dandri/proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2026-09-15 17:16:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
23,005 Commits 3 Branches 20 Tags
ea4d90ebe4e015c3b3aaae00842fdc2205df230a
Commit Graph
23005 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Niel Nielsen ea4d90ebe4 Refactor BWM command handling for clarity and structure 
Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-05 10:09:23 +02:00
Niel Nielsen eb5b9eb561 Added removed comment again 
Added removed comment again

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-05 09:12:39 +02:00
Niel Nielsen 96e13303c8 Update PM3_FPC_MAX_DATA to 2048 
Increase maximum data size for FPC from 240 to 2048 bytes.

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-05 08:33:03 +02:00
Niel Nielsen 1c8a1c1c95 Merge branch 'RfidResearchGroup:master' into BWM-work 2026-09-04 20:46:27 +02:00
Philippe Teuwen 47d0a8fa00 typo 2026-09-04 19:59:40 +02:00
Niel Nielsen 93ea5600f8 Merge branch 'RfidResearchGroup:master' into BWM-work 2026-09-04 17:10:15 +02:00
iceman1001 2025e49c09 added missing clock fct for pm5 2026-09-04 15:34:30 +02:00
iceman1001 9a958880ff fix bad txframe variable 2026-09-04 15:21:19 +02:00
iceman1001 0aef94c667 fix 'lf hitag reader -@' mode with sending a break afterwards. 2026-09-04 15:18:16 +02:00
Niel Nielsen 7b37171986 Merge pull request #1 from nieldk/bwm-ota-begin-timeout 
Give BWM OTA begin enough time to erase, and stop retuning UART for t…
 2026-09-04 14:55:00 +02:00
Niel Nielsen 8e1582233a Merge branch 'RfidResearchGroup:master' into BWM-work 2026-09-04 14:45:59 +02:00
iceman1001 ceda0728b6 remove debug statements 2026-09-04 14:34:19 +02:00
Niel Nielsen cf3730e1b4 Merge branch 'RfidResearchGroup:master' into BWM-work 2026-09-04 14:29:26 +02:00
WillandCursor 22969ec79a Give BWM OTA begin enough time to erase, and stop retuning UART for the transfer 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-04 08:24:16 -04:00
iceman1001 1a34aac8df texts 2026-09-04 13:32:54 +02:00
iceman1001 ace5d63ff9 hitag2: fix simulation against genuine readers, add restore, fix info 
Simulation now completes the full exchange with a genuine Paxton reader in
password mode, and crypto mode read/write passes Proxmark-to-Proxmark.

Firmware:
- SOF was one bit period short. The lead-in that compensated for the lost
  head half bit was removed and nothing replaced it, so readers rejected
  every answer with a second START_AUTH. Default is now 6.
- The edge-detect threshold was latched before being measured, so the value
  chosen depended on whether the Proxmark was in a field when sim started.
  It is now measured on field entry and re-armed when the reader leaves.
- The percentile walk latched on run-scoped variables, so one attempt made
  outside a field poisoned every later one.
- Field loss was detected from TIMESTAMP, which is free-running MCU time and
  never stalls. Detect it from receive silence instead.
- Frames of a length the protocol does not have no longer reach the state
  machine; our own modulation tail was resetting the session and breaking
  every write.
- A dropped edge merges two or three reader bit periods into one gap. Those
  bits were discarded; they are now recovered by decomposition, which is what
  made crypto mode work (AUTH decode 15% -> 100%).
- Threshold selection is limited to 20 and 32 and settles in under 25 ms.

Client:
- lf hitag info printed a hardcoded 0x06 and reported 'Password mode' for
  every tag. It now reads page 3, takes -k (4 bytes password, 6 bytes
  crypto), and says so when the config cannot be read.
- lf hitag restore: writes a dump back in dependency order - user pages,
  then key material, then config last - validates the config byte, and
  prints the credential the tag will require afterwards.
- lf hitag crack2 now reports why it failed instead of a bare 'fail'.
- trace list: bit count moved to its own column, relative mode shows a
  Frame Delay Time row rather than renaming Start/End, --frame and -r
  rejected together.
 2026-09-04 13:20:29 +02:00
Niel Nielsen a019756bfa Merge branch 'RfidResearchGroup:master' into BWM-work 2026-09-04 12:58:10 +02:00
Niel Nielsen d4e375f50b Move all bmw commands to subgroups 
hw bwmautooff	hw bwm autooff
hw bwmcharge	hw bwm charge
hw bwmsetcap	hw bwm setcap
hw bwmupgrade	hw bwm upgrade
hw bwmvchg	hw bwm vchg
hw bwmwifi	hw bwm wifi

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 11:57:28 +02:00
iceman1001 d85550c6de text 2026-09-04 10:18:08 +02:00
iceman1001 ff387762b4 text 2026-09-04 10:16:34 +02:00
Niel Nielsen 5f56828912 Change BWM OTA baud rate from 921600 to 460000 
Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 10:05:50 +02:00
Niel Nielsen 14df0485e8 Update bwm_wifi.h 
Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 10:03:04 +02:00
Niel Nielsen beb5ee7106 Update BWM_OTA_BAUD to 115200 
Changed the OTA baud rate to a slower, more reliable speed.

