Merge pull request #1 from RfidResearchGroup/master

Merge update
2025-08-21 13:53:55 -07:00 · 2020-05-20 15:57:21 +02:00 · 2020-05-20 15:57:21 +02:00 · 79016afcd6
commit 79016afcd6
parent 9c1cac905b 56bde13110
47 changed files with 10348 additions and 213 deletions
--- a/README.md
+++ b/README.md
@ -1,6 +1,8 @@
 # RRG / Iceman repo - Proxmark3


+
+
 | Releases     | Linux & OSX CI       | Windows CI | Coverity    |
 | ------------------- |:-------------------:| -------------------:| -------------------:|
 | [![Latest release](https://img.shields.io/github/release/RfidResearchGroup/proxmark3.svg)](https://github.com/RfidResearchGroup/proxmark3/releases/latest) | [![Build status](https://api.travis-ci.org/RfidResearchGroup/proxmark3.svg?branch=master)](https://travis-ci.org/RfidResearchGroup/proxmark3) | [![Build status](https://ci.appveyor.com/api/projects/status/b4gwrhq3nc876cuu/branch/master?svg=true)](https://ci.appveyor.com/project/RfidResearchGroup/proxmark3/branch/master) | [![Coverity Status](https://scan.coverity.com/projects/19334/badge.svg)](https://scan.coverity.com/projects/proxmark3-rrg-iceman-repo)|
@ -23,6 +25,7 @@


 ## Notes / helpful documents
+
 | Notes |||
 | ------------------- |:-------------------:| -------------------:|
 |[Notes on UART](/doc/uart_notes.md)|[Notes on Termux / Android](/doc/termux_notes.md)|[Notes on paths](/doc/path_notes.md)|
@ -31,6 +34,8 @@
 |[Notes on file formats used with Proxmark3](/doc/extensions_notes.md)|||
 |[Developing standalone mode](/armsrc/Standalone/readme.md)|[Wiki about standalone mode](https://github.com/RfidResearchGroup/proxmark3/wiki/Standalone-mode)||

+
+
 ## Build for non-RDV4 Proxmark3 platforms

 In order to build this repo for other Proxmark3 platforms we urge you to read [Advanced compilation parameters](/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md)
@ -52,21 +57,45 @@ On the software side: quite a lot, see the [Changelog file](CHANGELOG.md).

 This repo compiles nicely on 
   - Proxspace v3.x
-   - Windows/mingw environment with Qt5.6.1 & GCC 4.8
-   - Ubuntu 1604, 1804, 1904, 2004
+     - [latest release v3.4](https://github.com/Gator96100/ProxSpace/releases)
+   - Windows/mingw environment with Qt5.6.1 & GCC 4.9
+   - Ubuntu 1604 -> 2004
   - ParrotOS, Gentoo, Pentoo, Kali, Nethunter, Archlinux, Fedora, Debian
-   - Rasbian Pi, Jetson Nano, 
+   - Rasbian
   - Android / Termux
   - Mac OS X / Homebrew
   - WSL, WSL2  (Windows subsystem linux) on Windows 10
   - Docker container
+      - [ RRG / Iceman repo based ubuntu 18.04 container ](https://hub.docker.com/r/secopsconsult/proxmark3)
+      - [ Iceman fork based container v1.7 ](https://hub.docker.com/r/iceman1001/proxmark3/)

+Hardware to run client on
+   - PC
+   - Android
+   - Raspberry Pi & Raspberry Pi Zero
+   - Jetson Nano
+
+## Roadmap
 The [public roadmap](https://github.com/RfidResearchGroup/proxmark3/wiki/Public-Roadmap) is an excellent start to read if you are interesting in contributing.

 > 👉 **Remember!** If you intend to contribute to the code, please read the [coding style notes](HACKING.md) first.
 We usually merge your contributions fast since we do like the idea of getting a functionality in the Proxmark3 and weed out the bugs afterwards.


+## Issues & Troubleshooting
+Please search the [issues](https://github.com/rfidresearchgroup/proxmark3/issues) page here and see if your issue is listed in the first instance.  Next place to visit is the [Proxmark Forum](http://www.proxmark.org/forum/index.php). Learn to search it well and finally Google / duckduckgo is your friend :)    You will find many blogposts, youtube videos, tweets, reddit
+
+Read the [Troubleshooting](/doc/md/Installation_Instructions/Troubleshooting.md) guide to weed out most known problems.
+
+Offical channels
+   - [Proxmark3 IRC channel](http://webchat.freenode.net/?channels=#proxmark3)
+   - [Proxmark3 sub reddit](https://www.reddit.com/r/proxmark3/)
+   - [Twitter](https://twitter.com/proxmark3/)
+   
+ _no discord or slack channel_
+
+Iceman has quite a few videos on his [youtube channel](https://www.youtube.com/c/ChrisHerrmann1001)
+
 ## Cheat sheet

 Thanks to Alex Dibs, you can enjoy a [command cheat sheet](/doc/cheatsheet.md)
@ -85,13 +114,6 @@ The separation from official Proxmark3 repo gives us a lot of freedom to create
 The official PM3-GUI from Gaucho will not work.
 The new universal GUI will work. [Proxmark3 Universal GUI](https://github.com/burma69/PM3UniversalGUI) Almost, change needed in order to show helptext when client isn't connected to a device.

-## Issues
-
-Please see the [Proxmark Forum](http://www.proxmark.org/forum/index.php) and see if your issue is listed in the first instance Google is your friend :) Questions will be answered via the forum by Iceman and the team. 
-
-Read the [Troubleshooting](/doc/md/Installation_Instructions/Troubleshooting.md) guide to weed out most known problems.
-
-
 ## The end

 - July 2018 [@herrmann1001](https://mobile.twitter.com/herrmann1001)
--- a/armsrc/BigBuf.c
+++ b/armsrc/BigBuf.c
@ -156,11 +156,24 @@ bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t iLen, uint32_t timestamp_
        tracing = false; // don't trace any more
        return false;
    }
-    if (timestamp_end - timestamp_start > 0x7FFF) {
-        return false; // duration too long, must be max 15 bits
+
+    uint32_t duration;
+    if (timestamp_end > timestamp_start) {
+        duration = timestamp_end - timestamp_start;
+    } else {
+        duration = (UINT32_MAX - timestamp_start) + timestamp_end;
    }
+
+    if (duration > 0x7FFF) {
+        if (DBGLEVEL >= DBG_DEBUG) {
+            Dbprintf("Error in LogTrace: duration too long for 15 bits encoding: 0x%08x start:0x%08x end:0x%08x", duration, timestamp_start, timestamp_end);
+            Dbprintf("Forcing duration = 0");
+        }
+        duration = 0;
+    }
+
    hdr->timestamp = timestamp_start;
-    hdr->duration = timestamp_end - timestamp_start;
+    hdr->duration = duration;
    hdr->data_len = iLen;
    hdr->isResponse = !readerToTag;
    traceLen += TRACELOG_HDR_LEN;
--- a/armsrc/Makefile
+++ b/armsrc/Makefile
@ -157,7 +157,7 @@ version.c: default_version.c $(OBJDIR)/fpga_version_info.o $(OBJDIR)/fpga_all.o
 	$(info [-] GEN $@)
 	$(Q)sh ../tools/mkversion.sh > $@ || perl ../tools/mkversion.pl > $@ || $(CP) $^ $@

-fpga_version_info.c: $(FPGA_BITSTREAMS) | $(FPGA_COMPRESSOR)
+fpga_version_info.c: $(FPGA_BITSTREAMS) $(FPGA_COMPRESSOR)
 	$(info [-] GEN $@)
 	$(Q)$(FPGA_COMPRESSOR) -v $(filter %.bit,$^) $@

--- a/armsrc/Standalone/hf_colin.c
+++ b/armsrc/Standalone/hf_colin.c
@ -81,12 +81,12 @@

 */

-uint8_t cjuid[10];
-uint32_t cjcuid;
-iso14a_card_select_t p_card;
-int currline;
-int currfline;
-int curlline;
+static uint8_t cjuid[10];
+static uint32_t cjcuid;
+static iso14a_card_select_t p_card;
+static int currline;
+static int currfline;
+static int curlline;

 // TODO : Implement fast read of KEYS like in RFIdea
 // also http://ext.delaat.net/rp/2015-2016/p04/report.pdf
@ -162,7 +162,7 @@ static void scan_keys(const char *str, int len, uint64_t *user_data) {
    }
 }

-MFC1KSchema Schemas[MAX_SCHEMAS];
+static MFC1KSchema Schemas[MAX_SCHEMAS];

 /*MFC1KSchema Noralsy = {
    .name = "Noralsy",
@ -196,7 +196,7 @@ MFC1KSchema InfiHexact = {.name = "Infineon/Hexact",
              0x8829da9daf76, 0x8829da9daf76, 0x8829da9daf76, 0x8829da9daf76}};
 */

-int total_schemas = 0;
+static int total_schemas = 0;

 static void add_schema(MFC1KSchema *p, MFC1KSchema a, int *schemas_counter) {
    if (*schemas_counter < MAX_SCHEMAS) {
--- a/armsrc/Standalone/hf_mattyrun.c
+++ b/armsrc/Standalone/hf_mattyrun.c
@ -49,19 +49,19 @@ on a blank card.
 #include "mifaresim.h"  // mifare1ksim
 #include "mifareutil.h"

-uint8_t uid[10];
-uint32_t cuid;
-iso14a_card_select_t p_card;
+static uint8_t uid[10];
+static uint32_t cuid;
+static iso14a_card_select_t p_card;

 /*
    Pseudo-configuration block.
 */
-bool printKeys = false;         // Prints keys
-bool transferToEml = true;      // Transfer keys to emulator memory
-bool ecfill = true;             // Fill emulator memory with cards content.
-bool simulation = true;         // Simulates an exact copy of the target tag
-bool fillFromEmulator = false;  // Dump emulator memory.
-uint8_t stKeyBlock = 20;        // Set the quantity of keys in the block.
+static bool printKeys = false;         // Prints keys
+static bool transferToEml = true;      // Transfer keys to emulator memory
+static bool ecfill = true;             // Fill emulator memory with cards content.
+static bool simulation = true;         // Simulates an exact copy of the target tag
+static bool fillFromEmulator = false;  // Dump emulator memory.
+static uint8_t stKeyBlock = 20;        // Set the quantity of keys in the block.

