Philippe Teuwen
48724e44b4
hf mf sim: add --allowover option, needed for RF08S originality check
2025-07-25 20:54:18 +02:00
iceman1001
5de4dd68e5
text
2025-06-22 20:34:54 +02:00
iceman1001
65607fc727
added Ultralight-C simulation. hf mfu sim -t 13. Use eload first. Also added support to upload UL-C dictionaries and UL-AES to spiffs memory. A lot of textual reworked across client. Unifiy texts and a bit more color ;)
2025-06-19 17:26:20 +02:00
iceman1001
804acfbefa
the device side of iclass tear off is implemented. The base was done by @antiklesys. This version differs by the concept of trying to stabilize weak bits by performing a write operation in conjuction with the detected tear. Its untested but I can replicate most of the tears we performed client side. You will need to call the proxmark3 client with -f , ./pm3 -f to force flush out text which is needed for the inplace printing. I thought this was done automatically but it wasnt. hf iclass tear --arm + all the normal params to run on device side
2025-05-30 01:37:13 +02:00
iceman1001
cb4a0e2333
rename struct to follow code style
2025-04-30 13:27:41 +02:00
kormax
3550f11726
Remove mag argument from commands; Add support for magsafe polling via 14a config
2025-04-20 17:55:55 +03:00
kormax
56336d9d82
Add support for polling loop annotations
2025-04-09 12:31:21 +03:00
iceman1001
87c2e82e2f
style
2025-03-19 12:53:24 +01:00
douniwan5788
4bde83b89d
Added lf hitag htu support for Hitag µ/8265
2025-03-19 18:56:23 +08:00
iceman1001
2137284a93
style\n Some improvements to trace list -t seos annotations.
2025-03-12 16:41:06 +01:00
leecher1337
0e2a02bdf0
Implement new command hf 15 slixprotectpage to do ISO15693_PROTECT_PAGE on slix tags
2025-03-09 11:54:51 +01:00
iceman1001
cef07dedf6
code style, code clean up of redundant functions, comments, its many minor fixes across the platform. Sorry for not making 20 commits
2025-02-21 15:38:33 +01:00
Philippe Teuwen
1acc030fd4
rework simaid & rename few vars
2025-02-12 08:44:42 +01:00
n-hutton
4a23fb05f0
Cherry pick POC of emv simulation
2024-11-21 19:23:03 +00:00
ANTodorov
48ec109a1e
use all spi flash v0.1
...
* introduced a new communication command CMD_FLASHMEM_PAGES64K to get the number of 64k pages
* "the last page" is a special, holding the dicts and some other stuff, relocated to there
* raised timeout when wiping a mem page (W25Q16 looks a bit slower than W25X20BV)
* loop all pages in Flash_WipeMemory()
2024-11-17 19:03:15 +02:00
Philippe Teuwen
46813e0e50
hf mf isen: rewrite counters, add specific NONCE_SUPERSTATIC case (when first nt == nested nt)
2024-11-05 17:07:54 +01:00
Philippe Teuwen
838e0adfa7
rework Mifare simulation flags
2024-10-19 20:34:40 +02:00
Philippe Teuwen
079689628b
hf mf sim: add nested reader attack (needs data & rf08s nonces)
2024-10-16 19:54:03 +02:00
Philippe Teuwen
5b7ba3bf50
MFsim: RATS_IN_DATA was not a proper bit flag
2024-10-16 15:24:01 +02:00
Philippe Teuwen
a11ba61b01
hf mf ecfill: add support for quick dump via backdoor auth
2024-10-13 22:55:41 +02:00
iceman1001
c002ae9f77
style
2024-10-06 10:08:17 +02:00
douniwan5788
9a50e608e0
add PM3_REASON_UNKNOWN
2024-10-04 23:25:15 +08:00
douniwan5788
96d462acee
add: split PacketResponseNG status to status and reason
2024-09-24 03:10:53 +08:00
Adam Jon Foster
03fcc1d8d6
Update pm3_cmd.h
...
Signed-off-by: Adam Jon Foster <me@evildaemond.com>
2024-09-23 15:31:46 +08:00
Adam Jon Foster
d48d69b3e2
Update pm3_cmd.h
...
Added Header File
Signed-off-by: Adam Jon Foster <me@evildaemond.com>
2024-09-23 14:42:22 +08:00
Adam Jon Foster
92767a685f
Update pm3_cmd.h
...
