Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
You are not logged in.
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
Pages: 1
In Version 2.0.0 dark side attack don't work, but ver 0.0.7 crack card (same card).
In version 2.1.0 hf snoop don't work. I sniff data, red led turn on, then I press button, but list command don't show any data for a long time...
proxmark3.log
#db# cancelled by button
#db# COMMAND FINISHED
#db# maxDataLen=3, Uart.state=0, Uart.len=0
#db# traceLen=762, Uart.output[0]=00000050
Waiting for a response from the proxmark...
Don't forget to cancel its operation first by pressing on the button
#db# cancelled by button
#db# COMMAND FINISHED
#db# maxDataLen=1, Uart.state=0, Uart.len=0
#db# traceLen=0, Uart.output[0]=00000050
Recorded Activity (TraceLen = 0 bytes)
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
iso14443a - All times are in carrier periods (1/13.56Mhz)
iClass - Timings are not as accurate
Start | End | Src | Data (! denotes parity error) | CRC | Annotation |
-----------|-----------|-----|-----------------------------------------------------------------|-----|--------------------|
#db# cancelled by button
#db# COMMAND FINISHED
#db# maxDataLen=3, Uart.state=0, Uart.len=0
#db# traceLen=545, Uart.output[0]=00000052
Waiting for a response from the proxmark...
Don't forget to cancel its operation first by pressing on the button
#db# cancelled by button
#db# COMMAND FINISHED
#db# maxDataLen=1, Uart.state=0, Uart.len=0
#db# traceLen=0, Uart.output[0]=00000052
Recorded Activity (TraceLen = 0 bytes)
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
iso14443a - All times are in carrier periods (1/13.56Mhz)
iClass - Timings are not as accurate
Start | End | Src | Data (! denotes parity error) | CRC | Annotation |
-----------|-----------|-----|-----------------------------------------------------------------|-----|--------------------|
#db# cancelled by button
#db# COMMAND FINISHED
#db# maxDataLen=3, Uart.state=0, Uart.len=0
#db# cancelled by button
#db# COMMAND FINISHED
#db# maxDataLen=3, Uart.state=0, Uart.len=0
#db# traceLen=590, Uart.output[0]=00000050
Waiting for a response from the proxmark...
Don't forget to cancel its operation first by pressing on the button
#db# cancelled by button
#db# COMMAND FINISHED
#db# maxDataLen=1, Uart.state=0, Uart.len=0
#db# traceLen=0, Uart.output[0]=00000050
Recorded Activity (TraceLen = 0 bytes)
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
iso14443a - All times are in carrier periods (1/13.56Mhz)
iClass - Timings are not as accurate
Start | End | Src | Data (! denotes parity error) | CRC | Annotation |
-----------|-----------|-----|-----------------------------------------------------------------|-----|--------------------|
Do you have any idea?
Offline
How about you download the latest source from GitHub and compile/flash bootrom & fullimage.
The latest tag is v2.2.0
Offline
My PM3 works fine with Mifare cards on 0.0.7 build, but on 2.x.x I have random output: antenna is connected, but card is not in a range
Prox/RFID mark3 RFID instrument
bootrom: /-suspect 2015-08-16 18:49:55
os: /-suspect 2015-08-16 18:50:03
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2015/06/22 at 21:47:54
uC: AT91SAM7S256 Rev A
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 256K bytes. Used: 166521 bytes (64%). Free: 95623 bytes (36%).
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 256K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memory
proxmark3> hf mfu info
iso14443a card select failed
proxmark3>
proxmark3> hf 14a reader
iso14443a card select failed
proxmark3>
proxmark3> hf 14a reader
UID : 00 00 00 00
ATQA : 00 00
SAK : 00 [2]
iso14443a card select failed
TYPE : MIFARE Ultralight (MF0ICU1) <magic>
proxmark3>
proxmark3> hf 14a reader
iso14443a card select failed
proxmark3> hf 14a reader
UID : 88 04 20 d3
ATQA : 00 01
SAK : 80 [2]
proprietary non iso14443-4 card found, RATS not supported
Answers to chinese magic backdoor commands: NO
proxmark3>
proxmark3> hf 14a reader
iso14443a card select failed
proxmark3>
proxmark3> hf 14a reader
iso14443a card select failed
proxmark3>
proxmark3> hf 14a reader
iso14443a card select failed
proxmark3>
proxmark3> hf 14a reader
#db# Multiple tags detected. Collision after Bit 1
iso14443a card select failed
proxmark3>
proxmark3> hf 14a reader
UID : 00 00 00 00
ATQA : 00 01
SAK : 01 [2]
TYPE : NXP TNP3xxx Activision Game Appliance
proprietary non iso14443-4 card found, RATS not supported
#db# halt error. response len: 1
Answers to chinese magic backdoor commands: NO
proxmark3>
Offline
Same error as another user @ericbetts has...
