RfidResearchGroup/proxmark3
1
1
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-01-27 18:38:03 +08:00
Code Issues Projects Releases Packages Wiki Activity
867 commits 3 branches 15 tags 86 MiB
Commit graph

309 commits

Author SHA1 Message Date
Martin Holst Swende
9b82de75f4 more work towards iclass elite dumping.. not quite finished yet though :( 2014-06-30 00:20:40 +02:00
Martin Holst Swende
aa41c6058a Merged two iclass-reader functions into one to remove duplicated code, update loclass library with hash2 algo 2014-06-29 23:34:24 +02:00
Martin Holst Swende
dbf732ee41 Minor 2014-06-29 13:48:13 +02:00
Martin Holst Swende
26c0d833ac Some minor changes [iclass-related] 2014-06-28 22:57:48 +02:00
Martin Holst Swende
3ad48540d4 Merge branch 'iclass-research' of https://github.com/PenturaLabs/proxmark3 into PenturaLabs-iclass-research 
Conflicts:
	README.txt
	armsrc/apps.h
	client/Makefile
	client/cmdhficlass.c
	client/cmdhficlass.h
 2014-06-28 20:52:37 +02:00
Martin Holst Swende
6db28145ea Merge remote-tracking branch 'origin/master' into iclass-fixes 2014-06-28 12:47:40 +02:00
iZsh
3b2fee43ea New LF edge detection algorithm + lowpass filter 
This is a new LF edge detection algorithm for the FPGA.

- It uses a low-pass IIR filter to clean the signal
(see https://fail0verflow.com/blog/2014/proxmark3-fpga-iir-filter.html)
- The algorithm is able to detect consecutive peaks in the same
  direction
- It uses an envelope follower to dynamically adjust the peak thresholds
- The main threshold used in the envelope follower can be set from the ARM side

fpga/lf_edge_detect.v,
fpga/lp20khz_1MSa_iir_filter.v,
fpga/min_max_tracker.v: New file.

fpga/lo_edge_detect.v, fpga/fpga_lf.v: Modify accordingly.

armsrc/apps.h (FPGA_CMD_SET_USER_BYTE1,
FPGA_CMD_SET_EDGE_DETECT_THRESHOLD): New FPGA command.
fpga/fpga_lf.v: Modify accordingly/Add a 8bit user register.

fpga/fpga_lf.bit: Update accordingly.

fpga/tests: New directory for testbenches

fpga/tests/Makefile: New file. It compiles the testbenches
and runs all the tests by default (comparing with the golden output)

fpga/tests/tb_lp20khz_1MSa_iir_filter.v,
fpga/tests/tb_min_max_tracker.v,
fpga/tests/tb_lf_edge_detect.v: New testbenches

fpga/tests/plot_edgedetect.py: New script to plot the results from
the edge detection tests.

fpga/tests/tb_data: New directory for data and golden outputs
 2014-06-27 14:27:03 +02:00
Martin Holst Swende
42f57e0294 Merged with master 2014-06-27 13:16:31 +02:00
iZsh
b014c96d68 new command "lf snoop" to snoop raw ADC values 
fpga/lo_read.v (lf_field): new argument.
fpga/fpga_lf.v: modify accordingly.

armsrc/apps.h (FPGA_MAJOR_MODE_LF_READER): Rename as FPGA_MAJOR_MODE_LF_ADC.
armsrc/apps.h (FPGA_LF_ADC_READER_FIELD): New LF option.
armsrc/lfops.c: Modify accordingly.