 //-----------------------------------------------------------------------------
 // Matt's StandAlone mod.
--- a/armsrc/Standalone/hf_msdsal.c
+++ b/armsrc/Standalone/hf_msdsal.c
@ -52,7 +52,7 @@ void ModInfo(void) {
 * technologies. Be brave enough to share your knowledge & inspire others. Salvador Mendoza.
 */

-uint8_t ppdol [255] = {0x80, 0xA8, 0x00, 0x00, 0x02, 0x83, 0x00}; // Default GET PROCESSING
+static uint8_t ppdol [255] = {0x80, 0xA8, 0x00, 0x00, 0x02, 0x83, 0x00}; // Default GET PROCESSING

 static uint8_t treatPDOL(uint8_t *apdu) {                  //Generate GET PROCESSING
    uint8_t plen = 7;
--- a/armsrc/Standalone/lf_em4100emul.c
+++ b/armsrc/Standalone/lf_em4100emul.c
@ -25,11 +25,9 @@

 // low & high - array for storage IDs. Its length must be equal.
 // Predefined IDs must be stored in low[].
-// In high[] must be nulls
-uint64_t low[] = {0x565A1140BE, 0x365A398149, 0x5555555555, 0xFFFFFFFFFF};
-uint32_t high[] = {0, 0, 0, 0};
-uint8_t *bba, slots_count;
-int buflen;
+static uint64_t low[] = {0x565A1140BE, 0x365A398149, 0x5555555555, 0xFFFFFFFFFF};
+static uint8_t *bba, slots_count;
+static int buflen;

 void ModInfo(void) {
    DbpString("  LF EM4100 simulator standalone mode");
--- a/armsrc/Standalone/lf_em4100rswb.c
+++ b/armsrc/Standalone/lf_em4100rswb.c
@ -68,16 +68,16 @@

 // Predefined bruteforce speed
 // avg: 1s, 1.2s, 1.5s, 2s
-int bruteforceSpeedCurrent = 1;
-int bruteforceSpeed[] = {10, 12, 14, 16};
+static int bruteforceSpeedCurrent = 1;
+static int bruteforceSpeed[] = {10, 12, 14, 16};

 // low & high - array for storage IDs. Its length must be equal.
 // Predefined IDs must be stored in low[].
 // In high[] must be nulls
-uint64_t low[] = {0, 0, 0, 0};
-uint32_t high[] = {0, 0, 0, 0};
-uint8_t *bba;
-int buflen;
+static uint64_t low[] = {0, 0, 0, 0};
+static uint32_t high[] = {0, 0, 0, 0};
+static uint8_t *bba;
+static int buflen;

 void ModInfo(void) {
    DbpString("  LF EM4100 read/sim/write/brute mode");
--- a/armsrc/Standalone/lf_em4100rwc.c
+++ b/armsrc/Standalone/lf_em4100rwc.c
@ -39,10 +39,10 @@
 // low & high - array for storage IDs. Its length must be equal.
 // Predefined IDs must be stored in low[].
 // In high[] must be nulls
-uint64_t low[] = {0x565AF781C7, 0x540053E4E2, 0x1234567890, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
-uint32_t high[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
-uint8_t *bba, slots_count;
-int buflen;
+static uint64_t low[] = {0x565AF781C7, 0x540053E4E2, 0x1234567890, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+static uint32_t high[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+static uint8_t *bba, slots_count;
+static int buflen;

 void ModInfo(void) {
    DbpString("  LF EM4100 read/write/clone mode");
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@ -70,9 +70,11 @@
 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2)  // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
 uint8_t ToSend[TOSEND_BUFFER_SIZE];
 int ToSendMax = -1;
+
+
 static int ToSendBit;
 struct common_area common_area __attribute__((section(".commonarea")));
-int button_status = BUTTON_NO_CLICK;
+static int button_status = BUTTON_NO_CLICK;
 static bool allow_send_wtx = false;

 inline void send_wtx(uint16_t wtx) {
@ -276,9 +278,9 @@ static void SendVersion(void) {

    strncat(VersionString, "\n [ FPGA ]\n ", sizeof(VersionString) - strlen(VersionString) - 1);

-    for (int i = 0; i < fpga_bitstream_num; i++) {
-        strncat(VersionString, fpga_version_information[i], sizeof(VersionString) - strlen(VersionString) - 1);
-        if (i < fpga_bitstream_num - 1) {
+    for (int i = 0; i < g_fpga_bitstream_num; i++) {
+        strncat(VersionString, g_fpga_version_information[i], sizeof(VersionString) - strlen(VersionString) - 1);
+        if (i < g_fpga_bitstream_num - 1) {
            strncat(VersionString, "\n ", sizeof(VersionString) - strlen(VersionString) - 1);
        }
    }
--- a/armsrc/flashmem.c
+++ b/armsrc/flashmem.c
@ -16,8 +16,8 @@
 /// Calculates the value of the CSR DLYBCT field given the desired delay (in ns)
 #define SPI_DLYBCT(delay, masterClock) ((uint32_t) ((((masterClock) / 1000000) * (delay)) / 32000) << 24)

-
-uint32_t FLASHMEM_SPIBAUDRATE = FLASH_BAUD;
+static uint32_t FLASHMEM_SPIBAUDRATE = FLASH_BAUD;
+#define FASTFLASH (FLASHMEM_SPIBAUDRATE > FLASH_MINFAST)

 void FlashmemSetSpiBaudrate(uint32_t baudrate) {
    FLASHMEM_SPIBAUDRATE = baudrate;
--- a/armsrc/flashmem.h
+++ b/armsrc/flashmem.h
@ -106,8 +106,6 @@
 #define FLASH_FASTBAUD MCK
 #define FLASH_MINBAUD FLASH_FASTBAUD

-#define FASTFLASH (FLASHMEM_SPIBAUDRATE > FLASH_MINFAST)
-
 //~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~//

 void FlashmemSetSpiBaudrate(uint32_t baudrate);
--- a/armsrc/fpgaloader.c
+++ b/armsrc/fpgaloader.c
@ -203,7 +203,7 @@ static int get_from_fpga_combined_stream(z_streamp compressed_fpga_stream, uint8
 // 288 bytes from FPGA file 1, followed by 288 bytes from FGPA file 2, etc.
 //----------------------------------------------------------------------------
 static int get_from_fpga_stream(int bitstream_version, z_streamp compressed_fpga_stream, uint8_t *output_buffer) {
-    while ((uncompressed_bytes_cnt / FPGA_INTERLEAVE_SIZE) % fpga_bitstream_num != (bitstream_version - 1)) {
+    while ((uncompressed_bytes_cnt / FPGA_INTERLEAVE_SIZE) % g_fpga_bitstream_num != (bitstream_version - 1)) {
        // skip undesired data belonging to other bitstream_versions
        get_from_fpga_combined_stream(compressed_fpga_stream, output_buffer);
    }
@ -509,7 +509,7 @@ void SetAdcMuxFor(uint32_t whichGpio) {

 void Fpga_print_status(void) {
    DbpString(_BLUE_("Currently loaded FPGA image"));
-    Dbprintf("  mode....................%s", fpga_version_information[downloaded_bitstream - 1]);
+    Dbprintf("  mode....................%s", g_fpga_version_information[downloaded_bitstream - 1]);
 }

 int FpgaGetCurrent(void) {
--- a/armsrc/hitag2.c
+++ b/armsrc/hitag2.c
@ -1238,7 +1238,7 @@ void SimulateHitag2(bool tag_mem_supplied, uint8_t *data) {
        // Check if frame was captured
        if (rxlen > 4) {

-            LogTrace(rx, nbytes(rxlen), response, 0, NULL, true);
+            LogTrace(rx, nbytes(rxlen), response, response, NULL, true);

            // Process the incoming frame (rx) and prepare the outgoing frame (tx)
            hitag2_handle_reader_command(rx, rxlen, tx, &txlen);
--- a/armsrc/hitagS.c
+++ b/armsrc/hitagS.c
@ -1039,7 +1039,7 @@ void SimulateHitagSTag(bool tag_mem_supplied, uint8_t *data) {
        // Check if frame was captured
        if (rxlen > 0) {
 //            frame_count++;
-            LogTrace(rx, nbytes(rxlen), response, 0, NULL, true);
+            LogTrace(rx, nbytes(rxlen), response, response, NULL, true);

            // Disable timer 1 with external trigger to avoid triggers during our own modulation
            AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
@ -1281,7 +1281,7 @@ void ReadHitagS(hitag_function htf, hitag_data *htd) {
        // Check if frame was captured and store it
        if (rxlen > 0) {
 //            frame_count++;
-            LogTrace(rx, nbytes(rxlen), response, 0, NULL, false);
+            LogTrace(rx, nbytes(rxlen), response, response, NULL, false);
        }

        // By default reset the transmission buffer
@ -1410,7 +1410,7 @@ void ReadHitagS(hitag_function htf, hitag_data *htd) {
        // Add transmitted frame to total count
        if (txlen > 0) {
 //            frame_count++;
-            LogTrace(tx, nbytes(txlen), HITAG_T_WAIT_2, 0, NULL, true);
+            LogTrace(tx, nbytes(txlen), HITAG_T_WAIT_2, HITAG_T_WAIT_2, NULL, true);
        }

        hitagS_receive_frame(rx, &rxlen, &response);
@ -1538,7 +1538,7 @@ void WritePageHitagS(hitag_function htf, hitag_data *htd, int page) {
        // Check if frame was captured and store it
        if (rxlen > 0) {
 //            frame_count++;
-            LogTrace(rx, nbytes(rxlen), response, 0, NULL, false);
+            LogTrace(rx, nbytes(rxlen), response, response, NULL, false);
        }

        //check for valid input
@ -1625,7 +1625,7 @@ void WritePageHitagS(hitag_function htf, hitag_data *htd, int page) {
        // Add transmitted frame to total count
        if (txlen > 0) {
 //            frame_count++;
-            LogTrace(tx, nbytes(txlen), HITAG_T_WAIT_2, 0, NULL, true);
+            LogTrace(tx, nbytes(txlen), HITAG_T_WAIT_2, HITAG_T_WAIT_2, NULL, true);
        }

        hitagS_receive_frame(rx, &rxlen, &response);
@ -1732,7 +1732,7 @@ void check_challenges(bool file_given, uint8_t *data) {
        // Check if frame was captured and store it
        if (rxlen > 0) {
 //            frame_count++;
-            LogTrace(rx, nbytes(rxlen), response, 0, NULL, false);
+            LogTrace(rx, nbytes(rxlen), response, response, NULL, false);
        }

        uint8_t *tx = txbuf;
@ -1864,7 +1864,7 @@ void check_challenges(bool file_given, uint8_t *data) {
        // Add transmitted frame to total count
        if (txlen > 0) {
 //            frame_count++;
-            LogTrace(tx, nbytes(txlen), HITAG_T_WAIT_2, 0, NULL, true);
+            LogTrace(tx, nbytes(txlen), HITAG_T_WAIT_2, HITAG_T_WAIT_2, NULL, true);
        }

        hitagS_receive_frame(rx, &rxlen, &response);
--- a/armsrc/i2c.c
+++ b/armsrc/i2c.c
@ -32,7 +32,7 @@

