https://saturn.ffzg.hr/rot13/ 2014-01-24T10:05:09Z <div>Creator: Dobrica Pavlinušić</div><hr/><div>Tags: FPGA, hardware, RFID</div><hr/><div class="wiki"> <div class="nlw_phrase"><table class="wafl_container"> <tr> <td> <div class="wafl_box"> <div class="wafl_titlebox"> <div class="wafl_title"> Contents: [Dobrica Pavlinušić's random unstructured stuff] </div> </div> <div class="wafl_items"> <div class="wiki"> <ul> <li><span class="nlw_phrase"><a title="section link" href="https://saturn.ffzg.hr/rot13/index.cgi?dobrica_pavlinu%C5%A1i%C4%87_s_random_unstructured_stuff#cheap_er_china_proxmark">Dobrica Pavlinušić's random unstructured stuff (Cheap(er) China Proxmark)</a><!-- wiki: {link: [Dobrica Pavlinušić's random unstructured stuff] Cheap(er) China Proxmark} --></span></li> <li><span class="nlw_phrase"><a title="section link" href="https://saturn.ffzg.hr/rot13/index.cgi?dobrica_pavlinu%C5%A1i%C4%87_s_random_unstructured_stuff#mifare_sniff_crack">Dobrica Pavlinušić's random unstructured stuff (Mifare sniff/crack)</a><!-- wiki: {link: [Dobrica Pavlinušić's random unstructured stuff] Mifare sniff/crack} --></span></li> <ul> <li><span class="nlw_phrase"><a title="section link" href="https://saturn.ffzg.hr/rot13/index.cgi?dobrica_pavlinu%C5%A1i%C4%87_s_random_unstructured_stuff#usage">Dobrica Pavlinušić's random unstructured stuff (Usage)</a><!-- wiki: {link: [Dobrica Pavlinušić's random unstructured stuff] Usage} --></span></li> </ul> <li><span class="nlw_phrase"><a title="section link" href="https://saturn.ffzg.hr/rot13/index.cgi?dobrica_pavlinu%C5%A1i%C4%87_s_random_unstructured_stuff#brute_force_26_bit_proxcard">Dobrica Pavlinušić's random unstructured stuff (brute force 26-bit proxcard)</a><!-- wiki: {link: [Dobrica Pavlinušić's random unstructured stuff] brute force 26-=bit proxcard} --></span></li> <li><span class="nlw_phrase"><a title="section link" href="https://saturn.ffzg.hr/rot13/index.cgi?dobrica_pavlinu%C5%A1i%C4%87_s_random_unstructured_stuff#firmware_version">Dobrica Pavlinušić's random unstructured stuff (firmware version)</a><!-- wiki: {link: [Dobrica Pavlinušić's random unstructured stuff] firmware version} --></span></li> <li><span class="nlw_phrase"><a title="section link" href="https://saturn.ffzg.hr/rot13/index.cgi?dobrica_pavlinu%C5%A1i%C4%87_s_random_unstructured_stuff#flashing_update">Dobrica Pavlinušić's random unstructured stuff (flashing update)</a><!-- wiki: {link: [Dobrica Pavlinušić's random unstructured stuff] flashing update} --></span></li> <li><span class="nlw_phrase"><a title="section link" href="https://saturn.ffzg.hr/rot13/index.cgi?dobrica_pavlinu%C5%A1i%C4%87_s_random_unstructured_stuff#compile_new_version_of_firmware">Dobrica Pavlinušić's random unstructured stuff (Compile new version of firmware)</a><!-- wiki: {link: [Dobrica Pavlinušić's random unstructured stuff] Compile new version of firmware} --></span></li> <li><span class="nlw_phrase"><a title="section link" href="https://saturn.ffzg.hr/rot13/index.cgi?dobrica_pavlinu%C5%A1i%C4%87_s_random_unstructured_stuff#boot_loader">Dobrica Pavlinušić's random unstructured stuff (Boot loader)</a><!-- wiki: {link: [Dobrica Pavlinušić's random unstructured stuff] Boot loader} --></span></li> </ul> </div> </div> </div> </td> </tr> </table> <!-- wiki: {toc: } --></div><br /><br /><h1 id="cheap_er_china_proxmark">Cheap(er) China Proxmark</h1> <ul> <li><a target="_blank" title="(external link)" href="http://www.xfpga.com/e_products/?big_id=17&amp;small_id=7">http://www.xfpga.com/e_products/?big_id=17&amp;small_id=7</a></li> <li><a target="_blank" title="(external link)" href="http://www.proxmark.org/forum/viewtopic.php?id=863">http://www.proxmark.org/forum/viewtopic.php?id=863</a></li> </ul> <h1 id="mifare_sniff_crack">Mifare sniff/crack</h1> <p> <a target="_blank" title="(external link)" href="http://code.google.com/p/crapto1/">http://code.google.com/p/crapto1/</a></p> <p> <a target="_blank" title="(external link)" href="http://www.youtube.com/watch?v=kTvb7tjbSTI">http://www.youtube.com/watch?v=kTvb7tjbSTI</a><br /> <a target="_blank" title="(external link)" href="http://www.fuzzysecurity.com/tutorials/rfid/3.html">http://www.fuzzysecurity.com/tutorials/rfid/3.html</a></p> <p> Proxmark firmware comparison on emulated Mifare 