Proxmark developers community

Research, development and trades concerning the powerful Proxmark3 device!

You are not logged in.

#1 Re: MIFARE Classic » mifare reverse engenering??? » Today 08:35:29

I don't understand what you want to know. If you want come to irc freenode #proxmark3

#2 Re: MIFARE Classic » mifare reverse engenering??? » Yesterday 22:08:37

If you xor same numbers you will always obtain the same results... how can "A0A1A2A3A4A5 xor CAFED7DD4A09" = variable value ? I think you need to study A LOT more in your "srix" forums...

#3 Re: Questions and Requests » TI Tag-It HF-I "factory locked blocks" » Yesterday 21:55:29

I think the tag serial/id is "locked" someway to the device it is used for; without cloning its serial/id you will not be able to copy it, data only are not enough.

#4 Re: Questions and Requests » Kantech ioProx » Yesterday 07:15:04

Yes, you need to flash the bootloader because the new code has changes needed for the new fpga+os; usually it is not necessary to update also the bootloader, you need to have a look at the sources to see if it has been changed.

#6 Re: MIFARE Ultralight » Ultraligh otp - lockbits » 2014-10-18 10:25:51

Those "vulnerabilities" (better "bad implementations) are known since 1 year (almost) and yeah, with a lua script you can add it to pm3 in an easy way.

#7 Re: MIFARE Classic » Danish transport system RKF » 2014-10-17 22:23:21

If you have some dumps I would like to have a look.

#8 Re: MIFARE Classic » Danish transport system RKF » 2014-10-17 19:40:12

You can sniff communication between the mobile phone and the tag!

#10 Re: Various Tools and Utilities » HackRF One - A platform for RF analysis - Windows Guide » 2014-10-14 20:32:24

holiman wrote:

I've been diving into sdr, as a pet project I am writing gnuradio-modules to interpret DCS (digitally coded squelch) from a handheld radio (they use DCS / CTCSS to have 'private' channels, by transmitting a sub-audible signal which signals that the squelch should be opened). It's nice to extract that, because then you can jump on any such transmission with the same dcs-key and join the party (I can use my computer to tell the kids it's dinner time).

Anyway, @asper wrote

- 8-bit quadrature samples (8-bit I and 8-bit Q): I don't know what it is, if someone can explain it I will be grateful !

Michael Ossman has been talking about that in videos 6 and 7. Particularly 7: http://greatscottgadgets.com/sdr/7/. I'm now starting to understand the benefits of using quadrature sampling, and can't help thinking about if that's something we could do in proxmark. We wouldn't have to start anew from scratch, I think, but maybe have a separate mode for quadrature sampling. It seems a lot simpler to accurately determine PSK / ASK / whatever modulation scheme using that method instead of our current implementations which are not very robust.

Is there anyone else interested in exploring this?

@asper, on another note, how did you do the mifare reading? I would roughly go through these things...
* set the baseband frequency to 12.56 MHZ
* Shift the signal 1 MHz so 13.56 in centered
* Low-pass filter the signal. Check the waterfall graph to see how much bandwitdh is needed.
* Decimate heavily, you definitely don't need 20MHz channel width.
* Have the antenna *really* close to the signal source. Or, try to use an inductive antenna (coil) - e.g. a proper pm3 antenna. I used a pm3-antenna on my oscilloscope when doing the iclass-debugging.
* Do a recording to a file-sink. Then do the experimentation on the recorded file using a file sink.

Thank you man for your answer. Unfortunately Gnuradio is still not working with HackRF under Windows so I cannot use it to manipulate the signal. I tested the ham it up converter but the signal is really worse (almost not visible) than without the ham it up converter so I think something is wrong with my ham it up or my antenna... also recordings done with SdrSharp are not so good so I am not able to "read" the waveform...

I will do more tests with your suggestions !

