Commit Graph

132 Commits

Author SHA1 Message Date
naaraxi 0460d9b95e Support for changing the wake time in the client 2026-05-01 14:36:52 +03:00
Niel Nielsen e16505e6a7 FEAT! Add T55 write commands 2026-04-07 10:36:06 +02:00
Niel Nielsen efa2ea2c7b protocol ISO 14443-4 and emv scan, loading json file from PM3rdv4 2026-04-07 10:23:58 +02:00
Kevin Yuan 3924ad134b Merge branch 'main' into pac-emulation 2026-04-02 14:17:42 +01:00
GameTec-live 78e78eb883 Merge pull request #396 from nieldk/feat/hf14a-sniff
feat(hf): add ISO14443A reader frame capture (hf 14a sniff)
2026-04-02 12:32:26 +02:00
Niel Nielsen d0a8ade9e4 feat(lf): add raw LF field ADC capture (lf sniff) 2026-04-02 11:16:32 +02:00
Benjamin Møller dd27081cdf Merge branch 'main' into feat/hf14a-sniff 2026-04-02 10:50:53 +02:00
Niel Nielsen 164d450f87 feat(hf): add ISO14443A reader frame capture (hf 14a sniff) 2026-04-02 07:42:26 +02:00
Niel Nielsen e02918b867 feat(lf): add EM4x05/EM4x69 reader (RTF gap protocol) 2026-04-02 07:34:16 +02:00
Kevin Yuan 69327ded7d Clean up PAC/Stanley CLI: remove debug command, accept ASCII IDs, handle unknown tag types gracefully
- Remove lf pac debug command (development-only)
- Accept both 16-hex and 8-ASCII card ID formats with 7-bit validation
- Add T55xx write command under lf pac write
- Handle unknown TagSpecificType values in slot list without crashing
- Auto-initialize slot data when setting tag type
- Simplify pac_write_to_t55xx by removing unused key parameters
2026-03-24 14:41:22 +00:00
Kevin Yuan 8442bea4c1 Add PAC/Stanley T55XX write support
Add pac_t55xx_writer() for encoding PAC card data into T55XX blocks,
along with the T5577_PAC_CONFIG (NRZ/Direct, RF/32, password-protected,
4 data blocks). Wire DATA_CMD_PAC_WRITE_TO_T55XX (3011) through the
command processor, dispatch table, and Python client.
2026-03-24 14:38:46 +00:00
Kevin Yuan 2fd1a260cf Add PAC/Stanley LF tag emulation support
Implements NRZ/Direct modulation at RF/32 for PAC/Stanley tag emulation.
The modulator encodes 8-byte ASCII card IDs into 128-bit NRZ frames
(0xFF sync + 12 UART frames) and generates PWM waveforms using constant
output levels (compare=counter_top for HIGH, compare=0 for LOW).

