Elvis Wiki - User contributions [en]

Proxmark3: Debricking

2020-09-19T20:21:56Z

Jostrowski:

== Summary ==

This tutorial will show how to reset a Proxmark3 RDV2 via the JTAG interface.

This is useful when the '''Proxmark3 RDV2''' is bricked and won't connect to the computer. This will solve any software failures like a corrupt firmware or bootloader.

'''1.''' Debricking process via '''Raspberry Pi''' 3+ (version 2, 3 and 4 work exactly the same)<br>
'''2.''' Debricking process via '''Bus Pirate''' 3.6
: Note: The method with the Bus Pirate did '''not work''' for me. Maybe you have better luck.

== Requirements ==

* Proxmark3
* Raspberry Pi 2, 3, or 4
* Bus Pirate v3 (or higher)
* Linux: Debian

== Raspberry Pi ==

[[File:Proxmark raspi.jpg|thumb|500px]]

; This tutorial is based on:
: http://www.lucasoldi.com/2017/01/17/unbrick-proxmark3-with-a-raspberry-pi-and-openocd/
: https://github.com/synthetos/PiOCD/wiki/Using-a-Raspberry-Pi-as-a-JTAG-Dongle
: http://openocd.org/doc/html/OpenOCD-Project-Setup.html

-----

=== Compile Proxmark ===

See [https://wiki.elvis.science/index.php?title=Proxmark3:_Installation Proxmark: Installation] or from the [https://github.com/Proxmark/proxmark3/wiki/Ubuntu-Linux official website]

=== Compile OpenOCD ===

<pre>
sudo apt-get update
sudo apt-get install -y autoconf libtool libftdi-dev textinfo pkg-config pkgconf git
git clone https://git.code.sf.net/p/openocd/code openocd
cd openocd
./bootstrap
./configure --enable-sysfsgpio --enable-bcm2835gpio
make
sudo make install
sudo cp -r tcl/ /usr/share/openocd
</pre>
<code>make</code> will take about 15 minutes.

-> '''Note:''' make, bootstrap and configure should give no compilation errors !!! (if not so check if you have all necessary libraries installed)

-> '''Note:''' also make sure that you compiled the proxmark repository without any compilation errors! (if not so check if you have all necessary libraries installed)

=== Connect physically ===

Connect the following pins from the Raspberry Pi to the Proxmark3

: {| class="wikitable"
! Proxmark3
! Raspberry Pi
! Cable colour
|-
| TMS || 22 || yellow
|-
| TDI || 19 || blue
|-
| TDO || 21 || green
|-
| TCK || 23 || orange
|-
| GND || 6 || grey
|-
| 3.3V || 1 || purple
|}

For the pin layout of the Raspberry Pi see [https://www.theengineeringprojects.com/wp-content/uploads/2018/07/introduction-to-raspberry-pi-3-b-plus-2.png link].

[[File:Proxmark raspi pin.jpg|border|600px]]

The pin configuration can be changed in: <code>/usr/share/openocd/interface/raspberrypi2-native.cfg</code>. (Not necessary for this tutorial)

-----

=== Connect via OpenOCD ===

''Note: Power the Proxmark separately from the Raspberry Pi''

; 1. Start OpenOCD
: switch to the Proxmark folder
:: <code>cd proxmark3</code>
:: ''Note: the source code of the Proxmark should be already be complied.''
; 2. Create OpenOCD configuration
:: <code>nano tools/raspi.cfg</code>
:: Past following code into the file

<pre>
# Ports
telnet_port 4444
gdb_port 3333

# Interface
adapter_khz 1000
source [find interface/raspberrypi2-native.cfg]

# use combined on interfaces or targets that can't set TRST/SRST separately
reset_config srst_only srst_pulls_trst

jtag newtap sam7x cpu -irlen 4 -ircapture 0x1 -irmask 0xf

target create sam7x.cpu arm7tdmi -endian little -chain-position sam7x.cpu

sam7x.cpu configure -event reset-init {
soft_reset_halt
mww 0xfffffd00 0xa5000004 # RSTC_CR: Reset peripherals
mww 0xfffffd44 0x00008000 # WDT_MR: disable watchdog
mww 0xfffffd08 0xa5000001 # RSTC_MR enable user reset
mww 0xfffffc20 0x00005001 # CKGR_MOR : enable the main oscillator
sleep 10
mww 0xfffffc2c 0x000b1c02 # CKGR_PLLR: 16MHz * 12/2 = 96MHz
sleep 10
mww 0xfffffc30 0x00000007 # PMC_MCKR : MCK = PLL / 2 = 48 MHz
sleep 10
mww 0xffffff60 0x00480100 # MC_FMR: flash mode (FWS=1,FMCN=72)
sleep 100

}

gdb_memory_map enable
#gdb_breakpoint_override hard
#armv4_5 core_state arm

sam7x.cpu configure -work-area-virt 0 -work-area-phys 0x00200000 -work-area-size 0x10000 -work-area-backup 0
flash bank sam7x512.flash.0 at91sam7 0 0 0 0 sam7x.cpu 0 0 0 0 0 0 0 18432
flash bank sam7x512.flash.1 at91sam7 0 0 0 0 sam7x.cpu 1 0 0 0 0 0 0 18432
</pre>

; 3. Start OpenOCD with the configuration file just created
:: <code>sudo openocd -f tools/raspi.cfg</code>
:: Now a openOCD session is started. Do '''not''' close it.
~/git/proxmark3 $ sudo openocd -f tools/raspi.cfg
Open On-Chip Debugger 0.10.0+dev-01404-g393448342-dirty (2020-09-17-17:59)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : clock speed 1001 kHz
Info : JTAG tap: sam7x.cpu tap/device found: 0x3f0f0f0f (mfg: 0x787 (<unknown>), part: 0xf0f0, ver: 0x3)
Info : Embedded ICE version 1
Info : sam7x.cpu: hardware has 2 breakpoint/watchpoint units
Info : starting gdb server for sam7x.cpu on 3333
Info : Listening on port 3333 for gdb connections
Info : accepting 'telnet' connection on tcp/4444
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00122a74

'''Note:''' If the output does not look like that and rather looks like this:
~/git/proxmark3 $ sudo openocd -f tools/raspi.cfg
Open On-Chip Debugger 0.10.0+dev-01404-g393448342-dirty (2020-09-17-17:59)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : clock speed 1001 kHz
Info : JTAG tap: sam7x.cpu tap/device found: 0x3f0f0f0f (mfg: 0x787 (<unknown>), part: 0xf0f0, ver: 0x3)
Info : TAP auto0.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto1.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto2.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto3.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto4.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto5.tap does not have valid IDCODE (idcode=0x0)
, then erase the chip manually and enable the JTAG interface by connecting the pin of the AT91SAM7S512 to 3.3V (see http://www.proxmark.org/forum/viewtopic.php?id=6159)

; 4. Connect to OpenOCD session
: Open a new terminal window and telnet to the port that was specified in the .cfg file
:: <code>telnet localhost 4444</code>
; 5. Flash via JTAG
; 6. Halt the Proxmark3
:: <code>halt</code>
; 7. Erase the flash content:
:: <code>flash erase_sector 0 0 15</code>
:: <code>flash erase_sector 1 0 15</code>
; 8. Flash the new firmware:
:: <code>flash write_image ./armsrc/obj/fullimage.elf</code>
:: <code>flash write_image ./bootrom/obj/bootrom.elf</code>

$ telnet localhost 4444
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> halt
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00122a74
> flash erase_sector 0 0 15
erased sectors 0 through 15 on flash bank 0 in 0.032174s

> flash erase_sector 1 0 15
erased sectors 0 through 15 on flash bank 1 in 0.031851s

> flash write_image ./armsrc/obj/fullimage.elf
wrote 257448 bytes from file ./armsrc/obj/fullimage.elf in 21.204687s (11.857 KiB/s)

> flash write_image ./bootrom/obj/bootrom.elf
wrote 3888 bytes from file ./bootrom/obj/bootrom.elf in 0.352596s (10.768 KiB/s)

'''Done!'''

Disconnect the Raspberry Pi from the Proxmark

Now you should be able to connect to the Proxmark as usual:

<code>./client/proxmark3 /dev/ttyACM0</code>

For useful commands visit: [[Proxmark3: Useful commands]]

== Bus Pirate ==

''Note: Here the Bus Pirate 3.6 will be used''

''Note: This did not work for me, maybe it was faulty hardware or faulty firmware''

This tutorial is based on https://scund00r.com/all/rfid/2018/05/18/debrick-proxmark.html

; Update the Bus Pirate
: you can use following guide: [[Bus Pirate: First steps]]
; Get the latest Proxmark3 repository & build
: <code>git clone https://github.com/Proxmark/proxmark3.git</code>
: <code>cd proxmark3</code>
: install needed components:
: <code>sudo apt install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev gcc-arm-none-eabi libstdc++-arm-none-eabi-newlib libpcsclite-dev pcscd</code>
: <code> make clean && make all</code>
: Install proxmark3 driver:
:: <code>sudo cp -rf driver/77-mm-usb-device-blacklist.rules /etc/udev/rules.d/77-mm-usb-device-blacklist.rules</code>
:: <code>sudo udevadm control --reload-rules</code>
: Add user
:: <code>sudo adduser $USER dialout</code>
:: Now logout and login in again
; Install OpenOCD
: <code>sudo apt-get install openocd</code>
; Connect the Proxmark3 to the Bus Pirate
: use this pin configuration:
: {| class="wikitable"
! Proxmark3
! Bus Pirate
|-
| TMS || CS
|-
| TDI || MOSI
|-
| TDO || MISO
|-
| TCK || CLK
|-
| GND || GND
|-
| 3.3V || 3.3V
|}
; Flashing
: check on with Port the Bus Pirate is connected:
:: <code>ls /dev/tty*</code>
:: OR
:: <code>dmesg -wH</code> and plugout and connect the Bus Pirate again
: Set OpenOCD config
:: <code>nano tools/at91sam7s512-buspirate.cfg</code>
# Interface
interface buspirate
buspirate_port /dev/ttyUSB0
adapter_khz 1000
; Start OpenOCD
: Launch OpenOCD
:: <code>sudo openocd -f tools/at91sam7s512-buspirate.cfg</code>

:~/git/proxmark3$ sudo openocd -f tools/at91sam7s512-buspirate.cfg
[sudo] password for j:
Open On-Chip Debugger 0.10.0-rc1-dev-gc404ff5d-dirty (2019-11-11-15:43)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Warn : Adapter driver 'buspirate' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
adapter speed: 1 000 kHz
srst_only srst_p ulls_tr st srst_gates_jtag srst_open_drain connect_deassert_srst
Info : Buspirate Interf ace ready!
Info : This adap ter doe sn't suppo rt configurable speed
Info : JTAG tap: sam7x. cpu tap/de vice found: 0x3f0f0f0f (mfg: 0x787 (<unknown>), part: 0xf0f0, ver: 0x3 )
Info : Embedded ICE version 1
Info : sam7x.cpu: hardware has 2 breakpoint/watchpoint units
Info : accepting 'telnet' connection on tcp/4444

: Open a new terminal window
:: and type: <code>telnet localhost 4444</code>

j@laptop:~/git/proxmark3$ telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>

: Halt the Proxmark3
:: <code>halt</code>
: Erase the flash content:
:: <code>flash erase_sector 0 0 15</code>
:: <code>flash erase_sector 1 0 15</code>
: Flash the new firmware:
:: <code>flash write_image ./armsrc/obj/fullimage.elf</code>
:: This will take a while (about 6 minutes)
:: <code>flash write_image ./bootrom/obj/bootrom.elf</code>

== Used Hardware ==

[[Proxmark3 RDV2 Kit]]
[[Bus Pirate v3.6 Universal serial interface]]

== References ==

* https://scund00r.com/all/rfid/2018/05/18/debrick-proxmark.html

[[Category:Documentation]]

Proxmark3: Debricking

2020-09-19T08:09:06Z

Jostrowski:

== Summary ==

This tutorial will show how to reset a Proxmark3 RDV2 via the JTAG interface.

This is useful when the '''Proxmark3 RDV2''' is bricked and won't connect to the computer. This will solve any software failures like a corrupt firmware or bootloader.

'''1.''' Debricking process via '''Raspberry Pi''' 3+ (version 2, 3 and 4 work exactly the same)<br>
'''2.''' Debricking process via '''Bus Pirate''' 3.6
: Note: The method with the Bus Pirate did '''not work''' for me. Maybe you have better luck.

== Requirements ==

* Proxmark3
* Raspberry Pi 2, 3, or 4
* Bus Pirate v3 (or higher)
* Linux: Debian

== Raspberry Pi ==

[[File:Proxmark raspi.jpg|thumb|500px]]

; This tutorial is based on:
: http://www.lucasoldi.com/2017/01/17/unbrick-proxmark3-with-a-raspberry-pi-and-openocd/
: https://github.com/synthetos/PiOCD/wiki/Using-a-Raspberry-Pi-as-a-JTAG-Dongle
: http://openocd.org/doc/html/OpenOCD-Project-Setup.html

-----

=== Compile Proxmark ===

See [https://wiki.elvis.science/index.php?title=Proxmark3:_Installation Proxmark: Installation] or from the [https://github.com/Proxmark/proxmark3/wiki/Ubuntu-Linux official website]

=== Compile OpenOCD ===

<pre>
sudo apt-get update
sudo apt-get install -y autoconf libtool libftdi-dev textinfo pkg-config pkgconf git
git clone https://git.code.sf.net/p/openocd/code openocd
cd openocd
./bootstrap
./configure --enable-sysfsgpio --enable-bcm2835gpio
make
sudo make install
sudo cp -r tcl/ /usr/share/openocd
</pre>
<code>make</code> will take about 15 minutes.

=== Connect physically ===

Connect the following pins from the Raspberry Pi to the Proxmark3

: {| class="wikitable"
! Proxmark3
! Raspberry Pi
! Cable colour
|-
| TMS || 22 || yellow
|-
| TDI || 19 || blue
|-
| TDO || 21 || green
|-
| TCK || 23 || orange
|-
| GND || 6 || grey
|-
| 3.3V || 1 || purple
|}

For the pin layout of the Raspberry Pi see [https://www.theengineeringprojects.com/wp-content/uploads/2018/07/introduction-to-raspberry-pi-3-b-plus-2.png link].

[[File:Proxmark raspi pin.jpg|border|600px]]

The pin configuration can be changed in: <code>/usr/share/openocd/interface/raspberrypi2-native.cfg</code>. (Not necessary for this tutorial)

-----

=== Connect via OpenOCD ===

''Note: Power the Proxmark separately from the Raspberry Pi''

; 1. Start OpenOCD
: switch to the Proxmark folder
:: <code>cd proxmark3</code>
:: ''Note: the source code of the Proxmark should be already be complied.''
; 2. Create OpenOCD configuration
:: <code>nano tools/raspi.cfg</code>
:: Past following code into the file

<pre>
# Ports
telnet_port 4444
gdb_port 3333

# Interface
adapter_khz 1000
source [find interface/raspberrypi2-native.cfg]

# use combined on interfaces or targets that can't set TRST/SRST separately
reset_config srst_only srst_pulls_trst

jtag newtap sam7x cpu -irlen 4 -ircapture 0x1 -irmask 0xf

target create sam7x.cpu arm7tdmi -endian little -chain-position sam7x.cpu

sam7x.cpu configure -event reset-init {
soft_reset_halt
mww 0xfffffd00 0xa5000004 # RSTC_CR: Reset peripherals
mww 0xfffffd44 0x00008000 # WDT_MR: disable watchdog
mww 0xfffffd08 0xa5000001 # RSTC_MR enable user reset
mww 0xfffffc20 0x00005001 # CKGR_MOR : enable the main oscillator
sleep 10
mww 0xfffffc2c 0x000b1c02 # CKGR_PLLR: 16MHz * 12/2 = 96MHz
sleep 10
mww 0xfffffc30 0x00000007 # PMC_MCKR : MCK = PLL / 2 = 48 MHz
sleep 10
mww 0xffffff60 0x00480100 # MC_FMR: flash mode (FWS=1,FMCN=72)
sleep 100

}

gdb_memory_map enable
#gdb_breakpoint_override hard
#armv4_5 core_state arm

sam7x.cpu configure -work-area-virt 0 -work-area-phys 0x00200000 -work-area-size 0x10000 -work-area-backup 0
flash bank sam7x512.flash.0 at91sam7 0 0 0 0 sam7x.cpu 0 0 0 0 0 0 0 18432
flash bank sam7x512.flash.1 at91sam7 0 0 0 0 sam7x.cpu 1 0 0 0 0 0 0 18432
</pre>

; 3. Start OpenOCD with the configuration file just created
:: <code>sudo openocd -f tools/raspi.cfg</code>
:: Now a openOCD session is started. Do '''not''' close it.
; 4. Connect to OpenOCD session
: Open a new terminal window and telnet to the port that was specified in the .cfg file
:: <code>telnet localhost 4444</code>
; 5. Flash via JTAG

j@laptop:~/git/proxmark3$ telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>

; 6. Halt the Proxmark3
:: <code>halt</code>
; 7. Erase the flash content:
:: <code>flash erase_sector 0 0 15</code>
:: <code>flash erase_sector 1 0 15</code>
; 8. Flash the new firmware:
:: <code>flash write_image ./armsrc/obj/fullimage.elf</code>
:: <code>flash write_image ./bootrom/obj/bootrom.elf</code>

'''Done!'''

Disconnect the Raspberry Pi from the Proxmark

Now you should be able to connect to the Proxmark as usual:

<code>./client/proxmark3 /dev/ttyACM0</code>

For useful commands visit: [[Proxmark3: Useful commands]]

== Bus Pirate ==

''Note: Here the Bus Pirate 3.6 will be used''

''Note: This did not work for me, maybe it was faulty hardware or faulty firmware''

This tutorial is based on https://scund00r.com/all/rfid/2018/05/18/debrick-proxmark.html

; Update the Bus Pirate
: you can use following guide: [[Bus Pirate: First steps]]
; Get the latest Proxmark3 repository & build
: <code>git clone https://github.com/Proxmark/proxmark3.git</code>
: <code>cd proxmark3</code>
: install needed components:
: <code>sudo apt install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev gcc-arm-none-eabi libstdc++-arm-none-eabi-newlib libpcsclite-dev pcscd</code>
: <code> make clean && make all</code>
: Install proxmark3 driver:
:: <code>sudo cp -rf driver/77-mm-usb-device-blacklist.rules /etc/udev/rules.d/77-mm-usb-device-blacklist.rules</code>
:: <code>sudo udevadm control --reload-rules</code>
: Add user
:: <code>sudo adduser $USER dialout</code>
:: Now logout and login in again
; Install OpenOCD
: <code>sudo apt-get install openocd</code>
; Connect the Proxmark3 to the Bus Pirate
: use this pin configuration:
: {| class="wikitable"
! Proxmark3
! Bus Pirate
|-
| TMS || CS
|-
| TDI || MOSI
|-
| TDO || MISO
|-
| TCK || CLK
|-
| GND || GND
|-
| 3.3V || 3.3V
|}
; Flashing
: check on with Port the Bus Pirate is connected:
:: <code>ls /dev/tty*</code>
:: OR
:: <code>dmesg -wH</code> and plugout and connect the Bus Pirate again
: Set OpenOCD config
:: <code>nano tools/at91sam7s512-buspirate.cfg</code>
# Interface
interface buspirate
buspirate_port /dev/ttyUSB0
adapter_khz 1000
; Start OpenOCD
: Launch OpenOCD
:: <code>sudo openocd -f tools/at91sam7s512-buspirate.cfg</code>

:~/git/proxmark3$ sudo openocd -f tools/at91sam7s512-buspirate.cfg
[sudo] password for j:
Open On-Chip Debugger 0.10.0-rc1-dev-gc404ff5d-dirty (2019-11-11-15:43)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Warn : Adapter driver 'buspirate' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
adapter speed: 1 000 kHz
srst_only srst_p ulls_tr st srst_gates_jtag srst_open_drain connect_deassert_srst
Info : Buspirate Interf ace ready!
Info : This adap ter doe sn't suppo rt configurable speed
Info : JTAG tap: sam7x. cpu tap/de vice found: 0x3f0f0f0f (mfg: 0x787 (<unknown>), part: 0xf0f0, ver: 0x3 )
Info : Embedded ICE version 1
Info : sam7x.cpu: hardware has 2 breakpoint/watchpoint units
Info : accepting 'telnet' connection on tcp/4444

: Open a new terminal window
:: and type: <code>telnet localhost 4444</code>

j@laptop:~/git/proxmark3$ telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>

: Halt the Proxmark3
:: <code>halt</code>
: Erase the flash content:
:: <code>flash erase_sector 0 0 15</code>
:: <code>flash erase_sector 1 0 15</code>
: Flash the new firmware:
:: <code>flash write_image ./armsrc/obj/fullimage.elf</code>
:: This will take a while (about 6 minutes)
:: <code>flash write_image ./bootrom/obj/bootrom.elf</code>

== Used Hardware ==

[[Proxmark3 RDV2 Kit]]
[[Bus Pirate v3.6 Universal serial interface]]

== References ==

* https://scund00r.com/all/rfid/2018/05/18/debrick-proxmark.html

[[Category:Documentation]]

OS Hardening

2020-01-31T20:56:38Z

Jostrowski:

== Summary ==

In this article the term security is explored and applied to the security requirements of an operating system. A general overview is given on how OS security is defined. Then, the three main sectors on OS security are presented as a high-level overview.

This is based on the seminar paper "OS Hardening - Making systems more secure" ([[File:OS Hardening.pdf]]), which focuses on creating safe execution environments for exploitable applications with buffer overflows.

== Operating System Security Evaluation ==

Creating a completely secure system is hard if not impossible to achieve. Striving to such a goal gets even harder when dealing with enormous complex systems.

There are three main evaluation criteria for testing and classify computer systems:
* '''TCSEC''': Trusted Computer System Evaluation Criteria
: developed under the United States Government Department of Defense
* '''ITSEC''': Information Technology Security Evaluation Criteria
: published under the Commission of the European Communities
* '''CC''': Common Criteria
: These two standards got unified under ISO/IEC 15408 standard.

These standards classify computer systems on a set of criteria ranging
from minimal protection (EAL 1) to verified protection (EAL 7).

[[File:OS Security Evaluation Criteria.png|600px]]

To bring these requirements into perspective here is a short list, for common OS classification:

* EAL 4+: Red Hat Enterprise 7.1 (2017), Windows XP (2005), Windows 2008 (2008)
* EAL 3: Apple Mac OS X 10.6 (2009)
* EAL 2: Ubuntu 16.04 (2018)

It has to be noted that examination takes a long time to conducted and only applies to one specific version. This is one of the reasons why such investigations are performed rarely. Additionally, they are very costly, leading to only a marginal gain for the product.

== Common Threats ==

The main security purpose of an operating system is the separation of user data and applications. Other applications or users should not be able to access data they are not authorized to. The operating system has different techniques for achieving this goal. But before we look into the protection and hardening of an operating system, the most prominent attacks are presented. This list of threats is by no means complete and should only give a brief overview.

; Application Exploit
: Application exploits utilize programming errors to take advantage of the system with the goal in mind to have some kind of privilege escalation and accessing files that should normally not be accessible to a not authorized user.
; Buffer Overflow
: Buffer overflows are a subtype of an application exploit. As they are one of the more common attacks out there we examine them closer. Buffer overflow is the practice of exploiting unprotected size-unrestrained memory buffers. The goal of such an attack is the modification of the return pointer of a program, enabling the attacker to jump to an arbitrary location in memory. For more info, please visit [[Buffer Overflows]]
; Race Condition
: Race conditions can occur when concurrent processes can read or write on the same memory location. This attack is also known as time-to-check and time-of-use (TOC/TOU) as a shared value is checked and subsequently used to exploit some kind of software bug.
: For example, an attacker can create a symbolic link to a file in the precise moment a privileged program wants to write to it. If this symbolic link points to \textit{/etc/passwd}, the privilege program unwillingly overwrites the password file, allowing the attacker root access to the machine
; Other Attacks
: There are many more techniques attacking the CIA requirements of an operating system. Many malicious actors attack the confidentiality as it usually has the most value to an adversary.
: Other attacks on the CIA criteria include SQL injections, web exploits, password cracking, denial-of-service attacks, eavesdropping attacks and malware.

=== Background of attackers ===

In the 2019 Verizon data breach investigations report shows that the motives of threat actors were 67% financially motivated, 20% espionage driven, 8% for fun and self-esteem related.