 #define I2C_ERROR  "I2C_WaitAck Error"

-volatile unsigned long c;
+static volatile unsigned long c;

 // Direct use the loop to delay. 6 instructions loop, Masterclock 48MHz,
 // delay=1 is about 200kbps
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@ -67,7 +67,7 @@ static uint8_t iso14_pcb_blocknum = 0;
 #define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)

 // The FPGA will report its internal sending delay in
-uint16_t FpgaSendQueueDelay;
+static uint16_t FpgaSendQueueDelay;
 // the 5 first bits are the number of bits buffered in mod_sig_buf
 // the last three bits are the remaining ticks/2 after the mod_sig_buf shift
 #define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
@ -184,7 +184,7 @@ static tUart14a Uart;
 // 0011  -   a 2 tick wide pause, or a three tick wide pause shifted left
 // 0111  -   a 2 tick wide pause shifted left
 // 1001  -   a 2 tick wide pause shifted right
-const bool Mod_Miller_LUT[] = {
+static const bool Mod_Miller_LUT[] = {
    false,  true, false, true,  false, false, false, true,
    false,  true, false, false, false, false, false, false
 };
@ -351,11 +351,11 @@ RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time) {
 // 8 ticks modulated:                                     A collision. Save the collision position and treat as Sequence D
 // Note 1: the bitstream may start at any time. We therefore need to sync.
 // Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
-tDemod14a Demod;
+static tDemod14a Demod;

 // Lookup-Table to decide if 4 raw bits are a modulation.
 // We accept three or four "1" in any position
-const bool Mod_Manchester_LUT[] = {
+static const bool Mod_Manchester_LUT[] = {
    false, false, false, false, false, false, false, true,
    false, false, false, true,  false, true,  true,  true
 };
--- a/armsrc/iso14443b.c
+++ b/armsrc/iso14443b.c
@ -1152,7 +1152,7 @@ static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len) {

    if (g_trigger) LED_A_ON();

-    LogTrace(cmd, len, time_start, GetCountSspClk() - time_start, NULL, true);
+    LogTrace(cmd, len, time_start, GetCountSspClk(), NULL, true);
 }

 /* Sends an APDU to the tag
--- a/armsrc/iso15693.c
+++ b/armsrc/iso15693.c
@ -431,7 +431,7 @@ static int GetIso15693AnswerFromTag(uint8_t *received, int *elapsed) {
            getNext = !getNext;
        }
    }
-    time_stop = GetCountSspClk() - time_0 ;
+    time_stop = GetCountSspClk();
    int len = DemodAnswer(received, buf, counter);
    LogTrace(received, len, time_0 << 4, time_stop << 4, NULL, false);
    BigBuf_free();
@ -478,7 +478,7 @@ static int GetIso15693AnswerFromSniff(uint8_t *received, int *samples, int *elap
        }
    }

-    time_stop = GetCountSspClk() - time_0;
+    time_stop = GetCountSspClk();
    int k = DemodAnswer(received, buf, counter);
    LogTrace(received, k, time_0 << 4, time_stop << 4, NULL, false);
    return k;
@ -522,7 +522,7 @@ void AcquireRawAdcSamplesIso15693(void) {
    }


-    LogTrace(cmd, CMD_ID_RESP, time_start << 4, (GetCountSspClk() - time_start) << 4, NULL, true);
+    LogTrace(cmd, CMD_ID_RESP, time_start << 4, GetCountSspClk() << 4, NULL, true);

    FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);

@ -723,7 +723,7 @@ static int SendDataTag(uint8_t *send, int sendlen, bool init, int speed, uint8_t
    uint32_t time_start = GetCountSspClk();

    TransmitTo15693Tag(ToSend, ToSendMax, &t_samples, &wait);
-    LogTrace(send, sendlen, time_start << 4, (GetCountSspClk() - time_start) << 4, NULL, true);
+    LogTrace(send, sendlen, time_start << 4, GetCountSspClk() << 4, NULL, true);

    // Now wait for a response
    if (outdata != NULL) {
@ -825,7 +825,7 @@ void ReaderIso15693(uint32_t parameter) {
    uint8_t cmd[CMD_ID_RESP] = {0};
    BuildIdentifyRequest(cmd);
    TransmitTo15693Tag(ToSend, ToSendMax, &tsamples, &wait);
-    LogTrace(cmd, CMD_ID_RESP, time_start << 4, (GetCountSspClk() - time_start) << 4, NULL, true);
+    LogTrace(cmd, CMD_ID_RESP, time_start << 4, GetCountSspClk() << 4, NULL, true);

    // Now wait for a response
    answerLen1 = GetIso15693AnswerFromTag(answer1, &elapsed) ;
@ -906,7 +906,7 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid) {

            time_start = GetCountSspClk();
            TransmitTo15693Reader(ToSend, ToSendMax, &tsamples, &wait);
-            LogTrace(cmd, CMD_INV_RESP, time_start << 4, (GetCountSspClk() - time_start) << 4, NULL, true);
+            LogTrace(cmd, CMD_INV_RESP, time_start << 4, GetCountSspClk() << 4, NULL, true);

            if (DBGLEVEL >= DBG_EXTENDED) {
                Dbprintf("[+] %d octets read from reader command: %x %x %x %x %x %x %x %x", ans,
--- a/armsrc/lfadc.c
+++ b/armsrc/lfadc.c
@ -51,8 +51,8 @@ bool lf_test_periods(size_t expected, size_t count) {
 //////////////////////////////////////////////////////////////////////////////
 // Low frequency (LF) adc passthrough functionality
 //////////////////////////////////////////////////////////////////////////////
-uint8_t previous_adc_val = 0;
-uint8_t adc_avg = 0;
+static uint8_t previous_adc_val = 0;
+static uint8_t adc_avg = 0;

 void lf_sample_mean(void) {
    uint8_t periods = 0;
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@ -2289,10 +2289,10 @@ void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo) {
 #define FWD_CMD_READ    0x9
 #define FWD_CMD_DISABLE 0x5

-uint8_t forwardLink_data[64]; //array of forwarded bits
-uint8_t *forward_ptr;  //ptr for forward message preparation
-uint8_t fwd_bit_sz; //forwardlink bit counter
-uint8_t *fwd_write_ptr;  //forwardlink bit pointer
+static uint8_t forwardLink_data[64]; //array of forwarded bits
+static uint8_t *forward_ptr;  //ptr for forward message preparation
+static uint8_t fwd_bit_sz; //forwardlink bit counter
+static uint8_t *fwd_write_ptr;  //forwardlink bit pointer

 //====================================================================
 // prepares command bits
--- a/armsrc/lfsampling.c
+++ b/armsrc/lfsampling.c
@ -100,10 +100,10 @@ static void pushBit(BitstreamOut *stream, uint8_t bit) {
 }

 // Holds bit packed struct of samples.
-BitstreamOut data = {0, 0, 0};
+static BitstreamOut data = {0, 0, 0};

 // internal struct to keep track of samples gathered
-sampling_t samples = {0, 0, 0, 0};
+static sampling_t samples = {0, 0, 0, 0};

 void initSampleBuffer(uint32_t *sample_size) {
    initSampleBufferEx(sample_size, false);
--- a/armsrc/mifarecmd.c
+++ b/armsrc/mifarecmd.c
@ -2008,9 +2008,9 @@ out:
 // bit 6 - wipe tag.
 //-----------------------------------------------------------------------------
 // magic uid card generation 1 commands
-uint8_t wupC1[] = { MIFARE_MAGICWUPC1 };
-uint8_t wupC2[] = { MIFARE_MAGICWUPC2 };
-uint8_t wipeC[] = { MIFARE_MAGICWIPEC };
+static uint8_t wupC1[] = { MIFARE_MAGICWUPC1 };
+static uint8_t wupC2[] = { MIFARE_MAGICWUPC2 };
+static uint8_t wipeC[] = { MIFARE_MAGICWIPEC };

 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain) {

--- a/armsrc/mifaredesfire.c
+++ b/armsrc/mifaredesfire.c
@ -33,7 +33,7 @@ static  uint8_t deselect_cmd[] = {0xc2, 0xe0, 0xb4};
 /*                                       PCB   CID   CMD    PAYLOAD    */
 //static uint8_t __res[MAX_FRAME_SIZE];

-struct desfire_key skey = {0};
+static struct desfire_key skey = {0};
 static desfirekey_t sessionkey = &skey;

 bool InitDesfireCard(void) {
--- a/armsrc/thinfilm.c
+++ b/armsrc/thinfilm.c
@ -49,7 +49,7 @@ void ReadThinFilm(void) {
 #define SEC_D 0xf0
 #define SEC_E 0x0f
 #define SEC_F 0x00
-uint16_t FpgaSendQueueDelay;
+static uint16_t FpgaSendQueueDelay;

 static uint16_t ReadReaderField(void) {
 #if defined RDV4
--- a/client/android/pm3_main.c
+++ b/client/android/pm3_main.c
@ -45,15 +45,23 @@ int push_cmdscriptfile(char *path, bool stayafter) {
    return PM3_SUCCESS;
 }

-static char *my_executable_path = NULL;
-static char *my_executable_directory = NULL;
+static char *g_android_my_executable_path = NULL;
+static char *g_android_my_executable_directory = NULL;

 const char *get_my_executable_path(void) {
-    return my_executable_path;
+    return g_android_my_executable_path;
 }

 const char *get_my_executable_directory(void) {
-    return my_executable_directory;
+    if (g_android_my_executable_directory != NULL) free(g_android_my_executable_directory);
+    char buf[1024];
+    // get current work directory
+    getcwd(buf, sizeof(buf));
+    // add / to end.
+    sprintf(buf, "%s%s", buf, PATHSEP);
+    // create on global
+    g_android_my_executable_directory = strdup(buf);
+    return g_android_my_executable_directory;
 }

 static void set_my_executable_path(void) {
@ -95,7 +103,7 @@ jint sendCMD(JNIEnv *env, jobject instance, jstring cmd_) {
    }
    // display on new line
    PrintAndLogEx(NORMAL, "\n");
-    char *cmd = (char *)((*env)->GetStringUTFChars(env, cmd_, 0));
+    char *cmd = (char *) ((*env)->GetStringUTFChars(env, cmd_, 0));
    int ret = CommandReceived(cmd);
    if (ret == 99) {
        // exit / quit
@ -110,7 +118,7 @@ jint sendCMD(JNIEnv *env, jobject instance, jstring cmd_) {
 * Is client running!
 * */
 jboolean isExecuting(JNIEnv *env, jobject instance) {
-    return (jboolean)((jboolean) conn.run);
+    return (jboolean) ((jboolean) conn.run);
 }

