K only
- hf mf ecfill (add): added (optional) card size parameter and support for non 1K cards
- output of debug messages caused communication failures due to timing issues.
hf mf dbg 4 now required to see these debug messages.
- changed help text for hf mf dbg
- fixed minor bugs in help texts for hf mf sim and hf mf ecset
- display "key A" or "key B" instead of "key=0" or "key=1 in hf mf sim
- tracing was not always enabled when starting hf mf sniff or hf 14a snoop
- ATQA was displayed in wrong byte order in hf mf sniff
- 4 Byte UIDs were displayed as 7 Byte UIDs (padded with 0x000000) in hf mf sniff
- same for logfile names.
- assignment (=) had been used instead of == in comparisons (shouldn't have been relevant though)
This is a new LF edge detection algorithm for the FPGA.
- It uses a low-pass IIR filter to clean the signal
(see https://fail0verflow.com/blog/2014/proxmark3-fpga-iir-filter.html)
- The algorithm is able to detect consecutive peaks in the same
direction
- It uses an envelope follower to dynamically adjust the peak thresholds
- The main threshold used in the envelope follower can be set from the ARM side
fpga/lf_edge_detect.v,
fpga/lp20khz_1MSa_iir_filter.v,
fpga/min_max_tracker.v: New file.
fpga/lo_edge_detect.v, fpga/fpga_lf.v: Modify accordingly.
armsrc/apps.h (FPGA_CMD_SET_USER_BYTE1,
FPGA_CMD_SET_EDGE_DETECT_THRESHOLD): New FPGA command.
fpga/fpga_lf.v: Modify accordingly/Add a 8bit user register.
fpga/fpga_lf.bit: Update accordingly.
fpga/tests: New directory for testbenches
fpga/tests/Makefile: New file. It compiles the testbenches
and runs all the tests by default (comparing with the golden output)
fpga/tests/tb_lp20khz_1MSa_iir_filter.v,
fpga/tests/tb_min_max_tracker.v,
fpga/tests/tb_lf_edge_detect.v: New testbenches
fpga/tests/plot_edgedetect.py: New script to plot the results from
the edge detection tests.
fpga/tests/tb_data: New directory for data and golden outputs
- fixed a circular buffer rollover bug in iso14443a.c
- fixed 7 Byte UID handling in hf mf sniff
- fixed "cannot append" error in hf mf sniff d
- fixed hint on mfkey32 in hf mf sim x
- fixed hf mf sniff sometimes showing rogue data from previous calloc
- improve snooping/sniffing by syncing modulation detector window with reader signal (hi_iso14443a.v)
- code cleanup of hi_iso14443a.v
- enhanced tracing: hf 14a list now shows meaningful timing information. With new option f it also shows the frame delay times (fdt)
- small fix for hf 14b list - it used to run into the trace trailer
- hf 14a sim now obeys iso14443 timing (fdt of 1172 or 1234 resp.)
Note: you need to flash FPGA as well.
More details in http://www.proxmark.org/forum/viewtopic.php?pid=9721#p9721
- PM: used GetCountMifare in MifareNested() for improved timing accuracy and to deliver better quality nonces
- PM: MifareNested now delivers exactly two different nonces to avoid time consuming multiple lfsr_recovery32() on client side
- Client: replaced quicksort by bucketsort in crapto1.c which is faster
- Client: use multithreading (two parallel calls to lfsr_recovery32())
- Client: fixed a small bug in mfnested() (always showed trgkey=0)
- Client: introduced a mutex for PrintAndLog() to avoid interlaced printing
Minor rework of hf mf chk:
- Avoid time consuming off/on cycles. Send a "halt" instead.
* Modified commands (lf em4x):
em410xwatch ['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)
em410xwrite <UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate
* Better option checking for em410xwrite & fix for uninitialized vars
* Increased samples from 2000 to 4000 in em410xwatch (2000 is OK for clock=64, but too few for clock=32)
This fixes the bug that the USB communication breaks when collecting PACE nonces with no delay. The delay functionality has not been removed (it doesn't hurt to keep it), but using a delay of 0 is now possible without a high risk of getting too many errors.
-new files armsrc/epa.[ch] for ePA (electronic "Personalausweis") related functions
-Offers elementary functions (EPA_PACE_MSE_Set_AT etc.)
-Also offers one new USB command: EPA_PACE_Collect_Nonce
-created new command subtree in client: client/hfepa.[ch] ("hf epa")
-offers "hf epa cnonces" (collect encrypted PACE nonces)
-more to come
-According to ISO14443-4, the block number (bit 0) in the PCB needs to be flipped every once in a while. Not doing so leads to the card not responding to commands anymore. The flipping is done according to the standard now.
-Declare iso14_apdu in iso14443a.h to enable usage from other .c files
-iso14_apdu now returns 0 if ReaderReceive returned 0 (to distinguish between the case that ReaderReceive returns -1 and the case that it returns 0)
-Added a new function to change the timeout (to enable changing it from other .c files without the need for a global variable)
2. added increment, decrement, restore, transfer commands
3. fixed several small bugs and small code cleaning
4. there is strange behavier in the emulator: for 7BUID is seems that there is must be a feature that cam make work card withouth 2nd anticollision loop. NXP reader authenticates, but cant read card contents. all the rest readers works, BUT.... my 7BUID mifare card dont work AT ALL .... I dont know what i should do )
2. added abilities to: clear, get, set, load from card, load from nested card emulator dump
3. tried to fix proxmark promt have seen everywhere (not so good)
4. reorganized arm code
2. emulator commands select, authenticate, read block, write block works
3. nested authentication - not working (maybe next release)
4. small bugfixes
5. mifare1ksim - in alpha state!!! code not so clear!!!