[[File:Verzion2019 Report.png|400px]]

== OS Hardening ==

It is to be noted that achieving a completely secure system is almost impossible. What makes this especially challenging is the fact, that a general-purpose operating system has to account for a diverse set of applications running on it. The operating system has only a small influence changing the behavior of a program, as the source code is mostly controlled by a third party. It is the job of the operating system to manage all of the programs and create a safe environment for the user and the applications.

=== Safe Environments ===

Even though all applications operate in the same memory and on the same CPU, they should not be able to access files that they are not authorized to.

;: Kernel-Enforced Protection
:: The kernel does not know the internal functionality of the executing program, therefore it can only modify the layout of the memory and enforce access control rights.
;:: Memory Access Control
:::: By creating non-executable (NOEXEC) memory spaces. This prevents the execution of injected shellcode in the heap or the stack of an application.
;:: Memory Address Randomization
:::: Address Space Layout Randomization (ASLR) introduces randomness of the placement in virtual memory. For an attacker it is therefore hard to know where the location of variables, binary, libraries, heap and stack are in memory, as it is different for each execution.
;: Compiler-Enforced Protection
:: This method tackles the problem during the compilation of the program. The compiler leverages the knowledge it has on the structure of the program and could modify it in the way of securing against buffer overflows.
;:: Stack Canaries
::::: The compiler can insert special data, called canaries, into different parts of the program memory that get checked during the program execution. If an attacker tries to overflow a buffer, the possibility of overwriting a canary is very high, since they are placed in strategical positions.

For a more practical visualization please visit [[Buffer Overflows]].

== Access Control ==

Access control on an operating system is needed to preserve the confidentiality of a multi-user and multi-application system. The system has to control who is allowed to access, modify and execute certain data.

=== Access Control List ===

In Linux basic file access control is based on the traditional UNIX file model. Each file and directory has a total of 9 bits and some special markers to set the permission. The three bits resemble the privilege to read (r), write (w) and execute (x) a given file.

Dividing the access control into three groups can be quite limiting, especially if there are users that need special permissions and is called '''simple ACL'''. Maybe we want to grant permissions to additional users or groups. This is where the traditional system becomes quite constricting.

$ ls -l example.txt
-rw-r--r-- 1 root root 0 Jan 31 21:32 example.txt

Therefore, the extension for a '''extended''' ACL is provided in Linux per default and enables the definition of additional users (named user) and additional groups (named group). Accessing and viewing the extended ACL in Linux is possible with the command <code>getfacl</code>

// view extended ACL
$ getfacl example.txt

# file: example.txt
# owner: root
# group: root
user::rw-
group::r--
other::r--

// modify or add permissions
$ sudo setfacl -m "u:someuser:rwx" example.txt
$ sudo setfacl -m "g:somegroup:r-x" example.txt
$ getfacl eammple.txt

# file: example.txt
# owner: root
# group: root
user::rw-
user:someuser:rwx
group::r--
group:somegroup:r-x
mask::rwx
other::r--

// view with ls command (note the # that indicates the extended acl)
ls -l example.txt
-rw-rwxr--+ 1 root root 0 Jan 31 21:32 example.txt

// remove permissions
$ sudo setfacl -x user:someuser example.txt
$ getfacl example.txt
# file: example.txt
# owner: root
# group: root
user::rw-
group::r--
group:somegroup:r-x
mask::r-x
other::r--

// view with ls command
$ ls -l example.txt
-rw-r-xr--+ 1 root root 0 Jan 31 21:32 example.txt

=== Manditory Access Control ===

The aforementioned method of access control is called the '''Discretionary Access Control (DAC)''' method and is the most common mechanism to enforce confidentiality. The idea behind DAC is that the owner specifies who can access an object. This decision is based on the owner's discretion.

The so-called '''Mandatory Access Control (MAC)''' tries to tackle the problem with a changed fundamental concept. Instead of letting the user decide the permission of objects, each user is given a certain clearance and each object is given a security classification. Only when a user has a higher clearance level as the required security classification (secret, top-secret, confidential) the system allows access.

Well-known implementations in Linux that implement MAC is SE-Linux and AppArmor.

== Reducing the Attack Surface ==

Reducing the attack surface is a vital part of securing the operating system. As seen before we can use access control to prevent flawed applications to breach confidentiality. We should not rely on this technique entirely and should reduce the possible attacks in the first place.

The most common techniques on reducing the attack surface include:

* Removing unnecessary services
* Secure the network (firewalls)
* Securing the hardware (physical)

== References ==

; Seminar paper :
* [[File:OS Hardening.pdf]]

; References
* Commission of the European Communities. Information Technology Security Evaluation Criteria (ITSEC): Provisional Harmonised Criteria. Office For Official Publications Of The European Communities, Luxembourg, 1991.
* Luis Franco, Tony Sahama, and Peter Croll. Security Enhanced Linux to Enforce Mandatory Access Control in Health Information Systems. 2008.
* James Graham. Cyber Security Essentials. Auerbach Publications, 2011.
* Andreas Grunbacher. POSIX Access Control Lists on Linux. USENIX Annual Technical Conference, FREENIX Track, 2003.
* Aneesh Kumar, Andreas Grünbacher, and Greg Banks. Implementing an advanced access control model on Linux. 2010.
* Vasudevan Nagendra and Yaohui Chen. Access Control Lists in Linux & Windows. Stony Brook University, 2014.
* P. K. Patra and P. L. Pradhan. Hardening of UNIX Operating System. Int J. of Computer Communication and Technology, 1, 2009.
* Abraham Silberschatz, Peter B Galvin, and Greg Gagne. Operating System Concepts. 2013.
* Peter Silberman and Richard Johnson. A Comparison of Buffer Overflow Prevention Implementations and Weaknesses.
* Verizon. 2019 Data Breach Investigations Report. Technical report, 2019.

; Links
* https://www.redhat.com/en/about/press-releases/red-hat-adds-common-criteria-security-certification-red-hat-enterprise-linux
* https://www.schneier.com/blog/archives/2005/12/microsoft_windo.html
* https://www.niap-ccevs.org/Product/Archived.cfm?par303=Microsoft%20Corporation

[[Category:Documentation]]

File:Verzion2019 Report.png

2020-01-31T15:25:12Z

Jostrowski: Verizon. 2019 Data Breach Investigations Report. Technical report, 2019.

== Summary ==
Verizon. 2019 Data Breach Investigations Report. Technical report, 2019.

File:OS Security Evaluation Criteria.png

2020-01-31T15:09:30Z

Jostrowski:

File:OS Hardening.pdf

2020-01-31T14:57:32Z

Jostrowski:

OS Hardening

2020-01-31T14:43:21Z

Jostrowski: Created page with "== Summary == Description what this documentation is about == Requirements == * Operating system: Ubuntu 18.04 bionic amd64 * Packages: git emacs In order to complete the..."

== Summary ==

Description what this documentation is about

== Requirements ==

* Operating system: Ubuntu 18.04 bionic amd64
* Packages: git emacs

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Proxmark3 RDV4: SmartCard

2020-01-30T11:45:03Z

Jostrowski:

[[File:Smartcard chip.jpg|thumb|300px|Smartcard Chip]]

== Summary ==

The Proxmark3 RDV4 comes with a built-in smartcard chip reader allowing to read and send data to the smartcard. A smartcard chip is a small passive-powered microprocessor that can be used in many ways. Most common, it enables some type of identification and can store a small amount of data. These chips usually are built with security in mind only allowing communication over the contact plates.

== Requirements ==

* Proxmark3 RDV4
* Some Smartcards

== Setup ==

Hidden under the lid of the Proxmark RDV4 you can find a smart card reader. You can directly insert a smartcard directly into to the slot or insert it into the optional smartcard extender that allows for card size formats.

[[File:Prox smartcard.jpg|800px|Proxmark with the smartcard extender]]

== SC-Command ==

SC stands for smartcard and allows communication over the metal chip contact plates. The protocol used for communication is defined by the ISO/IEC 7816 standard.

A very informative and high-level introduction can be found here: [https://salmg.net/2018/10/18/proxmark3-rdv4-extracting-data-from-chip-and-pin-cards/ data-extraction from chip]

At the moment following commands are present on the Proxmark3 RDV4:

[usb] pm3 --> sc
help This help
list List ISO 7816 history
info Tag information
reader Act like an IS07816 reader
raw Send raw hex data to tag
upgrade Upgrade sim module firmware
setclock Set clock speed
brute Bruteforce SFI

At the moment there are not many specific commands available as this feature is rather new. The two main commands are <code>sc info</code> to get the ATS response of the smartcard and <code>sc raw</code> that enables to send command/ data to the chip allowing to interact with it.

I tested the <code>sc info</code> command on an Austrian e-card

[usb] pm3 --> sc info
[=] --- Smartcard Information ---------
[=] -------------------------------------------------------------
[=] ISO7618-3 ATR : 3B DD 96 FF 81 B1 FE 45 1F 03 80 xx xx xx xx xx xx xx xx xx xx xx 05 18

[=] http:/ /smartcard-atr.appspot.com/ parse?ATR= 3BDD96FF81B1FE451F0380xxxxx xxxxxxxxxxxxxxxxx0518

[=] ATR
- TA1 (Maximum clock frequency, p roposed bit duration) [ 0x96 ]
- TC1 (Extra delay between bytes required by card) [ 0xff ]
- TD1 (First offered transmission protocol, presence of TA2..TD2) [ 0x81 ] Protoc ol T1
- TD2 (A supported pr otocol or more global parameters, presence of TA3..T D3) [ 0xb1 ] Pr otocol T1
- TA3: 0xfe
- TB3: 0x45
- TD3 [ 0x1f ] Protoc ol T15
- TA4: 0x03
[=] Check sum OK.

[=] Histor ical bytes | le n 0x13 | format 80

[=] Hi storical bytes
00: 80 xx xx xx xx xx xx xx xx xx xx xx 05

[=] D/F (T A1)
- Di 3 2
- Fi 5 12
- F 5 ,0 MHz
- Cycl es/ETU 16
- 2500 00,0 bits/s ec a t 4 MHz
- 3125 00,0 bits/s ec a t Fmax (5,0MHz)

Following the weblink we get the addional information that the smartcard is probably running the operating system StarCOS 3.4

On website: https://smartcard-atr.apdu.fr/
Austrian "e-card" G3 (State Health Insurance Card)
(running StarCOS 3.4 by Giesecke & Devrient)

----

I had an old sim-card (GSM SIM card of the Austrian provider A1) laying around and tested the <code>sc raw</code> command.

For a high-level overview of sim-card commands and responses I recommend:
* http://rebelsimcard.com/sim-commands.html
* http://rebelsimcard.com/what-is-an-apdu.html
* http://rebelsimcard.com/sim-file-system.html

[usb] pm3 --> sc raw s t d A0 A4 00 00 02 3F 00
[+] 9F16 | Command successfully executed; 'xx' bytes of data are available and can be requested using GET RESPONSE.
[=] Requesting 0x16 bytes response
[+] 9000 | Command successfully executed (OK).
[!] TLV ERROR: Can't parse response as TLV tree.
[usb] pm3 --> sc list
[+] Recorded activity (trace len = 109 bytes)
[=] Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
[=] ISO7816-4 / Smartcard - Timings N/A yet

Start | End | Src | Data (! denotes parity error) | CRC | Annotation
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------
0 | 0 | Tag |3b 3f 96 00 80 69 af 03 3d 00 c6 00 00 00 0e 83 1e 9f | |
| | |16 | |
0 | 0 | Rdr |a0 a4 00 00 02 3f 00 | | R-block ACK
0 | 0 | Tag |a4 9f 16 | |
0 | 0 | Rdr |00 c0 00 00 16 | | GET RESPONSE
0 | 0 | Tag |c0 00 00 59 09 3f 00 01 00 00 00 00 00 09 13 02 0f 08 | |
| | |00 83 8a 83 8a 90 00 | |

I sent the Requet-Block command <code> A0 A4 00 00 02</code> and appended <code>3F 00</code> that tells the chip that I want to read out the file at the destination 0x3F00.

== EMV-Command ==

EMV originally stood for "Europay, Mastercard, Visa" which are the three companies that defined the standard that allows contact and contactless paying.

[usb] pm3 --> emv
help This help
exec Executes EMV contactless transaction.
pse Execute PPSE. It selects 2PAY.SYS.DDF01 or 1PAY.SYS.DDF01 directory.
search Try to select all applets from applets list and print installed applets.
select Select applet.
gpo Execute GetProcessingOptions.
readrec Read files from card.
genac Generate ApplicationCryptogram.
challenge Generate challenge.
intauth Internal authentication.
scan Scan EMV card and save it contents to json file for emulator.
test Crypto logic test.
list List ISO7816 history
roca Extract public keys and run ROCA test

With the extension of the smartcard-chip reader, it is now possible to perform the commands not only wirelessly but also wired. All the commands can be invoked with the parameter -w:

[usb] pm3 --> emv exec --help
Usage: emv exec [-h|-H|--help] [-s|-S|--select] [-a|-A|--apdu] [-t|-T|--tlv] [-j|-J|--jload] [-f|-F|--forceaid] By default: [-v|-V|--qvsdc] [-c|-C|--qvsdccda] [-x|-X|--vsdc] [-g|-G|--acgpo] [-w|-W|--wired]
Executes EMV contactless transaction

-h, -H, --help This help
-s, -S, --select activate field and select card.
-a, -A, --apdu show APDU reqests and responses.
-t, -T, --tlv TLV decode results.
-j, -J, --jload Load transaction parameters from `emv_defparams.json` file.
-f, -F, --forceaid Force search AID. Search AID instead of execute PPSE.
By default: Transaction type - MSD
-v, -V, --qvsdc Transaction type - qVSDC or M/Chip.
-c, -C, --qvsdccda Transaction type - qVSDC or M/Chip plus CDA (SDAD generation).
-x, -X, --vsdc Transaction type - VSDC. For test only. Not a standard behavior.
-g, -G, --acgpo VISA. generate AC from GPO.
-w, -W, --wired Send data via contact (iso7816) interface. Contactless interface set by default.

Usage:
emv exec -sat -> select card, execute MSD transaction, show APDU and TLV
emv exec -satc -> select card, execute CDA transaction, show APDU and TLV

== Used Hardware ==

[[Proxmark3 RDV4 Kit]]

== References ==

* https://en.wikipedia.org/wiki/EMV

[[Category:Documentation]]

File:Smartcard chip.jpg

2020-01-30T10:52:51Z

Jostrowski:

Wireshark: Traffic analysis of a Smart Alarm System

2020-01-30T10:15:01Z

Jostrowski: typo

== Summary ==

This is a traffic analysis of the [[Technaxx WiFi smart alarm system starter kit TX-84]] using Wireshark.

== Requirements ==

* Router running tcpdump (see: [[OpenWRT: Installation]])
* [[Technaxx WiFi smart alarm system starter kit TX-84]] with connected Smartphone app
* Wireshark

== Analysis ==

This analysis looks at the network traffic of the smart alarm system and later in step "Smartphone communication" at the traffic between the Alarm system and Smartphone App.

With the help of the [[Princeton IoT Inspector]] we are able to get a brief overview of the communications between the device and the outside world.

<div><ul>
<li style="display: inline-block;"> [[File:Alarm tx87 connections.png|thumb|500px|connections]] </li>
<li style="display: inline-block;"> [[File:Alarm tx86 IotInspector.png|thumb|500px|traffic visualization]] </li>
</ul></div>

What is not covered by the Princeton IoT-Inspector is the internal traffic. We will later find out that is quite interesting.

=== Boot up ===

There are two main communications to the outside world: 1. Heartbeat and 2. HTTP Traffic

==== UDP Heartbeat / "Hello" to Chinese server 18.195.211.66 ====

While the device is turned on it will send a notification to a Chinese server that it is turned on and active.

[[File:Technaxx Alarm Heartbeat.png]]

The password looks like a base64 string -> decode it: hex representation: aeb20fe3ead5942602831840a5c7292f9d548c7e (=bit length: 140 ... probably sha-1 or sha-128)

TODO: check out nonce attack

https://en.wikipedia.org/wiki/Digest_access_authentication

==== HTTP Traffic ====

[[File:Technaxx Alarm HTTP.png]]

==== Internal UDP communication between Smartphone App and alarm system ====

With the smartphone App [https://play.google.com/store/apps/details?id=com.mm.android.direct.technaxxphoneplus&hl=en My Secure Pro] you can monitor the current status and configuration of the smart alarm system. The Smartphone and the alarm system are connected through WLAN and talk to each other quite frequently. The communication is based on UDP and I suspect they talk a custom protocol called PTCP which sometimes contains JSON strings. These JSON strings contain information about the interface of the alarm system and you are also able to invoke function calls, like "turn off alarm" or "arming the device".

This type of internal UDP connection is quite a big portion as we can see: (using Wireshark IO-Graph)

[[File:Technaxx AlarmSystem Wireshark IOGraph.png]]

'''Green: UDP

'''Blue: TCP

'''Orange: DNS

Phone:
50 54 43 50 00 00 05 89 00 00 0b 29 00 00 fb 50 '''PTCP'''.... ...)...P
56 14 5f c4 00 37 41 ec 10 00 00 e1 ff b3 b1 85 V._..7A. ........
00 00 00 00 f6 00 00 00 c1 00 00 00 2b 70 02 00 ........ ....+p..
00 00 00 00 c1 00 00 00 00 00 00 00 00 17 26 02 ........ ......&.
00 00 00 00 7b 20 22 69 64 22 20 3a 20 31 35 39 ....{ "i d" : 159
37 38 37 2c 20 22 6d 65 74 68 6f 64 22 20 3a 20 787, '''"me thod" : '''
22 61 6c 61 72 6d 2e 73 65 74 41 72 6d 4d 6f 64 '''"alarm.s etArmMod
65 22 2c 20 22 6f 62 6a 65 63 74 22 20 3a 20 31 '''e"''', "obj ect" : 1
38 36 30 36 37 32 38 2c 20 22 70 61 72 61 6d 73 8606728, "params
22 20 3a 20 7b 20 22 6d 6f 64 65 22 20 3a 20 22 " : { '''"m ode" : "'''
41 72 6d 69 6e 67 22 2c 20 22 70 72 6f 66 69 6c '''Arming", "profil'''
65 22 20 3a 20 22 41 74 48 6f 6d 65 22 2c 20 22 '''e" : "At Home"''', "
70 77 64 22 20 3a 20 22 34 30 41 46 36 44 46 31 pwd" : " 40AF6DF1
46 34 42 46 35 46 30 33 30 41 30 30 42 32 30 33 F4BF5F03 0A00B203
41 44 46 42 42 30 34 31 22 20 7d 2c 20 22 73 65 ADFBB041 " }, "se
73 73 69 6f 6e 22 20 3a 20 33 36 30 35 30 36 38 ssion" : 3605068
38 20 7d 0a 00 8 }..
Alarm:
50 54 43 50 00 00 0b 29 00 00 06 76 00 00 f9 8d PTCP...) ...v....
00 37 47 d2 56 14 5f c4 10 00 00 80 ff b3 b1 85 .7G.V._. ........
00 00 00 00 f6 00 00 68 60 00 00 00 2b 70 02 00 .......h `...+p..
00 00 00 00 60 00 00 00 00 00 00 00 00 17 26 02 ....`... ......&.
00 00 00 00 7b 22 69 64 22 3a 31 35 39 37 38 37 ....{"id ":159787
2c 22 70 61 72 61 6d 73 22 3a 7b 22 64 65 74 61 ,"params ":{"deta
69 6c 22 3a 7b 22 49 44 22 3a 30 2c 22 54 72 69 il":{"ID ":0,"Tri
67 67 65 72 4d 6f 64 65 22 3a 22 4e 65 74 22 7d ggerMode ":"Net"}
7d 2c 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c },"resul t":true,
22 73 65 73 73 69 6f 6e 22 3a 33 36 30 35 30 36 "session ":360506
38 38 7d 0a 88}.
Phone:
50 54 43 50 00 00 06 76 00 00 0b b5 00 00 fa c4 PTCP...v ........
56 14 65 aa 00 37 47 d2 V.e..7G.

50 54 43 50 00 00 06 76 00 00 0b b5 00 00 fa c4 PTCP...v ........
56 14 65 b4 00 37 47 d2 10 00 00 8b ff b3 b1 85 V.e..7G. ........
00 00 00 00 f6 00 00 00 6b 00 00 00 2b 72 02 00 ........ k...+r..
00 00 00 00 6b 00 00 00 00 00 00 00 00 17 26 02 ....k... ......&.
00 00 00 00 7b 20 22 69 64 22 20 3a 20 31 36 30 ....{ "i d" : 160
32 39 39 2c 20 22 6d 65 74 68 6f 64 22 20 3a 20 299, "me thod" :
22 61 6c 61 72 6d 2e 64 65 73 74 72 6f 79 22 2c "'''alarm.d estroy'''",
20 22 6f 62 6a 65 63 74 22 20 3a 20 31 38 36 30 "object " : 1860
36 37 32 38 2c 20 22 70 61 72 61 6d 73 22 20 3a 6728, "p arams" :
20 6e 75 6c 6c 2c 20 22 73 65 73 73 69 6f 6e 22 null, " session"
20 3a 20 33 36 30 35 30 36 38 38 20 7d 0a 00 : 36050 688 }..
Alarm:
50 54 43 50 00 00 0b b5 00 00 07 0d 00 00 ff 68 PTCP.... .......h
00 37 47 f0 56 14 65 b4 .7G.V.e.
Phone:
50 54 43 50 00 00 07 0d 00 00 0b b5 00 00 fa c4 PTCP.... ........
56 14 65 be 00 37 47 d2 10 00 00 20 ff b3 b1 85 V.e..7G. ... ....
00 00 00 00 a4 00 00 00 00 00 00 00 1a 00 00 00 ........ ........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00 00 00 00

Calling the method: '''alarm.listMethod''' gives us following interface:
{
"id":157739,
"params":{
"method":[
"alarm.factory.instance",
"alarm.destroy",
"alarm.getInSlots",
"alarm.getOutSlots",
"alarm.getInState",
"alarm.getOutState",
"alarm.getExAlarmCaps",
"alarm.listMethod",
"alarm.startAlarmBell",
"alarm.stopAlarmBell",
"alarm.getChannelsState",
"alarm.getAlarmCaps",
"alarm.setArmMode",
"alarm.getArmMode",
"alarm.setBypassMode",
"alarm.getBypassMode",
"alarm.getActivateDefenceArea",
"alarm.addressBinding",
"alarm.getAllInSlots",
"alarm.getAllOutSlots",
"alarm.getAlarmInChannels",
"alarm.setSilentAlarm",
"alarm.setSoundAlarm"
]
},
"result":true,
"session":36050688
}

or '''configManager.listMethod'''

{
"id":161579,
"params":{
"method":[
"configManager.factory.instance",
"configManager.destroy",
"configManager.getConfig",
"configManager.setConfig",
"configManager.saveFile",
"configManager.deleteConfig",
"configManager.getDefault",
"configManager.setDefault",
"configManager.getMemberNames",
"configManager.restore",
"configManager.attach",
"configManager.detach",
"configManager.restoreExcept",
"configManager.copyConfig",
"configManager.getConfigEx",
"configManager.setConfigEx",
"configManager.exportPackConfig",
"configManager.importPackConfig",
"configManager.setChannelConfig",
"configManager.getVideoAnalyseConfig",
"configManager.setVideoAnalyseConfig",
"configManager.getFailureDetail",
"configManager.deleteFile",
"configManager.setTemporaryConfig",
"configManager.restoreTemporaryConfig",
"configManager.listMethod"
]
},
"result":true,
"session":36050688
}

== Used Hardware ==

* Router: [[Zyxel Armor Z2 AC 2600 MU-MIMO dualband wireless router]]
* [[Technaxx WiFi smart alarm system starter kit TX-84]]

== References ==

; I found an interesting presentation very similar to my findings:
: https://site.ieee.org/neworleans/files/2016/12/12052016-Presentation-IoT-security-website-copy.pdf

[[Category:Documentation]]

Technaxx SmartAlarm TX-84: Installation

2020-01-30T10:14:28Z

Jostrowski: typo

== Summary ==

The alarm system with Basis Station, PIR Sensor, Door & Window contact, Remote and Alarm Siren is a basic kit for a home security system.

== Installation ==

'''Step 11: Press the blue button on the base station for 6 seconds, and then let it go.'''

Now it should slowly blink blue, proceed with Step 12.

After that is should start to blink red. On the phone it will say "Connection successful" and the light of the base station should be blue again.

