]> git.zerfleddert.de Git - proxmark3-svn/blame - README.md
CHG: `lf em` - refactored @marshmellow42 's em paritycheck.
[proxmark3-svn] / README.md
CommitLineData
02b6f355 1The iceman fork
c00fc47d 2===============
b1d615df 3[![Build Status](https://travis-ci.org/iceman1001/proxmark3.svg?branch=master)](https://travis-ci.org/iceman1001/proxmark3) [![Coverity Status](https://scan.coverity.com/projects/5117/badge.svg)](https://scan.coverity.com/projects/proxmark3_iceman_fork) [![Latest release] (https://img.shields.io/github/release/iceman1001/proxmark3.svg)](https://github.com/iceman1001/proxmark3/releases/latest)
883c82b5 4
dac58254 5##This fork is HIGHLY experimental (or bleeding edge)
02b6f355 6
8e4021fd
I
7##Donate
8https://paypal.me/iceman1001/
9Feel free to donate. All support is welcome.
10
703ac289 11##Notice
dac58254 12There is so much in this fork, with all fixes and additions its basically the most enhanced fork to this day for the Proxmark3 device. Which makes it so awesum to play with. Do please play with it. Get excited and experiment. As a side note with all coverity scan fixes this client is much more stable than PM3 Master even if I tend to break it sometimes. I'll try to make a release when this fork becomes stable between my experiments.
c0bab227 13
d79411bf 14##Official
02b6f355 15The official Proxmark repository is found here: https://github.com/Proxmark/proxmark3
16
8b89fcae 17##Coverity Scan Config & Run
b112787d 18Download the Coverity Scan Self-buld and install it.
19You will need to configure ARM-NON-EABI- Compiler for it to use:
20
7c030a91 21- Configure
f3c2458a 22`cov-configure --comptype gcc --compiler /opt/devkitpro/devkitARM/bin/arm-none-eabi-gcc`
b112787d 23
7c030a91 24- run it (I'm running on Ubuntu)
f3c2458a 25`cov-build --dir cov-int make all`
b112787d 26
7c030a91 27- make a tarball
f3c2458a 28`tar czvf proxmark3.tgz cov-int`
b112787d 29
7c030a91 30- upload it to coverity.com
b112787d 31
703ac289 32##Whats changed?
6063655a 33Whats so special with this fork? I have scraped the web for different enhancements to the PM3 source code and not all of them ever found their way to the master branch.
02b6f355 34Among the stuff is
35
36 * Jonor's hf 14a raw timing patch
37 * Piwi's updates. (usually gets into the master)
38 * Piwi's "topaz" branch
39 * Piwi's "hardnested" branch
40 * Holiman's iclass, (usually gets into the master)
41 * Marshmellow's fixes (usually gets into the master)
42 * Midnitesnake's Ultralight, Ultralight-c enhancements
43 * Izsh's lf peak modification / iir-filtering
44 * Aspers's tips and tricks from inside the PM3-gui-tool, settings.xml and other stuff.
45 * My own desfire, Ultralight extras, LF T55xx enhancements, bugs fixes (filelength, hf mf commands ), TNP3xxx lua scripts, Awid26, skidata scripts (will come)
46 * other obscure patches like for the sammy-mode, (offline you know), tagidentifications, defaultkeys.
47 * Minor textual changes here and there.
48 * Simulation of Ultralight/Ntag.
6063655a 49 * Marshmellow's and my "RevEng" addon for the client. Ref: http://reveng.sourceforge.net/ Now using reveng1.31
f3c2458a 50 * J-Run alternative bruteforce Mifare nested auths.. (you need one other exe to make it work)
02b6f355 51 * A Bruteforce for T55XX passwords against tag.
