The iceman fork

[![Latest release] (https://img.shields.io/github/release/iceman1001/proxmark3.svg)] (https://github.com/iceman1001/proxmark3/releases/latest)

##::THIS FORK IS HIGHLY EXPERIMENTAL::

##NOTICE:

There is so much in this fork, with all fixes and additions its basically the most enhanced fork to this day for the Proxmark3 device.

##OFFICAL The official Proxmark repository is found here: https://github.com/Proxmark/proxmark3

Coverity Scan Config && Run

Download the Coverity Scan Self-buld and install it. You will need to configure ARM-NON-EABI- Compiler for it to use:

:: Configure cov-configure --comptype gcc --compiler /opt/devkitpro/devkitARM/bin/arm-none-eabi-gcc

::run it (I'm running on Ubuntu) cov-build --dir cov-int make all

:: make a tarball tar czvf proxmark3.tgz cov-int

:: upload it to coverity.com

Whats changed?

Whats so special with this fork? I have scraped the web for different enhancements to the PM3 source code and not all of them ever found their way to the master branch. Among the stuff is

* Jonor's hf 14a raw timing patch
* Piwi's updates. (usually gets into the master)
* Piwi's "topaz" branch
* Piwi's "hardnested" branch 
* Holiman's iclass, (usually gets into the master)
* Marshmellow's fixes (usually gets into the master)
* Midnitesnake's Ultralight,  Ultralight-c enhancements
* Izsh's lf peak modification / iir-filtering
* Aspers's tips and tricks from inside the PM3-gui-tool, settings.xml and other stuff.
* My own desfire, Ultralight extras, LF T55xx enhancements, bugs fixes (filelength, hf mf commands ), TNP3xxx lua scripts,  Awid26,  skidata scripts (will come)
* other obscure patches like for the sammy-mode,  (offline you know), tagidentifications, defaultkeys. 
* Minor textual changes here and there.
* Simulation of Ultralight/Ntag.
* Marshmellow's and my "RevEng" addon for the client.  Ref: http://reveng.sourceforge.net/    Now using reveng1.31
* Someone's alternative bruteforce Mifare changes.. (you need the two other exe to make it work)

* A Bruteforce for T55XX passwords against tag.
* A Bruteforce for AWID 26, starting w a facilitycode then trying all 0xFFFF cardnumbers via simulation. To be used against a AWID Reader.
* A Bruteforce for HID,  starting w a facilitycode then trying all 0xFFFF cardnumbers via simulation. To be used against a HID Reader.
* Blaposts Crapto1 v3.3
* Icsom's  legic script and legic enhancements
* Aczid's bitsliced bruteforce solver in 'hf mf hardnested'

---

Straight from the CHANGELOG

• 'lf viking clone' - fixed a bug. (iceman)

• Added bitsliced bruteforce solver in 'hf mf hardnested' (aczid)

• 'hf mf chk' speedup (iceman)

• 'hf 14a/mf sim x" attack mode, now uses also moebius version of mfkey32 to try finding the key. (iceman)

• 'hf 14a sim' Added emulation of Mifare cards with 10byte UID length. (iceman)

• 'hf mf sim' Added emulation of Mifare cards with 10byte UID length. (iceman)

• Added lf guard clone/sim (iceman)

• Added lf pyramd clone/sim (iceman)

• trying to fix "hf 14b" command to be able to read CALYPSO card. (iceman)

• hf legic load, it now loads faster and a casting bug is gone. (iceman)

• Added hf legic calccrc8 added a method to calculate the legic crc-8 value (iceman)

• hf legic decode fixed the output overflow bugs, better printing (iceman)

• Coverity Scan fixes a lot of resource leaks, etc (iceman)

• Added lf presco * commands started (iceman)

• Added lf hid wiegand added a method to calculate WIEGAND in different formats, (iceman)

• hf mf chkkeys better printing, same table output as nested, faster execution and added Adam Lauries "try to read Key B if Key A is found" (iceman)

• hf mf nested better printing and added Adam Lauries "try to read Key B if Key A is found" (iceman)

• hf mf mifare fixing the zero parity path, which doesn't got called. (iceman)

• Updated the @blapost's Crapto1 implementation to v3.3 (blapost)

• hf mf c* updated the calling structure and refactored of the chinese magic commands (iceman, marshmellow)