[[File:Alarm tx81 installation1.png|border|800px]]

[[File:Alarm tx81 installation2.png|border|800px]]

=== Add the Door and Window Contact to the base station ===

1. Press the blue button of the base station

2. Insert battery of the Sensor

3. The base station sends out an audible beep (if not repeat set 2)

[[Category:Documentation]]

Proxmark3: Useful commands

2020-01-30T10:14:02Z

Jostrowski: typo

== Summary ==

"NFC Hacking with Proxmark3" has been conducted during a school project, in which we analyzed the implementation of our NFC System. Which includes our on-campus cards, the printing system, snacks and drinks machines and the classroom doors. The additional output of this project was a (tested) guide on how to install the Proxmark3. For further details with regards to our project, concrete tests and more advanced commands please see our documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]].

In this thread we show a short overview of the different commands the proxmark3 environment has to offer.

== Requirements ==

Please see the [[Proxmark3: Installation]] guide for a full overview of requirements.
However, the Operating systems on which we tested the installation are:
*Ubuntu 16.04/18.03
*Windows 10
*MacOS 10.x

In order to complete the "Introduction" described below, you have to complete the [[Proxmark3: Installation]] guide first.

This overview is based on the proxmark3 client, published on Github on the 29. May 2019

== Introduction ==

This introduction should only give you a glimpse of the available commands and possibilities of the Proxmark3. The official Proxmark3-Repository, as well as the more advanced Ice-Man-Fork Repository (both linked in the reference section), provide lots of functions, though most of them are still in their alpha stage and therefore still need a bit of tinkering in order to work well. For further commands and our security analysis of our university feel free to have a look at our documentation!

=== The Commands ===

Connect via:
: Linux: <code>./client/proxmark3 /dev/ttyACM0</code>
: Windows <code>./client/proxmark3.exe COMx</code>

After you have successfully completed the Install Proxmark3 guide, you should see a screen similar to this when connecting to your proxmark3:

proxmark3>

You can always (in whichever menu you are) type 'help' in order to have a full list of available commands in that menu.
If you enter help in the start menu, you will get following output:
help This help. Use '<command> help' for details of a particular command.
data { Plot window / data buffer manipulation... }
hf { High Frequency commands... }
hw { Hardware commands... }
lf { Low Frequency commands... }
emv { EMV iso14443 and iso7816... }
sc { Smartcard commands... }
script { Scripting commands }
quit Exit program
exit Exit program

==== command: hw ====

"hw" stands for hardware and lists a bunch of commands to get basic hardware information of the Proxmark3.

detectreader ['l'|'h'] -- Detect external reader field (option 'l' or 'h' to limit to LF or HF)
fpgaoff Set FPGA off
lcd <HEX command> <count> -- Send command/data to LCD
lcdreset Hardware reset LCD
readmem [address] -- Read memory at decimal address from flash
reset Reset the Proxmark3
setlfdivisor <19 - 255> -- Drive LF antenna at 12Mhz/(divisor+1)
setmux <loraw|hiraw|lopkd|hipkd> -- Set the ADC mux to a specific value
tune ['l'|'h'] -- Measure antenna tuning (option 'l' or 'h' to limit to LF or HF)
version Show version information about the connected Proxmark
status Show runtime status information about the connected Proxmark
ping Test if the pm3 is responsive

We can check the version of the different builds of the Proxmark3 currently running on it:

proxmark3> hw version
Prox/RFID mark3 RFID instrument
bootrom: master/v3.1.0-94-gd38bb3a-dirty-suspect 2019-06-01 14:36:05
os: master/v3.1.0-94-gd38bb3a-dirty-suspect 2019-06-01 14:36:22
fpga_lf.bit built for 2s30vq100 on 2015/03/06 at 07:38:04
fpga_hf.bit built for 2s30vq100 on 2019/03/20 at 08:08:07

We can now check the antenna strength of the attached antennas. If you have borrowed the proxmark3 of the Elvis IoT Lab you will get following output:

(If no smart card is in proximity):

proxmark3> hw tune
Measuring antenna characteristics, please wait.........
# LF antenna: 43.86 V @ 125.00 kHz
# LF antenna: 21.04 V @ 134.00 kHz
# LF optimal: 44.14 V @ 123.71 kHz
# HF antenna: 30.41 V @ 13.56 MHz

If we now lay a NFC card on the antennas the voltages changes:

proxmark3> hw tune
Measuring antenna characteristics, please wait.........
# LF antenna: 44.27 V @ 125.00 kHz
# LF antenna: 21.04 V @ 134.00 kHz
# LF optimal: 44.27 V @ 123.71 kHz
# HF antenna: *19.39 V* @ 13.56 MHz

We can see, that the voltage of the HF antenna dropped from 30 volts to about 19 volts. We can assume that the placed NFC card is a high frequency card.

==== command: hf ====
"hf" stands for high frequency, which are specified at a carrier frequency of about 13.56 MHz.
Possible commands that can be issued are listed below:

proxmark3> hf
14a { ISO14443A RFIDs... }
14b { ISO14443B RFIDs... }
15 { ISO15693 RFIDs... }
epa { German Identification Card... }
legic { LEGIC RFIDs... }
iclass { ICLASS RFIDs... }
mf { MIFARE RFIDs... }
mfu { MIFARE Ultralight RFIDs... }
mfp { MIFARE Plus RFIDs... }
topaz { TOPAZ (NFC Type 1) RFIDs... }
fido { FIDO and FIDO2 authenticators... }
tune Continuously measure HF antenna tuning
list List protocol data in trace buffer
plot Plot signal
search Search for known HF tags [preliminary]
snoop <samples to skip (10000)> <triggers to skip (1)> Generic HF Snoop

Most of these command-options are for specific cards from specific manufacturers (e.g. legic, iclass, mf). On the other hand, 14a is an NFC card standard that describes low-level communication of smart cards. Not all follow the same standard and some implement proprietary protocols. The Mifare cards are built upon the 14a standard and have additional commands which can be found in their specific directory.

You usually start with the '''hf search''' command, which sends the card some data and analyses the return messages of the card. With this information, the Proxmark3 can make assumptions on what kind of card it may be.

proxmark3> hf search
UID : 01 02 03 04
ATQA : 00 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1
proprietary non iso14443-4 card found, RATS not supported
Chinese magic backdoor commands (GEN 1a) detected
Prng detection: WEAK
Valid ISO14443A Tag Found - Quiting Search

Here we see that this card is classified as a Mifare Classic 1k. In particular, it also answers back to the Chinese magic backdoor command which tells us that this card is a fully cloneable card that allows us to change the UID block of the card. More on this can be found in the Documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]]

We can now issue the '''hf plot''' command which will display a waveform with the just sent and received data.

[[File:Waveform.PNG|frameless]]

Thankfully people wrote programs that will parse this data to a dedicated protocol ('''hf list'''). In this case, we want to parse it as a Mifare classic communication with '''hf list mf'''.

proxmark3> hf list mf
Recorded Activity (TraceLen = 156 bytes)
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
iso14443a - All times are in carrier periods (1/13.56Mhz)
iClass - Timings are not as accurate
Start | End | Src | Data (! denotes parity error, ' denotes short bytes) | CRC | Annotation |
-----------|------------|-----|-----------------------------------------------------------------|-----|--------------------|
0 | 992 | Rdr | 40' | | MAGIC WUPC1
2484 | 3060 | Tag | 0a' | |
7040 | 8352 | Rdr | 43 | | MAGIC WUPC2
9524 | 10100 | Tag | 0a' | |
14080 | 18848 | Rdr | 50 00 57 cd | ok | HALT
0 | 992 | Rdr | 52' | | WUPA
2228 | 4596 | Tag | 04 00 | |
7040 | 9504 | Rdr | 93 20 | | ANTICOLL
10676 | 16564 | Tag | 01 02 03 04 04 | |
19328 | 29856 | Rdr | 93 70 01 02 03 04 04 8e 25 | ok | SELECT_UID
31028 | 34548 | Tag | 08 b6 dd | |
47488 | 52192 | Rdr | 60 00 f5 7b | ok | AUTH-A(0)
54196 | 58932 | Tag | 01 20 01 45 | | AUTH: nt

More on what is happening here can be found in the documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]]

There are many more commands. For example, '''hf data''' to manipulate the raw data, or '''hf mf''' to interact with Mifare Classic cards. Since this is only a short introduction to commands of the Proxmark3 we won't go deeper. If one is interested and wants to find out more about the Proxmark you we highly recommend the documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]] - where not only the essentials are covered, but also an in-depth explanation about the technology used, the Proxmark itself, the Mifare Classic Standard and a validation of the FH-Campus card system.

It is definitely worth checking out the paper since it also shows which vulnerabilities were found in the school card system.

== Used Hardware ==

[https://wiki.elvis.science/index.php?title=Proxmark_3 Proxmark3]

== Additional Documentation ==

* [[Proxmark3: Installation]]
* [[Proxmark3: FH-Campus Card NFC Security Valuation]]

== References ==

* https://github.com/Proxmark/proxmark3
* https://github.com/iceman1001/proxmark3

[[Category:Documentation]]

Princeton IoT Inspector: Tutorial

2020-01-30T10:10:28Z

Jostrowski: typo

== Summary ==

Princeton IoT Inspector is an open-source desktop tool to automatically discovers IoT devices and analyzes their network traffic.

== Requirements ==

* Operating system: Linux (or Mac OS)

== IoT Inspector ==

The official installation guide can be found on the [https://iot-inspector.princeton.edu/blog/post/getting-started/ official web-page]

Here a tutorial on how to install the IoT-Inspector on the Raspberry Pi: [[Princeton IoT Inspector: Installation on the Raspberry Pi]]

=== Start IoT Inspector ===

Launch the IoT Inspector:
cd ~/princeton-iot-inspector/
./linux-start-inspector.sh

You should be greeted with following screen:

===========================
Princeton IoT Inspector
===========================
View the IoT Inspector report at:
https://inspector.cs.princeton.edu/persistent/xxxx-xxxx-xxxx-xxxx
This is your private link. Open it only on trusted computers.
Hit Control + C to terminate this process and stop data collection.

=== Overview ===

visit the website from the previous output from any device

[[File:Iot inspector startpage.png|border|800px]]

=== View devices ===

Under "My Devices" you will find all connected devices on your network

You can now click on the device you want to monitor with the checkbox,

Or if you want to monitor all devices you can select "monitor all devices"

[[File:Iot inspector devices.png|border|800px]]

=== Network activities ===

Now it will get the network data

you can view it under "network activities"

[[File:Iot inspector activies.png|border|800px]]

== Analyze [[ABUS PPIC32020 smart security WiFi camera]] ==

Connect the camera to the network, click "monitor device" in the iot-inspector dashboard.

Now it will arp spoof the connection and log the network traffic.

[[File:Iot-inspector ABUS CAMERA.png|border|800px]]

We can analyze the connected IPs more closely when clicking on "communication endpoints"

[[File:Iot-inspector ABUS CAMERA endpoints.png|border|800px]]

== Analyze [[Technaxx WiFi smart alarm system starter kit TX-84]] ==

[[File:Alarm tx86 IotInspector.png|border|800px]]

'''We can observe, that the alarm base station is very talkative.'''

[[File:Alarm tx87 connections.png|border|800px]]]

== Used Hardware ==

[[Raspberry Pi 3, Model B+, WLAN, BT]]

[[ABUS PPIC32020 smart security WiFi camera]]

[[Technaxx WiFi smart alarm system starter kit TX-84]]

== References ==

https://iot-inspector.princeton.edu/

[[Category:Documentation]]

OpenWRT: Installation

2020-01-30T10:09:15Z

Jostrowski: typo

== Summary ==

This is a tutorial on how to install OpenWRT.
For this example the Router [[Zyxel Armor Z2 AC 2600 MU-MIMO dualband wireless router]] is used.

This tutorial is based on [https://openwrt.org/docs/guide-quick-start/factory_installation First-time install from OpenWRT]

== Requirements ==

* Router supporting OpenWRT (visit [https://openwrt.org/toh/start OpenWRT])

== Installation ==

=== Find the openWRT installation image ===

# Filter for your router on the [https://openwrt.org/toh/start official openWRT page]
# Go to "Device Page" or "Device Techdata"
# Check "Firmware OpenWrt Install URL"
#: If you can not find '''“factory.bin”''' firmware file (true for 70% of all supported devices), a device-specific custom installation procedure is required (Assuming your device does not already have an older LEDE or OpenWrt version installed). You can find custom installation instructions at the following locations
# In the case of the Zyxel Router we only have '''"kernel.bin"''' and '''"rootfs.bin"''' file.
#: '''So we have to proceed with a custom installation'''

If you have a factory.bin please follow these instructions: [https://openwrt.org/docs/guide-quick-start/factory_installation OpenWRT factory install]

=== Custom installation for the Zyxel Router ===

Following the custom installation steps: [https://openwrt.org/toh/zyxel/nbg6817]

; OEM easy installation
: Telnet (or ssh, if you allowed ssh on the router webpage) to the router
:: <code>login:root</code>
:: <code>password:1234</code>(or the set password)
:: [[File:Zyxel sshLogin.png]]
:: Interestingly OpenWRT is already is already installed by default, but limited and modified by Zyxel
: copy the kernel.bin and rootfs.bin to the /tmp/ folder
:: <code>scp j@192.168.1.67:/home/j/Desktop/openwrt-18.06.4-ipq806x-zyxel_nbg6817-squashfs-mmcblk0p4-kernel.bin /tmp/</code>
:: <code>scp j@192.168.1.67:/home/j/Desktop/openwrt-18.06.4-ipq806x-zyxel_nbg6817-squashfs-mmcblk0p5-rootfs.bin /tmp/</code>
: copy to local folders:
:: <code>printf "\xff" >/dev/mtdblock6</code>
:: <code>cat /tmp/openwrt-ipq806x-NBG6817-squashfs-mmcblk0p4-kernel.bin >/dev/mmcblk0p4</code>
:: <code>cat /tmp/openwrt-ipq806x-NBG6817-squashfs-mmcblk0p5-rootfs.bin >/dev/mmcblk0p5</code>
:: <code>sync</code>
:: <code>reboot -f</code>
; Update openWRT
: Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
: Upload image file for sysupgrade to LuCI
: Wait for reboot

=== Enjoy ===

[[File:OpenWRT StatusScreen.png|border|800px]]

----

=== Remote capture with tcpdump and Wireshark ===

;Installing tcpdump on the OpenWRT system
# Allow SSH
#: Go to "System" -> "Administration" and allow SSH
# Connect to SSH via terminal
#: <code>ssh root@192.168.1.1</code>
# Update system
#: <code>opkg update</code>
# Install tcpdump
#: <code>opkg install tcpdump</code>

'''Pipe tcpdump to remote Wireshark session [https://wiki.wireshark.org/CaptureSetup/Pipes Wireshark Wiki]:'''

Remote Capture

In bash syntax, remote capture is possible with the following command:

:<code>wireshark -k -i <(ssh -l root remote-host "dumpcap -P -w - -f 'not tcp port 22'")</code>

The main problem is that you have to exclude the traffic generated by the ssh session from capturing. Several patches are available to do this, but excluding port 22 is probably the easiest solution for now.

The second problem is that ssh cannot ask for a password on stdin. You should either set up ssh-agent, so that you don't need a password, or you should configure x-askpass to open a window for the password.

This can be worked around by combining SSH with a FIFO.

:<code>mkfifo /tmp/sharkfin</code>
:<code>wireshark -k -i /tmp/sharkfin</code>
:<code>ssh user@remote-host "dumpcap -P -w - -f 'not tcp port 22'" > /tmp/sharkfin</code>

'''for openWRT this would look like:'''

:<code>mkfifo /tmp/sharkfin</code>
:<code>wireshark -k -i /tmp/sharkfin</code>
:<code>ssh root@192.168.1.1 "tcpdump -i any -w - -f 'not tcp port 22'" > /tmp/sharkfin</code>

As soon as Wireshark starts "listening" on the pipe, SSH will prompt for the password and allow you to continue. Wireshark can also be switched out for tshark and tcpdump can be used in place of dumpcap with slight variations on the above commands.

== Used Hardware ==

[[Zyxel Armor Z2 AC 2600 MU-MIMO dualband wireless router]]

== References ==

* https://openwrt.org/
* https://openwrt.org/toh/zyxel/nbg6817
* https://wiki.wireshark.org/CaptureSetup/Pipes

[[Category:Documentation]]

JTAGulator: Introduction

2020-01-30T10:06:32Z

Jostrowski: typo

== JTAG explained ==

The JTAGulator is a tool to assist in identifying JTAG and USART pins.

[[File:JTAGulator.png|right]]

JTAG (named after the Joint Test Action Group) is an industry-standard for verifying designs and testing printed circuit boards after manufacture.

; JTAG allows for many applications:
:* Boundary Scan (read and set values of a pin)
:* Debugging of hardware/software
:* Program / Modify memory
:* Chips can be daisy-chained, so you can access multiple chips through one interface

; JTAG consist of 4 essential signals:
:* '''TCK''' ... Test Clock
:* '''TMS''' ... Test Mode Select (Steuerung)
:* '''TDI''' ... Test Data In
:* '''TDO''' ... Test Data Out

; additional signals:
:* '''Vcc''' ... 3.3V
:* '''GND''' ... ground
:* '''TRST''' .. test reset (low active)
:* '''RST''' ... system reset (low active)

Good video about the JTAG interface: [https://www.youtube.com/watch?v=TlWlLeC5BUs EEVblog #499 - What is JTAG and Boundary Scan?]

Manufactures have '''different''' Pin Layout, for Cortex Connectors, it looks like this:

[[File:JTAG connections.png|source:http://www.keil.com/support/man/docs/ulink2/ulink2_connector_20_16_14_10pin.png|500px]]

== JTAGulator Overview ==

Since JTAG pins are not always labeled, they can be hard to find. This is when the JTAGulator comes into play.

You connect the channels of the JTAGulator to different test pins on the hardware you want to analyze.

The JTAGulator test each individual pins and tries to find JTAG connections. If found it will output the correct JTAG pins.

== Setup ==

; Make sure you have the latest firmware: [[JTAGulator: Update firmware]]

; Connect the JTAGulator via serial to the computer
: 115200 bps, 8 data bits, no parity, 1 stop bit
:* Linux: you can use minicom
:* Windows: you can use Putty
: You should see the following output:
: [[File:JTAGulator welcomeScreen.png|400px]]

; Connect the JTAGulator to the test-device
# Connect the JTAGulator '''Ground (GND)''' to the GND of the hardware you want to analyze.
# Connect '''CHx''' from the JTAGulator to some pins '''(make sure via multimeter that the pins do not have a voltage level over 3.3V)''' on the hardware which may be JTAG pins (start from CH0). Do '''not''' use the '''VADJ''' pin on the JTAGualtor (VADJ is the output from the PWM/up-amp hardware on the JTAGulator that's used to create the target system voltage and drive the on-board level translators.)

== JTAGulator commands ==

This tutorial is based on the firmware version 1.6

* Display all commands: <code>H</code>
* Display firmware version: <code>I</code>

; First you need to set the voltage level
: Press <code>V</code> and set the voltage level accordingly (check via multimeter or hardware specification, usually 3.3)

=== Finding JTAG ===

* Type <code>J</code> to get to the JTAG commands
* Then type <code>H</code> for useful help-information
; IDCODE scan <code>I</code>
: This is a quick scan, which checks the output of every possible combination and presents possible combination + device IDs
: You can filter out incorrect JTAG identification by looking at the ID (device IDs are eye-catching, they are very non-uniform eg. (0x0D780237) and not like (0xFFFFFF7F) or (0x55555555) )
; BYPASS scan <code>B</code>
: After you used the IDcode scan, you want to determine the TDI line
: Enter x for the unknown TDI line and the numbers of the possible JTAG combination
; Test BYPASS <code>T</code>
: After the TDI pin was found, test the communication using the echo command of the JTAG interface. A random string gets sent to the TDI line of the JTAG interface and the JTAG controller should now send the same string back on the TDO line.
: With this you can make sure, that is really is a JTAG interface
: Go into the Test BYPASS menu, enter the number of the pins and see if the string matches
: If it does match it is very likely to be a JTAG interface, if not you will have to try out other pins.

'''For a real-world example look into the post: [[JTAGulator: Find a Smartphone's JTAG interface]]'''

----

=== Finding UART ===

The JTAGulator can also find UART pins by brute-forcing the pinout configuration as well as the baud-rate

; Find UART pins
* To enter the UART commands enter: <code>U</code>
: (You can get help via <code>H</code>)
* Set the voltage level with <code>V</code>
* Enter the brute-force mode: <code>U</code>
* Set parameters (make sure you do not ignore non-printable characters)
; Analyze output
: If the JTAGulator received a message it will output it to the screen
* The JTAGulator will display the TX and RX pin, the baud rate it was using and the message it received
: In the default configuration the JTAGualtor will send <CR> (0x0D) commands to the device
: Usually UART interfaces answer on <CR> commands with a response and append a <LF> (0x0A) or <CR> ( 0x0D) to it. Receiving such bytes are a good indicator that the correct baud rate was used.
; Connect to UART
: The JTAGualtor allows for passthrough of UART commands
* Enter <code>P</code> for UART passthrough
: Set the RX, TX and the baud rate you found before.

'''For an example visit: [[JTAGulator: Find IoT-Device's UART interface]]'''

== Used Hardware ==

[[JTAGulator]]

== References ==

[[Category:Documentation]]

JTAGulator: Find IoT-Device's UART interface

2020-01-30T10:02:05Z

Jostrowski: typo

== Summary ==

Description of how to find the UART interface of an IoT-Device. In this example the "smart" alarm system [[Technaxx WiFi smart alarm system starter kit TX-84]] will be used.

== Requirements ==

* '''Read subsection 'Finding UART' ''' of [[JTAGulator: Introduction]] to understand the basic commands available.
* JTAGualtor
* [[Technaxx WiFi smart alarm system starter kit TX-84]] or some other device

== UART explained ==

UART stands for Universal Asynchronous Receiver/Transmitter and is a serialized asynchronous communication specification between two devices. The communication can be simplex, half-duplex or duplex.

; UART consist out of:
* '''TX''' .. Transmit
* '''RX''' .. Receive
* Vcc .. Supply Voltage (optional)
* Gnd .. Ground 0V (optional)

whereas the RX from one device is connected to the TX from the other device

http://www.circuitbasics.com/wp-content/uploads/2016/01/Introduction-to-UART-Basic-Connection-Diagram-300x147.png

The two devices should have the same ground and same Vcc

=== Data transmission ===

http://www.circuitbasics.com/wp-content/uploads/2016/01/Introduction-to-UART-Packet-Frame-and-Bits-2.png

; UART packet are defined as followed:
: - Start Bit: A connected not-sending data-line is kept at the Vcc voltage (idle, but can also be the reverse). When one party wants to send data it indicates it by pulling the data-line to ground.
: - Data Frame: The actual data section allows to send 5 to 9 bits per packet.
: - Parity: To detect transmission errors a checksum is appended to the packet. There are different modes: total of all even bits, total of all uneven bits.
: - Stop Bit: To end the packet the data-line is set to Vcc for 1 or 2 bit duration.

* The Data Frame can only send 9 bits when the Parity Bit is turned off. The Data Frame "borrows" the extra bit from the Parity Bit.
* Data is send using least significant bit first.
* The baud rate of the 2 devices should be within +-10%

[[File:UART.png|400px|border]]

Source and Images:
* https://en.wikipedia.org/wiki/Universal_asynchronous_receiver-transmitter
* http://www.circuitbasics.com/basics-uart-communication/

== Find UART interface ==

As explained in the section before the UART interface consists out of two pins: RX and TX. Usually also the pins Gnd and Vcc are laid out together. Therefore these 4 pins are usually right next to each other in a line.

We look at this mainboard we can see 4 pins next to each other.

If you can't find them it helps to look at the datasheet of the microprocessor. It is good practice to remove the UART interface of the device since this should only be accessible for testing. (exceptions exist)

== Connect to the possible pins ==

Connect the JTAGulator Gnd Channel to the Gnd of the target device. Then connect the channels (start with 0 and proceed incrementally) to the possible pins of the UART.

(Tip: you do not have to connect to the Gnd and Vcc of the target device since Gnd is already connected and Vcc has to be set in the software of the JTAGulator)

== Connect to the JTAGualtor ==

''This tutorial is based on the firmware version 1.6''

Make sure you connected the target device to power.