client/cmdlf.c (CmdLFSnoop): New command.
armsrc/appmain.c, armsrc/lfops.c, client/cmdlf.h, include/usb_cmd.h: Modify accordingly.
 2014-06-21 21:33:54 +02:00
iZsh
62638f87db armsrc/fpgaloader.c: forgot the copyright notice 2014-06-20 12:29:58 +02:00
iZsh
7cc204bff8 THIS REQUIRES A BOOTROM UPDATE!! To save FPGA area, split the LF and HF bitstreams and load them on-demand. 2014-06-20 01:02:59 +02:00
penturalabs
fecd8202a5 implemented 'hf iclass dump xxxx', 
all you need is the magic key to dump contents of an iclass card
 2014-06-17 10:55:37 +01:00
Martin Holst Swende
9f6e9d1575 More work on iclass simulation attack 2014-06-16 21:27:12 +02:00
Martin Holst Swende
fa541aca96 Minor changes, it may actually work now, need to test with a credentialed reader 2014-06-07 22:16:57 +02:00
Martin Holst Swende
94ad01bfba Merged with head 2014-06-07 22:04:27 +02:00
Martin Holst Swende
81012e670b debug in progress 2014-06-07 22:00:31 +02:00
Martin Holst Swende
e3dc1e4cf5 Minor changes in iclass.c 2014-06-07 21:49:56 +02:00
Martin Holst Swende
83fd67ba0b Added mode for 424k modulation (iso 15693) 2014-06-07 21:40:47 +02:00
Martin Holst Swende
fdcd43eb15 Fixed (?) http://www.proxmark.org/forum/viewtopic.php?id=1967, two bytes are discarded when adding crc and sending raw iso14443a commands 2014-04-26 16:15:16 +02:00
Martin Holst Swende
f83cc12613 More work on iclass 2014-04-24 15:48:00 +02:00
Martin Holst Swende
17cba2693d Implemented client side changes for iclass hack, attempted to fix issues with trace. The trace functionality from iso14443 has been rewritten, unfortunately iclass used that also, which made iclass 'list' stop functioning, both for simulation and snooping 2014-04-24 14:13:33 +02:00
Martin Holst Swende
ff7bb4ef17 Experimenting with hacking iclass 2014-04-17 09:53:54 +02:00
penturalabs
c3963755b7 Implement replay command. 2014-04-15 11:47:01 +01:00
Martin Holst Swende
cba867f202 Final (?) fixes to git versioning https://github.com/Proxmark/proxmark3/issues/10 2014-04-04 20:14:58 +02:00
ikarus
9c6837165b Updated nameing (svn -> git) & fixed whitespaces. 2014-04-02 21:46:25 +02:00
Martin Holst Swende
07976a256d Refactoring low frequency operations, now 'lf hid fskdemod' is more stable. Also did changes to handling ioprox tags, this is yet untested, so until it's been tested it should be kept off 'stable' branch 2014-03-31 17:57:14 +02:00
Martin Holst Swende
69d88ec463 Major refactoring of lfops, removed a lot of duplicate code 2014-03-30 15:59:54 +02:00
pwpiwi
d714d3effc Improvements/Fixes to 14443 sniffing/snooping 
- fixed a circular buffer rollover bug in iso14443a.c
- fixed 7 Byte UID handling in hf mf sniff
- fixed "cannot append" error in hf mf sniff d
- fixed hint on mfkey32 in hf mf sim x
- fixed hf mf sniff sometimes showing rogue data from previous calloc
- improve snooping/sniffing by syncing modulation detector window with reader signal (hi_iso14443a.v)
- code cleanup of hi_iso14443a.v
 2014-03-25 21:38:24 +01:00
penturalabs
a1f3bb120f Added Kantech ioProx Support 2014-03-18 20:52:48 +00:00
micki.held@gmx.de
d7aa3739a9 More robust iso14443a sniffing/simulation functions by 
- iso14443a.c: less strict Miller/Manchester decoders
- FPGA hi_iso14443a.v: syncing on external readers' clock when simulating and sniffing.
 2014-02-23 15:46:19 +00:00
micki.held@gmx.de
7bc95e2e43 - fixed iso1443a ManchesterDecoder in order to fix broken Snoop/Sniff 
- enhanced tracing: hf 14a list now shows meaningful timing information. With new option f it also shows the frame delay times (fdt)
- small fix for hf 14b list - it used to run into the trace trailer
- hf 14a sim now obeys iso14443 timing (fdt of 1172 or 1234 resp.)
Note: you need to flash FPGA as well.
More details in http://www.proxmark.org/forum/viewtopic.php?pid=9721#p9721
 2014-02-19 20:35:04 +00:00
martin.holst@gmail.com
3be2a5ae0b reverted a non-intended commit with crappy debug printouts 2014-02-05 18:53:55 +00:00
martin.holst@gmail.com
273b57a7b0 Fixed error with ar/nr-collection 2014-02-05 08:07:27 +00:00
martin.holst@gmail.com
f87941bd22 Minor typo 2014-01-31 21:24:18 +00:00
martin.holst@gmail.com
d2f487af9c Various improvements on the Mifare1kSimulation. Fixed issue with tracebuffer not being cleared, fixed issue with 'static' errors, added modes for doing reader-only attack, added interactive mode, added possibility to set UID from cmdline, either 7-byte or 4-byte. See http://www.proxmark.org/forum/viewtopic.php?id=1529 and http://www.proxmark.org/forum/viewtopic.php?id=1649&p=3 for some more background and discussion 2014-01-31 21:17:34 +00:00
martin.holst@gmail.com
af1caf6e4a Fixed (?) issue with mifare simulation auth failed. See http://www.proxmark.org/forum/viewtopic.php?pid=9192#p9192 2014-01-22 08:49:28 +00:00
micki.held@gmx.de
e691fc45bc - improved reader sensitivity for 14443a cards (FPGA change!) 
- implemented ISO 14443A anticollision loop
See http://www.proxmark.org/forum/viewtopic.php?id=1797 further details
 2013-11-19 18:52:40 +00:00
roel@libnfc.org
981bd4292e integrated MIFARE ultralight features, contributed by 'midnitesnake' 2013-10-11 08:43:23 +00:00
jonor@live.it
4f269f63da Added more informations at command hw version. Now we can get some informations of microcontroller. 
Maybe is useful when someone got a bigger AT91

