<![CDATA[Proxmark developers community]]> 2010-09-01T18:08:08Z PunBB http://www.proxmark.org/forum/ <![CDATA[Is it possible to generate Indala UID from number printed on badges?]]> I am investigating some Indala 125MHz cards.  I am told that these are basic Indala cards (not encrypted Indala Flexsecure).  I am able to losamples, indalademod, and losim these cards successfully.  There seems to be a correlation between the last 5 digits printed on the card and the UID that proxmark3 detects with indalademod, because when I scan the card on the reader I can see the hex value of the printed ID transmitted over the network (ie the reader grabs the UID, converts it to hex(printed ID), and transmits it on the network).  I would love to be able to arbitrarily convert printed IDs to encoded UIDs, bypassing the need for physical access to someone's card for cloning, but so far I've been unable to reverse-engineer the algorithm that converts the printed ID to the UID. 

Does anyone know how, or if this is even possible?  Below are some sample reads.  My goal is to work this backwards, starting with printID and calculating the UID.   A command such as `indalasim {facility ID} {card ID}` would be the ideal end state, but the algorithm for converting between these IDs would be an awesome start in that direction.

UID read  by proxmark3                                           hex(UID)   FID  printIDs (hex & dec)
0000000000000000000000000000011110010010100010001011000010001101 x79288B08D x020 x2355 09045
0000000000000000000000000000010100000111101110110101000100001101 x507bb510d x081 xF893 63635
0000000000000000000000000000011110010010100010000010000100001101 x79288210D x130 x44A8 17576
0000000000000000000000000000011110010010100010001011000100001101 x79288B10D x138 xC4A8 50344
0000000000000000000000000000011000010010100010001101000100001101 x61288D10D x138 x9488 38024
0000000000000000000000000000011110010010100010001101000010001101 x79288D08D x170 xD408 54280
]]> http://www.proxmark.org/forum/user/2234/ 2010-09-01T18:08:08Z http://www.proxmark.org/forum/topic/624/is-it-possible-to-generate-indala-uid-from-number-printed-on-badges/new/posts/ <![CDATA[Question on hw tune]]> I inherited a proxmark3 and LF antenna.  I was able to connect it to my windows 7 system and upgrade the os, fpga, and bootimage to Win 2010.  That was the easy part.  When I run the command "hw tune" with the antenna that was purchased with the device I get the following:

proxmark3> hw tune
#db# Measuring antenna characteristics, please wait.
proxmark3>

# LF antenna:  0.00 V @   125.00 kHz
# LF antenna:  0.00 V @   134.00 kHz
# LF optimal:  0.00 V @ 12000.00 kHz
# HF antenna:  0.00 V @    13.56 MHz
# Your LF antenna is unusable.
# Your HF antenna is unusable.
proxmark3>

I thought that the port maybe bad so using the instructions on how to build a cheap HF antenna out of a usb cable, I formed the 3 loops and connected it to the test pads 3 and 4.  Still got the same results.    Hoping someone out there might have a thought or two on this.

Thank you for your time, sorry for the long post.

]]> http://www.proxmark.org/forum/user/2204/ 2010-08-31T16:34:58Z http://www.proxmark.org/forum/topic/621/question-on-hw-tune/new/posts/ <![CDATA[no success in running on os x please help]]> I'v downloaded ProxSpace-20100226-r390.7z
I open it then go to the folder  client
I type make at the terminal and I get this message
"Makefile:23: Extraneous text after `else' directive
Makefile:27: *** only one `else' per conditional.  Stop.
"
What do I due to fix this?

]]> http://www.proxmark.org/forum/user/401/ 2010-08-31T08:44:35Z http://www.proxmark.org/forum/topic/623/no-success-in-running-on-os-x-please-help/new/posts/ <![CDATA[How to read Mifare card]]> Hi All,
I am new to this topic. Can someone tell me what APDUs are to be sent to retrieve the card id from the Mifare card. I am using vivopay 5000 device & have a Mifare desfire card.
I tried this APDU
FF CA 00 00 00
to get serial number, but my device shows an error. Is there any authentication required before we can start reading ?