; Connect the JTAGulator to the computer
: and open a serial connection using the following parameters: (eg. use Putty, minicom, ...)
:: 115200 bps, 8 data bits, no parity, 1 stop bit
; Go into the UART menu
: Type <code>U</code> for the UART menu
: Type <code>H</code> for help and all possible commands
; Find UART pin configuration
: Set the voltage level of the target device
:: <code>V</code> and enter Vcc (if not known check with oscilloscope of multimeter)
: Type <code>U</code> in the UART menu to start the brute force on the pin configuration of the UART pins.
: Enter the text string you want to output on the UART interface:
:: Usually you want to keep the <code>default configuration [CR]</code> so <code>just press enter</code>
:: Usually when pressing <code>enter</code> into a UART interface it will great you with a response.
: Enter starting channel of the JTAGulator
: Enter ending channel of the JTAGulator
:: Now the JTAGulator will cycle through all pin configurations and possible baud rates and prints out the output character you specified

UART> u
UART pin naming is from the target's perspective.
Enter text string to output (prefix with \x for hex) [CR]:
Enter starting channel [0]:
Enter ending channel [4]:
Possible permutations: 20

Ignore non-printable characters? [y/N]: n
Press spacebar to begin (any other key to abort)...
JTAGulating! Press any key to abort...
----------
TXD: 2
RXD: 3
Baud: 19200
Data: ..(t0d^l.. ..... [ AF 85 28 74 30 64 5E 6C D9 0F 20 B7 E7 A5 F5 D4 ]

TXD: 2
RXD: 3
Baud: 57600
Data: ...[32;40m00:16: [ 0D 0A 1B 5B 33 32 3B 34 30 6D 30 30 3A 31 36 3A ]

TXD: 2
RXD: 3
Baud: 76800
Data: . [ 0C ]

...

TXD: 2
RXD: 4
Baud: 115200
Data: ................ [ 9E CF 0F 98 06 9E 0F 0F 98 98 E0 CF F3 98 E6 98 ]
---------
UART scan complete.

We can see that the JTAGulator received some input. Now you have to filter out the right combination by looking at the output. The UART interface will send back some ASCII characters. 0x0D / 0x0A are very good indicator signalling a carriage return / newline. So the second output (TX:2 RX:3 Baud:56700) looks very promising

; Check the found UART pin configuration
: Now we will use the UART pass-through to send terminal input directly through the JTAGulator to the specific UART pin configuration

Restarting the target device (alarmsystem) gives us the perfect example to disable the UART as a debugging interface

-Boot 1.1.3 (May 24 2016 - 11:52:40)

Board: Dahua Tech Soc DRAM: 64 MB
relocate_code Pointer at: 83fb8000
***********************
Watchdog Reset Occurred
***********************
flash manufacture id: ef, device id 40 18
find flash: W25Q128BV
env_relocate[232] malloced ENV at 83f78010
============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:May 24 2016 Time:11:52:40
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

##### The CPU freq = 580 MHZ ####
estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!

Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
*: Entr boot command line interface.
5: Load img then write to Flash via TFTP.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
default: 3
0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
Image Name: Linux Kernel Image
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 2621376 Bytes = 2.5 MB
Load Address: 80000000
Entry Point: 8000c150
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8000c150) ...
## Giving linux memsize in MB, 64

Starting kernel ...

LINUX started...
Linux version 2.6.36+ (wu_zhongren@centos128) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 Wed Nov 30 19:48:01 CST 2016

The CPU feqenuce set to 580 MHz

MIPS CPU sleep mode enabled.
prom_envp(0)=memsize=64 ace in production:

'''Ohh look it started Linux :)'''

further down in the output we can see following:

00:00:17|[NetApp-364975] debug tid:344 tid:344, P2P current config:[
{
"Address" : "www.easy4ipcloud.com",
"Enable" : true,
"Key" : "YXQ3Maxxxxxxxxx",
"Port" : 8800,
"RecvBufferSize" : 524288,
"RegisterPort" : 12366,
"RegisterServer" : "www.easy4ip.com",
"ThreadNum" : 1,
"Type" : "dhp2p",
"UUID" : "3F0073EPAN00338",
"WebVersion" : "2.211.0"
}
]

''' Oh look it also printed out some password! '''

(I replaced the last characters of the password with x)

Let's see what happens if I press enter:

user name:
password:
23:50:23|[Manager] info tid:360 CLocalClient::CLocalClient(0x0x1c28f90)>>>>>>
23:50:23|[libInfra] warn tid:360 [Src/Component/Client.cpp:67] this:0x1c28f90 tid:360, userName of client is a null string!
23:50:23|[libInfra] warn tid:360 [Sr c/Component/Client.cpp:67] this:0x1c28f90 tid:360, userName of client is a null string!
23:50:23|[Manager] info tid:360 si.l oginType=0, si.clientAddress=, si.clientType=Consol e si.authorityInfo= si.authorityType= si.passwordType=Plain
23:50:23|[Manager] error tid:360 CLo calClient::login() fa iled with:268632070!
23:50:23|[Manager] info tid:360 CLocalClient::~CLocalClie nt(0x0x1c28f90)>>>>>>
User not valid!
user name:

'''Oh look it asks for a username and password'''

Let's test admin:admin

23:50:27|[Manager] debug tid:360 CLocalClient::login() successful! username = admin

... well that was easy 😅

and the best part is: '''I am logged into root''' :)

== Used Hardware ==

[[JTAGulator]]
[[Technaxx WiFi smart alarm system starter kit TX-84]]]

[[Category:Documentation]]

JTAGulator: Find a Smartphone's JTAG interface

2020-01-30T09:55:21Z

Jostrowski: typo

== Summary ==

This will show how to find a JTAG interface on a Smartphone (HTC One M7 801n).

== Requirements ==

* JTAGulator
* Smartphone (HTC M7)

For an overview of the JTAGulator: [[JTAGulator: Introduction]]

== Finding the JTAG interface ==

Browsing the web for the JTAG pinout is the best place to start. Some people might have already tried this and will leave some hints where the JTAG interface can be found.

Open the smartphone and remove the mainboard:

<div><ul>
<li style="display: inline-block;"> [[File:HTC open.jpg|thumb|none|300px|HTC M7 without back cover]] </li>
<li style="display: inline-block;"> [[File:HTC mainboard.jpg|thumb|none|300px|Mainboard removed]] </li>
<li style="display: inline-block;"> [[File:HTC mainboardBack.jpg|thumb|none|300px|Backside of mainboard]] </li>
</ul></div>

People on the internet hinted that the JTAG interface is on the back on the mainboard. So I connected the JTAGulator to them. First I tried to use a temporary approach using needles and clay. But that did not work very well, since the needles were not in tight contact with the pcb. (Later I found out that the copper wire I used was isolated.. so that explains why it did not work that well) That is why I soldered wires to the pins.
<div><ul>
<li style="display: inline-block;"> [[File:HTC needleProbes.jpg|thumb|none|300px|Needle approach]] </li>
<li style="display: inline-block;"> [[File:HTC probes.jpg|thumb|none|300px|Better solution: soldering]] </li>
</ul></div>

After I connected the pins to the JTAGulator and the mainboard to power, I scanned via the '''IDcode Scan'''.

JTAG> i
Enter starting channel [0]:
Enter ending channel [7]:
Possible permutations: 336

Bring channels LOW between each permutation? [Y/n]:
Enter length of time for channels to remain LOW (in ms, 1 - 1000) [100]: 10
Enter length of time after channels return HIGH before proceeding (in ms, 1 - 1
Press spacebar to begin (any other key to abort)...
JTAGulating! Press any key to abort...
----------------------------------------------
TDI: N/A
TDO: 1
TCK: 4
TMS: 6
Device ID #7: 1111 1111111011111111 11111111111 1 (0xFFEFFFFF)
Device ID #10: 1111 1111111111111111 01111111111 1 (0xFFFFF7FF)

--
TDI: N/A
TDO: 2
TCK: 0
TMS: 6
TRST#: 4

--
TDI: N/A
TDO: 2
TCK: 1
TMS: 0
Device ID #5: 1011 1111111111111111 11111111111 1 (0xBFFFFFFF)
Device ID #6: 1010 1010101011111111 11111111111 1 (0xAAAFFFFF)
Device ID #7: 0101 0101010101010101 01010101010 1 (0x55555555)
Device ID #9: 0101 0101010101010101 01010101010 1 (0x55555555)
Device ID #11: 0101 0101010101010101 01010101010 1 (0x55555555)
Device ID #13: 0101 0101010101010101 01010101010 1 (0x55555555)
Device ID #15: 0101 0101010101010101 01010101010 1 (0x55555555)
TRST#: 4
TRST#: 6

--
TDI: N/A
TDO: 2
TCK: 1
TMS: 4
Device ID #16: 1111 1111111111111111 11101111111 1 (0xFFFFFEFF)
TRST#: 3
TRST#: 5
---

TDI: N/A
TDO: 3
TCK: 4
TMS: 1
Device ID #1: 0000 1101011110000000 00100011011 1 (0x0D780237)
TRST#: 2
TRST#: 5
TRST#: 6
TRST#: 7
.
.
.

The JTAGulator list all potential JTAG pinouts. Via the device ID you can easily spot real JTAG interfaces. Device IDs are usually very distinct and "random", not like (0xFFEFFFFF), (0xBFFFFFFF) or (0x55555555). The last entry looks very promising (0x0D780237).

Then I started a '''BYPASS scan''' on that specific pin configuration to find out the TDI line.

JTAG> b
Enter starting channel [0]: 0
Enter ending channel [7]: 7
Are any pins already known? [Y/n]:
Enter X for any unknown pin.
Enter TDI pin [0]: x
Enter TDO pin [6]: 3
Enter TCK pin [5]: 4
Enter TMS pin [3]: 1
Possible permutations: 5

Bring channels LOW between each permutation? [Y/n]:
Enter length of time for channels to remain LOW (in ms, 1 - 1000) [10]:
Enter length of time after channels return HIGH before proceeding (in ms, 1 - 1
Press spacebar to begin (any other key to abort)...
JTAGulating! Press any key to abort...
-
TDI: 2
TDO: 3
TCK: 4
TMS: 1
TRST#: 5
TRST#: 6
Number of devices detected: 2
----
BYPASS scan complete.

Let's test the JTAG interface using the JTAG echo command. The JTAGulator will send a random string on the TDI line and will receive the same string on the TDO line if it is a valid JTAG device.

JTAG> t
Enter TDI pin [2]:
Enter TDO pin [3]:
Enter TCK pin [4]:
Enter TMS pin [1]:
Number of devices detected: 2
Pattern in to TDI: 10000110100110111110011010011000
Pattern out from TDO: 10000110100110111110011010011000
Match!

We found the JTAG pinout! :)

[[File:HTC JTAGpinout.jpg|500px]]

Which closely relates to the image found on the internet:

https://i.pinimg.com/474x/ef/f3/d3/eff3d3586a82da36bd20c8e4088cdc37--html.jpg

* RTCK
* TMS
* TDI
* TDO
* TCK
* TRST
* RST

== Used Hardware ==

[[JTAGulator]]

[[Category:Documentation]]

Bus Pirate: OpenOCD

2020-01-30T09:47:02Z

Jostrowski: typo

== Summary ==

Open On-Chip Debugger (OpenOCD) software was created by Dominic Rath at the University of Applied Sciences Augsburg. The goal of this software is to provide debugging tools for a lot of different debugging adapters and platforms. It has a scripting language that allows creating configuration files for e.g. custom JTAG adapters or target platform.

This tutorial is an updated version to [https://research.kudelskisecurity.com/2014/05/01/jtag-debugging-made-easy-with-bus-pirate-and-openocd/]

== Requirements ==

* OS: Linux

'''In order to complete these steps, you must have followed [[Bus Pirate: First steps]] before.'''

In order to use OpenOCD on the Bus Pirate you need a firmware version of '''6+'''

== Installation ==

; Download OpenOCD:
: <code>git clone https://github.com/arduino/OpenOCD.git</code>
: Install dependencies for the OpenOCD build:
:: <code>sudo apt-get install autotools-dev</code>
:: <code>sudo apt-get install automake</code>
; Compile code
: <code>cd OpenOCD</code>
: <code>./bootsrap</code>
: <code>./configure --enable-maintainer-mode --disable-werror --enable-buspirate</code>
: <code>make</code>
: <code>sudo make install</code>
; Configure OpenOCD's buspirate.cfg
: <code>nano tcl/interface/buspirate.cfg</code>

#
# Buspirate with OpenOCD support
#
# http://dangerousprototypes.com/bus-pirate-manual/
#
interface buspirate
# you need to specify port on which BP lives
buspirate_port /dev/ttyUSB0 (select the correct PORT!!!)
# communication speed setting
buspirate_speed normal ;# or fast
# voltage regulator Enabled = 1 Disabled = 0
buspirate_vreg 0
# pin mode normal or open-drain
buspirate_mode open-drain
# pullup state Enabled = 1 Disabled = 0
buspirate_pullup 1
# this depends on the cable, you are safe with this option
reset_config srst_only

; Connect Bus Pirate and OpenOCD
: Connect the Bus Pirate to the computer
: Start OpenOCD
: <code>cd OpenOCD</code>
: <code>sudo openocd -f tcl/interface/buspirate.cfg</code>
: (Errors might appear)

$ sudo openocd -f tcl/interface/buspirate.cfg
Open On-Chip Debugger 0.10.0-rc1-dev-gc404ff5d-dirty (2019-11-11-15:43)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Warn : Adapter driver 'buspirate' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
srst_only separate srst_gates_jtag srst_open_drain connect_deassert_srst
Info : Buspirate Interface ready!
Info : This adapter doesn't support configurable speed
Warn : There are no enabled taps. AUTO PROBING MIGHT NOT WORK!!
Error: JTAG scan chain interrogation failed: all ones
Error: Check JTAG interface, timings, target power, etc.
Error: Trying to use configured scan chain anyway...
Warn : Bypassing JTAG setup events due to errors
Warn : gdb services need one or more targets defined

; Start OpenOCD session
: Open a new terminal tab
: type: <code>telnet localhost 4444</code>
: The OpenOCD terminal should open
: Type <code>help</code> for all possible operations

== Used Hardware ==

[[Bus Pirate v3.6 Universal serial interface]]

== References ==

* https://research.kudelskisecurity.com/2014/05/01/jtag-debugging-made-easy-with-bus-pirate-and-openocd/
* https://github.com/arduino/OpenOCD

[[Category:Documentation]]

Proxmark3 RDV4

2020-01-30T09:44:20Z

Jostrowski:

== Summary ==

[[File:Prox no case size.jpg|thumb|500px|Proxmark3 RDV4]]

The Proxmark is an RFID swiss-army tool, allowing for both high and low-level interactions with the vast majority of RFID/NFC tags and systems worldwide (proxmark.com).

The Proxmark3 Dev Kit 4 (RDV4) is more compact and portable than the older versions and brings various improvements to the open-source design. Antennas are highly customizable and there is a new multifunction multiplexing interface to support additional components such as external battery, external active high powered antenna, Bluetooth interfaces and SIM/Smart card reader (hackerwarehouse.com).

This write-up concentrates on the improvements of the RDV4 over the RDV2 and will not cover the basic operations. For more, please visit [[Proxmark3: Useful commands]] or [[Proxmark3: FH-Campus Card NFC Security Valuation]]

== Requirements ==

* Proxmark3 RDV4

To use the Bluetooth module & for new features of the RDV4 use the new [https://github.com/RfidResearchGroup/proxmark3.git new repository]

Setting-up & compiling are explained in the [https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Installation_Instructions/Linux-Installation-Instructions.md original documentation]

For a quick introduction to the default commands please visit: [[Proxmark3: Useful commands]]

== Smart Card ==

Hidden under the lid of the Proxmark RDV4 you can find a smart card reader. You can directly insert a smartcard directly into to the slot or insert it into the optional smartcard extender, which allows for card size formats.

[[File:Prox smartcard.jpg|800px|Proxmark with the smartcard extender]]

For more information on reading and writing to smartcards please visit the follow-up post [[Proxmark3 RDV4: SmartCard]]

== Bluetooth Module ==

With the Blue-Shark Module it is now possible to wirelessly communicate with the Proxmark RDV4!

=== Installation ===

<div><ul>
<li style="display: inline-block;"> [[File:Prox open case.jpg|thumb|none|x300px|1. Remove the antenna cover and use the plastic prying tool to open the case.]] </li>
<li style="display: inline-block;"> [[File:Prox remove antenna.jpg|thumb|none|x300px|2. Remove the six screws of the antenna.]] </li>
<li style="display: inline-block;"> [[File:Prox bt cable.jpg|thumb|none|x300px|3. Connect the Bluetooth cable to the Proxmark by first opening the black hinge of the ribbon cable.]] </li>
<li style="display: inline-block;"> [[File:Prox bt cable2.jpg|thumb|none|x300px|4. Insert the ribbon cable into the connector and close the hinge again.]] </li>
<li style="display: inline-block;"> [[File:Prox bt.jpg|thumb|none|x300px|5. Remove the blue tape on the Bluetooth module.]] </li>
<li style="display: inline-block;"> [[File:Prox bt2.jpg|thumb|none|x300px|6. Push the module onto the Proxmark.]] </li>
<li style="display: inline-block;"> [[File:Prox bt3.jpg|thumb|none|x300px|7. Connect the antenna to the Proxmark and add the cover of the antenna.]]</li>
</ul></div>

To enable this feature you need to install the newest RfidResearchGroup/proxmark3 repo and enable the Bluetooth setting in the makefile: the instructions are based on [https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/bt_manual_v10.md Blue Shark Installation]

=== Linux installation ===

; Preperation
* Update system:
: <code>sudo apt-get update</code>
* Install requirements:
: <code>sudo apt-get install --no-install-recommends git ca-certificates build-essential pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev</code>
* On Linux you have to make shure you remove of disable the ModemManager (this is usally pre-installed to interact with (2G,3G,4G) devices.
* Remove ModemManager
: <code>sudo apt remove modemmanager</code>
* Download repostiory:
: <code>git clone https://github.com/RfidResearchGroup/proxmark3.git</code>
* cd into repo
: <code>cd proxmark3</code>
* Or update to the newest version:
: <code>git pull</code>
; Compile source code
* Enable Bluetooth module
: <code>cp Makefile.platform.sample Makefile.platform</code>
: <code>nano Makefile.platform</code>
: And uncomment the line <code>#PLATFORM_EXTRAS=BTADDON</code> by removing the <code>#</code> & save changes by pressing <code>ctrl+x</code>
* Compile source code
: <code>make clean; make -j8</code>
: <code>sudo make install</code>
* Add access rights
: <code>make accessrights</code>
: Now log off and log on again.
* Connect the Proxmark3 to the computer
* Flash the firmware
: <code>./pm3-flash-bootrom</code>
: <code>./pm3-flash-all</code>
; Connect wirelessly to the Proxmark
* Turn on the Bluetooth module (both switches to on)
* Find MAC address
sudo hcitool scan
Scanning ...
aa:bb:cc:dd:ee:ff PM3_RDV4.0
* Bind your BT add-on MAC address to a serial port
: <code>sudo rfcomm bind rfcomm0 aa:bb:cc:dd:ee:ff</code>
* If connecting the first time:
bluetoothctl
[bluetooth]# pairable on
[bluetooth]# scan on
Discovery started
...
[CHG] Device aa:bb:cc:dd:ee:ff Name: PM3_RDV4.0
[bluetooth]# trust aa:bb:cc:dd:ee:ff
[bluetooth]# pair aa:bb:cc:dd:ee:ff
[agent] Enter PIN code: 1234
[bluetooth]# quit
* Else, open the Proxmark client
: <code>proxmark3 /dev/rfcomm0</code>
: Now the Proxmark LED should stop blinking and turn solid blue. THe Proxmark client should show the default interface.

== Antennas ==

The Proxmark3 RDV4 optionally ships with high-frequency (hf) and low-frequency (lf) antenna kits. They include a medium and long-range antenna. The following will show the differences between them.

=== High-Frequecy Antenna Kit ===

The hf-antenna kit comes with two antennas that are advertised as medium- and long-range antennas. The store [https://lab401.com/products/proxmark-3-rdv4-long-range-hf-antenna-1 lab401] says the range of the default antenna is about 40-85mm, medium-range antenna about 90mm, and the long-range has a reach of 100-120mm. A small test of mine concludes that this statement is only partially true.

<div><ul>
<li style="display: inline-block;"> [[File:Prox hf normal.jpg|thumb|none|x300px|Default HF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox hf med.jpg|thumb|none|x300px|Medium-Range HF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox hf long.jpg|thumb|none|x300px|Long-Range HF-Antenna]] </li>
</ul></div>

I tested the range of 4 different cards:

* Card 1: HF-Card shipped with the RDV4: NXP MIFARE CLASSIC 1k Gen1A S50
* Card 2: Student-Card: NXP MIFARE DESFire 4k
* Card 3: Portugal, Proto MetroCard: Ultralight EV1 48bytes (MF0UL1101)
* Card 4: SkiData Card: EM-Marin SA (Skidata); EM4233

(!) denotes that the readings were inconsistent:
The card only got recognized from time to time
(!!) denotes that the readings were '''very''' inconsistent:
Only if lucky the card got recognized
/ denotes that the card got not read at all

{| class="wikitable"
|-
! scope="col" | Card
! scope="col" | Default-Antenna
! scope="col" | Medium-Range Antenna
! scope="col" | Long-Range Antenna
|-
! scope="row" | Shipped HF-Card
| 8 cm
| (!!) 0 cm
| (!!) 2 cm
|-
! scope="row" | Student-Card
| 5 cm
| (!) 0 cm
| (!) 7 cm
|-
! scope="row" | Metro-Card
| 8 cm
| /
| (!) 11 cm
|-
! scope="row" | SkiData-Card
| 7 cm
| 7 cm
| 11 cm
|}

The results show that the antenna reach depends heavily on the card trying to read. The most consistent results came from the default-antenna that ships with the RDV4. As shown, the optional antennas did cope with the NXP Mifare cards very poorly but show improvements for the SkiData card.

=== Low-Frequency Antenna Kit ===

Sadly I do not have any lf-cards on hand and could not test the range of the given antennas.

The lf-antenna kit comes with two antennas that are advertised as medium- and long-range antennas. The store [https://lab401.com/products/proxmark-3-rdv4-01-long-range-lf-antenna-pack lab401] says the range of the default antenna is about 66 - 72mm, medium-range antenna about 90mm, and the long-range has a reach of 110 - 133mm. But as shown above, for the hf-antenna this depends heavily on the lf-card itself.

<div><ul>
<li style="display: inline-block;"> [[File:Prox lf med.jpg|thumb|none|x300px|Medium-Range LF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox lf long.jpg|thumb|none|x300px|Long-Range LF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox lf switch.jpg|thumb|none|300px|LF-Antenna Switch]] </li>
</ul></div>

The optional antennas come with 2 switches: (source: [https://lab401.com/products/proxmark-3-rdv4-01-long-range-lf-antenna-pack lab401])

; Q-Switch
: The Q-Switch has two settings: 14 (Extended Range) and 7 (Extended Accuracy).
:: Q-Switch setting of 14 will give up to 30% further read range (on lf search / lf hid read etc commands).
:: Q-Switch setting of 7 will give better writing performance on T55XX and EM410XX tags.

; Frequency Switch
: The frequency switch allows for tuning to specific tag types: 125KHz or 134KHz.

== Used Hardware ==

[[Proxmark3 RDV4 Kit]]

[[Proxmark3 RDV4.0 BT & Battery Addon Blue Shark]]

[[Proxmark3 RDV4.0 HF Antennas]]

[[Proxmark3 RDV4.0 LF Antennas]]

== References ==

* https://www.proxmark.com
* https://www.hackerwarehouse.com
* https://www.lab401.com
* https://github.com/RfidResearchGroup/proxmark3

[[Category:Documentation]]

Proxmark3 RDV4

2020-01-30T09:43:38Z

Jostrowski:

== Summary ==

[[File:Prox no case size.jpg|thumb|500px|Proxmark3 RDV4]]

The Proxmark is an RFID swiss-army tool, allowing for both high and low-level interactions with the vast majority of RFID/NFC tags and systems worldwide (proxmark.com).

The Proxmark3 Dev Kit 4 (RDV4) is more compact and portable than the older versions and brings various improvements to the open-source design. Antennas are highly customizable and there is a new multifunction multiplexing interface to support additional components such as external battery, external active high powered antenna, Bluetooth interfaces and SIM/Smart card reader (hackerwarehouse.com).