#13 Re: 125 kHz - ISO 11784 / 11785 » Broken: LF T55xx commands. » 2014-10-13 09:33:29

Those are my tunes with and without the tag on the antenna:

pm3 --> hw tune
pm3 --> 
pm3 --> #db# Measuring antenna characteristics, please wait...                 
pm3 --> #db# Measuring complete, sending report back to host                 
pm3 -->           
pm3 --> # LF antenna: 17.59 V @   125.00 kHz          
pm3 --> # LF antenna: 32.49 V @   134.00 kHz          
pm3 --> # LF optimal: 32.49 V @   133.33 kHz          
pm3 --> # HF antenna:  0.00 V @    13.56 MHz          
pm3 --> # Your HF antenna is unusable.          
pm3 --> hw tune
pm3 --> 
pm3 --> #db# Measuring antenna characteristics, please wait...                 
pm3 --> #db# Measuring complete, sending report back to host                 
pm3 -->           
pm3 --> # LF antenna: 27.93 V @   125.00 kHz          
pm3 --> # LF antenna: 35.45 V @   134.00 kHz          
pm3 --> # LF optimal: 40.01 V @   129.03 kHz          
pm3 --> # HF antenna:  0.00 V @    13.56 MHz          
pm3 --> # Your HF antenna is unusable.  

I sent you an email.

#14 Re: 125 kHz - ISO 11784 / 11785 » Broken: LF T55xx commands. » 2014-10-13 08:46:44

1OOJUlA.png
Is there any optional parameter you can add to the commands so I can make more tests without recompiling the source ?

#16 Re: 125 kHz - ISO 11784 / 11785 » Broken: LF T55xx commands. » 2014-10-12 19:28:14

Well the behaviour is strange; using a dedicated T55x7 reader I obtain the correct values (the tests I made were done with a T55x7 programmed to be an EM4100).

Another strange thing is that lf em4x 410read  command is not able to detect the cloned EM4100 but it can when I previously send an lf em4x 410watch command.

Also the lf em4x 410spoof hangs.

Are all those things normal ? Sorry but I am not in 125kHz field (except for descrambling IDs).


EDIT:

I double checked and the bits read by the pm3 commands are totally wrong. My block0 is 000880E8 (taken from official reader and it works) while pm3 reads 0xE0150A08 or 0x00150A08

EDIT2:
This is the (incorrect) dump done by pm3:
pm3 --> lf t55xx dump
     Block 0  : 0xE0150A08  11100000000101010000101000001000         
     Block 1  : 0xE0150A08  11100000000101010000101000001000         
     Block 2  : 0xE0150A08  11100000000101010000101000001000         
     Block 3  : 0xFF962003  11111111100101100010000000000011         
     Block 4  : 0xE0150A08  11100000000101010000101000001000         
     Block 5  : 0xFF962003  11111111100101100010000000000011         
     Block 6  : 0xE0150A08  11100000000101010000101000001000         
     Block 7  : 0xE0150A08  11100000000101010000101000001000


I tested various tag positions over the antenna.


EDIT3:

Well something is wrong in bits... when my tag is in EM4100 emulation mode block0 read by pm3 is 0150A081 (my official reader is not able to read the block0 when tag is in EM4100 emultaion mode but I think this is normal using a T55x7); while when t55x7 is not in emulation mode it reads E0150A08 (and it must be 000880E8 = taken from official reader - those are the bytes wrote by my official software to the T55x7 block0 to take it out of the EM4100 emulation mode); I change modes with the official programmer+software.
As you can see the 1st nibble seems to be changed for pm3 so it is able to read a difference but the value shown is not correct.

#17 Re: 125 kHz - ISO 11784 / 11785 » Broken: LF T55xx commands. » 2014-10-12 19:10:32

I think I found some sort of bug; while I was testing my block0 was: 01480400 and I was able to dump full tag content; after testing it became 01580400 and now all the blocks show block0 content; I NEVER used the write command.

Another interesting thing is that I am practically sure that my original block0 WAS absolutely NOT 01480400 so I think that the commands I sent to test wrote something inside the tag... can this be possible ?

I am also not able to write to the tag anymore using pm3, I will try with another dedicated programmer.

