mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2025-08-20 13:23:51 -07:00
typos
This commit is contained in:
parent
0ed66781a7
commit
88308ea727
98 changed files with 271 additions and 271 deletions
12
CHANGELOG.md
12
CHANGELOG.md
|
@ -62,7 +62,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
||||||
- Changed `nfc parser` - now also identify xvcard types (@iceman1001)
|
- Changed `nfc parser` - now also identify xvcard types (@iceman1001)
|
||||||
- Added `hf mf gview` - view contents of a magic Gen3 GTU (@iceman1001)
|
- Added `hf mf gview` - view contents of a magic Gen3 GTU (@iceman1001)
|
||||||
- Added Standalone mode for nexwatch ID credentials (@Guilhem7, @MaximeBosca)
|
- Added Standalone mode for nexwatch ID credentials (@Guilhem7, @MaximeBosca)
|
||||||
- Fix `lf em 4x50/4x70 *` reverted a missunderstanding in byte order macros (@iceman1001)
|
- Fix `lf em 4x50/4x70 *` reverted a misunderstanding in byte order macros (@iceman1001)
|
||||||
- Added more keys (@equipter)
|
- Added more keys (@equipter)
|
||||||
- Changed `hf nfc ndefread` - ndef parser now handles more types (@iceman1001)
|
- Changed `hf nfc ndefread` - ndef parser now handles more types (@iceman1001)
|
||||||
- Fix `hf desfire` changekey, GetUID, 3DES sesson key tweak. (@mwalker33)
|
- Fix `hf desfire` changekey, GetUID, 3DES sesson key tweak. (@mwalker33)
|
||||||
|
@ -109,9 +109,9 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
||||||
- Changed `smart raw` - now uses NG (@iceman1001)
|
- Changed `smart raw` - now uses NG (@iceman1001)
|
||||||
- Added `hf iclass configcard` - now can download / generate config card dumps with a cardhelper [WIP] (@iceman1001)
|
- Added `hf iclass configcard` - now can download / generate config card dumps with a cardhelper [WIP] (@iceman1001)
|
||||||
- Fix swapped DESELECT and WTX annotations (@VortixDev)
|
- Fix swapped DESELECT and WTX annotations (@VortixDev)
|
||||||
- Fixed `hf 15 findafi` - cliparser bug, and loop is user interruptable (@iceman1001)
|
- Fixed `hf 15 findafi` - cliparser bug, and loop is user interruptible (@iceman1001)
|
||||||
- Added `hf mf wipe` - takes a keyfile and wipes a MFC to default values (@iceman1001)
|
- Added `hf mf wipe` - takes a keyfile and wipes a MFC to default values (@iceman1001)
|
||||||
- Changed `pm3 shell` - now prioritise USB connections in WSL1 (@gator96100)
|
- Changed `pm3 shell` - now prioritize USB connections in WSL1 (@gator96100)
|
||||||
- Added `hf mf restore -w` - now supports usage of specified keyfile to authenticate with instead of default FFFFFF key (@iceman1001)
|
- Added `hf mf restore -w` - now supports usage of specified keyfile to authenticate with instead of default FFFFFF key (@iceman1001)
|
||||||
- Added `mem info --pem`- now supports loading of private key in PEM format (@iceman1001)
|
- Added `mem info --pem`- now supports loading of private key in PEM format (@iceman1001)
|
||||||
- Changed `hf mfp auth` - more verbose message (@vortixdev)
|
- Changed `hf mfp auth` - more verbose message (@vortixdev)
|
||||||
|
@ -286,7 +286,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
||||||
- Change pushed some ARM source to compile with THUMB. Saves a lot of space of ARM flash memory (@slurdge)
|
- Change pushed some ARM source to compile with THUMB. Saves a lot of space of ARM flash memory (@slurdge)
|
||||||
- Change from using ZLIB compression of FPGA images in ARM to LZ4. 15%+ speedups when swapping between HF & LF now (@slurdge)
|
- Change from using ZLIB compression of FPGA images in ARM to LZ4. 15%+ speedups when swapping between HF & LF now (@slurdge)
|
||||||
- Fix `emv scan -w` - hash mismatch, solution similar to below (@iceman1001)
|
- Fix `emv scan -w` - hash mismatch, solution similar to below (@iceman1001)
|
||||||
- Fix 'emv roca' - hash mismatch, merged from offical repo (@pwpiwi)
|
- Fix 'emv roca' - hash mismatch, merged from official repo (@pwpiwi)
|
||||||
- Fix 'lf ti demod' - now calculates correct crc (@iceman1001)
|
- Fix 'lf ti demod' - now calculates correct crc (@iceman1001)
|
||||||
- Add Python3 as possible script engine (@iceman1001, @doegox)
|
- Add Python3 as possible script engine (@iceman1001, @doegox)
|
||||||
- Add doc/mfu_binary_format_notes.md (@iceman1001)
|
- Add doc/mfu_binary_format_notes.md (@iceman1001)
|
||||||
|
@ -905,9 +905,9 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
||||||
|
|
||||||
## [3.0.0][2017-08-29]
|
## [3.0.0][2017-08-29]
|
||||||
Notes on this release
|
Notes on this release
|
||||||
this version includes a merge with the PM3 offical v3.0.1 code, a.k.a the "Monster merge"
|
this version includes a merge with the PM3 official v3.0.1 code, a.k.a the "Monster merge"
|
||||||
There is a lot of changes, command breaking changes, which is the cause for the JUMP in version number.
|
There is a lot of changes, command breaking changes, which is the cause for the JUMP in version number.
|
||||||
It is set to v3.0.0 to show that it is on par with PM3 Offical v3 release.
|
It is set to v3.0.0 to show that it is on par with PM3 Official v3 release.
|
||||||
|
|
||||||
- Updated `mkversion.pl` to write a date based on file when repo is downloaded as a zip file from github (@iceman1001)
|
- Updated `mkversion.pl` to write a date based on file when repo is downloaded as a zip file from github (@iceman1001)
|
||||||
- Update `readme.md` to fit GitHubs markup(@joanbono)
|
- Update `readme.md` to fit GitHubs markup(@joanbono)
|
||||||
|
|
|
@ -49,7 +49,7 @@ static tosend_t toSend = {
|
||||||
};
|
};
|
||||||
//=============================================================================
|
//=============================================================================
|
||||||
// The dmaBuf 16bit buffer.
|
// The dmaBuf 16bit buffer.
|
||||||
// A buffer where we recive IQ samples sent from the FPGA, for demodulating
|
// A buffer where we receive IQ samples sent from the FPGA, for demodulating
|
||||||
//=============================================================================
|
//=============================================================================
|
||||||
static dmabuf16_t dma_16 = {
|
static dmabuf16_t dma_16 = {
|
||||||
.size = DMA_BUFFER_SIZE,
|
.size = DMA_BUFFER_SIZE,
|
||||||
|
|
|
@ -225,7 +225,7 @@ static void RAMFUNC SniffAndStore(uint8_t param) {
|
||||||
}
|
}
|
||||||
|
|
||||||
if (g_dbglevel > 1)
|
if (g_dbglevel > 1)
|
||||||
Dbprintf("[!] Wrote %u Authentification attempts into logfile", auth_attempts);
|
Dbprintf("[!] Wrote %u Authentication attempts into logfile", auth_attempts);
|
||||||
|
|
||||||
SpinErr(LED_A, 200, 5);
|
SpinErr(LED_A, 200, 5);
|
||||||
SpinDelay(100);
|
SpinDelay(100);
|
||||||
|
|
|
@ -310,7 +310,7 @@ void WriteTagToFlash(uint32_t uid, size_t size) {
|
||||||
num_to_bytes(uid, 4, buid);
|
num_to_bytes(uid, 4, buid);
|
||||||
sprintf(dest, "hf_colin/mf_%02x%02x%02x%02x.bin", buid[0], buid[1], buid[2], buid[3]);
|
sprintf(dest, "hf_colin/mf_%02x%02x%02x%02x.bin", buid[0], buid[1], buid[2], buid[3]);
|
||||||
|
|
||||||
// TODO : by using safe function for multiple writes we are both breaking cache mecanisms and making useless and
|
// TODO : by using safe function for multiple writes we are both breaking cache mechanisms and making useless and
|
||||||
// unoptimized mount operations we should manage at out level the mount status before and after the whole
|
// unoptimized mount operations we should manage at out level the mount status before and after the whole
|
||||||
// standalone mode
|
// standalone mode
|
||||||
rdv40_spiffs_write((char *)dest, (uint8_t *)data, len, RDV40_SPIFFS_SAFETY_SAFE);
|
rdv40_spiffs_write((char *)dest, (uint8_t *)data, len, RDV40_SPIFFS_SAFETY_SAFE);
|
||||||
|
|
|
@ -11,7 +11,7 @@
|
||||||
// Created for the live streamed talk 'DEFCON 28 Wireless Village-Omikron and Iceman - Ghosting the PACS-man: New Tools and Techniques'
|
// Created for the live streamed talk 'DEFCON 28 Wireless Village-Omikron and Iceman - Ghosting the PACS-man: New Tools and Techniques'
|
||||||
// https://www.youtube.com/watch?v=ghiHXK4GEzE
|
// https://www.youtube.com/watch?v=ghiHXK4GEzE
|
||||||
//
|
//
|
||||||
// I created a youtube video demostrating the HF_ICECLASS standalone mode
|
// I created a youtube video demonstrating the HF_ICECLASS standalone mode
|
||||||
// https://youtu.be/w_1GnAscNIU
|
// https://youtu.be/w_1GnAscNIU
|
||||||
//
|
//
|
||||||
//
|
//
|
||||||
|
@ -43,7 +43,7 @@
|
||||||
|
|
||||||
// ====================================================
|
// ====================================================
|
||||||
// Select which standalone function to be active.
|
// Select which standalone function to be active.
|
||||||
// 5 possiblities. Uncomment the one you wanna use.
|
// 5 possibilities. Uncomment the one you wanna use.
|
||||||
|
|
||||||
#define ICE_USE ICE_STATE_FULLSIM
|
#define ICE_USE ICE_STATE_FULLSIM
|
||||||
//#define ICE_USE ICE_STATE_ATTACK
|
//#define ICE_USE ICE_STATE_ATTACK
|
||||||
|
|
|
@ -124,7 +124,7 @@ void RunMod(void) {
|
||||||
DbpString("[=] looking for tags");
|
DbpString("[=] looking for tags");
|
||||||
int read_success = PM3_ESOFT;
|
int read_success = PM3_ESOFT;
|
||||||
|
|
||||||
//search for legic card until reading successfull or button pressed
|
//search for legic card until reading successful or button pressed
|
||||||
do {
|
do {
|
||||||
LED_C_ON();
|
LED_C_ON();
|
||||||
SpinDelay(500);
|
SpinDelay(500);
|
||||||
|
|
|
@ -33,7 +33,7 @@ void ModInfo(void) {
|
||||||
*
|
*
|
||||||
* Instructions:
|
* Instructions:
|
||||||
*
|
*
|
||||||
* I recommend setting up & run the other end before start sending or receving data in this Proxmark3
|
* I recommend setting up & run the other end before start sending or receiving data in this Proxmark3
|
||||||
* standalone.
|
* standalone.
|
||||||
*
|
*
|
||||||
* For the reading mode:
|
* For the reading mode:
|
||||||
|
|
|
@ -8,8 +8,8 @@
|
||||||
//-----------------------------------------------------------------------------
|
//-----------------------------------------------------------------------------
|
||||||
// LF rswb - This mode can simulate ID from selected slot, read ID to
|
// LF rswb - This mode can simulate ID from selected slot, read ID to
|
||||||
// selected slot, write from selected slot to T5555/T55x7 tag and store
|
// selected slot, write from selected slot to T5555/T55x7 tag and store
|
||||||
// readed ID to flash (only RDV4).
|
// read ID to flash (only RDV4).
|
||||||
// Predefined its is not recomended because you can incedently rewrite your MANDATORY tag data.
|
// Predefining it is not recommended because you can incidentally rewrite your MANDATORY tag data.
|
||||||
//
|
//
|
||||||
// To recall stored ID from flash execute:
|
// To recall stored ID from flash execute:
|
||||||
// mem spifss dump o emdump p
|
// mem spifss dump o emdump p
|
||||||
|
@ -23,12 +23,12 @@
|
||||||
// 0 - READ Read source card ID and store it to current slot
|
// 0 - READ Read source card ID and store it to current slot
|
||||||
// Will switch to SIM mode automatically.
|
// Will switch to SIM mode automatically.
|
||||||
//
|
//
|
||||||
// 1 - SIM Simulate readed ID
|
// 1 - SIM Simulate read ID
|
||||||
//
|
//
|
||||||
// 2 - WRITE(CLONE) Write readed ID to T55x7 card
|
// 2 - WRITE(CLONE) Write read ID to T55x7 card
|
||||||
// !!! Warning, card id WILL BE OVERRWRITED
|
// !!! Warning, card id WILL BE OVERWRITTEN
|
||||||
//
|
//
|
||||||
// 3 - BRUTE Brute upper or down from readed card)
|
// 3 - BRUTE Brute upper or down from read card)
|
||||||
// You can PRESS SINGLE to exit brute mode OR
|
// You can PRESS SINGLE to exit brute mode OR
|
||||||
// PRESS DOUBLE to save bruted ID to current slot (will automatically switch to SIM mode) AND
|
// PRESS DOUBLE to save bruted ID to current slot (will automatically switch to SIM mode) AND
|
||||||
// Also You can HOLD button to change brute speeds.
|
// Also You can HOLD button to change brute speeds.
|
||||||
|
|
|
@ -2011,7 +2011,7 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||||
reply_ng(CMD_LF_UPLOAD_SIM_SAMPLES, PM3_EOVFLOW, NULL, 0);
|
reply_ng(CMD_LF_UPLOAD_SIM_SAMPLES, PM3_EOVFLOW, NULL, 0);
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
// ensure len bytes copied wont go past end of bigbuf
|
// ensure len bytes copied won't go past end of bigbuf
|
||||||
uint16_t len = MIN(BigBuf_get_size() - payload->offset, sizeof(payload->data));
|
uint16_t len = MIN(BigBuf_get_size() - payload->offset, sizeof(payload->data));
|
||||||
|
|
||||||
uint8_t *mem = BigBuf_get_addr();
|
uint8_t *mem = BigBuf_get_addr();
|
||||||
|
@ -2250,9 +2250,9 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||||
case CMD_FLASHMEM_WIPE: {
|
case CMD_FLASHMEM_WIPE: {
|
||||||
LED_B_ON();
|
LED_B_ON();
|
||||||
uint8_t page = packet->oldarg[0];
|
uint8_t page = packet->oldarg[0];
|
||||||
uint8_t initalwipe = packet->oldarg[1];
|
uint8_t initialwipe = packet->oldarg[1];
|
||||||
bool isok = false;
|
bool isok = false;
|
||||||
if (initalwipe) {
|
if (initialwipe) {
|
||||||
isok = Flash_WipeMemory();
|
isok = Flash_WipeMemory();
|
||||||
reply_mix(CMD_ACK, isok, 0, 0, 0, 0);
|
reply_mix(CMD_ACK, isok, 0, 0, 0, 0);
|
||||||
LED_B_OFF();
|
LED_B_OFF();
|
||||||
|
|
|
@ -443,7 +443,7 @@ static int find_double_listen_window(bool bcommand) {
|
||||||
return PM3_EFAILED;
|
return PM3_EFAILED;
|
||||||
}
|
}
|
||||||
|
|
||||||
// function is used to check wether a tag on the proxmark is an
|
// function is used to check whether a tag on the proxmark is an
|
||||||
// EM4x50 tag or not -> speed up "lf search" process
|
// EM4x50 tag or not -> speed up "lf search" process
|
||||||
static bool find_em4x50_tag(void) {
|
static bool find_em4x50_tag(void) {
|
||||||
return find_single_listen_window();
|
return find_single_listen_window();
|
||||||
|
@ -458,7 +458,7 @@ static int request_receive_mode(void) {
|
||||||
|
|
||||||
// returns true if signal structue corresponds to ACK, anything else is
|
// returns true if signal structue corresponds to ACK, anything else is
|
||||||
// counted as NAK (-> false)
|
// counted as NAK (-> false)
|
||||||
// Only relevant for pasword writing function:
|
// Only relevant for password writing function:
|
||||||
// If <bliw> is true then within the single listen window right after the
|
// If <bliw> is true then within the single listen window right after the
|
||||||
// ack signal a RM request has to be sent.
|
// ack signal a RM request has to be sent.
|
||||||
static bool check_ack(bool bliw) {
|
static bool check_ack(bool bliw) {
|
||||||
|
@ -1796,7 +1796,7 @@ void em4x50_sim(uint32_t *password) {
|
||||||
g_Login = false;
|
g_Login = false;
|
||||||
g_WritePasswordProcess = false;
|
g_WritePasswordProcess = false;
|
||||||
|
|
||||||
// start with inital command = standard read mode
|
// start with initial command = standard read mode
|
||||||
command = EM4X50_COMMAND_STANDARD_READ;
|
command = EM4X50_COMMAND_STANDARD_READ;
|
||||||
|
|
||||||
for (;;) {
|
for (;;) {
|
||||||
|
|
|
@ -59,7 +59,7 @@ static bool command_parity = true;
|
||||||
#define EM4X70_COMMAND_WRITE 0x05
|
#define EM4X70_COMMAND_WRITE 0x05
|
||||||
#define EM4X70_COMMAND_UM2 0x07
|
#define EM4X70_COMMAND_UM2 0x07
|
||||||
|
|
||||||
// Constants used to determing high/low state of signal
|
// Constants used to determine high/low state of signal
|
||||||
#define EM4X70_NOISE_THRESHOLD 13 // May depend on noise in environment
|
#define EM4X70_NOISE_THRESHOLD 13 // May depend on noise in environment
|
||||||
#define HIGH_SIGNAL_THRESHOLD (127 + EM4X70_NOISE_THRESHOLD)
|
#define HIGH_SIGNAL_THRESHOLD (127 + EM4X70_NOISE_THRESHOLD)
|
||||||
#define LOW_SIGNAL_THRESHOLD (127 - EM4X70_NOISE_THRESHOLD)
|
#define LOW_SIGNAL_THRESHOLD (127 - EM4X70_NOISE_THRESHOLD)
|
||||||
|
@ -539,7 +539,7 @@ static bool em4x70_read_um2(void) {
|
||||||
}
|
}
|
||||||
|
|
||||||
static bool find_em4x70_tag(void) {
|
static bool find_em4x70_tag(void) {
|
||||||
// function is used to check wether a tag on the proxmark is an
|
// function is used to check whether a tag on the proxmark is an
|
||||||
// EM4170 tag or not -> speed up "lf search" process
|
// EM4170 tag or not -> speed up "lf search" process
|
||||||
return find_listen_window(false);
|
return find_listen_window(false);
|
||||||
}
|
}
|
||||||
|
|
|
@ -5,7 +5,7 @@
|
||||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||||
// the license.
|
// the license.
|
||||||
//-----------------------------------------------------------------------------
|
//-----------------------------------------------------------------------------
|
||||||
// Routines to support the German eletronic "Personalausweis" (ID card)
|
// Routines to support the German electronic "Personalausweis" (ID card)
|
||||||
//-----------------------------------------------------------------------------
|
//-----------------------------------------------------------------------------
|
||||||
|
|
||||||
#ifndef __EPA_H
|
#ifndef __EPA_H
|
||||||
|
|
|
@ -172,7 +172,7 @@ uint16_t FlashSendByte(uint32_t data) {
|
||||||
|
|
||||||
//while ((AT91C_BASE_SPI->SPI_SR & AT91C_SPI_TDRE) == 0){};
|
//while ((AT91C_BASE_SPI->SPI_SR & AT91C_SPI_TDRE) == 0){};
|
||||||
|
|
||||||
// wait recive transfer is complete
|
// wait receive transfer is complete
|
||||||
while ((AT91C_BASE_SPI->SPI_SR & AT91C_SPI_RDRF) == 0) {};
|
while ((AT91C_BASE_SPI->SPI_SR & AT91C_SPI_RDRF) == 0) {};
|
||||||
|
|
||||||
// reading incoming data
|
// reading incoming data
|
||||||
|
@ -285,7 +285,7 @@ void Flash_TransferAdresse(uint32_t address) {
|
||||||
FlashSendByte((address >> 0) & 0xFF);
|
FlashSendByte((address >> 0) & 0xFF);
|
||||||
}
|
}
|
||||||
|
|
||||||
/* This ensure we can ReadData without having to cycle through initialization everytime */
|
/* This ensures we can ReadData without having to cycle through initialization every time */
|
||||||
uint16_t Flash_ReadDataCont(uint32_t address, uint8_t *out, uint16_t len) {
|
uint16_t Flash_ReadDataCont(uint32_t address, uint8_t *out, uint16_t len) {
|
||||||
|
|
||||||
// length should never be zero
|
// length should never be zero
|
||||||
|
|
|
@ -530,7 +530,7 @@ void FpgaSendCommand(uint16_t cmd, uint16_t v) {
|
||||||
//-----------------------------------------------------------------------------
|
//-----------------------------------------------------------------------------
|
||||||
// Write the FPGA setup word (that determines what mode the logic is in, read
|
// Write the FPGA setup word (that determines what mode the logic is in, read
|
||||||
// vs. clone vs. etc.). This is now a special case of FpgaSendCommand() to
|
// vs. clone vs. etc.). This is now a special case of FpgaSendCommand() to
|
||||||
// avoid changing this function's occurence everywhere in the source code.
|
// avoid changing this function's occurrence everywhere in the source code.
|
||||||
//-----------------------------------------------------------------------------
|
//-----------------------------------------------------------------------------
|
||||||
void FpgaWriteConfWord(uint16_t v) {
|
void FpgaWriteConfWord(uint16_t v) {
|
||||||
FpgaSendCommand(FPGA_CMD_SET_CONFREG, v);
|
FpgaSendCommand(FPGA_CMD_SET_CONFREG, v);
|
||||||
|
|
|
@ -75,7 +75,7 @@ int HfSniff(uint32_t samplesToSkip, uint32_t triggersToSkip, uint16_t *len) {
|
||||||
|
|
||||||
r = MAX(r & 0xFF, r >> 8);
|
r = MAX(r & 0xFF, r >> 8);
|
||||||
|
|
||||||
// 180 (0xB4) arbitary value to see if a strong RF field is near.
|
// 180 (0xB4) arbitrary value to see if a strong RF field is near.
