Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2015-04-06 12:01:46

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

[requests] What would you like to see next on proxmark3 ?

I would like to express here what I would like to be implemented/improved in future proxmark3 releases; if more than 1 would like to have the same features we can team-up to make them see the light:

HF
- add ISO15693 simulation
- add EPA support (acutal epa is 100% not working for the epa tested by me and a few other people); EPAs are a kind of smart card, you need to know which commands to send and read the response; datasheets (more and less full) are available.
- Mifare Desfire implementation
- Calypso implementation (Calypso probably uses ISO14443B protocol in latest versions; probably earlier versions uses proprietary Innovatron ISO14443B')
- complete Jewel/Topaz support (specially sim command - almost done thanks to the great piwi work)
- add mifare ultralight/ev1/NTAG simulation (pm3 can do that)
- add Sony FeliCa support (technical datasheets available)
- EMV implementation (visa,mastercard - Peter filmoore has one laying around)
- iClass write
- detection of Mifare Classic NACK bug

LF
- improve PCF support (datsheets are available for some tags - maybe iZsh will comes in hand!)
- converting a LF tagnumber (printed number)  into complete or partial clone command
- LF sim with a "bruteforce" mode where you can set the facilitycode and simulating the ID in a bruteforcing-way
- EM4x50 full read/write/password
- LF T55x7 password sniff
- EM4x05 full read/write/password
- LF T55XX bruteforce on the password (or analysing the time it takes)

Software Improvements
- A pipe buffer (that you could keep the transaction log on one file in the computer, not in the internal atmel´s buffer)
- Someway of fuzzing protocols.
- Side-channel/power analysis attacks support.


If you have any (feasible) request feel free to post it here. I will update this post adding new (again, feasible, ex. "Make coffee" will not be taken in consideration wink ) requests and the number of people interested.

Last edited by asper (2015-10-17 17:26:24)

Offline

#2 2015-04-06 18:49:09

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: [requests] What would you like to see next on proxmark3 ?

- implementation of  Mifare Desfire.
- implementation of EMV (visa,mastercard)   Peter filmoore has one laying around. Would love to get that one in the Master.
- implementation of Calypso.  (full datasheets needed.)

Offline

#3 2015-04-06 20:01:15

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: [requests] What would you like to see next on proxmark3 ?

1st post updated wink

Offline

#4 2015-04-06 21:30:48

thefkboss
Contributor
Registered: 2008-10-26
Posts: 198

Re: [requests] What would you like to see next on proxmark3 ?

A pipe buffer (that you could keep the transaction log on one file in the computer, not in the internal atmel´s buffer)
this could keep bigger tansactions logs, because you will use your hdd instead  the atmel's memory

Offline

#5 2015-04-06 22:09:05

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: [requests] What would you like to see next on proxmark3 ?

Great work ! This is what I was talking about.
1st post updated.

Offline

#6 2015-04-06 22:17:28

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: [requests] What would you like to see next on proxmark3 ?

LF:
EM4x50 full read/write/password
EM4x05 full read/write/password

HF:
iClass write

UHF: (i know i'm dreaming)

Offline

#7 2015-04-06 22:29:28

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: [requests] What would you like to see next on proxmark3 ?

Is it possible to add UHF capabilities hacking pm3 hardware ? (capacitor+antenna?)

Offline

#8 2015-04-07 07:33:39

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: [requests] What would you like to see next on proxmark3 ?

We should be able to get 400Mhz at least,  but 800-900 Mhz I doubt.

Offline

#9 2015-04-07 14:57:03

holiman
Contributor
Registered: 2013-05-03
Posts: 566

Re: [requests] What would you like to see next on proxmark3 ?

400Mhz? How? As for reader-side, how could we generate such a carrier, we dont have any chrystals that fast, afaik...?

Offline

#10 2015-04-07 15:01:41

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: [requests] What would you like to see next on proxmark3 ?

Lol. Look what I started...  UHF would need a hardware change, probably a significant one.  But it would be a cool device if we could re-use all the pm3 code and have UHF.

Offline

#11 2015-04-07 18:37:12

vivat
Contributor
Registered: 2010-10-26
Posts: 332

Re: [requests] What would you like to see next on proxmark3 ?

Side-channel/power analysis attacks support.

Offline

#12 2015-04-08 21:41:14

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: [requests] What would you like to see next on proxmark3 ?

When it comes to the wish for better PCF support,  it seems this will be solved when iZsh commits his improved PCF functionality.
so thats kind of cool.