Example:
#db# Prox/RFID mark3 RFID instrument                 
#db# bootrom: svn 756-unclean 2013-09-14 15:04:07                 
#db# os: svn 796-unclean 2013-10-04 18:50:44                 
#db# FPGA image built on 2013/ 9/26 at  9:17:32                 
uC: AT91SAM7S256 Rev B          
Embedded Processor: ARM7TDMI          
Nonvolatile Program Memory Size: 256K bytes          
Second Nonvolatile Program Memory Size: None          
Internal SRAM Size: 64K bytes          
Architecture Identifier: AT91SAM7Sxx Series          
Nonvolatile Program Memory Type: Embedded Flash Memory
 2013-10-04 18:54:10 +00:00
roel@libnfc.org
ce02f6f992 fixed iso14443a-4 similation, got rid of many ugly memory allocation issues 2013-10-03 14:22:43 +00:00
jonor@live.it
0318894e52 Correct issue of blew circular buffer in hf 14b snoop with gcc 4.7.4 the issue is solved 2013-09-30 19:08:29 +00:00
douniwan5788@gmail.com
b19bd5d689 Add support in 'hf mf mifare' for some unlicensed/compatible mifare card which always answer NACK. 
Change the 'nttmp' start from nt distance 500 to 100 in mifarecmd.c to compatible some unlicensed/compatible mifare card.
 2013-09-29 11:44:07 +00:00
martin.holst@gmail.com
5f6d6c9003 Raw 14a in commandline, patch by jonor, see http://proxmark.org/forum/viewtopic.php?id=1751 for more info 2013-09-28 19:28:55 +00:00
henryk@ploetzli.ch
bf7163bdb3 * Add an option to lf read command to use an arbitrary divisor, enabling reading at frequencies other than 125 and 134 kHz. 2013-09-27 13:48:20 +00:00
micki.held@gmx.de
9492e0b098 Major rework of hf mf nested: 
- PM: used GetCountMifare in MifareNested() for improved timing accuracy and to deliver better quality nonces
- PM: MifareNested now delivers exactly two different nonces to avoid time consuming multiple lfsr_recovery32() on client side
- Client: replaced quicksort by bucketsort in crapto1.c which is faster 
- Client: use multithreading (two parallel calls to lfsr_recovery32())
- Client: fixed a small bug in mfnested() (always showed trgkey=0)
- Client: introduced a mutex for PrintAndLog() to avoid interlaced printing
Minor rework of hf mf chk:
- Avoid time consuming off/on cycles. Send a "halt" instead.
 2013-09-15 09:33:17 +00:00
martin.holst@gmail.com
7cf3ef203c Patch by jonor for raw ISO 1444B commands. See http://www.proxmark.org/forum/viewtopic.php?id=1729 for more info 2013-09-01 18:41:05 +00:00
micki.held@gmx.de
1c611bbd26 2013-07-08 17:56:05 +00:00
martin.holst@gmail.com
e772353f72 Major changes to hf mf mifare 2013-06-26 21:13:02 +00:00
dn337t@gmail.com
79c3611cf3 fixed Mifare nested by activating commented SpinDelay()s 2013-05-30 14:48:27 +00:00
apresence@gmail.com
e67b06b706 Support for cloning to T55x7 at different clock rates & 134KHz 
* Modified commands (lf em4x):
  em410xwatch      ['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)
  em410xwrite      <UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate
* Better option checking for em410xwrite & fix for uninitialized vars
* Increased samples from 2000 to 4000 in em410xwatch (2000 is OK for clock=64, but too few for clock=32)
 2013-05-12 08:11:00 +00:00
martin.holst@gmail.com
9836a77f97 Fixed a third issue where a buffer was filled with 0x44, affecting chinese cards-commands.(csetblk) 2013-05-11 12:23:31 +00:00
martin.holst@gmail.com