4k</p> <table style="border-collapse: collapse;" class="formatter_table"> <tr> <td style="border: 1px solid black;padding: .2em;">r</td> <td style="border: 1px solid black;padding: .2em;">command</td> <td style="border: 1px solid black;padding: .2em;">note</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;">590</td> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">USB HID</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">hf mf rdbl 0 A a0a1a2a3a4a5</td> <td style="border: 1px solid black;padding: .2em;">OK</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">hf mf chk 0 A a0a1a2a3a4a5</td> <td style="border: 1px solid black;padding: .2em;">Can't select card</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;">617</td> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">USB HID</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">hf mf rdbl 0 A a0a1a2a3a4a5</td> <td style="border: 1px solid black;padding: .2em;">OK</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">hf mf chk 0 A a0a1a2a3a4a5</td> <td style="border: 1px solid black;padding: .2em;">Can't select card</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">hf mf mifare</td> <td style="border: 1px solid black;padding: .2em;">2 red, needs power cycle</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">hf mf nested o 0 a a0a1a2a3a4a5 4 t</td> <td style="border: 1px solid black;padding: .2em;">Can't select card</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;">672</td> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">proxendian.h:22:4: error: #error Define BYTE_ORDER</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;">756</td> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">USB CCID</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">hf mf rdbl 0 A a0a1a2a3a4a5</td> <td style="border: 1px solid black;padding: .2em;">Auth error</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">hf mf chk 0 A a0a1a2a3a4a5</td> <td style="border: 1px solid black;padding: .2em;">Can't select card</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">hf mf mifare</td> <td style="border: 1px solid black;padding: .2em;">red, yellow, red, needs power cycle</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">hf mf nested o 0 a a0a1a2a3a4a5 4 t</td> <td style="border: 1px solid black;padding: .2em;">Can't select card</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;">840</td> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">latest</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">hf mf rdbl 0 A a0a1a2a3a4a5</td> <td style="border: 1px solid black;padding: .2em;">Can't select card</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">hf mf chk 0 A a0a1a2a3a4a5</td> <td style="border: 1px solid black;padding: .2em;">Can't select card</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">hf mf mifare</td> <td style="border: 1px solid black;padding: .2em;">Can't select card</td> </tr> <tr> <td style="border: 1px solid black;padding: .2em;"><span style="padding:.5em">&nbsp;</span></td> <td style="border: 1px solid black;padding: .2em;">hf mf nested o 0 a a0a1a2a3a4a5 4 t</td> <td style="border: 1px solid black;padding: .2em;">Can't select card</td> </tr> </table> <br /><h2 id="usage">Usage</h2> <pre> proxmark3&gt; hw version #db# Prox/RFID mark3 RFID instrument #db# bootrom: svn 816 2013-10-11 22:09:42 #db# os: svn 816 2013-10-11 22:09:43 #db# FPGA image built on 2012/ 1/ 6 at 15:27:56 uC: AT91SAM7S256 Rev B Embedded Processor: ARM7TDMI Nonvolatile Program Memory Size: 256K bytes Second Nonvolatile Program Memory Size: None Internal SRAM Size: 64K bytes Architecture Identifier: AT91SAM7Sxx Series Nonvolatile Program Memory Type: Embedded Flash Memory proxmark3&gt; hw tune #db# Measuring antenna characteristics, please wait... #db# Measuring complete, sending report back to host # LF antenna: 0.00 V @ 125.00 kHz # LF antenna: 0.00 V @ 134.00 kHz # LF optimal: 0.00 V @ 12000.00 kHz # HF antenna: 7.28 V @ 13.56 MHz # Your LF antenna is unusable. proxmark3&gt; hf 14a read ATQA : 02 00 UID : ?? ?? ?? ?? SAK : 38 [1] TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K ATS : 0d 78 f7 b1 02 4a 43 4f 50 76 32 34 31 27 cc - TL : length is 13 bytes - T0 : TA1 is present, TB1 is present, TC1 