Commit Graph
22377 Commits
Author SHA1 Message Date
Philippe Teuwen 76dfb643d3 pm5 instructions 2026-08-20 17:37:58 +02:00
iceman1001 a9b98819bb fix not assigned warning 2026-08-20 17:20:45 +02:00
Iceman 7223422070 Update Proxmark5-Instructions.md
Signed-off-by: Iceman <iceman@iuse.se>
2026-08-20 17:00:02 +02:00
Iceman 3cbdfe3c1e Merge pull request #3475 from nemanjan00/fix/pm5-flash-mode-bpr-hick
fix(pm5): run flash-mode check on HICK before raising PLL clock
2026-08-20 21:52:18 +07:00
Iceman a7c696b9a0 Merge branch 'master' into fix/pm5-flash-mode-bpr-hick
Signed-off-by: Iceman <iceman@iuse.se>
2026-08-20 21:52:08 +07:00
nffq e9c61bca79 allow to break out of fm11_verify_candidates 2026-08-20 16:51:43 +02:00
nffq aca26117c0 fix: fm11_propagate_key_reuse_online always shows key A == key B when key B is read 2026-08-20 16:51:43 +02:00
Iceman d9066e365d Merge pull request #3481 from nemanjan00/doc-pm5-fpga-config-poweron
doc(pm5): run `hf 14a read` before `hw fpga config` to power on the FPGA
2026-08-20 21:48:03 +07:00
Iceman 45ac9fdfad Merge branch 'master' into doc-pm5-fpga-config-poweron
Signed-off-by: Iceman <iceman@iuse.se>
2026-08-20 21:47:12 +07:00
Iceman a746369cbe Merge pull request #3470 from corollary-de/mfdes-chk-keylogic
Fixes to key loading logic for mfdes chk
2026-08-20 21:46:04 +07:00
Iceman 4f410992d4 Merge branch 'master' into mfdes-chk-keylogic
Signed-off-by: Iceman <iceman@iuse.se>
2026-08-20 21:45:52 +07:00
Iceman 6151b26367 Merge pull request #3453 from trichimtrich/fix/iclass-unhash-preimage-enumeration
fix hf iclass unhash missing pre-images
2026-08-20 21:44:53 +07:00
Iceman f4b76715c1 Merge branch 'master' into fix/iclass-unhash-preimage-enumeration
Signed-off-by: Iceman <iceman@iuse.se>
2026-08-20 21:44:40 +07:00
Philippe Teuwen c9581bde4d rdv4_init_extflash: use same values as init_rdv4.lua 2026-08-20 15:45:57 +02:00
Nemanja Nedeljkovic f71bc53d0c fix(pm5): power on the FPGA in hw fpga config
`hw fpga config` drives the FPGA over JTAG, but on PM5 the FPGA has to be
clocked/powered first - previously that only happened as a side effect of a
reader command (e.g. `hf 14a read`), so `hw fpga config` failed if run on its
own. Bring the FPGA up in the HAL at the start of FpgaStartConfig()
(FpgaSetup24MHzClk) so the command works standalone; no doc workaround needed.
2026-08-20 15:36:17 +02:00
Philippe Teuwen 08f8dc8692 CARDHOPPER: document how to set CARDHOPPER_USB 2026-08-20 14:28:21 +02:00
Philippe Teuwen b11b85e51a CARDHOPPER: missing header 2026-08-20 14:28:21 +02:00
Chloé Franke 43e1f4db09 Merge branch 'master' into mfdes-chk-keylogic
Signed-off-by: Chloé Franke <git@corollary.de>
2026-08-20 12:21:38 +00:00
nffq 0b9d97be2b fix: FM11RF08S key recovery generates incorrect results when nt == 0 2026-08-20 13:37:34 +02:00
Nemanja Nedeljkovic 6507b8f36b feat(pm5): hf tune --rgb / lf tune --rgb - antenna RGB as a tuning meter
Adds an opt-in `--rgb` flag to the continuous `hf tune` / `lf tune` commands that
mirrors the antenna tuning level on the PM5 antenna RGB LED: blue = low, green =
mid, red = high, tracking the on-screen bar so you can find coupling (e.g. an
implant) by feel without watching the screen.

