a0efcb2686
fix data crypt - output error. We have 8 bytes.
2025-10-17 08:53:54 +02:00
11fe8f783a
Add --skip to hw tearoff, to cope with more complex commands. Example provided for hf mfu wrbl
2025-10-09 22:26:52 +02:00
4aac77aaa2
support for Ultralight AES auth in hf mfu info/rdbl/wrbl/dump/ndefread/wipe/setkey
2025-10-04 02:00:23 +02:00
b097e10aa3
this commit refactors the signature checks. First we introduce a common pm3 generic private / public key pair in order to allow for users to self sign their own modded device. The verification checks now looks at both hard coded public keys. If a vendor wants to add their own public key thus allowing for a simple way for us to identify their devices they can now do so. The downside is that the firmware mismatch detection becomes a bit dodgy. mem info; mem info -v; mem info -s -p <filename.pem>; mem info -s -p <filename.pem> -w contains the changes. OBS! when -w be careful to not overwrite your genuine RDV4 signature. As always, with great power comes great responsibility
2025-09-25 19:44:36 +02:00
944a80d217
make style
2025-09-21 16:41:30 +03:00
c3e29789a9
added a --override MAD crc check parameter to NDEF read commands
2025-08-29 13:55:00 +02:00
48724e44b4
hf mf sim: add --allowover option, needed for RF08S originality check
2025-07-25 20:54:18 +02:00
5de4dd68e5
text
2025-06-22 20:34:54 +02:00
65607fc727
added Ultralight-C simulation. hf mfu sim -t 13. Use eload first. Also added support to upload UL-C dictionaries and UL-AES to spiffs memory. A lot of textual reworked across client. Unifiy texts and a bit more color ;)
2025-06-19 17:26:20 +02:00
804acfbefa
the device side of iclass tear off is implemented. The base was done by @antiklesys. This version differs by the concept of trying to stabilize weak bits by performing a write operation in conjuction with the detected tear. Its untested but I can replicate most of the tears we performed client side. You will need to call the proxmark3 client with -f , ./pm3 -f to force flush out text which is needed for the inplace printing. I thought this was done automatically but it wasnt. hf iclass tear --arm + all the normal params to run on device side
2025-05-30 01:37:13 +02:00
cb4a0e2333
rename struct to follow code style
2025-04-30 13:27:41 +02:00
3550f11726
Remove mag argument from commands; Add support for magsafe polling via 14a config
2025-04-20 17:55:55 +03:00
56336d9d82
Add support for polling loop annotations
2025-04-09 12:31:21 +03:00
87c2e82e2f
style
2025-03-19 12:53:24 +01:00
4bde83b89d
Added lf hitag htu support for Hitag µ/8265
2025-03-19 18:56:23 +08:00
2137284a93
style\n Some improvements to trace list -t seos annotations.
2025-03-12 16:41:06 +01:00
0e2a02bdf0
Implement new command hf 15 slixprotectpage to do ISO15693_PROTECT_PAGE on slix tags
2025-03-09 11:54:51 +01:00
cef07dedf6
code style, code clean up of redundant functions, comments, its many minor fixes across the platform. Sorry for not making 20 commits
2025-02-21 15:38:33 +01:00
1acc030fd4
rework simaid & rename few vars
2025-02-12 08:44:42 +01:00
4a23fb05f0
Cherry pick POC of emv simulation
2024-11-21 19:23:03 +00:00
48ec109a1e
use all spi flash v0.1
...
* introduced a new communication command CMD_FLASHMEM_PAGES64K to get the number of 64k pages
* "the last page" is a special, holding the dicts and some other stuff, relocated to there
* raised timeout when wiping a mem page (W25Q16 looks a bit slower than W25X20BV)
* loop all pages in Flash_WipeMemory()
2024-11-17 19:03:15 +02:00
46813e0e50
hf mf isen: rewrite counters, add specific NONCE_SUPERSTATIC case (when first nt == nested nt)
2024-11-05 17:07:54 +01:00
838e0adfa7
rework Mifare simulation flags
2024-10-19 20:34:40 +02:00
079689628b
hf mf sim: add nested reader attack (needs data & rf08s nonces)
2024-10-16 19:54:03 +02:00
5b7ba3bf50
MFsim: RATS_IN_DATA was not a proper bit flag
2024-10-16 15:24:01 +02:00
a11ba61b01
hf mf ecfill: add support for quick dump via backdoor auth
2024-10-13 22:55:41 +02:00
c002ae9f77
style
2024-10-06 10:08:17 +02:00
9a50e608e0
add PM3_REASON_UNKNOWN
2024-10-04 23:25:15 +08:00
96d462acee
add: split PacketResponseNG status to status and reason
2024-09-24 03:10:53 +08:00
03fcc1d8d6
Update pm3_cmd.h
...
