Commit graph

4077 commits

Author SHA1 Message Date
Iceman
16fab8bd44
Merge pull request #2899 from rfidgeek1337/patch-1
LF HITAG: Adjust timing for LF ADC measurements to increase stability when the tag is in public mode/TTF mode
2025-06-12 22:05:12 +02:00
Antiklesys
0378d91595 Minor iclass sam comms tweaks
1- Removed timeout on client side to allow the sam to be slow in responding
2- Increased SIM_WAIT_DELAY to allow for bigger sam responses
2025-06-12 19:42:56 +08:00
iceman1001
92c288ab85 style 2025-06-11 21:40:54 +02:00
iceman1001
c1729ca264 if simulation fails, lets return back 2025-06-11 21:39:58 +02:00
rfidgeek1337
f7f0605207
Update lfadc.c
Signed-off-by: rfidgeek1337 <rfidgeek1337@proton.me>
2025-06-11 18:14:19 +02:00
rfidgeek1337
2dfb0706fa
Update lfadc.c
Signed-off-by: rfidgeek1337 <rfidgeek1337@proton.me>
2025-06-11 18:13:21 +02:00
rfidgeek1337
c4e019ec60
LF HITAG: Adjust timing for LF ADC measurements to increase stability when the tag is in public mode/TTF mode
Signed-off-by: rfidgeek1337 <rfidgeek1337@proton.me>
2025-06-11 18:07:51 +02:00
iceman1001
646f1a5b97 making the spiffs write guarded if firmware was compiled with spiffs flash enabled 2025-06-11 12:27:04 +02:00
iceman1001
24d6013f10 making the spiffs write guarded if firmware was compiled with spiffs flash enabled 2025-06-11 12:26:11 +02:00
Iceman
8156274007
Merge pull request #2896 from Antiklesys/master
Added hf iclass sam --info
2025-06-10 20:39:40 +02:00
Antiklesys
7fb5716ea3 Added hf iclass sam --info
Added hf iclass sam --info command that skips any card communication command and just interacts with the SAM to return:

1- Sam Firmware Version
2- Sam Firmware ID
3- Sam Serial Number
2025-06-11 01:06:38 +08:00
Henry Gabryjelski
b5e6d21128 Make it clear that this code was *always* sending a parity bit. All the tags require the parity bit. 2025-06-09 14:54:30 -07:00
Henry Gabryjelski
31b1117a51 em4x70 --par deprecation: Step 2: arm-side always uses false 2025-06-09 12:58:50 -07:00
iceman1001
15fbfafac1 fix exit logic 2025-06-08 23:19:09 +02:00
iceman1001
2d610b8dc0 text & style 2025-06-08 10:02:00 +02:00
Antiklesys
80e1c7f0d4 Implemented hf iclass sim -t 7
Implemented an iclass sim function that prevents simulated card responses after updating block 3.
Block 3 gets updated with the XOR key as if it was in personalization mode.
2025-06-07 23:12:21 +08:00
iceman1001
6fbb13ba41 style 2025-06-07 11:50:03 +02:00
Antiklesys
f49bc8ebaa
Update iclass.c
Signed-off-by: Antiklesys <syselkitna@gmail.com>
2025-06-07 17:00:28 +08:00
Antiklesys
606f65496c
Update iclass.c
Signed-off-by: Antiklesys <syselkitna@gmail.com>
2025-06-07 16:46:44 +08:00
Antiklesys
9c672d8289
Update iclass.c
Signed-off-by: Antiklesys <syselkitna@gmail.com>
2025-06-07 16:42:49 +08:00
Antiklesys
b4edcb9510 Updated hf iclass sim -t 6
Updates to the functionality of iclass sim -t 6 to specifically target the last SIO block and to do it automatically.
It now checks the AIA to determine if the card is SR or SE and adjust the block to jam based on the SIO length declared in block 6 (if SE) or fixed length if SR.
2025-06-07 13:46:19 +08:00
Antiklesys
94794f7519 Implemented a hf iclass sim variation
hf iclass sim -t 3 variation that glitches specific block responses during read/write operations based on the value of the last byte of block 31.
2025-06-07 02:15:01 +08:00
iceman1001
f41d6fad53 style 2025-06-06 13:27:02 +02:00
Antiklesys
e68be39a41 Updated hf iclass legrec to be able to use shorter delays
Added an option for hf iclass legrec to further increase speeds by using a shorter delay of 1500 vs the default of 3390.
This seems to be stable on new silicon especially now that we're keeping the field always on.
It may be more risky for the --fast operation.
2025-06-06 16:06:53 +08:00
Antiklesys
fd098ba12f Update iclass.c 2025-06-05 21:29:01 +08:00
Antiklesys
7acf507826 Update iclass.c
Minor optimizations to remove duplicate code
2025-06-05 21:18:03 +08:00
Antiklesys
083a9ce945 Updated hf iclass legrec with a fast option and improved AA2 selection
1- Added a --fast option for hf iclass legrec that further increases the speed from 4.6 key updates/second to 7.4 key updates/second. This is achieved by skipping some safety checks and is a very fast but more risky operation.
2- Automated AA2 block selection based on the values in the config block
3- Other minor code cleanups
2025-06-05 20:44:58 +08:00
iceman1001
186ed6fb07 make style 2025-06-04 18:05:30 +02:00
Antiklesys
7225ea6ac4
Update iclass.c
Removed unused value of blockno

