dandri/proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2026-09-25 19:54:14 +00:00
Code Issues Packages Projects Releases Wiki Activity
21,581 Commits 3 Branches 21 Tags
877e5c6b701f73a57ceea87362ebbb7e87f32641
Commit Graph
13395 Commits
Author SHA1 Message Date
team-orangeBlue 877e5c6b70 bugfix #2 
oops #2

Signed-off-by: team-orangeBlue <63470411+team-orangeBlue@users.noreply.github.com>
 2026-04-11 00:57:28 +03:00
team-orangeBlue 38af2eb1c5 bugfix 
oops

Signed-off-by: team-orangeBlue <63470411+team-orangeBlue@users.noreply.github.com>
 2026-04-11 00:56:59 +03:00
team-orangeBlue 9e52f0701f Correct ACL RO check 
See commit 1cb843a22b

Signed-off-by: team-orangeBlue <63470411+team-orangeBlue@users.noreply.github.com>
 2026-04-11 00:41:31 +03:00
team-orangeBlue 1cb843a22b Fix bug in ACL block-RO checker 
The code as-is would bug out like below:
```
(input) --blk 255 -d ...f0f0f0...
[=] Sector trailer (ST) write detected
[!] ⚠️  Strict ReadOnly Access Conditions on block 240 detected
[!] ⚠️  Strict ReadOnly Access Conditions on block 241 detected
[!] ⚠️  Strict ReadOnly Access Conditions on block 242 detected
```
This is incorrect. in 16-block sectors, ACLs cover chunks of 5 blocks at once.
It should (and now does) look like:
```
[=] Sector trailer (ST) write detected
[!] ⚠️  Strict ReadOnly Access Conditions on blocks 240-244 detected
[!] ⚠️  Strict ReadOnly Access Conditions on blocks 245-249 detected
[!] ⚠️  Strict ReadOnly Access Conditions on blocks 250-254 detected
```

Signed-off-by: team-orangeBlue <63470411+team-orangeBlue@users.noreply.github.com>
 2026-04-11 00:38:14 +03:00
team-orangeBlue 394aec40e2 Add ST+ACL check to hf mfp wrbl 
Sector trailers are now checked for errors.
Writes should not go through if for whatever reason ACLs provided to write are invalid.

Reminder that ACLs are checked on the 4-byte method of MFP with the encrypted-only exchange byte.

Signed-off-by: team-orangeBlue <63470411+team-orangeBlue@users.noreply.github.com>
 2026-04-11 00:14:36 +03:00
team-orangeBlue f8f6216958 Correct a typo in helptext 
Mifare Plus ACLs are 4 bytes, not 3... oops
Fixed typo in `hf mfp acl`

Signed-off-by: team-orangeBlue <63470411+team-orangeBlue@users.noreply.github.com>
 2026-04-11 00:11:41 +03:00
iceman1001 a5140dd666 add win32 headers, will need to refactor the lf relay using win32 aswell 2026-04-10 17:05:12 +07:00
iceman1001 f070d8a06e lf relay - relays between two pm3 devices over internet. Defaults to port 8000, Thanks to Moreno for original source 2026-04-10 14:03:50 +07:00
iceman1001 1b80129132 text 2026-04-10 13:50:41 +07:00
Iceman 89bcec22b2 Merge pull request #3225 from team-orangeBlue/mf_acl_polish 
Polish the `hf mf acl` command
 2026-04-10 13:06:23 +07:00
Iceman 557a8cc399 Merge pull request #3224 from team-orangeBlue/mfp_acl 
Add the `hf mfp acl` command
 2026-04-10 13:04:42 +07:00
team-orangeBlue b4da189aa7 Polish hf mf acl 
Just cause...

Signed-off-by: team-orangeBlue <63470411+team-orangeBlue@users.noreply.github.com>
 2026-04-09 23:43:47 +03:00
team-orangeBlue 9cf2f49d10 Add ACL command 
Mifare Plus has an extra byte for ACL payloads.
That byte controls if data exchange can be plaintext or must be encrypted.

Support for decoding is added in this commit.

