]> git.zerfleddert.de Git - proxmark3-svn/blob - README.md
6b7f8197fab907ceecd63cb84db05ac83e7bb4cf
[proxmark3-svn] / README.md
1 The iceman fork
2 ===============
3 [![Build Status](https://travis-ci.org/iceman1001/proxmark3.svg?branch=master)](https://travis-ci.org/iceman1001/proxmark3) [![Coverity Status](https://scan.coverity.com/projects/5117/badge.svg)](https://scan.coverity.com/projects/proxmark3_iceman_fork) [![Latest release] (https://img.shields.io/github/release/iceman1001/proxmark3.svg)](https://github.com/iceman1001/proxmark3/releases/latest)
4
5 ##This fork is HIGHLY experimental (or bleeding edge)
6
7 ##Donate
8 https://paypal.me/iceman1001/
9 Feel free to donate. All support is welcome.
10
11 ##Notice
12 There is so much in this fork, with all fixes and additions its basically the most enhanced fork to this day for the Proxmark3 device. Which makes it so awesum to play with. Do please play with it. Get excited and experiment. As a side note with all coverity scan fixes this client is much more stable than PM3 Master even if I tend to break it sometimes. I'll try to make a release when this fork becomes stable between my experiments.
13
14 ##Official
15 The official Proxmark repository is found here: https://github.com/Proxmark/proxmark3
16
17 ##Coverity Scan Config & Run
18 Download the Coverity Scan Self-buld and install it.
19 You will need to configure ARM-NON-EABI- Compiler for it to use:
20
21 - Configure
22 `cov-configure --comptype gcc --compiler /opt/devkitpro/devkitARM/bin/arm-none-eabi-gcc`
23
24 - run it (I'm running on Ubuntu)
25 `cov-build --dir cov-int make all`
26
27 - make a tarball
28 `tar czvf proxmark3.tgz cov-int`
29
30 - upload it to coverity.com
31
32 ##Whats changed?
33 Whats so special with this fork? I have scraped the web for different enhancements to the PM3 source code and not all of them ever found their way to the master branch.
34 Among the stuff is
35
36 * Jonor's hf 14a raw timing patch
37 * Piwi's updates. (usually gets into the master)
38 * Piwi's "topaz" branch
39 * Piwi's "hardnested" branch
40 * Holiman's iclass, (usually gets into the master)
41 * Marshmellow's fixes (usually gets into the master)
42 * Midnitesnake's Ultralight, Ultralight-c enhancements
43 * Izsh's lf peak modification / iir-filtering
44 * Aspers's tips and tricks from inside the PM3-gui-tool, settings.xml and other stuff.
45 * My own desfire, Ultralight extras, LF T55xx enhancements, bugs fixes (filelength, hf mf commands ), TNP3xxx lua scripts, Awid26, skidata scripts (will come)
46 * other obscure patches like for the sammy-mode, (offline you know), tagidentifications, defaultkeys.
47 * Minor textual changes here and there.
48 * Simulation of Ultralight/Ntag.
49 * Marshmellow's and my "RevEng" addon for the client. Ref: http://reveng.sourceforge.net/ Now using reveng1.31
50 * J-Run alternative bruteforce Mifare nested auths.. (you need one other exe to make it work)
51 * A Bruteforce for T55XX passwords against tag.
52 * A Bruteforce for AWID 26, starting w a facilitycode then trying all 0xFFFF cardnumbers via simulation. To be used against a AWID Reader.
53 * A Bruteforce for HID, starting w a facilitycode then trying all 0xFFFF cardnumbers via simulation. To be used against a HID Reader.