Signed-off-by: Antiklesys <syselkitna@gmail.com>
2025-06-04 22:46:44 +08:00
Antiklesys
81d7ac1f59
Update iclass.c
Re-added stop tracing in main loop to avoid crashes

Signed-off-by: Antiklesys <syselkitna@gmail.com>
2025-06-04 22:41:30 +08:00
Antiklesys
d654f6e78f Improved hf iclass legrec speed
Improved the speed of hficlass legrec from 7200 keys / hrs to 17800 keys / hr by removing the need to drop the field and re-select, re-authenticate with the card at every loop.
Re-select and re-authenticate will still happen if there's a read error and a loop needs to be repeated.
2025-06-04 22:34:28 +08:00
Antiklesys
2b2a1cc0a2 Updated hf iclass legrec
Updated hf iclass legrec to support pm3 button interrupt for user abort
Cleaned up messaging to look more neat and tidy during the process
2025-05-31 14:09:00 +08:00
iceman1001
749c23a6b5 iclass tear on device side , moved around debug printing not to disturb timings between reading and writing tag during stabilize weak bit phase 2025-05-30 20:46:27 +02:00
Antiklesys
23d9783b26 Updated hf iclass legrec
Updated hf iclass legrec:
1- Fixed communication timing inconsistencies by moving away from iclass_writeblock_ext to iclass_writeblock_sp which supports start_time and end_time
2- Reduced number of debug messages being printed

Overall this reduces slightly the speed of the process, but it should make it more stable as the timings are now all correctly being accounted for.
2025-05-31 02:15:13 +08:00
Antiklesys
2105dbc379
Update iclass.c
Clarified what tear success means

Signed-off-by: Antiklesys <syselkitna@gmail.com>
2025-05-30 13:05:25 +08:00
Antiklesys
c32f655023 Improved hf iclass tear erase phase readability
Improved readability of erase phase during iclass tear (client and arm side).
It is redundant to see a list of FF during the erase phase (which can be pretty lengthy), so it will only show it once when all bits are FF and then will resume printing the moment bits start changing again post erase phase.
2025-05-30 13:00:35 +08:00
Antiklesys
04cfe2a43e Modified iclass recover operations
1- Renamed legreclookup to legbrute to be in line with the command name
2- Updated estimate values with speed increase gains
3- Improved some if statements readability in iclass.c and added start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; to increase speed by ~8% (1.86 loops per second to 2.01 loops per second = ~560 more loops per hour).

Tried disabling some arm communications/comments but the speed increase was negligible (~1 sec / 1000 updates).
2025-05-30 12:36:42 +08:00
iceman1001
804acfbefa the device side of iclass tear off is implemented. The base was done by @antiklesys. This version differs by the concept of trying to stabilize weak bits by performing a write operation in conjuction with the detected tear. Its untested but I can replicate most of the tears we performed client side. You will need to call the proxmark3 client with -f , ./pm3 -f to force flush out text which is needed for the inplace printing. I thought this was done automatically but it wasnt. hf iclass tear --arm + all the normal params to run on device side 2025-05-30 01:37:13 +02:00
Iceman
90210fe588
Merge pull request #2853 from sup3rgiu/mfu-counters
Fixed SimulateIso14443aTag() to make MFU counter increments persistent in emulator memory.
2025-05-29 14:44:13 +02:00
iceman1001
b2e587afa5 missing break, migth lead to strange behavior 2025-05-28 20:51:51 +02:00
iceman1001
4e07fc2b31 if enabled but no delay, then disable tear off just in case. enforce user to set a delay. if not this function will be triggered over and over which might confuse users normal operation 2025-05-27 09:43:11 +02:00
iceman1001
4b92118f1f clear trace log before starting to run hf iclass tear 2025-05-25 11:29:43 +02:00
iceman1001
74f1936132 convert to our calloc instead since we prefer to know allocated shared memory is empty. Also removed a malloc(1) which is just a waste of bytes just like @NVX said a year ago at DefCon 2025-05-25 09:55:32 +02:00
iceman1001
b6a39768a1 text 2025-05-24 21:30:23 +02:00
iceman1001
c716467a7e fixed output for hf iclass trbl to not have tear off debug message and its more compact now 2025-05-23 10:52:09 +02:00
sup3rgiu
d5beb66508 Fixed SimulateIso14443aTag() to make MFU counter increments persistent in emulator memory.
- Fixed arguments for `SimulateIso14443aInit` in `hf_msdsal.c`, `hf_cardhopper.c`, `hf_reblay.c` and `hf_tcprst.c`.
2025-05-22 19:57:30 +02:00
iceman1001
84b565bec4 style 2025-05-19 22:31:41 +02:00
iceman1001
c847896a15 fix #2835 due to wrong variable used to calculate the size of the emulator memory to download , all get memory from emulator memory failed with a block no larger that 30-ish 2025-05-01 08:34:39 +02:00
iceman1001
42cdd34e59 fix #2834 refactored to use local pointer, no modification of input polling_parameters pointer is done. The compilation error error: initializer element is not constant .frames should be fixed. Using defines and removed some global vars 2025-04-30 18:55:07 +02:00
iceman1001
cb4a0e2333 rename struct to follow code style 2025-04-30 13:27:41 +02:00