Proxmark3 Easy and ISO 15693

zilot · 2016-06-22 09:12:47

Hello

I own Proxmark3 Easy bought from Aliexpress

http://www.aliexpress.com/item/Free-shipping-DIY-125KHZ-13-56MHZ-newest-Proxmark3-V3-DEV-kits-RFID-NFC-duplication-code-0/32657109079.html

I worked with several ISO 15693 tags. First time, with embedded firmware that comes with Proxmark3 I could read all ISO tags 15693 (some of them with full memory dump, some no (Tag returned Error 15: Unknown error at some point)), so I decided to flash firmware to version 2.5.0 from this forum thread to make some progress in ISO 15693 tags reading

http://proxmark.org/forum/viewtopic.php?id=1562

It was successful, but after flashing to 2.5.0 I couldn't read ISO 15693 tags anymore (other tags worked excellent), neither basic info UID. Then I tried to revert to version 2.0.0 (files from this thread too), but Proxmark3 Easy was blocked, could't be recognized by windows anymore. Then I had to hold "button" and could flash its FPGA and OS again. I tried all versions from 2.0.0 to 2.5.0 and had no success in ISO 15693 tags reading. Then I flashed Proxmark3 with one version provided on chinese aliexpress site, and everything backed on the beginning, now I can read again ISO 15693 tags.

These are system informations (hw version command) with its original 2.0.0 firmware version

#db# Prox/RFID mark3 RFID instrument
#db# bootrom: /-suspect 2015-11-19 10:08:02
#db# os: /-suspect 2015-04-02 15:12:11
#db# HF FPGA image built on 2015/03/09 at 08:41:42
Prox/RFID mark3 RFID instrument
uC: AT91SAM7S256 Rev D
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 256K bytes. Used: 0 bytes ( 0%). Free: 262144 bytes (100%).
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 64K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memory

and this I got with hw tune

Measuring antenna characteristics, please wait.......
# LF antenna: 30.66 V @ 125.00 kHz
# LF antenna: 29.98 V @ 134.00 kHz
# LF optimal: 36.58 V @ 129.03 kHz
# HF antenna: 28.82 V @ 13.56 MHz
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

Could someone tell me what is the problem with reading ISO 15693 tags, and what could I change in fullimage.elf to can read ISO 15693 tags with 2.5.0 firmware version. I believe this can be due to processor version or so...

please help, thanks

ps. this is readout from one of ISO 15693 tags made with 2.0.0 original version

Reading memory from tag UID=E0040200547FF119
Tag Info: NXP(Philips); IC SL2 ICS53/ICS54(SLI-S) ICS5302/ICS5402(SLIX-S)
Block 00 86 08 6D E6 ..m.
Block 01 02 1E E0 A0 ....
Block 02 1E 80 53 42 ..SB
Block 03 14 20 53 42 . SB
Block 04 0A 90 53 42 ..SB
Block 05 27 00 00 00 '...
Block 06 00 00 00 00 ....
Block 07 00 00 00 00 ....
Block 08 00 00 00 00 ....
Block 09 00 00 00 00 ....
Block 0a 00 00 00 00 ....
Block 0b 00 00 00 00 ....
Block 0c 00 00 00 00 ....
Block 0d 00 00 00 00 ....
Block 0e 00 00 00 00 ....
Block 0f 00 00 00 00 ....
Block 10 00 00 00 00 ....
Block 11 00 00 00 00 ....
Block 12 00 00 00 00 ....
Block 13 00 00 00 00 ....
Block 14 00 00 00 00 ....
Block 15 00 00 00 00 ....
Block 16 00 00 00 00 ....
Block 17 00 00 00 00 ....
Block 18 00 00 00 00 ....
Block 19 00 00 00 00 ....
Block 1a 00 00 00 00 ....
Block 1b 00 00 00 00 ....
Block 1c 00 00 00 00 ....
Block 1d 00 00 00 00 ....
Block 1e C6 0B 00 1F ....
Block 1f C0 05 1B 13 ....
Block 20 A9 45 B6 16 .E..
Block 21 87 D2 87 A9 ....
Block 22 90 5C 66 BB .\f.
Block 23 0B 80 07 0F ....
Block 24 00 00 C0 DB ....
Block 25 00 28 04 18 .(..
Block 26 00 00 00 00 ....
Block 27 00 00 00 00 ....
Tag returned Error 15: Unknown error.

Last edited by zilot (2016-06-22 09:22:39)

iceman · 2016-06-22 09:35:50

No, it hasn't anything to do with the processer etc. Its all in the arm-src code. There has been a lot of changes on the device side but the iso15693 didn't get any attention.

zilot · 2016-06-22 10:33:17

What do you thing then problem could be? This processor is 256K bytes, I guess antenna is not problem because it works with earlier version (2.0.0) and the valid distance was about 5cm where still communication was possible. Is there any specific triggers in arm-src code for this kind of processor? This fullimage.elf has date 04/02/2015 (its older than one on this forum) but works with ISO 15693.

Have you any suggestion what to try? Would some adjustments in arm-src code solve the problem?

iceman · 2016-06-22 10:58:59

its the changes to the different fpga demods of signal and timings. Changes made to iclass but not to 15963, changes to bigbuffer, so there is a need for a overhaul of the 15693 code to verify that everything works as expected.

You can look into it if you want to.

zilot · 2016-06-22 11:27:53

Thanks, could you please give me some directions, I'm in this world, but new to proxmark, which source file to look, which class etc.. of course if you want, thank you.

Last edited by zilot (2016-06-22 11:28:17)

iceman · 2016-06-22 11:40:58

look inside armsrc/iso15693.c ...

zilot · 2016-06-22 12:08:55

Ok, thank you...is there any thread discussing timings you mentioned?

iceman · 2016-06-22 12:28:47

you could search the iclass category

Proxmark3 community

Announcement

#1 2016-06-22 09:12:47

Proxmark3 Easy and ISO 15693

#2 2016-06-22 09:35:50

Re: Proxmark3 Easy and ISO 15693

#3 2016-06-22 10:33:17

Re: Proxmark3 Easy and ISO 15693

#4 2016-06-22 10:58:59

Re: Proxmark3 Easy and ISO 15693

#5 2016-06-22 11:27:53

Re: Proxmark3 Easy and ISO 15693

#6 2016-06-22 11:40:58

Re: Proxmark3 Easy and ISO 15693

#7 2016-06-22 12:08:55

Re: Proxmark3 Easy and ISO 15693

#8 2016-06-22 12:28:47

Re: Proxmark3 Easy and ISO 15693

Board footer