54 * Blaposts Crapto1 v3.3
55 * Icsom's legic script and legic enhancements
56 * Aczid's bitsliced bruteforce solver in 'hf mf hardnested'
57
58 ##Straight from the CHANGELOG
59 =============================
60 ## [1.6.9][icemanfork] [2017-02-06]
61 - Serial speedup, if possible 408600baud otherwise default to 115200baud (iceman)
62 - `hf emv` - Added Peter Fillmore's EMV branch now compiles on iceman fork. See seperate issue. (iceman)
63 - `hf 14a reader` - Aztek detection. (iceman)
64 - `standalone mode` - added more detection of tags and refactored (iceman)
65 - `script run ufodump` - dumps an Aztek tag. (iceman)
66 - `script run hard_autopwn` - runs hardnested attack against all sectors on tag (iceman)
67 - Added lf cotag read, and added it to lf search (iceman)
68 - Added hitag2 read UID only and added that to lf search (marshmellow)
69 - `lf search` - check for if signal is only noice (marshmellow)
70 - `hf 14a reader` - fixed a bug when card has sak 0x00 but still is not UL/NTAG etc. (iceman)
71 - `hf mf sim` / `hf 14a sim` - use random nonce. (micolous)
72 - `hw tune` - only prints out if voltage is detected from antenna. (iceman)
73 - `hf iclass decrypt` - only decrypt Application1 (iceman)
74 - `lf t55xx detect` - when finding multiple possible config blocks, see if a known configblock exists and select. (iceman)
75
76 - Added `hf mf key_brute` - adds J-Runs 2nd phase bruteforce ref: https://github.com/J-Run/mf_key_brute (iceman)
77 - Added `lf jablotron` - adds demod/clone/sim of Jablotron LF tags. (iceman)
78 - Added `lf t55xx recoverpw` - adds a new password recovery using bitflips and partial flips if password write went bad. (alexgrin)
79 - `hf legic` - added improved legic data mapping. (jason)
80 - `hf mf mifare` - added possibility to target key A|B (douniwan5788)
81 - Added `analyse lcr` - added a new main command group, to help analysing bytes & bits & nibbles. (iceman)
82 - Added `lf nedap` - added identification of a NEDAP tag. (iceman)
83 - `lf viking clone` - fixed a bug. (iceman)
84 - Added bitsliced bruteforce solver in `hf mf hardnested` (Aczid)
85 - `hf mf chk` speedup (iceman)
86 - `hf 14a/mf sim x` attack mode, now uses also moebius version of mfkey32 to try finding the key. (iceman)
87 - `hf 14a sim` Added emulation of Mifare cards with 10byte UID length. (iceman)
88 - `hf mf sim` Added emulation of Mifare cards with 10byte UID length. (iceman)
89 - Added `lf guard clone/sim` (iceman)
90 - Added `lf pyramd clone/sim` (iceman)
91 - trying to fix `hf 14b` command to be able to read CALYPSO card. (iceman)
92 - `hf legic load`, it now loads faster and a casting bug is gone. (iceman)
93 - Added `hf legic calccrc8` added a method to calculate the legic crc-8 value (iceman)
94 - `hf legic decode` fixed the output overflow bugs, better printing (iceman)
95 - Coverity Scan fixes a lot of resource leaks, etc (iceman)
96 - Added `lf presco *` commands started (iceman)
97 - Added `lf hid wiegand` added a method to calculate WIEGAND in different formats, (iceman)
98 - `hf mf chkkeys` better printing, same table output as nested, faster execution and added Adam Lauries "try to read Key B if Key A is found" (iceman)
99 - `hf mf nested` better printing and added Adam Lauries "try to read Key B if Key A is found" (iceman)
100 - `hf mf mifare` fixing the zero parity path, which doesn't got called. (iceman)
101 - Updated the @blapost's Crapto1 implementation to v3.3 (blapost)
102 - `hf mf c*` updated the calling structure and refactored of the chinese magic commands (iceman, marshmellow)
103 - Started to add Peter Fillmore's EMV fork into Iceman fork. ref: https://github.com/peterfillmore/proxmark3 (peter fillmore, iceman)
104 - Added Travis-CI automatic build integration with GitHub fork. (iceman)
105 - Updated the Reveng 1.30 sourcecode to 1.31 from Reveng project homepage (iceman)
106 - Updated the Reveng 1.31 sourcecode to 1.40 from Reveng project homepage (iceman)
107
108 - Added possibility to write direct to a Legic Prime Tag (MIM256/1024) without using values from the 'BigBuffer' -> 'hf legic writeRaw <addr> <value>' (icsom)
109 - Added possibility to decrease DCF values at address 0x05 & 0x06 on a Legic Prime Tag
110 DCF-value will be pulled from the BigBuffer (address 0x05 & 0x06) so you have to
111 load the data into the BigBuffer before with 'hf legic load <path/to/legic.dump>' & then
112 write the DCF-Values (both at once) with 'hf legic write 0x05 0x02' (icsom)
113 - Added script `legic.lua` for display and edit Data of Legic-Prime Tags (icsom)
114 - Added the experimental HITAG_S support (spenneb)
115 - Added topaz detection to `hf search` (iceman)
116 - Fixed the silent mode for 14b to be used inside `hf search` (iceman)
117
118 ---
119 ##Why don't you merged with offical PM3 Master?