]]> http://www.proxmark.org/forum/user/2226/ 2010-08-31T04:32:37Z http://www.proxmark.org/forum/topic/622/how-to-read-mifare-card/new/posts/ <![CDATA[How to use JTAG to upgrade a proxmark]]> Hello, it's been days since I first started trying to flash a proxmark, but I really can't figure it out.

I bought a JTAG connector (an Olimex USB TINY)... but I can't connect it through openocd on my backtrack.

I compiled openocd for libftdi with

./configure --enable-ft2232_libftdi && make && make install

Here is the configuration file that i used for openocd (0.4.0 version)

# cat ~/openocd.cfg
source [find interface/olimex-jtag-tiny.cfg]
source [find target/sam7x256.cfg]

telnet_port 4444
#

Then i connect both the proxmark and the olimex, and when i start openocd here's what i get:

# openocd -f ~/openocd.cfg
Open On-Chip Debugger 0.4.0 (2010-08-12-11:08)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.berlios.de/doc/doxygen/bugs.html
srst_only srst_pulls_trst srst_gates_jtag srst_open_drain
Info : clock speed 6000 kHz
Info : JTAG tap: sam7x256.cpu tap/device found: 0x3f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x3)
Warn : Unexpected idcode after end of chain: 32 0x00000000
Warn : Unexpected idcode after end of chain: 64 0x00000000
Warn : Unexpected idcode after end of chain: 96 0x00000000
Warn : Unexpected idcode after end of chain: 128 0x00000000
Warn : Unexpected idcode after end of chain: 160 0x00000000
Warn : Unexpected idcode after end of chain: 192 0x00000000
Warn : Unexpected idcode after end of chain: 224 0x00000000
Warn : Unexpected idcode after end of chain: 256 0x00000000
Warn : Unexpected idcode after end of chain: 288 0x00000000
Warn : Unexpected idcode after end of chain: 320 0x00000000
Warn : Unexpected idcode after end of chain: 352 0x00000000
Warn : Unexpected idcode after end of chain: 384 0x00000000
Warn : Unexpected idcode after end of chain: 416 0x00000000
Warn : Unexpected idcode after end of chain: 448 0x00000000
Warn : Unexpected idcode after end of chain: 480 0x00000000
Warn : Unexpected idcode after end of chain: 512 0x00000000
Warn : Unexpected idcode after end of chain: 544 0x00000000
Warn : Unexpected idcode after end of chain: 576 0x00000000
Warn : Unexpected idcode after end of chain: 608 0x00000000
Error: double-check your JTAG setup (interface, speed, missing TAPs, ...)
Info : JTAG tap: sam7x256.cpu tap/device found: 0x3f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x3)
Warn : Unexpected idcode after end of chain: 32 0x00000000
Warn : Unexpected idcode after end of chain: 64 0x00000000
Warn : Unexpected idcode after end of chain: 96 0x00000000
Warn : Unexpected idcode after end of chain: 128 0x00000000
Warn : Unexpected idcode after end of chain: 160 0x00000000
Warn : Unexpected idcode after end of chain: 192 0x00000000
Warn : Unexpected idcode after end of chain: 224 0x00000000
Warn : Unexpected idcode after end of chain: 256 0x00000000
Warn : Unexpected idcode after end of chain: 288 0x00000000
Warn : Unexpected idcode after end of chain: 320 0x00000000
Warn : Unexpected idcode after end of chain: 352 0x00000000
Warn : Unexpected idcode after end of chain: 384 0x00000000
Warn : Unexpected idcode after end of chain: 416 0x00000000
Warn : Unexpected idcode after end of chain: 448 0x00000000
Warn : Unexpected idcode after end of chain: 480 0x00000000
Warn : Unexpected idcode after end of chain: 512 0x00000000
Warn : Unexpected idcode after end of chain: 544 0x00000000
Warn : Unexpected idcode after end of chain: 576 0x00000000
Warn : Unexpected idcode after end of chain: 608 0x00000000
Error: double-check your JTAG setup (interface, speed, missing TAPs, ...)
Command handler execution failed
Warn : jtag initialization failed; try 'jtag init' again.
^C

