]> git.zerfleddert.de Git - proxmark3-svn/blame_incremental - README.md
CHG: "hf legic write" started to change this command to the updated code
[proxmark3-svn] / README.md
... / ...
CommitLineData
1The iceman fork
2===============
3[![Build Status](https://travis-ci.org/iceman1001/proxmark3.svg?branch=master)](https://travis-ci.org/iceman1001/proxmark3) [![Coverity Status](https://scan.coverity.com/projects/5117/badge.svg)](https://scan.coverity.com/projects/proxmark3_iceman_fork) [![Latest release] (https://img.shields.io/github/release/iceman1001/proxmark3.svg)] (https://github.com/iceman1001/proxmark3/releases/latest)
4
5##This fork is HIGHLY experimental (or bleeding edge)
6
7##Donate
8https://paypal.me/iceman1001/
9Feel free to donate. All support is welcome.
10
11##Notice
12There is so much in this fork, with all fixes and additions its basically the most enhanced fork to this day for the Proxmark3 device. Which makes it so awesum to play with. Do please play with it. Get excited and experiment. As a side note with all coverity scan fixes this client is much more stable than PM3 Master even if I tend to break it sometimes. I'll try to make a release when this fork becomes stable between my experiments.
13
14##Official
15The official Proxmark repository is found here: https://github.com/Proxmark/proxmark3
16
17##Coverity Scan Config & Run
18Download the Coverity Scan Self-buld and install it.
19You will need to configure ARM-NON-EABI- Compiler for it to use:
20
21- Configure
22`cov-configure --comptype gcc --compiler /opt/devkitpro/devkitARM/bin/arm-none-eabi-gcc`
23
24- run it (I'm running on Ubuntu)
25`cov-build --dir cov-int make all`
26
27- make a tarball
28`tar czvf proxmark3.tgz cov-int`
29
30- upload it to coverity.com
31
32##Whats changed?
33Whats so special with this fork? I have scraped the web for different enhancements to the PM3 source code and not all of them ever found their way to the master branch.
34Among the stuff is
35
36 * Jonor's hf 14a raw timing patch
37 * Piwi's updates. (usually gets into the master)
38 * Piwi's "topaz" branch
39 * Piwi's "hardnested" branch
40 * Holiman's iclass, (usually gets into the master)
41 * Marshmellow's fixes (usually gets into the master)
42 * Midnitesnake's Ultralight, Ultralight-c enhancements
43 * Izsh's lf peak modification / iir-filtering
44 * Aspers's tips and tricks from inside the PM3-gui-tool, settings.xml and other stuff.
45 * My own desfire, Ultralight extras, LF T55xx enhancements, bugs fixes (filelength, hf mf commands ), TNP3xxx lua scripts, Awid26, skidata scripts (will come)
46 * other obscure patches like for the sammy-mode, (offline you know), tagidentifications, defaultkeys.
47 * Minor textual changes here and there.
48 * Simulation of Ultralight/Ntag.
49 * Marshmellow's and my "RevEng" addon for the client. Ref: http://reveng.sourceforge.net/ Now using reveng1.31
50 * J-Run alternative bruteforce Mifare nested auths.. (you need one other exe to make it work)
51 * A Bruteforce for T55XX passwords against tag.
52 * A Bruteforce for AWID 26, starting w a facilitycode then trying all 0xFFFF cardnumbers via simulation. To be used against a AWID Reader.
53 * A Bruteforce for HID, starting w a facilitycode then trying all 0xFFFF cardnumbers via simulation. To be used against a HID Reader.
