]> git.zerfleddert.de Git - proxmark3-svn/blob - README.txt
Various traces from tags for testing and educational purposes
[proxmark3-svn] / README.txt
1 INTRO:
2
3 This file contains enough software, logic (for the FPGA), and design
4 documentation for the hardware that you could, at least in theory,
5 do something useful with a proxmark3. It has commands to:
6
7 * read any kind of 125 kHz unidirectional tag
8 * simulate any kind of 125 kHz unidirectional tag
9
10 (This is enough to perform all of the silly cloning attacks, like the
11 ones that I did at the Capitol in Sacramento, or anything involving
12 a Verichip. From a technical standpoint, these are not that exciting,
13 although the `software radio' architecture of the proxmark3 makes it
14 easy and fun to support new formats.)
15
16 As a bonus, I include some code to use the 13.56 MHz hardware, so you can:
17
18 * do anything that a (medium-range) ISO 15693 reader could
19 * read an ISO 14443 tag, if you know the higher-layer protocol
20 * pretend to be an ISO 14443 tag, if you know the higher-layer protocol
21 * snoop on an ISO 14443 transaction
22
23 I am not actively developing any of this. I have other projects that
24 seem to be more useful.
25
26 USING THE PACKAGE:
27
28 The software tools required to build include:
29
30 * cygwin or other unix-like tools for Windows
31 * the Microsoft Visual C++ compiler (I use Version 6)
32 * arm-elf-gcc; I use WinterMute's build, from http://www.devkitpro.org/
33 * Xilinx's WebPack tools
34 * Modelsim (for test only)
35 * perl
36
37 It is not necessary to build the FPGA image yourself; a pre-compiled
38 image is provided, as armsrc/fpgaimg.c. This is a generated file,
39 though, and you can rebuild it by running fpga/go.bat.
40
41 Documentation is minimal, but see the doc/ directory for what exists. A
42 previous familiarity with the ARM, with digital signal processing,
43 and with embedded programming in general is assumed.
44
45 The device is used through a specialized command line interface; for
46 example, to clone a Verichip, you might type:
47
48 loread ; this reads the tag, and stores the
49 ; raw samples in memory on the ARM
50
51 losamples ; then we download the samples to
52 ; the PC
53
54 vchdemod clone ; demodulate the ID, and then put it
55 ; back in a format that we can replay
56
57 losim ; and then replay it
58
59 To read an ISO 15693 tag, you might type:
60
61 hiread ; read the tag; this involves sending a
62 ; particular command, and then getting
63 ; the response (which is stored as raw
64 ; samples in memory on the ARM)
65
66 hisamples ; then download those samples to the PC
67
68 hi15demod ; and demod them to bits (and check the
69 ; CRC etc. at the same time)
70
71 Notice that in both cases the signal processing mostly happened on the PC
72 side; that is of course not practical for a real reader, but it is easier
73 to initially write your code and debug on the PC side than on the ARM. As
74 long as you use integer math (and I do), it's trivial to port it over
75 when you're done.
76
77 The USB driver and bootloader are documented (and available separately
78 for download, if you wish to use them in another project) at
79
80 http://cq.cx/trivia.pl
81
82
83 OBTAINING HARDWARE:
84
85 Most of the ultra-low-volume contract assemblers that have sprung up
86 (Screaming Circuits, the various cheap Asian suppliers, etc.) could put
87 something like this together with a reasonable yield. A run of around
88 a dozen units is probably cost-effective. The BOM includes (possibly-
89 outdated) component pricing, and everything is available from Digikey
90 and the usual distributors.
91
92 If you've never assembled a modern circuit board by hand, then this is
93 not a good place to start. Some of the components (e.g. the crystals)
94 must not be assembled with a soldering iron, and require hot air.
95
96 The schematics are included; the component values given are not
97 necessarily correct for all situations, but it should be possible to do
98 nearly anything you would want with appropriate population options.
99
100 The printed circuit board artwork is also available, as Gerbers and an
101 Excellon drill file.
102
103
104 FUTURE PLANS, ENHANCEMENTS THAT YOU COULD MAKE:
105
106 At some point I should write software involving a proper real-time
107 operating system for the ARM. I would then provide interrupt-driven
108 drivers for many of the peripherals that are polled now (the USB,
109 the data stream from the FPGA), which would make it easier to develop
110 complex applications.
111
112 It would not be all that hard to implement the ISO 15693 reader properly
113 (with anticollision, all the commands supported, and so on)--the signal
114 processing is already written, so it is all straightforward applications
115 work.
116
117 I have basic support for ISO 14443 as well: a sniffer, a simulated
118 tag, and a reader. It won't do anything useful unless you fill in the
119 high-layer protocol.
120
121 Nicer (i.e., closer-to-optimal) implementations of all kinds of signal
122 processing would be useful as well.
123
124 A practical implementation of the learning-the-tag's-ID-from-what-the-
125 reader-broadcasts-during-anticollision attacks would be relatively
126 straightforward. This would involve some signal processing on the FPGA,
127 but not much else after that.
128
129 It would be neat to write a driver that could stream samples from the A/Ds
130 over USB to the PC, using the full available bandwidth of USB. I am not
131 yet sure what that would be good for, but surely something. This would
132 require a kernel-mode driver under Windows, though, which is more work.
133
134
135 LICENSING:
136
137 This program is free software; you can redistribute it and/or modify
138 it under the terms of the GNU General Public License as published by
139 the Free Software Foundation; either version 2 of the License, or
140 (at your option) any later version.
141
142 This program is distributed in the hope that it will be useful,
143 but WITHOUT ANY WARRANTY; without even the implied warranty of
144 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
145 GNU General Public License for more details.
146
147 You should have received a copy of the GNU General Public License
148 along with this program; if not, write to the Free Software
149 Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
150
151
152 Jonathan Westhues
153 user jwesthues, at host cq.cx
154
155 May 2007, Cambridge MA
156
Impressum, Datenschutz