I also tested openocd with ftd2xx (instead of libftdi) and the results are the same:

# openocd -f ~/openocd.cfg
Open On-Chip Debugger 0.4.0 (2010-08-12-18:34)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.berlios.de/doc/doxygen/bugs.html
srst_only srst_pulls_trst srst_gates_jtag srst_open_drain
Info : device: 4 "2232C"
Info : deviceID: 364511236
Info : SerialNumber: ��@
Info : Description: Olimex OpenOCD JTAG TINY A
Info : clock speed 6000 kHz
Info : JTAG tap: sam7x256.cpu tap/device found: 0x3f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x3)
Warn : Unexpected idcode after end of chain: 32 0x00000000
Warn : Unexpected idcode after end of chain: 64 0x00000000
Warn : Unexpected idcode after end of chain: 96 0x00000000
Warn : Unexpected idcode after end of chain: 128 0x00000000
Warn : Unexpected idcode after end of chain: 160 0x00000000
Warn : Unexpected idcode after end of chain: 192 0x00000000
Warn : Unexpected idcode after end of chain: 224 0x00000000
Warn : Unexpected idcode after end of chain: 256 0x00000000
Warn : Unexpected idcode after end of chain: 288 0x00000000
Warn : Unexpected idcode after end of chain: 320 0x00000000
Warn : Unexpected idcode after end of chain: 352 0x00000000
Warn : Unexpected idcode after end of chain: 384 0x00000000
Warn : Unexpected idcode after end of chain: 416 0x00000000
Warn : Unexpected idcode after end of chain: 448 0x00000000
Warn : Unexpected idcode after end of chain: 480 0x00000000
Warn : Unexpected idcode after end of chain: 512 0x00000000
Warn : Unexpected idcode after end of chain: 544 0x00000000
Warn : Unexpected idcode after end of chain: 576 0x00000000
Warn : Unexpected idcode after end of chain: 608 0x00000000
Error: double-check your JTAG setup (interface, speed, missing TAPs, ...)
Info : JTAG tap: sam7x256.cpu tap/device found: 0x3f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x3)
Warn : Unexpected idcode after end of chain: 32 0x00000000
Warn : Unexpected idcode after end of chain: 64 0x00000000
Warn : Unexpected idcode after end of chain: 96 0x00000000
Warn : Unexpected idcode after end of chain: 128 0x00000000
Warn : Unexpected idcode after end of chain: 160 0x00000000
Warn : Unexpected idcode after end of chain: 192 0x00000000
Warn : Unexpected idcode after end of chain: 224 0x00000000
Warn : Unexpected idcode after end of chain: 256 0x00000000
Warn : Unexpected idcode after end of chain: 288 0x00000000
Warn : Unexpected idcode after end of chain: 320 0x00000000
Warn : Unexpected idcode after end of chain: 352 0x00000000
Warn : Unexpected idcode after end of chain: 384 0x00000000
Warn : Unexpected idcode after end of chain: 416 0x00000000
Warn : Unexpected idcode after end of chain: 448 0x00000000
Warn : Unexpected idcode after end of chain: 480 0x00000000
Warn : Unexpected idcode after end of chain: 512 0x00000000
Warn : Unexpected idcode after end of chain: 544 0x00000000
Warn : Unexpected idcode after end of chain: 576 0x00000000
Warn : Unexpected idcode after end of chain: 608 0x00000000
Error: double-check your JTAG setup (interface, speed, missing TAPs, ...)
Command handler execution failed
Warn : jtag initialization failed; try 'jtag init' again.
^C

Other than those unexpected idcodes, another odd thing that I notice is the SerialNumber which has some strange characters in it (this looks like a non allocated buffer since every time I restart openocd the characters inside the SerialNumber are different)... Anyway... I still i don't know what to do.