354d3a33fd Fixed another issue where a buffer was filled with 0x44, affecting chinese cards-commands. see http://www.proxmark.org/forum/viewtopic.php?id=1467&p=6 2013-05-11 12:22:11 +00:00
martin.holst@gmail.com
ea73261dc6 Fixed buffer corruption in iso1443a_select_card, affecting several operations, e.g. hf mf mifare and probably a few more 2013-05-11 12:13:17 +00:00
roel@libnfc.org
ed258538da retrieve uid correctly, patched by 'gregy' 2013-05-03 06:58:24 +00:00
dn337t@gmail.com
0beed8fc67 fixed hf mf rdbl response data (broken since r634) 2013-04-24 10:59:47 +00:00
dn337t@gmail.com
3803d5295d fixed possibly uninitialized variables 2013-04-24 10:58:12 +00:00
roel@libnfc.org
ce55f5a291 moved RAMFUNC definition 2013-04-08 09:18:39 +00:00
roel@libnfc.org
dfc3c5053c removed another redundant function to compose reader short frame 2013-04-03 11:18:01 +00:00
roel@libnfc.org
195af47289 removed redundant function to compose reader short frame 2013-04-03 08:45:04 +00:00
roel@libnfc.org
28afbd2bee added initial test to emulate memory of mf ul tag 2013-03-28 14:02:00 +00:00
roel@libnfc.org
5191b3d10b fixed sending of RATS during iso-14443-4 select 2013-03-27 12:23:59 +00:00
roel@libnfc.org
43751d2a65 removed failed hitag2 authentication attempts from the list 2013-03-18 15:32:19 +00:00
roel@libnfc.org
47e18126ec added hitag bit count output in log 2013-03-11 15:07:23 +00:00
roel@libnfc.org
17331e14ee tweaked sim command, added mfkey32 2013-03-07 12:22:12 +00:00
roel@libnfc.org
54a942b05d merged all patches into CDC repository 2013-02-28 17:04:23 +00:00
roel@libnfc.org
28fdb04fd8 Finally, rewrote bootrom and flasher program, much faster now 2013-02-28 15:11:52 +00:00
roel@libnfc.org
79a73ab2d1 fixed USB GPIO bug reported by gregy, and fixed 'hf 14a reader' command 2013-02-27 13:23:38 +00:00
roel@libnfc.org
ab6bf11f3f minor fix when reading blocks 2012-12-17 13:21:53 +00:00
roel@libnfc.org
fc8c5cdd12 fixed hitag2 dump if one or more blocks are locked 2012-12-10 15:12:32 +00:00
roel@libnfc.org
ab4da50d99 added automatically saving the hitag2 memory content to file 2012-12-09 21:25:29 +00:00
roel@libnfc.org
9440213d6b fixed 64-bit cmd/arg for windows 2012-12-09 13:00:19 +00:00
roel@libnfc.org
81ee3409f9 added so-called 'driver' for windows 2012-12-05 20:45:42 +00:00
roel@libnfc.org
6e82300dda removed all old usb calls 2012-12-05 16:14:10 +00:00
roel@libnfc.org
5bcc76c427 added missing files 2012-12-04 23:41:54 +00:00
roel@libnfc.org
902cb3c00b major USB update 2012-12-04 23:39:18 +00:00
Merlokbr@gmail.com
5a9506ac45 10 ms was too fast(. 50 is ok 2012-11-08 10:05:10 +00:00
Merlokbr@gmail.com
bfaecce6eb there was bug in hf mf mifare. and speed up this command. 2012-11-08 09:48:02 +00:00
thijsbreman@gmail.com
219a334de5 added: readed blocks (password mode) into tag.sectors[]. 'lf hitag sim' simulates the readed blocks. 2012-10-18 10:01:13 +00:00
roel@libnfc.org
bde10a5057 added hitag2 reading in crypto mode functionality 2012-10-16 15:18:13 +00:00
roel@libnfc.org
ed7bd3a380 Added Hitag2 reading tag memory in password mode 2012-09-19 10:23:19 +00:00
roel@libnfc.org
d19929cbe8 MAJOR update, added hitag2 reader, emulation and eavesdropping, lots of new code, including FPGA tweaks, part 2 2012-09-18 13:53:17 +00:00
frederikmoellers@aol.de
e5ad43c07e Power down the field before sending the USB ACK 
