Tom HarknessandClaude Sonnet 5
8faafcebb0
Problem
With PR #3672/#3674 landed, CEP handshakes reliably but the SPI transport
hangs PM5 hard (needs a physical reset, no watchdog on this platform)
after some number of attach/reconnect cycles - sometimes the first
cycle, sometimes dozens of pings in. Logic-analyzer capture of a hang in
progress showed a ~1.2s burst of rapid CS-gated retries, and in one
capture, three periodic transactions after that burst got progressively
slower (2.1ms -> 3.9ms -> 3.2ms -> 5.2ms) instead of recovering.
Root causes (two, compounding)
1. cep_spi_write_sync() had seven bare `while (flag == RESET);` spins
waiting on SPI1's TDBE/BF flags, with no timeout. PM5 is the SPI
slave - TDBE only clears when the Flipper is actively clocking, on
its own ~20-120ms schedule, completely async to when PM5's reply is
ready. Queue a reply between two master polls and the wait never
returns - full main-loop death.
2. Artery's own errata sheet for the AT32F435/437 (ES0003) documents
that in SPI slave hardware-CS mode, the internal clock sync is not
guaranteed to reset on every CS falling edge - a bad sync can persist
across transactions with no self-correction. This is PM5's exact CEP
configuration (SPI_CS_HARDWARE_MODE, slave mode).
Change
armsrc/pm5_cep.c:
- cep_spi_write_sync() rewritten around a bounded cep_spi_wait_tdbe()
helper (same spin-iteration-count pattern already used for reads) -
returns PM3_EIO on timeout instead of hanging.
- New cep_spi_resync(): hardware-resets SPI1 via crm_periph_reset()
(a register re-init alone doesn't clear the errata's bad internal
state) and brings it back up. This is Artery's own documented recovery
for ES0003 ("reset SPI and restart communication"), triggered by our
existing NG-frame CRC/length checks instead of the SPI peripheral's
hardware CRC feature.
- cep_do_handshake()'s SPI-stall recovery path was itself unbounded
(retried forever as long as the CC controller reported "still
attached") and missing the StartTicks()/I2C_init(true) guard every
other I2C call site in this file has (same bug class as #3672) - now
bounded (CEP_HANDSHAKE_REPLY_MAX_RETRIES) with the guard added.
- cep_spi_data_available() now discards the Flipper's 0x55 idle-poll
filler bytes before reading the real length header, instead of ever
interpreting one as (part of) a frame length.
armsrc/cmd.c: wire cep_spi_resync() into every CEP-reachable error exit
in receive_ng_internal() (short/overflow/CRC-mismatch reads) and both
reply_old()/reply_ng_internal()'s write-failure paths, so any detected
corruption resets SPI1 before the next transaction rather than letting a
bad sync persist. Add a WITH_CEP-gated inline stub for cep_spi_resync()
so receive_ng_internal()'s call sites don't need per-site #ifdef guards
on non-CEP platforms.
Behaviour change
None for USB/FPC/BWM. CEP: a corrupted or stalled SPI1 transaction now
self-heals (one dropped reply, then normal operation) instead of
wedging the device.
Testing
- make clean && make PLATFORM=PM5 PLATFORM_EXTRAS=BWM and
make clean && make PLATFORM=PM3RDV4 - both zero warnings.
- Hardware: flashed to a real PM5 paired with a real Flipper Zero FAP.
- 60s continuous-connection capture with zero USB activity (isolates
CEP from any client-side interaction): clean, no anomalies.
- 110s capture with 18 real `hw status` calls interspersed: all 18
succeeded, CEP stayed attached throughout.
- 5 full attach/detach cycles with `hf search` against a real NTAG213
card before/during/after each attach (240s, logic-analyzer capture
throughout): all 15 reads returned the identical UID regardless of
CEP state, zero hangs, final liveness check succeeded with no reset
needed.
- Not tested: clang toolchain (firmware-only diff).
Checklist
- [x] Proper style of own code, no unrelated reformatting included
- [x] Builds warning-free with gcc (PM5 and RDV4)
- [ ] clang not tried (firmware-only diff)
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Iceman Fork - Proxmark
The Proxmark is the swiss-army tool of RFID, allowing for interactions with the vast majority of RFID tags on a global scale. Originally built by Jonathan Westhues, the device is now the goto tool for RFID Analysis for the enthusiast.
Iceman repository is considered to be the pinnacle of features and functionality, enabling a huge range of extremely useful and convenient commands and Python/LUA scripts to automate chip identification, penetration testing, and programming.
| Latest Release | Coverity | Contributors |
|---|---|---|
 |
 |
 |
| Actions OSX CI | Actions Ubuntu CI | Actions Windows CI |
|---|---|---|
 |
 |
 |
Table of Contents
- Iceman Fork - Proxmark
- Table of Contents
- PROXMARK3 INSTALLATION AND OVERVIEW
- How to build?
- What has changed?
- Development
PROXMARK3 INSTALLATION AND OVERVIEW
Notes / helpful documents
How to build?