 /*
@ -123,7 +131,7 @@ jboolean testPm3(JNIEnv *env, jobject instance) {
        return false;
    }
    bool ret2 = TestProxmark() == PM3_SUCCESS;
-    return (jboolean)(ret1 && ret2);
+    return (jboolean) (ret1 && ret2);
 }

 /*
@ -148,21 +156,21 @@ JNIEXPORT jint JNI_OnLoad(JavaVM *vm, void *reserved) {
    }
    jclass clz_test = (*jniEnv)->FindClass(jniEnv, "cn/rrg/devices/Proxmark3RRGRdv4");
    JNINativeMethod methods[] = {
-        {"startExecute", "(Ljava/lang/String;)I", (void *) sendCMD},
-        {"stopExecute",  "()V", (void *) stopPm3},
-        {"isExecuting",  "()Z", (void *) isExecuting}
+            {"startExecute", "(Ljava/lang/String;)I", (void *) sendCMD},
+            {"stopExecute",  "()V",                   (void *) stopPm3},
+            {"isExecuting",  "()Z",                   (void *) isExecuting}
    };
    JNINativeMethod methods1[] = {
-        {"testPm3",  "()Z", (void *) testPm3},
-        {"closePm3", "()V", stopPm3}
+            {"testPm3",  "()Z", (void *) testPm3},
+            {"closePm3", "()V", stopPm3}
    };
    if ((*jniEnv)->RegisterNatives(jniEnv, clazz, methods, sizeof(methods) / sizeof(methods[0])) !=
-            JNI_OK) {
+        JNI_OK) {
        return -1;
    }
    if ((*jniEnv)->RegisterNatives(jniEnv, clz_test, methods1,
                                   sizeof(methods1) / sizeof(methods1[0])) !=
-            JNI_OK) {
+        JNI_OK) {
        return -1;
    }
    (*jniEnv)->DeleteLocalRef(jniEnv, clazz);
--- a/client/src/cmdflashmem.c
+++ b/client/src/cmdflashmem.c
@ -27,8 +27,6 @@
 #define FLASH_FASTBAUD MCK
 #define FLASH_MINBAUD FLASH_FASTBAUD

-#define FASTFLASH (FLASHMEM_SPIBAUDRATE > FLASH_MINFAST)
-
 static int CmdHelp(const char *Cmd);

 static int usage_flashmem_spibaud(void) {
@ -170,7 +168,7 @@ static int CmdFlashMemLoad(const char *Cmd) {
        return PM3_EINVARG;
    }
    size_t datalen = 0;
-    uint16_t keycount = 0;
+    uint32_t keycount = 0;
    int res = 0;
    uint8_t *data = calloc(FLASH_MEM_MAX_SIZE, sizeof(uint8_t));

@ -182,6 +180,10 @@ static int CmdFlashMemLoad(const char *Cmd) {
                free(data);
                return PM3_EFILE;
            }
+            // limited space on flash mem
+            if (keycount > 0xFFFF)
+                keycount &= 0xFFFF;
+
            data[0] = (keycount >> 0) & 0xFF;
            data[1] = (keycount >> 8) & 0xFF;
            datalen += 2;
@ -193,6 +195,10 @@ static int CmdFlashMemLoad(const char *Cmd) {
                free(data);
                return PM3_EFILE;
            }
+            // limited space on flash mem
+            if (keycount > 0xFFFF)
+                keycount &= 0xFFFF;
+
            data[0] = (keycount >> 0) & 0xFF;
            data[1] = (keycount >> 8) & 0xFF;
            datalen += 2;
@ -204,6 +210,10 @@ static int CmdFlashMemLoad(const char *Cmd) {
                free(data);
                return PM3_EFILE;
            }
+            // limited space on flash mem
+            if (keycount > 0xFFFF)
+                keycount &= 0xFFFF;
+
            data[0] = (keycount >> 0) & 0xFF;
            data[1] = (keycount >> 8) & 0xFF;
            datalen += 2;
--- a/client/src/cmdhficlass.c
+++ b/client/src/cmdhficlass.c
@ -2411,17 +2411,6 @@ static int CmdHFiClassCheckKeys(const char *Cmd) {
    }
    if (errors) return usage_hf_iclass_chk();

-
-    uint8_t *keyBlock = NULL;
-    uint16_t keycount = 0;
-
-    // load keys
-    int res = loadFileDICTIONARY_safe(filename, (void **)&keyBlock, 8, &keycount);
-    if (res != PM3_SUCCESS || keycount == 0) {
-        free(keyBlock);
-        return res;
-    }
-
    // Get CSN / UID and CCNR
    PrintAndLogEx(SUCCESS, "Reading tag CSN");
    for (uint8_t i = 0; i < ICLASS_AUTH_RETRY && !got_csn; i++) {
@ -2436,6 +2425,16 @@ static int CmdHFiClassCheckKeys(const char *Cmd) {
        return PM3_ESOFT;
    }

+    uint8_t *keyBlock = NULL;
+    uint32_t keycount = 0;
+
+    // load keys
+    int res = loadFileDICTIONARY_safe(filename, (void **)&keyBlock, 8, &keycount);
+    if (res != PM3_SUCCESS || keycount == 0) {
+        free(keyBlock);
+        return res;
+    }
+
    pre = calloc(keycount, sizeof(iclass_premac_t));
    if (!pre) {
        DropField();
@ -2678,7 +2677,7 @@ static int CmdHFiClassLookUp(const char *Cmd) {
    PrintAndLogEx(SUCCESS, "MAC_TAG | %s", sprint_hex(MAC_TAG, sizeof(MAC_TAG)));

    uint8_t *keyBlock = NULL;
-    uint16_t keycount = 0;
+    uint32_t keycount = 0;

    // load keys
    int res = loadFileDICTIONARY_safe(filename, (void **)&keyBlock, 8, &keycount);
@ -2737,11 +2736,12 @@ static int CmdHFiClassLookUp(const char *Cmd) {
 }

 // precalc diversified keys and their MAC
-void GenerateMacFrom(uint8_t *CSN, uint8_t *CCNR, bool use_raw, bool use_elite, uint8_t *keys, int keycnt, iclass_premac_t *list) {
+void GenerateMacFrom(uint8_t *CSN, uint8_t *CCNR, bool use_raw, bool use_elite, uint8_t *keys, uint32_t keycnt, iclass_premac_t *list) {
    uint8_t key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
    uint8_t div_key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};

-    for (int i = 0; i < keycnt; i++) {
+//iceman: threading
+    for (uint32_t i = 0; i < keycnt; i++) {

        memcpy(key, keys + 8 * i, 8);

@ -2754,11 +2754,12 @@ void GenerateMacFrom(uint8_t *CSN, uint8_t *CCNR, bool use_raw, bool use_elite,
    }
 }

-void GenerateMacKeyFrom(uint8_t *CSN, uint8_t *CCNR, bool use_raw, bool use_elite, uint8_t *keys, int keycnt, iclass_prekey_t *list) {
+void GenerateMacKeyFrom(uint8_t *CSN, uint8_t *CCNR, bool use_raw, bool use_elite, uint8_t *keys, uint32_t keycnt, iclass_prekey_t *list) {

    uint8_t div_key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};

-    for (int i = 0; i < keycnt; i++) {
+//iceman: threading
+    for (uint32_t i = 0; i < keycnt; i++) {

        memcpy(list[i].key, keys + 8 * i, 8);

@ -2774,13 +2775,13 @@ void GenerateMacKeyFrom(uint8_t *CSN, uint8_t *CCNR, bool use_raw, bool use_elit
 }

 // print diversified keys
-void PrintPreCalcMac(uint8_t *keys, int keycnt, iclass_premac_t *pre_list) {
+void PrintPreCalcMac(uint8_t *keys, uint32_t keycnt, iclass_premac_t *pre_list) {

-    iclass_prekey_t *b =  calloc(keycnt, sizeof(iclass_prekey_t));
+    iclass_prekey_t *b = calloc(keycnt, sizeof(iclass_prekey_t));
    if (!b)
        return;

-    for (int i = 0; i < keycnt; i++) {
+    for (uint32_t i = 0; i < keycnt; i++) {
        memcpy(b[i].key, keys + 8 * i, 8);
        memcpy(b[i].mac, pre_list[i].mac, 4);
    }
@ -2788,7 +2789,7 @@ void PrintPreCalcMac(uint8_t *keys, int keycnt, iclass_premac_t *pre_list) {
    free(b);
 }

-void PrintPreCalc(iclass_prekey_t *list, int itemcnt) {
+void PrintPreCalc(iclass_prekey_t *list, uint32_t itemcnt) {
    PrintAndLogEx(NORMAL, "-----+------------------+---------");
    PrintAndLogEx(NORMAL, "#key | key              | mac");
    PrintAndLogEx(NORMAL, "-----+------------------+---------");
--- a/client/src/cmdhficlass.h
+++ b/client/src/cmdhficlass.h
@ -33,8 +33,8 @@ int readIclass(bool loop, bool verbose);
 void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize);
 void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite);