|
||||||
if (r > 180) {
|
if (r > 180) {
|
||||||
|
|
||||||
if (++trigger_cnt > triggersToSkip) {
|
if (++trigger_cnt > triggersToSkip) {
|
||||||
|
|
|
@ -1141,7 +1141,7 @@ void SniffHitag2(void) {
|
||||||
// Disable timer during configuration
|
// Disable timer during configuration
|
||||||
AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
|
AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
|
||||||
|
|
||||||
// Capture mode, defaul timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger,
|
// Capture mode, default timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger,
|
||||||
// external trigger rising edge, load RA on rising edge of TIOA.
|
// external trigger rising edge, load RA on rising edge of TIOA.
|
||||||
AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK | AT91C_TC_ETRGEDG_BOTH | AT91C_TC_ABETRG | AT91C_TC_LDRA_BOTH;
|
AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK | AT91C_TC_ETRGEDG_BOTH | AT91C_TC_ABETRG | AT91C_TC_LDRA_BOTH;
|
||||||
|
|
||||||
|
@ -1225,7 +1225,7 @@ void SniffHitag2(void) {
|
||||||
//DbpString("wierd1?");
|
//DbpString("wierd1?");
|
||||||
// }
|
// }
|
||||||
// Capture the T0 periods that have passed since last communication or field drop (reset)
|
// Capture the T0 periods that have passed since last communication or field drop (reset)
|
||||||
// We always recieve a 'one' first, which has the falling edge after a half period |-_|
|
// We always receive a 'one' first, which has the falling edge after a half period |-_|
|
||||||
response = ra - HITAG_T_TAG_HALF_PERIOD;
|
response = ra - HITAG_T_TAG_HALF_PERIOD;
|
||||||
|
|
||||||
} else if (ra >= HITAG_T_TAG_CAPTURE_FOUR_HALF) {
|
} else if (ra >= HITAG_T_TAG_CAPTURE_FOUR_HALF) {
|
||||||
|
|
|
@ -727,7 +727,7 @@ bool hitag2crack_consume_keystream(uint8_t *keybits, int kslen, int *ksoffset, u
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
// dont bother decrypting the response - we already know the keybits
|
// don't bother decrypting the response - we already know the keybits
|
||||||
|
|
||||||
// update ksoffset with command length and response
|
// update ksoffset with command length and response
|
||||||
*ksoffset += (numcmds * 10) + 32;
|
*ksoffset += (numcmds * 10) + 32;
|
||||||
|
|
|
@ -603,7 +603,7 @@ static void hitagS_handle_reader_command(uint8_t *rx, const size_t rxlen,
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* to autenticate to a tag with the given key or challenge
|
* to authenticate to a tag with the given key or challenge
|
||||||
*/
|
*/
|
||||||
static int hitagS_handle_tag_auth(hitag_function htf, uint64_t key, uint64_t NrAr, uint8_t *rx, const size_t rxlen, uint8_t *tx, size_t *txlen) {
|
static int hitagS_handle_tag_auth(hitag_function htf, uint64_t key, uint64_t NrAr, uint8_t *rx, const size_t rxlen, uint8_t *tx, size_t *txlen) {
|
||||||
uint8_t rx_air[HITAG_FRAME_LEN];
|
uint8_t rx_air[HITAG_FRAME_LEN];
|
||||||
|
@ -1015,7 +1015,7 @@ void SimulateHitagSTag(bool tag_mem_supplied, uint8_t *data) {
|
||||||
// Capture reader frame
|
// Capture reader frame
|
||||||
if (ra >= HITAG_T_STOP) {
|
if (ra >= HITAG_T_STOP) {
|
||||||
if (rxlen != 0) {
|
if (rxlen != 0) {
|
||||||
//DbpString("wierd0?");
|
//DbpString("weird0?");
|
||||||
}
|
}
|
||||||
// Capture the T0 periods that have passed since last communication or field drop (reset)
|
// Capture the T0 periods that have passed since last communication or field drop (reset)
|
||||||
response = (ra - HITAG_T_LOW);
|
response = (ra - HITAG_T_LOW);
|
||||||
|
@ -1110,10 +1110,10 @@ static void hitagS_receive_frame(uint8_t *rx, size_t *rxlen, int *response) {
|
||||||
// Capture tag frame (manchester decoding using only falling edges)
|
// Capture tag frame (manchester decoding using only falling edges)
|
||||||
if (ra >= HITAG_T_EOF) {
|
if (ra >= HITAG_T_EOF) {
|
||||||
if (*rxlen != 0) {
|
if (*rxlen != 0) {
|
||||||
//DbpString("wierd1?");
|
//DbpString("weird1?");
|
||||||
}
|
}
|
||||||
// Capture the T0 periods that have passed since last communication or field drop (reset)
|
// Capture the T0 periods that have passed since last communication or field drop (reset)
|
||||||
// We always recieve a 'one' first, which has the falling edge after a half period |-_|
|
// We always receive a 'one' first, which has the falling edge after a half period |-_|
|
||||||
*response = ra - HITAG_T_TAG_HALF_PERIOD;
|
*response = ra - HITAG_T_TAG_HALF_PERIOD;
|
||||||
} else if (ra >= HITAG_T_TAG_CAPTURE_FOUR_HALF) {
|
} else if (ra >= HITAG_T_TAG_CAPTURE_FOUR_HALF) {
|
||||||
// Manchester coding example |-_|_-|-_| (101)
|
// Manchester coding example |-_|_-|-_| (101)
|
||||||
|
@ -1143,12 +1143,12 @@ static void hitagS_receive_frame(uint8_t *rx, size_t *rxlen, int *response) {
|
||||||
(*rxlen)++;
|
(*rxlen)++;
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
// Ignore wierd value, is to small to mean anything
|
// Ignore weird value, is to small to mean anything
|
||||||
errorCount++;
|
errorCount++;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// if we saw over 100 wierd values break it probably isn't hitag...
|
// if we saw over 100 weird values break it probably isn't hitag...
|
||||||
if (errorCount > 100) break;
|
if (errorCount > 100) break;
|
||||||
|
|
||||||
// We can break this loop if we received the last bit from a frame
|
// We can break this loop if we received the last bit from a frame
|
||||||
|
@ -1255,7 +1255,7 @@ void ReadHitagS(hitag_function htf, hitag_data *htd) {
|
||||||
// TC0: Capture mode, default timer source = MCK/2 (TIMER_CLOCK1), no triggers
|
// TC0: Capture mode, default timer source = MCK/2 (TIMER_CLOCK1), no triggers
|
||||||
AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK;
|
AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK;
|
||||||
|
|
||||||
// TC1: Capture mode, defaul timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger,
|
// TC1: Capture mode, default timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger,
|
||||||
// external trigger rising edge, load RA on falling edge of TIOA.
|
// external trigger rising edge, load RA on falling edge of TIOA.
|
||||||
AT91C_BASE_TC1->TC_CMR =
|
AT91C_BASE_TC1->TC_CMR =
|
||||||
AT91C_TC_CLKS_TIMER_DIV1_CLOCK |
|
AT91C_TC_CLKS_TIMER_DIV1_CLOCK |
|
||||||
|
@ -1320,13 +1320,13 @@ void ReadHitagS(hitag_function htf, hitag_data *htd) {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
k = 0;
|
k = 0;
|
||||||
for (i = 4; i < 36; i++) { // ignore first 4 bits: SOF (actualy 1 or 6 depending on response protocol)
|
for (i = 4; i < 36; i++) { // ignore first 4 bits: SOF (actually 1 or 6 depending on response protocol)
|
||||||
pageData[k] = response_bit[i];
|
pageData[k] = response_bit[i];
|
||||||
k++;
|
k++;
|
||||||
}
|
}
|
||||||
for (i = 0; i < 4; i++) // set page bytes to 0
|
for (i = 0; i < 4; i++) // set page bytes to 0
|
||||||
tag.pages[pageNum][i] = 0x0;
|
tag.pages[pageNum][i] = 0x0;
|
||||||
for (i = 0; i < 4; i++) { // set page bytes from recieved bits
|
for (i = 0; i < 4; i++) { // set page bytes from received bits
|
||||||
tag.pages[pageNum][i] += ((pageData[i * 8] << 7)
|
tag.pages[pageNum][i] += ((pageData[i * 8] << 7)
|
||||||
| (pageData[1 + (i * 8)] << 6)
|
| (pageData[1 + (i * 8)] << 6)
|
||||||
| (pageData[2 + (i * 8)] << 5)
|
| (pageData[2 + (i * 8)] << 5)
|
||||||
|
@ -1554,7 +1554,7 @@ void WritePageHitagS(hitag_function htf, hitag_data *htd, int page) {
|
||||||
Dbprintf("no write access on page %d", page);
|
Dbprintf("no write access on page %d", page);
|
||||||
bStop = !false;
|
bStop = !false;
|
||||||
} else if (rxlen == 0 && tag.tstate != HT_WRITING_PAGE_DATA) {
|
} else if (rxlen == 0 && tag.tstate != HT_WRITING_PAGE_DATA) {
|
||||||
//start the authetication
|
//start the authentication
|
||||||
txlen = 5;
|
txlen = 5;
|
||||||
memcpy(tx, "\xc0", nbytes(txlen));
|
memcpy(tx, "\xc0", nbytes(txlen));
|
||||||
tag.pstate = HT_READY;
|
tag.pstate = HT_READY;
|
||||||
|
@ -1581,7 +1581,7 @@ void WritePageHitagS(hitag_function htf, hitag_data *htd, int page) {
|
||||||
tx[2] = 0x00 + (crc % 16) * 16;
|
tx[2] = 0x00 + (crc % 16) * 16;
|
||||||
} else if (tag.pstate == HT_SELECTED && tag.tstate == HT_WRITING_PAGE_ACK
|
} else if (tag.pstate == HT_SELECTED && tag.tstate == HT_WRITING_PAGE_ACK
|
||||||
&& rxlen == 6 && rx[0] == 0xf4) {
|
&& rxlen == 6 && rx[0] == 0xf4) {
|
||||||
//ACK recieved to write the page. send data
|
//ACK received to write the page. send data
|
||||||
tag.tstate = HT_WRITING_PAGE_DATA;
|
tag.tstate = HT_WRITING_PAGE_DATA;
|
||||||
txlen = 40;
|
txlen = 40;
|
||||||
crc = CRC_PRESET;
|
crc = CRC_PRESET;
|
||||||
|
|
|
@ -1246,7 +1246,7 @@ static void iclass_send_as_reader(uint8_t *frame, int len, uint32_t *start_time,
|
||||||
CodeIso15693AsReader(frame, len);
|
CodeIso15693AsReader(frame, len);
|
||||||
tosend_t *ts = get_tosend();
|
tosend_t *ts = get_tosend();
|
||||||
TransmitTo15693Tag(ts->buf, ts->max, start_time);
|
TransmitTo15693Tag(ts->buf, ts->max, start_time);
|
||||||
*end_time = *start_time + (32 * ((8 * ts->max) - 4)); // substract the 4 padding bits after EOF
|
*end_time = *start_time + (32 * ((8 * ts->max) - 4)); // subtract the 4 padding bits after EOF
|
||||||
LogTrace_ISO15693(frame, len, (*start_time * 4), (*end_time * 4), NULL, true);
|
LogTrace_ISO15693(frame, len, (*start_time * 4), (*end_time * 4), NULL, true);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -2326,7 +2326,7 @@ int ReaderReceive(uint8_t *receivedAnswer, uint8_t *par) {
|
||||||
|
|
||||||
// This function misstreats the ISO 14443a anticollision procedure.
|
// This function misstreats the ISO 14443a anticollision procedure.
|
||||||
// by fooling the reader there is a collision and forceing the reader to
|
// by fooling the reader there is a collision and forceing the reader to
|
||||||
// increase the uid bytes. The might be an overflow, DoS will occure.
|
// increase the uid bytes. The might be an overflow, DoS will occur.
|
||||||
void iso14443a_antifuzz(uint32_t flags) {
|
void iso14443a_antifuzz(uint32_t flags) {
|
||||||
|
|
||||||
// We need to listen to the high-frequency, peak-detected path.
|
// We need to listen to the high-frequency, peak-detected path.
|
||||||
|
@ -3136,7 +3136,7 @@ void ReaderMifare(bool first_try, uint8_t block, uint8_t keytype) {
|
||||||
received_nack = true;
|
received_nack = true;
|
||||||
else if (resp_res == 4) {
|
else if (resp_res == 4) {
|
||||||
// did we get lucky and got our dummykey to be valid?
|
// did we get lucky and got our dummykey to be valid?
|
||||||
// however we dont feed key w uid it the prng..
|
// however we don't feed key w uid it the prng..
|
||||||
isOK = -6;
|
isOK = -6;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
@ -3520,7 +3520,7 @@ void DetectNACKbug(void) {
|
||||||
consecutive_resyncs = 0;
|
consecutive_resyncs = 0;
|
||||||
} // end for loop
|
} // end for loop
|
||||||
|
|
||||||
// num_nacks = number of nacks recieved. should be only 1. if not its a clone card which always sends NACK (parity == 0) ?
|
// num_nacks = number of nacks received. should be only 1. if not its a clone card which always sends NACK (parity == 0) ?
|
||||||
// i = number of authentications sent. Not always 256, since we are trying to sync but close to it.
|
// i = number of authentications sent. Not always 256, since we are trying to sync but close to it.
|
||||||
FpgaDisableTracing();
|
FpgaDisableTracing();
|
||||||
|
|
||||||
|
|
|
@ -194,7 +194,7 @@ static uint32_t iso14b_timeout = FWT_TIMEOUT_14B;
|
||||||
*
|
*
|
||||||
* Elementary Time Unit (ETU)
|
* Elementary Time Unit (ETU)
|
||||||
* --------------------------
|
* --------------------------
|
||||||
* ETU is used to denotate 1 bit period i.e. how long one bit transfer takes.
|
* ETU is used to denote 1 bit period i.e. how long one bit transfer takes.
|
||||||
*
|
*
|
||||||
* - 128 Carrier cycles / 13.56MHz = 8 Subcarrier units / 848kHz = 1/106kHz = 9.4395 µS
|
* - 128 Carrier cycles / 13.56MHz = 8 Subcarrier units / 848kHz = 1/106kHz = 9.4395 µS
|
||||||
* - 16 Carrier cycles = 1 Subcarrier unit = 1.17 µS
|
* - 16 Carrier cycles = 1 Subcarrier unit = 1.17 µS
|
||||||
|
@ -203,7 +203,7 @@ static uint32_t iso14b_timeout = FWT_TIMEOUT_14B;
|
||||||
* ----------
|
* ----------
|
||||||
* 1 ETU = 128 / ( D x fc )
|
* 1 ETU = 128 / ( D x fc )
|
||||||
* where
|
* where
|
||||||
* D = divisor. Which inital is 1
|
* D = divisor. Which initial is 1
|
||||||
* fc = carrier frequency
|
* fc = carrier frequency
|
||||||
* gives
|
* gives
|
||||||
* 1 ETU = 128 / fc
|
* 1 ETU = 128 / fc
|
||||||
|
@ -267,7 +267,7 @@ static uint32_t iso14b_timeout = FWT_TIMEOUT_14B;
|
||||||
* --------------------------
|
* --------------------------
|
||||||
* The mode FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK which we use to simulate tag
|
* The mode FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK which we use to simulate tag
|
||||||
* works like this:
|
* works like this:
|
||||||
* Simulation per definition is "inversed" effect on the reader antenna.
|
* Simulation per definition is "inverted" effect on the reader antenna.
|
||||||
* - A 1-bit input to the FPGA becomes 8 pulses at 847.5kHz (1.18µS / pulse) == 9.44us
|
* - A 1-bit input to the FPGA becomes 8 pulses at 847.5kHz (1.18µS / pulse) == 9.44us
|
||||||
* - A 0-bit input to the FPGA becomes an unmodulated time of 1.18µS or does it become 8 nonpulses for 9.44us
|
* - A 0-bit input to the FPGA becomes an unmodulated time of 1.18µS or does it become 8 nonpulses for 9.44us
|
||||||
*
|
*
|
||||||
|
|
|
@ -1454,7 +1454,7 @@ void Iso15693InitReader(void) {
|
||||||
|
|
||||||
///////////////////////////////////////////////////////////////////////
|
///////////////////////////////////////////////////////////////////////
|
||||||
// ISO 15693 Part 3 - Air Interface
|
// ISO 15693 Part 3 - Air Interface
|
||||||
// This section basicly contains transmission and receiving of bits
|
// This section basically contains transmission and receiving of bits
|
||||||
///////////////////////////////////////////////////////////////////////
|
///////////////////////////////////////////////////////////////////////
|
||||||
|
|
||||||
// Encode an identify request, which is the first
|
// Encode an identify request, which is the first
|
||||||
|
@ -1504,7 +1504,7 @@ int SendDataTag(uint8_t *send, int sendlen, bool init, bool speed_fast, uint8_t
|
||||||
|
|
||||||
} else {
|
} else {
|
||||||
|
|
||||||
*eof_time = start_time + 32 * ((8 * ts->max) - 4); // substract the 4 padding bits after EOF
|
*eof_time = start_time + 32 * ((8 * ts->max) - 4); // subtract the 4 padding bits after EOF
|
||||||
LogTrace_ISO15693(send, sendlen, (start_time * 4), (*eof_time * 4), NULL, true);
|
LogTrace_ISO15693(send, sendlen, (start_time * 4), (*eof_time * 4), NULL, true);
|
||||||
if (recv != NULL) {
|
if (recv != NULL) {
|
||||||
res = GetIso15693AnswerFromTag(recv, max_recv_len, timeout, eof_time);
|
res = GetIso15693AnswerFromTag(recv, max_recv_len, timeout, eof_time);
|
||||||
|
@ -1518,7 +1518,7 @@ int SendDataTagEOF(uint8_t *recv, uint16_t max_recv_len, uint32_t start_time, ui
|
||||||
CodeIso15693AsReaderEOF();
|
CodeIso15693AsReaderEOF();
|
||||||
tosend_t *ts = get_tosend();
|
tosend_t *ts = get_tosend();
|
||||||
TransmitTo15693Tag(ts->buf, ts->max, &start_time);
|
TransmitTo15693Tag(ts->buf, ts->max, &start_time);
|
||||||
uint32_t end_time = start_time + 32 * (8 * ts->max - 4); // substract the 4 padding bits after EOF
|
uint32_t end_time = start_time + 32 * (8 * ts->max - 4); // subtract the 4 padding bits after EOF
|
||||||
LogTrace_ISO15693(NULL, 0, (start_time * 4), (end_time * 4), NULL, true);
|
LogTrace_ISO15693(NULL, 0, (start_time * 4), (end_time * 4), NULL, true);
|
||||||
|
|
||||||
int res = 0;
|
int res = 0;
|
||||||
|
@ -1858,7 +1858,7 @@ void BruteforceIso15693Afi(uint32_t speed) {
|
||||||
Iso15693InitReader();
|
Iso15693InitReader();
|
||||||
|
|
||||||
// first without AFI
|
// first without AFI
|
||||||
// Tags should respond wihtout AFI and with AFI=0 even when AFI is active
|
// Tags should respond without AFI and with AFI=0 even when AFI is active
|
||||||
|
|
||||||
data[0] = ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1;
|
data[0] = ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1;
|
||||||
data[1] = ISO15693_INVENTORY;
|
data[1] = ISO15693_INVENTORY;
|
||||||
|
|
|
@ -38,10 +38,10 @@ static crc_t legic_crc;
|
||||||
// - 100us for a 1 (RWD_TIME_1)
|
// - 100us for a 1 (RWD_TIME_1)
|
||||||
//
|
//
|
||||||
// The data dependent timing makes writing comprehensible code significantly
|
// The data dependent timing makes writing comprehensible code significantly
|
||||||
// harder. The current aproach forwards the prng data based if there is data on
|
// harder. The current approach forwards the prng data based if there is data on
|
||||||
// air and time based, using GET_TICKS, during computational and wait periodes.
|
// air and time based, using GET_TICKS, during computational and wait periodes.
|
||||||
//
|
//
|
||||||
// To not have the necessity to calculate/guess exection time dependend timeouts
|
// To not have the necessity to calculate/guess execution time dependend timeouts
|
||||||
// tx_frame and rx_frame use a shared timestamp to coordinate tx and rx timeslots.
|
// tx_frame and rx_frame use a shared timestamp to coordinate tx and rx timeslots.
|
||||||
//-----------------------------------------------------------------------------
|
//-----------------------------------------------------------------------------
|
||||||
|
|
||||||
|
@ -79,10 +79,10 @@ static uint16_t rx_frame_from_fpga(void) {
|
||||||
// Demodulation (Reader)
|
// Demodulation (Reader)
|
||||||
//-----------------------------------------------------------------------------
|
//-----------------------------------------------------------------------------
|
||||||
|
|
||||||
// Returns a demedulated bit
|
// Returns a demodulated bit
|
||||||
//
|
//
|
||||||
// The FPGA running xcorrelation samples the subcarrier at ~13.56 MHz. The mode
|
// The FPGA running xcorrelation samples the subcarrier at ~13.56 MHz. The mode
|
||||||
// was initialy designed to receive BSPK/2-PSK. Hance, it reports an I/Q pair
|
// was initially designed to receive BSPK/2-PSK. Hance, it reports an I/Q pair
|
||||||
// every 4.7us (8 bits i and 8 bits q).
|
// every 4.7us (8 bits i and 8 bits q).
|
||||||
//
|
//
|
||||||
// The subcarrier amplitude can be calculated using Pythagoras sqrt(i^2 + q^2).
|
// The subcarrier amplitude can be calculated using Pythagoras sqrt(i^2 + q^2).
|
||||||
|
@ -93,7 +93,7 @@ static uint16_t rx_frame_from_fpga(void) {
|
||||||
// and averages the next (most stable) 8 samples. The final 8 samples are dropped
|
// and averages the next (most stable) 8 samples. The final 8 samples are dropped
|
||||||
// also.
|
// also.
|
||||||
//
|
//
|
||||||
// The demodulated should be alligned to the bit period by the caller. This is
|
// The demodulated should be aligned to the bit period by the caller. This is
|
||||||
// done in rx_bit and rx_ack.
|
// done in rx_bit and rx_ack.