#18 Re: 125 kHz - ISO 11784 / 11785 » Broken: LF T55xx commands. » 2014-10-11 19:41:19

Compiling issue solved (it was a simple problem with Qt dir folder: export QTDIR=/c/Qt/Qt5.3.2/5.3/mingw482_32/); I can make more tests if you need.

#20 Re: 125 kHz - ISO 11784 / 11785 » Broken: LF T55xx commands. » 2014-10-08 19:01:10

Ok I solved the DES error (used openssl libeay32.dll renamed to crypto.dll as suggested in some forums) but I still have those errors:
H4iI0dk.png
I think this is a wrong .dll I am using... any help ?

I reinstalled openssl just to be sure but the problem persist.

#21 Re: 125 kHz - ISO 11784 / 11785 » Broken: LF T55xx commands. » 2014-10-08 18:32:45

Yeah but I am not able to find the crypto.dll file anywhere... downloaded many but no one seems to be good... can you share your one ?

I can program the t55 to have an fsk modulation... but no, I don't have any native fsk tag.

#22 Re: 125 kHz - ISO 11784 / 11785 » Broken: LF T55xx commands. » 2014-10-08 18:18:59

Now it seems to be a lot better (I think problem was positiong the tag ove the antenna):

pm3 -->  lf t55xx rd 0
     Block 0  : 0x01480400  00000001010010000000010000000000         
pm3 -->
pm3 -->  lf t55xx trace
-- T55xx Trace Information ----------------------------------         
-------------------------------------------------------------         
ACL Allocation class (ISO/IEC 15963-1)  : 0x01 (1)         
MFC Manufacturer ID (ISO/IEC 7816-6)    : 0x50 (80)         
CID                                     : 0x14 (20)         
ICR IC Revision                         : 0         
Manufactured         
     Year/Quarter : 2008/0         
     Lot ID       : 1117         
     Wafer number : 1         
     Die Number   : 16583         
-------------------------------------------------------------         
Raw Data - Page 1         
     Block 0  : 0x0150A081  00000001010100001010000010000001         
     Block 0  : 0x1743031E  00010111010000110000001100011110         
-------------------------------------------------------------         
pm3 -->
pm3 -->  lf t55xx info
     Block 0  : 0x01480400  00000001010010000000010000000000         
-- T55xx Configuration --------------------------------------         
-------------------------------------------------------------         
Safer key                 : 0         
reserved                  : 10         
Data bit rate             : 2 - RF/32         
eXtended mode             : No         
Modulation                : 0 - direct         
PSK clock freq            : 1         
AOR - Answer on Request   : No         
OTP - One Time Pad        : No         
Max block                 : 0         
Password mode             : No         
Sequence Start Terminator : No         
Fast Write                : No         
Inverse data              : No         
POR-Delay                 : No         
-------------------------------------------------------------         
Raw Data - Page 0         
     Block 0  : 0x01480400  00000001010010000000010000000000         
-------------------------------------------------------------         
pm3 -->
pm3 -->  lf t55xx dump
     Block 0  : 0x01480400  00000001010010000000010000000000         
     Block 1  : 0xF962003F  11111001011000100000000000111111         
     Block 2  : 0x0C6141C0  00001100011000010100000111000000         
     Block 3  : 0x00000000  00000000000000000000000000000000         
     Block 4  : 0x00000000  00000000000000000000000000000000         
     Block 5  : 0x00000000  00000000000000000000000000000000         
     Block 6  : 0x00000000  00000000000000000000000000000000         
     Block 7  : 0x00000000  00000000000000000000000000000000         
pm3 -->
pm3 -->  data plot
pm3 -->
pm3 -->  lf t55xx rd 0
     Block 0  : 0x01480400  00000001010010000000010000000000         
pm3 -->
pm3 -->  data fskdemod
actual data bits start at sample 5433         
length 50/50         
bits: '011100000111001101001001011100000111001001111'         
hex: 00000e0e 692e0e4f         
pm3 -->
KXU94pk.png

I managed to solve the Qt compiling problem (same name .dll files unde the Qt folder, some under tools and some under mingw, tested different combination and it worked)  but now I still have this:
Bh6Jgkd.png

any hint ?

