* add a check to prevent multiple log handler additions. Still a hack, but ok for this purpose.
* GuessKey_Statistics.__init__() now validates is_solved using same class validator as unpack()
* fix exception text to reflect allowed types for Hangman_State
* Also in Hangman_State, fix validation when input is bytes / bytearray
* In dc34_PlayHangman_validate_user_input(), strip the input before checking length.
1. remove hard-coded binary path
2. define TCP_PORT in fallback path
3. only detect device when not called from client
4. struct.pack() requires bytes / bytearray when packing a string.
5. fix typo "existing" -> "exiting"
6. remove unused imports
Works both from the command-line and from within the PM3 client:
* python3 ./client/pyscripts/dc34.py
* ./pm3 -c "script run dc34"
Supports all three games:
* TicTacToe
* Hangman
* GuessKey
See https://dc34.rfid.wtf/
This script adds support for external SAM modules to be used with Proxmark 3 Easy and Proxmark 5.
To run this script you would need an external SIM/SAM reader such as the ACR39T or ACR40T family or similar.
1. Fixed a bug where old data caused incorrect bitwise operation results.
2. Do not call ResetLoEdgeCapture(), as this will prevent the condition rb >= HITAG_T_EOF from ever being met.
3. PM5 and RDV4 have been tested and have good compatibility.
4. FPGA_LF_EDGE_DETECT_TOGGLE_MODE seems to be useless.
pm3_grabbed_output_get null-terminated the captured output at
g_grabbed_output.size, but size is the allocated capacity, not the number of
bytes written -- ui.c grows it by MAX_PRINT_BUFFER at a time and tracks the
used length separately in idx. Every call therefore wrote one zero byte past
the end of the heap allocation.
The CLI mostly survives it because it calls the function once or twice and
then exits, so the corrupted malloc metadata is never reused. A long-running
libpm3 client that captures output on every command does not: the damage
surfaces later, far from the cause. It was found as a SIGTRAP inside an
unrelated AppKit autorelease pool.
Reproduced against real hardware:
MALLOC_STRICT_SIZE=1 MallocGuardEdges=1 \
DYLD_INSERT_LIBRARIES=/usr/lib/libgmalloc.dylib ./pm3run <port> "hw version"
which crashes with SIGSEGV inside pm3_grabbed_output_get before this change
and exits cleanly with identical captured output after it.
Terminating at idx is always in bounds: the grabber guarantees at least
MAX_PRINT_BUFFER bytes of headroom before each write, so idx is strictly less
than size.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AjGgtnsvWJHAMYEksAiYuf
Graham Gallagher