54 * Blaposts Crapto1 v3.3
55 * Icsom's legic script and legic enhancements
56 * Aczid's bitsliced bruteforce solver in 'hf mf hardnested'
57
58##Straight from the CHANGELOG
59=============================
60 - Added `hf mf key_brute` - adds J-Runs 2nd phase bruteforce ref: https://github.com/J-Run/mf_key_brute (iceman)
61 - Added `lf jablotron` - adds demod/clone/sim of Jablotron LF tags. (iceman)
62 - Added `lf t55xx recoverpw` - adds a new password recovery using bitflips and partial flips if password write went bad. (alexgrin)
63 - `hf legic` - added improved legic data mapping. (jason)
64 - `hf mf mifare` - added possibility to target key A|B (douniwan5788)
65 - Added `analyse lcr` - added a new main command group, to help analysing bytes & bits & nibbles. (iceman)
66 - Added `lf nedap` - added identification of a NEDAP tag. (iceman)
67 - `lf viking clone` - fixed a bug. (iceman)
68 - Added bitsliced bruteforce solver in `hf mf hardnested` (Aczid)
69 - `hf mf chk` speedup (iceman)
70 - `hf 14a/mf sim x` attack mode, now uses also moebius version of mfkey32 to try finding the key. (iceman)
71 - `hf 14a sim` Added emulation of Mifare cards with 10byte UID length. (iceman)
72 - `hf mf sim` Added emulation of Mifare cards with 10byte UID length. (iceman)
73 - Added `lf guard clone/sim` (iceman)
74 - Added `lf pyramd clone/sim` (iceman)
75 - trying to fix `hf 14b` command to be able to read CALYPSO card. (iceman)
76 - `hf legic load`, it now loads faster and a casting bug is gone. (iceman)
77 - Added `hf legic calccrc8` added a method to calculate the legic crc-8 value (iceman)
78 - `hf legic decode` fixed the output overflow bugs, better printing (iceman)
79 - Coverity Scan fixes a lot of resource leaks, etc (iceman)
80 - Added `lf presco *` commands started (iceman)
81 - Added `lf hid wiegand` added a method to calculate WIEGAND in different formats, (iceman)
82 - `hf mf chkkeys` better printing, same table output as nested, faster execution and added Adam Lauries "try to read Key B if Key A is found" (iceman)
83 - `hf mf nested` better printing and added Adam Lauries "try to read Key B if Key A is found" (iceman)
84 - `hf mf mifare` fixing the zero parity path, which doesn't got called. (iceman)
85 - Updated the @blapost's Crapto1 implementation to v3.3 (blapost)
86 - `hf mf c*` updated the calling structure and refactored of the chinese magic commands (iceman, marshmellow)
87 - Started to add Peter Fillmore's EMV fork into Iceman fork. ref: https://github.com/peterfillmore/proxmark3 (peter fillmore, iceman)
88 - Added Travis-CI automatic build integration with GitHub fork. (iceman)
89 - Updated the Reveng 1.30 sourcecode to 1.31 from Reveng project homepage (iceman)
90 - Updated the Reveng 1.31 sourcecode to 1.40 from Reveng project homepage (iceman)
91
92 - Added possibility to write direct to a Legic Prime Tag (MIM256/1024) without using values from the 'BigBuffer' -> 'hf legic writeRaw <addr> <value>' (icsom)
93 - Added possibility to decrease DCF values at address 0x05 & 0x06 on a Legic Prime Tag
94 DCF-value will be pulled from the BigBuffer (address 0x05 & 0x06) so you have to
95 load the data into the BigBuffer before with 'hf legic load <path/to/legic.dump>' & then
96 write the DCF-Values (both at once) with 'hf legic write 0x05 0x02' (icsom)
97 - Added script `legic.lua` for display and edit Data of Legic-Prime Tags (icsom)
98 - Added the experimental HITAG_S support (spenneb)
99 - Added topaz detection to `hf search` (iceman)
100 - Fixed the silent mode for 14b to be used inside `hf search` (iceman)
101
102---
103Give me a hint, and I'll see if I can't merge in the stuff you have.
104
105I don't actually know how to make small pull-request to github :( and that is the number one reason for me not pushing a lot of things back to the PM3 master.