• Started to add Peter Fillmore's EMV fork into Iceman fork. ref: https://github.com/peterfillmore/proxmark3 (peter fillmore, iceman)

• Added Travis-CI automatic build integration with GitHub fork. (iceman)

• Updated the Reveng 1.30 sourcecode to 1.31 from Reveng projecthomepage (iceman)

• Added possibility to write direct to a Legic Prime Tag (MIM256/1024) without using values from the 'BigBuffer' -> 'hf legic writeRaw ' (icsom)

• Added possibility to decrease DCF values at address 0x05 & 0x06 on a Legic Prime Tag DCF-value will be pulled from the BigBuffer (address 0x05 & 0x06) so you have to load the data into the BigBuffer before with 'hf legic load <path/to/legic.dump>' & then write the DCF-Values (both at once) with 'hf legic write 0x05 0x02' (icsom)

• Added script legic.lua for display and edit Data of Legic-Prime Tags (icsom)

• Added the experimental HITAG_S support (spenneb)

• Added topaz detection to hf search (iceman)

• Fixed the silent mode for 14b to be used inside 'hf search' (iceman)

---

Give me a hint, and I'll see if I can't merge in the stuff you have.

I don't actually know how to make small pull-request to github :( and that is the number one reason for me not pushing a lot of things back to the PM3 master.

PM3 GUI:

I do tend to rename and move stuff around, the official PM3-GUI from Gaucho will not work so well. sorry

DEVELOPMENT:

This fork now compiles just fine on windows/mingw environment with Qt5.3.1 & GCC 4.8 Ubuntuu 1404, 1510 Mac OS X

SETUP AND BUILD FOR UBUNTU

GC made updates to allow this to build easily on Ubuntu 14.04.2 LTS or 15.10 See https://github.com/Proxmark/proxmark3/wiki/Ubuntu%20Linux

Run -> sudo apt-get install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget

Follow these instructions Get devkitARM release 41 from SourceForge (choose either the 64/32 bit depending on your architecture, it is assumed you know how to check and recognize your architecture):

(64-bit) http://sourceforge.net/projects/devkitpro/files/devkitARM/previous/devkitARM_r41-x86_64-linux.tar.bz2/download (32-bit) http://sourceforge.net/projects/devkitpro/files/devkitARM/previous/devkitARM_r41-i686-linux.tar.bz2/download

Extract the contents of the .tar.bz2: -> tar jxvf devkitARM_r41--linux.tar.bz2

Create a directory for the arm dev kit: -> sudo mkdir -p /opt/devkitpro/

Move the ARM developer kit to the newly created directory: -> sudo mv devkitARM /opt/devkitpro/

Add the appropriate environment variable: -> export PATH=${PATH}:/opt/devkitpro/devkitARM/bin/

Add the environment variable to your profile: -> echo 'PATH=${PATH}:/opt/devkitpro/devkitARM/bin/ ' >> ~/.bashrc

Clone iceman fork -> git clone https://github.com/iceman1001/proxmark3.git

Get the latest commits -> git pull

CLEAN COMPILE -> make clean && make all

Flash the BOOTROM -> client/flasher -b /dev/ttyACM0 bootrom/obj/bootrom.elf

Flash the FULLIMAGE -> client/flasher /dev/ttyACM0 armsrc/obj/fullimage.elf

Change into the client folder. -> cd client

Run the client -> ./proxmark3 /dev/ttyACM0

January 2015, Sweden iceman at host iuse.se

BUYING A PROXMARK 3

The Proxmark 3 device is available for purchase (assembled and tested) from the following locations:

• http://www.elechouse.com (new and revised hardware package 2015)

I recommend you to buy this version.

---

Most of the ultra-low-volume contract assemblers could put something like this together with a reasonable yield. A run of around a dozen units is probably cost-effective. The BOM includes (possibly- outdated) component pricing, and everything is available from Digikey and the usual distributors.

If you've never assembled a modern circuit board by hand, then this is not a good place to start. Some of the components (e.g. the crystals) must not be assembled with a soldering iron, and require hot air.

The schematics are included; the component values given are not necessarily correct for all situations, but it should be possible to do nearly anything you would want with appropriate population options.

The printed circuit board artwork is also available, as Gerbers and an Excellon drill file.

LICENSING:

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA

Jonathan Westhues user jwesthues, at host cq.cx

May 2007, Cambridge MA