Firmware: modulator in pac.c, load/save/factory callbacks in lf_tag_em,
tag_emulation registration, SET/GET_EMU_ID commands (5006/5007).
CLI: pac_set/get_emu_id methods, 'lf pac econfig' command, hw slot list
display for PAC tags.
2026-03-24 14:38:46 +00:00
Kevin Yuan c494a2cc81 Add PAC/Stanley LF tag reading support
Implements NRZ/Direct modulation decoder for PAC/Stanley 125kHz cards
using SAADC ADC sampling with spike-aware threshold calibration.
The LC antenna produces brief high-amplitude transients at NRZ transitions
which are clipped before the moving-average filter to isolate the actual
data levels.
2026-03-24 14:37:25 +00:00
Jozef Bernadic 1b6701661d feat(cli): add ioProx commands 2026-03-03 16:24:26 +01:00
GameTec-live 38e3567add Merge pull request #306 from merlokk/lf_read_adc
Adds generic ADC read functionality
2026-02-07 20:42:25 +01:00
GameTec-live 3755bc24ce Merge pull request #307 from azuwis/hf-14a-config
Add `hf 14a config` to deal with badly configured cards
2026-02-06 11:19:23 +01:00
Alexandru Mazâlu 35192d9fc1 Merge branch 'RfidResearchGroup:main' into main 2026-02-03 12:49:45 +02:00
Zhong Jianxin b967bdcd98 Add hf 14a config to deal with badly configured cards 2026-02-02 20:48:03 +08:00
Konstantin Ilchenko c1b9df0e5d Added FIELD_OFF_DO_RESET support to cli hf mf econfig 2026-02-02 12:18:26 +02:00
Alexandru Mazalu c1c2b66882 Add Electra intercom tag support with slot auto switch 2026-01-24 14:45:15 +02:00
Oleg Moiseenko e2c6bfc9e1 Adds generic ADC read functionality
This introduces a new command to sample the ADC values from the LF antenna and returns them to the user.
2025-10-09 00:32:07 +03:00
GameTec-live ea2a9410b3 Merge branch 'main' into fix-senested-key-recovery 2025-09-02 19:40:39 +02:00
Derek Jamison 8c670f8554 Add LF Viking support 2025-08-29 11:00:02 -04:00
jekkos 62e904f114 Fix for static nested key recovery
When runnin static nested recovery, we run into a sector auth faild
error that stops the recovery process. Add a try/execpt handler so we
can continue to try all possibitlities
2025-08-28 21:55:06 +02:00
GameTec-live 09870c3fc5 Merge pull request #276 from Foxushka/ultralight-key-log
Mifare Ultralight key logger from reader
2025-08-19 19:59:39 +02:00
GameTec-live 039c54a62f Merge pull request #279 from TeCHiScy/hidcopy
feat: offline HIDProx tag copy
2025-08-14 07:25:30 +02:00
TeCHiScy b4c1c63698 feat: offline HIDProx tag copy
- refines comments
- use unified code for `lf tag not found` error
- merge lf_em410x_data.h & lf_hidprox_data.h, remove unused macros
- split btn_fn_copy_ic_uid as btn_fn_copy_lf & btn_fn_copy_hf
- fixes offline em410x tag copy not working
- fixes conflict SAADC usage between battery level service & lf fsk demodulator
2025-08-11 21:01:04 +08:00
Foxushka dc28a82b19 Mifare Ultralight key logger from reader 2025-08-10 21:39:08 +03:00
unkernet 89e098c773 Make CLI compatible with Python 3.9
- Replace Python 3.10+ type hint syntax (`int | None`) with  `Union[int, None]`.
- Add explicit `byteorder='big'` argument to all `int.from_bytes()` calls.
2025-08-10 14:44:40 +07:00
TeCHiScy 098e0a914b feat: add lf HIDProx read, t55xx write, emulate function (#267)
* feat: add lf HIDProx read, t55xx write, emulate function

code quaility:
- consistance: simulation -> emulation, label -> tag
- machine translated unreadable comments are made native

logic:
- newly added cli command includes: `lf hid prox read`, `lf hid prox write`, `lf hid prox econfig`
- machester demodulator is simplified
- various wiegand formats of HIDProx are supported
- goertzel algorithm is used in  HIDProx FSK demod
- lf read is refactored using stream/feed pattern to boost scan speed
- t55xx write is refactored to share same logic between em410x & HIDProx
- lf emulating is refactored to use PWM peripheral, allowing more card type to be added

closes: #212, #210

* chore: remove not implemented wiegand format comments

* fix: build ci

* fix: build ci

* fix: build ci

* fix: build ci
2025-08-04 07:01:53 +02:00
Foxushka cf00761902 Key recovery via backdoor for static encrypted nonce cards (#263)
* Implement MF1_ENC_NESTED_ACQUIRE in firmware

* Implement MF1_ENC_NESTED_ACQUIRE in software + fix code formatter

* Remove xz and pthreads from sources, use CMake FetchContent

* Update changelog

* lzma.h

* Update CMakeLists.txt

* Update CMakeLists.txt

* Probably fix workflow taking wrong commit for building

* Fix CMake building tools into bin/Debug on Windows

* Added cmd for fetching all slots nicks (without 16 commands)

* Fix type and use temp directory instead cwd (https://github.com/RfidResearchGroup/ChameleonUltra/pull/261)