|
||||||
//
|
//
|
||||||
// Note: The demodulator would be drifting (18.9us * 5 != 100us), rx_frame
|
// Note: The demodulator would be drifting (18.9us * 5 != 100us), rx_frame
|
||||||
|
|
|
@ -36,11 +36,11 @@ static crc_t legic_crc;
|
||||||
// - 99.1us for a 1 (RWD_TIME_1)
|
// - 99.1us for a 1 (RWD_TIME_1)
|
||||||
//
|
//
|
||||||
// The data dependent timing makes writing comprehensible code significantly
|
// The data dependent timing makes writing comprehensible code significantly
|
||||||
// harder. The current aproach forwards the prng data based if there is data on
|
// harder. The current approach forwards the prng data based if there is data on
|
||||||
// air and time based, using GetCountSspClk(), during computational and wait
|
// air and time based, using GetCountSspClk(), during computational and wait
|
||||||
// periodes. SSP Clock is clocked by the FPGA at 212 kHz (subcarrier frequency).
|
// periodes. SSP Clock is clocked by the FPGA at 212 kHz (subcarrier frequency).
|
||||||
//
|
//
|
||||||
// To not have the necessity to calculate/guess exection time dependend timeouts
|
// To not have the necessity to calculate/guess execution time dependent timeouts
|
||||||
// tx_frame and rx_frame use a shared timestamp to coordinate tx and rx timeslots.
|
// tx_frame and rx_frame use a shared timestamp to coordinate tx and rx timeslots.
|
||||||
//-----------------------------------------------------------------------------
|
//-----------------------------------------------------------------------------
|
||||||
|
|
||||||
|
@ -76,7 +76,7 @@ static bool wait_for(bool value, const uint32_t timeout) {
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
// Returns a demedulated bit or -1 on code violation
|
// Returns a demodulated bit or -1 on code violation
|
||||||
//
|
//
|
||||||
// rx_bit decodes bits using a thresholds. rx_bit has to be called by as soon as
|
// rx_bit decodes bits using a thresholds. rx_bit has to be called by as soon as
|
||||||
// a frame starts (first pause is received). rx_bit checks for a pause up to
|
// a frame starts (first pause is received). rx_bit checks for a pause up to
|
||||||
|
@ -118,8 +118,8 @@ static int8_t rx_bit(void) {
|
||||||
// - Subcarrier on for a 1
|
// - Subcarrier on for a 1
|
||||||
// - Subcarrier off for for a 0
|
// - Subcarrier off for for a 0
|
||||||
//
|
//
|
||||||
// The 212kHz subcarrier is generated by the FPGA as well as a mathcing ssp clk.
|
// The 212kHz subcarrier is generated by the FPGA as well as a matching ssp clk.
|
||||||
// Each bit is transfered in a 99.1us slot and the first timeslot starts 330us
|
// Each bit is transferred in a 99.1us slot and the first timeslot starts 330us
|
||||||
// after the final 20us pause generated by the reader.
|
// after the final 20us pause generated by the reader.
|
||||||
//-----------------------------------------------------------------------------
|
//-----------------------------------------------------------------------------
|
||||||
|
|
||||||
|
@ -201,7 +201,7 @@ static void tx_ack(void) {
|
||||||
LogTrace(cmdbytes, sizeof(cmdbytes), last_frame_start, last_frame_end, NULL, false);
|
LogTrace(cmdbytes, sizeof(cmdbytes), last_frame_start, last_frame_end, NULL, false);
|
||||||
}
|
}
|
||||||
|
|
||||||
// Returns a demedulated frame or -1 on code violation
|
// Returns a demodulated frame or -1 on code violation
|
||||||
//
|
//
|
||||||
// Since TX to RX delay is arbitrary rx_frame has to:
|
// Since TX to RX delay is arbitrary rx_frame has to:
|
||||||
// - detect start of frame (first pause)
|
// - detect start of frame (first pause)
|
||||||
|
@ -212,7 +212,7 @@ static int32_t rx_frame(uint8_t *len) {
|
||||||
int32_t frame = 0;
|
int32_t frame = 0;
|
||||||
|
|
||||||
// add 2 SSP clock cycles (1 for tx and 1 for rx pipeline delay)
|
// add 2 SSP clock cycles (1 for tx and 1 for rx pipeline delay)
|
||||||
// those will be substracted at the end of the rx phase
|
// those will be subtracted at the end of the rx phase
|
||||||
last_frame_end -= 2;
|
last_frame_end -= 2;
|
||||||
|
|
||||||
// wait for first pause (start of frame)
|
// wait for first pause (start of frame)
|
||||||
|
@ -259,7 +259,7 @@ static int32_t rx_frame(uint8_t *len) {
|
||||||
}
|
}
|
||||||
|
|
||||||
// rx_bit sets coordination timestamp to start of pause, append pause duration
|
// rx_bit sets coordination timestamp to start of pause, append pause duration
|
||||||
// and substract 2 SSP clock cycles (1 for rx and 1 for tx pipeline delay) to
|
// and subtract 2 SSP clock cycles (1 for rx and 1 for tx pipeline delay) to
|
||||||
// obtain exact end of frame.
|
// obtain exact end of frame.
|
||||||
last_frame_end += RWD_TIME_PAUSE - 2;
|
last_frame_end += RWD_TIME_PAUSE - 2;
|
||||||
|
|
||||||
|
@ -495,7 +495,7 @@ void LegicRfSimulate(uint8_t tagtype, bool send_reply) {
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
// conection is established, process commands until one fails
|
// connection is established, process commands until one fails
|
||||||
while (connected_phase(&card) == false) {
|
while (connected_phase(&card) == false) {
|
||||||
WDT_HIT();
|
WDT_HIT();
|
||||||
}
|
}
|
||||||
|
|
|
@ -113,7 +113,7 @@ static size_t lf_count_edge_periods_ex(size_t max, bool wait, bool detect_gap) {
|
||||||
if (wait == false) {
|
if (wait == false) {
|
||||||
// Test if we are locating a field modulation (100% ASK = complete field drop)
|
// Test if we are locating a field modulation (100% ASK = complete field drop)
|
||||||
if (detect_gap) {
|
if (detect_gap) {
|
||||||
// Only return when the field completely dissapeared
|
// Only return when the field completely disappeared
|
||||||
if (adc_val == 0) {
|
if (adc_val == 0) {
|
||||||
return periods;
|
return periods;
|
||||||
}
|
}
|
||||||
|
|
|
@ -52,7 +52,7 @@ Short note about timers on Proxmark device ARM. They are a bit differently impl
|
||||||
SAM7S has several timers, we will use the source TIMER_CLOCK1 (aka AT91C_TC_CLKS_TIMER_DIV1_CLOCK)
|
SAM7S has several timers, we will use the source TIMER_CLOCK1 (aka AT91C_TC_CLKS_TIMER_DIV1_CLOCK)
|
||||||
TIMER_CLOCK1 = MCK/2, MCK is running at 48 MHz, Timer is running at 48/2 = 24 MHz
|
TIMER_CLOCK1 = MCK/2, MCK is running at 48 MHz, Timer is running at 48/2 = 24 MHz
|
||||||
|
|
||||||
New timer implemenation in ticks.c, which is used in LFOPS.c
|
New timer implementation in ticks.c, which is used in LFOPS.c
|
||||||
1 μs = 1.5 ticks
|
1 μs = 1.5 ticks
|
||||||
1 fc = 8 μs = 12 ticks
|
1 fc = 8 μs = 12 ticks
|
||||||
|
|
||||||
|
@ -135,7 +135,7 @@ Initial values if not in flash
|
||||||
WG = Write gap
|
WG = Write gap
|
||||||
RG = Read gap
|
RG = Read gap
|
||||||
|
|
||||||
Explainations for array T55xx_Timing below
|
Explanations for array T55xx_Timing below
|
||||||
|
|
||||||
0 1 2 3
|
0 1 2 3
|
||||||
SG WG Bit 00 Bit 01 Bit 10 Bit 11 RG
|
SG WG Bit 00 Bit 01 Bit 10 Bit 11 RG
|
||||||
|
@ -1680,7 +1680,7 @@ static void T55xxWriteBit(uint8_t bit, uint8_t downlink_idx) {
|
||||||
// Function to abstract an Arbitrary length byte array to store bit pattern.
|
// Function to abstract an Arbitrary length byte array to store bit pattern.
|
||||||
// bit_array - Array to hold data/bit pattern
|
// bit_array - Array to hold data/bit pattern
|
||||||
// start_offset - bit location to start storing new bits.
|
// start_offset - bit location to start storing new bits.
|
||||||
// data - upto 32 bits of data to store
|
// data - up to 32 bits of data to store
|
||||||
// num_bits - how many bits (low x bits of data) Max 32 bits at a time
|
// num_bits - how many bits (low x bits of data) Max 32 bits at a time
|
||||||
// max_len - how many bytes can the bit_array hold (ensure no buffer overflow)
|
// max_len - how many bytes can the bit_array hold (ensure no buffer overflow)
|
||||||
// returns "Next" bit offset / bits stored (for next store)
|
// returns "Next" bit offset / bits stored (for next store)
|
||||||
|
@ -1927,7 +1927,7 @@ void T55xxWriteBlock(uint8_t *data) {
|
||||||
// as the tag should repeat back the new block
|
// as the tag should repeat back the new block
|
||||||
// until it is reset, but to confirm it we would
|
// until it is reset, but to confirm it we would
|
||||||
// need to know the current block 0 config mode for
|
// need to know the current block 0 config mode for
|
||||||
// modulation clock an other details to demod the response...
|
// modulation clock another details to demod the response...
|
||||||
// response should be (for t55x7) a 0 bit then (ST if on)
|
// response should be (for t55x7) a 0 bit then (ST if on)
|
||||||
// block data written in on repeat until reset.
|
// block data written in on repeat until reset.
|
||||||
|
|
||||||
|
@ -2446,7 +2446,7 @@ static uint8_t Prepare_Cmd(uint8_t cmd) {
|
||||||
cmd >>= 1;
|
cmd >>= 1;
|
||||||
*forward_ptr++ = cmd;
|
*forward_ptr++ = cmd;
|
||||||
|
|
||||||
return 6; //return number of emited bits
|
return 6; //return number of emitted bits
|
||||||
}
|
}
|
||||||
|
|
||||||
//====================================================================
|
//====================================================================
|
||||||
|
@ -2467,7 +2467,7 @@ static uint8_t Prepare_Addr(uint8_t addr) {
|
||||||
|
|
||||||
*forward_ptr++ = (line_parity & 1);
|
*forward_ptr++ = (line_parity & 1);
|
||||||
|
|
||||||
return 7; //return number of emited bits
|
return 7; //return number of emitted bits
|
||||||
}
|
}
|
||||||
|
|
||||||
//====================================================================
|
//====================================================================
|
||||||
|
@ -2502,7 +2502,7 @@ static uint8_t Prepare_Data(uint16_t data_low, uint16_t data_hi) {
|
||||||
}
|
}
|
||||||
*forward_ptr = 0;
|
*forward_ptr = 0;
|
||||||
|
|
||||||
return 45; //return number of emited bits
|
return 45; //return number of emitted bits
|
||||||
}
|
}
|
||||||
|
|
||||||
//====================================================================
|
//====================================================================
|
||||||
|
|
|
@ -1413,7 +1413,7 @@ void MifareChkKeys_fast(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *da
|
||||||
if (keyCount == 0)
|
if (keyCount == 0)
|
||||||
goto OUT;
|
goto OUT;
|
||||||
|
|
||||||
// limit size of availlable for keys in bigbuff
|
// limit size of available for keys in bigbuff
|
||||||
// a key is 6bytes
|
// a key is 6bytes
|
||||||
uint16_t key_mem_available = MIN(BigBuf_get_size(), keyCount * 6);
|
uint16_t key_mem_available = MIN(BigBuf_get_size(), keyCount * 6);
|
||||||
|
|
||||||
|
|
|
@ -544,7 +544,7 @@ void MifareDES_Auth1(uint8_t *datain) {
|
||||||
memcpy(cmd+19,buff3,8);
|
memcpy(cmd+19,buff3,8);
|
||||||
|
|
||||||
// The command always times out on the first attempt, this will retry until a response
|
// The command always times out on the first attempt, this will retry until a response
|
||||||
// is recieved.
|
// is received.
|
||||||
len = 0;
|
len = 0;
|
||||||
while(!len) {
|
while(!len) {
|
||||||
len = DesfireAPDU(cmd,27,resp);
|
len = DesfireAPDU(cmd,27,resp);
|
||||||
|
@ -587,7 +587,7 @@ void MifareDES_Auth1(uint8_t *datain) {
|
||||||
memcpy(cmd+19,buff3,8);
|
memcpy(cmd+19,buff3,8);
|
||||||
|
|
||||||
// The command always times out on the first attempt, this will retry until a response
|
// The command always times out on the first attempt, this will retry until a response
|
||||||
// is recieved.
|
// is received.
|
||||||
len = 0;
|
len = 0;
|
||||||
while(!len) {
|
while(!len) {
|
||||||
len = DesfireAPDU(cmd,27,resp);
|
len = DesfireAPDU(cmd,27,resp);
|
||||||
|
|
|
@ -897,7 +897,7 @@ void Mifare1ksim(uint16_t flags, uint8_t exitAfterNReads, uint8_t *datain, uint1
|
||||||
response[14], response[15]);
|
response[14], response[15]);
|
||||||
}
|
}
|
||||||
|
|
||||||
// Access permission managment:
|
// Access permission management:
|
||||||
//
|
//
|
||||||
// Sector Trailer:
|
// Sector Trailer:
|
||||||
// - KEY A access
|
// - KEY A access
|
||||||
|
@ -907,7 +907,7 @@ void Mifare1ksim(uint16_t flags, uint8_t exitAfterNReads, uint8_t *datain, uint1
|
||||||
// Data block:
|
// Data block:
|
||||||
// - Data access
|
// - Data access
|
||||||
|
|
||||||
// If permission is not allowed, data is cleared (00) in emulator memeory.
|
// If permission is not allowed, data is cleared (00) in emulator memory.
|
||||||
// ex: a0a1a2a3a4a561e789c1b0b1b2b3b4b5 => 00000000000061e789c1b0b1b2b3b4b5
|
// ex: a0a1a2a3a4a561e789c1b0b1b2b3b4b5 => 00000000000061e789c1b0b1b2b3b4b5
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -291,7 +291,7 @@ static void copy_in_spiffs(const char *src, const char *dst) {
|
||||||
////// Abstract Operations for base Safetyness /////////////////////////////////
|
////// Abstract Operations for base Safetyness /////////////////////////////////
|
||||||
//
|
//
|
||||||
// mount if not already
|
// mount if not already
|
||||||
// As an "hint" to the behavior one should adopt after his or her lazyness
|
// As an "hint" to the behavior one should adopt after his or her laziness
|
||||||
// it will return 0 if the call was a noop, either because it did not need to
|
// it will return 0 if the call was a noop, either because it did not need to
|
||||||
// change OR because it wasn't ABLE to change :)
|
// change OR because it wasn't ABLE to change :)
|
||||||
// 1 if the mount status actually changed
|
// 1 if the mount status actually changed
|
||||||
|
@ -384,7 +384,7 @@ int rdv40_spiffs_lazy_mount_rollback(int changed) {
|
||||||
}
|
}
|
||||||
///////////////////////////////////////////////////////////////////////////////
|
///////////////////////////////////////////////////////////////////////////////
|
||||||
|
|
||||||
// High level functions with SatefetyLevel
|
// High level functions with SafetyLevel
|
||||||
// Beware that different safety level makes different return behavior
|
// Beware that different safety level makes different return behavior
|
||||||
//
|
//
|
||||||
// RDV40_SPIFFS_SAFETY_NORMAL : will operate withtout further change on mount
|
// RDV40_SPIFFS_SAFETY_NORMAL : will operate withtout further change on mount
|
||||||
|
@ -396,7 +396,7 @@ int rdv40_spiffs_lazy_mount_rollback(int changed) {
|
||||||
// mount state had to change will return SPIFFS_OK /
|
// mount state had to change will return SPIFFS_OK /
|
||||||
// 0 / false if everything went well
|
// 0 / false if everything went well
|
||||||
|
|
||||||
// TODO : this functions are common enought to be unified with a switchcase
|
// TODO : this functions are common enough to be unified with a switchcase
|
||||||
// statement or some function taking function parameters
|
// statement or some function taking function parameters
|
||||||
// TODO : forbid writing to a filename which already exists as lnk !
|
// TODO : forbid writing to a filename which already exists as lnk !
|
||||||
// TODO : forbid writing to a filename.lnk which already exists without lnk !
|
// TODO : forbid writing to a filename.lnk which already exists without lnk !
|
||||||
|
@ -468,7 +468,7 @@ int rdv40_spiffs_is_symlink(const char *s) {
|
||||||
// since FILENAME can't be longer than 32Bytes as of hard configuration, we're
|
// since FILENAME can't be longer than 32Bytes as of hard configuration, we're
|
||||||
// safe with Such maximum. So the "size" variable is actually the known/intended
|
// safe with Such maximum. So the "size" variable is actually the known/intended
|
||||||
// size of DESTINATION file, may it be known (may we provide a "stat from
|
// size of DESTINATION file, may it be known (may we provide a "stat from
|
||||||
// symlinkk ?")
|
// symlink ?")
|
||||||
// ATTENTION : you must NOT provide the whole filename (so please do not include the .lnk extension)
|
// ATTENTION : you must NOT provide the whole filename (so please do not include the .lnk extension)
|
||||||
// TODO : integrate in read_function
|
// TODO : integrate in read_function
|
||||||
int rdv40_spiffs_read_as_symlink(char *filename, uint8_t *dst, uint32_t size, RDV40SpiFFSSafetyLevel level) {
|
int rdv40_spiffs_read_as_symlink(char *filename, uint8_t *dst, uint32_t size, RDV40SpiFFSSafetyLevel level) {
|
||||||
|
@ -499,7 +499,7 @@ int rdv40_spiffs_read_as_symlink(char *filename, uint8_t *dst, uint32_t size, RD
|
||||||
// Eg :
|
// Eg :
|
||||||
// rdv40_spiffs_make_symlink((uint8_t *)"hello", (uint8_t *)"world", RDV40_SPIFFS_SAFETY_SAFE)
|
// rdv40_spiffs_make_symlink((uint8_t *)"hello", (uint8_t *)"world", RDV40_SPIFFS_SAFETY_SAFE)
|
||||||
// will generate a file named "world.lnk" with the path to file "hello" written in
|
// will generate a file named "world.lnk" with the path to file "hello" written in
|
||||||
// wich you can then read back with :
|
// which you can then read back with :
|
||||||
// rdv40_spiffs_read_as_symlink((uint8_t *)"world",(uint8_t *) buffer, orig_file_size, RDV40_SPIFFS_SAFETY_SAFE);
|
// rdv40_spiffs_read_as_symlink((uint8_t *)"world",(uint8_t *) buffer, orig_file_size, RDV40_SPIFFS_SAFETY_SAFE);
|
||||||
// TODO : FORBID creating a symlink with a basename (before.lnk) which already exists as a file !
|
// TODO : FORBID creating a symlink with a basename (before.lnk) which already exists as a file !
|
||||||
int rdv40_spiffs_make_symlink(char *linkdest, char *filename, RDV40SpiFFSSafetyLevel level) {
|
int rdv40_spiffs_make_symlink(char *linkdest, char *filename, RDV40SpiFFSSafetyLevel level) {
|
||||||
|
@ -513,8 +513,8 @@ int rdv40_spiffs_make_symlink(char *linkdest, char *filename, RDV40SpiFFSSafetyL
|
||||||
// filename and filename.lnk will both the existence-checked
|
// filename and filename.lnk will both the existence-checked
|
||||||
// if filename exists, read will be used, if filename.lnk exists, read_as_symlink will be used
|
// if filename exists, read will be used, if filename.lnk exists, read_as_symlink will be used
|
||||||
// Both existence is not handled right now and should not happen or create a default fallback behavior
|
// Both existence is not handled right now and should not happen or create a default fallback behavior
|
||||||
// Still, this case won't happend when the write(s) functions will check for both symlink and real file
|
// Still, this case won't happen when the write(s) functions will check for both symlink and real file
|
||||||
// preexistance, avoiding a link being created if filename exists, or avoiding a file being created if
|
// preexistence, avoiding a link being created if filename exists, or avoiding a file being created if
|
||||||
// symlink exists with same name
|
// symlink exists with same name
|
||||||
int rdv40_spiffs_read_as_filetype(char *filename, uint8_t *dst, uint32_t size, RDV40SpiFFSSafetyLevel level) {
|
int rdv40_spiffs_read_as_filetype(char *filename, uint8_t *dst, uint32_t size, RDV40SpiFFSSafetyLevel level) {
|
||||||
RDV40_SPIFFS_SAFE_FUNCTION(
|
RDV40_SPIFFS_SAFE_FUNCTION(
|
||||||
|
@ -537,7 +537,7 @@ int rdv40_spiffs_read_as_filetype(char *filename, uint8_t *dst, uint32_t size, R
|
||||||
// TODO regarding reads/write and symlinks :
|
// TODO regarding reads/write and symlinks :
|
||||||
// Provide a higher level readFile function which
|
// Provide a higher level readFile function which
|
||||||
// - don't need a size to be provided, getting it from STAT call and using bigbuff malloc
|
// - don't need a size to be provided, getting it from STAT call and using bigbuff malloc
|
||||||
// - send back the whole readed file as return Result
|
// - send back the whole read file as return Result
|
||||||
// Maybe a good think to implement a VFS api here.
|
// Maybe a good think to implement a VFS api here.
|
||||||
|
|
||||||
////////////////////////////////////////////////////////////////////////////////
|
////////////////////////////////////////////////////////////////////////////////
|
||||||
|
@ -566,10 +566,10 @@ void rdv40_spiffs_safe_print_fsinfo(void) {
|
||||||
// this function is safe and WILL rollback since it is only a PRINTING function,
|
// this function is safe and WILL rollback since it is only a PRINTING function,
|
||||||
// not a function intended to give any sort of struct to manipulate the FS
|
// not a function intended to give any sort of struct to manipulate the FS
|
||||||
// objects
|
// objects
|
||||||
// TODO : Fake the Directory availability by spliting strings , buffering,
|
// TODO : Fake the Directory availability by splitting strings , buffering,
|
||||||
// maintaining prefix list sorting, unique_checking, THEN outputing precomputed
|
// maintaining prefix list sorting, unique_checking, THEN outputting precomputed
|
||||||
// tree Other solutio nwould be to add directory support to SPIFFS, but that we
|
// tree Other solution would be to add directory support to SPIFFS, but that we
|
||||||
// dont want, as prefix are way easier and lighter in every aspect.
|
// don't want, as prefix are way easier and lighter in every aspect.