Otherwise I must just say that the PM3 has evolved so much in the last year.  Nowdays is more about adding protocols then figuring out why basic stuff doesn't work or if it was suppose to be like that.

Offline

#13 2015-04-12 13:52:13

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: [requests] What would you like to see next on proxmark3 ?

Someway of fuzzing protocols?    Like how to find out the "nack" bug in Mifare classic.

Offline

#14 2015-04-23 16:12:13

dk1206
Contributor
Registered: 2014-12-23
Posts: 34

Re: [requests] What would you like to see next on proxmark3 ?

Maybe CIPURSE implementation ?

Offline

#15 2015-04-30 16:59:20

Kieths
Contributor
Registered: 2015-04-21
Posts: 18

Re: [requests] What would you like to see next on proxmark3 ?

Add an 'hf search', similar to the current 'lf search', to help quickly identify unknown devices when / if possible.

Offline

#16 2015-05-13 12:19:34

dk1206
Contributor
Registered: 2014-12-23
Posts: 34

Re: [requests] What would you like to see next on proxmark3 ?

Hey guys,

Any news on CIPURSE idea of implementation ? Has anyone even appraoched researching how to clone CIPURSE cards ?

Offline

#17 2015-05-13 18:40:01

joe
Contributor
Registered: 2013-08-15
Posts: 126

Re: [requests] What would you like to see next on proxmark3 ?

need more functional cmds for iclass, none of them can work now .

Offline

#18 2015-06-18 20:20:33

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: [requests] What would you like to see next on proxmark3 ?

I think @asper can edit the UL/NTAG sim request... smile


Back to suggestions:

Marshmellow mentioned once that he wanted to see a LF T55XX bruteforce on the password.  Or analysing the time it takes...


I would like to see converting a LF tagnumber (printed number)  into complete or partial clone command?!  If you understand what I'm aiming at.
Also the old  LF sim with a "bruteforce" mode where you set the facilitycode  and  simulating in a bruteforce manor the id...

Offline

#19 2015-06-18 23:00:58

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: [requests] What would you like to see next on proxmark3 ?

Done! wink

Offline

#20 2015-06-22 10:42:46

lutcheti
Contributor
Registered: 2015-05-21
Posts: 30

Re: [requests] What would you like to see next on proxmark3 ?

Hi guys,
I would love to see a Calypso implementation (v. ISO14443B) come out.
Fuzzing capabilities would be great as well.
I'm starter with Proxmark3 but I was about to try to reverse (using fuzzing?) a calypso implementation (the one that is used in travel card in Paris) so I'd be glad to help/team-up/do something.

Offline

#21 2015-06-25 02:29:58

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: [requests] What would you like to see next on proxmark3 ?

iceman wrote:

I would like to see converting a LF tagnumber (printed number)  into complete or partial clone command?!  If you understand what I'm aiming at.
Also the old  LF sim with a "bruteforce" mode where you set the facilitycode  and  simulating in a bruteforce manor the id...

the challenge with this is what format should we make?  there are literally hundreds.  sad 

handling them via the raw wiegand data covers all of them, which is why the commands are the way they are.

Offline

#22 2015-06-25 02:31:26

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: [requests] What would you like to see next on proxmark3 ?

iceman wrote:

I think @asper can edit the UL/NTAG sim request... smile

granted this hasn't made it's way to the main trunk yet...

Offline

#23 2015-06-25 02:34:33

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: [requests] What would you like to see next on proxmark3 ?

lutcheti wrote:

Hi guys,
I would love to see a Calypso implementation (v. ISO14443B) come out.
Fuzzing capabilities would be great as well.
I'm starter with Proxmark3 but I was about to try to reverse (using fuzzing?) a calypso implementation (the one that is used in travel card in Paris) so I'd be glad to help/team-up/do something.

a good start would be to get a snoop of the transactions and post them on the forum in the Calypso section.  now that 14b is working well if the tags are fully 14b it should be semi easy to make some progress.

Offline

#24 2015-06-25 09:08:14

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: [requests] What would you like to see next on proxmark3 ?

Well @marshmellow,  I got my wish for a UL/NTAG sim. If it makes its way to PM3 master is another thing.

With @pwpiwi 's fpga compress is finished, that has opened up some more possibilities.

Offline

#25 2015-06-25 20:56:06

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: [requests] What would you like to see next on proxmark3 ?

