I received a nice little portable USB power source today, thanks to duran97 for pointing me to the device, and made the proxmark3 and antennas (125khz + 13.56mhz) in a nice little portable setup.

It's about the width, length and height of an Altoids tin can, just a little bit wider.

I wrapped the proxmark3 in a protective baseball card cover, similar to my Ken Griffey Jr. card. That will be worth something someday...it will help me afford the proxmark8 when I'm older. I cut holes out of the card so that the proxmark3 would fit in nicely, allow the JTAG connector out, allow the relay to breathe, and allow the button to be easily pressed. Everything else is covered nicely. Two holes for what look like capacitors, as well.

I then use another card holder with a hirose USB cable as both my HF and LF antenna. I use the black/green cables as HF and I connected the LF antenna (purchased from proxmark3.com) to the other two wires. I then fit it in the baseball card holder (had to cut a hole into the card to fit it all in, then taped it all up). Taped up the entire thing with electric tape to get some symmetry and superglued some of the wires on the inside so they don't move around. It's very thin and also a small form factor, about the width and length of an Altoids tin.

The battery is a lithium ion battery with a USB output up to 700ma. Only $20, available from http://www.radioshack.com/product/index … ab=summary

Here are some photos -- you will see an Altoids can for comparison

Here is everything (antenna on bottom, battery in middle, pm3 on top)

My man Ken!

This is my patch. I hope someone can add it in repository.

Index: include/usb_cmd.h
===================================================================
--- include/usb_cmd.h   (revision 258)
+++ include/usb_cmd.h   (working copy)
@@ -60,6 +60,7 @@
 #define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443                                  0x0301
 #define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443_SIM                      0x0302
 #define CMD_READ_SRI512_TAG                                                                                                            0x0303
+#define CMD_READ_SRIX4K_TAG                                                                                                            0x0304
 #define CMD_READER_ISO_15693                                                                                                   0x0310
 #define CMD_SIMTAG_ISO_15693                                                                                                   0x0311
 #define CMD_SIMULATE_TAG_HF_LISTEN                                                                             0x0380
Index: winsrc/command.cpp
===================================================================
--- winsrc/command.cpp  (revision 258)
+++ winsrc/command.cpp  (working copy)
@@ -108,6 +108,18 @@
        SendCommand(&c, FALSE);
 }

+/* New command to read the contents of a SRIX4K tag
+ * SRIX4K tags are ISO14443-B modulated memory tags,
+ * this command just dumps the contents of the memory/
+ */
+static void CmdSrix4kread(char *str)
+{
+        UsbCommand c;
+        c.cmd = CMD_READ_SRIX4K_TAG;
+        c.ext1 = atoi(str);
+        SendCommand(&c, FALSE);
+}
+
 // ## New command
 static void CmdHi14areader(char *str)
 {
@@ -2935,6 +2947,7 @@
        {"setlfdivisor",        CmdSetDivisor,                  0, "<19 - 255> -- Drive LF antenna at 12Mhz/(divisor+1)"},
        {"setmux",              CmdSetMux,                      0, "<loraw|hiraw|lopkd|hipkd> -- Set the ADC mux to a specific value"},
        {"sri512read",          CmdSri512read,                  0, "<int> -- Read contents of a SRI512 tag"},
+       {"srix4kread",          CmdSrix4kread,                  0, "<int> -- Read contents of a SRIX4K tag"},
        {"tidemod",                             CmdTIDemod,                                     1, "Demodulate raw bits for TI-type LF tag"},
        {"tiread",                              CmdTIRead,                                      0, "Read and decode a TI 134 kHz tag"},
        {"tiwrite",                             CmdTIWrite,                                     0, "Write new data to a r/w TI 134 kHz tag"},
Index: armsrc/apps.h
===================================================================
--- armsrc/apps.h       (revision 258)
+++ armsrc/apps.h       (working copy)
@@ -81,6 +81,8 @@
 void SimulateIso14443Tag(void);
 void AcquireRawAdcSamplesIso14443(DWORD parameter);
 void ReadSRI512Iso14443(DWORD parameter);
+void ReadSRIX4KIso14443(DWORD parameter);
+void ReadSTMemoryIso14443(DWORD parameter,DWORD dwLast);
 void SnoopIso14443(void);

 /// iso14443a.h
Index: armsrc/appmain.c
===================================================================
--- armsrc/appmain.c    (revision 258)
+++ armsrc/appmain.c    (working copy)
@@ -582,6 +582,9 @@
                case CMD_READ_SRI512_TAG:
                        ReadSRI512Iso14443(c->ext1);
                        break;
+               case CMD_READ_SRIX4K_TAG:
+                       ReadSRIX4KIso14443(c->ext1);
+                       break;
 #endif

 #ifdef WITH_ISO14443a
Index: armsrc/iso14443.c
===================================================================
--- armsrc/iso14443.c   (revision 258)
+++ armsrc/iso14443.c   (working copy)
@@ -873,6 +873,15 @@
 //-----------------------------------------------------------------------------
 void ReadSRI512Iso14443(DWORD parameter)
 {
+     ReadSTMemoryIso14443(parameter,0x0F);
+}
+void ReadSRIX4KIso14443(DWORD parameter)
+{
+     ReadSTMemoryIso14443(parameter,0x7F);
+}
+
+void ReadSTMemoryIso14443(DWORD parameter,DWORD dwLast)
+{
     BYTE i = 0x00;

     // Make sure that we start from off, since the tags are stateful;
@@ -961,8 +970,9 @@
     DbpString("Tag memory dump, block 0 to 15");
     cmd1[0] = 0x08;
     i = 0x00;
+    dwLast++;
     for (;;) {
-           if (i == 0x10) {
+           if (i == dwLast) {
                    DbpString("System area block (0xff):");
                    i = 0xff;
            }
@@ -995,6 +1005,7 @@
 }


+
 //=============================================================================
 // Finally, the `sniffer' combines elements from both the reader and
 // simulated tag, to show both sides of the conversation.

I saw that there are some pins free on the ARM, could these be used?

This might sound dumb, but supposing that the MITM would be on HF tags, could the LF antenna pins be used in some way without doing hardware modifications to the board ?

In particular, it seems that depending on the toolchain I use, I get very different performance on the same routines, some giving very good performance - the Windows toolchain on this site -, others being pretty bad - gcc 4.3.0 on Linux for instance. Does anyone have advice on the right choices there ?

  Also: most routines make use of a globally-defined DMA buffer size: is there any reason not to adapt the DMA buffer size to requirements depending on the function that is called ?

Thanks for your input!

ED

All the parts required to build it can be obtained from 3 suppliers, PCB from batchpcb.com (3 weeks lead), LCD from sparkfun.com (1 week) everything else from Digikey.com (1 week).

Read the readme file, any other questions, post them here on the forum and I'll answer them. As I've said before, I've built this already and field tested it without any real issues but I sent the assembled device to someone. I have more parts coming next week to make another one for myself.

I understand that most people don't want to make their own due to the difficulty of soldering small parts. I'm half thinking at looking into getting some assembled. If for argument's sake a complete board cost, say $350 USD (same as the original PM3) would you consider purchasing?

Surely it's possible to attach an a an extra peice of hardware to the Proxmark3 to make a simple serial port interface. Then using a peice of electronics like http://www.sparkfun.com/commerce/produc … cts_id=582 and programming a simple serial protocol for the Proxmark3 it could become wireless.

If so it'd make life pretty easy for using a Mobiles to access the hardware and read tags, etc.

Thank You.

The LCD is a bit hard to see as the backlight is off and the screen protector has not been peeled off. Initially I was hoping the LCD backlight was LED based and I'd be able to run it off the board's 5V supply, however in practice the 5V isn't enough to light up the backlight. Not even a little. You need a minimum 6.5v and ideally somewhere between 7V-9V so at this stage the backlight will stay off. This is why the LCD colors in the picture appear dim and washed out. I'd need a DC/DC boost converter to power up the LCD backlight off the board supply.

The LCD connects to the Serial Peripheral Interface, SPI bus (SPCK, MOSI) which normally goes to the FPGA. JW originally coded the comms to the FPGA by bitbanging so I ended up changing the code to use the SPI to both the FPGA and the LCD. The FPGA is selected with NCS (PA11) and the LCD is selected by an additional spare pin NCS2 (PA10). In addition to that one more pin is required PA7 as the LCD reset line. Closeup of the final hookup can be seen below.

To complicate thinks a little these, LCD's come in two flavours, Phillips PCF8833 and Epson S1D15G10D08BE based controllers and the LCD commands between them are different and, get this, the Epson LCD doesn't support serial output so you can't query the LCD to find out which type you have. Grrr... Anyway I bought a lot of 5 Phillips LCDs off ebay for $9.95 free shipping (ex Hong Kong). I don't need 5, but the price was right and I'd rather have spares in case I stuff one up. Or use some for other projects.

Originally I tried to use some ARM LCD driver code off the sparkfun.com web site that was supposedly written for the Phillips LCD controller but it didn't seem to work. Turns out the LCD commands matched that of the Epson controller even though the source files were called PCF8833U8_LCD.c  Weird. The guy who wrote the code said he based it on the Phillips datasheet !?!? Confusion reigns

Anyway this is a proof of concept experiment. If ever a proxmark4 is designed I believe this 130x130 pixel color LCD a good fit as it's easy to interface (only 4 control lines), cheap, ubiquitous (milions of Nokia phones), runs off 3.3v and a one chip boost converter for the LCD backlight could easily be implemented on board to supply the 7v required. The LCD can support 16 lines of 21 characters with a 6x8 pixel font.

What I've done is implement a way to send specific command/data pairs to the FPGA, so whereas in the original version the ARM could only send an 8 bit configuration byte over the SSP (sync serial port), I've changed it to send a 16 bit word which the FPGA interprets as a 4 bit command followed by 12 bits of data.

Out of the 16 possible commands, only two are impemented. The other 14 FPGA command values can be used in the future for setting internal FPGA parameters should the need arise.

Command 1 is the old fpga config byte (only the low 8 bits of the data is used)
Command 2 sets an internal 8 bit FPGA divisor register used to set the low frequency according to the formula 12Mhz/(divisor+1).

Some example values:

Divisor  Frequency
255  46.88Khz
119  100.0Khz
95   125.0Khz
87   136.6Khz
59   200.0Khz
19   600.0Khz

I've simulated the logic with ModelSim and it works for divisor values of 19-255 inclusive (600Khz to 46.9Khz). Divisor values less than 19 can be programmed and they will drive the antenna at the specified frequency, but the logic won't have enough clock cycles to read the ADC and send it back to the ARM, so stick to 19 and over for divisor.

I've also done practical tests by flashing my board and measuring the frequency at the antenna as well as running hidfskdemod and hi14areader to ensure that the old functionality didn't break. Anybody else care to test drive it ?

Example usage:

> setlfdivisor 70
Divisor set, expected freq=169014Hz
#db# Divisor set
> tune
# LF antenna @   4 mA /  5371 mV [1273 ohms] 125Khz
# LF antenna @   4 mA /  5505 mV [1187 ohms] 134Khz
# HF antenna @  47 mA / 11247 mV [235 ohms] 13.56Mhz
> setlfdivisor 80
Divisor set, expected freq=148148Hz
#db# Divisor set
> tune
# LF antenna @   8 mA / 10742 mV [1273 ohms] 125Khz
# LF antenna @   8 mA / 10473 mV [1187 ohms] 134Khz
# HF antenna @  47 mA / 11247 mV [235 ohms] 13.56Mhz
> setlfdivisor 90
Divisor set, expected freq=131868Hz
#db# Divisor set
> tune
# LF antenna @  32 mA / 41491 mV [1273 ohms] 125Khz
# LF antenna @  34 mA / 41491 mV [1187 ohms] 134Khz
# HF antenna @  47 mA / 11214 mV [235 ohms] 13.56Mhz

It should go without saying that if you muck around with the divisor, set it back to 95 if you plan to read some 125Khz tags or else the LF reader functions won't read too well

So here's my question:

What improvements would you like to see and are there any ways you can help?

The new "sri512read" function does tag wake-up, select and loops through the memory. Nothing special, but it does the job.

One note though: I often get errors on the CRC value when reading the tags, though the first bytes are always OK...

Code is checked in in SVN on google code (http://code.google.com/p/proxmark3/),

I'd flash my pm3 using the newest "20090301_proxmark_doob.zip" version, but when I use "hi14asnoop" to snoop the communications, I can't stop the snooping process via the push-butoon ("SW1" component) as I do with the "20081211" version. and it's very strange that the returned-parameter of "tune" is half lower than the "20081211" version (but the antenna) is the same one.

anyone can help me? thx a ton in advance!

BR.
Ryan

Who has uploaded the proxmark3.1b.pdf and the 2 gifs in the upload dir?
I can move them to the rightful dir, but I don't know where they are related to.

Thanks a lot in advance,

  Roel