This fixes the bug that the USB communication breaks when collecting PACE nonces with no delay. The delay functionality has not been removed (it doesn't hurt to keep it), but using a delay of 0 is now possible without a high risk of getting too many errors.
 2012-09-01 23:54:38 +00:00
frederikmoellers@aol.de
5acd09bdfb Basic support for EAC documents (e.g. German Identification Card) 
-new files armsrc/epa.[ch] for ePA (electronic "Personalausweis") related functions
    -Offers elementary functions (EPA_PACE_MSE_Set_AT etc.)
    -Also offers one new USB command: EPA_PACE_Collect_Nonce
-created new command subtree in client: client/hfepa.[ch] ("hf epa")
    -offers "hf epa cnonces" (collect encrypted PACE nonces)
-more to come
 2012-08-28 21:39:50 +00:00
frederikmoellers@aol.de
b0127e65f1 -Fixed a bug in iso14_apdu 
-According to ISO14443-4, the block number (bit 0) in the PCB needs to be flipped every once in a while. Not doing so leads to the card not responding to commands anymore. The flipping is done according to the standard now.
-Declare iso14_apdu in iso14443a.h to enable usage from other .c files
-iso14_apdu now returns 0 if ReaderReceive returned 0 (to distinguish between the case that ReaderReceive returns -1 and the case that it returns 0)
-Added a new function to change the timeout (to enable changing it from other .c files without the need for a global variable)
 2012-08-24 21:00:03 +00:00
Merlokbr@gmail.com
71d90e54cd hf mf sniff transfered parity from arm to decoding procedure 2012-07-17 15:19:15 +00:00
Merlokbr@gmail.com
55acbb2a39 improved command hf mf sniff. Now it cant decode nested authentication and cant write emulator files 2012-07-16 14:49:51 +00:00
Merlokbr@gmail.com
39864b0bd4 "hf mf sniff" low level logics works. 2012-07-11 15:52:33 +00:00
Merlokbr@gmail.com
5cd9ec01e0 hf 14a snoop optimized and added parameters. hf 14a sniff - not work. 2012-07-07 15:29:51 +00:00
Merlokbr@gmail.com
b62a5a8444 small improvements, added new command hf mf sniff (there will be cool sniffer). But now... here is optimized hf 14a snoop. As I see it works the same as th old version. 2012-07-06 16:19:05 +00:00
douniwan5788
423efaccad fixed the mifare bug 2012-07-06 07:06:43 +00:00
Merlokbr@gmail.com
545a1f385c another "magic card" backdoor - command "read block". Added several commands to manipulate card data. 2012-07-05 14:05:01 +00:00
Merlokbr@gmail.com
208a0166b9 magic Chinese card fully supported. Added commands:csetuid-set card uid and wipe it, csetblk-set 16 byte block, cload-load dump from emulator memory or emulator file 2012-07-05 10:59:15 +00:00
Merlokbr@gmail.com
0675f200e6 Added work with "magic Chinese" card (card from: ouyangweidaxian@live.cn) with wipe support). Change UID and wipe only. 2012-07-05 07:31:56 +00:00
cex123@gmail.com
2414f97889 Added Indala cloning. Fixed HID cloning bug 2012-07-02 08:37:50 +00:00
roel@libnfc.org
7862f4ad5b fixed output 2012-06-29 12:25:31 +00:00
roel@libnfc.org
9fc6a16779 removed output that slowed down the process, this is to avoid missing frames 2012-06-29 12:21:17 +00:00
roel@libnfc.org
254b70a4af cleaned up some code 2012-06-29 12:09:24 +00:00
roel@libnfc.org
4ab4336a97 added better tracing capabilities, fixed some reader issues 2012-06-29 10:47:07 +00:00
roel@libnfc.org
81cd0474cb fixed a lot of simulation issues 2012-06-29 10:24:05 +00:00
dekoninggans@gmail.com
912a3e94e4 iClass support is tweaked so it works with HID readers... waiting for further improvement 2012-06-28 15:41:28 +00:00