This write-up concentrates on the improvements of the RDV4 over the RDV2 and will not cover the basic operations. For more, please visit [[Proxmark3: Useful commands]] or [[Proxmark3: FH-Campus Card NFC Security Valuation]]

== Requirements ==

* Proxmark3 RDV4

To use the Bluetooth module & for new features of the RDV4 use the new [https://github.com/RfidResearchGroup/proxmark3.git new repository]

Setting-up & compiling are explained in the [https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Installation_Instructions/Linux-Installation-Instructions.md original documentation]

For a quick introduction to the default commands please visit: [[Proxmark3: Useful commands]]

== Smart Card ==

Hidden under the lid of the Proxmark RDV4 you can find a smart card reader. You can directly insert a smartcard directly into to the slot or insert it into the optional smartcard extender, which allows for card size formats.

[[File:Prox smartcard.jpg|800px|Proxmark with the smartcard extender]]

For more information on reading and writing to smartcards please visit the follow-up post [[Creating Proxmark3 RDV4: SmartCard]]

== Bluetooth Module ==

With the Blue-Shark Module it is now possible to wirelessly communicate with the Proxmark RDV4!

=== Installation ===

<div><ul>
<li style="display: inline-block;"> [[File:Prox open case.jpg|thumb|none|x300px|1. Remove the antenna cover and use the plastic prying tool to open the case.]] </li>
<li style="display: inline-block;"> [[File:Prox remove antenna.jpg|thumb|none|x300px|2. Remove the six screws of the antenna.]] </li>
<li style="display: inline-block;"> [[File:Prox bt cable.jpg|thumb|none|x300px|3. Connect the Bluetooth cable to the Proxmark by first opening the black hinge of the ribbon cable.]] </li>
<li style="display: inline-block;"> [[File:Prox bt cable2.jpg|thumb|none|x300px|4. Insert the ribbon cable into the connector and close the hinge again.]] </li>
<li style="display: inline-block;"> [[File:Prox bt.jpg|thumb|none|x300px|5. Remove the blue tape on the Bluetooth module.]] </li>
<li style="display: inline-block;"> [[File:Prox bt2.jpg|thumb|none|x300px|6. Push the module onto the Proxmark.]] </li>
<li style="display: inline-block;"> [[File:Prox bt3.jpg|thumb|none|x300px|7. Connect the antenna to the Proxmark and add the cover of the antenna.]]</li>
</ul></div>

To enable this feature you need to install the newest RfidResearchGroup/proxmark3 repo and enable the Bluetooth setting in the makefile: the instructions are based on [https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/bt_manual_v10.md Blue Shark Installation]

=== Linux installation ===

; Preperation
* Update system:
: <code>sudo apt-get update</code>
* Install requirements:
: <code>sudo apt-get install --no-install-recommends git ca-certificates build-essential pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev</code>
* On Linux you have to make shure you remove of disable the ModemManager (this is usally pre-installed to interact with (2G,3G,4G) devices.
* Remove ModemManager
: <code>sudo apt remove modemmanager</code>
* Download repostiory:
: <code>git clone https://github.com/RfidResearchGroup/proxmark3.git</code>
* cd into repo
: <code>cd proxmark3</code>
* Or update to the newest version:
: <code>git pull</code>
; Compile source code
* Enable Bluetooth module
: <code>cp Makefile.platform.sample Makefile.platform</code>
: <code>nano Makefile.platform</code>
: And uncomment the line <code>#PLATFORM_EXTRAS=BTADDON</code> by removing the <code>#</code> & save changes by pressing <code>ctrl+x</code>
* Compile source code
: <code>make clean; make -j8</code>
: <code>sudo make install</code>
* Add access rights
: <code>make accessrights</code>
: Now log off and log on again.
* Connect the Proxmark3 to the computer
* Flash the firmware
: <code>./pm3-flash-bootrom</code>
: <code>./pm3-flash-all</code>
; Connect wirelessly to the Proxmark
* Turn on the Bluetooth module (both switches to on)
* Find MAC address
sudo hcitool scan
Scanning ...
aa:bb:cc:dd:ee:ff PM3_RDV4.0
* Bind your BT add-on MAC address to a serial port
: <code>sudo rfcomm bind rfcomm0 aa:bb:cc:dd:ee:ff</code>
* If connecting the first time:
bluetoothctl
[bluetooth]# pairable on
[bluetooth]# scan on
Discovery started
...
[CHG] Device aa:bb:cc:dd:ee:ff Name: PM3_RDV4.0
[bluetooth]# trust aa:bb:cc:dd:ee:ff
[bluetooth]# pair aa:bb:cc:dd:ee:ff
[agent] Enter PIN code: 1234
[bluetooth]# quit
* Else, open the Proxmark client
: <code>proxmark3 /dev/rfcomm0</code>
: Now the Proxmark LED should stop blinking and turn solid blue. THe Proxmark client should show the default interface.

== Antennas ==

The Proxmark3 RDV4 optionally ships with high-frequency (hf) and low-frequency (lf) antenna kits. They include a medium and long-range antenna. The following will show the differences between them.

=== High-Frequecy Antenna Kit ===

The hf-antenna kit comes with two antennas that are advertised as medium- and long-range antennas. The store [https://lab401.com/products/proxmark-3-rdv4-long-range-hf-antenna-1 lab401] says the range of the default antenna is about 40-85mm, medium-range antenna about 90mm, and the long-range has a reach of 100-120mm. A small test of mine concludes that this statement is only partially true.

<div><ul>
<li style="display: inline-block;"> [[File:Prox hf normal.jpg|thumb|none|x300px|Default HF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox hf med.jpg|thumb|none|x300px|Medium-Range HF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox hf long.jpg|thumb|none|x300px|Long-Range HF-Antenna]] </li>
</ul></div>

I tested the range of 4 different cards:

* Card 1: HF-Card shipped with the RDV4: NXP MIFARE CLASSIC 1k Gen1A S50
* Card 2: Student-Card: NXP MIFARE DESFire 4k
* Card 3: Portugal, Proto MetroCard: Ultralight EV1 48bytes (MF0UL1101)
* Card 4: SkiData Card: EM-Marin SA (Skidata); EM4233

(!) denotes that the readings were inconsistent:
The card only got recognized from time to time
(!!) denotes that the readings were '''very''' inconsistent:
Only if lucky the card got recognized
/ denotes that the card got not read at all

{| class="wikitable"
|-
! scope="col" | Card
! scope="col" | Default-Antenna
! scope="col" | Medium-Range Antenna
! scope="col" | Long-Range Antenna
|-
! scope="row" | Shipped HF-Card
| 8 cm
| (!!) 0 cm
| (!!) 2 cm
|-
! scope="row" | Student-Card
| 5 cm
| (!) 0 cm
| (!) 7 cm
|-
! scope="row" | Metro-Card
| 8 cm
| /
| (!) 11 cm
|-
! scope="row" | SkiData-Card
| 7 cm
| 7 cm
| 11 cm
|}

The results show that the antenna reach depends heavily on the card trying to read. The most consistent results came from the default-antenna that ships with the RDV4. As shown, the optional antennas did cope with the NXP Mifare cards very poorly but show improvements for the SkiData card.

=== Low-Frequency Antenna Kit ===

Sadly I do not have any lf-cards on hand and could not test the range of the given antennas.

The lf-antenna kit comes with two antennas that are advertised as medium- and long-range antennas. The store [https://lab401.com/products/proxmark-3-rdv4-01-long-range-lf-antenna-pack lab401] says the range of the default antenna is about 66 - 72mm, medium-range antenna about 90mm, and the long-range has a reach of 110 - 133mm. But as shown above, for the hf-antenna this depends heavily on the lf-card itself.

<div><ul>
<li style="display: inline-block;"> [[File:Prox lf med.jpg|thumb|none|x300px|Medium-Range LF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox lf long.jpg|thumb|none|x300px|Long-Range LF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox lf switch.jpg|thumb|none|300px|LF-Antenna Switch]] </li>
</ul></div>

The optional antennas come with 2 switches: (source: [https://lab401.com/products/proxmark-3-rdv4-01-long-range-lf-antenna-pack lab401])

; Q-Switch
: The Q-Switch has two settings: 14 (Extended Range) and 7 (Extended Accuracy).
:: Q-Switch setting of 14 will give up to 30% further read range (on lf search / lf hid read etc commands).
:: Q-Switch setting of 7 will give better writing performance on T55XX and EM410XX tags.

; Frequency Switch
: The frequency switch allows for tuning to specific tag types: 125KHz or 134KHz.

== Used Hardware ==

[[Proxmark3 RDV4 Kit]]

[[Proxmark3 RDV4.0 BT & Battery Addon Blue Shark]]

[[Proxmark3 RDV4.0 HF Antennas]]

[[Proxmark3 RDV4.0 LF Antennas]]

== References ==

* https://www.proxmark.com
* https://www.hackerwarehouse.com
* https://www.lab401.com
* https://github.com/RfidResearchGroup/proxmark3

[[Category:Documentation]]

Proxmark3 RDV4: SmartCard

2020-01-30T09:43:31Z

Jostrowski: Created page with "== Summary == The Proxmark3 RDV4 comes with a built-in smartcard reader allowing to read and send data to the smartcard. A smartcard is a small micro == Requirements == *..."

== Summary ==

The Proxmark3 RDV4 comes with a built-in smartcard reader allowing to read and send data to the smartcard. A smartcard is a small micro

== Requirements ==

* Proxmark3 RDV4
* Some Smartcards

== Description ==

== Used Hardware ==

[[Proxmark3 RDV4 Kit]]

== References ==

[[Category:Documentation]]

File:Prox smartcard.jpg

2020-01-30T09:34:38Z

Jostrowski:

Proxmark3: Useful commands

2020-01-29T22:49:54Z

Jostrowski:

== Summary ==

"NFC Hacking with Proxmark3" has been conducted during a school project, in which we analyzed the implementation of our NFC System. Which includes our on-campus cards, the printing system, snacks and drinks machines and the classroom doors. The additional output of this project was a (tested) guide on how to install the Proxmark3. For further details with regards to our project, concrete tests and more advanced commands please see our documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]].

In this thread we show a short overview of the different commands the proxmark3 environment has to offer.

== Requirements ==

Please see the [[Proxmark3: Installation]] guide for a full overview of requirements.
However, the Operating systems on which we tested the installation on are:
*Ubuntu 16.04/18.03
*Windows 10
*MacOS 10.x

In order to complete the "Introduction" described below, you have to complete the [[Proxmark3: Installation]] guide first.

These overview is based on the proxmark3 client, published on Github on the 29. May 2019

== Introduction ==

This introduction should only give you a glimpse of the available commands and possibilities of the Proxmark3. The official Proxmark3-Repository as well as the more advanced Ice-Man-Fork Repository (both linked in the reference section) provide lots of functions, though most of them are still in their alpha stage and therefore still need a bit of tinkering in order to work well. For further commands and our security analysis of our university feel free to have a look at our documentation!

=== The Commands ===

Connect via:
: Linux: <code>./client/proxmark3 /dev/ttyACM0</code>
: Windows <code>./client/proxmark3.exe COMx</code>

After you have successfully completed the Install Proxmark3 guide, you should see a screen similar to this when connecting to your proxmark3:

proxmark3>

You can always (in whichever menu you are) type 'help' in order to have a full list of available commands in that menu.
If you enter help in the start menu, you will get following output:
help This help. Use '<command> help' for details of a particular command.
data { Plot window / data buffer manipulation... }
hf { High Frequency commands... }
hw { Hardware commands... }
lf { Low Frequency commands... }
emv { EMV iso14443 and iso7816... }
sc { Smartcard commands... }
script { Scripting commands }
quit Exit program
exit Exit program

==== command: hw ====

"hw" stands for hardware and lists a bunch of commands to get basic hardware information of the Proxmark3.

detectreader ['l'|'h'] -- Detect external reader field (option 'l' or 'h' to limit to LF or HF)
fpgaoff Set FPGA off
lcd <HEX command> <count> -- Send command/data to LCD
lcdreset Hardware reset LCD
readmem [address] -- Read memory at decimal address from flash
reset Reset the Proxmark3
setlfdivisor <19 - 255> -- Drive LF antenna at 12Mhz/(divisor+1)
setmux <loraw|hiraw|lopkd|hipkd> -- Set the ADC mux to a specific value
tune ['l'|'h'] -- Measure antenna tuning (option 'l' or 'h' to limit to LF or HF)
version Show version information about the connected Proxmark
status Show runtime status information about the connected Proxmark
ping Test if the pm3 is responsive

We can check the version of the different builds of the Proxmark3 currently running on it:

proxmark3> hw version
Prox/RFID mark3 RFID instrument
bootrom: master/v3.1.0-94-gd38bb3a-dirty-suspect 2019-06-01 14:36:05
os: master/v3.1.0-94-gd38bb3a-dirty-suspect 2019-06-01 14:36:22
fpga_lf.bit built for 2s30vq100 on 2015/03/06 at 07:38:04
fpga_hf.bit built for 2s30vq100 on 2019/03/20 at 08:08:07

We can now check the antenna strength of the attached antennas. If you have borrowed the proxmark3 of the Elvis IoT Lab you will get following output:

(If no smart card is in proximity):

proxmark3> hw tune
Measuring antenna characteristics, please wait.........
# LF antenna: 43.86 V @ 125.00 kHz
# LF antenna: 21.04 V @ 134.00 kHz
# LF optimal: 44.14 V @ 123.71 kHz
# HF antenna: 30.41 V @ 13.56 MHz

If we now lay a NFC card on the antennas the voltages changes:

proxmark3> hw tune
Measuring antenna characteristics, please wait.........
# LF antenna: 44.27 V @ 125.00 kHz
# LF antenna: 21.04 V @ 134.00 kHz
# LF optimal: 44.27 V @ 123.71 kHz
# HF antenna: *19.39 V* @ 13.56 MHz

We can see, that the voltage of the HF antenna dropped from 30 volts to about 19 volts. We can assume that the placed NFC card is a high frequency card.

==== command: hf ====
"hf" stands for high frequency, which are specified at a carrier frequency of about 13.56 MHz.
Possible commands that can be issued are listed below:

proxmark3> hf
14a { ISO14443A RFIDs... }
14b { ISO14443B RFIDs... }
15 { ISO15693 RFIDs... }
epa { German Identification Card... }
legic { LEGIC RFIDs... }
iclass { ICLASS RFIDs... }
mf { MIFARE RFIDs... }
mfu { MIFARE Ultralight RFIDs... }
mfp { MIFARE Plus RFIDs... }
topaz { TOPAZ (NFC Type 1) RFIDs... }
fido { FIDO and FIDO2 authenticators... }
tune Continuously measure HF antenna tuning
list List protocol data in trace buffer
plot Plot signal
search Search for known HF tags [preliminary]
snoop <samples to skip (10000)> <triggers to skip (1)> Generic HF Snoop

Most of these command-options are for specific cards from specific manufacturers (e.g. legic, iclass, mf). On the other hand 14a is a NFC card standard that describes low level communication of smart cards. Not all follow the same standard and some implement proprietary protocols. The Mifare cards are built upon the 14a standard and have additional commands which can be found in their specific directory.

You usually start with the '''hf search''' command, which sends the card some data and analyses the return messages of the card. With this information the Proxmark3 can make assumptions on what kind of card it may be.

proxmark3> hf search
UID : 01 02 03 04
ATQA : 00 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1
proprietary non iso14443-4 card found, RATS not supported
Chinese magic backdoor commands (GEN 1a) detected
Prng detection: WEAK
Valid ISO14443A Tag Found - Quiting Search

Here we see that this card is classified as a Mifare Classic 1k. In particularly it also answers back to the Chinese magic backdoor command which tells us that this card is a fully cloneable card which allows us to change the UID block of the card. More on this can be found in the Documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]]

We can now issue the '''hf plot''' command which will display a waveform with the just sent and received data.

[[File:Waveform.PNG|frameless]]

Thankfully people wrote programs that will parse this data to a dedicated protocol ('''hf list'''). In this case we want to parse it as a Mifare classic communication with '''hf list mf'''.

proxmark3> hf list mf
Recorded Activity (TraceLen = 156 bytes)
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
iso14443a - All times are in carrier periods (1/13.56Mhz)
iClass - Timings are not as accurate
Start | End | Src | Data (! denotes parity error, ' denotes short bytes) | CRC | Annotation |
-----------|------------|-----|-----------------------------------------------------------------|-----|--------------------|
0 | 992 | Rdr | 40' | | MAGIC WUPC1
2484 | 3060 | Tag | 0a' | |
7040 | 8352 | Rdr | 43 | | MAGIC WUPC2
9524 | 10100 | Tag | 0a' | |
14080 | 18848 | Rdr | 50 00 57 cd | ok | HALT
0 | 992 | Rdr | 52' | | WUPA
2228 | 4596 | Tag | 04 00 | |
7040 | 9504 | Rdr | 93 20 | | ANTICOLL
10676 | 16564 | Tag | 01 02 03 04 04 | |
19328 | 29856 | Rdr | 93 70 01 02 03 04 04 8e 25 | ok | SELECT_UID
31028 | 34548 | Tag | 08 b6 dd | |
47488 | 52192 | Rdr | 60 00 f5 7b | ok | AUTH-A(0)
54196 | 58932 | Tag | 01 20 01 45 | | AUTH: nt

More on what is happening here can be found in the documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]]

There are many more commands. For example, '''hf data''' to manipulate the raw data, or '''hf mf''' to interact with Mifare Classic cards. Since this is only a short introduction to commands of the Proxmark3 we won't go deeper. If one is interested and wants to find out more about the Proxmark you we highly recommend the documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]] - where not only the essentials are covered, but also an in depth explanation about the technology used, the Proxmark itself, the Mifare Classic Standard and a validation of the FH-Campus card system.

It is definitely worth checking out the paper, since it also shows which vulnerabilities where found in the school card system.

== Used Hardware ==

[https://wiki.elvis.science/index.php?title=Proxmark_3 Proxmark3]

== Additional Documentation ==

* [[Proxmark3: Installation]]
* [[Proxmark3: FH-Campus Card NFC Security Valuation]]

== References ==

* https://github.com/Proxmark/proxmark3
* https://github.com/iceman1001/proxmark3

[[Category:Documentation]]

Proxmark3 RDV4

2020-01-28T22:18:21Z

Jostrowski:

== Summary ==

[[File:Prox no case size.jpg|thumb|500px|Proxmark3 RDV4]]

The Proxmark is an RFID swiss-army tool, allowing for both high and low-level interactions with the vast majority of RFID/NFC tags and systems worldwide (proxmark.com).

The Proxmark3 Dev Kit 4 (RDV4) is more compact and portable than the older versions and brings various improvements to the open-source design. Antennas are highly customizable and there is a new multifunction multiplexing interface to support additional components such as external battery, external active high powered antenna, Bluetooth interfaces and SIM/Smart card reader (hackerwarehouse.com).

This write-up concentrates on the improvements of the RDV4 over the RDV2 and will not cover the basic operations. For more, please visit [[Proxmark3: Useful commands]] or [[Proxmark3: FH-Campus Card NFC Security Valuation]]

== Requirements ==

* Proxmark3 RDV4

To use the Bluetooth module & for new features of the RDV4 use the new [https://github.com/RfidResearchGroup/proxmark3.git new repository]

Setting-up & compiling are explained in the [https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Installation_Instructions/Linux-Installation-Instructions.md original documentation]

For a quick introduction to the default commands please visit: [[Proxmark3: Useful commands]]

== Bluetooth Module ==

With the Blue-Shark Module it is now possible to wirelessly communicate with the Proxmark RDV4!

=== Installation ===

<div><ul>
<li style="display: inline-block;"> [[File:Prox open case.jpg|thumb|none|x300px|1. Remove the antenna cover and use the plastic prying tool to open the case.]] </li>
<li style="display: inline-block;"> [[File:Prox remove antenna.jpg|thumb|none|x300px|2. Remove the six screws of the antenna.]] </li>
<li style="display: inline-block;"> [[File:Prox bt cable.jpg|thumb|none|x300px|3. Connect the Bluetooth cable to the Proxmark by first opening the black hinge of the ribbon cable.]] </li>
<li style="display: inline-block;"> [[File:Prox bt cable2.jpg|thumb|none|x300px|4. Insert the ribbon cable into the connector and close the hinge again.]] </li>
<li style="display: inline-block;"> [[File:Prox bt.jpg|thumb|none|x300px|5. Remove the blue tape on the Bluetooth module.]] </li>
<li style="display: inline-block;"> [[File:Prox bt2.jpg|thumb|none|x300px|6. Push the module onto the Proxmark.]] </li>
<li style="display: inline-block;"> [[File:Prox bt3.jpg|thumb|none|x300px|7. Connect the antenna to the Proxmark and add the cover of the antenna.]]</li>
</ul></div>

To enable this feature you need to install the newest RfidResearchGroup/proxmark3 repo and enable the Bluetooth setting in the makefile: the instructions are based on [https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/bt_manual_v10.md Blue Shark Installation]

=== Linux installation ===

; Preperation
* Update system:
: <code>sudo apt-get update</code>
* Install requirements:
: <code>sudo apt-get install --no-install-recommends git ca-certificates build-essential pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev</code>
* On Linux you have to make shure you remove of disable the ModemManager (this is usally pre-installed to interact with (2G,3G,4G) devices.
* Remove ModemManager
: <code>sudo apt remove modemmanager</code>
* Download repostiory:
: <code>git clone https://github.com/RfidResearchGroup/proxmark3.git</code>
* cd into repo
: <code>cd proxmark3</code>
* Or update to the newest version:
: <code>git pull</code>
; Compile source code
* Enable Bluetooth module
: <code>cp Makefile.platform.sample Makefile.platform</code>
: <code>nano Makefile.platform</code>
: And uncomment the line <code>#PLATFORM_EXTRAS=BTADDON</code> by removing the <code>#</code> & save changes by pressing <code>ctrl+x</code>
* Compile source code
: <code>make clean; make -j8</code>
: <code>sudo make install</code>
* Add access rights
: <code>make accessrights</code>
: Now log off and log on again.
* Connect the Proxmark3 to the computer
* Flash the firmware
: <code>./pm3-flash-bootrom</code>
: <code>./pm3-flash-all</code>
; Connect wirelessly to the Proxmark
* Turn on the Bluetooth module (both switches to on)
* Find MAC address
sudo hcitool scan
Scanning ...
aa:bb:cc:dd:ee:ff PM3_RDV4.0
* Bind your BT add-on MAC address to a serial port
: <code>sudo rfcomm bind rfcomm0 aa:bb:cc:dd:ee:ff</code>
* If connecting the first time:
bluetoothctl
[bluetooth]# pairable on
[bluetooth]# scan on
Discovery started
...
[CHG] Device aa:bb:cc:dd:ee:ff Name: PM3_RDV4.0
[bluetooth]# trust aa:bb:cc:dd:ee:ff
[bluetooth]# pair aa:bb:cc:dd:ee:ff
[agent] Enter PIN code: 1234
[bluetooth]# quit
* Else, open the Proxmark client
: <code>proxmark3 /dev/rfcomm0</code>
: Now the Proxmark LED should stop blinking and turn solid blue. THe Proxmark client should show the default interface.

== Smart Card ==

== Antennas ==

The Proxmark3 RDV4 optionally ships with high-frequency (hf) and low-frequency (lf) antenna kits. They include a medium and long-range antenna. The following will show the differences between them.

=== High-Frequecy Antenna Kit ===

The hf-antenna kit comes with two antennas that are advertised as medium- and long-range antennas. The store [https://lab401.com/products/proxmark-3-rdv4-long-range-hf-antenna-1 lab401] says the range of the default antenna is about 40-85mm, medium-range antenna about 90mm, and the long-range has a reach of 100-120mm. A small test of mine concludes that this statement is only partially true.