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 09:58:40 +02:00
Niel Nielsen 9d12204135 Change BWM_OTA_CHUNK_MAX to 240 
Updated maximum firmware bytes per WRITE action from 2048 to 240.

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 09:56:04 +02:00
Niel Nielsen edd5ada64a Increase response timeout and update comments in cmdhw.c 
Increase timeout for response when querying BWM version and adjust comments for clarity.

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 09:47:35 +02:00
Niel Nielsen 7e30a10bd4 Add newline at end of bwm_uart_at32.c 
Fix formatting issue by adding a newline at the end of the file.

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 09:46:05 +02:00
Niel Nielsen 81a3c61058 Add progress bar and write delay to OTA function 
Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 09:31:47 +02:00
Niel Nielsen afcfa2168b Update print statement from 'Hello' to 'Goodbye' 
Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 09:28:36 +02:00
Niel Nielsen fa9691d8d0 Update cmdhw.c 
Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 09:25:33 +02:00
Niel Nielsen 1f6e4eed00 Uncomment clearCommandBuffer() for OTA command 
Uncommented the clearCommandBuffer() function to ensure the command buffer is cleared before sending OTA commands.

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 09:22:41 +02:00
Niel Nielsen fa7aa4e594 Increase PM3_FPC_MAX_DATA from 2048 to 240 
240 seems the best choise

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 09:17:49 +02:00
Niel Nielsen ef09ab673b Update BWM_OTA_CHUNK_MAX to allow larger firmware writes 
Increased the maximum firmware bytes per WRITE action from 196 to 2048.

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 09:15:11 +02:00
Niel Nielsen c1d47f2be9 Reduce BWM_OTA_CHUNK_MAX from 240 to 196 
Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 09:10:45 +02:00
Niel Nielsen 36d2ab1198 Refactor OTA handling and improve timeout duration 
Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 09:02:09 +02:00
Niel Nielsen dd35afc886 Update cmdhw.c 
Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 08:54:57 +02:00
Niel Nielsen 1c2a42321a Removed possible unnessecary clearCommandBuffer(); 
Removed redundant clearCommandBuffer() calls during OTA process.

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 08:48:14 +02:00
Niel Nielsen 803856343c Clean up comments in bwm_wifi.c 
Removed comments regarding CMD_ERROR handling and ESP log message processing.

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 08:41:30 +02:00
Niel Nielsen f5029c265f Increase BWM_OTA_CHUNK_MAX from 236 to 240 
Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 08:31:54 +02:00
Niel Nielsen c4cc31e06b Reduce BWM_OTA_CHUNK_MAX from 248 to 236 
Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 08:27:17 +02:00
Niel Nielsen 857a85557a Reduce BWM_OTA_CHUNK_MAX from 264 to 248 
Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 08:22:58 +02:00
Niel Nielsen dec0185b5a Increase BWM_OTA_CHUNK_MAX from 240 to 264 
Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 08:18:39 +02:00
Niel Nielsen 73a3c85f2c Fix: ROERR handling 
On the AT32, an unhandled UART overrun (ROERR) latches: one overrun stops the USART feeding the DMA, every ack after it is lost, and only a re-init clears it.

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-04 06:21:20 +02:00
Niel Nielsen 9944e4d161 Implement progress bar for OTA updates 
Add progress bar and enhance OTA update handling

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-03 21:23:26 +02:00
Niel Nielsen 6b41421a4f Implement CmdBWMUpgrade function for firmware updates 
Refactor BWM firmware upgrade process and improve error handling.

Signed-off-by: Niel Nielsen <nieldk@gmail.com>
 2026-09-03 21:14:42 +02:00
Niel Nielsen 121408f652 Merge branch 'RfidResearchGroup:master' into BWM-work 2026-09-03 20:07:49 +02:00
iceman1001 50c1c72136 added some sample dump files and trace file for hitag2 2026-09-03 19:35:58 +02:00
iceman1001 1b631a288a text output 2026-09-03 19:31:56 +02:00
iceman1001 12bd5736ad renamed script 2026-09-03 19:23:39 +02:00
Niel Nielsen 55424947ea Merge branch 'RfidResearchGroup:master' into BWM-work 2026-09-03 19:22:22 +02:00
iceman1001 a7918d5135 style 2026-09-03 18:30:00 +02:00