Whats the output from your "hw tune" / "hw info" / "hw status" (running pm 2.x.x.) ?
Offline
'hw info' command is not supported in 2.x.x.
proxmark3> hw version
[[[ Cached information ]]]
Prox/RFID mark3 RFID instrument
bootrom: /-suspect 2015-08-16 18:49:55
os: /-suspect 2015-08-16 18:50:03
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2015/06/22 at 21:47:54
uC: AT91SAM7S256 Rev A
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 256K bytes. Used: 166521 bytes (64%). Free: 95623 bytes (36%).
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 256K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memory
proxmark3> hw tune
Measuring antenna characteristics, please wait......#db# DownloadFPGA(len: 42096)
.
# LF antenna: 0.00 V @ 125.00 kHz
# LF antenna: 0.00 V @ 134.00 kHz
# LF optimal: 0.00 V @ 12000.00 kHz
# HF antenna: 16.80 V @ 13.56 MHz
# Your LF antenna is unusable.
proxmark3> hw status
#db# Memory
#db# BIGBUF_SIZE.............40000
#db# BigBuf_hi .............40000
#db# Tracing
#db# tracing ................1
#db# traceLen ...............0
#db# Fgpa
#db# mode.............HF
#db# LF Sampling config:
#db# [q] divisor: 95
#db# [b] bps: 8
#db# [d] decimation: 1
#db# [a] averaging: 1
#db# [t] trigger threshold: 0
#db# USB Speed:
#db# Sending USB packets to client...
#db# Time elapsed: 1500ms
#db# Bytes transferred: 706560
#db# USB Transfer Speed PM3 -> Client = 471040 Bytes/s
#db# Various
#db# MF_DBGLEVEL......2
#db# ToSendMax........39
#db# ToSendBit........0
proxmark3>
Offline
very strange...
Offline
Do I have the latest FPGA images ?
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2015/06/22 at 21:47:54
BTW: LF works fine I have issue only with LH
Offline
You have the same FPGA images as me.
Offline
You have the same FPGA images as me.
What version of CPU do you have
uC: AT91SAM7S256 Rev A
or
uC: AT91SAM7S512 Rev B
Offline
Neither, "AT91SAM7S256 Rev B" 256kb Rev B
Offline
@bettse has the same version as me 'uC: AT91SAM7S256 Rev A' and also has the problem
http://www.proxmark.org/forum/viewtopic.php?pid=17870#p17870
Offline
yeah, I've seen his problem before..
For a wild idea,
you could download an older fpga_hf.bit file (from 2015-01-20) and see if that solves your ghost values..
Offline
you could download an older fpga_hf.bit file (from 2015-01-20) and see if that solves your ghost values..
Newbie question: how to do this (and where the files is located)
Offline
github history maybe.. just put in the fpga_folder where the new one is.. then re-compile and flash..
Offline
I don't have a environment to rebuild FPGA, but I did downgrade to 0.0.7 with 'HF FPGA image built on 2015/01/15'
and is working stable (no random data)
#db# Prox/RFID mark3 RFID instrument
#db# bootrom: /-suspect 2015-01-31 07:13:30
#db# os: /-suspect 2015-01-31 07:13:36
#db# HF FPGA image built on 2015/01/15 at 12:19:06
Prox/RFID mark3 RFID instrument
uC: AT91SAM7S256 Rev A
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 256K bytes. Used: 0 bytes ( 0%). Free: 262144 bytes (100%).
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 256K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memory
proxmark3> hf search
UID : 04 20 d3 0a 53 1e 80
ATQA : 00 44
SAK : 00 [2]
TYPE : MIFARE Ultralight (MF0ICU1)
MANUFACTURER : NXP Semiconductors Germany
proprietary non iso14443-4 card found, RATS not supported
Answers to chinese magic backdoor commands: NO
Valid ISO14443A Tag Found - Quiting Search
proxmark3> hf search
UID : 04 20 d3 0a 53 1e 80
ATQA : 00 44
SAK : 00 [2]
TYPE : MIFARE Ultralight (MF0ICU1)
MANUFACTURER : NXP Semiconductors Germany
proprietary non iso14443-4 card found, RATS not supported
Answers to chinese magic backdoor commands: NO
Valid ISO14443A Tag Found - Quiting Search
proxmark3> hf search
UID : 04 20 d3 0a 53 1e 80
ATQA : 00 44
SAK : 00 [2]
TYPE : MIFARE Ultralight (MF0ICU1)
MANUFACTURER : NXP Semiconductors Germany
proprietary non iso14443-4 card found, RATS not supported
Answers to chinese magic backdoor commands: NO
Valid ISO14443A Tag Found - Quiting Search
proxmark3>
Offline
Sorry, I was unclear. You don't need to recompile the FPGA code, the *.bit files is already compiled.