Added RATS_IN_DATA as a definition
Signed-off-by: Adam Jon Foster <me@evildaemond.com>
2024-09-23 14:33:30 +08:00
iceman1001
db1b28f327
rename hts read/write commands to rdbl/wrbl to match rest of the client. added a lf hitag hts reader comamnd, modified the lf search to identify hitag2/s/82xx in the chipset detection
2024-09-14 21:00:42 +02:00
douniwan5788
9b879b0dc0
fix: exit status
2024-09-05 19:31:37 +08:00
douniwan5788
970c2d0999
refactor: remove positive error codes
2024-09-04 22:50:26 +08:00
Philippe Teuwen
c73e2ea623
Added support for collecting all fm11rf08s nT/{nT}/par_err at once
2024-09-02 23:11:36 +02:00
douniwan5788
8928883f2d
refactor: move FPGA_BITSTREAM_* to fpga.h
2024-08-26 20:55:58 +08:00
douniwan5788
d15537bbf1
Unified hitag naming style
2024-08-22 02:01:43 +08:00
Antiklesys
1832997ccb
Iclass Legacy Raw Key Recovery Function
...
Based on the work described in Dismantling iClass whitepaper.
hf iclass legbrute is tested working
hf iclass legrec is partially working: logic of operations and sequence seems to be in order and was tested on simulated data to be effective. The privilege escalation part is still not successful, but the logic should be correct.
2024-07-19 14:47:13 +08:00
iceman1001
05df50678c
missing header
2024-04-26 16:18:10 +02:00
iceman1001
87c6633de1
add support for generation 2 magic command when setting UID on ISO15693 cards. ref:: https://github.com/RfidResearchGroup/proxmark3/issues/1604#issuecomment-2068444071
2024-04-22 09:04:01 +02:00
Henry Gabryjelski
cc2bae2f4d
lf em 4x70 writekey --> lf em 4x70 setkey
2024-03-13 09:38:35 -07:00
Henry Gabryjelski
ba83ac065e
lf em 4x70 writepin --> lf em 4x70 setpin
2024-03-13 09:25:43 -07:00
iceman1001
c4c1601446
added rudimentary functions for doing AES authentication against MIFARE UL AES tags. (wip)
2024-02-15 16:20:47 +01:00
Christian Zietz
dbfd8b7a6d
Make detection threshold for ISO14443A configurable
...
This adds a new command "hw sethfthresh" to configure the thresholds
used inside the FPGA while demodulating ISO14443A. The thresholds
need to be increased on particularly noisy hardware, such as certain
Chinese PM3 Easy clones.
2024-02-02 20:51:05 +01:00
iceman1001
303c6b6067
style
2024-01-26 12:45:23 +01:00
nvx
e22776a7e0
style
2024-01-26 20:20:25 +10:00
nvx
49f7ae57dc
Changed hf mf gdmcfg/gdmsetcfg commands to support Gen1a and GDM Alt magic wakeups
...
This was implemented with a new pair of RPCs CMD_HF_MIFARE_READBL_EX and CMD_HF_MIFARE_WRITEBL_EX
these RPCs support all combinations of read/write commands, wakeup, and auth options so
in time can replace the other MFC read/write commands too reduce armsrc code size
and complexity.
Also added config parsing for the gdm cfg block when reading with hf mf gdmcfg and
explicitly with hf mf gdmparsecfg.
2024-01-26 20:09:08 +10:00
iceman1001
ba578ee139
hf 15 sim, reverse uid and a shorter read from emul to get uid if none is user given
2024-01-25 00:34:05 +01:00
Martijn Plak
1d14bc38c5
Rename CMD_READ_MEM_DOWNLOAD flag.
...
It got included in pm3_cmd.lua but shouldn't be because it's not a command.
Also, the bitshift in the value upsets some versions of lua.
2024-01-24 16:36:52 +01:00
Martijn Plak
e35385fde1
Adding processor flash memory reading, viewing and writing to file.
...
Works when the device is running either osimage or bootloader.
- New memory reading command in osimage and bootloader.
- Extended 'hw readmem' command with length parameter, file writing and hex viewer.
- Introduced '--dumpmem' option to proxmark3 executable to support dumping from bootloader.
Simple interactive examples:
hw readmem -f flashdump
hw readmem -l 1024
CLI example:
./pm3 --dumpmem flashdump.bin
Reading from arbitrary memory ranges can be unlocked using the 'raw' option.
2024-01-22 16:40:05 +01:00
iceman1001
82aa6ac08c
gave 14b commands some serious love and overhaul. package handling for APDU and different selects is improved. return codes now consequent
2024-01-08 21:17:42 +01:00
wh201906
ecec001fdd
Put uart_bind() into uart_common.c
2023-12-26 17:56:14 +08:00
merlokk
91892bc1bf
add static encrypted nonce detection
2023-12-11 21:24:26 +02:00
wh201906
bb529a9077
Fix corrupted data caused by CMD_WTX
...
No need to wait for 2.5s (1s + FPGA_LOAD_WAIT_TIME) if the real-time
sampling stops.
Make sure the LF bitstream is loaded before real-time sampling so the
response of CMD_WTX won't appear.
2023-12-02 17:04:03 +08:00
iceman1001
a913b2c662
style
2023-12-01 10:59:18 +01:00