-void GenerateMacFrom(uint8_t *CSN, uint8_t *CCNR, bool use_raw, bool use_elite, uint8_t *keys, int keycnt, iclass_premac_t *list);
-void GenerateMacKeyFrom(uint8_t *CSN, uint8_t *CCNR, bool use_raw, bool use_elite, uint8_t *keys, int keycnt, iclass_prekey_t *list);
-void PrintPreCalcMac(uint8_t *keys, int keycnt, iclass_premac_t *pre_list);
-void PrintPreCalc(iclass_prekey_t *list, int itemcnt);
+void GenerateMacFrom(uint8_t *CSN, uint8_t *CCNR, bool use_raw, bool use_elite, uint8_t *keys, uint32_t keycnt, iclass_premac_t *list);
+void GenerateMacKeyFrom(uint8_t *CSN, uint8_t *CCNR, bool use_raw, bool use_elite, uint8_t *keys, uint32_t keycnt, iclass_prekey_t *list);
+void PrintPreCalcMac(uint8_t *keys, uint32_t keycnt, iclass_premac_t *pre_list);
+void PrintPreCalc(iclass_prekey_t *list, uint32_t itemcnt);
 #endif
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@ -1904,7 +1904,7 @@ static int CmdHF14AMfAutoPWN(const char *Cmd) {
    bool calibrate = true;
    // Attack key storage variables
    uint8_t *keyBlock = NULL;
-    uint16_t key_cnt = 0;
+    uint32_t key_cnt = 0;
    sector_t *e_sector;
    uint8_t sectors_cnt = MIFARE_1K_MAXSECTOR;
    int block_cnt = MIFARE_1K_MAXBLOCK;
@ -2169,7 +2169,7 @@ static int CmdHF14AMfAutoPWN(const char *Cmd) {
            for (int j = 0; j < 2; j++) {
                // Check if the key is known
                if (e_sector[i].foundKey[j] == 0) {
-                    for (int k = 0; k < key_cnt; k++) {
+                    for (uint32_t k = 0; k < key_cnt; k++) {
                        printf(".");
                        fflush(stdout);
                        if (mfCheckKeys(FirstBlockOfSector(i), j, true, 1, (keyBlock + (6 * k)), &key64) == PM3_SUCCESS) {
@ -2186,13 +2186,13 @@ static int CmdHF14AMfAutoPWN(const char *Cmd) {
        fflush(stdout);
    } else {

-        int chunksize = key_cnt > (PM3_CMD_DATA_SIZE / 6) ? (PM3_CMD_DATA_SIZE / 6) : key_cnt;
+        uint32_t chunksize = key_cnt > (PM3_CMD_DATA_SIZE / 6) ? (PM3_CMD_DATA_SIZE / 6) : key_cnt;
        bool firstChunk = true, lastChunk = false;

        for (uint8_t strategy = 1; strategy < 3; strategy++) {
            PrintAndLogEx(INFO, "running strategy %u", strategy);
            // main keychunk loop
-            for (int i = 0; i < key_cnt; i += chunksize) {
+            for (uint32_t i = 0; i < key_cnt; i += chunksize) {

                if (kbd_enter_pressed()) {
                    PrintAndLogEx(WARNING, "\naborted via keyboard!\n");
--- a/client/src/cmdhfmfdes.c
+++ b/client/src/cmdhfmfdes.c
@ -2972,7 +2972,7 @@ static int CmdHF14ADesInfo(const char *Cmd) {
    if (major == 1 && minor == 3)
        PrintAndLogEx(INFO, "\t1.3 - DESFire Ev1 MF3ICD21/41/81, Support extended APDU commands, EAL4+");
    if (major == 1 && minor == 4)
-        PrintAndLogEx(INFO, "\t1.4 - DESFire Ev1 MF3ICD21/41/81, EAL4+, N/A (report to iceman!)");
+        PrintAndLogEx(INFO, "\t1.4 - DESFire Ev1 MF3ICD21/41/81, EAL4+");
    if (major == 2 && minor == 0)
        PrintAndLogEx(INFO, "\t2.0 - DESFire Ev2, Originality check, proximity check, EAL5");
 //    if (major == 3 && minor == 0)
@ -3561,7 +3561,11 @@ static int CmdHF14ADesAuth(const char *Cmd) {
    return PM3_SUCCESS;
 }

-static void DesFill2bPattern(uint8_t deskeyList[MAX_KEYS_LIST_LEN][8], size_t *deskeyListLen, uint8_t aeskeyList[MAX_KEYS_LIST_LEN][16], size_t *aeskeyListLen, uint8_t k3kkeyList[MAX_KEYS_LIST_LEN][24], size_t *k3kkeyListLen, uint32_t *startPattern) {
+static void DesFill2bPattern(
+                        uint8_t deskeyList[MAX_KEYS_LIST_LEN][8], uint32_t *deskeyListLen,
+                        uint8_t aeskeyList[MAX_KEYS_LIST_LEN][16], uint32_t *aeskeyListLen,
+                        uint8_t k3kkeyList[MAX_KEYS_LIST_LEN][24], uint32_t *k3kkeyListLen, uint32_t *startPattern) {
+
    for (uint32_t pt = *startPattern; pt < 0x10000; pt++) {
        if (*deskeyListLen != MAX_KEYS_LIST_LEN) {
            deskeyList[*deskeyListLen][0] = (pt >> 8) & 0xff;
@ -3598,7 +3602,11 @@ static void DesFill2bPattern(uint8_t deskeyList[MAX_KEYS_LIST_LEN][8], size_t *d
    (*startPattern)++;
 }

-static int AuthCheckDesfire(uint8_t *aid, uint8_t deskeyList[MAX_KEYS_LIST_LEN][8], size_t deskeyListLen, uint8_t aeskeyList[MAX_KEYS_LIST_LEN][16], size_t aeskeyListLen, uint8_t k3kkeyList[MAX_KEYS_LIST_LEN][24], size_t k3kkeyListLen, uint8_t foundKeys[4][0xE][24 + 1], bool *result) {
+static int AuthCheckDesfire(uint8_t *aid,
+                      uint8_t deskeyList[MAX_KEYS_LIST_LEN][8], uint32_t deskeyListLen,
+                      uint8_t aeskeyList[MAX_KEYS_LIST_LEN][16], uint32_t aeskeyListLen,
+                      uint8_t k3kkeyList[MAX_KEYS_LIST_LEN][24], uint32_t k3kkeyListLen,
+                      uint8_t foundKeys[4][0xE][24 + 1], bool *result) {

    uint32_t curaid = (aid[0] & 0xFF) + ((aid[1] & 0xFF) << 8) + ((aid[2] & 0xFF) << 16);

@ -3689,7 +3697,7 @@ static int AuthCheckDesfire(uint8_t *aid, uint8_t deskeyList[MAX_KEYS_LIST_LEN][

            if (usedkeys[keyno] == 1 && foundKeys[0][keyno][0] == 0) {

-                for (int curkey = 0; curkey < deskeyListLen; curkey++) {
+                for (uint32_t curkey = 0; curkey < deskeyListLen; curkey++) {

                    payload.keylen = 8;
                    memcpy(payload.key, deskeyList[curkey], 8);
@ -3728,7 +3736,7 @@ static int AuthCheckDesfire(uint8_t *aid, uint8_t deskeyList[MAX_KEYS_LIST_LEN][

            if (usedkeys[keyno] == 1 && foundKeys[1][keyno][0] == 0) {

-                for (int curkey = 0; curkey < aeskeyListLen; curkey++) {
+                for (uint32_t curkey = 0; curkey < aeskeyListLen; curkey++) {

                    payload.keylen = 16;
                    memcpy(payload.key, aeskeyList[curkey], 16);
@ -3767,7 +3775,7 @@ static int AuthCheckDesfire(uint8_t *aid, uint8_t deskeyList[MAX_KEYS_LIST_LEN][

            if (usedkeys[keyno] == 1 && foundKeys[2][keyno][0] == 0) {

-                for (int curkey = 0; curkey < aeskeyListLen; curkey++) {
+                for (uint32_t curkey = 0; curkey < aeskeyListLen; curkey++) {

                    payload.keylen = 16;
                    memcpy(payload.key, aeskeyList[curkey], 16);
@ -3806,7 +3814,7 @@ static int AuthCheckDesfire(uint8_t *aid, uint8_t deskeyList[MAX_KEYS_LIST_LEN][

            if (usedkeys[keyno] == 1 && foundKeys[3][keyno][0] == 0) {

-                for (int curkey = 0; curkey < k3kkeyListLen; curkey++) {
+                for (uint32_t curkey = 0; curkey < k3kkeyListLen; curkey++) {
                    payload.keylen = 24;
                    memcpy(payload.key, k3kkeyList[curkey], 24);
                    payload.mode = MFDES_AUTH_ISO;
@ -3846,9 +3854,9 @@ static int CmdHF14aDesChk(const char *Cmd) {
    uint8_t deskeyList[MAX_KEYS_LIST_LEN][8] = {{0}};
    uint8_t aeskeyList[MAX_KEYS_LIST_LEN][16] = {{0}};
    uint8_t k3kkeyList[MAX_KEYS_LIST_LEN][MAX_KEY_LEN] = {{0}};
-    size_t deskeyListLen = 0;
-    size_t aeskeyListLen = 0;
-    size_t k3kkeyListLen = 0;
+    uint32_t deskeyListLen = 0;
+    uint32_t aeskeyListLen = 0;
+    uint32_t k3kkeyListLen = 0;
    uint8_t foundKeys[4][0xE][24 + 1] = {{{0}}};

    CLIParserInit("hf mfdes chk",
@ -3972,7 +3980,7 @@ static int CmdHF14aDesChk(const char *Cmd) {
    // dictionary mode
    size_t endFilePosition = 0;
    if (dict_filenamelen) {
-        uint16_t keycnt = 0;
+        uint32_t keycnt = 0;
        res = loadFileDICTIONARYEx((char *)dict_filename, deskeyList, sizeof(deskeyList), NULL, 8, &keycnt, 0, &endFilePosition, true);
        deskeyListLen = keycnt;
        if (endFilePosition)
@ -3994,21 +4002,21 @@ static int CmdHF14aDesChk(const char *Cmd) {
        PrintAndLogEx(ERR, "Aes key list is empty. Nothing to check.");
        return PM3_EINVARG;
    } else {
-        PrintAndLogEx(INFO, "Loaded " _YELLOW_("%zu") " aes keys", aeskeyListLen);
+        PrintAndLogEx(INFO, "Loaded " _YELLOW_("%"PRIu32) " aes keys", aeskeyListLen);
    }

    if (deskeyListLen == 0) {
        PrintAndLogEx(ERR, "Des key list is empty. Nothing to check.");
        return PM3_EINVARG;
    } else {
-        PrintAndLogEx(INFO, "Loaded " _YELLOW_("%zu") " des keys", deskeyListLen);
+        PrintAndLogEx(INFO, "Loaded "  _YELLOW_("%"PRIu32) " des keys", deskeyListLen);
    }

    if (k3kkeyListLen == 0) {
        PrintAndLogEx(ERR, "K3k key list is empty. Nothing to check.");
        return PM3_EINVARG;
    } else {
-        PrintAndLogEx(INFO, "Loaded " _YELLOW_("%zu") " k3kdes keys", k3kkeyListLen);
+        PrintAndLogEx(INFO, "Loaded " _YELLOW_("%"PRIu32) " k3kdes keys", k3kkeyListLen);
    }

    if (!verbose)
@ -4049,7 +4057,7 @@ static int CmdHF14aDesChk(const char *Cmd) {
        if (dict_filenamelen && endFilePosition) {
            if (!verbose)
                printf("d");
-            uint16_t keycnt = 0;
+            uint32_t keycnt = 0;
            res = loadFileDICTIONARYEx((char *)dict_filename, deskeyList, sizeof(deskeyList), NULL, 16, &keycnt, endFilePosition, &endFilePosition, false);
            deskeyListLen = keycnt;
            keycnt = 0;
--- a/client/src/cmdhfmfp.c
+++ b/client/src/cmdhfmfp.c
@ -1027,7 +1027,7 @@ static int MFPKeyCheck(uint8_t startSector, uint8_t endSector, uint8_t startKeyA
    return PM3_SUCCESS;
 }