The colour is computed client-side from the same per-iteration voltage / running
peak the bar uses (so it matches the bar and auto-scales), and pushed to the
device via a new dumb CMD_PM5_RGB_SET {r,g,b}. That command is handled (#ifdef
PM5) by a dedicated AT32 RGB HAL module, common_arm/rgb/{rgb_apis.h,
rgb_hw_at32.c} (RgbLedSet(), I2C controller @ 0x48), wired into the armsrc
Makefile/CMake as SRC_RGB for PM5 only - so no other platform is affected and no
hardware code lands in shared files.
2026-08-20 11:55:55 +02:00
Iceman ad4a94b1a5 Merge pull request #3480 from s00se/spinlock-api-gate
Add API check to Android spinlock shim
2026-08-20 16:24:33 +07:00
Nemanja Nedeljkovic ba315d8d58 fix(pm5): suppress bogus [FPGA] version section on PM5
PM5's FPGA (Gowin GW1NR) bitstream is loaded at runtime via `hw fpga config`
and is not compiled into the firmware; only the Xilinx fpga_pm3_hf.bit is pulled
in (to generate g_fpga_version_information[]) which PM5 never runs. So the
`[ FPGA ] fpga_pm3_hf.ncd image 2s30vq100` line described a bitstream unrelated
to the actual device.

- Firmware (appmain.c): omit the [FPGA] section from the version string on PM5
  (#ifndef PM5), since there's no meaningful built-in FPGA version to report.
- Client (cmdhw.c): skip the FPGA_TYPE "chip mismatch" check for PM5, which would
  otherwise trigger now that the section is gone.
2026-08-20 10:36:09 +02:00
Nemanja Nedeljkovic 36027b48e6 fix(pm5): report PM5 in hw status [Model] firmware line
The [Model] section only distinguished RDV4 firmware from a "PM3 GENERIC"
else branch, so PM5 (AT32) fell through and printed "Firmware... PM3 GENERIC"
even though the banner/Target/MCU already report PM5/AT32F437. Add an IfPm5()
branch that prints "Firmware... PM5" and the external-flash status.

Note: the "[ FPGA ] ... 2s30vq100" line in hw version is separate and comes
from the firmware-generated version string (fpga_version_info.c). On PM5 the
build reuses the Xilinx fpga_pm3_hf.bit only to generate that version info
(see Makefile.hal PM5 TODO), while the real Gowin FPGA is loaded via JTAG, so
the reported bitstream name is a placeholder. Fixing that is a firmware/build
change, not addressed here.
2026-08-20 10:36:09 +02:00
Philippe Teuwen 72d72ddc9d update extflash init scripts 2026-08-20 10:11:42 +02:00
s00se 0482fa8757 Add API check to Android spinlock shim
Android spinlock shim not needed on modern (API 24+) Android, this fixes compiling on Termux

Signed-off-by: s00se <95649696+s00se@users.noreply.github.com>
2026-08-19 20:04:03 -06:00
Philippe Teuwen cb5b3b65c8 pm5 doc: cmake for ARM 2026-08-19 22:56:46 +02:00
Philippe Teuwen 4da4eb706a Fix bug in bootrom.bin target 2026-08-19 22:18:48 +02:00
Philippe Teuwen fbfe53d0bb update pm5 doc 2026-08-19 22:02:28 +02:00
Nemanja Nedeljkovic 6da7c77427 feat(pm5): report AT32 MCU, flash size and PM5 target in hw version/status
`hw version` and `hw status` decoded the reported chip id as an Atmel AT91
CIDR. On PM5 (AT32) the id is an ARM DBGMCU IDCODE, so it showed
"MCU Unknown", a bogus flash size (32 KB / 973% used) and "PM3 GENERIC".

- Client: when IfPm5(), print MCU "AT32F437" and the real flash size, and add
  a "PM5" target line, instead of running the AT91 decode.
- Firmware: the flash size can't be derived from the AT32 IDCODE, so the device
  now sends GetChipFlashSize(). It is appended AFTER the version string in the
  CMD_VERSION reply, so the wire layout is unchanged and it stays compatible in
  both directions (old client ignores the trailing bytes; new client length-
  guards and treats a missing value as 0). GetChipFlashSize() already exists for
  both AT91 and AT32.
2026-08-19 21:49:43 +02:00
Philippe Teuwen 06bc3239ab Proxmark5 instructions, WIP 2026-08-19 21:40:15 +02:00
Nemanja Nedeljkovic b81966c419 fix(pm5): select an ERTC clock before the BPR write
The AT32 battery-domain helper at32_bpr_write_dt1() enabled the ERTC (ertcen)
but never selected an ERTC clock source (ertcsel stayed NOCLK). Writing the
ERTC write-protection register (ERTC->wp) requires the ERTC to be clocked, so
with no source the write stalled the APB once the CPU ran at the full PLL clock
(288MHz, 144MHz APB); it only survived on the slow HICK clock.