#23 Re: 125 kHz - ISO 11784 / 11785 » Broken: LF T55xx commands. » 2014-10-08 17:56:17

If someone is using my official trunk releases these are all the needed .dlls (verified 1 by 1) for the iceman compiled pack: download.

Is my test enough ? Unfortunately I have this t5557 only.

#24 Re: 125 kHz - ISO 11784 / 11785 » Broken: LF T55xx commands. » 2014-10-08 17:42:33

Manged to run your compiled version !

Here is my test:

pm3 -->  lf t55xx rd 0
     Block 0  : 0xEDDFF3F4  22220220222022222222200222222020         
pm3 -->
pm3 -->  lf t55xx trace
-- T55xx Trace Information ----------------------------------         
-------------------------------------------------------------         
ACL Allocation class (ISO/IEC 15963-1)  : 0x1D8 (472)         
MFC Manufacturer ID (ISO/IEC 7816-6)    : 0x175 (373)         
CID                                     : 0x26 (38)         
ICR IC Revision                         : 14         
Manufactured         
     Year/Quarter : 2000/0         
     Lot ID       : 0         
     Wafer number : 0         
     Die Number   : 0         
-------------------------------------------------------------         
Raw Data - Page 1         
     Block 0  : 0xD9753E00  22202200212221212011222200000000         
     Block 0  : 0x00000000  00000000000000000000000000000000         
-------------------------------------------------------------         
pm3 -->
pm3 -->  lf t55xx info
     Block 0  : 0x7AFFF3F6  01222212022222222222200222222022         
-- T55xx Configuration --------------------------------------         
-------------------------------------------------------------         
Safer key                 : 6 - pasdwd         
reserved                  : 214         
Data bit rate             : 14 - (Unknown)         
eXtended mode             : Yes - Warning         
Modulation                : 0x3E (Unknown)         
PSK clock freq            : 4         
AOR - Answer on Request   : No         
OTP - One Time Pad        : Yes - Warning         
Max block                 : 14         
Password mode             : Yes         
Sequence Start Terminator : Yes         
Fast Write                : No         
Inverse data              : Yes         
POR-Delay                 : Yes         
-------------------------------------------------------------         
Raw Data - Page 0         
     Block 0  : 0x7AFFF3F6  01222212022222222222200222222022         
-------------------------------------------------------------         
pm3 -->
pm3 -->  lf t55xx dump
     Block 0  : 0xFF6ECEE3  12222222202202220220022202220011         
     Block 1  : 0xFD9FBBEC  22222221220022222202220222220220         
     Block 2  : 0x3EFDD7DA  00122222022222202221212222202202         
     Block 3  : 0xF7000000  22222022200000000000000000000000         
     Block 4  : 0xECFF1766  22220220022222222000212221220022         
     Block 5  : 0x7CEED53E  01222220022202220221202020122222         
     Block 6  : 0xFCFEFE5E  22222220022222220222222200202222         
     Block 7  : 0x79BD7396  01222201120222212022201022012122         
pm3 -->
pm3 -->  data plot
pm3 -->
pm3 -->  lf t55xx rd 0
     Block 0  : 0x3E7D754E  20122222012222202122212021200222         
pm3 -->
pm3 -->  data fskdemod
actual data bits start at sample 4389         
length 50/50         
bits: '011000101011111110000100101000000111101110000'         
hex: 00000c57 f0940f70         
pm3 -->

dxJ80ZO.png

#25 Re: 125 kHz - ISO 11784 / 11785 » Broken: LF T55xx commands. » 2014-10-08 12:29:42

h2RHE3P.png

Still problems. If someone have crypto.dll or libcrypto.dll or cryptolib.dll please upload them somewhere.

Board footer

Powered by FluxBB