* using WITH_FPC:
* activate basic usart
* no double buffer for now, no interrupt
* usart_dataavailable/usart_readbuffer/usart_writebuffer, to demo it:
* pm3 client over USB, minicom over usart
* analyse a d 414243
* using WITH_FPC_HOST:
* it implies WITH_FPC as it's based on it
* control pm3 with client over usart
* EXPERIMENTAL! still some frame desync issues
* you can connect both from usart & USB with two pm3 clients
* actually you *have* to connect USB for the moment because
it's used to send debug messages about buggy usart... See Dbprintf_usb below
* "sessions": msgs are directed to the latest client to have sent a cmd
* Dbprintf_usb macro to send msgs to USB client to help debugging usart...
* We now have an option to run client at different speed as usart is 115200:
client/proxmark3 /dev/ttyUSB0 -b 115200
* Consequently, argc,argv handling is a bit revamped, it was so messy...
* USB and flashing are still at 460800, don't try flashing over usart yet ^^
* Add \r\n to sent strings
* remove usart_init() from UsbPacketReceive cmd, it's already init in main.
* Add PLATFORM PM3RDV4FPC to ease dev
* TX: US_TCR is len of data to send, not len of buffer
* Use only one PDC bank as we're using it in sync
* Busy loop to wait for end of TX as we'using it in sync
* Change usart speed to 115200
* Don't downgrade USB speed, keep 460800
* Attempt to detect received data, fail so far
- lf t55xx brute (tries bruteforcing a range of pwds
- lf t55xx chk (uses dictionary file or RDV4 flashmem)
FIX: adjust lf sim (@marshmellow42) see 7008cf9c15
"attempt to speed up the loops waiting for carrier signal to go high or low
by only checking for a halt (button press or usbpol) every 256th loop
iteration. some users were experiencing modulating reactions to be too slow.
ADD: 'lf t55xx chk'
It uses @marshmellows42 idea behind commit (6178b085a0)
With calculating a baseline (read block0 32times and average the signal-ish) and sampling only 1024 signal data. The algo then proceeds to calc the average and keep track of the candidate which is given the most difference in signal data average value. I do some squaring and shifting for this.
The candidate is then send back to client to be tested properly with trymodulation like before.
This seems to work good on t55xx card which has a ASK configuration.
WORK-IN-PROGRESS
CHG: 'script run read_pwd_mem.lua' - script now can print those uploaded dictionary files.
How to upload
pm3 --> mem load f default_iclass_keys i
pm3 --> mem load f default_keys m
pm3 --> mem load f default_pwd t
How to validate / view
PM3 -->scr run read_pwd_mem -o 237568 -k 8
pm3 -->scr run read_pwd_mem -o 241664 -k 6
pm3 -->scr run read_pwd_mem -o 245760 -k 4
Reader and card simulation have almost no common code. Moreover the sim
uses an SSP Clock at 212kHz for all timings to prevent any drifting from
the PRNG. This clock speed is not available in reader simulation mode (SSP
runs at up to 3.4MHz, and changes speed between TX and RX). For these
reasons having the code in separate files makes it significantly cleaner.
ADD: raw commands - added the basis for sending RAW commands to FeliCa.
CHG: CRC16 rework, uses table based implementation. This will change more functions as I go on.
the idea is to have a statistically solid conclusion if tag does or does not have the NACK bug.
-in short, ref https://github.com/iceman1001/proxmark3/issues/141
NACK bug; when a tag responds with a NACK to a 8 byte nonce exchange during authentication when the bytes are wrong but the parity bits are correct.
This is a strong oracle which is used in the darkside attack.
https://github.com/federicodotta/proxmark3
--adjusted to fit iceman fork and latest enhancements to LF
(untested)
FIX: some calls to deviceside demods, use 0 instead of reference.
ADD: timeout after n cycles of simulating
CHG: flasher - removed unneeded parameter to function
CHG: flasher - increased limit to fpga-files that can be loaded
FIX: main client, wrong windows define fixed.
CHG: device side - recieve usb command does not always get 544 bytes. usb packages can be incomplete.
CHG: usb_cdc.c also got piwi's changes.
CHG: uart_posix.c removed a debug value
CHG: uart_win32.c clean up.
Using a dictionary file with 421keys,
Current implementation of checkkeys takes 300 sec.
This implementation of checkkeys takes 250 sec.
I implemented it as a separate command so it will be easier to compare between the old and new checkkeys.
Its also doing much on deviceside, which is a step to much funnier standalone modes :))
fix: 'hf mf hardnested' test cases doesn't need to verify key.
add: 'hf mf ' - collect nonces from classic tag.
chg: switch_off on armside, a more unified way, so we don't forget to turn of the antenna ...
chg: renamed 'hf iclass snoop' into 'hf iclass sniff' in an attempt to make all sniff/snoop commands only SNIFF
chg: 'standalone' -> starting the work of moving all standalone mods into a plugin kind of style, in its own folder.
'hw version' - added a function to print out which mods is installed on the firmware (deviceside)
New compiler flags are:
# -DWITH_ICEMAN
# -DWITH_LF_SAMYRUN
# -DWITH_LF_PROXBRUTE
# -DWITH_LF_HIDCORP
# -DWITH_HF_YOUNG
# -DWITH_HF_MATTYRUN
The code behind them are NOT in this commit. They will come in there own files later on.
- armsrc/Makefile when commenting out functionality, move it below the comment otherwise APPS_CFLAG breaks to early. See WITH_LCD
- common/Makefile.common enable / disable EMV, uncomment two lines. then make clean && make all. flash, MIGHT NOT work on 256kb devices
FIX: missing break in appmain.c made it go to iclass function..
- `lf em4x readwordPWD` merged into `lf em4x readword` See help text
- `lf em4x writewordPWD` merged into `lf em4x writeword` See help text
- `lf em4x readword` now download the collected signal data after command.
On device side the lfops.c has gotten some love. Code cleaner, increased EM_START_GAP from 55 FC to 56 FC, because of how our microsecond(us) clock works with 21.3us increments.
TODO: `lf em4x em4x50read` needs to be factored to use @marshmellow42 's ASKdemod instead of trying to do itself.
CHG: call params to selectcard too few
CHG: 'standalone HF mode' - when copying second UID onto data array, it should append after first one, not over the first one.
ref: https://github.com/iceman1001/proxmark3/issues/77 Lets see if this fixes the HF part of this issue
Added a lot of #ifndef , extern C,
Move inside from ARMSRC -> THUMBS, which made the compiled image smaller.. I don't know if it broke anything.
Moved MF_DBGLEVEL definitions into common.h
Moved print_result from util.c into appmain.c
Also split up some struct typedef into header files so they could be reused in other code places.
''' danger ''' this might have broken stuff...
