Commit Graph
21278 Commits
Author SHA1 Message Date
Iceman 5b1fb71102 Merge pull request #3145 from kormax/vas-improvements
Add support for reading multiple pass type identifiers in VAS
2026-03-18 06:32:21 +07:00
kormax a4b1c745f0 If VAS mode is not given, choose one based on pass type id count 2026-03-17 22:03:36 +02:00
kormax 3da63fafcd Print VAS OSE information in 'hf vas reader' only if 'verbose' argument is given 2026-03-17 21:55:27 +02:00
Iceman 2bd3ce76fc Merge pull request #3142 from erland-ca/correct-EmGetCmd-return-value
Correct return value type int in EmGetCmd
2026-03-18 02:01:05 +07:00
Iceman a895fcfd5b Merge pull request #3143 from Antiklesys/master
Added `hf iclass blacktears` command
2026-03-18 01:50:32 +07:00
kormax ff052e8ee2 Add support for reading multiple pass type identifiers in VAS 2026-03-17 20:42:39 +02:00
Antiklesys f10d52a8a9 Update cmdhficlass.c
Updated logic to support debit key
2026-03-17 22:20:55 +08:00
Erland Waldreus d281724ca8 Correct return value type int in EmGetCmd
The return false would trigger unwanted behaviour as emulation completed with button pressed.
2026-03-17 15:17:50 +01:00
Antiklesys 2ea01f765e Merge branch 'master' of https://github.com/Antiklesys/proxmark3 2026-03-17 22:09:02 +08:00
Antiklesys e768a1d9ad Update cmdhficlass.c 2026-03-17 22:08:41 +08:00
Antiklesys 8b1922eeb4 Updated command description
Updated description

Signed-off-by: Antiklesys <syselkitna@gmail.com>
2026-03-17 22:00:48 +08:00
Antiklesys b91ef4adaf Implemented hf iclass blacktears
Added `hf iclass blacktears` command to perform an automated tearoff of block 1 to set non-secure page mode.
2026-03-17 21:53:16 +08:00
Iceman 9dee44a1ce Merge pull request #3138 from kormax/felica-node-discovery-adjustments
Skip nodes with PIN attribute when performing node discovery with RequestService in FeliCa
2026-03-17 15:46:12 +07:00
Iceman d285ac4dd9 Merge pull request #3137 from kormax/hint-aid-select-response-matching
Allow to detect which exact app implements AID via matching response data
2026-03-17 15:13:03 +07:00
kormax e52c2f79fc Skip nodes with PIN attribute when performing node discovery with RequestService in FeliCa 2026-03-16 19:45:30 +02:00
kormax 215ac24edb Allow to detect which exact app implements AID via matching response data 2026-03-16 19:32:35 +02:00
Iceman cd7481fa78 Merge pull request #3135 from kormax/aliro-bitmask-print-format
Improve aliro bitmask print format
2026-03-15 16:03:37 +07:00
kormax 5cbae8fc12 Update signaling bitmask print format in Aliro 2026-03-15 11:00:52 +02:00
Iceman 493dfbf928 Merge pull request #3133 from kormax/aliro-vas-maintenance
Aliro & VAS maintenance
2026-03-15 16:00:19 +07:00
kormax ec3b249d30 Remove redundant methods from Aliro/VAS, make private key load helpers universal 2026-03-15 10:08:30 +02:00
Iceman f504af8a04 Merge pull request #3134 from xNovyz/st25tb-tearoff-speedup
hf 14b tearoff: speed up tear-off loop timings
2026-03-15 14:08:31 +07:00
Iceman 9b016d79c1 Merge pull request #3132 from kormax/google-smart-tap
Add `hf gst` commands
2026-03-15 14:06:17 +07:00
xNovyz 6b5eee46af hf 14b tearoff: dramatically speed up tear-off loop timings
- Reinitialize BigBuf memory before FpgaSetupSsc to reset PDC internal buffer pointers
- With properly reset DMA pointers, the field stabilization time can be safely reduced from 5.0ms down to 0.25ms (which matches the timing originally intended by the near-field-chaos patch)
- Further reduced the ST25TB charge capacitor drain wait time from 10ms to an aggressive 0.5ms (the tRST minimum specified in ST25TB datasheet)
2026-03-14 22:44:12 +01:00
kormax 892559ac05 Add tests for zlib support 2026-03-14 22:16:59 +02:00
kormax c8a4314353 Add hf gst commands 2026-03-14 17:34:58 +02:00
Iceman 190f6265c2 Merge pull request #3131 from q0jt/master
Improve felica validation and cleanup handling
2026-03-14 11:06:23 +07:00
Iceman d962e30856 Merge pull request #3124 from xNovyz/hf-14b-tearoff
Hf 14b tearoff
2026-03-14 10:52:32 +07:00
q0jt 661634649a Fix reject responses with invalid CRC 2026-03-14 03:45:22 +09:00
q0jt 08a90b9eba Fix correct status flag error handling in authentication flow 2026-03-14 03:36:57 +09:00
q0jt bf0abf3ee1 Fix avoid double free in CmdHFFelicaReader 2026-03-14 03:22:42 +09:00
Iceman 465e5e6a9c Merge branch 'master' into hf-14b-tearoff
Signed-off-by: Iceman <iceman@iuse.se>
2026-03-13 22:14:20 +07:00
Iceman 147a19eca0 Merge pull request #3129 from kormax/vas-info
Implement 'hf vas info' command
2026-03-13 22:13:26 +07:00
Christian Zanon 5b2e805c73 Update start delay comment
Signed-off-by: Christian Zanon <105173223+xNovyz@users.noreply.github.com>
2026-03-13 13:02:34 +01:00
Christian Zanon b9ddb038b7 Merge branch 'master' into hf-14b-tearoff
Signed-off-by: Christian Zanon <105173223+xNovyz@users.noreply.github.com>
2026-03-13 11:39:06 +01:00
iceman1001 b801cddf13 fix @zerochaos compiler warning 2026-03-13 12:33:47 +07:00
kormax 0ab4cc161b Implement 'hf vas info' command 2026-03-13 07:06:04 +02:00
Iceman 6b3670f95d Merge pull request #3130 from Antiklesys/master
Updated hg iclass legrec
2026-03-13 11:38:41 +07:00
Iceman cfaddb067b Merge pull request #3128 from kormax/android-hce-aid
Refine known AIDs; add Android HCE
2026-03-13 11:38:10 +07:00
Antiklesys 61d20368af Updated hg iclass legrec
Code cleanup removed unused variables
2026-03-13 12:23:35 +08:00
xNovyz 52676ebbd4 style: whitespace fixes 2026-03-11 22:41:21 +01:00
xNovyz 286df8f4eb feat(14b): add interactive hf 14b tearoff command
Add an interactive command for performing tear-off attacks on ST25TB/SRx
monotonic counter blocks. This exploits EEPROM tearing to increment
counters that normally can only be decremented, based on the
near-field-chaos project by SecLabz.