You need to recompile the PM3 source and flash, the Make command links the *.bit files into the binaries.
Offline
The issue still exist in build 2.3.0
Output for HF antenna + MIfare card
X:\pm3-bin-2.3.0\win32 (client+GUI)>proxmark3.exe COM3
Prox/RFID mark3 RFID instrument
bootrom: /-suspect 2015-08-16 18:49:55
os: /-suspect 2015-11-03 09:23:35
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2015/11/ 2 at 9: 8: 8
uC: AT91SAM7S256 Rev A
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 256K bytes. Used: 171338 bytes (65%). Free: 90806 bytes (35%).
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 256K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memory
proxmark3> hw tune
Measuring antenna characteristics, please wait...#db# DownloadFPGA(len: 42096)
......#db# DownloadFPGA(len: 42096)
.
# LF antenna: 0.00 V @ 125.00 kHz
# LF antenna: 0.00 V @ 134.00 kHz
# LF optimal: 0.00 V @ 12000.00 kHz
# HF antenna: 13.72 V @ 13.56 MHz
# Your LF antenna is unusable.
proxmark3> hf sea
no known/supported 13.56 MHz tags found
proxmark3> hf sea
no known/supported 13.56 MHz tags found
proxmark3> hf sea
#db# Multiple tags detected. Collision after Bit 2
no known/supported 13.56 MHz tags found
proxmark3> hf sea
#db# Multiple tags detected. Collision after Bit 5
#db# Multiple tags detected. Collision after Bit 12
no known/supported 13.56 MHz tags found
proxmark3> hf sea
no known/supported 13.56 MHz tags found
proxmark3> hf sea
#db# Multiple tags detected. Collision after Bit 14
no known/supported 13.56 MHz tags found
proxmark3> hf sea
#db# Multiple tags detected. Collision after Bit 12
no known/supported 13.56 MHz tags found
proxmark3>
and output for build 2.3.0 with old FPGA (compilation by iceman http://www.proxmark.org/forum/viewtopic.php?pid=18112#p18112)
X:\pm3-bin-2.3.0\win32 (client+GUI)>proxmark3.exe COM3
Prox/RFID mark3 RFID instrument
bootrom: /-suspect 2015-08-16 18:49:55
os: master/v2.2.0-58-gdfb387b-dirty-suspect 2015-10-02 01:08:42
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2015/02/11 at 21:05:50
uC: AT91SAM7S256 Rev A
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 256K bytes. Used: 168186 bytes (64%). Free: 93958 bytes (36%).
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 256K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memory
proxmark3> hw tune
Measuring antenna characteristics, please wait...#db# DownloadFPGA(len: 42096)
......#db# DownloadFPGA(len: 42096)
.
# LF antenna: 0.00 V @ 125.00 kHz
# LF antenna: 0.00 V @ 134.00 kHz
# LF optimal: 0.00 V @ 12000.00 kHz
# HF antenna: 13.58 V @ 13.56 MHz
# Your LF antenna is unusable.
proxmark3> hf sea
UID : bd a3 xx xx
ATQA : 00 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1
proprietary non iso14443-4 card found, RATS not supported
Answers to chinese magic backdoor commands: NO
Valid ISO14443A Tag Found - Quiting Search
proxmark3>
Last edited by Piorun (2015-11-03 19:27:21)
Offline
This version should include the hf sniff command which is a great debugging feature. Please try it with a reader and a card and post a screenshot of a tag answer.
hf sniff 10000 1
data samples 40000
data plot
In the resulting plot you should see pairs of Reader requests and tag answers. Zoom in to one of those pairs. The tag answers can be identified by some additional "ripples". Example (first signal group = reader, second group = tag):
Offline
fpga_hf.bit from pm3 master
running: 'hf snoop 10000 1'
Doesn't look like yours...