<div><ul>
<li style="display: inline-block;"> [[File:Prox hf normal.jpg|thumb|none|x300px|Default HF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox hf med.jpg|thumb|none|x300px|Medium-Range HF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox hf long.jpg|thumb|none|x300px|Long-Range HF-Antenna]] </li>
</ul></div>

I tested the range of 4 different cards:

* Card 1: HF-Card shipped with the RDV4: NXP MIFARE CLASSIC 1k Gen1A S50
* Card 2: Student-Card: NXP MIFARE DESFire 4k
* Card 3: Portugal, Proto MetroCard: Ultralight EV1 48bytes (MF0UL1101)
* Card 4: SkiData Card: EM-Marin SA (Skidata); EM4233

(!) denotes that the readings were inconsistent:
The card only got recognized from time to time
(!!) denotes that the readings were '''very''' inconsistent:
Only if lucky the card got recognized
/ denotes that the card got not read at all

{| class="wikitable"
|-
! scope="col" | Card
! scope="col" | Default-Antenna
! scope="col" | Medium-Range Antenna
! scope="col" | Long-Range Antenna
|-
! scope="row" | Shipped HF-Card
| 8 cm
| (!!) 0 cm
| (!!) 2 cm
|-
! scope="row" | Student-Card
| 5 cm
| (!) 0 cm
| (!) 7 cm
|-
! scope="row" | Metro-Card
| 8 cm
| /
| (!) 11 cm
|-
! scope="row" | SkiData-Card
| 7 cm
| 7 cm
| 11 cm
|}

The results show that the antenna reach depends heavily on the card trying to read. The most consistent results came from the default-antenna that ships with the RDV4. As shown, the optional antennas did cope with the NXP Mifare cards very poorly but show improvements for the SkiData card.

=== Low-Frequency Antenna Kit ===

Sadly I do not have any lf-cards on hand and could not test the range of the given antennas.

The lf-antenna kit comes with two antennas that are advertised as medium- and long-range antennas. The store [https://lab401.com/products/proxmark-3-rdv4-01-long-range-lf-antenna-pack lab401] says the range of the default antenna is about 66 - 72mm, medium-range antenna about 90mm, and the long-range has a reach of 110 - 133mm. But as shown above, for the hf-antenna this depends heavily on the lf-card itself.

<div><ul>
<li style="display: inline-block;"> [[File:Prox lf med.jpg|thumb|none|x300px|Medium-Range LF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox lf long.jpg|thumb|none|x300px|Long-Range LF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox lf switch.jpg|thumb|none|300px|LF-Antenna Switch]] </li>
</ul></div>

The optional antennas come with 2 switches: (source: [https://lab401.com/products/proxmark-3-rdv4-01-long-range-lf-antenna-pack lab401])

; Q-Switch
: The Q-Switch has two settings: 14 (Extended Range) and 7 (Extended Accuracy).
:: Q-Switch setting of 14 will give up to 30% further read range (on lf search / lf hid read etc commands).
:: Q-Switch setting of 7 will give better writing performance on T55XX and EM410XX tags.

; Frequency Switch
: The frequency switch allows for tuning to specific tag types: 125KHz or 134KHz.

== Used Hardware ==

[[Proxmark3 RDV4 Kit]]

[[Proxmark3 RDV4.0 BT & Battery Addon Blue Shark]]

[[Proxmark3 RDV4.0 HF Antennas]]

[[Proxmark3 RDV4.0 LF Antennas]]

== Courses ==

== References ==

* https://www.proxmark.com
* https://www.hackerwarehouse.com
* https://www.lab401.com
* https://github.com/RfidResearchGroup/proxmark3

[[Category:Documentation]]

Proxmark3 RDV4

2020-01-28T22:13:30Z

Jostrowski:

== Summary ==

[[File:Prox no case size.jpg|thumb|500px|Proxmark3 RDV4]]

The Proxmark is an RFID swiss-army tool, allowing for both high and low-level interactions with the vast majority of RFID/NFC tags and systems worldwide (proxmark.com).

The Proxmark3 Dev Kit 4 (RDV4) is more compact and portable than the older versions and brings various improvements to the open-source design. Antennas are highly customizable and there is a new multifunction multiplexing interface to support additional components such as external battery, external active high powered antenna, Bluetooth interfaces and SIM/Smart card reader (hackerwarehouse.com).

This write-up concentrates on the improvements of the RDV4 over the RDV2 and will not cover the basic operations. For more, please visit [[Proxmark3: Useful commands]] or [[Proxmark3: FH-Campus Card NFC Security Valuation]]

== Requirements ==

* Proxmark3 RDV4

To use the Bluetooth module & for new features of the RDV4 use the new [https://github.com/RfidResearchGroup/proxmark3.git new repository]

Setting-up & compiling are explained in the [https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Installation_Instructions/Linux-Installation-Instructions.md original documentation]

For a quick introduction to the default commands please visit: [[Proxmark3: Useful commands]]

== Bluetooth Module ==

With the Blue-Shark Module it is now possible to wirelessly communicate with the Proxmark RDV4!

=== Installation ===

<div><ul>
<li style="display: inline-block;"> [[File:Prox open case.jpg|thumb|none|x300px|1. Remove the antenna cover and use the plastic prying tool to open the case.]] </li>
<li style="display: inline-block;"> [[File:Prox remove antenna.jpg|thumb|none|x300px|2. Remove the six screws of the antenna.]] </li>
<li style="display: inline-block;"> [[File:Prox bt cable.jpg|thumb|none|x300px|3. Connect the Bluetooth cable to the Proxmark by first opening the black hinge of the ribbon cable.]] </li>
<li style="display: inline-block;"> [[File:Prox bt cable2.jpg|thumb|none|x300px|4. Insert the ribbon cable into the connector and close the hinge again.]] </li>
<li style="display: inline-block;"> [[File:Prox bt.jpg|thumb|none|x300px|5. Remove the blue tape on the Bluetooth module.]] </li>
<li style="display: inline-block;"> [[File:Prox bt2.jpg|thumb|none|x300px|6. Push the module onto the Proxmark.]] </li>
<li style="display: inline-block;"> [[File:Prox bt3.jpg|thumb|none|x300px|7. Connect the antenna to the Proxmark and add the cover of the antenna.]]</li>
</ul></div>

To enable this feature you need to install the newest RfidResearchGroup/proxmark3 repo and enable the Bluetooth setting in the makefile: the instructions are based on [https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/bt_manual_v10.md Blue Shark Installation]

=== Linux installation ===

; Preperation
* Update system:
: <code>sudo apt-get update</code>
* Install requirements:
: <code>sudo apt-get install --no-install-recommends git ca-certificates build-essential pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev</code>
* On Linux you have to make shure you remove of disable the ModemManager (this is usally pre-installed to interact with (2G,3G,4G) devices.
* Remove ModemManager
: <code>sudo apt remove modemmanager</code>
* Download repostiory:
: <code>git clone https://github.com/RfidResearchGroup/proxmark3.git</code>
* cd into repo
: <code>cd proxmark3</code>
* Or update to the newest version:
: <code>git pull</code>
; Compile source code
* Enable Bluetooth module
: <code>cp Makefile.platform.sample Makefile.platform</code>
: <code>nano Makefile.platform</code>
: And uncomment the line <code>#PLATFORM_EXTRAS=BTADDON</code> by removing the <code>#</code> & save changes by pressing <code>ctrl+x</code>
* Compile source code
: <code>make clean; make -j8</code>
: <code>sudo make install</code>
* Add access rights
: <code>make accessrights</code>
: Now log off and log on again.
* Connect the Proxmark3 to the computer
* Flash the firmware
: <code>./pm3-flash-bootrom</code>
: <code>./pm3-flash-all</code>
; Connect wirelessly to the Proxmark
* Turn on the Bluetooth module (both switches to on)
* Find MAC address
sudo hcitool scan
Scanning ...
aa:bb:cc:dd:ee:ff PM3_RDV4.0
* Bind your BT add-on MAC address to a serial port
: <code>sudo rfcomm bind rfcomm0 aa:bb:cc:dd:ee:ff</code>
* If connecting the first time:
bluetoothctl
[bluetooth]# pairable on
[bluetooth]# scan on
Discovery started
...
[CHG] Device aa:bb:cc:dd:ee:ff Name: PM3_RDV4.0
[bluetooth]# trust aa:bb:cc:dd:ee:ff
[bluetooth]# pair aa:bb:cc:dd:ee:ff
[agent] Enter PIN code: 1234
[bluetooth]# quit
* Else, open the Proxmark client
: <code>proxmark3 /dev/rfcomm0</code>
: Now the Proxmark LED should stop blinking and turn solid blue. THe Proxmark client should show the default interface.

== Smart Card ==

== Antennas ==

The Proxmark3 RDV4 optionally ships with high-frequency (hf) and low-frequency (lf) antenna kits. They include a medium and long-range antenna. The following will show the differences between them.

=== High-Frequecy Antenna Kit ===

The hf-antenna kit comes with two antennas that are advertised as medium- and long-range antennas. The store [https://lab401.com/products/proxmark-3-rdv4-long-range-hf-antenna-1 lab401] says the range of the default antenna is about 40-85mm, medium-range antenna about 90mm, and the long-range has a reach of 100-120mm. A small test of mine concludes that this statement is only partially true.

<div><ul>
<li style="display: inline-block;"> [[File:Prox hf normal.jpg|thumb|none|x300px|Default HF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox hf med.jpg|thumb|none|x300px|Medium-Range HF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox hf long.jpg|thumb|none|x300px|Long-Range HF-Antenna]] </li>
</ul></div>

I tested the range of 4 different cards:

* Card 1: HF-Card shiped with the RDV4: NXP MIFARE CLASSIC 1k Gen1A S50
* Card 2: Student-Card: NXP MIFARE DESFire 4k
* Card 3: Portugal, Proto MetroCard: Ultralight EV1 48bytes (MF0UL1101)
* Card 4: SkiData Card: EM-Marin SA (Skidata); EM4233

(!) denotes that the readings were inconsistent:
The card only got recognized from time to time
(!!) denotes that the readings were '''very''' inconsistent:
Only if lucky the card got recognized
/ denotes that the card got not read at all

{| class="wikitable"
|-
! scope="col" | Card
! scope="col" | Default-Antenna
! scope="col" | Medium-Range Antenna
! scope="col" | Long-Range Antenna
|-
! scope="row" | Shipped HF-Card
| 8 cm
| (!!) 0 cm
| (!!) 2 cm
|-
! scope="row" | Student-Card
| 5 cm
| (!) 0 cm
| (!) 7 cm
|-
! scope="row" | Metro-Card
| 8 cm
| /
| (!) 11 cm
|-
! scope="row" | SkiData-Card
| 7 cm
| 7 cm
| 11 cm
|}

The results show that the antenna reach depends heavily on the card trying to read. The most consistent results came from the default-antenna that ships with the RDV4. As shown, the optional antennas did cope with the NXP Mifare cards very poorly but show improvements for the SkiData card.

=== Low-Frequency Antenna Kit ===

Sadly I do not have any lf-cards on hand and could not test the range of the given antennas.

The lf-antenna kit comes with two antennas that are advertised as medium- and long-range antennas. The store [https://lab401.com/products/proxmark-3-rdv4-01-long-range-lf-antenna-pack lab401] says the range of the default antenna is about 66 - 72mm, medium-range antenna about 90mm, and the long-range has a reach of 110 - 133mm. But as shown above for the hf-antenna this depends heavily on the lf-card itself.

<div><ul>
<li style="display: inline-block;"> [[File:Prox lf med.jpg|thumb|none|x300px|Medium-Range LF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox lf long.jpg|thumb|none|x300px|Long-Range LF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox lf switch.jpg|thumb|none|300px|LF-Antenna Switch]] </li>
</ul></div>

The optional antennas come with 2 switches: (source: [https://lab401.com/products/proxmark-3-rdv4-01-long-range-lf-antenna-pack lab401])

; Q-Switch
: The Q-Switch has two settings: 14 (Extended Range) and 7 (Extended Accuracy).
:: Q-Switch setting of 14 will give up to 30% further read range (on lf search / lf hid read etc commands).
:: Q-Switch setting of 7 will give better writing performance on T55XX and EM410XX tags.

; Frequency Switch
: The frequency switch allows for tuning to specific tag types: 125KHz or 134KHz.

== Used Hardware ==

[[Proxmark3 RDV4 Kit]]

[[Proxmark3 RDV4.0 BT & Battery Addon Blue Shark]]

[[Proxmark3 RDV4.0 HF Antennas]]

[[Proxmark3 RDV4.0 LF Antennas]]

== Courses ==

== References ==

* https://www.proxmark.com
* https://www.hackerwarehouse.com
* https://www.lab401.com
* https://github.com/RfidResearchGroup/proxmark3

[[Category:Documentation]]

File:Prox bt3.jpg

2020-01-28T21:37:55Z

Jostrowski:

File:Prox bt2.jpg

2020-01-28T21:36:35Z

Jostrowski:

File:Prox bt.jpg

2020-01-28T21:35:43Z

Jostrowski:

File:Prox bt cable2.jpg

2020-01-28T21:35:00Z

Jostrowski:

File:Prox bt cable.jpg

2020-01-28T21:34:09Z

Jostrowski:

File:Prox remove antenna.jpg

2020-01-28T21:33:31Z

Jostrowski:

File:Prox open case.jpg

2020-01-28T21:23:26Z

Jostrowski:

Proxmark3 RDV4

2020-01-28T21:05:59Z

Jostrowski: Antennas

File:Prox lf switch.jpg

2020-01-28T20:51:55Z

Jostrowski:

File:Prox lf long.jpg

2020-01-28T20:51:46Z

Jostrowski:

File:Prox lf med.jpg

2020-01-28T20:51:34Z

Jostrowski:

File:Prox hf long.jpg

2020-01-28T20:08:47Z

Jostrowski:

File:Prox hf med.jpg

2020-01-28T20:08:38Z

Jostrowski:

File:Prox hf normal.jpg

2020-01-28T20:08:01Z

Jostrowski:

File:Prox no case size.jpg

2020-01-28T20:02:44Z

Jostrowski:

Proxmark3 RDV4

2020-01-28T19:57:46Z

Jostrowski:

== Summary ==

The Proxmark is an RFID swiss-army tool, allowing for both high and low-level interactions with the vast majority of RFID/NFC tags and systems worldwide (proxmark.com).

The Proxmark3 Dev Kit 4 (RDV4) is more compact and portable than the older versions and brings various improvements to the open-source design. Antennas are highly customizable and there is a new multifunction multiplexing interface to support additional components such as external battery, external active high powered antenna, Bluetooth interfaces and SIM/Smart card reader (hackerwarehouse.com).

== Requirements ==

* Proxmark3 RDV4

To use the Bluetooth module & for new features of the RDV4 use the new [https://github.com/RfidResearchGroup/proxmark3.git new repository]

Setting-up & compiling are explained in the [https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Installation_Instructions/Linux-Installation-Instructions.md original documentation]

For a quick introduction to the default commands please visit: [[Proxmark3: Useful commands]]

== Bluetooth Module ==

With the Blue-Shark Module it is now possible to wirelessly communicate with the Proxmark RDV4!

To enable this feature you need to install the newest RfidResearchGroup/proxmark3 repo and enable the Bluetooth setting in the makefile: please follow the instructions at [https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/bt_manual_v10.md Blue Shark Installation]

== Smart Card

== Used Hardware ==

[[Proxmark3 RDV4 Kit]]

[[Proxmark3 RDV4.0 BT & Battery Addon Blue Shark]]

[[Proxmark3 RDV4.0 HF Antennas]]

[[Proxmark3 RDV4.0 LF Antennas]]

== Courses ==

== References ==

* proxmark.com
* hackerwarehouse.com

[[Category:Documentation]]

Proxmark3 RDV4

2020-01-27T21:49:58Z

Jostrowski:

== Summary ==

The Proxmark is an RFID swiss-army tool, allowing for both high and low level interactions with the vast majority of RFID/NFC tags and systems world-wide (proxmark.com).

The Proxmark3 Dev Kit 4 (RDV4) is more compact and portable than the older versions and brings various improvements to the open source design. Antennas are highly customizable and there is a new multifunction multiplexing interface to support additional components such as external battery, external active high powered antenna, bluetooth interfaces and SIM/Smart card reader (hackerwarehouse.com).

== Requirements ==

* Proxmark3 RDV4

To use the bluetooth module & for new features of the RDV4 use the new [https://github.com/RfidResearchGroup/proxmark3.git new repository]

Setting-up & compiling are explained in the [https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Installation_Instructions/Linux-Installation-Instructions.md original documentation]

For a quick introduction to the default commands please visit: [[Proxmark3: Useful commands]]

== Bluetooth Module ==

With the Blue-Shark Module it is now possible to wirelessly communicate with the Proxmark RDV4!

To enable this feature you need to install the newest RfidResearchGroup/proxmark3 repo and enable the bluetooth setting in the makefile: please follow the instructions at [https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/bt_manual_v10.md Blue Shark Installation]

== Used Hardware ==

[[Proxmark3 RDV4 Kit]]

[[Proxmark3 RDV4.0 BT & Battery Addon Blue Shark]]

[[Proxmark3 RDV4.0 HF Antennas]]

[[Proxmark3 RDV4.0 LF Antennas]]

== Courses ==

== References ==

* proxmark.com
* hackerwarehouse.com

[[Category:Documentation]]

Proxmark3: Installation

2020-01-27T20:44:50Z

Jostrowski:

== Summary ==

Installation of [[Proxmark3 RDV2 Kit|Proxmark3]] on macOS, Linux and Windows for RFID and NFC sniffing.

<pre style="color: red">
To use the Bluetooth Module of the Proxmark3 RDV4 you need to install the https://github.com/RfidResearchGroup/proxmark3.git repository

For installing on Linux please visit https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Installation_Instructions/Linux-Installation-Instructions.md
</pre>

== MacOS installation ==

=== Requirements ===

Xcode (AppStore) is a must.

In addition to make the installation easier have either HomeBrew or MacPorts ready.
A Tutorial for installing:
A) HomeBrew: https://docs.brew.sh/Installation
B) MacPorts: https://www.macports.org/install.php

Because of their different architecture (HomeBrew/MacPorts), some parts of this tutorial are split into:
A) Installation with HomeBrew
B) Installation with MacPorts
Just choose the tutorial that suits your current setup.

=== Installation with HomeBrew ===

1. Download ("tap") the proxmark repository:

brew tap proxmark/proxmark3

2. Install proxmark3:

brew install proxmark3

=== Manual Installation ===

Download the drivers and install them.
If you have MacPorts:

sudo port install p7zip readline libusb libusb-compat perl5 wget qt5\\ arm-none-eabi-gcc pkgconfig

If you have HomeBrew:

brew tap nitsky/stm32
brew install readline libusb p7zip libusb-compat wget qt5 pkgconfig\\ arm-none-eabi-gcc

Now you will need to add QT to the PKG_CONFIG_PATH so it find QT5 (replace YOUR_VERSION with your version number:

export\\ PKG_CONFIG_PATH=/usr/local/Cellar/qt5/<<YOUR_VERSION>>/lib/pkgconfig/

3. And add moc_location in Qt5Core.pc file:

export QT_PKG_CONFIG_QT5CORE=$(find /usr -name Qt5Core.pc 2>/dev/null)
chmod 666 $QT_PKG_CONFIG_QT5CORE
echo "moc_location=\${prefix}/bin/moc" >> $QT_PKG_CONFIG_QT5CORE
chmod 444 $QT_PKG_CONFIG_QT5CORE

4. For link creation to avoid any errors of "readline" (may happen):

brew link --force readline

5. Now either git clone or manually download the Proxmark project. Git clone:

git clone https://github.com/Proxmark/proxmark3.git

6. "cd" to the proxmark3 folder

7. Now jump to the section "Connecting your Proxmark"

=== Connecting your Proxmark ===

1. Insert your Proxmark and run

system_profiler SPUSBDataType

2.a) If your Proxmark is CDC you should somewhere see in the output:

Product ID: 0x504d
Vendor ID: 0x2d2d

2.b) If your Proxmark is an HID device you should see:

Product ID: 0x4b8f
Vendor ID: 0x9ac4

If it is an HID Device you will need to upgrade it, then go to "Upgrading my Proxmark HID->CDC"
If you have an CDC Proxmark you can jump to "Finish Line"

=== Upgrading my Proxmark HID->CDC ===

1. Compile the bootrom, OS and software:

make clean; make

2. Also compile the HID compatible flash program:

cd client/hid-flasher;make

3. Disconnect Apple's HID driver, by installing a dummy kernel driver:

sudo make install_kext
sudo kextcache -system-caches

4. Keep the Proxmark button pressed while reconnecting it to USB. Its yellow and red lights should light up (you can release the button after 5-ish seconds).

5. Now upgrade the bootrom:

./flasher -b ../../bootrom/obj/bootrom.elf

6. cd ../..

7. Disconnect your proxmark and keep the button pressed while reconnecting to USB.

8. While keeping the button pressed run to get the device name:

ls /dev/cu*

You should find a name like "/dev/cu.usbmodem####" (#### represents a number).

9. While still KEEPING PRESSED the button update the FPGA and its OS:

./client/flasher /dev/cu.usbmodem#### armsrc/obj/fullimage.elf

10. Disconnect the proxmark and release the button.

11. Now reconnect your proxmark to USB and run it:

cd proxmark3/client
./proxmark3 /dev/cu.usbmodem####

No need to go to "Finish Line", you are already finished with setting up the Proxmark Environment

=== Finish Line ===

1. Compile the bootrom and OS:

make clean; make

2. Disconnect your Proxmark from USB. Then keep the button pressed while reconnecting it back to USB. You can release the button when you see yellow/orange and red lights on your proxmark. (If you have an Elechouse v2 Proxmark3 or Elechouse v3 Proxmark3 Easy you do not need to press the button)

3. Figure out your device name:

ls /dev/cu*

It should be something with /dev/cu.usbmodem#### (#### represents a number).

4. After you have found your device run the program:

cd proxmark3/client
./proxmark3 /dev/cu.usbmodem####

== Linux installation ==

=== Requirements ===

* Operating system: Ubuntu 16.04 trusty amd64

=== Step 1 Compile resources:===

1. download and install some needed packages and libs

sudo apt-get install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev gcc-arm-none-eabi libstdc++-arm-none-eabi-newlib

2. clone proxmark3 git repository

git clone https://github.com/proxmark/proxmark3.git

3. enter repo

cd proxmark3

4. get newest version

git pull

5. Install the blacklist rules

sudo cp -rf driver/77-mm-usb-device-blacklist.rules /etc/udev/rules.d/77-mm-usb-device-blacklist.rules
sudo udevadm control --reload-rules

6. add current user to group

sudo adduser $USER dialout

7. log out and log into your account

8. compile proxmark3

make clean && make all

=== Step 2 Identify proxmark3 device ===

dmesg | grep -i usb
[ 9704.503904] usb 1-3: Manufacturer: proxmark.org
[ 9704.539638] cdc_acm 1-3:1.0: ttyACM0: USB ACM device

=== Step 3 Flash the firmware of the proxmark ===

!!! Do '''NOT''' press enter during the flashing process !!!

./client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf armsrc/obj/fullimage.elf

=== Step 4 Start the proxmark3 client ===

./client/proxmark3 /dev/ttyACM0

== Windows installation ==

=== Requirements ===
The tested Version for Windows was Windows 10, therefore the requirements for successfully completing our installation guide are:
* Windows 10
* [https://git-scm.com/download/win Git for Windows]

=== Installation ===
In order to be able to connect to your Proxmark3 under Windows you need to emulate a Linux environment which is done through a tool called ProxSpace.

1. First you need to download the download the ProxSpace Repository through git.

'''Caution!''' Your current working directory should contain no whitespaces!

git clone https://github.com/Gator96100/ProxSpace.git

2. Inside your ProxSpace Folder you should find "runme.bat". Start it.

3. This will create and install all necessary packets and folders. After you should see the pm3-console.

4. From this console you should change the directory to ProxSpace and download the Proxmark3 Repository:

git clone https://github.com/Proxmark/proxmark3.git

5. After this process is complete, cd to the proxmark3 directory:

cd proxmark3

6. Compile the proxmark3 project:

make clean && make all

7. Install the proxmark3 driver

==== Windows 10 ====
Since this driver is not officially signed by a trusted authority the installation is a bit tricky. You first have to start Windows in save-mode. This is done easiest, when pressing the shift-key while restarting your PC. On reboot you choose Startup-Settings followed by #7 Disable driver signature enforcement.
After the computer restarted you connect the proxmark3 and go to the device manager, right click on the non-identified device (which is the proxmark3) and go to the settings. Click on update driver and search locally for the proxmark3.inf. If you have trouble getting the proxmark3 driver to work, please visit this [[https://store.ryscc.com/blogs/news/how-to-install-a-proxmark3-driver-on-windows-10 picture-guided tutorial]]

After, the installation should be complete and you can safely restart your PC to normal mode again. From there start the runme.bat and the pm3-console should appear.