52 * A Bruteforce for AWID 26, starting w a facilitycode then trying all 0xFFFF cardnumbers via simulation. To be used against a AWID Reader.
c0bab227 53 * A Bruteforce for HID, starting w a facilitycode then trying all 0xFFFF cardnumbers via simulation. To be used against a HID Reader.
b112787d 54 * Blaposts Crapto1 v3.3
f3c2458a 55 * Icsom's legic script and legic enhancements
56 * Aczid's bitsliced bruteforce solver in 'hf mf hardnested'
fdefe5cb 57
c00fc47d
I
58##Straight from the CHANGELOG
59=============================
b1d615df 60## [1.6.9][icemanfork] [2017-02-06]
61 - Serial speedup, if possible 408600baud otherwise default to 115200baud (iceman)
62 - `hf emv` - Added Peter Fillmore's EMV branch now compiles on iceman fork. See seperate issue. (iceman)
63 - `hf 14a reader` - Aztek detection. (iceman)
64 - `standalone mode` - added more detection of tags and refactored (iceman)
65 - `script run ufodump` - dumps an Aztek tag. (iceman)
66 - `script run hard_autopwn` - runs hardnested attack against all sectors on tag (iceman)
67 - Added lf cotag read, and added it to lf search (iceman)
68 - Added hitag2 read UID only and added that to lf search (marshmellow)
69 - `lf search` - check for if signal is only noice (marshmellow)
70 - `hf 14a reader` - fixed a bug when card has sak 0x00 but still is not UL/NTAG etc. (iceman)
71 - `hf mf sim` / `hf 14a sim` - use random nonce. (micolous)
72 - `hw tune` - only prints out if voltage is detected from antenna. (iceman)
73 - `hf iclass decrypt` - only decrypt Application1 (iceman)
74 - `lf t55xx detect` - when finding multiple possible config blocks, see if a known configblock exists and select. (iceman)
75
185d675b 76 - Added `hf mf key_brute` - adds J-Runs 2nd phase bruteforce ref: https://github.com/J-Run/mf_key_brute (iceman)
77 - Added `lf jablotron` - adds demod/clone/sim of Jablotron LF tags. (iceman)
78 - Added `lf t55xx recoverpw` - adds a new password recovery using bitflips and partial flips if password write went bad. (alexgrin)
79 - `hf legic` - added improved legic data mapping. (jason)
80 - `hf mf mifare` - added possibility to target key A|B (douniwan5788)
81 - Added `analyse lcr` - added a new main command group, to help analysing bytes & bits & nibbles. (iceman)
82 - Added `lf nedap` - added identification of a NEDAP tag. (iceman)
83 - `lf viking clone` - fixed a bug. (iceman)
84 - Added bitsliced bruteforce solver in `hf mf hardnested` (Aczid)
85 - `hf mf chk` speedup (iceman)
86 - `hf 14a/mf sim x` attack mode, now uses also moebius version of mfkey32 to try finding the key. (iceman)
87 - `hf 14a sim` Added emulation of Mifare cards with 10byte UID length. (iceman)
88 - `hf mf sim` Added emulation of Mifare cards with 10byte UID length. (iceman)
89 - Added `lf guard clone/sim` (iceman)
90 - Added `lf pyramd clone/sim` (iceman)
91 - trying to fix `hf 14b` command to be able to read CALYPSO card. (iceman)
6063655a 92 - `hf legic load`, it now loads faster and a casting bug is gone. (iceman)
185d675b 93 - Added `hf legic calccrc8` added a method to calculate the legic crc-8 value (iceman)
6063655a 94 - `hf legic decode` fixed the output overflow bugs, better printing (iceman)
95 - Coverity Scan fixes a lot of resource leaks, etc (iceman)
185d675b 96 - Added `lf presco *` commands started (iceman)
97 - Added `lf hid wiegand` added a method to calculate WIEGAND in different formats, (iceman)
6063655a 98 - `hf mf chkkeys` better printing, same table output as nested, faster execution and added Adam Lauries "try to read Key B if Key A is found" (iceman)