1. commands changed from "hf 14a" to "hf mf"
2. some code cleaning and small bugfixes
3. alpha version hf mf sim
4. added internal function GetTickCount() for time measuring
Add a RAMFUNC function attribute to have functions copied to and run from ram.
Fix "blew circular buffer" error in hf 14a snoop by executing SnoopIso14443a from ram (eats about 3.5k of ram)
I have kept whatever copyright notices exist. Please add your own
copyright notice if you have made any nontrivial changes or additions to
the code. There are several files without any attribution, currently.
Next Step is refactoring some of the giant functions which are
just copy/paste of some other ones with just a few line changes,
removing unnecessary 'goto' etc.
The MS Windows version is broken with this commit but will be fixed
soon. Everything can't be done all at once :P
The commands are now hierarchical, for example:
"hf 14a read" vs. "hf 14b read".
You can also request help:
"hf help", "data help", "hf 15 help" etc.
Indents are now space-based, not tab-based anymore. Hopefully
no one will be trolling about it, considering the suicide-prone work
being done here ;)
client/cmdhw.c, client/proxusb.c, client/cmdhw.h, client/proxusb.h,
client/cmdmain.c, client/cmdlfhid.c, client/cmdmain.h, client/cmdlfhid.h,
client/data.c, client/data.h, client/cmdhf.c, client/cmdlf.c,
client/cmdhf.h, client/cmdhf15.c, client/cmdhf14b.c, client/cmdlf.h,
client/cmdhf15.h, client/cmdhf14b.h, client/cmddata.c, client/cmddata.h,
client/ui.c, client/cmdparser.c, client/cmdlfti.c, client/ui.h,
client/cmdlfem4x.c, client/cmdparser.h, client/cmdlfti.h, client/cmdlfem4x.h,
client/graph.c, client/graph.h, client/cmdhf14a.c, client/cmdhf14a.h,
client/cmdhflegic.c, client/cmdhflegic.c: New files.
client/cli.c, client/flasher.c, client/snooper.c, client/proxmark3.c,
client/proxmark3.h, client/Makefile: Update accordingly.
client/flash.h, client/flash.c, client/proxgui.cpp: Cosmetic changes.
client/translate.h, client/command.c, client/gui.c,
client/usb.c, client/prox.h: Remove.
include/usb_cmd.h (CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443_SIM): Remove dead cmd.
common/crc16.h: New file.
common/crc16.c: Modify accordingly.
common/iso14443crc.h: New file.
common/iso14443_crc.c: Rename to
common/iso14443crc.c: and modify accordingly.
armsrc/lfops.c, armsrc/iso14443.c,
armsrc/iso14443a.c: include .h files from
the common directory instead of including the c files.
common/Makefile.common, armsrc/Makefile: Modify accordingly.
+ Add common area at end of RAM to communicate between main os and bootrom
+ Lower stack end to make room for common area
+ Implement CMD_DEVICE_INFO in both OS and bootrom to give information about the current state and supported features
+ Allow hands-free firmware update: When CMD_START_FLASH is received over USB in OS mode, the device will reset and enter the bootrom
Pressing the button in hands-free update mode takes precedence: releasing the button will immediately abort firmware update and
perform a reset. Do not press the button.
+ Require each flash sequence to be preceded by a CMD_START_FLASH to set up the boundaries for the following flash sequence
Not compatible with linux flasher before SVN revision 200
Currently no compatible flasher for Windows. WINDOWS USERS: DO NOT UPDATE YOUR BOOTROM YET
+ Protect bootrom flash area unless magic unlock sequence is given in CMD_START_FLASH
Use perl to create the version information (thereby re-creating the perl dependency and adding an svn dependency) but fall back in case of missing perl or svn
Retire rbt2c.pl, instead use objcopy to directly convert the .bit file into an .o that can be linked with the flash image
Rename armsrc/fpga.c to armsrc/fpgaloader.c (since there is now a new fpga.o, created from fpga.bit)
Remove fpgaimg.c from subversion, add fpga.bit
Instead of creating fpgaimage.elf and osimage.elf separately, now create a joined fullimage.elf
first (obsoleting ldscript-full), then extract only the fpga and os sections with objcopy
(This creates unspecific warnings about an empty segment, need to investigate)
Implement a rudimentary .bit parser in the firmware, use that to locate the bitstream in the new
fpgaimage (which is just a plain copy of the fpga.bit file) and send it to the FPGA
The code will check the format that's in flash and fall back to the legacy format
Remove the now unnecessary files (merge-srec.pl, ldscript-ram-jtag)
Note that this drops the dependency on perl for bootrom build, so end-users who don't touch the FPGA bitstream will not need perl anymore
+ Needs GNU make for Windows, a new release of the Windows development environment will follow
+ Is based on the Windows Makefile, so will build everything in Thumb mode, doesn't have flash commands (yet)
and LED A, B and C respectively show:
- Receiving from reader
- Transmitting to tag/reader
- Receiving from tag
Also, updated the snoop function to make full use of the DMA buffer, which removes (in my case) all the 'blew DMA buffer' issues.
Last, moved the compilation of iso1443.c to ARM mode (not thumb) to make it faster on my Linux gcc 4.3 version, otherwise the 'blew DMA buffer' issue was systematic.
Also: restored the "indalademod" command which had mysteriously disappeared from the prox.exe (proxmark3) client!
- Cleaned up Makefile.linux in armsrc directory
- Added Linux toolchain build script in tools directory
- Made LCD support optional (disabled by default) in armsrc
- Small formatting changes
I have a problem with CRC though: sometimes it works, sometimes not, I have no
clue why, I must be doing something wrong with the CRC calculation routine...
It is identical to the popular 20081211, with the doob addition (20090301), a
linux client, and two additional commands for LF analysis. Let me know if
you find issues here!
