The iceman fork
----------------
+===============
+[](https://travis-ci.org/iceman1001/proxmark3) [](https://scan.coverity.com/projects/proxmark3_iceman_fork) [![Latest release] (https://img.shields.io/github/release/iceman1001/proxmark3.svg)](https://github.com/iceman1001/proxmark3/releases/latest)
-NOTICE:
-
-The official Proxmark repository is found here: https://github.com/Proxmark/proxmark3
-
-NEWS:
-
-::THIS FORK IS HIGHLY EXPERIMENTAL::
+##This fork is HIGHLY experimental (or bleeding edge)
+##Donate
+https://paypal.me/iceman1001/
+Feel free to donate. All support is welcome.
-## Build Status Travis CI
-[](https://travis-ci.org/iceman1001/proxmark3)
+##Notice
+There is so much in this fork, with all fixes and additions its basically the most enhanced fork to this day for the Proxmark3 device. Which makes it so awesum to play with. Do please play with it. Get excited and experiment. As a side note with all coverity scan fixes this client is much more stable than PM3 Master even if I tend to break it sometimes. I'll try to make a release when this fork becomes stable between my experiments.
-## Build Status Coverity Scan
-[](https://scan.coverity.com/projects/proxmark3-iceman-fork)
-
-
-## Coverity Scan Config && Run
+##Official
+The official Proxmark repository is found here: https://github.com/Proxmark/proxmark3
+##Coverity Scan Config & Run
Download the Coverity Scan Self-buld and install it.
You will need to configure ARM-NON-EABI- Compiler for it to use:
-:: Configure
-cov-configure --comptype gcc --compiler /opt/devkitpro/devkitARM/bin/arm-none-eabi-gcc
+- Configure
+`cov-configure --comptype gcc --compiler /opt/devkitpro/devkitARM/bin/arm-none-eabi-gcc`
-::run it (I'm running on Ubuntu)
-cov-build --dir cov-int make all UBUNTU_1404_QT4=1
+- run it (I'm running on Ubuntu)
+`cov-build --dir cov-int make all`
-:: make a tarball
-tar czvf proxmark3.tgz cov-int
+- make a tarball
+`tar czvf proxmark3.tgz cov-int`
-:: upload it to coverity.com
+- upload it to coverity.com
-## Whats changed?
-
-Whats in this fork? I have scraped the web for different enhancements to the PM3 source code and not all of them ever found their way to the master branch.
+##Whats changed?
+Whats so special with this fork? I have scraped the web for different enhancements to the PM3 source code and not all of them ever found their way to the master branch.
Among the stuff is
* Jonor's hf 14a raw timing patch
* other obscure patches like for the sammy-mode, (offline you know), tagidentifications, defaultkeys.
* Minor textual changes here and there.
* Simulation of Ultralight/Ntag.
- * Marshmellow's and my "RevEng" addon for the client. Ref: http://reveng.sourceforge.net/
- * Someone's alternative bruteforce Mifare changes.. (you need the two other exe to make it work)
-
+ * Marshmellow's and my "RevEng" addon for the client. Ref: http://reveng.sourceforge.net/ Now using reveng1.31
+ * J-Run alternative bruteforce Mifare nested auths.. (you need one other exe to make it work)
* A Bruteforce for T55XX passwords against tag.
* A Bruteforce for AWID 26, starting w a facilitycode then trying all 0xFFFF cardnumbers via simulation. To be used against a AWID Reader.
-
+ * A Bruteforce for HID, starting w a facilitycode then trying all 0xFFFF cardnumbers via simulation. To be used against a HID Reader.