Signed-off-by: Adam Jon Foster <me@evildaemond.com >
2024-09-23 15:31:46 +08:00
d48d69b3e2
Update pm3_cmd.h
...
Added Header File
Signed-off-by: Adam Jon Foster <me@evildaemond.com >
2024-09-23 14:42:22 +08:00
92767a685f
Update pm3_cmd.h
...
Added RATS_IN_DATA as a definition
Signed-off-by: Adam Jon Foster <me@evildaemond.com >
2024-09-23 14:33:30 +08:00
db1b28f327
rename hts read/write commands to rdbl/wrbl to match rest of the client. added a lf hitag hts reader comamnd, modified the lf search to identify hitag2/s/82xx in the chipset detection
2024-09-14 21:00:42 +02:00
9b879b0dc0
fix: exit status
2024-09-05 19:31:37 +08:00
970c2d0999
refactor: remove positive error codes
2024-09-04 22:50:26 +08:00
c73e2ea623
Added support for collecting all fm11rf08s nT/{nT}/par_err at once
2024-09-02 23:11:36 +02:00
8928883f2d
refactor: move FPGA_BITSTREAM_* to fpga.h
2024-08-26 20:55:58 +08:00
d15537bbf1
Unified hitag naming style
2024-08-22 02:01:43 +08:00
1832997ccb
Iclass Legacy Raw Key Recovery Function
...
Based on the work described in Dismantling iClass whitepaper.
hf iclass legbrute is tested working
hf iclass legrec is partially working: logic of operations and sequence seems to be in order and was tested on simulated data to be effective. The privilege escalation part is still not successful, but the logic should be correct.
2024-07-19 14:47:13 +08:00
05df50678c
missing header
2024-04-26 16:18:10 +02:00
87c6633de1
add support for generation 2 magic command when setting UID on ISO15693 cards. ref:: https://github.com/RfidResearchGroup/proxmark3/issues/1604#issuecomment-2068444071
2024-04-22 09:04:01 +02:00
cc2bae2f4d
lf em 4x70 writekey --> lf em 4x70 setkey
2024-03-13 09:38:35 -07:00
ba83ac065e
lf em 4x70 writepin --> lf em 4x70 setpin
2024-03-13 09:25:43 -07:00
c4c1601446
added rudimentary functions for doing AES authentication against MIFARE UL AES tags. (wip)
2024-02-15 16:20:47 +01:00
dbfd8b7a6d
Make detection threshold for ISO14443A configurable
...
This adds a new command "hw sethfthresh" to configure the thresholds
used inside the FPGA while demodulating ISO14443A. The thresholds
need to be increased on particularly noisy hardware, such as certain
Chinese PM3 Easy clones.
2024-02-02 20:51:05 +01:00
303c6b6067
style
2024-01-26 12:45:23 +01:00
e22776a7e0
style
2024-01-26 20:20:25 +10:00
49f7ae57dc
Changed hf mf gdmcfg/gdmsetcfg commands to support Gen1a and GDM Alt magic wakeups
...
This was implemented with a new pair of RPCs CMD_HF_MIFARE_READBL_EX and CMD_HF_MIFARE_WRITEBL_EX
these RPCs support all combinations of read/write commands, wakeup, and auth options so
in time can replace the other MFC read/write commands too reduce armsrc code size
and complexity.
Also added config parsing for the gdm cfg block when reading with hf mf gdmcfg and
explicitly with hf mf gdmparsecfg.
2024-01-26 20:09:08 +10:00
ba578ee139
hf 15 sim, reverse uid and a shorter read from emul to get uid if none is user given
2024-01-25 00:34:05 +01:00
1d14bc38c5
Rename CMD_READ_MEM_DOWNLOAD flag.
...
It got included in pm3_cmd.lua but shouldn't be because it's not a command.
Also, the bitshift in the value upsets some versions of lua.
2024-01-24 16:36:52 +01:00
iceman1001