-static void Fill2bPattern(uint8_t keyList[MAX_KEYS_LIST_LEN][AES_KEY_LEN], size_t *keyListLen, uint32_t *startPattern) {
+static void Fill2bPattern(uint8_t keyList[MAX_KEYS_LIST_LEN][AES_KEY_LEN], uint32_t *keyListLen, uint32_t *startPattern) {
    for (uint32_t pt = *startPattern; pt < 0x10000; pt++) {
        keyList[*keyListLen][0] = (pt >> 8) & 0xff;
        keyList[*keyListLen][1] = pt & 0xff;
@ -1045,7 +1045,7 @@ static void Fill2bPattern(uint8_t keyList[MAX_KEYS_LIST_LEN][AES_KEY_LEN], size_
 static int CmdHFMFPChk(const char *Cmd) {
    int res;
    uint8_t keyList[MAX_KEYS_LIST_LEN][AES_KEY_LEN] = {{0}};
-    size_t keyListLen = 0;
+    uint32_t keyListLen = 0;
    uint8_t foundKeys[2][64][AES_KEY_LEN + 1] = {{{0}}};

    CLIParserInit("hf mfp chk",
@ -1149,6 +1149,7 @@ static int CmdHFMFPChk(const char *Cmd) {
    uint8_t endKeyAB = 1;
    if (keyA && !keyB)
        endKeyAB = 0;
+
    if (!keyA && keyB)
        startKeyAB = 1;

@ -1170,7 +1171,7 @@ static int CmdHFMFPChk(const char *Cmd) {
    // dictionary mode
    size_t endFilePosition = 0;
    if (dict_filenamelen) {
-        uint16_t keycnt = 0;
+        uint32_t keycnt = 0;
        res = loadFileDICTIONARYEx((char *)dict_filename, keyList, sizeof(keyList), NULL, 16, &keycnt, 0, &endFilePosition, true);
        keyListLen = keycnt;
        if (endFilePosition)
@ -1190,7 +1191,7 @@ static int CmdHFMFPChk(const char *Cmd) {
        PrintAndLogEx(ERR, "Key list is empty. Nothing to check.");
        return PM3_EINVARG;
    } else {
-        PrintAndLogEx(INFO, "Loaded " _YELLOW_("%zu") " keys", keyListLen);
+        PrintAndLogEx(INFO, "Loaded " _YELLOW_("%"PRIu32) " keys", keyListLen);
    }

    if (!verbose)
@ -1210,7 +1211,7 @@ static int CmdHFMFPChk(const char *Cmd) {
        if (dict_filenamelen && endFilePosition) {
            if (!verbose)
                printf("d");
-            uint16_t keycnt = 0;
+            uint32_t keycnt = 0;
            res = loadFileDICTIONARYEx((char *)dict_filename, keyList, sizeof(keyList), NULL, 16, &keycnt, endFilePosition, &endFilePosition, false);
            keyListLen = keycnt;
            continue;
--- a/client/src/cmdhw.c
+++ b/client/src/cmdhw.c
@ -661,10 +661,10 @@ void pm3_version(bool verbose, bool oneliner) {
 # define PM3HOSTOS " OS:OpenBSD"
 #elif defined(__CYGWIN__)
 # define PM3HOSTOS " OS:Cygwin"
-#elif defined(_WIN64) | defined(__WIN64__)
+#elif defined(_WIN64) || defined(__WIN64__)
 // must be tested before _WIN32
 # define PM3HOSTOS " OS:Windows (64b)"
-#elif defined(_WIN32) | defined(__WIN32__)
+#elif defined(_WIN32) || defined(__WIN32__)
 # define PM3HOSTOS " OS:Windows (32b)"
 #else
 # define PM3HOSTOS " OS:unknown"
--- a/client/src/cmdlffdx.c
+++ b/client/src/cmdlffdx.c
@ -62,6 +62,7 @@ static int usage_lf_fdx_clone(void) {
    PrintAndLogEx(NORMAL, "");
    PrintAndLogEx(NORMAL, "Examples:");
    PrintAndLogEx(NORMAL, "       lf fdx clone 999 112233");
+    PrintAndLogEx(NORMAL, "       lf fdx clone 999 112233 16a");
    return PM3_SUCCESS;
 }

@ -78,19 +79,34 @@ static int usage_lf_fdx_sim(void) {
    PrintAndLogEx(NORMAL, "");
    PrintAndLogEx(NORMAL, "Examples:");
    PrintAndLogEx(NORMAL, "       lf fdx sim 999 112233");
+    PrintAndLogEx(NORMAL, "       lf fdx sim 999 112233 16a");
    return PM3_SUCCESS;
 }

 // clearing the topbit needed for the preambl detection.
-static void verify_values(uint64_t *animalid, uint32_t *countryid) {
+static void verify_values(uint64_t *animalid, uint32_t *countryid, uint32_t *extended) {
    if ((*animalid & 0x3FFFFFFFFF) != *animalid) {
        *animalid &= 0x3FFFFFFFFF;
-        PrintAndLogEx(INFO, "Animal ID Truncated to 38bits: %"PRIx64, *animalid);
+        PrintAndLogEx(INFO, "Animal ID truncated to 38bits: " _YELLOW_("%"PRIx64), *animalid);
    }
    if ((*countryid & 0x3ff) != *countryid) {
        *countryid &= 0x3ff;
-        PrintAndLogEx(INFO, "Country ID Truncated to 10bits: %03d", *countryid);
+        PrintAndLogEx(INFO, "Country ID truncated to 10bits:" _YELLOW_("%03d"), *countryid);
    }
+    if ((*extended & 0xfff) != *extended) {
+        *extended &= 0xfff;
+        PrintAndLogEx(INFO, "Extended truncated to 24bits: " _YELLOW_("0x%03X"), *extended);
+    }
+}
+
+static inline uint32_t bitcount(uint32_t a) {
+#if defined __GNUC__
+    return __builtin_popcountl(a);
+#else
+    a = a - ((a >> 1) & 0x55555555);
+    a = (a & 0x33333333) + ((a >> 2) & 0x33333333);
+    return (((a + (a >> 4)) & 0x0f0f0f0f) * 0x01010101) >> 24;
+#endif
 }

 // FDX-B ISO11784/85 demod  (aka animal tag)  BIPHASE, inverted, rf/32,  with preamble of 00000000001 (128bits)
@ -187,9 +203,7 @@ static int CmdFDXBdemodBI(const char *Cmd) {

 //see ASKDemod for what args are accepted
 //almost the same demod as cmddata.c/CmdFDXBdemodBI
-static int CmdFdxDemod(const char *Cmd) {
-    (void)Cmd; // Cmd is not used so far
-
+int demodFDX(void) {
    //Differential Biphase / di-phase (inverted biphase)
    //get binary from ask wave
    if (ASKbiphaseDemod("0 32 1 100", false) != PM3_SUCCESS) {
@ -234,8 +248,8 @@ static int CmdFdxDemod(const char *Cmd) {
    num_to_bytes(rawid, 8, raw);

    PrintAndLogEx(SUCCESS, "\nFDX-B / ISO 11784/5 Animal Tag ID Found:  Raw : %s", sprint_hex(raw, 8));
-    PrintAndLogEx(SUCCESS, "Animal ID          %04u-%012" PRIu64, countryCode, NationalCode);
-    PrintAndLogEx(SUCCESS, "National Code      %012" PRIu64 " (0x%" PRIx64 ")", NationalCode, NationalCode);
+    PrintAndLogEx(SUCCESS, "Animal ID          " _GREEN_("%04u-%012"PRIu64), countryCode, NationalCode);
+    PrintAndLogEx(SUCCESS, "National Code      " _GREEN_("%012" PRIu64) " (0x%" PRIx64 ")", NationalCode, NationalCode);
    PrintAndLogEx(SUCCESS, "Country Code       %04u", countryCode);
    PrintAndLogEx(SUCCESS, "Reserved/RFU       %u (0x04%X)", reservedCode,  reservedCode);
    PrintAndLogEx(SUCCESS, "Animal Tag         %s", animalBit ? _YELLOW_("True") : "False");
@ -243,7 +257,7 @@ static int CmdFdxDemod(const char *Cmd) {

    uint8_t c[] = {0, 0};
    compute_crc(CRC_11784, raw, sizeof(raw), &c[0], &c[1]);
-    PrintAndLogEx(SUCCESS, "CRC-16             0x%04X  [%s] ", crc, (crc == (c[1] << 8 | c[0])) ? _GREEN_("OK") : _RED_("Fail"));
+    PrintAndLogEx(SUCCESS, "CRC-16             0x%04X  (%s) ", crc, (crc == (c[1] << 8 | c[0])) ? _GREEN_("ok") : _RED_("fail"));

    if (g_debugMode) {
        PrintAndLogEx(DEBUG, "Start marker %d;   Size %zu", preambleIndex, size);
@ -251,12 +265,30 @@ static int CmdFdxDemod(const char *Cmd) {
        PrintAndLogEx(DEBUG, "DEBUG bin stream:\n%s", bin);
    }

+    uint8_t bt_par = (extended & 0x100) >> 8;
+    uint8_t bt_temperature = extended & 0xff;    
+    uint8_t bt_calc_parity = (bitcount(bt_temperature) & 0x1) ? 0 : 1;   
+    uint8_t is_bt_temperature = (bt_calc_parity == bt_par) && !(extended & 0xe00) ;
+
+    if (is_bt_temperature) {
+        float bt_F = 74 + bt_temperature * 0.2;
+        float bt_C = (bt_F - 32) / 1.8;
+        PrintAndLogEx(NORMAL, "");
+        PrintAndLogEx(SUCCESS, "Bio-Thermo detected");
+        PrintAndLogEx(INFO, "   temperature     " _GREEN_("%.1f")" F / " _GREEN_("%.1f") " C", bt_F, bt_C);
+    }
+
    // set block 0 for later
    //g_DemodConfig = T55x7_MODULATION_DIPHASE | T55x7_BITRATE_RF_32 | 4 << T55x7_MAXBLOCK_SHIFT;

    return PM3_SUCCESS;
 }

+static int CmdFdxDemod(const char *Cmd) {
+    (void)Cmd; // Cmd is not used so far
+    return demodFDX();
+}
+
 static int CmdFdxRead(const char *Cmd) {
    lf_read(false, 10000);
    return CmdFdxDemod(Cmd);
@ -272,9 +304,9 @@ static int CmdFdxClone(const char *Cmd) {

    countryid = param_get32ex(Cmd, 0, 0, 10);
    animalid = param_get64ex(Cmd, 1, 0, 10);
-    extended = param_get32ex(Cmd, 2, 0, 10);
+    extended = param_get32ex(Cmd, 2, 0, 16);