Calypso may be using a different protocol to send (or receive); it can be 14B' and not 14B.

Offline

#26 2015-06-25 21:20:34

jump
Contributor
Registered: 2015-04-29
Posts: 57

Re: [requests] What would you like to see next on proxmark3 ?

You are right asper. This is actually 14B' and not 14B

Offline

#27 2015-06-25 22:19:29

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: [requests] What would you like to see next on proxmark3 ?

it is 14b' ,  but the actual protocol is unknown..

Offline

#28 2015-06-25 22:31:15

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: [requests] What would you like to see next on proxmark3 ?

iceman wrote:

it is 14b' ,  but the actual protocol is unknown..

Not publically known... dataseets needed.

Offline

#29 2015-06-25 22:33:57

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: [requests] What would you like to see next on proxmark3 ?

and here I though you were there info-archangel Asper,...  deliver.. deliver..  wink

Offline

#30 2015-06-26 08:12:29

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: [requests] What would you like to see next on proxmark3 ?

Unfortunately no info. Subscribing to the protocol datasheets is expensive.

Offline

#31 2015-06-29 16:46:19

lutcheti
Contributor
Registered: 2015-05-21
Posts: 30

Re: [requests] What would you like to see next on proxmark3 ?

I thought they used 14b' in the past but moved to 14b recently. To be sure I would like
to get '14b snoop' working.
I tried to snoop a transaction but I always obtain a weird error message:

proxmark3> hf 14b snoop
#db# Snooping buffers initialized:                 
#db#   Trace: 39360 bytes                 
#db#   Reader -> tag: 256 bytes                 
#db#   tag -> Reader: 256 bytes                 
#db#   DMA: 128 bytes                 
#db# blew circular buffer! behindBy=0x74                 
#db# Snoop statistics:                 
#db#   Max behind by: 116                 
#db#   Uart State: 0                 
#db#   Uart ByteCnt: 0                 
#db#   Uart ByteCntMax: 256                 
#db#   Trace length: 0         

Maybe we could start by fixing this?

Offline

#32 2015-06-29 16:47:59

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: [requests] What would you like to see next on proxmark3 ?

Update your firmware.  It IS fixed.

Offline

#33 2015-06-29 17:26:18

lutcheti
Contributor
Registered: 2015-05-21
Posts: 30

Re: [requests] What would you like to see next on proxmark3 ?

I thought they used 14b' in the past but moved to 14b recently. To be sure I would like
to get '14b snoop' working.
I tried to snoop a transaction but I always obtain a weird error message:

proxmark3> hf 14b snoop
#db# Snooping buffers initialized:                 
#db#   Trace: 39360 bytes                 
#db#   Reader -> tag: 256 bytes                 
#db#   tag -> Reader: 256 bytes                 
#db#   DMA: 128 bytes                 
#db# blew circular buffer! behindBy=0x74                 
#db# Snoop statistics:                 
#db#   Max behind by: 116                 
#db#   Uart State: 0                 
#db#   Uart ByteCnt: 0                 
#db#   Uart ByteCntMax: 256                 
#db#   Trace length: 0         

Here is my config:
http://sebsauvage.net/paste/?73f80ed23271fa3e#lGP+oZ2Rwty1hn2yarAjBlQsHbBWjpsITDlh5cPR6kQ=

[EDIT]
This is actually a serious issue. I'm trying to solve it here: http://www.proxmark.org/forum/viewtopic.php?id=2487
I must solve it before beeing able to snoop a full Calypso transaction (RATP or Velib), really frustrating sad
[/EDIT]

Last edited by lutcheti (2015-07-13 11:28:26)

Offline

#34 2015-06-29 17:52:57

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: [requests] What would you like to see next on proxmark3 ?

are you running on the latest firmware compiled from GitHub??

Offline

#35 2015-07-06 22:55:50

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: [requests] What would you like to see next on proxmark3 ?

i have a Request:  hf snoop
a generic recording of HF samples regardless of the protocol.  for use with tags that we don't know the protocol yet.  (sielox.. others)

is it a question of buffer space?  it seems like something like this used to exist (hisamples?)  i'm going to start digging up some old info on this.

but i remember piwi recently said that passing hf samples (specifically regarding ISO 14b) to the client for demod couldn't work due to speed?  maybe?

Offline

#36 2015-07-13 10:04:03

meter
Contributor
Registered: 2015-07-13
Posts: 78

Re: [requests] What would you like to see next on proxmark3 ?