The command sweeps tear-off timing from --start downward in --adj
microsecond steps, automatically consolidates partial writes, verifies
stability across multiple reads, and reports progress in real-time with
color-coded output.

Performance optimizations:
- One-time full iso14443b_setup() at start; subsequent field cycles use
  lightweight tearoff_field_on()/tearoff_field_off() that skip FPGA
  bitstream reload and buffer reallocation
- Periodic CMD_WTX keepalives to prevent USB timeouts during long attacks
- Calls FpgaResetBitstream() on exit to ensure clean FPGA state

Usage: hf 14b tearoff -b <block> -d <target> [--start <us>] [--adj <us>]
2026-03-11 21:43:37 +01:00
kormax 24d1fe79f8 Refine known AIDs; add Android HCE 2026-03-11 20:45:24 +02:00
Iceman 94ba21485d Merge pull request #3125 from pingu2211/standalone-mode-docs
Standalone mode Documentation
2026-03-11 16:00:20 +07:00
pingu2211 3d5f1df093 Pull docs out for all the existing stand alone modes, including a diagram and what do the lights mean, so users don't have to go digging in source code 2026-03-11 14:57:06 +11:00
Iceman 89c10a4b06 Merge pull request #3119 from jof/vanderbilt-act-key
mfc: dic: Vanderbilt ACT
2026-03-11 10:39:19 +07:00
Iceman 87d6d1563f Merge pull request #3123 from cindersocket/feat-wiegand-improvement
Improve Wiegand PACS encode/decode and add verbose output
2026-03-11 10:38:31 +07:00
Iceman 3d6e805cb9 Merge branch 'master' into feat-wiegand-improvement
Signed-off-by: Iceman <iceman@iuse.se>
2026-03-11 10:37:47 +07:00
Iceman 7c6f91bdfb Merge pull request #3120 from pingu2211/gallagher-mifare-classic
Add MIFARE Classic Reading and Writing to HF Gallagher
2026-03-11 10:32:17 +07:00
pingu2211 7d7903deed Feedback from Iceman.
Now respecting quiet flag for continuous reads.
Return Correct PM3 _* return codes.
2026-03-11 09:38:13 +11:00
CinderSocket 08cd96c5a9 Improve Wiegand PACS encode/decode and verbose output 2026-03-10 15:32:25 -07:00