|
||||||
void rdv40_spiffs_safe_print_tree(void) {
|
void rdv40_spiffs_safe_print_tree(void) {
|
||||||
int changed = rdv40_spiffs_lazy_mount();
|
int changed = rdv40_spiffs_lazy_mount();
|
||||||
spiffs_DIR d;
|
spiffs_DIR d;
|
||||||
|
@ -643,7 +643,7 @@ void test_spiffs(void) {
|
||||||
|
|
||||||
Dbprintf(" Writing 'I love Proxmark3 RDV4' in a testspiffs.txt");
|
Dbprintf(" Writing 'I love Proxmark3 RDV4' in a testspiffs.txt");
|
||||||
|
|
||||||
// Since We lazy_mounted manually before hand, the wrte safety level will
|
// Since We lazy_mounted manually before hand, the write safety level will
|
||||||
// just imply noops
|
// just imply noops
|
||||||
rdv40_spiffs_write((char *)"testspiffs.txt", (uint8_t *)"I love Proxmark3 RDV4", 21, RDV40_SPIFFS_SAFETY_SAFE);
|
rdv40_spiffs_write((char *)"testspiffs.txt", (uint8_t *)"I love Proxmark3 RDV4", 21, RDV40_SPIFFS_SAFETY_SAFE);
|
||||||
|
|
||||||
|
|
|
@ -742,7 +742,7 @@ s32_t SPIFFS_tell(spiffs *fs, spiffs_file fh);
|
||||||
* in this callback will mess things up for sure - do not do this.
|
* in this callback will mess things up for sure - do not do this.
|
||||||
* This can be used to track where files are and move around during garbage
|
* This can be used to track where files are and move around during garbage
|
||||||
* collection, which in turn can be used to build location tables in ram.
|
* collection, which in turn can be used to build location tables in ram.
|
||||||
* Used in conjuction with SPIFFS_open_by_page this may improve performance
|
* Used in conjunction with SPIFFS_open_by_page this may improve performance
|
||||||
* when opening a lot of files.
|
* when opening a lot of files.
|
||||||
* Must be invoked after mount.
|
* Must be invoked after mount.
|
||||||
*
|
*
|
||||||
|
|
|
@ -25,7 +25,7 @@ VERSIONSRC = version_pm3.c
|
||||||
# stdint.h provided locally until GCC 4.5 becomes C99 compliant
|
# stdint.h provided locally until GCC 4.5 becomes C99 compliant
|
||||||
APP_CFLAGS = -I. -ffunction-sections -fdata-sections
|
APP_CFLAGS = -I. -ffunction-sections -fdata-sections
|
||||||
|
|
||||||
# stack-protect , no-pie reduces size on Gentoo Hardened 8.2 gcc, no-common makes sure uninitalized vars doesn't end up in COMMON area
|
# stack-protect , no-pie reduces size on Gentoo Hardened 8.2 gcc, no-common makes sure uninitialized vars don't end up in COMMON area
|
||||||
APP_CFLAGS += -fno-stack-protector -fno-pie -fno-common
|
APP_CFLAGS += -fno-stack-protector -fno-pie -fno-common
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -4356,7 +4356,7 @@ int arg_parse(int argc, char * *argv, void * *argtable) {
|
||||||
/* parse the command line (local copy) for untagged options */
|
/* parse the command line (local copy) for untagged options */
|
||||||
arg_parse_untagged(argc, argvcopy, table, endtable);
|
arg_parse_untagged(argc, argvcopy, table, endtable);
|
||||||
|
|
||||||
/* if no errors so far then perform post-parse checks otherwise dont bother */
|
/* if no errors so far then perform post-parse checks otherwise don't bother */
|
||||||
if (endtable->count == 0)
|
if (endtable->count == 0)
|
||||||
arg_parse_check(table, endtable);
|
arg_parse_check(table, endtable);
|
||||||
|
|
||||||
|
|
|
@ -75,7 +75,7 @@ typedef void (arg_errorfn)(void *parent, FILE *fp, int error, const char *argval
|
||||||
* that particular arg_xxx arguments, performing post-parse checks, and
|
* that particular arg_xxx arguments, performing post-parse checks, and
|
||||||
* reporting errors.
|
* reporting errors.
|
||||||
* These functions are private to the individual arg_xxx source code
|
* These functions are private to the individual arg_xxx source code
|
||||||
* and are the pointer to them are initiliased by that arg_xxx struct's
|
* and are the pointer to them are initialised by that arg_xxx struct's
|
||||||
* constructor function. The user could alter them after construction
|
* constructor function. The user could alter them after construction
|
||||||
* if desired, but the original intention is for them to be set by the
|
* if desired, but the original intention is for them to be set by the
|
||||||
* constructor and left unaltered.
|
* constructor and left unaltered.
|
||||||
|
@ -83,11 +83,11 @@ typedef void (arg_errorfn)(void *parent, FILE *fp, int error, const char *argval
|
||||||
struct arg_hdr {
|
struct arg_hdr {
|
||||||
char flag; /* Modifier flags: ARG_TERMINATOR, ARG_HASVALUE. */
|
char flag; /* Modifier flags: ARG_TERMINATOR, ARG_HASVALUE. */
|
||||||
const char *shortopts; /* String defining the short options */
|
const char *shortopts; /* String defining the short options */
|
||||||
const char *longopts; /* String defiing the long options */
|
const char *longopts; /* String defining the long options */
|
||||||
const char *datatype; /* Description of the argument data type */
|
const char *datatype; /* Description of the argument data type */
|
||||||
const char *glossary; /* Description of the option as shown by arg_print_glossary function */
|
const char *glossary; /* Description of the option as shown by arg_print_glossary function */
|
||||||
int mincount; /* Minimum number of occurences of this option accepted */
|
int mincount; /* Minimum number of occurrences of this option accepted */
|
||||||
int maxcount; /* Maximum number of occurences if this option accepted */
|
int maxcount; /* Maximum number of occurrences if this option accepted */
|
||||||
void *parent; /* Pointer to parent arg_xxx struct */
|
void *parent; /* Pointer to parent arg_xxx struct */
|
||||||
arg_resetfn *resetfn; /* Pointer to parent arg_xxx reset function */
|
arg_resetfn *resetfn; /* Pointer to parent arg_xxx reset function */
|
||||||
arg_scanfn *scanfn; /* Pointer to parent arg_xxx scan function */
|
arg_scanfn *scanfn; /* Pointer to parent arg_xxx scan function */
|
||||||
|
|
|
@ -1143,7 +1143,7 @@ fc9839273862
|
||||||
4a306e62e9b6
|
4a306e62e9b6
|
||||||
B9C874AE63D0
|
B9C874AE63D0
|
||||||
#
|
#
|
||||||
# Data from offical repo
|
# Data from official repo
|
||||||
f00dfeedd0d0
|
f00dfeedd0d0
|
||||||
0bb31dc123e5
|
0bb31dc123e5
|
||||||
7578bf2c66a9
|
7578bf2c66a9
|
||||||
|
|
|
@ -322,21 +322,21 @@ encode2 = function (value, indent, level, buffer, buflen, tables, globalorder, s
|
||||||
if v then
|
if v then
|
||||||
used[k] = true
|
used[k] = true
|
||||||
buflen, msg = addpair (k, v, prev, indent, level, buffer, buflen, tables, globalorder, state)
|
buflen, msg = addpair (k, v, prev, indent, level, buffer, buflen, tables, globalorder, state)
|
||||||
prev = true -- add a seperator before the next element
|
prev = true -- add a separator before the next element
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
for k,v in pairs (value) do
|
for k,v in pairs (value) do
|
||||||
if not used[k] then
|
if not used[k] then
|
||||||
buflen, msg = addpair (k, v, prev, indent, level, buffer, buflen, tables, globalorder, state)
|
buflen, msg = addpair (k, v, prev, indent, level, buffer, buflen, tables, globalorder, state)
|
||||||
if not buflen then return nil, msg end
|
if not buflen then return nil, msg end
|
||||||
prev = true -- add a seperator before the next element
|
prev = true -- add a separator before the next element
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
else -- unordered
|
else -- unordered
|
||||||
for k,v in pairs (value) do
|
for k,v in pairs (value) do
|
||||||
buflen, msg = addpair (k, v, prev, indent, level, buffer, buflen, tables, globalorder, state)
|
buflen, msg = addpair (k, v, prev, indent, level, buffer, buflen, tables, globalorder, state)
|
||||||
if not buflen then return nil, msg end
|
if not buflen then return nil, msg end
|
||||||
prev = true -- add a seperator before the next element
|
prev = true -- add a separator before the next element
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
if indent then
|
if indent then
|
||||||
|
|
|
@ -203,7 +203,7 @@ local Utils =
|
||||||
|
|
||||||
|
|
||||||
-- input parameter is a string
|
-- input parameter is a string
|
||||||
-- Swaps the endianess and returns a number,
|
-- Swaps the endianness and returns a number,
|
||||||
-- IE: 'cd7a' -> '7acd' -> 0x7acd
|
-- IE: 'cd7a' -> '7acd' -> 0x7acd
|
||||||
SwapEndianness = function(s, len)
|
SwapEndianness = function(s, len)
|
||||||
if s == nil then return nil end
|
if s == nil then return nil end
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
#!/usr/bin/env -S pm3 -l
|
#!/usr/bin/env -S pm3 -l
|
||||||
|
|
||||||
--[[
|
--[[
|
||||||
A sampe script file on how to implement at cmd line inteface.
|
A sampe script file on how to implement at cmd line interface.
|
||||||
It also demonstrates how the script can be used with a shebang.
|
It also demonstrates how the script can be used with a shebang.
|
||||||
--]]
|
--]]
|
||||||
|
|
||||||
|
|
|
@ -29,7 +29,7 @@ arguments = [[
|
||||||
-o do not connect - use this only if you previously used -k to stay connected
|
-o do not connect - use this only if you previously used -k to stay connected
|
||||||
-r do not read response
|
-r do not read response
|
||||||
-c calculate and append CRC
|
-c calculate and append CRC
|
||||||
-k stay connected - dont inactivate the field
|
-k stay connected - don't inactivate the field
|
||||||
-x <payload> Data to send (NO SPACES!)
|
-x <payload> Data to send (NO SPACES!)
|
||||||
-d Debug flag
|
-d Debug flag
|
||||||
-t Topaz mode
|
-t Topaz mode
|
||||||
|
|
|
@ -83,7 +83,7 @@ local function tablelen(T)
|
||||||
end
|
end
|
||||||
---
|
---
|
||||||
-- helper function, gives a sorted table from table t,
|
-- helper function, gives a sorted table from table t,
|
||||||
-- order can be a seperate sorting-order function.
|
-- order can be a separate sorting-order function.
|
||||||
local function spairs(t, order)
|
local function spairs(t, order)
|
||||||
-- collect the keys
|
-- collect the keys
|
||||||
local keys = {}
|
local keys = {}
|
||||||
|
|
|
@ -84,7 +84,7 @@ local function tablelen(T)
|
||||||
end
|
end
|
||||||
---
|
---
|
||||||
-- helper function, gives a sorted table from table t,
|
-- helper function, gives a sorted table from table t,
|
||||||
-- order can be a seperate sorting-order function.
|
-- order can be a separate sorting-order function.
|
||||||
local function spairs(t, order)
|
local function spairs(t, order)
|
||||||
-- collect the keys
|
-- collect the keys
|
||||||
local keys = {}
|
local keys = {}
|
||||||
|
|
|
@ -25,7 +25,7 @@ script run hf_15_magic -h -u <uid>
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h : this help
|
-h : this help
|
||||||
-u <UID> : UID (16 hexsymbols)
|
-u <UID> : UID (16 hexsymbols)
|
||||||
-a : use offical pm3 repo ISO15 commands instead of iceman fork.
|
-a : use official pm3 repo ISO15 commands instead of iceman fork.
|
||||||
]]
|
]]
|
||||||
|
|
||||||
local DEBUG = true
|
local DEBUG = true
|
||||||
|
@ -74,9 +74,9 @@ local function magicUID_iceman(b0, b1)
|
||||||
core.console('hf 15 raw -2 -c -d 022139'..b0)
|
core.console('hf 15 raw -2 -c -d 022139'..b0)
|
||||||
end
|
end
|
||||||
--
|
--
|
||||||
--- Set UID on magic command enabled, OFFICAL REPO
|
--- Set UID on magic command enabled, OFFICIAL REPO
|
||||||
local function magicUID_offical(b0, b1)
|
local function magicUID_official(b0, b1)
|
||||||
print('Using backdoor Magic tag function OFFICAL REPO')
|
print('Using backdoor Magic tag function OFFICIAL REPO')
|
||||||
core.console('hf 15 cmd raw -c 02213E00000000')
|
core.console('hf 15 cmd raw -c 02213E00000000')
|
||||||
core.console('hf 15 cmd raw -c 02213F69960000')
|
core.console('hf 15 cmd raw -c 02213F69960000')
|
||||||
core.console('hf 15 cmd raw -c 022138'..b1)
|
core.console('hf 15 cmd raw -c 022138'..b1)
|
||||||
|
@ -117,7 +117,7 @@ function main(args)
|
||||||
if use_iceman then
|
if use_iceman then
|
||||||
magicUID_iceman(block0, block1)
|
magicUID_iceman(block0, block1)
|
||||||
else
|
else
|
||||||
magicUID_offical(block0, block1)
|
magicUID_official(block0, block1)
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
|
@ -136,10 +136,10 @@ it's kinda interactive with following commands in three categories:
|
||||||
|
|
||||||
lf: 'load file' - load a (xored) binary file (*.bin) from the local Filesystem into the 'virtual inTag'
|
lf: 'load file' - load a (xored) binary file (*.bin) from the local Filesystem into the 'virtual inTag'
|
||||||
sf: 'save file' - saves the 'virtual inTag' to the local Filesystem as eml and bin (xored with Tag-MCC)
|
sf: 'save file' - saves the 'virtual inTag' to the local Filesystem as eml and bin (xored with Tag-MCC)
|
||||||
xf: 'xor file' - saves the 'virtual inTag' to the local Filesystem (xored with choosen MCC - use '00' for plain values)
|
xf: 'xor file' - saves the 'virtual inTag' to the local Filesystem (xored with chosen MCC - use '00' for plain values)
|
||||||
|
|
||||||
ct: 'copy tag' - copy the 'virtual Tag' to a second 'virtual TAG' - not usefull yet, but inernally needed
|
ct: 'copy tag' - copy the 'virtual Tag' to a second 'virtual TAG' - not useful yet, but inernally needed
|
||||||
tc: 'copy tag' - copy the 'second virtual Tag' to 'virtual TAG' - not usefull yet, but inernally needed
|
tc: 'copy tag' - copy the 'second virtual Tag' to 'virtual TAG' - not useful yet, but inernally needed
|
||||||
tt: 'toggle tag' - copy mainTag to BackupTag and backupTag to mainTag
|
tt: 'toggle tag' - copy mainTag to BackupTag and backupTag to mainTag
|
||||||
|
|
||||||
di: 'dump mainTag' - shows the current content of the 'virtual Tag'
|
di: 'dump mainTag' - shows the current content of the 'virtual Tag'
|
||||||
|
@ -155,7 +155,7 @@ it's kinda interactive with following commands in three categories:
|
||||||
cc: 'check Segment-CRC'- checks & calculates (if check failed) the Segment-CRC of all Segments
|
cc: 'check Segment-CRC'- checks & calculates (if check failed) the Segment-CRC of all Segments
|
||||||
ck: 'check KGH-CRC' - checks the and calculates a 'Kaba Group Header' if one was detected
|
ck: 'check KGH-CRC' - checks the and calculates a 'Kaba Group Header' if one was detected
|
||||||
'Kaba Group Header CRC calculation'
|
'Kaba Group Header CRC calculation'
|
||||||
tk: 'toggle KGH' - toglle the (script-internal) flag for kgh-calculation for a segment
|
tk: 'toggle KGH' - toggle the (script-internal) flag for kgh-calculation for a segment
|
||||||
xc: 'etra c' - show string that was used to calculate the kgh-crc of a segment
|
xc: 'etra c' - show string that was used to calculate the kgh-crc of a segment
|
||||||
|
|
||||||
dlc: 'dump Legic-Cash' - show balance and checksums of a Legic-Cash Segment
|
dlc: 'dump Legic-Cash' - show balance and checksums of a Legic-Cash Segment
|
||||||
|
@ -359,7 +359,7 @@ function getInputBytes(infile)
|
||||||
local line
|
local line
|
||||||
local bytes = {}
|
local bytes = {}
|
||||||
local fhi,err = io.open(infile,"rb")
|
local fhi,err = io.open(infile,"rb")
|
||||||
if err then oops("faild to read from file ".. infile); return false; end
|
if err then oops("failed to read from file ".. infile); return false; end
|
||||||
|
|
||||||
file_data = fhi:read("*a");
|
file_data = fhi:read("*a");
|
||||||
for i = 1, #file_data do
|
for i = 1, #file_data do
|
||||||
|
@ -767,7 +767,7 @@ local function saveTagMap(map, filename)
|
||||||
|
|
||||||
local line
|
local line
|
||||||
local fho,err = io.open(filename, "w")
|
local fho,err = io.open(filename, "w")
|
||||||
if err then oops("OOps ... faild to open output-file "..acyellow..filename..acoff) end
|
if err then oops("OOps ... failed to open output-file "..acyellow..filename..acoff) end
|
||||||
|
|
||||||
-- write line to new file
|
-- write line to new file
|
||||||
for k, v in pairs(map) do
|
for k, v in pairs(map) do
|
||||||
|
@ -1871,7 +1871,7 @@ function getSegmentStamp(seg, bytes)
|
||||||
-- with stamps smaller 3 bytes (except: Master-Token)
|
-- with stamps smaller 3 bytes (except: Master-Token)
|
||||||
-- WRP -> Read/Write Protection
|
-- WRP -> Read/Write Protection
|
||||||
-- WRC -> Read/Write Condition
|
-- WRC -> Read/Write Condition
|
||||||
-- RD depends on WRC - if WRC > 0 and RD=1: only reader with matching #WRC of Stamp-bytes in thier Database have Read-Access to the Tag
|
-- RD depends on WRC - if WRC > 0 and RD=1: only reader with matching #WRC of Stamp-bytes in their Database have Read-Access to the Tag
|
||||||
if (seg.WRP<7) then stamp_len=(seg.WRP) end
|
if (seg.WRP<7) then stamp_len=(seg.WRP) end
|
||||||
for i=1, (stamp_len) do
|
for i=1, (stamp_len) do
|
||||||
stamp=stamp..seg.data[i-1]
|
stamp=stamp..seg.data[i-1]
|
||||||
|
@ -2780,7 +2780,7 @@ function main(args)
|
||||||
|
|
||||||
bytes=tagToBytes(inTAG)
|
bytes=tagToBytes(inTAG)
|
||||||
if (cfs) then
|
if (cfs) then
|
||||||
-- xor willl be done in function writeFile
|
-- xor will be done in function writeFile
|
||||||
-- with the value of byte[5]
|
-- with the value of byte[5]
|
||||||
bytes[5]=crc
|
bytes[5]=crc
|
||||||
end
|
end
|
||||||
|
|
|
@ -224,7 +224,7 @@ end
|
||||||
-- write to file
|
-- write to file
|
||||||
local function writeOutputBytes(bytes, outfile)
|
local function writeOutputBytes(bytes, outfile)
|
||||||
local fho,err = io.open(outfile, "wb")
|
local fho,err = io.open(outfile, "wb")
|
||||||
if err then print("OOps ... faild to open output-file ".. outfile); return false; end
|
if err then print("OOps ... failed to open output-file ".. outfile); return false; end
|
||||||
|
|
||||||
for i = 1, #bytes do
|
for i = 1, #bytes do
|
||||||
fho:write(string.char(tonumber(bytes[i], 16)))
|
fho:write(string.char(tonumber(bytes[i], 16)))
|
||||||
|
|
|
@ -434,7 +434,7 @@ local function main(args)
|
||||||
|
|
||||||
local fairy = blocks[9]:sub(1,8)
|
local fairy = blocks[9]:sub(1,8)
|
||||||
--FD0F = Left, FF0F = Right
|
--FD0F = Left, FF0F = Right
|
||||||
local path = 'not choosen'
|
local path = 'not chosen'
|
||||||
if fairy:sub(2,2) == 'D' then
|
if fairy:sub(2,2) == 'D' then
|
||||||
path = 'Left'
|
path = 'Left'
|
||||||
elseif fairy:sub(2,2) == 'F' then
|
elseif fairy:sub(2,2) == 'F' then
|
||||||
|
|
|
@ -367,7 +367,7 @@ local function write_version(data)
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
---
|
---
|
||||||
-- writen TYPE which card is based on.
|
-- write TYPE which card is based on.
|
||||||
-- 00 = 213, 01 = 215, 02 = 216
|
-- 00 = 213, 01 = 215, 02 = 216
|
||||||
local function write_type(data)
|
local function write_type(data)
|
||||||
-- type string checks
|
-- type string checks
|
||||||
|
@ -390,7 +390,7 @@ end
|
||||||
---
|
---
|
||||||
-- Set tag type. Predefinde version data together with magic type set.
|
-- Set tag type. Predefinde version data together with magic type set.
|
||||||
-- Since cmd always gives 10 bytes len (data+crc) we can impersonate the following types
|
-- Since cmd always gives 10 bytes len (data+crc) we can impersonate the following types
|
||||||
-- we only truely be three types NTAG 213,215 and 216
|
-- we only truly be three types NTAG 213,215 and 216
|
||||||
local function set_type(tagtype)
|
local function set_type(tagtype)
|
||||||
|
|
||||||
-- tagtype checks
|
-- tagtype checks
|
||||||
|
|
|
@ -15,7 +15,7 @@ It also write the dump to an eml-file <uid>.eml.
|
||||||
|
|
||||||
(The difference between an .eml-file and a .bin-file is that the eml file contains
|
(The difference between an .eml-file and a .bin-file is that the eml file contains
|
||||||
ASCII representation of the hex-data, with linebreaks between 'rows'. A .bin-file contains the
|
ASCII representation of the hex-data, with linebreaks between 'rows'. A .bin-file contains the
|
||||||
raw data, but when saving into that for, we lose the infromation about how the memory is structured.
|
raw data, but when saving into that for, we lose the information about how the memory is structured.
|
||||||
For example: 24 bytes could be 6 blocks of 4 bytes, or vice versa.
|
For example: 24 bytes could be 6 blocks of 4 bytes, or vice versa.
|
||||||
Therefore, the .eml is better to use file when saving dumps.)
|
Therefore, the .eml is better to use file when saving dumps.)
|
||||||
|
|
||||||
|
|
|
@ -83,7 +83,7 @@ local function main(args)
|
||||||
2. lf em 4x05_write
|
2. lf em 4x05_write
|
||||||
3. lf em 4x05_read
|
3. lf em 4x05_read
|
||||||
|
|
||||||
The first two commands dont need a feedback from the system, so going with core.console commands.