Could it be useful, I have the same identical results with jtag_khz 6000, jtag_khz 3000 and jtag_khz 300

The proxmark3 and the olimex are connected through an usb1 hub (I even tested this on a old notebook that only has usb1, with Windows XP SP3 and libusb-win32, and I got the same exact results).

Any ideas please?

Thanks

]]> http://www.proxmark.org/forum/user/2032/ 2010-08-23T21:12:02Z http://www.proxmark.org/forum/topic/617/how-to-use-jtag-to-upgrade-a-proxmark/new/posts/ <![CDATA[is there a A/S service?]]> I don't know why my PM3 doesn't work.
So I want to send back it. And I want to repair it with a little pay like A/S service~
Can I do that? If I send it back, then you can repair it?~

]]> http://www.proxmark.org/forum/user/2011/ 2010-08-23T09:06:54Z http://www.proxmark.org/forum/topic/620/is-there-a-as-service/new/posts/ <![CDATA[proxmark III mifare reader software]]> hi,

is there any software existing that can use the proxmark III to read/write the mifare-cards ?

]]> http://www.proxmark.org/forum/user/1421/ 2010-08-18T06:28:30Z http://www.proxmark.org/forum/topic/525/proxmark-iii-mifare-reader-software/new/posts/ <![CDATA[Hi World]]> Hello guys.. just joined today.. Hoping to meet some cool dudes here. pokies online

]]> http://www.proxmark.org/forum/user/1921/ 2010-08-17T01:31:38Z http://www.proxmark.org/forum/topic/590/hi-world/new/posts/ <![CDATA[does the proxmark3 can work with 25khz frequency?]]> Hello!

We saw the presentation on the 26c3 and now we want to start playing around with the hard and software to get an overview on whats possiblean and what is not.

We are using a simonssvoss 3060 system ant work and we would like to target this first. It looks that the communication between transponder and key cylinder is at 25khz. I would like to know if it is possible to read this communication wit the proxmark3.

Or more precicely:
Can we work with this frequency after: building a new antenna and update the firmware? (we can go to work)
Do we need to change the hardware (not enough know how on my side)?
Is it impossible?

Thanks for your time!

Greetings
Christian

]]> http://www.proxmark.org/forum/user/2161/ 2010-08-16T11:33:24Z http://www.proxmark.org/forum/topic/619/does-the-proxmark3-can-work-with-25khz-frequency/new/posts/ <![CDATA[Client working under OS X]]> I have the Linux client -- at least the text-based version -- working under OS X.  Using a codeless kext, we can prevent the HID driver from grabbing the device and can talk to it normally.   Here is a patch against current SVN trunk; note that the "linux" directory should probably be renamed to "unix".

Index: linux/Info.plist
===================================================================
--- linux/Info.plist  (revision 0)
+++ linux/Info.plist  (revision 0)
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd ">
+<plist version="1.0">
+<dict>
+  <key>CFBundleDevelopmentRegion</key> <string>English</string>
+  <key>CFBundleIdentifier</key> <string>org.proxmark</string>
+  <key>CFBundleIconFile</key> <string></string>
+  <key>CFBundleInfoDictionaryVersion</key> <string>6.0</string>
+  <key>CFBundlePackageType</key> <string>KEXT</string>
+  <key>CFBundleSignature</key> <string>????</string>
+  <key>CFBundleVersion</key> <string>1.0.0</string>
+  <key>IOKitPersonalities</key>
+  <dict>
+    <key>Proxmark3</key>
+    <dict>
+      <key>CFBundleIdentifier</key><string>com.apple.kernel.iokit</string>
+      <key>IOClass</key><string>IOService</string>
+      <key>IOProviderClass</key><string>IOUSBInterface</string>
+      <key>bConfigurationValue</key> <integer>1</integer>
+      <key>bInterfaceNumber</key> <integer>0</integer>
+      <key>idProduct</key><integer>19343</integer>
+      <key>idVendor</key><integer>39620</integer>
+    </dict>
+  </dict>
+  <key>OSBundleLibraries</key>
+  <dict>
+    <key>com.apple.iokit.IOUSBFamily</key><string>1.8</string>
+  </dict>
+</dict>
+</plist>
Index: linux/proxmark3.c
===================================================================
--- linux/proxmark3.c  (revision 262)
+++ linux/proxmark3.c  (working copy)
@@ -46,21 +46,17 @@
 {
   struct main_loop_arg *arg = (struct main_loop_arg*)targ;
   char *cmd = NULL;
+  pthread_t reader_thread;
 