Offline
Looks that V2.3.0 doesn't include sniff command, output for 'hf snoop 10000 1' (card Mirafe clasic)
Last edited by Piorun (2015-11-04 01:28:42)
Offline
Sorry, my bad, its hf snoop, not hf sniff.
@iceman: all I see is a 50Hz noise. Looks like your reader isn't active - or the trigger didn't work as expected.
@Piorun: there seems to be much distortion or noise. Can you please provide both a close-up and a full range picture. Or save the data to a file and paste it here.
Offline
@Piorun: there seems to be much distortion or noise. Can you please provide both a close-up and a full range picture. Or save the data to a file and paste it here.
In attachment two tests: the same PM3 hardware, antena and Mifarte card.
#New_FPGA
HF detection failed (build 2.3.0)
#Old_FPGA
HF works fine, by build 2.3.0 uses old FPGA firmware
#Nen
Prox/RFID mark3 RFID instrument
bootrom: /-suspect 2015-11-03 09:23:28
os: /-suspect 2015-11-03 09:23:35
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2015/11/ 2 at 9: 8: 8
proxmark3> hf sear
no known/supported 13.56 MHz tags found
#Old
Prox/RFID mark3 RFID instrument
bootrom: /-suspect 2015-11-03 09:23:28
os: master/v2.2.0-58-gdfb387b-dirty-suspect 2015-10-02 01:08:42
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2015/02/11 at 21:05:50
proxmark3> hf sea
UID : 1d xx xx xx
ATQA : 00 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1
proprietary non iso14443-4 card found, RATS not supported
Answers to chinese magic backdoor commands: NO
Valid ISO14443A Tag Found - Quiting Search
I can't upload ZIP Image and DAT
Last edited by Piorun (2015-11-05 01:27:54)
Offline
I am wondering how you could do a hf snoop with the old FPGA which didn't support it?
hf snoop shows the received antenna signal after the analogue part but before any signal processing by FPGA or ARM. It is therefore the same for old and new FPGA (if the old FPGA would have provided the logic for hf snoop - see above).
Your .dat and .png show a strong signal overlaying both reader and tag signals. I would be interested in a hf snoop without any reader or tag. Just holding your PM3 antenna in the air.
You don't happen to life nearby a Digital Radio station?
Offline
>I am wondering how you could do a hf snoop with the old FPGA which didn't support it?
I'm using custom FPGA
http://www.proxmark.org/forum/viewtopic.php?pid=18132#p18132
> Your .dat and .png show a strong signal overlaying both reader and tag signals.
> I would be interested in a hf snoop without any reader or tag. Just holding your PM3 antenna in the air.
But the problem is that my PM3 hardware works fine with 0.0.7, the issue is only with new FPGA builds
>You don't happen to life nearby a Digital Radio station?
no (nearest is 10 Km)
Offline
But the problem is that my PM3 hardware works fine with 0.0.7, the issue is only with new FPGA builds
Yes, I know. And I am very interested how the old FPGA code (0.0.7 - and also the newer one before May 2015 if I understood correctly ?) could detect anything at all despite this HUGE interferring signal. And why the new code fails in this case.
It is hard to read on the screenshot but the disturbing signal seems to cover the whole amplitude range from -127 to +128? Can you please provide the .dat file for this again? And this is really without any reader or tag?
Offline
Wow and I thought I had areas with lots of interference, my max is 30 on the lf band... You don't have the pm3 sitting on an old portable phone do you? Lol.
Offline
I can see the same "noise" when doing data samples and data plot without hf snoop before. What you see there is part of the compressed FPGA image (the decompressor uses BigBuf[] as temporary buffer).
Obviously Piorun's hf snoops never triggered and therefore didn't record any data.
@Piorun: if your hf snoop is successfull you will see
#db# Trigger kicked! Value: 252.
#db# Trigger kicked! Value: 252, Dumping Samples Hispeed now.
#db# HF Snoop end
Otherwise you didn't snoop at all and you get void data with data samples.
I will change hf snoop to clear the BigBuf[] to avoid such issues in the future.
EDIT: Done. Change committed to master.
Last edited by piwi (2015-11-06 09:48:00)
Offline
Can you please provide the .dat file for this again? And this is really without any reader or tag?
Please find in attachment:
- PM3 2.4.0 + fresh build EXE from GitHub
- two tests: no card and reader with Mifare.
- before each test the PM3 was disconnected from USB port to clear memory
- FPGA is from build 2.4.0
https://www.sendspace.com/file/mo8b16
Offline
Did you read my last post?