99 - `hf mf nested` better printing and added Adam Lauries "try to read Key B if Key A is found" (iceman)
100 - `hf mf mifare` fixing the zero parity path, which doesn't got called. (iceman)
101 - Updated the @blapost's Crapto1 implementation to v3.3 (blapost)
102 - `hf mf c*` updated the calling structure and refactored of the chinese magic commands (iceman, marshmellow)
103 - Started to add Peter Fillmore's EMV fork into Iceman fork. ref: https://github.com/peterfillmore/proxmark3 (peter fillmore, iceman)
104 - Added Travis-CI automatic build integration with GitHub fork. (iceman)
185d675b 105 - Updated the Reveng 1.30 sourcecode to 1.31 from Reveng project homepage (iceman)
106 - Updated the Reveng 1.31 sourcecode to 1.40 from Reveng project homepage (iceman)
6063655a 107
108 - Added possibility to write direct to a Legic Prime Tag (MIM256/1024) without using values from the 'BigBuffer' -> 'hf legic writeRaw <addr> <value>' (icsom)
109 - Added possibility to decrease DCF values at address 0x05 & 0x06 on a Legic Prime Tag
110 DCF-value will be pulled from the BigBuffer (address 0x05 & 0x06) so you have to
111 load the data into the BigBuffer before with 'hf legic load <path/to/legic.dump>' & then
112 write the DCF-Values (both at once) with 'hf legic write 0x05 0x02' (icsom)
113 - Added script `legic.lua` for display and edit Data of Legic-Prime Tags (icsom)
114 - Added the experimental HITAG_S support (spenneb)
115 - Added topaz detection to `hf search` (iceman)
185d675b 116 - Fixed the silent mode for 14b to be used inside `hf search` (iceman)
6063655a 117
118---
b1d615df 119##Why don't you merged with offical PM3 Master?
02b6f355 120I don't actually know how to make small pull-request to github :( and that is the number one reason for me not pushing a lot of things back to the PM3 master.
b1d615df 121Me fiddling with the code so much, there is a nightmare in merging a PR. Luckily I have @marshmellow42 who takes some stuff and push PR's back.
122
123##Why don't you add nnnn or mmmm functionality?
124Give me a hint, and I'll see if I can't merge in the stuff you have.
02b6f355 125
703ac289 126##PM3 GUI
02b6f355 127I do tend to rename and move stuff around, the official PM3-GUI from Gaucho will not work so well. *sorry*
128
703ac289 129##Development
c0bab227 130This fork now compiles just fine on
9b8fb1da 131 - Windows/mingw environment with Qt5.6.1 & GCC 4.8
fd056682 132 - Ubuntu 1404, 1510, 1604
b1d615df 133 - Mac OS X
c0bab227 134
703ac289 135##Setup and build for UBUNTU
d06c81b7 136GC made updates to allow this to build easily on Ubuntu 14.04.2 LTS, 15.10 or 16.04
c0bab227 137See https://github.com/Proxmark/proxmark3/wiki/Ubuntu%20Linux
02b6f355 138
d06c81b7
I
139A nice and cool install script made by @daveio is found here:
140https://github.com/daveio/attacksurface/blob/master/proxmark3/pm3-setup.sh
141
7c030a91 142- Run
abf3b8af 143`sudo apt-get install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev gcc-arm-none-eabi`
c0bab227 144
7c030a91 145- Clone iceman fork
76fc7219 146`git clone https://github.com/iceman1001/proxmark3.git`
02b6f355 147
d233b629 148- Get the latest commits
76fc7219 149`git pull`
c0bab227 150
d06c81b7 151- Install the blacklist rules
0ecec539
I
152`make udev`
153
d06c81b7 154- add user to dialout group (if you on a Linux/ubuntu/debian). If you do this one, you need to logout and login in again to make sure your rights got changed.