-  while(1) {
+  if (arg->usb_present == 1) {
     struct usb_receiver_arg rarg;
-    pthread_t reader_thread;
-
     rarg.run=1;
-    if (arg->usb_present == 1) {
-      pthread_create(&reader_thread, NULL, &usb_receiver, &rarg);
-    }
-    cmd = readline(PROXPROMPT);
-    rarg.run=0;
-    if (arg->usb_present == 1) {
-      pthread_join(reader_thread, NULL);
-    }
+    pthread_create(&reader_thread, NULL, &usb_receiver, &rarg);
+  }
 
+  while(1) {
+
+    cmd = readline(PROXPROMPT);
     if (cmd) {
       if (cmd[0] != 0x00) {
         CommandReceived(cmd);
Index: linux/Makefile
===================================================================
--- linux/Makefile  (revision 262)
+++ linux/Makefile  (working copy)
@@ -1,7 +1,7 @@
 #COMMON_FLAGS = -m32
-LDLIBS = -L/usr/local/lib -lusb -lreadline -lpthread
+LDLIBS = -L/usr/local/lib -L/opt/local/lib -lusb -lreadline -lpthread
 LDFLAGS = $(COMMON_FLAGS)
-CFLAGS = -I. -I/opt/local/include -Wall -Wno-unused-function $(COMMON_FLAGS)
+CFLAGS = -I. -I/usr/local/include -I/opt/local/include -Wall -Wno-unused-function $(COMMON_FLAGS)
 
 CXXFLAGS = $(shell pkg-config --cflags QtCore QtGui 2>/dev/null) -Wall
 QTLDLIBS = $(shell pkg-config --libs QtCore QtGui 2>/dev/null)
@@ -34,6 +34,17 @@
 proxguiqt.moc.cpp: proxguiqt.h
   $(MOC) -o$@ $^
 
+# must be run as root
+install_kext: Info.plist
+  mkdir -p /System/Library/Extensions/Proxmark3.kext/Contents
+  cp Info.plist /System/Library/Extensions/Proxmark3.kext/Contents
+  chown -R root:wheel /System/Library/Extensions/Proxmark3.kext
+  chmod 755 /System/Library/Extensions/Proxmark3.kext /System/Library/Extensions/Proxmark3.kext/Contents
+  chmod 644 /System/Library/Extensions/Proxmark3.kext/Contents/Info.plist
+  rm -rf /System/Library/Caches/com.apple.kext.caches
+  touch /System/Library/Extensions
+  @echo "*** You may need to reboot for the kext to take effect."
+
 clean:
   rm -f cli flasher proxmark3 snooper *.o *.moc.cpp
 

Index: common/Makefile.common
===================================================================
--- common/Makefile.common  (revision 262)
+++ common/Makefile.common  (working copy)
@@ -14,19 +14,14 @@
 #  Windows yields literal "", on Linux yields an empty line
 ifeq ($(shell echo ""),)
 
-# This is probably a proper system, so we can use uname
-UNAME := $(shell uname)
-ifeq ($(UNAME), Linux)
-# Linux. (Todo: Add MacOS X if appropriate)
 DELETE=rm -rf
 MOVE=mv
 COPY=cp
 PATHSEP=/
 FLASH_TOOL=linux/flasher
-DETECTED_OS=Linux
+DETECTED_OS=Unix
 # You may/should set this in your environment
 ARMLIB ?= /usr/local/lib/gcc/arm-elf/4.3.3/interwork
-endif
 
 else
 
@@ -41,7 +36,7 @@
 
 endif
 
-CROSS   = arm-elf-
+CROSS ?= arm-elf-
 CC  = $(CROSS)gcc
 AS  = $(CROSS)as
 LD  = $(CROSS)ld
Index: Makefile
===================================================================
--- Makefile  (revision 262)
+++ Makefile  (working copy)
@@ -1,6 +1,6 @@
 include common/Makefile.common
 