* Fix endian for mfu_read_emu_counter_data and mfu_write_emu_counter_data

* Fix  --key interpreted as list
2025-08-01 22:12:07 +02:00
AbyssAndromalius 303d2d31e1 Mifare Ultralight - Shadowmode (#251)
* Adding shadow mode to UltraLight

* Syncing with main repos

---------

Co-authored-by: AbyssAndromalius <abyss@barbed.fr>
2025-04-21 18:04:24 +02:00
zeusricote 2b0d02f12e complete hardnested attack implementation (#254)
* hardnested test fixed, increased timeout on mf1_hard_nested_acquire to fix cmd exec timeout on clone

* hardnested recovery(cli command not yet ready), based in noproto/HardnestedRecovery

* removed compiled binary

* Hardnested cli ready

* removed some unnecesary files

* removed unnecesary cached files

* cmake now builds hardnested too

* removed license.md

* added liblzma source(should fix checks not passing)

* i missed a line

* trimmed xz sources

* cmake now links local liblzma.a

* third try(warning solved)

* cmake now builds and links correcctly liblzma.a

* xz-5.8.1 vfolder renamed to xz

* fixed paths

* runner test

* removed wrong placed check

* disable landlock under windows

* missing files

* missing files

* windows strtok fix

* corrected lzma path under windows

* fix

* set release config for liblzma

* corrected path

* trailing_zeros

* msclock

* msclock integer issue

* msclock missing header

* fallback if not using msvc

* deleted include by accident

* revert clock change

* change custom target for custom command

* windows fmemopen implementation

* wrong path

* wrong name

* use fmemopen only when not using msvc

* use fmemopen.h when building on windows, non msvc

* re-add static link

* wrong filename

* pthread handling for mingw(proxspace)

* cleanup
2025-04-18 23:53:25 +02:00
dxl 3f6f5ac9c1 Hardnested nonces acquire implemented. 2025-04-02 12:32:27 +08:00
dxl a4b3adad48 Reuse the 'STATUS_PAR_ERR' & Add an interface
1. Added 'cmd_processor_mf0_ntag_get_emu_page_count' interface to get available page count of mf0.
2. We can reuse the 'STATUS_PAR_ERR', and we can delete repeated cmd 'STATUS_INVALID_PARAMS'.
2024-07-16 12:47:47 +08:00
turbocool3r 607df41bca Add a command to reset MF0 / NTAG unsuccessful auth counter. 2024-07-09 21:30:27 +03:00
turbocool3r 0ce920cfcc Add hf mfu ercnt/ewcnt commands for reading and writing emulator's counters. 2024-07-09 17:11:42 +03:00
turbocool3r 37f2b0783c Add hf mfu eload command. 2024-07-08 00:33:33 +03:00
turbocool3r 297cb061cb Add support for custom version and signature data for MF0 / NTAG emulator. 2024-07-05 16:30:38 +03:00
turbocool3r eafa14e4e5 Add hf mfu eview command. 2024-07-05 03:32:23 +03:00
turbocool3r 9488127531 Add commands for reading and writing to/from MF0/NTAG emulator memory. 2024-07-05 02:58:15 +03:00
turbocool3r 248f3b2839 Add support for Ultralight emulation.
This version only emulates MF0ICU1 properly.
2024-06-19 22:55:43 +03:00
戴均民 c1eb213d4a Added command to check keys of multiple sectors at once (#199)
thx @taichunmin
2024-03-07 15:07:12 +08:00
taichunmin e79568298f Added support for mifare classic value block operations 2023-11-13 23:38:56 +08:00
Philippe Teuwen ece5e79060 typechecking fixes 2023-10-24 23:44:56 +02:00
Philippe Teuwen d77e166249 pep287 2023-10-24 00:57:44 +02:00
Philippe Teuwen ff3df15278 misc lint 2023-10-23 23:57:23 +02:00
Philippe Teuwen fa0754aed2 cli: make status an enum. rename some status for consistency 2023-10-17 23:43:25 +02:00
Philippe Teuwen 830ba98721 cli: move enums to new file 2023-10-15 01:17:34 +02:00
Philippe Teuwen 75e368da62 cli: hf mf econfig, hf mfu econfig (wip), fix dumphelp 2023-10-09 21:23:17 +02:00