The bootrom reaches this via check_goto_flash_mode() -> system_bpr_chk_clear()
while reading/clearing the "enter flash mode" magic the OS sets on a software
reset. That runs after ConfigSystemClocks() (the button branch needs
SpinDelayUs()/the timer clock, so the clock must be up first), i.e. at 288MHz,
so the bootrom hung and the device never re-enumerated into the bootloader
until a physical USB replug.

Fix: select the ERTC clock (HEXT/20, as the tick HAL does) before touching the
ERTC registers. HEXT is running by the time this executes, so the wp write no
longer stalls. The fix is contained in the AT32 HAL (sys_hw_at32.c, which only
builds for AT32/PM5); the shared bootrom flow and its ConfigSystemClocks()-first
ordering (needed by AT91/RDV4 SpinDelayUs) are unchanged.
2026-08-19 19:33:01 +02:00
Philippe Teuwen caa76f57b3 Fix pm5 recovery image 2026-08-19 19:28:17 +02:00
dxl 86dfdfff89 Fixed a bug in reading hitagU and hitagS on RDV4. 2026-08-19 18:53:35 +02:00
iceman1001 75c2803d30 Corrected the file extension 2026-08-19 18:48:12 +02:00
Philippe Teuwen 4e684cb4d3 PM5: Detect incompatible PLATFORM_EXTRAS 2026-08-19 17:52:15 +02:00
Chloé Franke 23ed174e76 added to changelog 2026-08-19 16:29:04 +02:00
Chloé Franke 7587a05cf1 Inverted verbose flag to work correctly 2026-08-19 16:28:10 +02:00
Philippe Teuwen 827fce4839 Use ARRAYLEN when possible 2026-08-19 15:51:54 +02:00
Philippe Teuwen 5518e6af77 Fix Flash_UniqueID 2026-08-19 15:51:54 +02:00
Philippe Teuwen 6863314019 Remove tabs 2026-08-19 15:51:54 +02:00
Philippe Teuwen 52af3f11e2 rename a couple of commands 2026-08-19 15:51:54 +02:00
Philippe Teuwen b6752e9dde compile CMD_FPGA_CMD_SET_PWR_PWM_LOW_COUNT only for pm5 2026-08-19 15:51:54 +02:00
Philippe Teuwen f82ac61e78 Prompt the user when flash_suggest_update_bootloader()
pm3line_init() delayed to not install signal handlers on other usages than interactive client
2026-08-19 15:51:54 +02:00
dxl 2dfe6c85a4 Record all remarks related to Proxmark5 to Proxmark5.md 2026-08-19 15:51:54 +02:00
dxl d064f9a310 Change HITAG_T_WAIT_FIRST to 350(See datasheet) so that PM5 can read hitagu normally. 2026-08-19 15:51:54 +02:00
dxl a286002d27 Refactor ISO14443A DMA RX to use cross-platform buffer helpers
Replace the hard-coded AT91 PDC register access in SniffIso14443a() with
cross-platform helpers for the RX double-buffer status/refresh, so the
sniffer no longer depends on AT91-specific registers.

- Add FPGA_SSC_DMA_RX_{Primary,Secondary}_Done and
  FPGA_SSC_DMA_RX_Refresh_{Both,Secondary} to fpga_apis.h.
- AT91: primary maps to PDC RPR/RCR, secondary ("next") to RNPR/RNCR.
- AT32: no double buffer, so the primary path is a no-op and all re-arming
  is done through the secondary (single-shot DMA re-arm).
2026-08-19 15:51:53 +02:00
dxl 676bc467cd Deleted unused variable 'maxDataLen' from SniffIso14443a() 2026-08-19 15:51:53 +02:00
dxl 7ef2d7b5b7 Moved startup_at32f435_437.s from armlib to armsrc 2026-08-19 15:51:53 +02:00
Philippe Teuwen 86b9e4d108 Merge: hardware abstraction layer for ARM 2026-08-19 15:51:53 +02:00
dxl d286946d0f Update the Makefile support for ARM 2026-08-19 15:51:53 +02:00