-ifeq ($(DETECTED_OS),Linux)
+ifeq ($(DETECTED_OS),Unix)
 HOST_BINARY=linux
 else
 HOST_BINARY=winsrc
]]> http://www.proxmark.org/forum/user/171/ 2010-08-14T03:29:47Z http://www.proxmark.org/forum/topic/422/client-working-under-os-x/new/posts/ <![CDATA[Cases]]> Does anyone have a case for sale for the proxmark3?

]]> http://www.proxmark.org/forum/user/401/ 2010-08-13T22:26:32Z http://www.proxmark.org/forum/topic/616/cases/new/posts/ <![CDATA[Sending a signal]]> How can I send a signal as I want?

I want to send a signal sequence not in the ISO standard.

Is there a function for sending a signal sequence?~

]]> http://www.proxmark.org/forum/user/2011/ 2010-08-12T06:20:39Z http://www.proxmark.org/forum/topic/615/sending-a-signal/new/posts/ <![CDATA[Help - Clone - 125KHz HID Proximity Tag - PM3]]> Hello,
-I've read through the various threads.
-I want to clone a 125KHz HID proximity tag using my PM3.
-I have tried separately using the TWO methods available
Method i.) "hidfskdemod" then "hidsimtag"
Method ii.) "loread" then "losamples" then "losim"

-My measure of success is if the security reader accepts the second 'cloned' card.
-In each method I was unsuccessful.

QUESTION:  What have I done wrong?

NOTE: Procedure for Method (i) and (ii) below.

Method (i):
1.) Run command "hidfskdemod" which records and interprets (demodulator) the signal
for a HID proximity cards (when the RFID tag is read I press the button on the PM3).

> hidfskdemod
#db# TAG ID
#db# 00000020, 06c6384a, 00001c25
#db# Stopped

2.) I simulated the record by "hidsimtag" and placed a 125KHz tag I wanted to write to near my aerial
wait a few seconds then press the button on the PM3.

> hidsimtag
Emulating tag with ID 0               0
#db# Stopped

Method (ii)
1.) Run "loread"
> loread
#db# 00000000, 00000000, 00000000
2.) Run losamples
> losamples
3.) Run losim and press the button on the board after a few seconds (the yellow light on board will come on).
> losim
Auto-detected clock rate: 8


Some other relevant threads:
https://www.lafargue.name/article2754.html
http://www.proxmark.org/forum/topic/280 … it/page/1/

kind regards,
JaEGeR.

]]> http://www.proxmark.org/forum/user/854/ 2010-08-06T07:12:12Z http://www.proxmark.org/forum/topic/362/help-clone-125khz-hid-proximity-tag-pm3/new/posts/ <![CDATA[Mifare Classic HMAC]]> Hi, I've run across some MF classic cards that seam to have some sort of checksum after the data, i.e.

010000000000000000000000000477ea

where 77ea is the checksum... does anybody know how to compute this value? Also it seams that this value is different on each card so the UID is involved somehow. It should be documented in the "TKF" standard but I can not find it anywhere.. anyone ?

]]> http://www.proxmark.org/forum/user/1676/ 2010-08-06T05:28:58Z http://www.proxmark.org/forum/topic/550/mifare-classic-hmac/new/posts/ <![CDATA[Legic write/simulate released]]> I've just posted code (rev 440) that simulates and writes to legic cards. This was sent to me anonymously and I've only gone as far in testing as to make sure that it builds, flashes and 'seems to work'. I do not have a native legic reader to test it properly against, so I'd be interested to hear if anyone has...

]]> http://www.proxmark.org/forum/user/553/ 2010-08-05T09:46:08Z http://www.proxmark.org/forum/topic/556/legic-writesimulate-released/new/posts/