abf3b8af
I
155`sudo adduser $USER dialout`
156
d06c81b7 157- Clean and complete compilation
76fc7219 158`make clean && make all`
02b6f355 159
d233b629 160- Flash the BOOTROM
76fc7219 161`client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf`
c0bab227 162
d233b629 163- Flash the FULLIMAGE
76fc7219 164`client/flasher /dev/ttyACM0 armsrc/obj/fullimage.elf`
02b6f355 165
9fe46b69 166- Change into the client folder
76fc7219 167`cd client`
02b6f355 168
d233b629 169- Run the client
76fc7219 170`./proxmark3 /dev/ttyACM0`
c0bab227 171
703ac289 172##Homebrew (Mac OS X)
dc1c9ae4 173These instructions comes from @Chrisfu, where I got the proxmark3.rb scriptfile from.
4003623b 174Further questions about Mac & Homebrew, contact @Chrisfu (https://github.com/chrisfu/)
02b6f355 175
dc1c9ae4
I
1761. Install homebrew if you haven't yet already done so: http://brew.sh/
177
1782. Tap this repo: `brew tap iceman1001/proxmark3`
179
1803. Install Proxmark3: `brew install proxmark3` for stable release or `brew install --HEAD proxmark3` for latest non-stable from GitHub.
181
703ac289
I
182##Docker container
183I recently added a docker container on Docker HUB. You find it here: https://hub.docker.com/r/iceman1001/proxmark3/
184Follow those instructions to get it up and running. No need for the old proxspace-environment anymore.
dc1c9ae4 185
ba2e685d
I
186[1.6.0] How to start: https://www.youtube.com/watch?v=b5Zta89Cf6Q
187[1.6.0] How to connect: https://youtu.be/0ZS2t5C-caI
188[1.6.1] How to flash: https://www.youtube.com/watch?v=WXouhuGYEiw
189
beb2ce1f 190Recommendations: Use only latest container.
ba2e685d 191
dc1c9ae4 192
9b8fb1da
O
193## Building on Windows
194### 1. QT Open Source
195Download QT 5.6.1: http://download.qt.io/archive/qt/5.6/5.6.1-1/qt-opensource-windows-x86-mingw492-5.6.1-1.exe
196Install to `C:\Qt` and choose the following components to be installed:
197- QT - MinGW 32 bit
198- Tools - MinGW
199
200In your shell from MSYS (see below), make sure you set QTDIR to your QT installation and add its bin to your path as well:
f176990a 201`export QTDIR=/c/Qt/5.6/mingw49_32`
9b8fb1da
O
202`export PATH=$PATH:$QTDIR/bin`
203
204### 2. MSYS
205MSYS is a collection of GNU utilities such as bash, make, gawk and grep to allow building of applications and programs which depend on traditionally UNIX tools to be present. It is intended to supplement MinGW and the deficiencies of the cmd shell.