|
The first two commands don't need a feedback from the system, so going with core.console commands.
|
||||||
Since the read needs demodulation of signal I opted to add that function from cmdlfem4x.c to the core lua scripting
|
Since the read needs demodulation of signal I opted to add that function from cmdlfem4x.c to the core lua scripting
|
||||||
core.em4x05_read(addr, password)
|
core.em4x05_read(addr, password)
|
||||||
|
|
||||||
|
|
|
@ -26,7 +26,7 @@ It uses both LF and HF simulations.
|
||||||
-- Author note
|
-- Author note
|
||||||
-- I wrote this as i was doing a PACS audit. This is far from complete, but is easily expandable.
|
-- I wrote this as i was doing a PACS audit. This is far from complete, but is easily expandable.
|
||||||
-- The idea was based on proxbrute, but i needed more options, and support for different readers.
|
-- The idea was based on proxbrute, but i needed more options, and support for different readers.
|
||||||
-- I dont know LUA, so I used Brian Redbeards lf_hid_bulkclone.lua script as a starting point, sorry if its kludgy.
|
-- I don't know LUA, so I used Brian Redbeards lf_hid_bulkclone.lua script as a starting point, sorry if its kludgy.
|
||||||
|
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
|
|
|
@ -376,20 +376,20 @@ static int CmdFlashMemWipe(const char *Cmd) {
|
||||||
"Wipe flash memory on device, which fills it with 0xFF\n"
|
"Wipe flash memory on device, which fills it with 0xFF\n"
|
||||||
_WHITE_("[ ") _RED_("!!! OBS") _WHITE_(" ] use with caution"),
|
_WHITE_("[ ") _RED_("!!! OBS") _WHITE_(" ] use with caution"),
|
||||||
"mem wipe -p 0 -> wipes first page"
|
"mem wipe -p 0 -> wipes first page"
|
||||||
// "mem wipe -i -> inital total wipe"
|
// "mem wipe -i -> initial total wipe"
|
||||||
);
|
);
|
||||||
|
|
||||||
void *argtable[] = {
|
void *argtable[] = {
|
||||||
arg_param_begin,
|
arg_param_begin,
|
||||||
arg_int0("p", NULL, "<dec>", "0,1,2 page memory"),
|
arg_int0("p", NULL, "<dec>", "0,1,2 page memory"),
|
||||||
// arg_lit0("i", NULL, "inital total wipe"),
|
// arg_lit0("i", NULL, "initial total wipe"),
|
||||||
arg_param_end
|
arg_param_end
|
||||||
};
|
};
|
||||||
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
||||||
|
|
||||||
bool initalwipe = false;
|
bool initialwipe = false;
|
||||||
int page = arg_get_int_def(ctx, 1, -1);
|
int page = arg_get_int_def(ctx, 1, -1);
|
||||||
// initalwipe = arg_get_lit(ctx, 2);
|
// initialwipe = arg_get_lit(ctx, 2);
|
||||||
CLIParserFree(ctx);
|
CLIParserFree(ctx);
|
||||||
|
|
||||||
if (page < 0 || page > 2) {
|
if (page < 0 || page > 2) {
|
||||||
|
@ -398,7 +398,7 @@ static int CmdFlashMemWipe(const char *Cmd) {
|
||||||
}
|
}
|
||||||
|
|
||||||
clearCommandBuffer();
|
clearCommandBuffer();
|
||||||
SendCommandMIX(CMD_FLASHMEM_WIPE, page, initalwipe, 0, NULL, 0);
|
SendCommandMIX(CMD_FLASHMEM_WIPE, page, initialwipe, 0, NULL, 0);
|
||||||
PacketResponseNG resp;
|
PacketResponseNG resp;
|
||||||
if (!WaitForResponseTimeout(CMD_ACK, &resp, 8000)) {
|
if (!WaitForResponseTimeout(CMD_ACK, &resp, 8000)) {
|
||||||
PrintAndLogEx(WARNING, "timeout while waiting for reply.");
|
PrintAndLogEx(WARNING, "timeout while waiting for reply.");
|
||||||
|
|
|
@ -2202,7 +2202,7 @@ static uint16_t get_sw(uint8_t *d, uint8_t n) {
|
||||||
return d[n] * 0x0100 + d[n + 1];
|
return d[n] * 0x0100 + d[n + 1];
|
||||||
}
|
}
|
||||||
|
|
||||||
static uint64_t inc_sw_error_occurence(uint16_t sw, uint64_t all_sw[256][256]) {
|
static uint64_t inc_sw_error_occurrence(uint16_t sw, uint64_t all_sw[256][256]) {
|
||||||
uint8_t sw1 = (uint8_t)(sw >> 8);
|
uint8_t sw1 = (uint8_t)(sw >> 8);
|
||||||
uint8_t sw2 = (uint8_t)(0xff & sw);
|
uint8_t sw2 = (uint8_t)(0xff & sw);
|
||||||
if (sw1 == 0x90 && sw2 == 0x00) {
|
if (sw1 == 0x90 && sw2 == 0x00) {
|
||||||
|
@ -2291,7 +2291,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
|
||||||
bool inc_p1 = true;
|
bool inc_p1 = true;
|
||||||
bool skip_ins = false;
|
bool skip_ins = false;
|
||||||
uint64_t all_sw[256][256] = { { 0 } };
|
uint64_t all_sw[256][256] = { { 0 } };
|
||||||
uint64_t sw_occurences = 0;
|
uint64_t sw_occurrences = 0;
|
||||||
uint64_t t_start = msclock();
|
uint64_t t_start = msclock();
|
||||||
uint64_t t_last_reset = msclock();
|
uint64_t t_last_reset = msclock();
|
||||||
|
|
||||||
|
@ -2334,10 +2334,10 @@ retry_ins:
|
||||||
goto retry_ins;
|
goto retry_ins;
|
||||||
}
|
}
|
||||||
uint16_t sw = get_sw(response, response_n);
|
uint16_t sw = get_sw(response, response_n);
|
||||||
sw_occurences = inc_sw_error_occurence(sw, all_sw);
|
sw_occurrences = inc_sw_error_occurrence(sw, all_sw);
|
||||||
|
|
||||||
// Show response.
|
// Show response.
|
||||||
if (sw_occurences < error_limit) {
|
if (sw_occurrences < error_limit) {
|
||||||
logLevel_t log_level = INFO;
|
logLevel_t log_level = INFO;
|
||||||
if (sw == 0x9000) {
|
if (sw == 0x9000) {
|
||||||
log_level = SUCCESS;
|
log_level = SUCCESS;
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
|
// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
|
||||||
// Modified 2010-2012 by <adrian -at- atrox.at>
|
// Modified 2010-2012 by <adrian -at- atrox.at>
|
||||||
// Modified 2012 by <vsza at vsza.hu>
|
// Modified 2012 by <vsza at vsza.hu>
|
||||||
// Modfified 2018 by <iceman>
|
// Modified 2018 by <iceman>
|
||||||
//
|
//
|
||||||
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||||
|
|
|
@ -121,7 +121,7 @@ static bool get_14b_UID(iso14b_card_select_t *card) {
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
// Print extented information about tag.
|
// Print extended information about tag.
|
||||||
static int infoHFCryptoRF(bool verbose) {
|
static int infoHFCryptoRF(bool verbose) {
|
||||||
iso14b_raw_cmd_t packet = {
|
iso14b_raw_cmd_t packet = {
|
||||||
.flags = (ISO14B_CONNECT | ISO14B_SELECT_STD | ISO14B_DISCONNECT),
|
.flags = (ISO14B_CONNECT | ISO14B_SELECT_STD | ISO14B_DISCONNECT),
|
||||||
|
|
|
@ -168,7 +168,7 @@ static int CmdHFFidoRegister(const char *cmd) {
|
||||||
char filename[FILE_PATH_SIZE] = {0};
|
char filename[FILE_PATH_SIZE] = {0};
|
||||||
CLIParamStrToBuf(arg_get_str(ctx, 4), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
CLIParamStrToBuf(arg_get_str(ctx, 4), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
||||||
|
|
||||||
// deafault name
|
// default name
|
||||||
if (fnlen == 0) {
|
if (fnlen == 0) {
|
||||||
strcat(filename, DEF_FIDO_PARAM_FILE);
|
strcat(filename, DEF_FIDO_PARAM_FILE);
|
||||||
fnlen = strlen(filename);
|
fnlen = strlen(filename);
|
||||||
|
@ -438,7 +438,7 @@ static int CmdHFFidoAuthenticate(const char *cmd) {
|
||||||
char filename[FILE_PATH_SIZE] = {0};
|
char filename[FILE_PATH_SIZE] = {0};
|
||||||
CLIParamStrToBuf(arg_get_str(ctx, 6), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
CLIParamStrToBuf(arg_get_str(ctx, 6), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
||||||
|
|
||||||
// deafault name
|
// default name
|
||||||
if (fnlen == 0) {
|
if (fnlen == 0) {
|
||||||
strcat(filename, DEF_FIDO_PARAM_FILE);
|
strcat(filename, DEF_FIDO_PARAM_FILE);
|
||||||
fnlen = strlen(filename);
|
fnlen = strlen(filename);
|
||||||
|
@ -683,7 +683,7 @@ static int CmdHFFido2MakeCredential(const char *cmd) {
|
||||||
CLIParamStrToBuf(arg_get_str(ctx, 5), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
CLIParamStrToBuf(arg_get_str(ctx, 5), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
||||||
CLIParserFree(ctx);
|
CLIParserFree(ctx);
|
||||||
|
|
||||||
// deafault name
|
// default name
|
||||||
if (fnlen == 0) {
|
if (fnlen == 0) {
|
||||||
strcat(filename, DEF_FIDO_PARAM_FILE);
|
strcat(filename, DEF_FIDO_PARAM_FILE);
|
||||||
fnlen = strlen(filename);
|
fnlen = strlen(filename);
|
||||||
|
@ -802,7 +802,7 @@ static int CmdHFFido2GetAssertion(const char *cmd) {
|
||||||
CLIParamStrToBuf(arg_get_str(ctx, 5), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
CLIParamStrToBuf(arg_get_str(ctx, 5), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
||||||
CLIParserFree(ctx);
|
CLIParserFree(ctx);
|
||||||
|
|
||||||
// deafault name
|
// default name
|
||||||
if (fnlen == 0) {
|
if (fnlen == 0) {
|
||||||
strcat(filename, DEF_FIDO_PARAM_FILE);
|
strcat(filename, DEF_FIDO_PARAM_FILE);
|
||||||
fnlen = strlen(filename);
|
fnlen = strlen(filename);
|
||||||
|
|
|
@ -180,7 +180,7 @@ static int CmdLegicInfo(const char *Cmd) {
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
||||||
// Makes no sence to show this on blank media...
|
// Makes no sense to show this on blank media...
|
||||||
if (dcf != 0xFFFF) {
|
if (dcf != 0xFFFF) {
|
||||||
|
|
||||||
if (bIsSegmented) {
|
if (bIsSegmented) {
|
||||||
|
|
|
@ -2689,7 +2689,7 @@ static int CmdHF14ADesFormatPICC(const char *Cmd) {
|
||||||
static int CmdHF14ADesGetFreeMem(const char *Cmd) {
|
static int CmdHF14ADesGetFreeMem(const char *Cmd) {
|
||||||
CLIParserContext *ctx;
|
CLIParserContext *ctx;
|
||||||
CLIParserInit(&ctx, "hf mfdes getfreemem",
|
CLIParserInit(&ctx, "hf mfdes getfreemem",
|
||||||
"Get card's free memory. Can be done with ot without authentication. Master key may be provided.",
|
"Get card's free memory. Can be done with or without authentication. Master key may be provided.",
|
||||||
"hf mfdes getfreemem -> execute with default factory setup");
|
"hf mfdes getfreemem -> execute with default factory setup");
|
||||||
|
|
||||||
void *argtable[] = {
|
void *argtable[] = {
|
||||||
|
|
|
@ -3208,7 +3208,7 @@ static int CmdHF14AMfuOtpTearoff(const char *Cmd) {
|
||||||
PrintAndLogEx(INFO, "Starting Tear-off test");
|
PrintAndLogEx(INFO, "Starting Tear-off test");
|
||||||
PrintAndLogEx(INFO, "Target block no: %u", blockno);
|
PrintAndLogEx(INFO, "Target block no: %u", blockno);
|
||||||
if (use_data) {
|
if (use_data) {
|
||||||
PrintAndLogEx(INFO, "Target inital block data : %s", sprint_hex_inrow(data, 4));
|
PrintAndLogEx(INFO, "Target initial block data : %s", sprint_hex_inrow(data, 4));
|
||||||
}
|
}
|
||||||
PrintAndLogEx(INFO, "Target write block data : %s", sprint_hex_inrow(teardata, 4));
|
PrintAndLogEx(INFO, "Target write block data : %s", sprint_hex_inrow(teardata, 4));
|
||||||
if (use_match) {
|
if (use_match) {
|
||||||
|
@ -3498,28 +3498,28 @@ static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) {
|
||||||
return PM3_ESOFT;
|
return PM3_ESOFT;
|
||||||
}
|
}
|
||||||
|
|
||||||
uint8_t inital_cnt[3] = {0, 0, 0};
|
uint8_t initial_cnt[3] = {0, 0, 0};
|
||||||
int len = ulev1_readCounter(cnt_no, inital_cnt, sizeof(inital_cnt));
|
int len = ulev1_readCounter(cnt_no, initial_cnt, sizeof(initial_cnt));
|
||||||
if ( len != sizeof(inital_cnt) ) {
|
if ( len != sizeof(initial_cnt) ) {
|
||||||
PrintAndLogEx(WARNING, "failed to read counter");
|
PrintAndLogEx(WARNING, "failed to read counter");
|
||||||
return PM3_ESOFT;
|
return PM3_ESOFT;
|
||||||
}
|
}
|
||||||
|
|
||||||
uint8_t inital_tear[1] = {0};
|
uint8_t initial_tear[1] = {0};
|
||||||
len = ulev1_readTearing(cnt_no, inital_tear, sizeof(inital_tear));
|
len = ulev1_readTearing(cnt_no, initial_tear, sizeof(initial_tear));
|
||||||
DropField();
|
DropField();
|
||||||
if ( len != sizeof(inital_tear) ) {
|
if ( len != sizeof(initial_tear) ) {
|
||||||
PrintAndLogEx(WARNING, "failed to read ANTITEAR, exiting... %d", len);
|
PrintAndLogEx(WARNING, "failed to read ANTITEAR, exiting... %d", len);
|
||||||
return PM3_ESOFT;
|
return PM3_ESOFT;
|
||||||
}
|
}
|
||||||
|
|
||||||
uint32_t wr_value = ( newvalue[0] | newvalue[1] << 8 | newvalue[2] << 16 );
|
uint32_t wr_value = ( newvalue[0] | newvalue[1] << 8 | newvalue[2] << 16 );
|
||||||
uint32_t inital_value = ( inital_cnt[0] | inital_cnt[1] << 8 | inital_cnt[2] << 16 );;
|
uint32_t initial_value = ( initial_cnt[0] | initial_cnt[1] << 8 | initial_cnt[2] << 16 );;
|
||||||
|
|
||||||
PrintAndLogEx(INFO, "----------------- " _CYAN_("MFU Ev1 Counter Tear off") " ---------------------");
|
PrintAndLogEx(INFO, "----------------- " _CYAN_("MFU Ev1 Counter Tear off") " ---------------------");
|
||||||
PrintAndLogEx(INFO, "Target counter no [ " _GREEN_("%u") " ]", counter);
|
PrintAndLogEx(INFO, "Target counter no [ " _GREEN_("%u") " ]", counter);
|
||||||
PrintAndLogEx(INFO, " counter value [ " _GREEN_("%s") " ]", sprint_hex_inrow(inital_cnt, sizeof(inital_cnt)));
|
PrintAndLogEx(INFO, " counter value [ " _GREEN_("%s") " ]", sprint_hex_inrow(initial_cnt, sizeof(initial_cnt)));
|
||||||
PrintAndLogEx(INFO, " anti-tear value [ " _GREEN_("%02X") " ]", inital_tear[0]);
|
PrintAndLogEx(INFO, " anti-tear value [ " _GREEN_("%02X") " ]", initial_tear[0]);
|
||||||
PrintAndLogEx(INFO, " increase value [ " _GREEN_("%s") " ]", sprint_hex_inrow(newvalue, newvaluelen));
|
PrintAndLogEx(INFO, " increase value [ " _GREEN_("%s") " ]", sprint_hex_inrow(newvalue, newvaluelen));
|
||||||
PrintAndLogEx(INFO, "----------------------------------------------------");
|
PrintAndLogEx(INFO, "----------------------------------------------------");
|
||||||
|
|
||||||
|
@ -3630,20 +3630,20 @@ static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) {
|
||||||
|
|
||||||
PrintAndLogEx(NORMAL, "");
|
PrintAndLogEx(NORMAL, "");
|
||||||
|
|
||||||
if (inital_value != a ) {
|
if (initial_value != a ) {
|
||||||
|
|
||||||
if ( inital_value != b )
|
if ( initial_value != b )
|
||||||
PrintAndLogEx(INFO, "pre %08x, post %08x != inital %08x | tear: 0x%02X == 0x%02X", a, b, inital_value, pre_tear, post_tear);
|
PrintAndLogEx(INFO, "pre %08x, post %08x != initial %08x | tear: 0x%02X == 0x%02X", a, b, initial_value, pre_tear, post_tear);
|
||||||
else
|
else
|
||||||
PrintAndLogEx(INFO, "pre %08x != inital and post %08x == inital %08x | tear: 0x%02X == 0x%02X", a, b, inital_value, pre_tear, post_tear);
|
PrintAndLogEx(INFO, "pre %08x != initial and post %08x == initial %08x | tear: 0x%02X == 0x%02X", a, b, initial_value, pre_tear, post_tear);
|
||||||
} else {
|
} else {
|
||||||
|
|
||||||
if ( inital_value != b )
|
if ( initial_value != b )
|
||||||
PrintAndLogEx(INFO, "pre %08x == inital and post %08x != inital %08x | tear: 0x%02X == 0x%02X", a, b, inital_value, pre_tear, post_tear);
|
PrintAndLogEx(INFO, "pre %08x == initial and post %08x != initial %08x | tear: 0x%02X == 0x%02X", a, b, initial_value, pre_tear, post_tear);
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( b == 0 ) {
|
if ( b == 0 ) {
|
||||||
PrintAndLogEx(INFO, _CYAN_("Tear off occured (ZEROS value!) -> ") "%s vs " _GREEN_("%s") " Tear status: 0x%02X == 0x%02X ( %s )"
|
PrintAndLogEx(INFO, _CYAN_("Tear off occurred (ZEROS value!) -> ") "%s vs " _GREEN_("%s") " Tear status: 0x%02X == 0x%02X ( %s )"
|
||||||
, prestr
|
, prestr
|
||||||
, poststr
|
, poststr
|
||||||
, pre_tear
|
, pre_tear
|
||||||
|
@ -3654,7 +3654,7 @@ static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) {
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( a > b ) {
|
if ( a > b ) {
|
||||||
PrintAndLogEx(INFO, _CYAN_("Tear off occured " _RED_("( LESS )") " -> ") "%s vs " _GREEN_("%s") " Tear status: 0x%02X == 0x%02X ( %s )"
|
PrintAndLogEx(INFO, _CYAN_("Tear off occurred " _RED_("( LESS )") " -> ") "%s vs " _GREEN_("%s") " Tear status: 0x%02X == 0x%02X ( %s )"
|
||||||
, prestr
|
, prestr
|
||||||
, poststr
|
, poststr
|
||||||
, pre_tear
|
, pre_tear
|
||||||
|
@ -3688,7 +3688,7 @@ static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) {
|
||||||
} else {
|
} else {
|
||||||
|
|
||||||
PrintAndLogEx(NORMAL, "");
|
PrintAndLogEx(NORMAL, "");
|
||||||
PrintAndLogEx(INFO, _CYAN_("Tear off occured (+1) (too late) -> ") "%s vs %s Tear: 0x%02X == 0x%02X ( %s )"
|
PrintAndLogEx(INFO, _CYAN_("Tear off occurred (+1) (too late) -> ") "%s vs %s Tear: 0x%02X == 0x%02X ( %s )"
|
||||||
, prestr
|
, prestr
|
||||||
, poststr
|
, poststr
|
||||||
, pre_tear
|
, pre_tear
|
||||||
|
@ -3696,7 +3696,7 @@ static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) {
|
||||||
, post_tear_check ? _GREEN_("OK") : _RED_("DETECTED")
|
, post_tear_check ? _GREEN_("OK") : _RED_("DETECTED")
|
||||||
);
|
);
|
||||||
|
|
||||||
if ( post_tear_check && b == inital_value) {
|
if ( post_tear_check && b == initial_value) {
|
||||||
PrintAndLogEx(INFO, "Reverted to previous value");
|
PrintAndLogEx(INFO, "Reverted to previous value");
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
@ -3708,7 +3708,7 @@ static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) {
|
||||||
newvalue[1] = 0;
|
newvalue[1] = 0;
|
||||||
newvalue[2] = 0;
|
newvalue[2] = 0;
|
||||||
|
|
||||||
if ( b >= (inital_value + (2 * wr_value))) {
|
if ( b >= (initial_value + (2 * wr_value))) {
|
||||||
PrintAndLogEx(INFO, "Large " _YELLOW_("( JUMP )") " detected");
|
PrintAndLogEx(INFO, "Large " _YELLOW_("( JUMP )") " detected");
|
||||||
|
|
||||||
|
|
||||||
|
@ -3750,7 +3750,7 @@ static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) {
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( b == inital_value ) {
|
if ( b == initial_value ) {
|
||||||
PrintAndLogEx(INFO, "Reverted to previous value");
|
PrintAndLogEx(INFO, "Reverted to previous value");
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
|
@ -36,7 +36,7 @@
|
||||||
#include "cmdlfhitag.h" // for hitag menu
|
#include "cmdlfhitag.h" // for hitag menu
|
||||||
#include "cmdlfidteck.h" // for idteck menu
|
#include "cmdlfidteck.h" // for idteck menu
|
||||||
#include "cmdlfio.h" // for ioprox menu
|
#include "cmdlfio.h" // for ioprox menu
|
||||||
#include "cmdlfcotag.h" // for COTAG meny
|
#include "cmdlfcotag.h" // for COTAG menu
|
||||||
#include "cmdlfdestron.h" // for FDX-A FECAVA Destron menu
|
#include "cmdlfdestron.h" // for FDX-A FECAVA Destron menu
|
||||||
#include "cmdlffdxb.h" // for FDX-B menu
|
#include "cmdlffdxb.h" // for FDX-B menu
|
||||||
#include "cmdlfgallagher.h" // for GALLAGHER menu
|
#include "cmdlfgallagher.h" // for GALLAGHER menu
|
||||||
|
@ -47,7 +47,7 @@
|
||||||
#include "cmdlfmotorola.h" // for Motorola menu
|
#include "cmdlfmotorola.h" // for Motorola menu
|
||||||
#include "cmdlfnedap.h" // for NEDAP menu
|
#include "cmdlfnedap.h" // for NEDAP menu
|
||||||
#include "cmdlfnexwatch.h" // for nexwatch menu
|
#include "cmdlfnexwatch.h" // for nexwatch menu
|
||||||
#include "cmdlfnoralsy.h" // for NORALSY meny
|
#include "cmdlfnoralsy.h" // for NORALSY menu
|
||||||
#include "cmdlfpac.h" // for pac menu
|
#include "cmdlfpac.h" // for pac menu
|
||||||
#include "cmdlfparadox.h" // for paradox menu
|
#include "cmdlfparadox.h" // for paradox menu
|
||||||
#include "cmdlfpcf7931.h" // for pcf7931 menu
|
#include "cmdlfpcf7931.h" // for pcf7931 menu
|
||||||
|
|
|
@ -572,7 +572,7 @@ int CmdEM4x05Dump(const char *Cmd) {
|
||||||
if (card_type == EM_4205 || card_type == EM_4305 || card_type == EM_UNKNOWN) {
|
if (card_type == EM_4205 || card_type == EM_4305 || card_type == EM_UNKNOWN) {
|
||||||
bool lockInPW2 = false;
|
bool lockInPW2 = false;
|
||||||
// To flag any blocks locked we need to read blocks 14 and 15 first
|
// To flag any blocks locked we need to read blocks 14 and 15 first
|
||||||
// dont swap endian until we get block lock flags.