106
107##PM3 GUI
108I do tend to rename and move stuff around, the official PM3-GUI from Gaucho will not work so well. *sorry*
109
110##Development
111This fork now compiles just fine on
112 - Windows/mingw environment with Qt5.6.1 & GCC 4.8
113 - Ubuntuu 1404, 1510
114 - Mac OS X (or before the hardnested BF solver at least)
115
116##Setup and build for UBUNTU
117GC made updates to allow this to build easily on Ubuntu 14.04.2 LTS or 15.10
118See https://github.com/Proxmark/proxmark3/wiki/Ubuntu%20Linux
119
120- Run
121`sudo apt-get install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev`
122
123Follow these instructions
124Get devkitARM release 41 from SourceForge (choose either the 64/32 bit depending on your architecture, it is assumed you know how to check and recognize your architecture):
125
126(64-bit) http://sourceforge.net/projects/devkitpro/files/devkitARM/previous/devkitARM_r41-x86_64-linux.tar.bz2/download
127(32-bit) http://sourceforge.net/projects/devkitpro/files/devkitARM/previous/devkitARM_r41-i686-linux.tar.bz2/download
128
129- Extract the contents of the .tar.bz2
130`tar jxvf devkitARM_r41-<arch>-linux.tar.bz2`
131
132- Create a directory for the arm dev kit
133`sudo mkdir -p /opt/devkitpro/`
134
135- Move the ARM developer kit to the newly created directory
136`sudo mv devkitARM /opt/devkitpro/`
137
138- Add the appropriate environment variable
139`export PATH=${PATH}:/opt/devkitpro/devkitARM/bin/`
140
141- Add the environment variable to your profile
142`echo 'PATH=${PATH}:/opt/devkitpro/devkitARM/bin/ ' >> ~/.bashrc`
143
144- Clone iceman fork
145`git clone https://github.com/iceman1001/proxmark3.git`
146
147- Get the latest commits
148`git pull`
149
150- CLEAN COMPILE
151`make clean && make all`
152
153- Flash the BOOTROM
154`client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf`
155
156- Flash the FULLIMAGE
157`client/flasher /dev/ttyACM0 armsrc/obj/fullimage.elf`
158
159- Change into the client folder
160`cd client`
161
162- Run the client
163`./proxmark3 /dev/ttyACM0`
164
165##Homebrew (Mac OS X)
166These instructions comes from @Chrisfu, where I got the proxmark3.rb scriptfile from.
167Further questions about Mac & Homebrew, contact @Chrisfu (https://github.com/chrisfu/)
168
1691. Install homebrew if you haven't yet already done so: http://brew.sh/
170
1712. Tap this repo: `brew tap iceman1001/proxmark3`
172
1733. Install Proxmark3: `brew install proxmark3` for stable release or `brew install --HEAD proxmark3` for latest non-stable from GitHub.
174
175##Docker container
176I recently added a docker container on Docker HUB. You find it here: https://hub.docker.com/r/iceman1001/proxmark3/
177Follow those instructions to get it up and running. No need for the old proxspace-environment anymore.
178
179[1.6.0] How to start: https://www.youtube.com/watch?v=b5Zta89Cf6Q
180[1.6.0] How to connect: https://youtu.be/0ZS2t5C-caI
181[1.6.1] How to flash: https://www.youtube.com/watch?v=WXouhuGYEiw
182
183Recommendations:
184Use only container tag [1.6.4]
185
186
187## Building on Windows
188### 1. QT Open Source
189Download QT 5.6.1: http://download.qt.io/archive/qt/5.6/5.6.1-1/qt-opensource-windows-x86-mingw492-5.6.1-1.exe
190Install to `C:\Qt` and choose the following components to be installed:
191- QT - MinGW 32 bit
192- Tools - MinGW
193
194In your shell from MSYS (see below), make sure you set QTDIR to your QT installation and add its bin to your path as well:
195`export QTDIR=/c/Qt/5.6/mingw492_32`
196`export PATH=$PATH:$QTDIR/bin`
197
198### 2. MSYS
199MSYS is a collection of GNU utilities such as bash, make, gawk and grep to allow building of applications and programs which depend on traditionally UNIX tools to be present. It is intended to supplement MinGW and the deficiencies of the cmd shell.
