6658905f |
1 | INTRO:\r |
2 | \r |
3 | This file contains enough software, logic (for the FPGA), and design\r |
4 | documentation for the hardware that you could, at least in theory,\r |
5 | do something useful with a proxmark3. It has commands to:\r |
6 | \r |
7 | * read any kind of 125 kHz unidirectional tag\r |
8 | * simulate any kind of 125 kHz unidirectional tag\r |
9 | \r |
10 | (This is enough to perform all of the silly cloning attacks, like the\r |
11 | ones that I did at the Capitol in Sacramento, or anything involving\r |
12 | a Verichip. From a technical standpoint, these are not that exciting,\r |
13 | although the `software radio' architecture of the proxmark3 makes it\r |
14 | easy and fun to support new formats.)\r |
15 | \r |
16 | As a bonus, I include some code to use the 13.56 MHz hardware, so you can:\r |
17 | \r |
18 | * do anything that a (medium-range) ISO 15693 reader could\r |
19 | * read an ISO 14443 tag, if you know the higher-layer protocol\r |
20 | * pretend to be an ISO 14443 tag, if you know the higher-layer protocol\r |
21 | * snoop on an ISO 14443 transaction\r |
22 | \r |
23 | I am not actively developing any of this. I have other projects that\r |
24 | seem to be more useful.\r |
25 | \r |
26 | USING THE PACKAGE:\r |
27 | \r |
28 | The software tools required to build include:\r |
29 | \r |
30 | * cygwin or other unix-like tools for Windows\r |
afb8304a |
31 | * devkitPro (http://wiki.devkitpro.org/index.php/Getting_Started/devkitARM)\r |
6658905f |
32 | * Xilinx's WebPack tools\r |
33 | * Modelsim (for test only)\r |
34 | * perl\r |
35 | \r |
afb8304a |
36 | When installing devkitPro, you only need to install the compiler itself. Additional\r |
37 | support libraries are not required.\r |
6658905f |
38 | \r |
39 | Documentation is minimal, but see the doc/ directory for what exists. A\r |
40 | previous familiarity with the ARM, with digital signal processing,\r |
41 | and with embedded programming in general is assumed.\r |
42 | \r |
43 | The device is used through a specialized command line interface; for\r |
44 | example, to clone a Verichip, you might type:\r |
45 | \r |
46 | loread ; this reads the tag, and stores the\r |
47 | ; raw samples in memory on the ARM\r |
48 | \r |
49 | losamples ; then we download the samples to\r |
50 | ; the PC\r |
51 | \r |
52 | vchdemod clone ; demodulate the ID, and then put it\r |
53 | ; back in a format that we can replay\r |
54 | \r |
55 | losim ; and then replay it\r |
56 | \r |
57 | To read an ISO 15693 tag, you might type:\r |
58 | \r |
59 | hiread ; read the tag; this involves sending a\r |
60 | ; particular command, and then getting\r |
61 | ; the response (which is stored as raw\r |
62 | ; samples in memory on the ARM)\r |
63 | \r |
64 | hisamples ; then download those samples to the PC\r |
65 | \r |
66 | hi15demod ; and demod them to bits (and check the\r |
67 | ; CRC etc. at the same time)\r |
68 | \r |
69 | Notice that in both cases the signal processing mostly happened on the PC\r |
70 | side; that is of course not practical for a real reader, but it is easier\r |
71 | to initially write your code and debug on the PC side than on the ARM. As\r |
72 | long as you use integer math (and I do), it's trivial to port it over\r |
73 | when you're done.\r |
74 | \r |
75 | The USB driver and bootloader are documented (and available separately\r |
76 | for download, if you wish to use them in another project) at\r |
77 | \r |
78 | http://cq.cx/trivia.pl\r |
79 | \r |
80 | \r |
81 | OBTAINING HARDWARE:\r |
82 | \r |
83 | Most of the ultra-low-volume contract assemblers that have sprung up\r |
84 | (Screaming Circuits, the various cheap Asian suppliers, etc.) could put\r |
85 | something like this together with a reasonable yield. A run of around\r |
86 | a dozen units is probably cost-effective. The BOM includes (possibly-\r |
87 | outdated) component pricing, and everything is available from Digikey\r |
88 | and the usual distributors.\r |
89 | \r |
90 | If you've never assembled a modern circuit board by hand, then this is\r |
91 | not a good place to start. Some of the components (e.g. the crystals)\r |
92 | must not be assembled with a soldering iron, and require hot air.\r |
93 | \r |
94 | The schematics are included; the component values given are not\r |
95 | necessarily correct for all situations, but it should be possible to do\r |
96 | nearly anything you would want with appropriate population options.\r |
97 | \r |
98 | The printed circuit board artwork is also available, as Gerbers and an\r |
99 | Excellon drill file.\r |
100 | \r |
101 | \r |
102 | FUTURE PLANS, ENHANCEMENTS THAT YOU COULD MAKE:\r |
103 | \r |
104 | At some point I should write software involving a proper real-time\r |
105 | operating system for the ARM. I would then provide interrupt-driven\r |
106 | drivers for many of the peripherals that are polled now (the USB,\r |
107 | the data stream from the FPGA), which would make it easier to develop\r |
108 | complex applications.\r |
109 | \r |
110 | It would not be all that hard to implement the ISO 15693 reader properly\r |
111 | (with anticollision, all the commands supported, and so on)--the signal\r |
112 | processing is already written, so it is all straightforward applications\r |
113 | work.\r |
114 | \r |
115 | I have basic support for ISO 14443 as well: a sniffer, a simulated\r |
116 | tag, and a reader. It won't do anything useful unless you fill in the\r |
117 | high-layer protocol.\r |
118 | \r |
119 | Nicer (i.e., closer-to-optimal) implementations of all kinds of signal\r |
120 | processing would be useful as well.\r |
121 | \r |
122 | A practical implementation of the learning-the-tag's-ID-from-what-the-\r |
123 | reader-broadcasts-during-anticollision attacks would be relatively\r |
124 | straightforward. This would involve some signal processing on the FPGA,\r |
125 | but not much else after that.\r |
126 | \r |
127 | It would be neat to write a driver that could stream samples from the A/Ds\r |
128 | over USB to the PC, using the full available bandwidth of USB. I am not\r |
129 | yet sure what that would be good for, but surely something. This would\r |
130 | require a kernel-mode driver under Windows, though, which is more work.\r |
131 | \r |
132 | \r |
133 | LICENSING:\r |
134 | \r |
135 | This program is free software; you can redistribute it and/or modify\r |
136 | it under the terms of the GNU General Public License as published by\r |
137 | the Free Software Foundation; either version 2 of the License, or\r |
138 | (at your option) any later version.\r |
139 | \r |
140 | This program is distributed in the hope that it will be useful,\r |
141 | but WITHOUT ANY WARRANTY; without even the implied warranty of\r |
142 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\r |
143 | GNU General Public License for more details.\r |
144 | \r |
145 | You should have received a copy of the GNU General Public License\r |
146 | along with this program; if not, write to the Free Software\r |
147 | Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA\r |
148 | \r |
149 | \r |
150 | Jonathan Westhues\r |
151 | user jwesthues, at host cq.cx\r |
152 | \r |
153 | May 2007, Cambridge MA\r |
154 | \r |