120 I don't actually know how to make small pull-request to github :( and that is the number one reason for me not pushing a lot of things back to the PM3 master.
121 Me fiddling with the code so much, there is a nightmare in merging a PR. Luckily I have @marshmellow42 who takes some stuff and push PR's back.
122
123 ##Why don't you add nnnn or mmmm functionality?
124 Give me a hint, and I'll see if I can't merge in the stuff you have.
125
126 ##PM3 GUI
127 I do tend to rename and move stuff around, the official PM3-GUI from Gaucho will not work so well. *sorry*
128
129 ##Development
130 This fork now compiles just fine on
131 - Windows/mingw environment with Qt5.6.1 & GCC 4.8
132 - Ubuntu 1404, 1510, 1604
133 - Mac OS X
134
135 ##Setup and build for UBUNTU
136 GC made updates to allow this to build easily on Ubuntu 14.04.2 LTS or 15.10
137 See https://github.com/Proxmark/proxmark3/wiki/Ubuntu%20Linux
138
139 - Run
140 `sudo apt-get install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev gcc-arm-none-eabi`
141
142 - Clone iceman fork
143 `git clone https://github.com/iceman1001/proxmark3.git`
144
145 - Get the latest commits
146 `git pull`
147
148 - Install the blacklist rules
149 `make udev`
150
151 - add user to dialout group (if you on a Linux/ubuntu/debian)
152 - if you do this one, you need to logout and login in again to make sure your rights got changed.
153 `sudo adduser $USER dialout`
154
155 - Clean and complete compilation
156 `make clean && make all`
157
158 - Flash the BOOTROM
159 `client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf`
160
161 - Flash the FULLIMAGE
162 `client/flasher /dev/ttyACM0 armsrc/obj/fullimage.elf`
163
164 - Change into the client folder
165 `cd client`
166
167 - Run the client
168 `./proxmark3 /dev/ttyACM0`
169
170 ##Homebrew (Mac OS X)
171 These instructions comes from @Chrisfu, where I got the proxmark3.rb scriptfile from.
172 Further questions about Mac & Homebrew, contact @Chrisfu (https://github.com/chrisfu/)
173
174 1. Install homebrew if you haven't yet already done so: http://brew.sh/
175
176 2. Tap this repo: `brew tap iceman1001/proxmark3`
177
178 3. Install Proxmark3: `brew install proxmark3` for stable release or `brew install --HEAD proxmark3` for latest non-stable from GitHub.
179
180 ##Docker container
181 I recently added a docker container on Docker HUB. You find it here: https://hub.docker.com/r/iceman1001/proxmark3/
182 Follow those instructions to get it up and running. No need for the old proxspace-environment anymore.
183
184 [1.6.0] How to start: https://www.youtube.com/watch?v=b5Zta89Cf6Q
185 [1.6.0] How to connect: https://youtu.be/0ZS2t5C-caI
186 [1.6.1] How to flash: https://www.youtube.com/watch?v=WXouhuGYEiw
187
188 Recommendations: Use only latest container.
189
190
191 ## Building on Windows
192 ### 1. QT Open Source
193 Download QT 5.6.1: http://download.qt.io/archive/qt/5.6/5.6.1-1/qt-opensource-windows-x86-mingw492-5.6.1-1.exe
194 Install to `C:\Qt` and choose the following components to be installed:
195 - QT - MinGW 32 bit
196 - Tools - MinGW
197
198 In your shell from MSYS (see below), make sure you set QTDIR to your QT installation and add its bin to your path as well:
199 `export QTDIR=/c/Qt/5.6/mingw49_32`
200 `export PATH=$PATH:$QTDIR/bin`
201
202 ### 2. MSYS
203 MSYS is a collection of GNU utilities such as bash, make, gawk and grep to allow building of applications and programs which depend on traditionally UNIX tools to be present. It is intended to supplement MinGW and the deficiencies of the cmd shell.