-    verify_values(&animalid, &countryid);
+    verify_values(&animalid, &countryid, &extended);

    uint8_t *bits = calloc(128, sizeof(uint8_t));

@ -298,7 +330,7 @@ static int CmdFdxClone(const char *Cmd) {

    free(bits);

-    PrintAndLogEx(INFO, "Preparing to clone FDX-B to T55x7 with animal ID: %04u-%"PRIu64, countryid, animalid);
+    PrintAndLogEx(INFO, "Preparing to clone FDX-B to T55x7 with animal ID: " _GREEN_("%04u-%"PRIu64)" (extended 0x%X)", countryid, animalid, extended);
    print_blocks(blocks,  ARRAYLEN(blocks));

    int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
@ -316,11 +348,11 @@ static int CmdFdxSim(const char *Cmd) {

    countryid = param_get32ex(Cmd, 0, 0, 10);
    animalid = param_get64ex(Cmd, 1, 0, 10);
-    extended = param_get32ex(Cmd, 2, 0, 10);
+    extended = param_get32ex(Cmd, 2, 0, 16);

-    verify_values(&animalid, &countryid);
+    verify_values(&animalid, &countryid, &extended);

-    PrintAndLogEx(SUCCESS, "Simulating FDX-B animal ID: %04u-%"PRIu64, countryid, animalid);
+    PrintAndLogEx(SUCCESS, "Simulating FDX-B animal ID: " _GREEN_("%04u-%"PRIu64)" (extended 0x%X)", countryid, animalid, extended);

    //getFDXBits(uint64_t national_id, uint16_t country, uint8_t isanimal, uint8_t isextended, uint32_t extended, uint8_t *bits)
    uint8_t *bits = calloc(128, sizeof(uint8_t));
@ -389,10 +421,6 @@ int detectFDXB(uint8_t *dest, size_t *size) {
    return (int)startIdx;
 }

-int demodFDX(void) {
-    return CmdFdxDemod("");
-}
-
 int getFDXBits(uint64_t national_id, uint16_t country, uint8_t is_animal, uint8_t is_extended, uint32_t extended, uint8_t *bits) {

    // add preamble ten 0x00 and one 0x01
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@ -3045,7 +3045,7 @@ static int CmdT55xxChkPwds(const char *Cmd) {
    }

    if (use_pwd_file) {
-        uint16_t keycount = 0;
+        uint32_t keycount = 0;

        int res = loadFileDICTIONARY_safe(filename, (void **) &keyBlock, 4, &keycount);
        if (res != PM3_SUCCESS || keycount == 0 || keyBlock == NULL) {
@ -3056,7 +3056,7 @@ static int CmdT55xxChkPwds(const char *Cmd) {
            return PM3_ESOFT;
        }

-        for (uint16_t c = 0; c < keycount; ++c) {
+        for (uint32_t c = 0; c < keycount; ++c) {

            if (!session.pm3_present) {
                PrintAndLogEx(WARNING, "Device offline\n");
--- a/client/src/fileutils.c
+++ b/client/src/fileutils.c
@ -996,7 +996,7 @@ out:
    return retval;
 }

-int loadFileDICTIONARY(const char *preferredName, void *data, size_t *datalen, uint8_t keylen, uint16_t *keycnt) {
+int loadFileDICTIONARY(const char *preferredName, void *data, size_t *datalen, uint8_t keylen, uint32_t *keycnt) {
    // t5577 == 4bytes
    // mifare == 6 bytes
    // mf plus == 16 bytes
@ -1009,7 +1009,7 @@ int loadFileDICTIONARY(const char *preferredName, void *data, size_t *datalen, u
    return loadFileDICTIONARYEx(preferredName, data, 0, datalen, keylen, keycnt, 0, NULL, true);
 }

-int loadFileDICTIONARYEx(const char *preferredName, void *data, size_t maxdatalen, size_t *datalen, uint8_t keylen, uint16_t *keycnt,
+int loadFileDICTIONARYEx(const char *preferredName, void *data, size_t maxdatalen, size_t *datalen, uint8_t keylen, uint32_t *keycnt,
                         size_t startFilePosition, size_t *endFilePosition, bool verbose) {

    if (data == NULL) return PM3_EINVARG;
@ -1025,7 +1025,7 @@ int loadFileDICTIONARYEx(const char *preferredName, void *data, size_t maxdatale
    keylen <<= 1;

    char line[255];
-    uint16_t vkeycnt = 0;
+    uint32_t vkeycnt = 0;
    size_t counter = 0;
    int retval = PM3_SUCCESS;

@ -1097,7 +1097,7 @@ out:
    return retval;
 }

-int loadFileDICTIONARY_safe(const char *preferredName, void **pdata, uint8_t keylen, uint16_t *keycnt) {
+int loadFileDICTIONARY_safe(const char *preferredName, void **pdata, uint8_t keylen, uint32_t *keycnt) {

    int retval = PM3_SUCCESS;

@ -1141,7 +1141,7 @@ int loadFileDICTIONARY_safe(const char *preferredName, void **pdata, uint8_t key
    while (fgets(line, sizeof(line), f)) {

        // check if we have enough space (if not allocate more)
-        if ((((size_t)(*keycnt)) * (keylen >> 1)) >= mem_size) {
+        if ((*keycnt * (keylen >> 1)) >= mem_size) {

            mem_size += block_size;
            *pdata = realloc(*pdata, mem_size);
--- a/client/src/fileutils.h
+++ b/client/src/fileutils.h
@ -210,7 +210,7 @@ int loadFileJSON(const char *preferredName, void *data, size_t maxdatalen, size_
 * @param keycnt key count that lays in data. may be NULL
 * @return 0 for ok, 1 for failz
 */
-int loadFileDICTIONARY(const char *preferredName, void *data, size_t *datalen, uint8_t keylen, uint16_t *keycnt);
+int loadFileDICTIONARY(const char *preferredName, void *data, size_t *datalen, uint8_t keylen, uint32_t *keycnt);

 /**
 * @brief  Utility function to load data from a DICTIONARY textfile. This method takes a preferred name.
@ -228,7 +228,7 @@ int loadFileDICTIONARY(const char *preferredName, void *data, size_t *datalen, u
 * @param verbose print messages if true
 * @return 0 for ok, 1 for failz
 */
-int loadFileDICTIONARYEx(const char *preferredName, void *data, size_t maxdatalen, size_t *datalen, uint8_t keylen, uint16_t *keycnt,
+int loadFileDICTIONARYEx(const char *preferredName, void *data, size_t maxdatalen, size_t *datalen, uint8_t keylen, uint32_t *keycnt,
                         size_t startFilePosition, size_t *endFilePosition, bool verbose);

 /**
@ -240,7 +240,7 @@ int loadFileDICTIONARYEx(const char *preferredName, void *data, size_t maxdatale
 * @param keylen  the number of bytes a key per row is
 * @return 0 for ok, 1 for failz
 */
-int loadFileDICTIONARY_safe(const char *preferredName, void **pdata, uint8_t keylen, uint16_t *keycnt);
+int loadFileDICTIONARY_safe(const char *preferredName, void **pdata, uint8_t keylen, uint32_t *keycnt);

 /**
 * @brief  Utility function to check and convert old mfu dump format to new
--- a/common/legic_prng.c
+++ b/common/legic_prng.c
@ -12,7 +12,7 @@
 // b is 8bit lsfr
 // c keeps track on which step the prng is.
 // legic_prng_get_bit() = gets a bit muxed from a and b.
-struct lfsr {
+static struct lfsr {
    uint8_t  a;
    uint8_t  b;
    uint32_t c;
--- a/common/parity.c
+++ b/common/parity.c
@ -25,7 +25,7 @@ const uint8_t OddByteParity[256] = {
    0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
    1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
 };
-
+/*
 const uint8_t EvenByteParity[256] = {
    0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
    1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
@ -44,4 +44,4 @@ const uint8_t EvenByteParity[256] = {
    1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
    0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0
 };
-
+*/
--- a/common_arm/usb_cdc.c
+++ b/common_arm/usb_cdc.c
@ -130,9 +130,9 @@ AT91SAM7S256  USB Device Port
 #define SET_CONTROL_LINE_STATE        0x2221

 AT91PS_UDP pUdp = AT91C_BASE_UDP;
-uint8_t btConfiguration = 0;
-uint8_t btConnection    = 0;
-uint8_t btReceiveBank   = AT91C_UDP_RX_DATA_BK0;
+static uint8_t btConfiguration = 0;
+static uint8_t btConnection    = 0;
+static uint8_t btReceiveBank   = AT91C_UDP_RX_DATA_BK0;

 static const char devDescriptor[] = {
    /* Device descriptor */
--- a/common_fpga/fpga.h
+++ b/common_fpga/fpga.h
@ -17,7 +17,7 @@
 #define FPGA_TRACE_SIZE                     3072

 static const uint8_t bitparse_fixed_header[] = {0x00, 0x09, 0x0f, 0xf0, 0x0f, 0xf0, 0x0f, 0xf0, 0x0f, 0xf0, 0x00, 0x00, 0x01};
-extern const int fpga_bitstream_num;
-extern const char *const fpga_version_information[];
+extern const int g_fpga_bitstream_num;
+extern const char *const g_fpga_version_information[];

 #endif
--- a/doc/termux_notes.md
+++ b/doc/termux_notes.md
@ -1,6 +1,27 @@
+<a id="top"></a>
 # Proxmark 3 on Android
+## Table of Contents
+  * [ Requirements ](#requirements)
+  * [ Notes ](#notes)
+  * [ Tested setups ](#tested-setups)
+    * OnePlus 5 (arm64, USB-C)
+    * Nexus 5X (arm64, USB-C)
+    * Xiaomi Mi Mix 2S (arm64, USB-C)
+    * OnePlus 5T (arm64, USB-C)
+    * Samsung Galaxy Tab S2 (arm64, MicroUSB)
+  * [ Setup ](#setup)
+    * [ Setting up Termux ](#setting-up-termux)
+    * [ Install Proxmark3 package ](#install-proxmark3-package)
+    * [ USB_ACM ](#usb_acm)
+    * [ Enable the driver ](#enable-the-driver)
+    * [ Building the kernel ](#building-the-kernel)
+    * [ Flashing the kernel ](#flashing-the-kernel)
+  * [ Testing ](#testing)
+  * [ Troubleshooting ](#troubleshooting)