|
// don't swap endian until we get block lock flags.
|
||||||
int status14 = em4x05_read_word_ext(EM4305_PROT1_BLOCK, pwd, usePwd, &word);
|
int status14 = em4x05_read_word_ext(EM4305_PROT1_BLOCK, pwd, usePwd, &word);
|
||||||
if (status14 == PM3_SUCCESS) {
|
if (status14 == PM3_SUCCESS) {
|
||||||
if ((word & 0x00008000) != 0x00) {
|
if ((word & 0x00008000) != 0x00) {
|
||||||
|
@ -643,7 +643,7 @@ int CmdEM4x05Dump(const char *Cmd) {
|
||||||
} else if (card_type == EM_4369 || card_type == EM_4469) {
|
} else if (card_type == EM_4369 || card_type == EM_4469) {
|
||||||
|
|
||||||
// To flag any blocks locked we need to read block 3 first
|
// To flag any blocks locked we need to read block 3 first
|
||||||
// dont swap endian until we get block lock flags.
|
// don't swap endian until we get block lock flags.
|
||||||
int status14 = em4x05_read_word_ext(EM4469_PROT_BLOCK, pwd, usePwd, &word);
|
int status14 = em4x05_read_word_ext(EM4469_PROT_BLOCK, pwd, usePwd, &word);
|
||||||
if (status14 == PM3_SUCCESS) {
|
if (status14 == PM3_SUCCESS) {
|
||||||
lock_bits = word;
|
lock_bits = word;
|
||||||
|
@ -1579,7 +1579,7 @@ int CmdEM4x05Unlock(const char *Cmd) {
|
||||||
uint32_t search_value = 0;
|
uint32_t search_value = 0;
|
||||||
uint32_t write_value = 0;
|
uint32_t write_value = 0;
|
||||||
//
|
//
|
||||||
// inital phase
|
// initial phase
|
||||||
//
|
//
|
||||||
// read word 14
|
// read word 14
|
||||||
uint32_t init_14 = 0;
|
uint32_t init_14 = 0;
|
||||||
|
|
|
@ -153,8 +153,8 @@ static int CmdMotorolaReader(const char *Cmd) {
|
||||||
PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
|
PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
|
||||||
}
|
}
|
||||||
|
|
||||||
// Motorola Flexpass seem to work at 74 kHz
|
// Motorola Flexpass seems to work at 74 kHz
|
||||||
// and take about 4400 samples to befor modulating
|
// and take about 4400 samples too before modulating
|
||||||
sample_config sc = {
|
sample_config sc = {
|
||||||
.decimation = -1,
|
.decimation = -1,
|
||||||
.bits_per_sample = -1,
|
.bits_per_sample = -1,
|
||||||
|
|
|
@ -53,7 +53,7 @@ static int getWiegandFromPrintedPresco(void *arr, uint32_t *fullcode) {
|
||||||
|
|
||||||
*fullcode += val;
|
*fullcode += val;
|
||||||
|
|
||||||
// last digit is only added, not multipled.
|
// last digit is only added, not multiplied.
|
||||||
if (i < strlen(s) - 1)
|
if (i < strlen(s) - 1)
|
||||||
*fullcode *= 12;
|
*fullcode *= 12;
|
||||||
}
|
}
|
||||||
|
|
|
@ -188,7 +188,7 @@ int clone_t55xx_tag(uint32_t *blockdata, uint8_t numblocks) {
|
||||||
|
|
||||||
if (i == 0) {
|
if (i == 0) {
|
||||||
SetConfigWithBlock0(blockdata[0]);
|
SetConfigWithBlock0(blockdata[0]);
|
||||||
if (t55xxAquireAndCompareBlock0(false, 0, blockdata[0], false))
|
if (t55xxAcquireAndCompareBlock0(false, 0, blockdata[0], false))
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -273,7 +273,7 @@ static bool t55xxProtect(bool lock, bool usepwd, uint8_t override, uint32_t pass
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
bool t55xxAquireAndCompareBlock0(bool usepwd, uint32_t password, uint32_t known_block0, bool verbose) {
|
bool t55xxAcquireAndCompareBlock0(bool usepwd, uint32_t password, uint32_t known_block0, bool verbose) {
|
||||||
|
|
||||||
if (verbose)
|
if (verbose)
|
||||||
PrintAndLogEx(INFO, "Block0 write detected, running `detect` to see if validation is possible");
|
PrintAndLogEx(INFO, "Block0 write detected, running `detect` to see if validation is possible");
|
||||||
|
@ -299,7 +299,7 @@ bool t55xxAquireAndCompareBlock0(bool usepwd, uint32_t password, uint32_t known_
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
bool t55xxAquireAndDetect(bool usepwd, uint32_t password, uint32_t known_block0, bool verbose) {
|
bool t55xxAcquireAndDetect(bool usepwd, uint32_t password, uint32_t known_block0, bool verbose) {
|
||||||
|
|
||||||
if (verbose)
|
if (verbose)
|
||||||
PrintAndLogEx(INFO, "Block0 write detected, running `detect` to see if validation is possible");
|
PrintAndLogEx(INFO, "Block0 write detected, running `detect` to see if validation is possible");
|
||||||
|
@ -334,11 +334,11 @@ bool t55xxVerifyWrite(uint8_t block, bool page1, bool usepwd, uint8_t override,
|
||||||
|
|
||||||
} else if (res == PM3_EWRONGANSWER) {
|
} else if (res == PM3_EWRONGANSWER) {
|
||||||
|
|
||||||
// could't decode. Lets see if this was a block 0 write and try read/detect it auto.
|
// couldn't decode. Lets see if this was a block 0 write and try read/detect it auto.
|
||||||
// this messes up with ppls config..
|
// this messes up with ppl config..
|
||||||
if (block == 0 && page1 == false) {
|
if (block == 0 && page1 == false) {
|
||||||
|
|
||||||
if (t55xxAquireAndDetect(usepwd, password, data, true) == false)
|
if (t55xxAcquireAndDetect(usepwd, password, data, true) == false)
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
return t55xxVerifyWrite(block, page1, usepwd, 2, password, config.downlink_mode, data);
|
return t55xxVerifyWrite(block, page1, usepwd, 2, password, config.downlink_mode, data);
|
||||||
|
@ -474,7 +474,7 @@ static int CmdT55xxSetConfig(const char *Cmd) {
|
||||||
}
|
}
|
||||||
|
|
||||||
// Not these flags are used to Toggle the values.
|
// Not these flags are used to Toggle the values.
|
||||||
// If not flag then dont set or reset, leave as is since the call may just be be setting a different value.
|
// If not flag then don't set or reset, leave as is since the call may just be be setting a different value.
|
||||||
bool invert = arg_get_lit(ctx, idx++);
|
bool invert = arg_get_lit(ctx, idx++);
|
||||||
bool use_q5 = arg_get_lit(ctx, idx++);
|
bool use_q5 = arg_get_lit(ctx, idx++);
|
||||||
bool use_st = arg_get_lit(ctx, idx++);
|
bool use_st = arg_get_lit(ctx, idx++);
|
||||||
|
@ -1727,7 +1727,7 @@ static int CmdT55xxReadTrace(const char *Cmd) {
|
||||||
bool pwdmode = false;
|
bool pwdmode = false;
|
||||||
uint32_t password = 0;
|
uint32_t password = 0;
|
||||||
|
|
||||||
// REGULAR_READ_MODE_BLOCK - yeilds correct Page 1 Block 2 data i.e. + 32 bit offset.
|
// REGULAR_READ_MODE_BLOCK - yields correct Page 1 Block 2 data i.e. + 32 bit offset.
|
||||||
if (!AcquireData(T55x7_PAGE1, REGULAR_READ_MODE_BLOCK, pwdmode, password, downlink_mode))
|
if (!AcquireData(T55x7_PAGE1, REGULAR_READ_MODE_BLOCK, pwdmode, password, downlink_mode))
|
||||||
return PM3_ENODATA;
|
return PM3_ENODATA;
|
||||||
}
|
}
|
||||||
|
@ -1867,7 +1867,7 @@ void printT55x7Trace(t55x7_tracedata_t data, uint8_t repeat) {
|
||||||
|
|
||||||
/*
|
/*
|
||||||
Trace info.
|
Trace info.
|
||||||
M1, M2 has the about ATMEL defintion of trace data.
|
M1, M2 has the about ATMEL definition of trace data.
|
||||||
M3 has unique format following industry defacto standard with row/col parity
|
M3 has unique format following industry defacto standard with row/col parity
|
||||||
|
|
||||||
TRACE - BLOCK O
|
TRACE - BLOCK O
|
||||||
|
@ -3212,7 +3212,7 @@ static int CmdT55xxChkPwds(const char *Cmd) {
|
||||||
|
|
||||||
PrintAndLogEx(INFO, "testing %08"PRIX32, curr_password);
|
PrintAndLogEx(INFO, "testing %08"PRIX32, curr_password);
|
||||||
for (dl_mode = downlink_mode; dl_mode <= 3; dl_mode++) {
|
for (dl_mode = downlink_mode; dl_mode <= 3; dl_mode++) {
|
||||||
// If aquire fails, then we still need to check if we are only trying a single downlink mode.
|
// If acquire fails, then we still need to check if we are only trying a single downlink mode.
|
||||||
// If we continue on fail, it will skip that test and try the next downlink mode; thus slowing down the check
|
// If we continue on fail, it will skip that test and try the next downlink mode; thus slowing down the check
|
||||||
// when on a single downlink mode is wanted.
|
// when on a single downlink mode is wanted.
|
||||||
if (AcquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, curr_password, dl_mode)) {
|
if (AcquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, curr_password, dl_mode)) {
|
||||||
|
@ -3288,7 +3288,7 @@ static int CmdT55xxBruteForce(const char *Cmd) {
|
||||||
}
|
}
|
||||||
|
|
||||||
uint8_t downlink_mode = refFixedBit; // if no downlink mode suppliled use fixed bit/default as the is the most common
|
uint8_t downlink_mode = refFixedBit; // if no downlink mode suppliled use fixed bit/default as the is the most common
|
||||||
// Since we dont know the password the config.downlink mode is of little value.
|
// Since we don't know the password the config.downlink mode is of little value.
|
||||||
// if (r0 || ra) // if try all (ra) then start at fixed bit for correct try all
|
// if (r0 || ra) // if try all (ra) then start at fixed bit for correct try all
|
||||||
// downlink_mode = refFixedBit;
|
// downlink_mode = refFixedBit;
|
||||||
// else
|
// else
|
||||||
|
@ -4071,7 +4071,7 @@ static int CmdT55xxSniff(const char *Cmd) {
|
||||||
|
|
||||||
if (pulseSamples > 0) {
|
if (pulseSamples > 0) {
|
||||||
pulseBuffer[pulseIdx++] = pulseSamples;
|
pulseBuffer[pulseIdx++] = pulseSamples;
|
||||||
if (pulseIdx > 79) { // make room for next sample - if not used by now, it wont be.
|
if (pulseIdx > 79) { // make room for next sample - if not used by now, it won't be.
|
||||||
t55sniff_trim_samples(pulseBuffer, &pulseIdx, 1);
|
t55sniff_trim_samples(pulseBuffer, &pulseIdx, 1);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -4111,14 +4111,14 @@ static int CmdT55xxSniff(const char *Cmd) {
|
||||||
// At this point we should have
|
// At this point we should have
|
||||||
// - a min of 6 samples
|
// - a min of 6 samples
|
||||||
// - the 0 and 1 sample widths
|
// - the 0 and 1 sample widths
|
||||||
// - min 0 and min seperations (worst case)
|
// - min 0 and min separations (worst case)
|
||||||
// No max checks done (yet) as have seen samples > then specs in use.
|
// No max checks done (yet) as have seen samples > then specs in use.
|
||||||
|
|
||||||
// Check first bit.
|
// Check first bit.
|
||||||
|
|
||||||
// Long leading 0
|
// Long leading 0
|
||||||
if (have_data == false && (APPROX_EQ(pulseBuffer[0], 136 + minWidth, tolerance) && APPROX_EQ(pulseBuffer[1], maxWidth, tolerance))) {
|
if (have_data == false && (APPROX_EQ(pulseBuffer[0], 136 + minWidth, tolerance) && APPROX_EQ(pulseBuffer[1], maxWidth, tolerance))) {
|
||||||
// printf ("Long Leading 0 - not yet hanled | have 1 Fisrt bit | Min : %-3d - Max : %-3d : diff : %d\n",minWidth,maxWidth, maxWidth-minWidth);
|
// printf ("Long Leading 0 - not yet handled | have 1 First bit | Min : %-3d - Max : %-3d : diff : %d\n",minWidth,maxWidth, maxWidth-minWidth);
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -181,8 +181,8 @@ void printT5xxHeader(uint8_t page);
|
||||||
void printT55xxBlock(uint8_t blockNum, bool page1);
|
void printT55xxBlock(uint8_t blockNum, bool page1);
|
||||||
int printConfiguration(t55xx_conf_block_t b);
|
int printConfiguration(t55xx_conf_block_t b);
|
||||||
|
|
||||||
bool t55xxAquireAndCompareBlock0(bool usepwd, uint32_t password, uint32_t known_block0, bool verbose);
|
bool t55xxAcquireAndCompareBlock0(bool usepwd, uint32_t password, uint32_t known_block0, bool verbose);
|
||||||
bool t55xxAquireAndDetect(bool usepwd, uint32_t password, uint32_t known_block0, bool verbose);
|
bool t55xxAcquireAndDetect(bool usepwd, uint32_t password, uint32_t known_block0, bool verbose);
|
||||||
bool t55xxVerifyWrite(uint8_t block, bool page1, bool usepwd, uint8_t override, uint32_t password, uint8_t downlink_mode, uint32_t data);
|
bool t55xxVerifyWrite(uint8_t block, bool page1, bool usepwd, uint8_t override, uint32_t password, uint8_t downlink_mode, uint32_t data);
|
||||||
int T55xxReadBlock(uint8_t block, bool page1, bool usepwd, uint8_t override, uint32_t password, uint8_t downlink_mode);
|
int T55xxReadBlock(uint8_t block, bool page1, bool usepwd, uint8_t override, uint32_t password, uint8_t downlink_mode);
|
||||||
int T55xxReadBlockEx(uint8_t block, bool page1, bool usepwd, uint8_t override, uint32_t password, uint8_t downlink_mode, bool verbose);
|
int T55xxReadBlockEx(uint8_t block, bool page1, bool usepwd, uint8_t override, uint32_t password, uint8_t downlink_mode, bool verbose);
|
||||||
|
|
|
@ -271,7 +271,7 @@ static int CmdScriptRun(const char *Cmd) {
|
||||||
}
|
}
|
||||||
CLIParserFree(ctx);
|
CLIParserFree(ctx);
|
||||||
|
|
||||||
// try to detect a valid script file extention, case-insensitive
|
// try to detect a valid script file extension, case-insensitive
|
||||||
char *extension_chk;
|
char *extension_chk;
|
||||||
extension_chk = str_dup(filename);
|
extension_chk = str_dup(filename);
|
||||||
str_lower(extension_chk);
|
str_lower(extension_chk);
|
||||||
|
|
|
@ -100,7 +100,7 @@ void SendCommandOLD(uint64_t cmd, uint64_t arg0, uint64_t arg1, uint64_t arg2, v
|
||||||
but comm thread just spins here. Not good.../holiman
|
but comm thread just spins here. Not good.../holiman
|
||||||
**/
|
**/
|
||||||
while (txBuffer_pending) {
|
while (txBuffer_pending) {
|
||||||
// wait for communication thread to complete sending a previous commmand
|
// wait for communication thread to complete sending a previous command
|
||||||
pthread_cond_wait(&txBufferSig, &txBufferMutex);
|
pthread_cond_wait(&txBufferSig, &txBufferMutex);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -137,7 +137,7 @@ static void SendCommandNG_internal(uint16_t cmd, uint8_t *data, size_t len, bool
|
||||||
but comm thread just spins here. Not good.../holiman
|
but comm thread just spins here. Not good.../holiman
|
||||||
**/
|
**/
|
||||||
while (txBuffer_pending) {
|
while (txBuffer_pending) {
|
||||||
// wait for communication thread to complete sending a previous commmand
|
// wait for communication thread to complete sending a previous command
|
||||||
pthread_cond_wait(&txBufferSig, &txBufferMutex);
|
pthread_cond_wait(&txBufferSig, &txBufferMutex);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -1365,13 +1365,13 @@ static int CmdEMVExec(const char *Cmd) {
|
||||||
}
|
}
|
||||||
PrintAndLogEx(NORMAL, "raw ARPC: %s", sprint_hex(rawARPC, rawARPClen));
|
PrintAndLogEx(NORMAL, "raw ARPC: %s", sprint_hex(rawARPC, rawARPClen));
|
||||||
|
|
||||||
// here must be calculation of ARPC, but we dont know a bank keys.
|
// here must be calculation of ARPC, but we don't know a bank keys.
|
||||||
PrintAndLogEx(NORMAL, "ARPC: n/a");
|
PrintAndLogEx(NORMAL, "ARPC: n/a");
|
||||||
|
|
||||||
} else {
|
} else {
|
||||||
PrintAndLogEx(WARNING, "Application Cryptogram (AC) not found.");
|
PrintAndLogEx(WARNING, "Application Cryptogram (AC) not found.");
|
||||||
}
|
}
|
||||||
// here must be external authenticate, but we dont know ARPC
|
// here must be external authenticate, but we don't know ARPC
|
||||||
}
|
}
|
||||||
|
|
||||||
// needs to send AC2 command (res == ARQC)
|
// needs to send AC2 command (res == ARQC)
|
||||||
|
@ -1386,7 +1386,7 @@ static int CmdEMVExec(const char *Cmd) {
|
||||||
|
|
||||||
PrintAndLogEx(NORMAL, "CDOL2 data[%zu]: %s", cdol2_data_tlv->len, sprint_hex(cdol2_data_tlv->value, cdol2_data_tlv->len));
|
PrintAndLogEx(NORMAL, "CDOL2 data[%zu]: %s", cdol2_data_tlv->len, sprint_hex(cdol2_data_tlv->value, cdol2_data_tlv->len));
|
||||||
//PrintAndLogEx(NORMAL, "* * AC2");
|
//PrintAndLogEx(NORMAL, "* * AC2");
|
||||||
// here must be AC2, but we dont make external authenticate (
|
// here must be AC2, but we don't make external authenticate (
|
||||||
/* // AC2
|
/* // AC2
|
||||||
PRINT_INDENT(level);
|
PRINT_INDENT(level);
|
||||||
if ((CID & EMVAC_AC2_MASK) == EMVAC_AAC2) PrintAndLogEx(NORMAL, "\tAC2: AAC (Transaction declined)");
|
if ((CID & EMVAC_AC2_MASK) == EMVAC_AAC2) PrintAndLogEx(NORMAL, "\tAC2: AAC (Transaction declined)");
|
||||||
|
|
|
@ -218,7 +218,7 @@ int JsonSaveTLVTree(json_t *root, json_t *elm, const char *path, struct tlvdb *t
|
||||||
if (!pelm)
|
if (!pelm)
|
||||||
return 1;
|
return 1;
|
||||||
|
|
||||||
// check childs element and add it if not found
|
// check children element and add it if not found
|
||||||
json_t *chjson = json_path_get(pelm, "$.Childs");
|
json_t *chjson = json_path_get(pelm, "$.Childs");
|
||||||
if (!chjson) {
|
if (!chjson) {
|
||||||
json_object_set_new(pelm, "Childs", json_array());
|
json_object_set_new(pelm, "Childs", json_array());
|
||||||
|
|
|
@ -9,7 +9,7 @@
|
||||||
// To add a new setting
|
// To add a new setting
|
||||||
// Add the new setting to the session_arg_t; in ui.h
|
// Add the new setting to the session_arg_t; in ui.h
|
||||||
// Add the default value for the setting in the settings_load page below
|
// Add the default value for the setting in the settings_load page below
|
||||||
// Update the preferences_load_callback to load your setting into the stucture
|
// Update the preferences_load_callback to load your setting into the structure
|
||||||
// Update the preferences_save_callback to ensure your setting gets saved when needed.
|
// Update the preferences_save_callback to ensure your setting gets saved when needed.