Offline
Did you read my last post?
yes , but what I should do exactly ?
I have loaded new build from GitHub, FPGA is from 2.4.0
and I did not receive a output:
#db# Trigger kicked! Value: 252.
#db# Trigger kicked! Value: 252, Dumping Samples Hispeed now.
#db# HF Snoop end
Offline
I still think that your "custom" FPGA doesn't include the HF snoop logic. Please download and compile the latest source from github. If you don't get a trigger your data plot should be empty (all zeroes). If you get a trigger, your data plot should look different from all you had sent so far. Then you have a real snoop instead of random data.
Offline
> still think that your "custom" FPGA doesn't include the HF snoop logic.
but for test I use FPGA from build 2.4.0
bootrom: /-suspect 2015-11-04 22:15:34
os: /-suspect 2015-11-04 22:15:41
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2015/11/ 2 at 9: 8: 8
is this fine ?
> Please download and compile the latest source from github.
I did it yesterday ( new build from https://github.com/Proxmark/proxmark3, only 'make client')
@piwi maybe you can create for me new package (FPGA + EXE) to be shure that I have right version ?
Offline
HF FPGA image built for 2s30vq100 on 2015/11/ 2 at 9: 8: 8
is correct but this
os: /-suspect 2015-11-04 22:15:41
is not good. Have you last patches from git?
hf snoop has three changes: ARM, FPGA and client, are you sure to have all?
I did it yesterday ( new build from https://github.com/Proxmark/proxmark3, only 'make client')
So no patches for ARM?
EDIT
but for test I use FPGA from build 2.4.0
Sorry but where is 2.4.0? Last stable release is 2.2.0, so lastest from github will be 2.3.0 when all is working.
Last edited by meter (2015-11-07 14:53:35)
Offline
but for test I use FPGA from build 2.4.0
Sorry but where is 2.4.0? Last stable release is 2.2.0, so lastest from github will be 2.3.0 when all is working.
2.4.0 http://www.proxmark.org/forum/viewtopic.php?id=1562
Offline
Running the snoop, with latest fpga-images from PM3 master, still gives me the same noise of 50khz.
And I have piwi's bigbuff clear code (not that it matters in this case)
I've tried different space between reader antenna - snoop antenna - card.
Other sources of interference, yes alot I guess.
Electronic interference like screens, wireless mouse, low-energy lightbulbs..
pm3 --> hf snoo 10000
#db# Skipping first 10000 sample pairs, Skipping 0 triggers.
#db# Buffer cleared (40000 bytes)
#db# Trigger kicked! Value: 255, Dumping Samples Hispeed now.
#db# HF Snoop end
pm3 --> da sam
Reading 39999 bytes from device memory
Data fetched
Waiting for a response from the proxmark...
Don't forget to cancel its operation first by pressing on the button
Samples @ 8 bits/smpl, decimation 1:1
Offline
#db# Buffer cleared (40000 bytes) #db# Trigger kicked! Value: 255, Dumping Samples Hispeed now. #db# HF Snoop end
Could you share yours FPGA full image, I don't see "#db# Buffer cleared" in my log
Offline
>I still think that your "custom" FPGA doesn't include the HF snoop logic.
I loaded new FPGA (there is a 'Buffer cleared' message)
proxmark3> hf snoo 10000 1
#db# Skipping first 10000 sample pairs, Skipping 1 triggers.
#db# Buffer cleared (40000 bytes)
#db# HF Snoop end
proxmark3> data samples 40000
Reading 39999 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
proxmark3> data plot
Unfortunately buffer is empty now (with card or without)
proxmark3> hw tune
Measuring antenna characteristics, please wait...#db# DownloadFPGA(len: 42096)
......#db# DownloadFPGA(len: 42096)
.
# LF antenna: 0.00 V @ 125.00 kHz
# LF antenna: 0.00 V @ 134.00 kHz
# LF optimal: 0.00 V @ 12000.00 kHz
# HF antenna: 11.59 V @ 13.56 MHz
# Your LF antenna is unusable.
proxmark3> hf sear
Last edited by Piorun (2015-11-07 22:25:25)
Offline
It suggests your tag/readers field is too low to kick the trigger. Try a Better antenna? Adjust the code to lower the threshold?
Offline
It suggests your tag/readers field is too low to kick the trigger. Try a Better antenna? Adjust the code to lower the threshold?
but my PM3 works fine with old FPGA builds, the issue is only with 2.x.x releases.
Offline
Pages: 1