 ## Requirements
+^[Top](#top)
+
 - Android phone
 - Kernel with one of:
    - USB_ACM driver
@ -10,11 +31,13 @@
 - [Termux](https://play.google.com/store/apps/details?id=com.termux)

 ## Notes
+^[Top](#top)
 From official Proxmark3 wiki:
 > In any case, you would need a USB-C to A or USB-OTG cable to connect Proxmark3 to your Android device. Some Android devices may not supply enough power (USB-OTG = 100mA), and need a USB Y-cable and external battery, otherwise they will get strange failures.
 ref : https://github.com/Proxmark/proxmark3/wiki/android

 ## Tested setups
+^[Top](#top)

 - OnePlus 5 (arm64, USB-C)

@ -45,9 +68,17 @@ ref : https://github.com/Proxmark/proxmark3/wiki/android


 ## Setup
+^[Top](#top)
+
 ### Setting up Termux
+^[Top](#top)
+
 Install [Termux](https://play.google.com/store/apps/details?id=com.termux) and start it
+
+
 ### Install Proxmark3 package
+^[Top](#top)
+
 Run the following commands:
 ```
 pkg install proxmark3 tsu
@ -61,18 +92,28 @@ make clean && make client
 ```

 ### USB_ACM
+^[Top](#top)
+
 You need the `USB_ACM` driver enabled and working to communicate with the Proxmark3. To see if it's working, run `tsudo ls /dev/tty*` and it should list `/dev/ttyACM0` (or similar). If you see this, congratulations, skip this step!

 #### Enable the driver
+^[Top](#top)
+
 If  your kernel has module loading enabled, you should be able to build the module separately and load it on your system without any changes. Otherwise, grab your kernel sources and edit your build config to include `CONFIG_USB_ACM=y`. On the tested kernel, this was under: `android_kernel_oneplus_msm8998/arch/arm64/configs/omni_oneplus5_defconfig`

 #### Building the kernel
+^[Top](#top)
+
 If using a custom kernel, refer to the build instructions provided by its maintainer. Otherwise, follow the standard Linux kernel build procedure

 #### Flashing the kernel
+^[Top](#top)
+
 You can flash the kernel however it suits you. On the tested device, this was achieved using [TWRP](https://twrp.me/), the most popular custom recovery

 ### Testing
+^[Top](#top)
+
 Open Termux and start the Proxmark3 client:
 ```
 tsudo proxmark3/client/proxmark3 /dev/ttyACM0
@ -80,5 +121,7 @@ tsudo proxmark3/client/proxmark3 /dev/ttyACM0
 Everything should work just like if it was your PC!

 ### Troubleshooting
+^[Top](#top)
+
 - `dmesg | grep usb` - useful debug info
 - `/proc/config.gz` - contains your kernel's build configuration. Look for `CONFIG_USB_ACM`, which should be enabled
--- a/include/pmflash.h
+++ b/include/pmflash.h
@ -14,9 +14,6 @@

 #include "common.h"

-// Flashmem spi baudrate
-extern uint32_t FLASHMEM_SPIBAUDRATE;
-
 // RDV40 Section
 // 256kb divided into 4k sectors.
 //
--- a/pm3test.sh
+++ b/pm3test.sh
@ -116,19 +116,21 @@ while true; do
  if ! CheckExecute "trace load/list x"       "$PM3BIN -c 'trace load traces/hf_mfu.trace; trace list x 1;'" "0.0101840425"; then break; fi

  echo -e "\n${C_BLUE}Testing LF:${C_NC}"
-  if ! CheckExecute "lf EM4x05 test"      "$PM3BIN -c 'data load traces/em4x05.pm3;lf search 1'" "FDX-B ID found"; then break; fi
-  if ! CheckExecute "lf EM410x test"      "$PM3BIN -c 'data load traces/EM4102-1.pm3;lf search 1'" "EM410x ID found"; then break; fi
-  if ! CheckExecute "lf VISA2000 test"    "$PM3BIN -c 'data load traces/visa2000.pm3;lf search 1'" "Visa2000 ID found"; then break; fi
-  if ! CheckExecute "lf AWID test"        "$PM3BIN -c 'data load traces/AWID-15-259.pm3;lf search 1'" "AWID ID found"; then break; fi
-  if ! CheckExecute "lf SECURAKEY test"   "$PM3BIN -c 'data load traces/securakey-64169.pm3;lf search 1 '" "Securakey ID found"; then break; fi
-  if ! CheckExecute "lf NEXWATCH test"    "$PM3BIN -c 'data load traces/quadrakey-521512301.pm3;lf search 1 '" "NexWatch ID found"; then break; fi
-  if ! CheckExecute "lf KERI test"        "$PM3BIN -c 'data load traces/keri.pm3;lf search 1'" "Pyramid ID found"; then break; fi
-  if ! CheckExecute "lf HID Prox test" "$PM3BIN -c 'data load traces/hid-proxCardII-05512-11432784-1.pm3;lf search 1'" "HID Prox ID found"; then break; fi
-  if ! CheckExecute "lf PARADOX test"     "$PM3BIN -c 'data load traces/Paradox-96_40426-APJN08.pm3;lf search 1'" "Paradox ID found"; then break; fi
-  if ! CheckExecute "lf PAC test"         "$PM3BIN -c 'data load traces/pac-8E4C058E.pm3;lf search 1'" "PAC/Stanley ID found"; then break; fi
-  if ! CheckExecute "lf VIKING test"      "$PM3BIN -c 'data load traces/Transit999-best.pm3;lf search 1'" "Viking ID found"; then break; fi
-  if ! CheckExecute "lf FDX-B test"       "$PM3BIN -c 'data load traces/homeagain1600.pm3;lf search 1'" "FDX-B ID found"; then break; fi
-  if ! CheckExecute "lf INDALA test"      "$PM3BIN -c 'data load traces/indala-504278295.pm3;lf search 1'" "Indala ID found"; then break; fi
+  if ! CheckExecute "lf EM4x05 test"        "$PM3BIN -c 'data load traces/em4x05.pm3;lf search 1'" "FDX-B ID found"; then break; fi
+  if ! CheckExecute "lf EM410x test"        "$PM3BIN -c 'data load traces/EM4102-1.pm3;lf search 1'" "EM410x ID found"; then break; fi
+  if ! CheckExecute "lf VISA2000 test"      "$PM3BIN -c 'data load traces/visa2000.pm3;lf search 1'" "Visa2000 ID found"; then break; fi
+  if ! CheckExecute "lf AWID test"          "$PM3BIN -c 'data load traces/AWID-15-259.pm3;lf search 1'" "AWID ID found"; then break; fi
+  if ! CheckExecute "lf SECURAKEY test"     "$PM3BIN -c 'data load traces/securakey-64169.pm3;lf search 1 '" "Securakey ID found"; then break; fi
+  if ! CheckExecute "lf NEXWATCH test"      "$PM3BIN -c 'data load traces/quadrakey-521512301.pm3;lf search 1 '" "NexWatch ID found"; then break; fi
+  if ! CheckExecute "lf KERI test"          "$PM3BIN -c 'data load traces/keri.pm3;lf search 1'" "Pyramid ID found"; then break; fi
+  if ! CheckExecute "lf HID Prox test"      "$PM3BIN -c 'data load traces/hid-proxCardII-05512-11432784-1.pm3;lf search 1'" "HID Prox ID found"; then break; fi
+  if ! CheckExecute "lf PARADOX test"       "$PM3BIN -c 'data load traces/Paradox-96_40426-APJN08.pm3;lf search 1'" "Paradox ID found"; then break; fi
+  if ! CheckExecute "lf PAC test"           "$PM3BIN -c 'data load traces/pac-8E4C058E.pm3;lf search 1'" "PAC/Stanley ID found"; then break; fi
+  if ! CheckExecute "lf VIKING test"        "$PM3BIN -c 'data load traces/Transit999-best.pm3;lf search 1'" "Viking ID found"; then break; fi
+  if ! CheckExecute "lf FDX-B test"         "$PM3BIN -c 'data load traces/homeagain1600.pm3;lf search 1'" "FDX-B ID found"; then break; fi
+  if ! CheckExecute "lf INDALA test"        "$PM3BIN -c 'data load traces/indala-504278295.pm3;lf search 1'" "Indala ID found"; then break; fi
+  if ! CheckExecute "lf FDX/BioThermo test" "$PM3BIN -c 'data load traces/lf_fdx_biothermo.pm3; lf fdx demo'" "95.2 F / 35.1 C"; then break; fi
+

  echo -e "\n${C_BLUE}Testing HF:${C_NC}"
  if ! CheckExecute "hf mf offline text"               "$PM3BIN -c 'hf mf'" "at_enc"; then break; fi
--- a/tools/fpga_compress/fpga_compress.c
+++ b/tools/fpga_compress/fpga_compress.c
@ -378,8 +378,8 @@ static void print_version_info_preamble(FILE *outfile, int num_infiles) {
    fprintf(outfile, "//-----------------------------------------------------------------------------\n");
    fprintf(outfile, "\n");
    fprintf(outfile, "\n");
-    fprintf(outfile, "const int fpga_bitstream_num = %d;\n", num_infiles);
-    fprintf(outfile, "const char *const fpga_version_information[%d] = {\n", num_infiles);
+    fprintf(outfile, "const int g_fpga_bitstream_num = %d;\n", num_infiles);
+    fprintf(outfile, "const char *const g_fpga_version_information[%d] = {\n", num_infiles);
 }

 static int generate_fpga_version_info(FILE *infile[], char *infile_names[], int num_infiles, FILE *outfile) {
--- a/tools/mf_nonce_brute/mf_nonce_brute.c
+++ b/tools/mf_nonce_brute/mf_nonce_brute.c
@ -1,5 +1,9 @@
 #define __STDC_FORMAT_MACROS
-#define _USE_32BIT_TIME_T 1
+
+#if defined(_WIN32)
+# define _USE_32BIT_TIME_T 1
+#endif
+
 #include <inttypes.h>
 #include <stdio.h>
 #include <stdbool.h>
--- a/traces/lf_fdx_biothermo.pm3
+++ b/traces/lf_fdx_biothermo.pm3