is present, FSCI is 8 - TA1 : different divisors are NOT supported, DR: [2, 4, 8], DS: [2, 4, 8] - TB1 : SFGI = 0, FWI = 8 - TC1 : NAD is NOT supported, CID is supported - HB : 4a 43 4f 50 76 32 34 31 </pre> <br /><h1 id="brute_force_26_bit_proxcard">brute force 26-bit proxcard</h1> <ul> <li><a target="_blank" title="(external link)" href="https://github.com/brad-anton/proxbrute">https://github.com/brad-anton/proxbrute</a></li> </ul> <h1 id="firmware_version">firmware version</h1> <p> According to <a target="_blank" title="(external link)" href="http://wiki.radiowar.org/Proxmark3%E5%9B%BA%E4%BB%B6%E5%88%97%E8%A1%A8">http://wiki.radiowar.org/Proxmark3%E5%9B%BA%E4%BB%B6%E5%88%97%E8%A1%A8</a><br /> firmwares newer than 617 have problems.</p> <p> Google translated version</p> <blockquote> Please do not upgrade your firmware to the CDC Proxmark3 version r617 ~ r830 driver's! We found that because the problem will lead to Proxmark3 code appears unable to identify high-frequency card, and 816 will appear after Nested number of keys for 000000000000.</blockquote> <br /><h1 id="flashing_update">flashing update</h1> <pre> dpavlin@blue:/blue-zfs/FPGA/proxmark/proxmark3$ make flash-all </pre> <br /><h1 id="compile_new_version_of_firmware">Compile new version of firmware</h1> <p> <strong>All instructions below this are for old version of software</strong> see <a target="_blank" title="(external link)" href="http://www.proxmark.org/forum/viewtopic.php?id=1668">http://www.proxmark.org/forum/viewtopic.php?id=1668</a></p> <p> <a target="_blank" title="(external link)" href="http://code.google.com/p/proxmark3/wiki/Compiling">http://code.google.com/p/proxmark3/wiki/Compiling</a> je strgan <a target="_blank" title="(external link)" href="http://www.proxmark.org/forum/post/3244/#p3244">http://www.proxmark.org/forum/post/3244/#p3244</a></p> <pre> sudo apt-get install build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config dpavlin@t61p:/tank/proxmark3$ svn co http://proxmark3.googlecode.com/svn/trunk proxmark3 </pre> <br /><h1 id="boot_loader">Boot loader</h1> <pre> dpavlin@t61p:/tank/proxmark3/proxmark3$ ./client/flasher -b ./bootrom/obj/bootrom.elf Loading ELF file './bootrom/obj/bootrom.elf'... Loading usable ELF segments: 0: V 0x00100000 P 0x00100000 (0x00000200-&gt;0x00000200) [R X] @0x94 1: V 0x00200000 P 0x00100200 (0x000017a8-&gt;0x000017a8) [R X] @0x294 Waiting for Proxmark to appear on USB... Connected units: 1. SN: ? [004/013] Found. Entering bootloader... (Press and release the button only to abort) Waiting for Proxmark to reappear on USB.... Connected units: 1. SN: ? [004/014] Found. Flashing... Writing segments for file: ./bootrom/obj/bootrom.elf 0x00100000..0x001001ff [0x200 / 2 blocks].. OK 0x00100200..0x001019a7 [0x17a8 / 24 blocks]........................ OK Resetting hardware... All done. Have a nice day! </pre> <br />^ <br /><pre> dpavlin@t61p:/tank/proxmark3/proxmark3$ ./client/flasher ./armsrc/obj/fullimage.elf Loading ELF file './armsrc/obj/fullimage.elf'... Loading usable ELF segments: 0: V 0x00102000 P 0x00102000 (0x0000a4bc-&gt;0x0000a4bc) [R ] @0xb4 1: V 0x00110000 P 0x00110000 (0x0000ba8c-&gt;0x0000ba8c) [R X] @0xa570 2: V 0x00200000 P 0x0011ba8c (0x00000004-&gt;0x00000004) [RW ] @0x15ffc Note: Extending previous segment from 0xba8c to 0xba90 bytes Waiting for Proxmark to appear on USB... Connected units: 1. SN: ? [004/015] Found. Entering bootloader... (Press and release the button only to abort) Waiting for Proxmark to reappear on USB.... Connected units: 1. SN: ChangeMe [004/016] Found. Flashing... Writing segments for file: ./armsrc/obj/fullimage.elf 0x00102000..0x0010c4bb [0xa4bc / 165 blocks]..................................................................................................................................................................... OK 0x00110000..0x0011ba8f [0xba90 / 187 blocks]........................................................................................................................................................................................... OK Resetting hardware... All done. Have a nice day! </pre> </div> <hr/><div>Attachments: gnuarm.diff</div> https://saturn.ffzg.hr/rot13/index.cgi?proxmark Dobrica Pavlinušić 2014-01-24T10:05:09Z