204
205 Download MSYS: http://downloads.sourceforge.net/mingw/MSYS-1.0.11.exe
206
207 Follow the installation procedure, you may want to install MSYS to `C:\Qt\msys` and when asked where is your MinGW installation and for its path answer the following: `c:/Qt/Tools/mingw492_32`
208
209 ### 3. Readline
210 Download and unpack: https://sourceforge.net/projects/gnuwin32/files/readline/5.0-1/readline-5.0-1-bin.zip/download
211
212 `bin/*` to `C:\Qt\5.6\Tools\mingw492_32\bin`
213 `include/*` to `C:\Qt\5.6\Tools\mingw492_32\include`
214 `lib/*` to `C:\Qt\5.6\Tools\mingw492_32\lib`
215
216 ### 4. LibUSB
217 Download and unpack: https://sourceforge.net/projects/libusb-win32/files/latest/download?source=files
218
219 `include/lusb0_usb.h` to `C:\Qt\5.6\Tools\mingw492_32\include`
220 `lib/gcc/libusb.a` to `C:\Qt\5.6\Tools\mingw492_32\lib`
221
222 ### 5. DevkitPro
223 Download and install: https://sourceforge.net/projects/devkitpro/files/latest/download?source=files
224
225 You only need devkitARM, nothing more (no extra lib or anything else) to compile the firmware (ARM) side. Assuming you installed it to `C:\devkitpro`, make sure you set the `DEVKITARM` environment variable to `/c/devkitPro/devkitARM` and add its bin to your PATH:
226 `export DEVKITARM=/c/devkitPro/devkitARM`
227 `export PATH=$PATH:$DEVKITARM/bin`
228
229 ### 6. Install Strawberry Perl
230 Download and install: https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/strawberry-perl/strawberry-perl-5.10.1.3.msi
231
232 ### 7. Build and run
233 Download and install Git for Windows: https://git-scm.com/download/win
234
235 - Run minimal system: `C:\Qt\msys\msys.bat`
236
237 - Set the environment:
238 `export DEVKITARM=/c/devkitPro/devkitARM`
239 `export PATH=$PATH:$DEVKITARM/bin`
240 `export QTDIR=/c/Qt/5.6/mingw49_32`
241 `export PATH=$PATH:$QTDIR/bin`
242
243 - Clone iceman fork
244 `git clone https://github.com/iceman1001/proxmark3.git`
245
246 - Get the latest commits
247 `git pull`
248
249 - CLEAN COMPILE
250 `make clean && make all`
251
252 Assuming you have Proxmark3 Windows drivers installed you can run the Proxmark software where "X" is the com port number assigned to proxmark3 under Windows.
253
254 - Flash the BOOTROM
255 `client/flasher.exe comX -b bootrom/obj/bootrom.elf`
256
257 - Flash the FULLIMAGE
258 `client/flasher.exe comX armsrc/obj/fullimage.elf`
259
260 - Change into the client folder
261 `cd client`
262
263 - Run the client
264 `proxmark3.exe comX`
265
266 ##Buying a proxmark3
267 The Proxmark 3 device is available for purchase (assembled and tested) from the following locations:
268
269 * http://proxmark3.tictail.com/ (For buyers in EU, most likely in Sweden)
270
271 * http://www.elechouse.com/ (new and revised hardware package 2015, located in China)
272
273
274 ##Enjoy
275
276 January 2015, Sweden
277 iceman at host iuse.se
278
279
280
281
282 ##Note from Jonathan Westhues
283 Most of the ultra-low-volume contract assemblers could put
284 something like this together with a reasonable yield. A run of around
285 a dozen units is probably cost-effective. The BOM includes (possibly-
286 outdated) component pricing, and everything is available from Digikey
287 and the usual distributors.
288
289 If you've never assembled a modern circuit board by hand, then this is
290 not a good place to start. Some of the components (e.g. the crystals)
291 must not be assembled with a soldering iron, and require hot air.
292
293 The schematics are included; the component values given are not
294 necessarily correct for all situations, but it should be possible to do
295 nearly anything you would want with appropriate population options.
296
297 The printed circuit board artwork is also available, as Gerbers and an
298 Excellon drill file.
299
300
301 LICENSING:
302
303 This program is free software; you can redistribute it and/or modify
304 it under the terms of the GNU General Public License as published by
305 the Free Software Foundation; either version 2 of the License, or
306 (at your option) any later version.
307
308 This program is distributed in the hope that it will be useful,
309 but WITHOUT ANY WARRANTY; without even the implied warranty of
310 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
311 GNU General Public License for more details.
312
313 You should have received a copy of the GNU General Public License
314 along with this program; if not, write to the Free Software
315 Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
316
317
318 Jonathan Westhues
319 user jwesthues, at host cq.cx
320
321 May 2007, Cambridge MA
Impressum, Datenschutz