|
||||||
// use the preference as needed : g_session.<preference name>
|
// use the preference as needed : g_session.<preference name>
|
||||||
// Can use (g_session.preferences_loaded) to check if json settings file was used
|
// Can use (g_session.preferences_loaded) to check if json settings file was used
|
||||||
|
@ -515,7 +515,7 @@ static void showClientExeDelayState(void) {
|
||||||
static int setCmdEmoji(const char *Cmd) {
|
static int setCmdEmoji(const char *Cmd) {
|
||||||
CLIParserContext *ctx;
|
CLIParserContext *ctx;
|
||||||
CLIParserInit(&ctx, "prefs set emoji ",
|
CLIParserInit(&ctx, "prefs set emoji ",
|
||||||
"Set presistent preference of using emojis in the client",
|
"Set persistent preference of using emojis in the client",
|
||||||
"prefs set emoji --alias"
|
"prefs set emoji --alias"
|
||||||
);
|
);
|
||||||
|
|
||||||
|
@ -569,7 +569,7 @@ static int setCmdEmoji(const char *Cmd) {
|
||||||
static int setCmdColor(const char *Cmd) {
|
static int setCmdColor(const char *Cmd) {
|
||||||
CLIParserContext *ctx;
|
CLIParserContext *ctx;
|
||||||
CLIParserInit(&ctx, "prefs set color ",
|
CLIParserInit(&ctx, "prefs set color ",
|
||||||
"Set presistent preference of using colors in the client",
|
"Set persistent preference of using colors in the client",
|
||||||
"prefs set color --ansi"
|
"prefs set color --ansi"
|
||||||
);
|
);
|
||||||
|
|
||||||
|
@ -613,7 +613,7 @@ static int setCmdColor(const char *Cmd) {
|
||||||
static int setCmdDebug(const char *Cmd) {
|
static int setCmdDebug(const char *Cmd) {
|
||||||
CLIParserContext *ctx;
|
CLIParserContext *ctx;
|
||||||
CLIParserInit(&ctx, "prefs set clientdebug ",
|
CLIParserInit(&ctx, "prefs set clientdebug ",
|
||||||
"Set presistent preference of using clientside debug level",
|
"Set persistent preference of using clientside debug level",
|
||||||
"prefs set clientdebug --simple"
|
"prefs set clientdebug --simple"
|
||||||
);
|
);
|
||||||
|
|
||||||
|
@ -664,7 +664,7 @@ static int setCmdDeviceDebug (const char *Cmd)
|
||||||
{
|
{
|
||||||
CLIParserContext *ctx;
|
CLIParserContext *ctx;
|
||||||
CLIParserInit(&ctx, "prefs set devicedebug ",
|
CLIParserInit(&ctx, "prefs set devicedebug ",
|
||||||
"Set presistent preference of device side debug level",
|
"Set persistent preference of device side debug level",
|
||||||
"prefs set devicedebug --on"
|
"prefs set devicedebug --on"
|
||||||
);
|
);
|
||||||
|
|
||||||
|
@ -732,7 +732,7 @@ static int setCmdDeviceDebug (const char *Cmd)
|
||||||
static int setCmdExeDelay(const char *Cmd) {
|
static int setCmdExeDelay(const char *Cmd) {
|
||||||
CLIParserContext *ctx;
|
CLIParserContext *ctx;
|
||||||
CLIParserInit(&ctx, "prefs set clientdelay",
|
CLIParserInit(&ctx, "prefs set clientdelay",
|
||||||
"Set presistent preference of delay before executing a command in the client",
|
"Set persistent preference of delay before executing a command in the client",
|
||||||
"prefs set clientdelay --ms 0 --> unsets any delay\n"
|
"prefs set clientdelay --ms 0 --> unsets any delay\n"
|
||||||
"prefs set clientdelay --ms 1000 --> sets 1000ms delay"
|
"prefs set clientdelay --ms 1000 --> sets 1000ms delay"
|
||||||
);
|
);
|
||||||
|
@ -760,7 +760,7 @@ static int setCmdExeDelay(const char *Cmd) {
|
||||||
static int setCmdHint(const char *Cmd) {
|
static int setCmdHint(const char *Cmd) {
|
||||||
CLIParserContext *ctx;
|
CLIParserContext *ctx;
|
||||||
CLIParserInit(&ctx, "prefs set hints ",
|
CLIParserInit(&ctx, "prefs set hints ",
|
||||||
"Set presistent preference of showing hint messages in the client",
|
"Set persistent preference of showing hint messages in the client",
|
||||||
"prefs set hints --on"
|
"prefs set hints --on"
|
||||||
);
|
);
|
||||||
|
|
||||||
|
@ -803,7 +803,7 @@ static int setCmdHint(const char *Cmd) {
|
||||||
static int setCmdPlotSliders(const char *Cmd) {
|
static int setCmdPlotSliders(const char *Cmd) {
|
||||||
CLIParserContext *ctx;
|
CLIParserContext *ctx;
|
||||||
CLIParserInit(&ctx, "prefs set plotsliders",
|
CLIParserInit(&ctx, "prefs set plotsliders",
|
||||||
"Set presistent preference of showing the plotslider control in the client",
|
"Set persistent preference of showing the plotslider control in the client",
|
||||||
"prefs set plotsliders --on"
|
"prefs set plotsliders --on"
|
||||||
);
|
);
|
||||||
|
|
||||||
|
@ -845,7 +845,7 @@ static int setCmdPlotSliders(const char *Cmd) {
|
||||||
static int setCmdSavePaths(const char *Cmd) {
|
static int setCmdSavePaths(const char *Cmd) {
|
||||||
CLIParserContext *ctx;
|
CLIParserContext *ctx;
|
||||||
CLIParserInit(&ctx, "prefs set savepaths",
|
CLIParserInit(&ctx, "prefs set savepaths",
|
||||||
"Set presistent preference of file paths in the client",
|
"Set persistent preference of file paths in the client",
|
||||||
"prefs set savepaths --dump /home/mydumpfolder -> all dump files will be saved into this folder\n"
|
"prefs set savepaths --dump /home/mydumpfolder -> all dump files will be saved into this folder\n"
|
||||||
"prefs set savepaths --def /home/myfolder -c -> create if needed, all files will be saved into this folder"
|
"prefs set savepaths --def /home/myfolder -c -> create if needed, all files will be saved into this folder"
|
||||||
);
|
);
|
||||||
|
@ -926,7 +926,7 @@ static int setCmdSavePaths(const char *Cmd) {
|
||||||
static int setCmdBarMode(const char *Cmd) {
|
static int setCmdBarMode(const char *Cmd) {
|
||||||
CLIParserContext *ctx;
|
CLIParserContext *ctx;
|
||||||
CLIParserInit(&ctx, "prefs set barmode",
|
CLIParserInit(&ctx, "prefs set barmode",
|
||||||
"Set presistent preference of HF/LF tune command styled output in the client",
|
"Set persistent preference of HF/LF tune command styled output in the client",
|
||||||
"prefs set barmode --mix"
|
"prefs set barmode --mix"
|
||||||
);
|
);
|
||||||
|
|
||||||
|
|
|
@ -249,7 +249,7 @@ ProxGuiQT::~ProxGuiQT(void) {
|
||||||
// Event override functions
|
// Event override functions
|
||||||
// -------------------------------------------------
|
// -------------------------------------------------
|
||||||
PictureWidget::PictureWidget() {
|
PictureWidget::PictureWidget() {
|
||||||
// Set the initail postion and size from settings
|
// Set the initial postion and size from settings
|
||||||
// if (g_session.preferences_loaded)
|
// if (g_session.preferences_loaded)
|
||||||
// setGeometry(g_session.pw.x, g_session.pw.y, g_session.pw.w, g_session.pw.h);
|
// setGeometry(g_session.pw.x, g_session.pw.y, g_session.pw.w, g_session.pw.h);
|
||||||
// else
|
// else
|
||||||
|
@ -268,7 +268,7 @@ void PictureWidget::closeEvent(QCloseEvent *event) {
|
||||||
// -------------------------------------------------
|
// -------------------------------------------------
|
||||||
|
|
||||||
SliderWidget::SliderWidget() {
|
SliderWidget::SliderWidget() {
|
||||||
// Set the initail postion and size from settings
|
// Set the initial postion and size from settings
|
||||||
if (g_session.preferences_loaded)
|
if (g_session.preferences_loaded)
|
||||||
setGeometry(g_session.overlay.x, g_session.overlay.y, g_session.overlay.w, g_session.overlay.h);
|
setGeometry(g_session.overlay.x, g_session.overlay.y, g_session.overlay.w, g_session.overlay.h);
|
||||||
else
|
else
|
||||||
|
@ -330,7 +330,7 @@ void ProxWidget::vchange_dthr_down(int v) {
|
||||||
|
|
||||||
ProxWidget::ProxWidget(QWidget *parent, ProxGuiQT *master) : QWidget(parent) {
|
ProxWidget::ProxWidget(QWidget *parent, ProxGuiQT *master) : QWidget(parent) {
|
||||||
this->master = master;
|
this->master = master;
|
||||||
// Set the initail postion and size from settings
|
// Set the initial postion and size from settings
|
||||||
if (g_session.preferences_loaded)
|
if (g_session.preferences_loaded)
|
||||||
setGeometry(g_session.plot.x, g_session.plot.y, g_session.plot.w, g_session.plot.h);
|
setGeometry(g_session.plot.x, g_session.plot.y, g_session.plot.w, g_session.plot.h);
|
||||||
else
|
else
|
||||||
|
|
|
@ -107,7 +107,7 @@ serial_port uart_open(const char *pcPortName, uint32_t speed) {
|
||||||
}
|
}
|
||||||
|
|
||||||
// Prepare the device control
|
// Prepare the device control
|
||||||
// doesn't matter since PM3 device ignors this CDC command: set_line_coding in usb_cdc.c
|
// doesn't matter since PM3 device ignores this CDC command: set_line_coding in usb_cdc.c
|
||||||
memset(&sp->dcb, 0, sizeof(DCB));
|
memset(&sp->dcb, 0, sizeof(DCB));
|
||||||
sp->dcb.DCBlength = sizeof(DCB);
|
sp->dcb.DCBlength = sizeof(DCB);
|
||||||
if (!BuildCommDCBA("baud=115200 parity=N data=8 stop=1", &sp->dcb)) {
|
if (!BuildCommDCBA("baud=115200 parity=N data=8 stop=1", &sp->dcb)) {
|
||||||
|
|
|
@ -447,7 +447,7 @@ int hex_to_bytes(const char *hexValue, uint8_t *bytesValue, size_t maxBytesValue
|
||||||
}
|
}
|
||||||
|
|
||||||
if (maxBytesValueLen && bytesValueLen >= maxBytesValueLen) {
|
if (maxBytesValueLen && bytesValueLen >= maxBytesValueLen) {
|
||||||
// if we dont have space in buffer and have symbols to translate
|
// if we don't have space in buffer and have symbols to translate
|
||||||
return -2;
|
return -2;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -718,7 +718,7 @@ int param_gethex_to_eol(const char *line, int paramnum, uint8_t *data, int maxda
|
||||||
}
|
}
|
||||||
|
|
||||||
if (*datalen >= maxdatalen) {
|
if (*datalen >= maxdatalen) {
|
||||||
// if we dont have space in buffer and have symbols to translate
|
// if we don't have space in buffer and have symbols to translate
|
||||||
return 2;
|
return 2;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -763,7 +763,7 @@ int param_getbin_to_eol(const char *line, int paramnum, uint8_t *data, int maxda
|
||||||
}
|
}
|
||||||
|
|
||||||
if (*datalen >= maxdatalen) {
|
if (*datalen >= maxdatalen) {
|
||||||
// if we dont have space in buffer and have symbols to translate
|
// if we don't have space in buffer and have symbols to translate
|
||||||
return 2;
|
return 2;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -475,7 +475,7 @@ static struct Crypto1State *check_pfx_parity(uint32_t prefix, uint32_t rresp, ui
|
||||||
|
|
||||||
#if !defined(__arm__) || defined(__linux__) || defined(_WIN32) || defined(__APPLE__) // bare metal ARM Proxmark lacks malloc()/free()
|
#if !defined(__arm__) || defined(__linux__) || defined(_WIN32) || defined(__APPLE__) // bare metal ARM Proxmark lacks malloc()/free()
|
||||||
/** lfsr_common_prefix
|
/** lfsr_common_prefix
|
||||||
* Implentation of the common prefix attack.
|
* Implementation of the common prefix attack.
|
||||||
* Requires the 28 bit constant prefix used as reader nonce (pfx)
|
* Requires the 28 bit constant prefix used as reader nonce (pfx)
|
||||||
* The reader response used (rr)
|
* The reader response used (rr)
|
||||||
* The keystream used to encrypt the observed NACK's (ks)
|
* The keystream used to encrypt the observed NACK's (ks)
|
||||||
|
|
|
@ -243,7 +243,7 @@ void sm_auth(const uint8_t *Gc, const uint8_t *Ci, const uint8_t *Q, uint8_t *Ch
|
||||||
|
|
||||||
initialize(false, Gc, Ci, Q, 1, s);
|
initialize(false, Gc, Ci, Q, 1, s);
|
||||||
|
|
||||||
// Generate challange answer for Tag and Reader
|
// Generate challenge answer for Tag and Reader
|
||||||
for (pos = 0; pos < 8; pos++) {
|
for (pos = 0; pos < 8; pos++) {
|
||||||
Ci_1[pos] = sm_byte(s);
|
Ci_1[pos] = sm_byte(s);
|
||||||
Ch[pos] = sm_byte(s);
|
Ch[pos] = sm_byte(s);
|
||||||
|
@ -255,7 +255,7 @@ void cm_auth(const uint8_t *Gc, const uint8_t *Ci, const uint8_t *Q, uint8_t *Ch
|
||||||
|
|
||||||
initialize(true, Gc, Ci, Q, 3, s);
|
initialize(true, Gc, Ci, Q, 3, s);
|
||||||
|
|
||||||
// Construct the reader-answer (challange)
|
// Construct the reader-answer (challenge)
|
||||||
next_n(true, 6, 0, s);
|
next_n(true, 6, 0, s);
|
||||||
Ch[0] = cm_byte(s);
|
Ch[0] = cm_byte(s);
|
||||||
for (pos = 1; pos < 8; pos++) {
|
for (pos = 1; pos < 8; pos++) {
|
||||||
|
|
|
@ -23,8 +23,8 @@
|
||||||
#include "mbedtls/sha1.h"
|
#include "mbedtls/sha1.h"
|
||||||
#include "crc16.h" // crc16 ccitt
|
#include "crc16.h" // crc16 ccitt
|
||||||
|
|
||||||
// Implemetation tips:
|
// Implementation tips:
|
||||||
// For each implementation of the algos, I recommend adding a self test for easy "simple unit" tests when Travic CI / Appveyour runs.
|
// For each implementation of the algos, I recommend adding a self test for easy "simple unit" tests when Travis CI / Appveyor runs.
|
||||||
// See special note for MFC based algos.
|
// See special note for MFC based algos.
|
||||||
|
|
||||||
//------------------------------------
|
//------------------------------------
|
||||||
|
|
|
@ -36,7 +36,7 @@
|
||||||
|
|
||||||
//RESPONSE FLAGS
|
//RESPONSE FLAGS
|
||||||
#define ISO15_RES_ERROR 0x01
|
#define ISO15_RES_ERROR 0x01
|
||||||
#define ISO15_RES_EXT 0x08 // Protocol Extention
|
#define ISO15_RES_EXT 0x08 // Protocol Extension
|
||||||
|
|
||||||
// RESPONSE ERROR CODES
|
// RESPONSE ERROR CODES
|
||||||
#define ISO15_NOERROR 0x00
|
#define ISO15_NOERROR 0x00
|
||||||
|
|
|
@ -9,7 +9,7 @@
|
||||||
// many others who came before
|
// many others who came before
|
||||||
//
|
//
|
||||||
// NOTES:
|
// NOTES:
|
||||||
// LF Demod functions are placed here to allow the flexability to use client or
|
// LF Demod functions are placed here to allow the flexibility to use client or
|
||||||
// device side. Most BUT NOT ALL of these functions are currenlty safe for
|
// device side. Most BUT NOT ALL of these functions are currenlty safe for
|
||||||
// device side use currently. (DetectST for example...)
|
// device side use currently. (DetectST for example...)
|
||||||
//
|
//
|
||||||
|
@ -1883,7 +1883,7 @@ static size_t fsk_wave_demod(uint8_t *dest, size_t size, uint8_t fchigh, uint8_t
|
||||||
|
|
||||||
// process:
|
// process:
|
||||||
// count width from 0-1 transition to 1-0.
|
// count width from 0-1 transition to 1-0.
|
||||||
// determine the width is withing FUZZ_min and FUZZ_max tolerances
|
// determine the width is within FUZZ_min and FUZZ_max tolerances
|
||||||
// width should be divided with exp_one. i:e 6+7+6+2=21, 21/5 = 4,
|
// width should be divided with exp_one. i:e 6+7+6+2=21, 21/5 = 4,
|
||||||
// the 1-0 to 0-1 width should be divided with exp_zero. Ie: 3+5+6+7 = 21/6 = 3
|
// the 1-0 to 0-1 width should be divided with exp_zero. Ie: 3+5+6+7 = 21/6 = 3
|
||||||
|
|
||||||
|
|
|
@ -257,7 +257,7 @@ Practice reading and writing to blocks 1 to 6 until you are happy you
|
||||||
can do it and get the results you wanted (i.e. the data you want stored
|
can do it and get the results you wanted (i.e. the data you want stored
|
||||||
is written to the block you want it stored in). I recommend staying
|
is written to the block you want it stored in). I recommend staying
|
||||||
away from block 7 as this is where the password is stored, if used.
|
away from block 7 as this is where the password is stored, if used.
|
||||||
If you forget this data/password, you wont be able to read or write
|
If you forget this data/password, you won't be able to read or write
|
||||||
to the card.
|
to the card.
|
||||||
|
|
||||||
## How do I use a password
|
## How do I use a password
|
||||||
|
|
|
@ -49,11 +49,11 @@ and it will be added along the other firmwares as:
|
||||||
|
|
||||||
For verbose usage and see the actual commands being executed, add `V=1`.
|
For verbose usage and see the actual commands being executed, add `V=1`.
|
||||||
|
|
||||||
`CFLAGS` and `LDFLAGS` can be overriden by environment variables for client-side components.
|
`CFLAGS` and `LDFLAGS` can be overridden by environment variables for client-side components.
|
||||||
|
|
||||||
Default compiler is gcc but you can use clang for the non-ARM parts with e.g. `make client CC=clang CXX=clang++ LD=clang++`. Note that `CC`, `CXX` and `LD` must be provided as explicit arguments, they won't be overriden by environment variables.
|
Default compiler is gcc but you can use clang for the non-ARM parts with e.g. `make client CC=clang CXX=clang++ LD=clang++`. Note that `CC`, `CXX` and `LD` must be provided as explicit arguments, they won't be overridden by environment variables.
|
||||||
|
|
||||||
Similarly, for ARM-side components, `CROSS_CFLAGS` and `CROSS_LDFLAGS` can be overriden by environment variables and `CROSS_CC`, `CROSS_LD` and `CROSS_OBJCOPY` can be provided as explicit arguments.
|
Similarly, for ARM-side components, `CROSS_CFLAGS` and `CROSS_LDFLAGS` can be overridden by environment variables and `CROSS_CC`, `CROSS_LD` and `CROSS_OBJCOPY` can be provided as explicit arguments.
|
||||||
|
|
||||||
If your platform needs specific lib/include paths for the client, you can use `LDLIBS` and `INCLUDES_CLIENT` *as envvars*, e.g. `LDLIBS="-L/some/more/lib" INCLUDES_CLIENT="-I/some/more/include" make client ...`
|
If your platform needs specific lib/include paths for the client, you can use `LDLIBS` and `INCLUDES_CLIENT` *as envvars*, e.g. `LDLIBS="-L/some/more/lib" INCLUDES_CLIENT="-I/some/more/include" make client ...`
|
||||||
|
|
||||||
|
|
|
@ -18,7 +18,7 @@ Always use the latest repository commits from *master* branch. There are always
|
||||||
* [File not found](#file-not-found)
|
* [File not found](#file-not-found)
|
||||||
* [Pixmap / pixbuf warnings](#pixmap--pixbuf-warnings)
|
* [Pixmap / pixbuf warnings](#pixmap--pixbuf-warnings)
|
||||||
* [Usb cable](#usb-cable)
|
* [Usb cable](#usb-cable)
|
||||||
* [WSL explorer.exe . doesnt work](#WSL)
|
* [WSL explorer.exe . doesn't work](#WSL)
|
||||||
* [Troubles with running the Proxmark3 client](#troubles-with-running-the-proxmark3-client)
|
* [Troubles with running the Proxmark3 client](#troubles-with-running-the-proxmark3-client)
|
||||||
* [libQt5Core.so.5 not found](#libQt5Coreso5-not-found)
|
* [libQt5Core.so.5 not found](#libQt5Coreso5-not-found)
|
||||||
* [Target attribute is not supported on this machine](#target-attribute-is-not-supported-on-this-machine)
|
* [Target attribute is not supported on this machine](#target-attribute-is-not-supported-on-this-machine)
|
||||||
|
|
|
@ -83,7 +83,7 @@ Now you're ready to follow the [compilation instructions](/doc/md/Use_of_Proxmar
|
||||||
# Installing pre-compiled binaries with ProxSpace
|
# Installing pre-compiled binaries with ProxSpace
|
||||||
^[Top](#top)
|
^[Top](#top)
|
||||||
|
|
||||||
There are a community effort by @gator96100 to make up-to-date precompiled version of the offical repository and this repository.
|
There are a community effort by @gator96100 to make up-to-date precompiled version of the official repository and this repository.
|
||||||
[www.proxmarkbuilds.org](https://www.proxmarkbuilds.org/)
|
[www.proxmarkbuilds.org](https://www.proxmarkbuilds.org/)
|
||||||
|
|
||||||
It has excellent instructions to follow.
|
It has excellent instructions to follow.
|
||||||
|
|
|
@ -852,7 +852,7 @@ typedef struct {
|
||||||
#define PM3_EFAILED -21
|
#define PM3_EFAILED -21
|
||||||
// partial success client/pm3: when trying to dump a tag and fails on some blocks. Partial dump.
|
// partial success client/pm3: when trying to dump a tag and fails on some blocks. Partial dump.
|
||||||
#define PM3_EPARTIAL -22
|
#define PM3_EPARTIAL -22
|
||||||
// tearoff occured client/pm3: when a tearoff hook was called and a tearoff actually happened
|
// tearoff occurred client/pm3: when a tearoff hook was called and a tearoff actually happened
|
||||||
#define PM3_ETEAROFF -23
|
#define PM3_ETEAROFF -23
|
||||||
|
|
||||||
// Got bad CRC client/pm3: error in transfer of data, crc mismatch.