Proxmark5
The last hardware generation is called Proxmark5. It has
- MCU: AT32F435, a 288 MHz Artery Cortex-M4
- Gowin FPGA
- TypeC Extended Port (CEP)
- BLE / Wifi / Battery Addon, via a ESp32c2
- Swappable antennas (LF, HF, UHF)
- 125, 134, 250, 375, 500 KHz Low Frequency Antenna (LF)
- 13.56 MHz High Frequency Antenna (HF)
- as a addon: 860-960 MHz Ultra High Frequency Antenna (UHF), ** not developed yet **
At the moment, Proxmark5-specific instructions are all grouped in a single Getting Started guide. Read it to build, flash and run your Proxmark5 device. See the instruction links in the tables above to get the compilation environment.
- ⚠ The firmware is not stable at the moment and is actively being developed at.
- ⚠ Don't install the BWM addon board for now.
Proxmark3 RDV4
See the instruction links in the tables above to build, flash and run for your Proxmark3 RDV4 device.
Generic Proxmark3 platforms
In order to build this repo for generic Proxmark3 platforms we urge you to read Advanced compilation parameters
We define generic Proxmark3 platforms as following devices.
Supported
- RDV1, RDV2, RDV3 easy
- Ryscorp green PCB version
- Radiowar black PCB version
- numerous Chinese adapted versions of the RDV3 easy (kkmoon, PiSwords etc)
- Proxmark3 SE (Special Edition) (BLE enabled)
- Proxmark3 X
- Note: Community tested
- Note: unknown device hw
- iCopy-X
- Note: Compatible ONLY after installation of iCopy-X Open Source firmware
- Factory firmware is not compatible (Client Commands are different / Factory UI closed source / Factory Firmware enforces tag DRM)
Not supported
- ⚠ Proxmark Evolution (EVO)
- Note: unknown pin assignments.
- ⚠ Ryscorp Proxmark3 Pro
- Note: device has different fpga and unknown pin assignments.
- Note: Company have disappeared, leaving their customers in the dark.
Experimental support
- ⚠ Proxmark3 Ultimate
- Note: unknown device hw
- Note: FPGA images is building for it. Use on your own risk.
Unknown support status
- ⚠ VX
- Note: unknown device hw
When it comes to these new unknown models we are depending on the community to report in if this repo works and what they did to make it work.
256KB flash memory size of generic Proxmark3 platforms
⚠ Note: You need to keep a eye on how large your ARM chip built-in flash memory is. With 512KB you are fine but if its 256KB you need to compile this repo with even less functionality. When running the
./pm3-flash-allyou can see which size your device have if you have the bootloader from this repo installed. Otherwise you will find the size reported in the start message when running the Proxmark3 client./pm3.
What has changed?
See the Changelog file which we try to keep updated.
Development
⚠ Note: This is a bleeding edge repository. The maintainers actively is working out of this repository and will be periodically re-structuring the code to make it easier to comprehend, navigate, build, test, and contribute to, so DO expect significant changes to code layout on a regular basis.
👉 Remember! If you intend to contribute to the code, please read the coding style notes first. We usually merge your contributions fast since we do like the idea of getting a functionality in the Proxmark3 and weed out the bugs afterwards.
The public roadmap is an excellent start to read if you are interesting in contributing.
Supported operating systems
This repo compiles nicely on
- WSL1 on Windows 10
- WSL2 on Windows 10/11
- Proxspace environment release v3.xx
- Windows/MinGW environment
- Ubuntu, ParrotOS, Gentoo, Pentoo, Kali, NetHunter, Arch Linux, Fedora, Debian, Raspbian
- Android / Termux
- macOS / Homebrew (or MacPorts, experimental) / Apple Silicon M1
- iOS (Jailbroken, rootful)
- Docker container
Precompiled binaries
See Proxmark3 precompiled builds
Proxmark3 GUI
Most community driven GUI for Proxmark tends to be quite old and out-of-date. Here is a list of a few:
- Proxmark3 Universal GUI will work more or less.
- Proxmark3 GUI cross-compiled which is recently updated and claims to support latest source of this repo.
- Proxmark3_GUI simple gui in vb.net
Official channels
Where do you find the community?
Maintainers
To all distro, package maintainers, we tried to make your life easier.
make install is now available and if you want to know more.
This document will be helpful for you
Citation
Use this bibtex to cite this repository globally:
@misc{proxmark3,
author = {C. {Herrmann} and P. {Teuwen} and O. {Moiseenko} and M. {Walker} and others},
title = {{Proxmark3 -- Iceman repo}},
howpublished = {\url{https://github.com/RfidResearchGroup/proxmark3}},
keywords = {rfid nfc iceman proxmark3 125khz 134khz 13.56mhz},
}
If you need to refer to a specific state of the repository, use a commit number or a date of access, e.g.:
note = {Accessed: commit 12327f71a27da23831901847886aaf20e8ad3ca0}
note = {Accessed: 2021-01-01}
Copyright and licensing terms
Each contribution is under the copyright of its author. See AUTHORS.
The Proxmark3 source code is covered by the following licensing terms, usually referred as GPLv3 or later.
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
A copy of the GPLv3 is available in LICENSE.
Some dependencies may be under other free licensing terms compatible with the Proxmark3 licensing terms, see their respective description.