Philippe Teuwen
e7c4ae2b1e
hf mf isen for analyzing some static encrypted nonces MFC
2024-07-29 23:19:18 +02:00
Philippe Teuwen
de326fc772
hf mf rdbl/wrbl/rdsc/nested: support extended AUTH
2024-07-29 22:38:30 +02:00
Antiklesys
1832997ccb
Iclass Legacy Raw Key Recovery Function
...
Based on the work described in Dismantling iClass whitepaper.
hf iclass legbrute is tested working
hf iclass legrec is partially working: logic of operations and sequence seems to be in order and was tested on simulated data to be effective. The privilege escalation part is still not successful, but the logic should be correct.
2024-07-19 14:47:13 +08:00
iceman1001
2bc7c50302
changed fct names
2024-04-26 22:52:49 +02:00
Iceman
8550cf0e85
Merge pull request #2364 from xueliu/delete-duplicate-header-file
...
Delete a duplicate header file fpga.h in armsrc/appmain.c
2024-04-23 21:12:39 +02:00
Xue Liu
4216900694
- delete a duplicate header file in armsrc/appmain.c
...
Signed-off-by: Xue Liu <liuxuenetmail@gmail.com>
2024-04-23 16:34:26 +02:00
iceman1001
3f6ea0f0fc
style
2024-04-22 16:35:22 +02:00
iceman1001
c8849af5e0
This is the major changes made to the HITAG2 commands. Its heavly based on RFIDLers implementation and its been converted to work with Proxmark3. Special thanks to @kevsecurity for his amazing implementations of the Gone in 360 Seconds paper by Roel, Flavio & Balasch. Thanks to @adamlaurie for his RFIDler project. It wouldnt been doable without it.
2024-04-22 16:20:24 +02:00
iceman1001
87c6633de1
add support for generation 2 magic command when setting UID on ISO15693 cards. ref:: https://github.com/RfidResearchGroup/proxmark3/issues/1604#issuecomment-2068444071
2024-04-22 09:04:01 +02:00
Henry Gabryjelski
cc2bae2f4d
lf em 4x70 writekey --> lf em 4x70 setkey
2024-03-13 09:38:35 -07:00
Henry Gabryjelski
ba83ac065e
lf em 4x70 writepin --> lf em 4x70 setpin
2024-03-13 09:25:43 -07:00
iceman1001
9de6f59136
modified standalone mode hf_unisniff. It now also sniffs iclass. Another option added was for hw standalone -b, which allows you to trigger a particular sniff from client. Good for debugging w/o need to recompile or upload a config file.
2024-03-06 21:07:42 +01:00
iceman1001
c544d67d2b
Thanks to the user jareckib for his solution of adding two extra blocks to t5577 in order to clone a more modern Electra tag. Find it under the extra param lf em 410x clone --electra
2024-02-16 21:21:02 +01:00
wh201906
710c8ede8e
Better hw detectreader
...
Fix regression in 5f831ee776
2024-02-16 21:52:27 +08:00
iceman1001
c4c1601446
added rudimentary functions for doing AES authentication against MIFARE UL AES tags. (wip)
2024-02-15 16:20:47 +01:00
Christian Zietz
c1b23a761c
Use struct for parameter passing in CMD_HF_ISO14443A_SET_THRESHOLDS
2024-02-03 12:09:08 +01:00
Christian Zietz
43b257ddb4
Make demodulation threshold for Legic configurable
...
This adds a new parameter to the "hw sethfthresh" command.
2024-02-02 20:51:49 +01:00
Christian Zietz
dbfd8b7a6d
Make detection threshold for ISO14443A configurable
...
This adds a new command "hw sethfthresh" to configure the thresholds
used inside the FPGA while demodulating ISO14443A. The thresholds
need to be increased on particularly noisy hardware, such as certain
Chinese PM3 Easy clones.
2024-02-02 20:51:05 +01:00
nvx
49f7ae57dc
Changed hf mf gdmcfg/gdmsetcfg commands to support Gen1a and GDM Alt magic wakeups
...
This was implemented with a new pair of RPCs CMD_HF_MIFARE_READBL_EX and CMD_HF_MIFARE_WRITEBL_EX
these RPCs support all combinations of read/write commands, wakeup, and auth options so
in time can replace the other MFC read/write commands too reduce armsrc code size
and complexity.
Also added config parsing for the gdm cfg block when reading with hf mf gdmcfg and
explicitly with hf mf gdmparsecfg.