Hi, this is my first message on this forum, I vote +1 for request of marshmellow.
There is also a patch from another user, never released in master branch, here http://proxmark.org/forum/viewtopic.php?id=1945 maybe is useful

Offline

#37 2015-07-15 08:54:07

Dake
Contributor
Registered: 2015-06-16
Posts: 32

Re: [requests] What would you like to see next on proxmark3 ?

Hello !
- improve PCF support
- Calypso implementation

Offline

#38 2015-07-22 23:41:48

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: [requests] What would you like to see next on proxmark3 ?

Regarding "HF SNOOP"

https://github.com/EnioArda/proxmark3/commit/1bae666bcfaeab3b86c5a64bb150559862e1089d

Enio's fork had a HF SNOOP implemented, and it got merged,  but I can't see it anymore in PM3 master..

Offline

#39 2015-07-27 05:22:21

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: [requests] What would you like to see next on proxmark3 ?

lf snoop got merged, but I don't see hf snoop ever getting finished.

Offline

#40 2015-07-27 10:40:28

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: [requests] What would you like to see next on proxmark3 ?

Yeah, it was something about splitting up the fpga firmware into a LF and a HF part at that time when Enio was doing this.
There has been changes to the HF part in the FPGA since then, so his adaptations might not work straight up.

But with the memory saving changes with the new BigBuff, the HF snooping might actually be able to snoop complete transactions. I remember that this also was an issue with hf snooping at the time.

Offline

#41 2015-07-27 21:28:04

holiman
Contributor
Registered: 2013-05-03
Posts: 566

Re: [requests] What would you like to see next on proxmark3 ?

iceman wrote:

Regarding "HF SNOOP"

https://github.com/EnioArda/proxmark3/commit/1bae666bcfaeab3b86c5a64bb150559862e1089d

Enio's fork had a HF SNOOP implemented, and it got merged,  but I can't see it anymore in PM3 master..

Nope, it never got merged into master. And afaik, he never did a pull request on it, I don't think he ever considered it finished enough to "officially" submit it, and noone took up on it. Personally, it's not of much value to me (I'd rather use an oscilloscope or my Saleae pro logic), so I haven't put in the time that would be required to make it work.

And yes, he implemented it as an LF-mode, only because of addressing issues (no more flag-space in HF-section). That was a bit awkward, I pinged him a few months back that there now was 'space' available in HF, if he would want to continue with it.

Offline

#42 2015-07-27 21:40:19

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: [requests] What would you like to see next on proxmark3 ?

I see,  I stand corrected.
But we got a LF SNOOP from Gaucho?!?  which works?! no?

Offline

#43 2015-07-27 23:05:59

holiman
Contributor
Registered: 2013-05-03
Posts: 566

Re: [requests] What would you like to see next on proxmark3 ?

Yes, we have an LF snoop, afaik there are no problems on that front

Offline

#44 2015-07-28 05:04:10

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: [requests] What would you like to see next on proxmark3 ?

i guess i'll have to find myself a good oscilloscope and learn it...  sad

Offline

#45 2015-07-28 09:54:25

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: [requests] What would you like to see next on proxmark3 ?

@marshmellow, Pretty soon you'll be compiling the fpga-code aswell

Offline

#46 2015-10-17 03:43:26

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: [requests] What would you like to see next on proxmark3 ?

we have iclass write now (it works most of the time...) 

it can be crossed off.  smile

Offline

#47 2015-10-17 13:59:24

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: [requests] What would you like to see next on proxmark3 ?

+1

Offline

#48 2016-02-23 13:02:08

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: [requests] What would you like to see next on proxmark3 ?

You can cross over " LF T55XX bruteforce on the password (or analysing the time it takes)"

Offline

#49 2016-02-23 20:10:56

Apt-Get
Contributor
Registered: 2015-12-23
Posts: 111

Re: [requests] What would you like to see next on proxmark3 ?

an lf search command that runs like the hid fsk command..
basically will constantly search and demod tags until you hit the button.

Offline

#50 2016-02-23 21:20:38

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: [requests] What would you like to see next on proxmark3 ?

@apt-get See the threshold setting of lf config.  It works.  (if set properly it should search until the antenna picks up something, then it will attempt all known demods on the captured data)  but doing it for more than one tag would be too slow and the output too long to be useful with the current device and implementation.

Last edited by marshmellow (2016-02-23 22:19:48)

Offline

Board footer

Powered by FluxBB