Proxmark developers community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

#51 2015-10-27 12:26:07

novadrome
Member
Registered: 2015-10-27
Posts: 1

Re: PCF7931

news about the code to dump and write?

Offline

#52 2015-10-27 19:37:57

mariolino
Contributor
Registered: 2014-04-27
Posts: 47

Re: PCF7931

This is my PCF audio sniff smile

1445971051_immagine_02_.jpg
1445971072_pw.jpg

Offline

#53 2015-10-31 14:54:10

Dake
Contributor
Registered: 2015-06-16
Posts: 32

Re: PCF7931

@novadrome : the next improvement could be an automatic detection of PMC but for now I am very busy

Good job Mariolino ! You are near of goal.

If you use writing pcf functions you have to enter your bytes in LSB first. For example if you read with your snooper :

  10011110 00011010 11101010   .........

you have to enter in the command :

   01111001 01011000 01010111 .........
=> in hex
         79            58            57         .........

Last edited by Dake (2015-10-31 15:19:10)

Offline

#54 2015-10-31 20:14:41

mariolino
Contributor
Registered: 2014-04-27
Posts: 47

Re: PCF7931

Dear Dake, it just was an example of my audio recording by the sniffer. I'm already able to write the PCF smile and I know how to convert the recording to password in hex.

Last edited by mariolino (2015-10-31 20:15:26)

Offline

#55 2015-11-04 04:49:39

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,031

Re: PCF7931

iceman and I have cleaned up the existing PCF code a little especially the client side inputs (it was creating an annoying compiler warning).  could someone with a PCF tag test the changes?  https://github.com/marshmellow42/proxmark3

Offline

#56 2015-11-04 12:37:35

meter
Contributor
Registered: 2015-07-13
Posts: 77

Re: PCF7931

I tried read and work without issue, I can't test write because the actual version don't detect PMC for send a pulse.

Offline

#57 2015-11-04 14:22:27

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,031

Re: PCF7931

Thx.  If I had a tag I'd try to help with the pulse detection, but unfortunately I don't.

Offline

#58 2015-11-04 14:32:05

iceman
Administrator
Registered: 2013-04-25
Posts: 3,864
Website

Re: PCF7931

I actually have a tag, but its so small my lf antenna is not strong enough. It needs to be centered inside I guess.


modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#59 2015-11-04 19:36:33

meter
Contributor
Registered: 2015-07-13
Posts: 77

Re: PCF7931

centered and perpendicular. With antenna of RDV2.0 I haven't problem to read PCF7931. RDV1.0 doesn't work?

Offline

#60 2015-11-04 21:11:30

iceman
Administrator
Registered: 2013-04-25
Posts: 3,864
Website

Re: PCF7931

well,..  it could be the tag aswell..  I gotten some reads from it but it doesn't look like proper and I need to place it very specific over the antenna.


modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#61 2016-12-02 21:25:56

gelop4
Contributor
Registered: 2016-12-01
Posts: 3

Re: PCF7931

Hello.
I've got a PCF7931 tag.
The actual reference on it is PCF7931AS

Signal seems good, but it always repeat the same dataset.
KdEKq2v.png

proxmark3> lf pcf7931 read
#db# (dbg) 00 16 00 16 00 16 00 04 00 5f 50 95 00 00 00 00                 
#db# (dbg) 00 16 00 16 00 16 00 04 00 5f 50 95 00 00 00 00                 
#db# (dbg) 00 16 00 16 00 16 00 04 00 5f 50 95 00 00 00 00                 
...

data don't change and reading of the black fail.
Form my manual decode data are different:

00 00 00 00 4A A8 2F 80 02 00 0B 00 0B 00 0B 00

Any idea what's going on ?

Offline

#62 2016-12-02 21:35:33

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,031

Re: PCF7931

just a difference in binary interpretation.  a bit or two off and reverse endian.  otherwise it is the same binary.

Offline

#63 2017-09-13 21:03:35

Tatka
Contributor
From: Czech rep., EU
Registered: 2017-08-21
Posts: 17

Re: PCF7931

I have the tag PCF7931AS. I have two antennas: the first is an orginal antenna PM3 rv2. I made the other antenna myself.
Both antennas seem to be OK and PM3 shows the same values in the tag.
I'll use it:

proxmark3> lf pcf7931 read
#db# (dbg) 00 00 00 00 00 00 00 01 00 55 55 55 55 55 55 55
#db# (dbg) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
#db# (dbg) 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00
#db# (dbg) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f
#db# (dbg) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
#db# (dbg) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
#db# (dbg) 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00
#db# (dbg) 00 00 00 00 00 00 00 01 00 55 55 55 55 55 55 55
#db# (dbg) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f
Waiting for a response from the proxmark...
Don't forget to cancel its operation first by pressing on the button
#db# (dbg) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
#db# (dbg) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
command execution time out
#db# (dbg) 00 32 00 00 e9 02 00 00 00 00 00 00 19 99 69 01
#db# (dbg) 00 00 00 00 00 00 00 01 00 55 55 55 55 55 55 55
#db# (dbg) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
#db# (dbg) 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00
#db# (dbg) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
#db# (dbg) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f
#db# (dbg) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
#db# (dbg) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
#db# (dbg) 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00
#db# (dbg) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f
#db# (dbg) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
#db# (dbg) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
#db# (dbg) Max blocks: 1
#db# Error reading the tag
#db# Here is the partial content
#db# -----------------------------------------
#db# Memory content:
#db# -----------------------------------------
#db# 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
#db# -----------------------------------------
proxmark3>

Blocks are listed in different order. I do not know what is 0 block, 1 block, ...
I would like to see block 0 sector 0x07 0x08.
I read the datasheet many times. I still do not know where I'm making a mistake.
Can you help me?

Orginal antenna:

proxmark3> hw tune

Measuring antenna characteristics, please wait.........
# LF antenna: 44.96 V @   125.00 kHz
# LF antenna: 20.21 V @   134.00 kHz
# LF optimal: 46.06 V @   123.71 kHz
# HF antenna: 34.85 V @    13.56 MHz
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

proxmark3>

Myself antenna:

proxmark3> hw tune

Measuring antenna characteristics, please wait.......
# LF antenna: 46.34 V @   125.00 kHz
# LF antenna: 23.65 V @   134.00 kHz
# LF optimal: 46.34 V @   125.00 kHz
# HF antenna: 34.88 V @    13.56 MHz
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

proxmark3>

Still about my PM3

Prox/RFID mark3 RFID instrument          
bootrom: /-suspect 2015-11-19 10:08:02
os: master/v3.0.1-75-g1dae981-suspect 2017-08-31 15:46:50
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2017/07/13 at 08:44:13
          
uC: AT91SAM7S512 Rev B          
Embedded Processor: ARM7TDMI          
Nonvolatile Program Memory Size: 512K bytes. Used: 198426 bytes (38%). Free: 325862 bytes (62%).          
Second Nonvolatile Program Memory Size: None          
Internal SRAM Size: 64K bytes          
Architecture Identifier: AT91SAM7Sxx Series          
Nonvolatile Program Memory Type: Embedded Flash Memory   

I do not know what to say. I think I'm a normal person.

Offline

Board footer

Powered by FluxBB