206
207Download MSYS: http://downloads.sourceforge.net/mingw/MSYS-1.0.11.exe
208
209Follow the installation procedure, you may want to install MSYS to `C:\Qt\msys` and when asked where is your MinGW installation and for its path answer the following: `c:/Qt/Tools/mingw492_32`
210
211### 3. Readline
212Download and unpack: https://sourceforge.net/projects/gnuwin32/files/readline/5.0-1/readline-5.0-1-bin.zip/download
213
bd437fdd
O
214`bin/*` to `C:\Qt\5.6\Tools\mingw492_32\bin`
215`include/*` to `C:\Qt\5.6\Tools\mingw492_32\include`
216`lib/*` to `C:\Qt\5.6\Tools\mingw492_32\lib`
9b8fb1da
O
217
218### 4. LibUSB
219Download and unpack: https://sourceforge.net/projects/libusb-win32/files/latest/download?source=files
220
bd437fdd
O
221`include/lusb0_usb.h` to `C:\Qt\5.6\Tools\mingw492_32\include`
222`lib/gcc/libusb.a` to `C:\Qt\5.6\Tools\mingw492_32\lib`
9b8fb1da
O
223
224### 5. DevkitPro
225Download and install: https://sourceforge.net/projects/devkitpro/files/latest/download?source=files
226
227You only need devkitARM, nothing more (no extra lib or anything else) to compile the firmware (ARM) side. Assuming you installed it to `C:\devkitpro`, make sure you set the `DEVKITARM` environment variable to `/c/devkitPro/devkitARM` and add its bin to your PATH:
228`export DEVKITARM=/c/devkitPro/devkitARM`
229`export PATH=$PATH:$DEVKITARM/bin`
230
2b2bccbd 231### 6. Install Strawberry Perl
2e78fbaa 232Download and install: https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/strawberry-perl/strawberry-perl-5.10.1.3.msi
b2c63717 233
234### 7. Build and run
9b8fb1da
O
235Download and install Git for Windows: https://git-scm.com/download/win
236
237- Run minimal system: `C:\Qt\msys\msys.bat`
238
239- Set the environment:
240`export DEVKITARM=/c/devkitPro/devkitARM`
241`export PATH=$PATH:$DEVKITARM/bin`
f176990a 242`export QTDIR=/c/Qt/5.6/mingw49_32`
9b8fb1da
O
243`export PATH=$PATH:$QTDIR/bin`
244
245- Clone iceman fork
246`git clone https://github.com/iceman1001/proxmark3.git`
247
248- Get the latest commits
249`git pull`
250
251- CLEAN COMPILE
252`make clean && make all`
253
254Assuming you have Proxmark3 Windows drivers installed you can run the Proxmark software where "X" is the com port number assigned to proxmark3 under Windows.
255
256- Flash the BOOTROM
257`client/flasher.exe comX -b bootrom/obj/bootrom.elf`
258
259- Flash the FULLIMAGE
260`client/flasher.exe comX armsrc/obj/fullimage.elf`
261
262- Change into the client folder
263`cd client`
264
265- Run the client
266`proxmark3.exe comX`
267
8b89fcae 268##Buying a proxmark3
c0bab227 269The Proxmark 3 device is available for purchase (assembled and tested) from the following locations:
270
b82c2f85
I
271 * http://proxmark3.tictail.com/ (For buyers in EU, most likely in Sweden)
272
273 * http://www.elechouse.com/ (new and revised hardware package 2015, located in China)
02b6f355 274
c00fc47d 275
4003623b
I
276##Enjoy
277
278January 2015, Sweden
279iceman at host iuse.se
280
281
282
283
8b89fcae 284##Note from Jonathan Westhues
02b6f355 285Most of the ultra-low-volume contract assemblers could put
286something like this together with a reasonable yield. A run of around
287a dozen units is probably cost-effective. The BOM includes (possibly-
288outdated) component pricing, and everything is available from Digikey
289and the usual distributors.
290
291If you've never assembled a modern circuit board by hand, then this is
292not a good place to start. Some of the components (e.g. the crystals)
293must not be assembled with a soldering iron, and require hot air.
294
295The schematics are included; the component values given are not
296necessarily correct for all situations, but it should be possible to do
297nearly anything you would want with appropriate population options.
298
299The printed circuit board artwork is also available, as Gerbers and an
300Excellon drill file.
301
302
303LICENSING:
304
305This program is free software; you can redistribute it and/or modify
306it under the terms of the GNU General Public License as published by
307the Free Software Foundation; either version 2 of the License, or
308(at your option) any later version.
309
310This program is distributed in the hope that it will be useful,
311but WITHOUT ANY WARRANTY; without even the implied warranty of
312MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
313GNU General Public License for more details.
314
315You should have received a copy of the GNU General Public License
316along with this program; if not, write to the Free Software
317Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
318
319
320Jonathan Westhues
321user jwesthues, at host cq.cx
322
323May 2007, Cambridge MA
Impressum, Datenschutz