|
// Got bad CRC client/pm3: error in transfer of data, crc mismatch.
|
||||||
|
|
|
@ -27,7 +27,7 @@ Mifare
|
||||||
C2 = Restore
|
C2 = Restore
|
||||||
B0 = Transfer
|
B0 = Transfer
|
||||||
Ultralight C
|
Ultralight C
|
||||||
A0 = Compatibility Write (to accomodate MIFARE commands)
|
A0 = Compatibility Write (to accommodate MIFARE commands)
|
||||||
1A = Step1 Authenticate
|
1A = Step1 Authenticate
|
||||||
AF = Step2 Authenticate
|
AF = Step2 Authenticate
|
||||||
|
|
||||||
|
|
|
@ -179,7 +179,7 @@ static inline uint8_t bit_rotate_r(uint8_t a, uint8_t n_bits) {
|
||||||
return ((a >> 1) | ((a & 1) << (n_bits - 1)));
|
return ((a >> 1) | ((a & 1) << (n_bits - 1)));
|
||||||
}
|
}
|
||||||
|
|
||||||
static uint8_t lookup_left_substraction[0x400];
|
static uint8_t lookup_left_subtraction[0x400];
|
||||||
static uint8_t lookup_right_subtraction[0x400];
|
static uint8_t lookup_right_subtraction[0x400];
|
||||||
static lookup_entry lookup_left[0x100000];
|
static lookup_entry lookup_left[0x100000];
|
||||||
static lookup_entry lookup_right[0x8000];
|
static lookup_entry lookup_right[0x8000];
|
||||||
|
@ -211,15 +211,15 @@ static inline void init_lookup_right() {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
static void init_lookup_left_substraction() {
|
static void init_lookup_left_subtraction() {
|
||||||
for (int index = 0; index < 0x400 ; index++) {
|
for (int index = 0; index < 0x400 ; index++) {
|
||||||
uint8_t b3 = (index >> 5 & 0x1f);
|
uint8_t b3 = (index >> 5 & 0x1f);
|
||||||
uint8_t bx = (index & 0x1f);
|
uint8_t bx = (index & 0x1f);
|
||||||
lookup_left_substraction[index] = bit_rotate_r(mod((bx + 0x1f) - b3, 0x1f), 5);
|
lookup_left_subtraction[index] = bit_rotate_r(mod((bx + 0x1f) - b3, 0x1f), 5);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
static void init_lookup_right_substraction() {
|
static void init_lookup_right_subtraction() {
|
||||||
for (int index = 0; index < 0x400 ; index++) {
|
for (int index = 0; index < 0x400 ; index++) {
|
||||||
int b16 = (index >> 5);
|
int b16 = (index >> 5);
|
||||||
uint8_t bx = (index & 0x1f);
|
uint8_t bx = (index & 0x1f);
|
||||||
|
@ -248,7 +248,7 @@ static inline void previous_left(uint8_t in, vector<cs_t> *candidate_states) {
|
||||||
state->l ^= (((uint64_t)in & 0x1f) << 20);
|
state->l ^= (((uint64_t)in & 0x1f) << 20);
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
uint8_t b6 = lookup_left_substraction[b3 | bx];
|
uint8_t b6 = lookup_left_subtraction[b3 | bx];
|
||||||
state->l = (state->l & 0x7ffffffe0ull) | b6;
|
state->l = (state->l & 0x7ffffffe0ull) | b6;
|
||||||
state->l ^= (((uint64_t)in & 0x1f) << 20);
|
state->l ^= (((uint64_t)in & 0x1f) << 20);
|
||||||
|
|
||||||
|
@ -790,8 +790,8 @@ int main(int argc, const char *argv[]) {
|
||||||
printf("Initializing lookup tables for increasing cipher speed\n");
|
printf("Initializing lookup tables for increasing cipher speed\n");
|
||||||
init_lookup_left();
|
init_lookup_left();
|
||||||
init_lookup_right();
|
init_lookup_right();
|
||||||
init_lookup_left_substraction();
|
init_lookup_left_subtraction();
|
||||||
init_lookup_right_substraction();
|
init_lookup_right_subtraction();
|
||||||
|
|
||||||
// Load in the ci (tag-nonce), together with the first half of Q (reader-nonce)
|
// Load in the ci (tag-nonce), together with the first half of Q (reader-nonce)
|
||||||
rstate_before_gc = 0;
|
rstate_before_gc = 0;
|
||||||
|
|
|
@ -192,7 +192,7 @@ static inline uint8_t bit_rotate_r(uint8_t a, uint8_t n_bits) {
|
||||||
#define BIT_ROR(a) (((a) >> 1) | (((a) & 1) << 4))
|
#define BIT_ROR(a) (((a) >> 1) | (((a) & 1) << 4))
|
||||||
|
|
||||||
|
|
||||||
static uint8_t lookup_left_substraction[0x400];
|
static uint8_t lookup_left_subtraction[0x400];
|
||||||
static uint8_t lookup_right_subtraction[0x400];
|
static uint8_t lookup_right_subtraction[0x400];
|
||||||
static lookup_entry lookup_left[0x100000];
|
static lookup_entry lookup_left[0x100000];
|
||||||
static lookup_entry lookup_right[0x8000];
|
static lookup_entry lookup_right[0x8000];
|
||||||
|
@ -232,17 +232,17 @@ static inline void init_lookup_right() {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
static void init_lookup_left_substraction() {
|
static void init_lookup_left_subtraction() {
|
||||||
for (int index = 0; index < 0x400 ; index++) {
|
for (int index = 0; index < 0x400 ; index++) {
|
||||||
uint8_t b3 = (index >> 5 & 0x1f);
|
uint8_t b3 = (index >> 5 & 0x1f);
|
||||||
uint8_t bx = (index & 0x1f);
|
uint8_t bx = (index & 0x1f);
|
||||||
|
|
||||||
//lookup_left_substraction[index] = bit_rotate_r(mod((bx+0x1f)-b3,0x1f),5);
|
//lookup_left_subtraction[index] = bit_rotate_r(mod((bx+0x1f)-b3,0x1f),5);
|
||||||
lookup_left_substraction[index] = BIT_ROR(mod((bx + 0x1F) - b3, 0x1F));
|
lookup_left_subtraction[index] = BIT_ROR(mod((bx + 0x1F) - b3, 0x1F));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
static void init_lookup_right_substraction() {
|
static void init_lookup_right_subtraction() {
|
||||||
for (int index = 0; index < 0x400 ; index++) {
|
for (int index = 0; index < 0x400 ; index++) {
|
||||||
int b16 = (index >> 5);
|
int b16 = (index >> 5);
|
||||||
uint8_t bx = (index & 0x1f);
|
uint8_t bx = (index & 0x1f);
|
||||||
|
@ -271,7 +271,7 @@ static inline void previous_left(uint8_t in, vector<cs_t> *candidate_states) {
|
||||||
state->l ^= (((uint64_t)in & 0x1f) << 20);
|
state->l ^= (((uint64_t)in & 0x1f) << 20);
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
uint8_t b6 = lookup_left_substraction[b3 | bx];
|
uint8_t b6 = lookup_left_subtraction[b3 | bx];
|
||||||
state->l = (state->l & 0x7ffffffe0ull) | b6;
|
state->l = (state->l & 0x7ffffffe0ull) | b6;
|
||||||
state->l ^= (((uint64_t)in & 0x1f) << 20);
|
state->l ^= (((uint64_t)in & 0x1f) << 20);
|
||||||
|
|
||||||
|
@ -1050,8 +1050,8 @@ int main(int argc, const char *argv[]) {
|
||||||
|
|
||||||
std::thread foo_left(init_lookup_left);
|
std::thread foo_left(init_lookup_left);
|
||||||
std::thread foo_right(init_lookup_right);
|
std::thread foo_right(init_lookup_right);
|
||||||
std::thread foo_leftsub(init_lookup_left_substraction);
|
std::thread foo_leftsub(init_lookup_left_subtraction);
|
||||||
std::thread foo_rightsub(init_lookup_right_substraction);
|
std::thread foo_rightsub(init_lookup_right_subtraction);
|
||||||
|
|
||||||
foo_left.join();
|
foo_left.join();
|
||||||
foo_right.join();
|
foo_right.join();
|
||||||
|
|
|
@ -160,7 +160,7 @@
|
||||||
(Mikron's European Patent EP 0473569 A2 was filed 23 August 1991, with a
|
(Mikron's European Patent EP 0473569 A2 was filed 23 August 1991, with a
|
||||||
priority date of 23 Aug 1990.)
|
priority date of 23 Aug 1990.)
|
||||||
Mikron was subsequently acquired by Philips Semiconductors in 1995.
|
Mikron was subsequently acquired by Philips Semiconductors in 1995.
|
||||||
Philips Semiconductors divsion subsequently became NXP.
|
Philips Semiconductors division subsequently became NXP.
|
||||||
|
|
||||||
+ Modulation read/write device -> transponder: 100 % ASK and binary pulse
|
+ Modulation read/write device -> transponder: 100 % ASK and binary pulse
|
||||||
length coding
|
length coding
|
||||||
|
|
|
@ -67,7 +67,7 @@ static unsigned int profiles[11][2] = {
|
||||||
{ 16384, 5 }, // 0, best for Intel GPU's with Neo
|
{ 16384, 5 }, // 0, best for Intel GPU's with Neo
|
||||||
{ 8192, 6 }, // 1, only for Intel NEO
|
{ 8192, 6 }, // 1, only for Intel NEO
|
||||||
{ 4096, 7 }, // 2 (old 0) seems the best for all others (also NVIDIA) :D Apple/Intel GPU's stable here
|
{ 4096, 7 }, // 2 (old 0) seems the best for all others (also NVIDIA) :D Apple/Intel GPU's stable here
|
||||||
{ 2048, 8 }, // 3 (old 1) usefull for any kind of CPU's
|
{ 2048, 8 }, // 3 (old 1) usefulfor any kind of CPU's
|
||||||
{ 1024, 9 },
|
{ 1024, 9 },
|
||||||
{ 512, 10 },
|
{ 512, 10 },
|
||||||
{ 256, 11 },
|
{ 256, 11 },
|
||||||
|
@ -1008,7 +1008,7 @@ int main(int argc, char **argv) {
|
||||||
exit(3);
|
exit(3);
|
||||||
}
|
}
|
||||||
|
|
||||||
// at this point z is the max value, still usefull for free's
|
// at this point z is the max value, still usefulfor free's
|
||||||
|
|
||||||
#if DEBUGME > 0
|
#if DEBUGME > 0
|
||||||
printf("[debug] Lower profile between %u device(s) is: %d\n", selected_devices_cnt, profile);
|
printf("[debug] Lower profile between %u device(s) is: %d\n", selected_devices_cnt, profile);
|
||||||
|
|
|
@ -25,7 +25,7 @@ License: GNU General Public License v3 or any later version (see LICENSE.txt)
|
||||||
#include "opencl.h"
|
#include "opencl.h"
|
||||||
|
|
||||||
bool plat_dev_enabled(unsigned int id, unsigned int *sel, unsigned int cnt, unsigned int cur_type, unsigned int allow_type) {
|
bool plat_dev_enabled(unsigned int id, unsigned int *sel, unsigned int cnt, unsigned int cur_type, unsigned int allow_type) {
|
||||||
// usefull only with devices
|
// usefulonly with devices
|
||||||
if (allow_type != CL_DEVICE_TYPE_ALL) {
|
if (allow_type != CL_DEVICE_TYPE_ALL) {
|
||||||
if (cur_type != allow_type) return false;
|
if (cur_type != allow_type) return false;
|
||||||
}
|
}
|
||||||
|
@ -404,7 +404,7 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
|
||||||
(*cd_ctx)[platform_idx].device[device_idx].is_apple_gpu = (*cd_ctx)[platform_idx].device[device_idx].is_gpu;
|
(*cd_ctx)[platform_idx].device[device_idx].is_apple_gpu = (*cd_ctx)[platform_idx].device[device_idx].is_gpu;
|
||||||
}
|
}
|
||||||
|
|
||||||
// force profile to 0 with Intel GPU and 2 wih Intel CPU's
|
// force profile to 0 with Intel GPU and 2 with Intel CPU's
|
||||||
if ((*cd_ctx)[platform_idx].is_intel) {
|
if ((*cd_ctx)[platform_idx].is_intel) {
|
||||||
if ((*cd_ctx)[platform_idx].device[device_idx].is_gpu) {
|
if ((*cd_ctx)[platform_idx].device[device_idx].is_gpu) {
|
||||||
(*cd_ctx)[platform_idx].device[device_idx].profile = 0; // Intel GPU's, work better with a very slow profile
|
(*cd_ctx)[platform_idx].device[device_idx].profile = 0; // Intel GPU's, work better with a very slow profile
|
||||||
|
@ -461,7 +461,7 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
|
||||||
if (!show && verbose) printf("%14s: %s\n", "Selected", ((*cd_ctx)[platform_idx].device[device_idx].selected) ? "yes" : "no");
|
if (!show && verbose) printf("%14s: %s\n", "Selected", ((*cd_ctx)[platform_idx].device[device_idx].selected) ? "yes" : "no");
|
||||||
|
|
||||||
if ((*cd_ctx)[platform_idx].device[device_idx].unsupported) {
|
if ((*cd_ctx)[platform_idx].device[device_idx].unsupported) {
|
||||||
printf("\n%14s: this device was not supported, beacuse of missing resources\n\n", "=====> Warning");
|
printf("\n%14s: this device was not supported, because of missing resources\n\n", "=====> Warning");
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -411,7 +411,7 @@ int main(void) {
|
||||||
{ 16384, 5 }, // 0, best for Intel GPU's with Neo
|
{ 16384, 5 }, // 0, best for Intel GPU's with Neo
|
||||||
{ 8192, 6 }, // 1, only for Intel NEO
|
{ 8192, 6 }, // 1, only for Intel NEO
|
||||||
{ 4096, 7 }, // 2 (old 0) seems the best for all others (also NVIDIA) :D Apple/Intel GPU's stable here
|
{ 4096, 7 }, // 2 (old 0) seems the best for all others (also NVIDIA) :D Apple/Intel GPU's stable here
|
||||||
{ 2048, 8 }, // 3 (old 1) usefull for any kind of CPU's
|
{ 2048, 8 }, // 3 (old 1) usefulfor any kind of CPU's
|
||||||
{ 1024, 9 },
|
{ 1024, 9 },
|
||||||
{ 512, 10 },
|
{ 512, 10 },
|
||||||
{ 256, 11 },
|
{ 256, 11 },
|
||||||
|
|
|
@ -206,7 +206,7 @@ int thread_start_scheduler(thread_ctx_t *ctx, thread_args_t *t_arg, wu_queue_ctx
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// internel err
|
// internal err
|
||||||
if (error && err == 0) {
|
if (error && err == 0) {
|
||||||
thread_destroy(ctx);
|
thread_destroy(ctx);
|
||||||
err = THREAD_ERROR_INTERNAL;
|
err = THREAD_ERROR_INTERNAL;
|
||||||
|
|
|
@ -34,10 +34,10 @@ TAG a3 76 dc df c1 42 e0 ee c6 75 a4 ca eb 0c da eb 46 a0 // 18 bytes = 16 byte
|
||||||
|
|
||||||
-------Until this line we can recover key or decrypt communication with no troubles (see mfkey64 tool)--------------------------------
|
-------Until this line we can recover key or decrypt communication with no troubles (see mfkey64 tool)--------------------------------
|
||||||
|
|
||||||
TAG 52 6e af 8b // nested auth encrypted tag nonce that we dont know
|
TAG 52 6e af 8b // nested auth encrypted tag nonce that we don't know
|
||||||
8e 21 3a 29 a4 80 7e 02 // nr_enc = nr^ks1, ar_enc = ar^ks2
|
8e 21 3a 29 a4 80 7e 02 // nr_enc = nr^ks1, ar_enc = ar^ks2
|
||||||
TAG b9 43 74 8d // at_enc = at^ks3
|
TAG b9 43 74 8d // at_enc = at^ks3
|
||||||
e2 25 f8 32 // probably next command (actually is read block cmd, but we dont know it yet)
|
e2 25 f8 32 // probably next command (actually is read block cmd, but we don't know it yet)
|
||||||
TAG 1f 26 82 8d 12 21 dd 42 c2 84 3e d0 26 7f 6b 2a 81 a9 // probably data
|
TAG 1f 26 82 8d 12 21 dd 42 c2 84 3e d0 26 7f 6b 2a 81 a9 // probably data
|
||||||
ba 85 1d 36 // probably read cmd
|
ba 85 1d 36 // probably read cmd
|
||||||
TAG 62 a8 78 69 ee 36 22 16 1c ff 4b 4e 69 cb 27 c2 e8 7e // probably data
|
TAG 62 a8 78 69 ee 36 22 16 1c ff 4b 4e 69 cb 27 c2 e8 7e // probably data
|
||||||
|
|
|
@ -127,7 +127,7 @@ static int param_gethex_to_eol(const char *line, int paramnum, uint8_t *data, in
|
||||||
}
|
}
|
||||||
|
|
||||||
if (*datalen >= maxdatalen) {
|
if (*datalen >= maxdatalen) {
|
||||||
// if we dont have space in buffer and have symbols to translate
|
// if we don't have space in buffer and have symbols to translate
|
||||||
return 2;
|
return 2;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -113,7 +113,7 @@ static int param_gethex_to_eol(const char *line, int paramnum, uint8_t *data, in
|
||||||
}
|
}
|
||||||
|
|
||||||
if (*datalen >= maxdatalen) {
|
if (*datalen >= maxdatalen) {
|
||||||
// if we dont have space in buffer and have symbols to translate
|
// if we don't have space in buffer and have symbols to translate
|
||||||
return 2;
|
return 2;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -74,7 +74,7 @@ Recovering key for:
|
||||||
{enc7}: 4abd964b07d3563aa066ed0a2eac7f6312bf
|
{enc7}: 4abd964b07d3563aa066ed0a2eac7f6312bf
|
||||||
{enc8}: 9f9149ea
|
{enc8}: 9f9149ea
|
||||||
|
|
||||||
LFSR succesors of the tag challenge:
|
LFSR successors of the tag challenge:
|
||||||
nt': 76d4468d
|
nt': 76d4468d
|
||||||
nt'': d5f3c476
|
nt'': d5f3c476
|
||||||
|
|
||||||
|
|
|
@ -40,7 +40,7 @@ int main(int argc, char *argv[]) {
|
||||||
printf(" {nr_1}: %08x\n", nr1_enc);
|
printf(" {nr_1}: %08x\n", nr1_enc);
|
||||||
printf(" {ar_1}: %08x\n", ar1_enc);
|
printf(" {ar_1}: %08x\n", ar1_enc);
|
||||||
|
|
||||||
// Generate lfsr succesors of the tag challenge
|
// Generate lfsr successors of the tag challenge
|
||||||
printf("\nLFSR successors of the tag challenge:\n");
|
printf("\nLFSR successors of the tag challenge:\n");
|
||||||
uint32_t p64 = prng_successor(nt, 64);
|
uint32_t p64 = prng_successor(nt, 64);
|
||||||
printf(" nt': %08x\n", p64);
|
printf(" nt': %08x\n", p64);
|
||||||
|
|
|
@ -44,7 +44,7 @@ int main(int argc, char *argv[]) {
|
||||||
printf(" {nr_1}: %08x\n", nr1_enc);
|
printf(" {nr_1}: %08x\n", nr1_enc);
|
||||||
printf(" {ar_1}: %08x\n", ar1_enc);
|
printf(" {ar_1}: %08x\n", ar1_enc);
|
||||||
|
|
||||||
// Generate lfsr succesors of the tag challenge
|
// Generate lfsr successors of the tag challenge
|
||||||
printf("\nLFSR successors of the tag challenge:\n");
|
printf("\nLFSR successors of the tag challenge:\n");
|
||||||
uint32_t p64 = prng_successor(nt0, 64);
|
uint32_t p64 = prng_successor(nt0, 64);
|
||||||
uint32_t p64b = prng_successor(nt1, 64);
|
uint32_t p64b = prng_successor(nt1, 64);
|
||||||
|
|
|
@ -58,7 +58,7 @@ int main(int argc, char *argv[]) {
|
||||||
printf("\n");
|
printf("\n");
|
||||||
}
|
}
|
||||||
|
|
||||||
// Generate lfsr succesors of the tag challenge
|
// Generate lfsr successors of the tag challenge
|
||||||
printf("\nLFSR successors of the tag challenge:\n");
|
printf("\nLFSR successors of the tag challenge:\n");
|
||||||
uint32_t p64 = prng_successor(nt, 64);
|
uint32_t p64 = prng_successor(nt, 64);
|
||||||
printf(" nt': %08x\n", p64);
|
printf(" nt': %08x\n", p64);
|
||||||
|
|
|
@ -69,7 +69,7 @@
|
||||||
# Block 59: Success: isOk:01
|
# Block 59: Success: isOk:01
|
||||||
# Block 63: Success: isOk:01
|
# Block 63: Success: isOk:01
|
||||||
#
|
#
|
||||||
# Thats it! Your S50 7byte UID card is wiped back. Now you can return back to Step 1 of this manual.
|
# That's it! Your S50 7byte UID card is wiped back. Now you can return back to Step 1 of this manual.
|
||||||
#
|
#
|
||||||
#
|
#
|
||||||
|
|
||||||
|
|
|
@ -21,7 +21,7 @@
|
||||||
# GNU General Public License for more details.
|
# GNU General Public License for more details.
|
||||||
#
|
#
|
||||||
#
|
#
|
||||||
# Dependecies:
|
# Dependencies:
|
||||||
#
|
#
|
||||||
# pip3 install pexpect ansicolors
|
# pip3 install pexpect ansicolors
|
||||||
#
|
#
|
||||||
|
@ -247,10 +247,10 @@ def main():
|
||||||
must_update_fw = 1
|
must_update_fw = 1
|
||||||
|
|
||||||
if flash_mem in msg:
|
if flash_mem in msg:
|
||||||
print("[+] Flash memory accessable ", color('[OK]', fg='green'))
|
print("[+] Flash memory accessible ", color('[OK]', fg='green'))
|
||||||
res += 1
|
res += 1
|
||||||
else:
|
else:
|
||||||
print("[-] Flash memory accessable ", color('[FAIL]', fg='red'))
|
print("[-] Flash memory accessible ", color('[FAIL]', fg='red'))
|
||||||
|
|
||||||
# extract slow clock and verify its OK...
|
# extract slow clock and verify its OK...
|
||||||
# slow clock check:
|
# slow clock check:
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue