iceman1001 [Thu, 30 Oct 2014 14:28:45 +0000 (15:28 +0100)]
ADD: Implemented a "hf 14b write" function using the CmdHF14BCmdRaw method. The function can write to SRI512 and SRIX4K tags only. Be extremly cautious when writing to Block 0xFF
iceman1001 [Mon, 27 Oct 2014 20:42:41 +0000 (21:42 +0100)]
FIX: Another try to see if the "lf em4x 410xsim" becomes better, added the clock in the calls since the auto detection of the clock seems to be wrong. I get 67, instead of 64...
FIX: changes the transfersize from sim -> pm3, was 48, now USB_CMD_DATA_SIZE (512) Much faster!
iceman1001 [Mon, 27 Oct 2014 18:46:21 +0000 (19:46 +0100)]
Inital test for the "lf em4x 410xsim / lf em4x 410xwatch" which I try to verify that the sim works.
Something about speed, the clock detection is not so good. should be 64, usually 67..
iceman1001 [Sun, 26 Oct 2014 20:25:06 +0000 (21:25 +0100)]
Minor bug fixes with help from Holiman.
FIX: sprint_hex, sprint_bin has better length detection.
FIX: ui.c has removed all c99 array declarations, with malloc
FIX: hfmfmfu.c wrong length in one array caused crashes in CmdHF14AMfURdCard
FIX: cmdlft55xx.c CmdDump has now a correct pwd string.
iceman1001 [Thu, 23 Oct 2014 22:04:56 +0000 (00:04 +0200)]
BUG: the lf read now uses "getbigbuffer" which the offset from where the data starts in "data samples nnnnn" needed to be set.
ADD: ioprox nxp identifikations
iceman1001 [Thu, 16 Oct 2014 13:05:27 +0000 (15:05 +0200)]
Small fixes,
Fix: removed a call to free, which I think made linux people unhappy during "lf t55xx rd 0"...
Add: "lf t55xx fsk" now kind of outputs binary from "FSK2a R/40 R/50"..
hf mf dump error handling, revive hf mf chk d option, provide known keys dictionary file
- hf mf dump: abort on unrecoverable errors. Don't create file dumpdata.bin in this case.
- hf mf chk: re-enabled and fixed option d (dump keys to dumpkeys.bin).
if there are unknown keys, write 0xffffffffffff instead to the file.
- provide a default key dictionary file for hf mf chk (default_keys.dic). Contents taken from
mf_default_keys.lua
fix/add support for 4K (and other non 1K) card sizes in hf mf commands
- hf mf rdsc (fix): didn't account for 16 block sectors, allowed max sector 63 instead of 39
- hf mf ecfill (add): added (optional) card size parameter and support for non 1K cards
- hf mf dump (add): added (optional) card size parameter and support for non 1K cards
- hf mf dump (fix): Access Condition 011 not handled correctly (tried to access with key A)
- hf mf restore (add): added (optional) card size parameter and support for non 1K cards
- hf mf nested (fix): didn't account for 16 block sectors, allowed max sector 63 instead of 39
- hf mf nested (fix): always dumped 16 keys to dumpkeys.bin instead of correct number
- hf mf chk (fix): always dumped 16 keys to dumpkeys.bin instead of correct number
- hf mf eget (fix): displayed three instead of one block
- hf mf eload (add): load 4K .eml files (but accepts 1K .eml files for backwards compatibility)
- hf mf esave (add): always save the whole emulator memory (4K) instead of 1K only
- hf mf ecfill (add): added (optional) card size parameter and support for non 1K cards
bugfixes hf mf sim
- output of debug messages caused communication failures due to timing issues.
hf mf dbg 4 now required to see these debug messages.
- changed help text for hf mf dbg
- fixed minor bugs in help texts for hf mf sim and hf mf ecset
- display "key A" or "key B" instead of "key=0" or "key=1 in hf mf sim
minor bugfixes to hf mf sniff and hf 14a snoop
- tracing was not always enabled when starting hf mf sniff or hf 14a snoop
- ATQA was displayed in wrong byte order in hf mf sniff
- 4 Byte UIDs were displayed as 7 Byte UIDs (padded with 0x000000) in hf mf sniff
- same for logfile names.
- assignment (=) had been used instead of == in comparisons (shouldn't have been relevant though)
minor bugfix and enhancement to hf 14a reader
- "SAK incorrectly claims ... " message was displayed incorrectly
- now decodes FSCI, SFGI, FWI and displays FSC, SFGT, FWT resp.
pwpiwi [Mon, 30 Jun 2014 06:21:50 +0000 (08:21 +0200)]
hf 14a reader enhancement
In order to be able to distinguish between Mifare Classic and Mifare Plus
in Security Level 1 (SL1, Mifare Classic Compatibility Mode), hf 14a reader
now always tries RATS - even if SAK claims not to support ISO14443-4.
iZsh [Sat, 21 Jun 2014 22:26:38 +0000 (00:26 +0200)]
New LF edge detection algorithm + lowpass filter
This is a new LF edge detection algorithm for the FPGA.
- It uses a low-pass IIR filter to clean the signal
(see https://fail0verflow.com/blog/2014/proxmark3-fpga-iir-filter.html)
- The algorithm is able to detect consecutive peaks in the same
direction
- It uses an envelope follower to dynamically adjust the peak thresholds
- The main threshold used in the envelope follower can be set from the ARM side
fpga/lf_edge_detect.v,
fpga/lp20khz_1MSa_iir_filter.v,
fpga/min_max_tracker.v: New file.
armsrc/apps.h (FPGA_CMD_SET_USER_BYTE1,
FPGA_CMD_SET_EDGE_DETECT_THRESHOLD): New FPGA command.
fpga/fpga_lf.v: Modify accordingly/Add a 8bit user register.
fpga/fpga_lf.bit: Update accordingly.
fpga/tests: New directory for testbenches
fpga/tests/Makefile: New file. It compiles the testbenches
and runs all the tests by default (comparing with the golden output)
fpga/tests/tb_lp20khz_1MSa_iir_filter.v,
fpga/tests/tb_min_max_tracker.v,
fpga/tests/tb_lf_edge_detect.v: New testbenches
fpga/tests/plot_edgedetect.py: New script to plot the results from
the edge detection tests.
fpga/tests/tb_data: New directory for data and golden outputs
Implemented client side changes for iclass hack, attempted to fix issues with trace. The trace functionality from iso14443 has been rewritten, unfortunately iclass used that also, which made iclass 'list' stop functioning, both for simulation and snooping
pwpiwi [Tue, 25 Mar 2014 20:38:24 +0000 (21:38 +0100)]
Improvements/Fixes to 14443 sniffing/snooping
- fixed a circular buffer rollover bug in iso14443a.c
- fixed 7 Byte UID handling in hf mf sniff
- fixed "cannot append" error in hf mf sniff d
- fixed hint on mfkey32 in hf mf sim x
- fixed hf mf sniff sometimes showing rogue data from previous calloc
- improve snooping/sniffing by syncing modulation detector window with reader signal (hi_iso14443a.v)
- code cleanup of hi_iso14443a.v
projects / proxmark3-svn / log