==== Windows 7 ====
[[File:Win7-disable-driversignature.png|520px|right]]

* Start command prompt (cmd.exe) as '''administrator''' and execute:

bcdedit.exe -set loadoptions DDISABLE_INTEGRITY_CHECKS
bcdedit.exe -set TESTSIGNING ON

* Open the device manager, right-click on the unknow device "proxmark3" and select "update"
* Select the manual driver selection, and within your ''ProxSpace'' folder select the ''msys2\proxmark3\driver'' subfolder

After the successful driver setup you may want to disable testsigning again, and restart windows

bcdedit.exe -set TESTSIGNING OFF

=== Update your Proxmark3 ===

To update the firmware of your Proxmark3 to the latest version, open cmd and type in (with x standing for the right number of your COM port, e.g. COM2):

./proxmark/client/flasher COMx -b /bootrom/obj/bootrom.elf
./proxmark/client/flasher COMX ./armsrc/obj/fullimage.elf

=== Connecting to your Proxmark3 ===

After having done all the steps above you can safely connect to your Proxmark3 through (where x again stands for the right number of your COM port, e.g. COM2):

./client/proxmark3.exe COMx

== Usage ==

For using the Proxmark3 please visit our second documentation [[Proxmark3: Useful commands]] and feel free to have a look at the [https://github.com/Proxmark/proxmark3 Proxmark Repository!]

== Resources and Tutorials ==

* Client commands: https://github.com/Proxmark/proxmark3/wiki/commands
* Usage example: https://www.youtube.com/watch?v=FODGYfhqb4Q
* Basic tutorial for RFID usage: https://blog.kchung.co/rfid-hacking-with-the-proxmark-3/
* Advanced tutorial: https://blog.kchung.co/rfid-hacking-with-the-proxmark-3/
* Capture NFC traffic of apple pay transaction: https://salmg.net/2017/12/29/analyzing-an-apple-pay-transaction-with-proxmark3/

== Used Hardware ==

[[Proxmark 3]]

== References ==
* Product page and infos: https://www.elechouse.com/elechouse/index.php?main_page=product_info&cPath=90_93&products_id=2264&zenid=kmvhiob7nq1orc4pfjtf53sbr7
* Manual: https://www.elechouse.com/elechouse/images/product/proxmark3_V2/Proxmark3%20V2%20User%20Guid.pdf
* MacOS 10.x client installation: https://github.com/Proxmark/proxmark3/wiki/MacOS
* Linux 16.04 client installation: https://github.com/Proxmark/proxmark3/wiki/Ubuntu-Linux
* Windows 10 client installation: https://github.com/Proxmark/proxmark3/wiki/Windows

[[Category:Documentation]]

Proxmark3: Installation

2020-01-27T19:09:28Z

Jostrowski:

== Summary ==

Installation of [[Proxmark3 RDV2 Kit|Proxmark3]] on macOS, Linux and Windows for RFID and NFC sniffing.

== MacOS installation ==

=== Requirements ===

Xcode (AppStore) is a must.

In addition to make the installation easier have either HomeBrew or MacPorts ready.
A Tutorial for installing:
A) HomeBrew: https://docs.brew.sh/Installation
B) MacPorts: https://www.macports.org/install.php

Because of their different architecture (HomeBrew/MacPorts), some parts of this tutorial are split into:
A) Installation with HomeBrew
B) Installation with MacPorts
Just choose the tutorial that suits your current setup.

=== Installation with HomeBrew ===

1. Download ("tap") the proxmark repository:

brew tap proxmark/proxmark3

2. Install proxmark3:

brew install proxmark3

=== Manual Installation ===

Download the drivers and install them.
If you have MacPorts:

sudo port install p7zip readline libusb libusb-compat perl5 wget qt5\\ arm-none-eabi-gcc pkgconfig

If you have HomeBrew:

brew tap nitsky/stm32
brew install readline libusb p7zip libusb-compat wget qt5 pkgconfig\\ arm-none-eabi-gcc

Now you will need to add QT to the PKG_CONFIG_PATH so it find QT5 (replace YOUR_VERSION with your version number:

export\\ PKG_CONFIG_PATH=/usr/local/Cellar/qt5/<<YOUR_VERSION>>/lib/pkgconfig/

3. And add moc_location in Qt5Core.pc file:

export QT_PKG_CONFIG_QT5CORE=$(find /usr -name Qt5Core.pc 2>/dev/null)
chmod 666 $QT_PKG_CONFIG_QT5CORE
echo "moc_location=\${prefix}/bin/moc" >> $QT_PKG_CONFIG_QT5CORE
chmod 444 $QT_PKG_CONFIG_QT5CORE

4. For link creation to avoid any errors of "readline" (may happen):

brew link --force readline

5. Now either git clone or manually download the Proxmark project. Git clone:

git clone https://github.com/Proxmark/proxmark3.git

6. "cd" to the proxmark3 folder

7. Now jump to the section "Connecting your Proxmark"

=== Connecting your Proxmark ===

1. Insert your Proxmark and run

system_profiler SPUSBDataType

2.a) If your Proxmark is CDC you should somewhere see in the output:

Product ID: 0x504d
Vendor ID: 0x2d2d

2.b) If your Proxmark is an HID device you should see:

Product ID: 0x4b8f
Vendor ID: 0x9ac4

If it is an HID Device you will need to upgrade it, then go to "Upgrading my Proxmark HID->CDC"
If you have an CDC Proxmark you can jump to "Finish Line"

=== Upgrading my Proxmark HID->CDC ===

1. Compile the bootrom, OS and software:

make clean; make

2. Also compile the HID compatible flash program:

cd client/hid-flasher;make

3. Disconnect Apple's HID driver, by installing a dummy kernel driver:

sudo make install_kext
sudo kextcache -system-caches

4. Keep the Proxmark button pressed while reconnecting it to USB. Its yellow and red lights should light up (you can release the button after 5-ish seconds).

5. Now upgrade the bootrom:

./flasher -b ../../bootrom/obj/bootrom.elf

6. cd ../..

7. Disconnect your proxmark and keep the button pressed while reconnecting to USB.

8. While keeping the button pressed run to get the device name:

ls /dev/cu*

You should find a name like "/dev/cu.usbmodem####" (#### represents a number).

9. While still KEEPING PRESSED the button update the FPGA and its OS:

./client/flasher /dev/cu.usbmodem#### armsrc/obj/fullimage.elf

10. Disconnect the proxmark and release the button.

11. Now reconnect your proxmark to USB and run it:

cd proxmark3/client
./proxmark3 /dev/cu.usbmodem####

No need to go to "Finish Line", you are already finished with setting up the Proxmark Environment

=== Finish Line ===

1. Compile the bootrom and OS:

make clean; make

2. Disconnect your Proxmark from USB. Then keep the button pressed while reconnecting it back to USB. You can release the button when you see yellow/orange and red lights on your proxmark. (If you have an Elechouse v2 Proxmark3 or Elechouse v3 Proxmark3 Easy you do not need to press the button)

3. Figure out your device name:

ls /dev/cu*

It should be something with /dev/cu.usbmodem#### (#### represents a number).

4. After you have found your device run the program:

cd proxmark3/client
./proxmark3 /dev/cu.usbmodem####

== Linux installation ==

=== Requirements ===

* Operating system: Ubuntu 16.04 trusty amd64

=== Step 1 Compile resources:===

1. download and install some needed packages and libs

sudo apt-get install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev gcc-arm-none-eabi libstdc++-arm-none-eabi-newlib

2. clone proxmark3 git repository

git clone https://github.com/proxmark/proxmark3.git

3. enter repo

cd proxmark3

4. get newest version

git pull

5. Install the blacklist rules

sudo cp -rf driver/77-mm-usb-device-blacklist.rules /etc/udev/rules.d/77-mm-usb-device-blacklist.rules
sudo udevadm control --reload-rules

6. add current user to group

sudo adduser $USER dialout

7. log out and log into your account

8. compile proxmark3

make clean && make all

=== Step 2 Identify proxmark3 device ===

dmesg | grep -i usb
[ 9704.503904] usb 1-3: Manufacturer: proxmark.org
[ 9704.539638] cdc_acm 1-3:1.0: ttyACM0: USB ACM device

=== Step 3 Flash the firmware of the proxmark ===

!!! Do '''NOT''' press enter during the flashing process !!!

./client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf armsrc/obj/fullimage.elf

=== Step 4 Start the proxmark3 client ===

./client/proxmark3 /dev/ttyACM0

== Windows installation ==

=== Requirements ===
The tested Version for Windows was Windows 10, therefore the requirements for successfully completing our installation guide are:
* Windows 10
* [https://git-scm.com/download/win Git for Windows]

=== Installation ===
In order to be able to connect to your Proxmark3 under Windows you need to emulate a Linux environment which is done through a tool called ProxSpace.

1. First you need to download the download the ProxSpace Repository through git.

'''Caution!''' Your current working directory should contain no whitespaces!

git clone https://github.com/Gator96100/ProxSpace.git

2. Inside your ProxSpace Folder you should find "runme.bat". Start it.

3. This will create and install all necessary packets and folders. After you should see the pm3-console.

4. From this console you should change the directory to ProxSpace and download the Proxmark3 Repository:

git clone https://github.com/Proxmark/proxmark3.git

5. After this process is complete, cd to the proxmark3 directory:

cd proxmark3

6. Compile the proxmark3 project:

make clean && make all

7. Install the proxmark3 driver

==== Windows 10 ====
Since this driver is not officially signed by a trusted authority the installation is a bit tricky. You first have to start Windows in save-mode. This is done easiest, when pressing the shift-key while restarting your PC. On reboot you choose Startup-Settings followed by #7 Disable driver signature enforcement.
After the computer restarted you connect the proxmark3 and go to the device manager, right click on the non-identified device (which is the proxmark3) and go to the settings. Click on update driver and search locally for the proxmark3.inf. If you have trouble getting the proxmark3 driver to work, please visit this [[https://store.ryscc.com/blogs/news/how-to-install-a-proxmark3-driver-on-windows-10 picture-guided tutorial]]

After, the installation should be complete and you can safely restart your PC to normal mode again. From there start the runme.bat and the pm3-console should appear.

==== Windows 7 ====
[[File:Win7-disable-driversignature.png|520px|right]]

* Start command prompt (cmd.exe) as '''administrator''' and execute:

bcdedit.exe -set loadoptions DDISABLE_INTEGRITY_CHECKS
bcdedit.exe -set TESTSIGNING ON

* Open the device manager, right-click on the unknow device "proxmark3" and select "update"
* Select the manual driver selection, and within your ''ProxSpace'' folder select the ''msys2\proxmark3\driver'' subfolder

After the successful driver setup you may want to disable testsigning again, and restart windows

bcdedit.exe -set TESTSIGNING OFF

=== Update your Proxmark3 ===

To update the firmware of your Proxmark3 to the latest version, open cmd and type in (with x standing for the right number of your COM port, e.g. COM2):

./proxmark/client/flasher COMx -b /bootrom/obj/bootrom.elf
./proxmark/client/flasher COMX ./armsrc/obj/fullimage.elf

=== Connecting to your Proxmark3 ===

After having done all the steps above you can safely connect to your Proxmark3 through (where x again stands for the right number of your COM port, e.g. COM2):

./client/proxmark3.exe COMx

== Usage ==

For using the Proxmark3 please visit our second documentation [[Proxmark3: Useful commands]] and feel free to have a look at the [https://github.com/Proxmark/proxmark3 Proxmark Repository!]

== Resources and Tutorials ==

* Client commands: https://github.com/Proxmark/proxmark3/wiki/commands
* Usage example: https://www.youtube.com/watch?v=FODGYfhqb4Q
* Basic tutorial for RFID usage: https://blog.kchung.co/rfid-hacking-with-the-proxmark-3/
* Advanced tutorial: https://blog.kchung.co/rfid-hacking-with-the-proxmark-3/
* Capture NFC traffic of apple pay transaction: https://salmg.net/2017/12/29/analyzing-an-apple-pay-transaction-with-proxmark3/

== Used Hardware ==

[[Proxmark 3]]

== References ==
* Product page and infos: https://www.elechouse.com/elechouse/index.php?main_page=product_info&cPath=90_93&products_id=2264&zenid=kmvhiob7nq1orc4pfjtf53sbr7
* Manual: https://www.elechouse.com/elechouse/images/product/proxmark3_V2/Proxmark3%20V2%20User%20Guid.pdf
* MacOS 10.x client installation: https://github.com/Proxmark/proxmark3/wiki/MacOS
* Linux 16.04 client installation: https://github.com/Proxmark/proxmark3/wiki/Ubuntu-Linux
* Windows 10 client installation: https://github.com/Proxmark/proxmark3/wiki/Windows

[[Category:Documentation]]

Proxmark3 RDV4

2020-01-27T12:57:13Z

Jostrowski:

== Summary ==

The Proxmark is an RFID swiss-army tool, allowing for both high and low level interactions with the vast majority of RFID/NFC tags and systems world-wide (proxmark.com).

The Proxmark3 Dev Kit 4 (RDV4) is more compact and portable than the older versions and brings various improvements to the open source design. Antennas are highly customizable and there is a new multifunction multiplexing interface to support additional components such as external battery, external active high powered antenna, bluetooth interfaces and SIM/Smart card reader (hackerwarehouse.com).

== Requirements ==

* Proxmark3 RDV4

In order to complete these steps, you must have updated the Proxmark3 RDV4 to the latest repository before. At the moment of writing the Proxmark3 RDV2 and RDV4 share the same repository and the same source code.

Therefore, follow [[Proxmark3: Installation]] to create a working proxmark environment.

For a quick introduction to the default commands please visit: [[Proxmark3: Useful commands]]

== Description ==

== Used Hardware ==

[[Proxmark3 RDV4 Kit]]

[[Proxmark3 RDV4.0 BT & Battery Addon Blue Shark]]

[[Proxmark3 RDV4.0 HF Antennas]]

[[Proxmark3 RDV4.0 LF Antennas]]

== Courses ==

== References ==

* proxmark.com
* hackerwarehouse.com

[[Category:Documentation]]

Proxmark3 RDV4

2020-01-27T12:39:34Z

Proxmark3: Useful commands

2019-12-12T19:33:00Z

Jostrowski:

== Authors ==

*Ostrowski, John
*Arseven, Can

== Summary ==

"NFC Hacking with Proxmark3" has been conducted during a school project, in which we analyzed the implementation of our NFC System. Which includes our on-campus cards, the printing system, snacks and drinks machines and the classroom doors. The additional output of this project was a (tested) guide on how to install the Proxmark3. For further details with regards to our project, concrete tests and more advanced commands please see our documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]].

In this thread we show a short overview of the different commands the proxmark3 environment has to offer.

== Requirements ==

Please see the [[Proxmark3: Installation]] guide for a full overview of requirements.
However, the Operating systems on which we tested the installation on are:
*Ubuntu 16.04/18.03
*Windows 10
*MacOS 10.x

In order to complete the "Introduction" described below, you have to complete the [[Proxmark3: Installation]] guide first.

These overview is based on the proxmark3 client, published on Github on the 29. May 2019

== Introduction ==

This introduction should only give you a glimpse of the available commands and possibilities of the Proxmark3. The official Proxmark3-Repository as well as the more advanced Ice-Man-Fork Repository (both linked in the reference section) provide lots of functions, though most of them are still in their alpha stage and therefore still need a bit of tinkering in order to work well. For further commands and our security analysis of our university feel free to have a look at our documentation!

=== The Commands ===

Connect via:
: Linux: <code>./client/proxmark3 /dev/ttyACM0</code>
: Windows <code>./client/proxmark3.exe COMx</code>

After you have successfully completed the Install Proxmark3 guide, you should see a screen similar to this when connecting to your proxmark3:

proxmark3>

You can always (in whichever menu you are) type 'help' in order to have a full list of available commands in that menu.
If you enter help in the start menu, you will get following output:
help This help. Use '<command> help' for details of a particular command.
data { Plot window / data buffer manipulation... }
hf { High Frequency commands... }
hw { Hardware commands... }
lf { Low Frequency commands... }
emv { EMV iso14443 and iso7816... }
sc { Smartcard commands... }
script { Scripting commands }
quit Exit program
exit Exit program

==== command: hw ====

"hw" stands for hardware and lists a bunch of commands to get basic hardware information of the Proxmark3.

detectreader ['l'|'h'] -- Detect external reader field (option 'l' or 'h' to limit to LF or HF)
fpgaoff Set FPGA off
lcd <HEX command> <count> -- Send command/data to LCD
lcdreset Hardware reset LCD
readmem [address] -- Read memory at decimal address from flash
reset Reset the Proxmark3
setlfdivisor <19 - 255> -- Drive LF antenna at 12Mhz/(divisor+1)
setmux <loraw|hiraw|lopkd|hipkd> -- Set the ADC mux to a specific value
tune ['l'|'h'] -- Measure antenna tuning (option 'l' or 'h' to limit to LF or HF)
version Show version information about the connected Proxmark
status Show runtime status information about the connected Proxmark
ping Test if the pm3 is responsive

We can check the version of the different builds of the Proxmark3 currently running on it:

proxmark3> hw version
Prox/RFID mark3 RFID instrument
bootrom: master/v3.1.0-94-gd38bb3a-dirty-suspect 2019-06-01 14:36:05
os: master/v3.1.0-94-gd38bb3a-dirty-suspect 2019-06-01 14:36:22
fpga_lf.bit built for 2s30vq100 on 2015/03/06 at 07:38:04
fpga_hf.bit built for 2s30vq100 on 2019/03/20 at 08:08:07

We can now check the antenna strength of the attached antennas. If you have borrowed the proxmark3 of the Elvis IoT Lab you will get following output:

(If no smart card is in proximity):

proxmark3> hw tune
Measuring antenna characteristics, please wait.........
# LF antenna: 43.86 V @ 125.00 kHz
# LF antenna: 21.04 V @ 134.00 kHz
# LF optimal: 44.14 V @ 123.71 kHz
# HF antenna: 30.41 V @ 13.56 MHz

If we now lay a NFC card on the antennas the voltages changes:

proxmark3> hw tune
Measuring antenna characteristics, please wait.........
# LF antenna: 44.27 V @ 125.00 kHz
# LF antenna: 21.04 V @ 134.00 kHz
# LF optimal: 44.27 V @ 123.71 kHz
# HF antenna: *19.39 V* @ 13.56 MHz

We can see, that the voltage of the HF antenna dropped from 30 volts to about 19 volts. We can assume that the placed NFC card is a high frequency card.

==== command: hf ====
"hf" stands for high frequency, which are specified at a carrier frequency of about 13.56 MHz.
Possible commands that can be issued are listed below:

proxmark3> hf
14a { ISO14443A RFIDs... }
14b { ISO14443B RFIDs... }
15 { ISO15693 RFIDs... }
epa { German Identification Card... }
legic { LEGIC RFIDs... }
iclass { ICLASS RFIDs... }
mf { MIFARE RFIDs... }
mfu { MIFARE Ultralight RFIDs... }
mfp { MIFARE Plus RFIDs... }
topaz { TOPAZ (NFC Type 1) RFIDs... }
fido { FIDO and FIDO2 authenticators... }
tune Continuously measure HF antenna tuning
list List protocol data in trace buffer
plot Plot signal
search Search for known HF tags [preliminary]
snoop <samples to skip (10000)> <triggers to skip (1)> Generic HF Snoop

Most of these command-options are for specific cards from specific manufacturers (e.g. legic, iclass, mf). On the other hand 14a is a NFC card standard that describes low level communication of smart cards. Not all follow the same standard and some implement proprietary protocols. The Mifare cards are built upon the 14a standard and have additional commands which can be found in their specific directory.

You usually start with the '''hf search''' command, which sends the card some data and analyses the return messages of the card. With this information the Proxmark3 can make assumptions on what kind of card it may be.

proxmark3> hf search
UID : 01 02 03 04
ATQA : 00 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1
proprietary non iso14443-4 card found, RATS not supported
Chinese magic backdoor commands (GEN 1a) detected
Prng detection: WEAK
Valid ISO14443A Tag Found - Quiting Search

Here we see that this card is classified as a Mifare Classic 1k. In particularly it also answers back to the Chinese magic backdoor command which tells us that this card is a fully cloneable card which allows us to change the UID block of the card. More on this can be found in the Documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]]

We can now issue the '''hf plot''' command which will display a waveform with the just sent and received data.

[[File:Waveform.PNG|frameless]]

Thankfully people wrote programs that will parse this data to a dedicated protocol ('''hf list'''). In this case we want to parse it as a Mifare classic communication with '''hf list mf'''.

proxmark3> hf list mf
Recorded Activity (TraceLen = 156 bytes)
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
iso14443a - All times are in carrier periods (1/13.56Mhz)
iClass - Timings are not as accurate
Start | End | Src | Data (! denotes parity error, ' denotes short bytes) | CRC | Annotation |
-----------|------------|-----|-----------------------------------------------------------------|-----|--------------------|
0 | 992 | Rdr | 40' | | MAGIC WUPC1
2484 | 3060 | Tag | 0a' | |
7040 | 8352 | Rdr | 43 | | MAGIC WUPC2
9524 | 10100 | Tag | 0a' | |
14080 | 18848 | Rdr | 50 00 57 cd | ok | HALT
0 | 992 | Rdr | 52' | | WUPA
2228 | 4596 | Tag | 04 00 | |
7040 | 9504 | Rdr | 93 20 | | ANTICOLL
10676 | 16564 | Tag | 01 02 03 04 04 | |
19328 | 29856 | Rdr | 93 70 01 02 03 04 04 8e 25 | ok | SELECT_UID
31028 | 34548 | Tag | 08 b6 dd | |
47488 | 52192 | Rdr | 60 00 f5 7b | ok | AUTH-A(0)
54196 | 58932 | Tag | 01 20 01 45 | | AUTH: nt

More on what is happening here can be found in the documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]]

There are many more commands. For example, '''hf data''' to manipulate the raw data, or '''hf mf''' to interact with Mifare Classic cards. Since this is only a short introduction to commands of the Proxmark3 we won't go deeper. If one is interested and wants to find out more about the Proxmark you we highly recommend the documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]] - where not only the essentials are covered, but also an in depth explanation about the technology used, the Proxmark itself, the Mifare Classic Standard and a validation of the FH-Campus card system.

It is definitely worth checking out the paper, since it also shows which vulnerabilities where found in the school card system.

== Used Hardware ==

[https://wiki.elvis.science/index.php?title=Proxmark_3 Proxmark3]

== Additional Documentation ==

* [[Proxmark3: Installation]]
* [[Proxmark3: FH-Campus Card NFC Security Valuation]]

== References ==

* https://github.com/Proxmark/proxmark3
* https://github.com/iceman1001/proxmark3

[[Category:Documentation]]

Proxmark3: Debricking

2019-12-12T19:17:07Z

Jostrowski:

== Summary ==

This tutorial will show how to reset a Proxmark3 RDV2 via the JTAG interface.

This is useful when the '''Proxmark3 RDV2''' is bricked and won't connect to the computer. This will solve any software failures like a corrupt firmware or bootloader.

'''1.''' Debricking process via '''Raspberry Pi''' 3+ (version 2, 3 and 4 work exactly the same)<br>
'''2.''' Debricking process via '''Bus Pirate''' 3.6
: Note: The method with the Bus Pirate did '''not work''' for me. Maybe you have better luck.

== Requirements ==

* Proxmark3
* Raspberry Pi 2, 3, or 4
* Bus Pirate v3 (or higher)
* Linux: Debian

== Raspberry Pi ==

[[File:Proxmark raspi.jpg|thumb|500px]]

; This tutorial is based on:
: http://www.lucasoldi.com/2017/01/17/unbrick-proxmark3-with-a-raspberry-pi-and-openocd/
: https://github.com/synthetos/PiOCD/wiki/Using-a-Raspberry-Pi-as-a-JTAG-Dongle
: http://openocd.org/doc/html/OpenOCD-Project-Setup.html

-----

=== Compile Proxmark ===

See [https://wiki.elvis.science/index.php?title=Proxmark3:_Installation Proxmark: Installation] or from the [https://github.com/Proxmark/proxmark3/wiki/Ubuntu-Linux official website]

=== Compile OpenOCD ===

<pre>
sudo apt-get update
sudo apt-get install -y autoconf libtool libftdi-dev textinfo pkg-config pkgconf git
git clone https://git.code.sf.net/p/openocd/code openocd
cd openocd
./bootstrap
./configure --enable-sysfsgpio --enable-bcm2835gpio
make
sudo make install
sudo cp -r tcl/ /usr/share/openocd
</pre>
<code>make</code> will take about 15 minutes.