200
201Download MSYS: http://downloads.sourceforge.net/mingw/MSYS-1.0.11.exe
202
203Follow the installation procedure, you may want to install MSYS to `C:\Qt\msys` and when asked where is your MinGW installation and for its path answer the following: `c:/Qt/Tools/mingw492_32`
204
205### 3. Readline
206Download and unpack: https://sourceforge.net/projects/gnuwin32/files/readline/5.0-1/readline-5.0-1-bin.zip/download
207
208`bin/*` to `C:\Qt\5.6\Tools\mingw492_32\bin`
209`include/*` to `C:\Qt\5.6\Tools\mingw492_32\include`
210`lib/*` to `C:\Qt\5.6\Tools\mingw492_32\lib`
211
212### 4. LibUSB
213Download and unpack: https://sourceforge.net/projects/libusb-win32/files/latest/download?source=files
214
215`include/lusb0_usb.h` to `C:\Qt\5.6\Tools\mingw492_32\include`
216`lib/gcc/libusb.a` to `C:\Qt\5.6\Tools\mingw492_32\lib`
217
218### 5. DevkitPro
219Download and install: https://sourceforge.net/projects/devkitpro/files/latest/download?source=files
220
221You only need devkitARM, nothing more (no extra lib or anything else) to compile the firmware (ARM) side. Assuming you installed it to `C:\devkitpro`, make sure you set the `DEVKITARM` environment variable to `/c/devkitPro/devkitARM` and add its bin to your PATH:
222`export DEVKITARM=/c/devkitPro/devkitARM`
223`export PATH=$PATH:$DEVKITARM/bin`
224
225### 6. Build and run
226Download and install Git for Windows: https://git-scm.com/download/win
227
228- Run minimal system: `C:\Qt\msys\msys.bat`
229
230- Set the environment:
231`export DEVKITARM=/c/devkitPro/devkitARM`
232`export PATH=$PATH:$DEVKITARM/bin`
233`export QTDIR=/c/Qt/5.6/mingw492_32`
234`export PATH=$PATH:$QTDIR/bin`
235
236- Clone iceman fork
237`git clone https://github.com/iceman1001/proxmark3.git`
238
239- Get the latest commits
240`git pull`
241
242- CLEAN COMPILE
243`make clean && make all`
244
245Assuming you have Proxmark3 Windows drivers installed you can run the Proxmark software where "X" is the com port number assigned to proxmark3 under Windows.
246
247- Flash the BOOTROM
248`client/flasher.exe comX -b bootrom/obj/bootrom.elf`
249
250- Flash the FULLIMAGE
251`client/flasher.exe comX armsrc/obj/fullimage.elf`
252
253- Change into the client folder
254`cd client`
255
256- Run the client
257`proxmark3.exe comX`
258
259##Buying a proxmark3
260The Proxmark 3 device is available for purchase (assembled and tested) from the following locations:
261
262 * http://proxmark3.tictail.com/ (For buyers in EU, most likely in Sweden)
263
264 * http://www.elechouse.com/ (new and revised hardware package 2015, located in China)
265
266
267##Enjoy
268
269January 2015, Sweden
270iceman at host iuse.se
271
272
273
274
275##Note from Jonathan Westhues
276Most of the ultra-low-volume contract assemblers could put
277something like this together with a reasonable yield. A run of around
278a dozen units is probably cost-effective. The BOM includes (possibly-
279outdated) component pricing, and everything is available from Digikey
280and the usual distributors.
281
282If you've never assembled a modern circuit board by hand, then this is
283not a good place to start. Some of the components (e.g. the crystals)
284must not be assembled with a soldering iron, and require hot air.
285
286The schematics are included; the component values given are not
287necessarily correct for all situations, but it should be possible to do
288nearly anything you would want with appropriate population options.
289
290The printed circuit board artwork is also available, as Gerbers and an
291Excellon drill file.
292
293
294LICENSING:
295
296This program is free software; you can redistribute it and/or modify
297it under the terms of the GNU General Public License as published by
298the Free Software Foundation; either version 2 of the License, or
299(at your option) any later version.
300
301This program is distributed in the hope that it will be useful,
302but WITHOUT ANY WARRANTY; without even the implied warranty of
303MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
304GNU General Public License for more details.
305
306You should have received a copy of the GNU General Public License
307along with this program; if not, write to the Free Software
308Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
309
310
311Jonathan Westhues
312user jwesthues, at host cq.cx
313
314May 2007, Cambridge MA
Impressum, Datenschutz