Signed-off-by: team-orangeBlue <63470411+team-orangeBlue@users.noreply.github.com>
 2026-04-09 23:17:44 +03:00
kormax c85115036a Add 'LEGIC Connect' entries to 'aidlist.json' 2026-04-09 20:50:20 +03:00
kormax e9801d1e9c Add extra 'Sources' to 'aidlist.json' 2026-04-09 20:42:53 +03:00
iceman1001 a64d115fa8 changed filed name to match prefered style 2026-04-09 12:22:10 +07:00
iceman1001 9e09e6c5cc changed file name to match prefered style 2026-04-09 12:21:38 +07:00
iceman1001 e199f3dd11 thanks to Claude, this script actually has become the way I wanted it to be. It is alpha-num sorted, column width adapted, and alternative rows are now in yellow. There is also a -s parameter if you have a known value you are looking for. If found it will be marked in green text. Marvelous changes! 2026-04-09 12:18:38 +07:00
kormax ad27ccae5c Remove use of printf in mfdes module 2026-04-09 00:20:31 +03:00
kormax 63a9a46b2d Replace space padding with dotted padding in 'hf mfdes getdelegateappinfo' 2026-04-09 00:16:52 +03:00
kormax f5d659235b Re-auth after failed response in 'hf mfdes brutedamslot' 2026-04-08 21:15:30 +03:00
kormax d6a18e0270 Implement 'hf mfdes brutedamslot' command 2026-04-08 20:50:44 +03:00
iceman1001 95845dfa6f style 2026-04-08 15:55:48 +07:00
Antiklesys 4382750688 Update hidconfig_sample.json 
Signed-off-by: Antiklesys <syselkitna@gmail.com>
 2026-04-08 16:24:58 +08:00
Antiklesys 796ec85a6f Improved secc 
Improved hf secc to use default apdu reply from the json file and not the hardcoded one (used as fallback now).
Removed old hardcoded functions no longer in use.
 2026-04-08 16:23:50 +08:00
kormax 7f6898feae Add more 'Sources' to 'aidlist.json' 2026-04-07 18:08:21 +03:00
kormax 26dfceaea9 Add 'STiD Mobile ID' entries to 'aidlist.json' 2026-04-07 18:01:58 +03:00
iceman1001 b011c76dd0 style 2026-04-07 08:35:30 +07:00
Matteo Scarlata 7b632dd1f0 client: fix lf hitag hts restore dump length handling 2026-04-07 01:59:41 +02:00
kormax c8f4430636 Implement DESFire delegated app info retrieval 2026-04-06 21:04:32 +03:00
Antiklesys 3bfc645a0a Added hf secc info command 
Added `hf secc info` command to retrieve the Card Recognition Template
 2026-04-06 18:43:30 +08:00
kormax 909e1c3f23 Fix secure channel issues with 'hf mfdes createdelegateapp' 2026-04-05 22:09:12 +03:00
kormax f9dc8319fb Add createdelegateapp to autocomplete 2026-04-05 11:26:39 +03:00
kormax 6e73038157 Guard against EV2, remove LRP, EV2 channel suggestions 2026-04-05 10:50:28 +03:00
kormax 9ab41dc875 Implement DESFire delegated application creation 2026-04-05 10:22:18 +03:00
kormax e78735e26e Fix DESFire ChangeKey 'keyNo' annotation value 2026-04-04 21:43:24 +03:00
Iceman 2e49d441b9 Merge pull request #3205 from Antiklesys/master 
Removed --credit from hf iclass legrec & stabilized --fast timing
 2026-04-04 08:06:48 +07:00
kormax e4ed0b4d4f Add more sources to existing 'aidlist.json' mobile entries 2026-04-03 23:28:13 +03:00
Antiklesys 51c44843c9 Removed --credit from hf iclass legrec 
Option wasn't working and caused unnecessary complexity in the workflow.
 2026-04-04 01:07:47 +08:00
iceman1001 d8d221bc81 add reference to blacktears 2026-04-03 12:20:59 +07:00
Iceman 11e4fa3fd7 Merge pull request #3204 from Antiklesys/master 
Huge hf iclass legbrute performance improvements (4x)
 2026-04-03 11:31:34 +07:00
iceman1001 1767fbfff9 text list 2026-04-03 11:27:08 +07:00
Antiklesys b5fe39cf34 Update cmdhficlass.c 
Signed-off-by: Antiklesys <syselkitna@gmail.com>
 2026-04-03 12:17:34 +08:00
Antiklesys 2145bc8869 Update cmdhficlass.c 2026-04-03 12:03:59 +08:00
Antiklesys 51521fdad9 Fixed blacktears bugs 2026-04-03 12:00:56 +08:00
Antiklesys 10bd253eab Update elite_crack.c 2026-04-03 11:43:11 +08:00
Antiklesys f9474feec0 Update elite_crack.c 
Leveraging doMAC_brute for speed gains.

Precomputation (lines 330-346): Before the loop, sel_brute_idx[i] is set to the brute-byte index j if key_index[i] == bytes_to_recover[j], or 0xFF if that key_sel position is from a already-cracked constant entry. Fixed positions are filled into key_sel once here.

Hot loop (lines 356-361): Replaces:

numbytes_to_recover keytable writes + 8 keytable reads + 8 & 0xFF masks
With: up to numbytes_to_recover (1-3) direct shifts from brute — no keytable touches at all.

Success path (line 386): (brute >> (i * 8)) & 0xFF recovers the exact byte value that was just used for the winning iteration, equivalent to the old keytable[bytes_to_recover[i]] & 0xFF which was the same value that had just been written into the keytable from brute.
 2026-04-03 11:38:08 +08:00
Antiklesys 8380c02a54 Fixed legrec grammar error and checks 2026-04-03 03:22:32 +08:00
Antiklesys a0f89d09e8 Merge branch 'RfidResearchGroup:master' into master 2026-04-03 01:19:39 +08:00
Antiklesys 6b2e6ab1e8 Huge hf iclass legbrute performance improvements (4x) 
Optimized `hf iclass legbrute` throughput: replaced recursive `suc()`/`output()` cipher functions with iterative loops, added 256-entry LUT for the `select()` function eliminating redundant bit arithmetic and halving key lookups per state step, switched successor state to in-place pointer update removing per-call struct copies, added `doMAC_brute()` with byte-wise LSB-first processing and direct output bit packing eliminating all bitstream struct overhead and output reversal calls per key candidate, and replaced per-iteration 64-bit modulo progress check with a countdown counter
 2026-04-03 01:18:55 +08:00