=== Connect physically ===

Connect the following pins from the Raspberry Pi to the Proxmark3

: {| class="wikitable"
! Proxmark3
! Raspberry Pi
! Cable colour
|-
| TMS || 22 || yellow
|-
| TDI || 19 || blue
|-
| TDO || 21 || green
|-
| TCK || 23 || orange
|-
| GND || 6 || purple
|-
| 3.3V || 1 || grey
|}

For the pin layout of the Raspberry Pi see [https://www.theengineeringprojects.com/wp-content/uploads/2018/07/introduction-to-raspberry-pi-3-b-plus-2.png link].

[[File:Proxmark raspi pin.jpg|border|600px]]

The pin configuration can be changed in: <code>/usr/share/openocd/interface/raspberrypi2-native.cfg</code>. (Not necessary for this tutorial)

-----

=== Connect via OpenOCD ===

''Note: Power the Proxmark separately from the Raspberry Pi''

; 1. Start OpenOCD
: switch to the Proxmark folder
:: <code>cd proxmark3</code>
:: ''Note: the source code of the Proxmark should be already be complied.''
; 2. Create OpenOCD configuration
:: <code>nano tools/raspi.cfg</code>
:: Past following code into the file

<pre>
# Ports
telnet_port 4444
gdb_port 3333

# Interface
adapter_khz 1000
source [find interface/raspberrypi2-native.cfg]

# use combined on interfaces or targets that can't set TRST/SRST separately
reset_config srst_only srst_pulls_trst

jtag newtap sam7x cpu -irlen 4 -ircapture 0x1 -irmask 0xf

target create sam7x.cpu arm7tdmi -endian little -chain-position sam7x.cpu

sam7x.cpu configure -event reset-init {
soft_reset_halt
mww 0xfffffd00 0xa5000004 # RSTC_CR: Reset peripherals
mww 0xfffffd44 0x00008000 # WDT_MR: disable watchdog
mww 0xfffffd08 0xa5000001 # RSTC_MR enable user reset
mww 0xfffffc20 0x00005001 # CKGR_MOR : enable the main oscillator
sleep 10
mww 0xfffffc2c 0x000b1c02 # CKGR_PLLR: 16MHz * 12/2 = 96MHz
sleep 10
mww 0xfffffc30 0x00000007 # PMC_MCKR : MCK = PLL / 2 = 48 MHz
sleep 10
mww 0xffffff60 0x00480100 # MC_FMR: flash mode (FWS=1,FMCN=72)
sleep 100

}

gdb_memory_map enable
#gdb_breakpoint_override hard
#armv4_5 core_state arm

sam7x.cpu configure -work-area-virt 0 -work-area-phys 0x00200000 -work-area-size 0x10000 -work-area-backup 0
flash bank sam7x512.flash.0 at91sam7 0 0 0 0 sam7x.cpu 0 0 0 0 0 0 0 18432
flash bank sam7x512.flash.1 at91sam7 0 0 0 0 sam7x.cpu 1 0 0 0 0 0 0 18432
</pre>

; 3. Start OpenOCD with the configuration file just created
:: <code>sudo openocd -f tools/raspi.cfg</code>
:: Now a openOCD session is started. Do '''not''' close it.
; 4. Connect to OpenOCD session
: Open a new terminal window and telnet to the port that was specified in the .cfg file
:: <code>telnet localhost 4444</code>
; 5. Flash via JTAG

j@laptop:~/git/proxmark3$ telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>

; 6. Halt the Proxmark3
:: <code>halt</code>
; 7. Erase the flash content:
:: <code>flash erase_sector 0 0 15</code>
:: <code>flash erase_sector 1 0 15</code>
; 8. Flash the new firmware:
:: <code>flash write_image ./armsrc/obj/fullimage.elf</code>
:: <code>flash write_image ./bootrom/obj/bootrom.elf</code>

'''Done!'''

Disconnect the Raspberry Pi from the Proxmark

Now you should be able to connect to the Proxmark as usual:

<code>./client/proxmark3 /dev/ttyACM0</code>

For useful commands visit: [[Proxmark3: Useful commands]]

== Bus Pirate ==

''Note: Here the Bus Pirate 3.6 will be used''

''Note: This did not work for me, maybe it was faulty hardware or faulty firmware''

This tutorial is based on https://scund00r.com/all/rfid/2018/05/18/debrick-proxmark.html

; Update the Bus Pirate
: you can use following guide: [[Bus Pirate: First steps]]
; Get the latest Proxmark3 repository & build
: <code>git clone https://github.com/Proxmark/proxmark3.git</code>
: <code>cd proxmark3</code>
: install needed components:
: <code>sudo apt install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev gcc-arm-none-eabi libstdc++-arm-none-eabi-newlib libpcsclite-dev pcscd</code>
: <code> make clean && make all</code>
: Install proxmark3 driver:
:: <code>sudo cp -rf driver/77-mm-usb-device-blacklist.rules /etc/udev/rules.d/77-mm-usb-device-blacklist.rules</code>
:: <code>sudo udevadm control --reload-rules</code>
: Add user
:: <code>sudo adduser $USER dialout</code>
:: Now logout and login in again
; Install OpenOCD
: <code>sudo apt-get install openocd</code>
; Connect the Proxmark3 to the Bus Pirate
: use this pin configuration:
: {| class="wikitable"
! Proxmark3
! Bus Pirate
|-
| TMS || CS
|-
| TDI || MOSI
|-
| TDO || MISO
|-
| TCK || CLK
|-
| GND || GND
|-
| 3.3V || 3.3V
|}
; Flashing
: check on with Port the Bus Pirate is connected:
:: <code>ls /dev/tty*</code>
:: OR
:: <code>dmesg -wH</code> and plugout and connect the Bus Pirate again
: Set OpenOCD config
:: <code>nano tools/at91sam7s512-buspirate.cfg</code>
# Interface
interface buspirate
buspirate_port /dev/ttyUSB0
adapter_khz 1000
; Start OpenOCD
: Launch OpenOCD
:: <code>sudo openocd -f tools/at91sam7s512-buspirate.cfg</code>

:~/git/proxmark3$ sudo openocd -f tools/at91sam7s512-buspirate.cfg
[sudo] password for j:
Open On-Chip Debugger 0.10.0-rc1-dev-gc404ff5d-dirty (2019-11-11-15:43)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Warn : Adapter driver 'buspirate' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
adapter speed: 1 000 kHz
srst_only srst_p ulls_tr st srst_gates_jtag srst_open_drain connect_deassert_srst
Info : Buspirate Interf ace ready!
Info : This adap ter doe sn't suppo rt configurable speed
Info : JTAG tap: sam7x. cpu tap/de vice found: 0x3f0f0f0f (mfg: 0x787 (<unknown>), part: 0xf0f0, ver: 0x3 )
Info : Embedded ICE version 1
Info : sam7x.cpu: hardware has 2 breakpoint/watchpoint units
Info : accepting 'telnet' connection on tcp/4444

: Open a new terminal window
:: and type: <code>telnet localhost 4444</code>

j@laptop:~/git/proxmark3$ telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>

: Halt the Proxmark3
:: <code>halt</code>
: Erase the flash content:
:: <code>flash erase_sector 0 0 15</code>
:: <code>flash erase_sector 1 0 15</code>
: Flash the new firmware:
:: <code>flash write_image ./armsrc/obj/fullimage.elf</code>
:: This will take a while (about 6 minutes)
:: <code>flash write_image ./bootrom/obj/bootrom.elf</code>

== Used Hardware ==

[[Proxmark3 RDV2 Kit]]
[[Bus Pirate v3.6 Universal serial interface]]

== References ==

* https://scund00r.com/all/rfid/2018/05/18/debrick-proxmark.html

[[Category:Documentation]]

Proxmark3: Debricking

2019-12-12T19:03:08Z

Jostrowski:

== Summary ==

Description on how to debrick the Proxmark3 RDV2 if the bootloader or firmware is corrupted and there is no connection between the Proxmark3 and the computer.

Note: The method with the Bus Pirate did '''not work''' for me. Maybe you have better luck.

In the first part the debricking process for the Raspberry Pi 3+ (version 2, 3 and 4 work exactly the same) will be showcased. In the second part the same will be shown using a Bus Pirate.

== Requirements ==

* Proxmark3
* Raspberry Pi 2, 3, or 4
* Bus Pirate v3 (or higher)
* Linux: Debian

== Raspberry Pi ==

[[File:Proxmark raspi.jpg|thumb|500px]]

; This tutorial is based on:
: http://www.lucasoldi.com/2017/01/17/unbrick-proxmark3-with-a-raspberry-pi-and-openocd/
: https://github.com/synthetos/PiOCD/wiki/Using-a-Raspberry-Pi-as-a-JTAG-Dongle
: http://openocd.org/doc/html/OpenOCD-Project-Setup.html

-----

=== Compile Proxmark ===

See [https://wiki.elvis.science/index.php?title=Proxmark3:_Installation Proxmark: Installation] or from the [https://github.com/Proxmark/proxmark3/wiki/Ubuntu-Linux official website]

=== Compiling OpenOCD ===

<pre>
sudo apt-get update
sudo apt-get install -y autoconf libtool libftdi-dev textinfo pkg-config pkgconf git
git clone https://git.code.sf.net/p/openocd/code openocd
cd openocd
./bootstrap
./configure --enable-sysfsgpio --enable-bcm2835gpio
make
sudo make install
sudo cp -r tcl/ /usr/share/openocd
</pre>
<code>make</code> will take about 15 minutes.

=== Connect physically ===

Connect the following pins from the Raspberry Pi to the Proxmark3

: {| class="wikitable"
! Proxmark3
! Raspberry Pi
! Cable color
|-
| TMS || 22 || yellow
|-
| TDI || 19 || blue
|-
| TDO || 21 || green
|-
| TCK || 23 || orange
|-
| GND || 6 || purple
|-
| 3.3V || 1 || grey
|}

For the pin layout of the Raspberry Pi see [https://www.theengineeringprojects.com/wp-content/uploads/2018/07/introduction-to-raspberry-pi-3-b-plus-2.png link].

[[File:Proxmark raspi pin.jpg|border|600px]]

The pin configuration can be changed in: <code>/usr/share/openocd/interface/raspberrypi2-native.cfg</code>. (Not necessary for this tutorial)

-----

=== Connect via OpenOCD ===

''Note: Power the Proxmark desperately from the Raspberry Pi''

; 1. Start OpenOCD
: switch to the Proxmark folder
:: <code>cd proxmark3</code>
:: ''Note: the source code of the proxmark should be already be complied.''
; 2. Create OpenOCD configuration
:: <code>nano tools/raspi.cfg</code>
:: Past following code into the file

<pre>
# Ports
telnet_port 4444
gdb_port 3333

# Interface
adapter_khz 1000
source [find interface/raspberrypi2-native.cfg]

# use combined on interfaces or targets that can't set TRST/SRST separately
reset_config srst_only srst_pulls_trst

jtag newtap sam7x cpu -irlen 4 -ircapture 0x1 -irmask 0xf

target create sam7x.cpu arm7tdmi -endian little -chain-position sam7x.cpu

sam7x.cpu configure -event reset-init {
soft_reset_halt
mww 0xfffffd00 0xa5000004 # RSTC_CR: Reset peripherals
mww 0xfffffd44 0x00008000 # WDT_MR: disable watchdog
mww 0xfffffd08 0xa5000001 # RSTC_MR enable user reset
mww 0xfffffc20 0x00005001 # CKGR_MOR : enable the main oscillator
sleep 10
mww 0xfffffc2c 0x000b1c02 # CKGR_PLLR: 16MHz * 12/2 = 96MHz
sleep 10
mww 0xfffffc30 0x00000007 # PMC_MCKR : MCK = PLL / 2 = 48 MHz
sleep 10
mww 0xffffff60 0x00480100 # MC_FMR: flash mode (FWS=1,FMCN=72)
sleep 100

}

gdb_memory_map enable
#gdb_breakpoint_override hard
#armv4_5 core_state arm

sam7x.cpu configure -work-area-virt 0 -work-area-phys 0x00200000 -work-area-size 0x10000 -work-area-backup 0
flash bank sam7x512.flash.0 at91sam7 0 0 0 0 sam7x.cpu 0 0 0 0 0 0 0 18432
flash bank sam7x512.flash.1 at91sam7 0 0 0 0 sam7x.cpu 1 0 0 0 0 0 0 18432
</pre>

; 3. Start OpenOCD with the configuration file just created
:: <code>sudo openocd -f tools/raspi.cfg</code>
:: Now a openOCD session is started. Do '''not''' close it.
; 4. Connect to OpenOCD session
: Open a new terminal window and telnet to the port that was specified in the .cfg file
:: <code>telnet localhost 4444</code>
; 5. Flash via JTAG

j@laptop:~/git/proxmark3$ telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>

; 6. Halt the Proxmark3
:: <code>halt</code>
; 7. Erase the flash content:
:: <code>flash erase_sector 0 0 15</code>
:: <code>flash erase_sector 1 0 15</code>
; 8. Flash the new firmware:
:: <code>flash write_image ./armsrc/obj/fullimage.elf</code>
:: <code>flash write_image ./bootrom/obj/bootrom.elf</code>

'''Done!'''

Disconnect the Raspberry Pi from the Proxmark

Now you should be able to connect to the Proxmark as usual:

<code>./client/proxmark3 /dev/ttyACM0</code>

For useful commands visit: [[Proxmark3: Useful commands]]

== Bus Pirate ==

''Note: Here the Bus Pirate 3.6 will be used''

''Note: This did not work for me, maybe it was faulty hardware a faulty firmware''

This tutorial is based on https://scund00r.com/all/rfid/2018/05/18/debrick-proxmark.html

; Update the Bus Pirate
: you can use following guide: [[Bus Pirate: First steps]]
; Get the latest Proxmark3 repository & build
: <code>git clone https://github.com/Proxmark/proxmark3.git</code>
: <code>cd proxmark3</code>
: install needed components:
: <code>sudo apt install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev gcc-arm-none-eabi libstdc++-arm-none-eabi-newlib libpcsclite-dev pcscd</code>
: <code> make clean && make all</code>
: Install proxmark3 driver:
:: <code>sudo cp -rf driver/77-mm-usb-device-blacklist.rules /etc/udev/rules.d/77-mm-usb-device-blacklist.rules</code>
:: <code>sudo udevadm control --reload-rules</code>
: Add user
:: <code>sudo adduser $USER dialout</code>
:: Now logout and login in again
; Install OpenOCD
: <code>sudo apt-get install openocd</code>
; Connect the Proxmark3 to the Bus Pirate
: use this pin configuration:
: {| class="wikitable"
! Proxmark3
! Bus Pirate
|-
| TMS || CS
|-
| TDI || MOSI
|-
| TDO || MISO
|-
| TCK || CLK
|-
| GND || GND
|-
| 3.3V || 3.3V
|}
; Flashing
: check on with Port the Bus Pirate is connected:
:: <code>ls /dev/tty*</code>
:: OR
:: <code>dmesg -wH</code> and plugout and connect the Bus Pirate again
: Set OpenOCD config
:: <code>nano tools/at91sam7s512-buspirate.cfg</code>
# Interface
interface buspirate
buspirate_port /dev/ttyUSB0
adapter_khz 1000
; Start OpenOCD
: Launch OpenOCD
:: <code>sudo openocd -f tools/at91sam7s512-buspirate.cfg</code>

:~/git/proxmark3$ sudo openocd -f tools/at91sam7s512-buspirate.cfg
[sudo] password for j:
Open On-Chip Debugger 0.10.0-rc1-dev-gc404ff5d-dirty (2019-11-11-15:43)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Warn : Adapter driver 'buspirate' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
adapter speed: 1 000 kHz
srst_only srst_p ulls_tr st srst_gates_jtag srst_open_drain connect_deassert_srst
Info : Buspirate Interf ace ready!
Info : This adap ter doe sn't suppo rt configurable speed
Info : JTAG tap: sam7x. cpu tap/de vice found: 0x3f0f0f0f (mfg: 0x787 (<unknown>), part: 0xf0f0, ver: 0x3 )
Info : Embedded ICE version 1
Info : sam7x.cpu: hardware has 2 breakpoint/watchpoint units
Info : accepting 'telnet' connection on tcp/4444

: Open a new terminal window
:: and type: <code>telnet localhost 4444</code>

j@laptop:~/git/proxmark3$ telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>

: Halt the Proxmark3
:: <code>halt</code>
: Erase the flash content:
:: <code>flash erase_sector 0 0 15</code>
:: <code>flash erase_sector 1 0 15</code>
: Flash the new firmware:
:: <code>flash write_image ./armsrc/obj/fullimage.elf</code>
:: This will take a while (about 6 minutes)
:: <code>flash write_image ./bootrom/obj/bootrom.elf</code>

== Used Hardware ==

[[Proxmark3 RDV2 Kit]]
[[Bus Pirate v3.6 Universal serial interface]]

== References ==

* https://scund00r.com/all/rfid/2018/05/18/debrick-proxmark.html

[[Category:Documentation]]

Proxmark3: Debricking

2019-12-12T15:22:04Z

Jostrowski:

== Summary ==

Description on how to debrick the Proxmark3 RDV2 if the bootloader or firmware is corrupted and there is no connection between the Proxmark3 and the computer.

Note: The method with the Bus Pirate did '''not work''' for me. Maybe you have better luck.

In the first part the debricking process with an Raspberry Pi 3+ (version 2, 3 and 4 will work exactly the same) will be showcased. In the second part the same will be shown using a Bus Pirate.
using a Bus Pirate.

== Requirements ==

* Proxmark3
* Raspberry Pi 2, 3, or 4
* Bus Pirate v3 (or higher)
* Linux: Debian

== Raspberry Pi ==

[[File:Proxmark raspi.jpg|thumb|500px]]

; This tutorial is based on:
: http://www.lucasoldi.com/2017/01/17/unbrick-proxmark3-with-a-raspberry-pi-and-openocd/
: https://github.com/synthetos/PiOCD/wiki/Using-a-Raspberry-Pi-as-a-JTAG-Dongle
: http://openocd.org/doc/html/OpenOCD-Project-Setup.html

-----

=== Compile Proxmark ===

See [https://wiki.elvis.science/index.php?title=Proxmark3:_Installation Proxmark: Installation] or from the [https://github.com/Proxmark/proxmark3/wiki/Ubuntu-Linux official website]

=== Compiling OpenOCD ===

<pre>
sudo apt-get update
sudo apt-get install -y autoconf libtool libftdi-dev textinfo pkg-config pkgconf git
git clone https://git.code.sf.net/p/openocd/code openocd
cd openocd
./bootstrap
./configure --enable-sysfsgpio --enable-bcm2835gpio
make
sudo make install
sudo cp -r tcl/ /usr/share/openocd
</pre>
<code>make</code> will take about 15 minutes.

=== Connect physically ===

Connect the following pins from the Raspberry Pi to the Proxmark3

: {| class="wikitable"
! Proxmark3
! Raspberry Pi
! Cable color
|-
| TMS || 22 || yellow
|-
| TDI || 19 || blue
|-
| TDO || 21 || green
|-
| TCK || 23 || orange
|-
| GND || 6 || purple
|-
| 3.3V || 1 || grey
|}

For the pin layout of the Raspberry Pi see [https://www.theengineeringprojects.com/wp-content/uploads/2018/07/introduction-to-raspberry-pi-3-b-plus-2.png link].

[[File:Proxmark raspi pin.jpg|border|600px]]

The pin configuration can be changed in: <code>/usr/share/openocd/interface/raspberrypi2-native.cfg</code>. (Not necessary for this tutorial)

-----

=== Connect via OpenOCD ===

''Note: Power the Proxmark desperately from the Raspberry Pi''

; 1. Start OpenOCD
: switch to the Proxmark folder
:: <code>cd proxmark3</code>
:: ''Note: the source code of the proxmark should be already be complied.''
; 2. Create OpenOCD configuration
:: <code>nano tools/raspi.cfg</code>
:: Past following code into the file
<pre>
TODO: Paste code here
</pre>
; 3. Start OpenOCD with the configuration file just created
:: <code>sudo openocd -f tools/raspi.cfg</code>
:: Now a openOCD session is started. Do '''not''' close it.
; 4. Connect to OpenOCD session
: Open a new terminal window and telnet to the port that was specified in the .cfg file
:: <code>telnet localhost 4444</code>
; 5. Flash via JTAG

j@laptop:~/git/proxmark3$ telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>

; 6. Halt the Proxmark3
:: <code>halt</code>
; 7. Erase the flash content:
:: <code>flash erase_sector 0 0 15</code>
:: <code>flash erase_sector 1 0 15</code>
; 8. Flash the new firmware:
:: <code>flash write_image ./armsrc/obj/fullimage.elf</code>
:: <code>flash write_image ./bootrom/obj/bootrom.elf</code>

'''Done!'''

Disconnect the Raspberry Pi from the Proxmark

Now you should be able to connect to the Proxmark as usual:

<code>./client/proxmark3 /dev/ttyACM0</code>

For useful commands visit: [[Proxmark3: Useful commands]]

== Bus Pirate ==

''Note: Here the Bus Pirate 3.6 will be used''

''Note: This did not work for me, maybe it was faulty hardware a faulty firmware''

This tutorial is based on https://scund00r.com/all/rfid/2018/05/18/debrick-proxmark.html

; Update the Bus Pirate
: you can use following guide: [[Bus Pirate: First steps]]
; Get the latest Proxmark3 repository & build
: <code>git clone https://github.com/Proxmark/proxmark3.git</code>
: <code>cd proxmark3</code>
: install needed components:
: <code>sudo apt install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev gcc-arm-none-eabi libstdc++-arm-none-eabi-newlib libpcsclite-dev pcscd</code>
: <code> make clean && make all</code>
: Install proxmark3 driver:
:: <code>sudo cp -rf driver/77-mm-usb-device-blacklist.rules /etc/udev/rules.d/77-mm-usb-device-blacklist.rules</code>
:: <code>sudo udevadm control --reload-rules</code>
: Add user
:: <code>sudo adduser $USER dialout</code>
:: Now logout and login in again
; Install OpenOCD
: <code>sudo apt-get install openocd</code>
; Connect the Proxmark3 to the Bus Pirate
: use this pin configuration:
: {| class="wikitable"
! Proxmark3
! Bus Pirate
|-
| TMS || CS
|-
| TDI || MOSI
|-
| TDO || MISO
|-
| TCK || CLK
|-
| GND || GND
|-
| 3.3V || 3.3V
|}
; Flashing
: check on with Port the Bus Pirate is connected:
:: <code>ls /dev/tty*</code>
:: OR
:: <code>dmesg -wH</code> and plugout and connect the Bus Pirate again
: Set OpenOCD config
:: <code>nano tools/at91sam7s512-buspirate.cfg</code>
# Interface
interface buspirate
buspirate_port /dev/ttyUSB0
adapter_khz 1000
; Start OpenOCD
: Launch OpenOCD
:: <code>sudo openocd -f tools/at91sam7s512-buspirate.cfg</code>

:~/git/proxmark3$ sudo openocd -f tools/at91sam7s512-buspirate.cfg
[sudo] password for j:
Open On-Chip Debugger 0.10.0-rc1-dev-gc404ff5d-dirty (2019-11-11-15:43)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Warn : Adapter driver 'buspirate' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
adapter speed: 1 000 kHz
srst_only srst_p ulls_tr st srst_gates_jtag srst_open_drain connect_deassert_srst
Info : Buspirate Interf ace ready!
Info : This adap ter doe sn't suppo rt configurable speed
Info : JTAG tap: sam7x. cpu tap/de vice found: 0x3f0f0f0f (mfg: 0x787 (<unknown>), part: 0xf0f0, ver: 0x3 )
Info : Embedded ICE version 1
Info : sam7x.cpu: hardware has 2 breakpoint/watchpoint units
Info : accepting 'telnet' connection on tcp/4444

: Open a new terminal window
:: and type: <code>telnet localhost 4444</code>

j@laptop:~/git/proxmark3$ telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>

: Halt the Proxmark3
:: <code>halt</code>
: Erase the flash content:
:: <code>flash erase_sector 0 0 15</code>
:: <code>flash erase_sector 1 0 15</code>
: Flash the new firmware:
:: <code>flash write_image ./armsrc/obj/fullimage.elf</code>
:: This will take a while (about 6 minutes)
:: <code>flash write_image ./bootrom/obj/bootrom.elf</code>

== Used Hardware ==

[[Proxmark3 RDV2 Kit]]
[[Bus Pirate v3.6 Universal serial interface]]

== References ==

* https://scund00r.com/all/rfid/2018/05/18/debrick-proxmark.html

[[Category:Documentation]]