2024-01-26 20:09:08 +10:00
iceman1001
414275802d
style
2024-01-25 01:55:07 +01:00
iceman1001
ba578ee139
hf 15 sim, reverse uid and a shorter read from emul to get uid if none is user given
2024-01-25 00:34:05 +01:00
iceman1001
a6fa662d3c
increase upload block size for 15 eload, was 64 now 256
2024-01-24 23:37:13 +01:00
iceman1001
db616ce7bf
style
2024-01-24 17:12:56 +01:00
Martijn Plak
6202da367f
coding style
2024-01-24 17:05:37 +01:00
Martijn Plak
1d14bc38c5
Rename CMD_READ_MEM_DOWNLOAD flag.
...
It got included in pm3_cmd.lua but shouldn't be because it's not a command.
Also, the bitshift in the value upsets some versions of lua.
2024-01-24 16:36:52 +01:00
iceman1001
081ff216eb
style
2024-01-23 15:28:50 +01:00
Martijn Plak
ebdd30e92c
readmem (ARM): boundary check against end of addressable space
2024-01-23 08:41:53 +01:00
Martijn Plak
e35385fde1
Adding processor flash memory reading, viewing and writing to file.
...
Works when the device is running either osimage or bootloader.
- New memory reading command in osimage and bootloader.
- Extended 'hw readmem' command with length parameter, file writing and hex viewer.
- Introduced '--dumpmem' option to proxmark3 executable to support dumping from bootloader.
Simple interactive examples:
hw readmem -f flashdump
hw readmem -l 1024
CLI example:
./pm3 --dumpmem flashdump.bin
Reading from arbitrary memory ranges can be unlocked using the 'raw' option.
2024-01-22 16:40:05 +01:00
iceman1001
70b4bee761
reworked the 14B comms. Uses NG packets now. Most raw / apdu / write / rd got some love
2024-01-16 11:37:13 +01:00
iceman1001
8d0b41a911
this commit fixes #2244 #2246 #1596 #2101 . Its kind of a big refactoring and I most likely broke something. With that said. Now: HF 15 commands now uses NG packets, hf 15 raw support -k keepfield on and -s select, hf 15 dump/rdbl/rdmulti should handle blocksizes of 4 or 8, the error messages are unified and error handling the same. Some understanding how add_option impacts response message from card. A more clear separation between PM3 flags and ISO15693 protocol flags.
2024-01-14 14:23:51 +01:00
iceman1001
82aa6ac08c
gave 14b commands some serious love and overhaul. package handling for APDU and different selects is improved. return codes now consequent
2024-01-08 21:17:42 +01:00
iceman1001
238572c337
style
2024-01-01 21:52:05 +01:00
iceman1001
f840dc810b
made keytype instead of fixed keyB. would help in situations keyB is readable...
2023-12-31 09:35:42 +01:00
iceman1001
1f4f5febae
adapt magic detection and textual output. Hf mf info - now uses found keys to send for magic detection
2023-12-30 23:08:58 +01:00
iceman1001
95d1d5646f
an attempt to reduce some stack memory. No need for the debug printing to be 512 bytes. Now limited to 200 chars
2023-12-14 23:29:43 +01:00
iceman1001
ee1534103b
make sure to turn off the antenna if entering this state
2023-12-14 00:31:09 +01:00
merlokk
2517e8b345
make style
2023-12-12 01:11:10 +02:00
merlokk
91892bc1bf
add static encrypted nonce detection
2023-12-11 21:24:26 +02:00
merlokk
ebe9d72cc2
set debug log level
2023-12-11 18:46:25 +02:00
Iceman
17a93a3b1b
Merge pull request #2173 from wh201906/lf_sniff_clean
...
Real-time LF sampling
2023-12-01 10:54:10 +01:00
Henry Gabryjelski
627cf6e3d5
Slow clock speed message update
...
Signed-off-by: Henry Gabryjelski <henrygab@users.noreply.github.com>
2023-11-14 01:52:02 -08:00
wh201906
b4cc7c02cd
Real-time LF sampling mode on armsrc
2023-11-14 01:43:20 +08:00
wh201906
9e8b1ceda7
Reduce duplicate payload structure for lf read/sniff
2023-11-14 01:05:27 +08:00
iceman1001
d137b74de7
missing
2023-11-06 23:19:46 +01:00
iceman1001
6653bffe00
coverity fixes
2023-11-06 22:58:14 +01:00
iceman1001
bf6f5518ac
fix overflow (@wh201906)
2023-11-06 17:12:03 +01:00
wh201906
2d48e33a99
Some small fix
2023-11-06 18:45:10 +08:00
wh201906
85e38ddc38
Add --ms option in hw status
...
To specify the timeout of connection speed test
2023-11-06 16:35:43 +08:00
iceman1001
5ae919d8ee
since we split the image for iclass, every time we swap back to hf / mf commands there is a penalty for swapping fpga image. this fix some allow for fast simulation part
2023-10-18 20:43:52 +02:00
iceman1001
efac735bad
added support for HID SAM picopass communications. Nasty array copying but does the trick. Will need refactoring.
2023-10-18 19:59:34 +02:00