* Blaposts Crapto1 v3.3
+ * Icsom's legic script and legic enhancements
+ * Aczid's bitsliced bruteforce solver in 'hf mf hardnested'
+
+##Straight from the CHANGELOG
+=============================
+## [1.6.9][icemanfork] [2017-02-06]
+ - Serial speedup, if possible 408600baud otherwise default to 115200baud (iceman)
+ - `hf emv` - Added Peter Fillmore's EMV branch now compiles on iceman fork. See seperate issue. (iceman)
+ - `hf 14a reader` - Aztek detection. (iceman)
+ - `standalone mode` - added more detection of tags and refactored (iceman)
+ - `script run ufodump` - dumps an Aztek tag. (iceman)
+ - `script run hard_autopwn` - runs hardnested attack against all sectors on tag (iceman)
+ - Added lf cotag read, and added it to lf search (iceman)
+ - Added hitag2 read UID only and added that to lf search (marshmellow)
+ - `lf search` - check for if signal is only noice (marshmellow)
+ - `hf 14a reader` - fixed a bug when card has sak 0x00 but still is not UL/NTAG etc. (iceman)
+ - `hf mf sim` / `hf 14a sim` - use random nonce. (micolous)
+ - `hw tune` - only prints out if voltage is detected from antenna. (iceman)
+ - `hf iclass decrypt` - only decrypt Application1 (iceman)
+ - `lf t55xx detect` - when finding multiple possible config blocks, see if a known configblock exists and select. (iceman)
+
+ - Added `hf mf key_brute` - adds J-Runs 2nd phase bruteforce ref: https://github.com/J-Run/mf_key_brute (iceman)
+ - Added `lf jablotron` - adds demod/clone/sim of Jablotron LF tags. (iceman)
+ - Added `lf t55xx recoverpw` - adds a new password recovery using bitflips and partial flips if password write went bad. (alexgrin)
+ - `hf legic` - added improved legic data mapping. (jason)
+ - `hf mf mifare` - added possibility to target key A|B (douniwan5788)
+ - Added `analyse lcr` - added a new main command group, to help analysing bytes & bits & nibbles. (iceman)
+ - Added `lf nedap` - added identification of a NEDAP tag. (iceman)
+ - `lf viking clone` - fixed a bug. (iceman)
+ - Added bitsliced bruteforce solver in `hf mf hardnested` (Aczid)
+ - `hf mf chk` speedup (iceman)
+ - `hf 14a/mf sim x` attack mode, now uses also moebius version of mfkey32 to try finding the key. (iceman)
+ - `hf 14a sim` Added emulation of Mifare cards with 10byte UID length. (iceman)
+ - `hf mf sim` Added emulation of Mifare cards with 10byte UID length. (iceman)
+ - Added `lf guard clone/sim` (iceman)
+ - Added `lf pyramd clone/sim` (iceman)
+ - trying to fix `hf 14b` command to be able to read CALYPSO card. (iceman)
+ - `hf legic load`, it now loads faster and a casting bug is gone. (iceman)
+ - Added `hf legic calccrc8` added a method to calculate the legic crc-8 value (iceman)
+ - `hf legic decode` fixed the output overflow bugs, better printing (iceman)
+ - Coverity Scan fixes a lot of resource leaks, etc (iceman)
+ - Added `lf presco *` commands started (iceman)
+ - Added `lf hid wiegand` added a method to calculate WIEGAND in different formats, (iceman)
+ - `hf mf chkkeys` better printing, same table output as nested, faster execution and added Adam Lauries "try to read Key B if Key A is found" (iceman)
+ - `hf mf nested` better printing and added Adam Lauries "try to read Key B if Key A is found" (iceman)
+ - `hf mf mifare` fixing the zero parity path, which doesn't got called. (iceman)
+ - Updated the @blapost's Crapto1 implementation to v3.3 (blapost)
+ - `hf mf c*` updated the calling structure and refactored of the chinese magic commands (iceman, marshmellow)
+ - Started to add Peter Fillmore's EMV fork into Iceman fork. ref: https://github.com/peterfillmore/proxmark3 (peter fillmore, iceman)
+ - Added Travis-CI automatic build integration with GitHub fork. (iceman)
+ - Updated the Reveng 1.30 sourcecode to 1.31 from Reveng project homepage (iceman)
+ - Updated the Reveng 1.31 sourcecode to 1.40 from Reveng project homepage (iceman)
+
+ - Added possibility to write direct to a Legic Prime Tag (MIM256/1024) without using values from the 'BigBuffer' -> 'hf legic writeRaw <addr> <value>' (icsom)
+ - Added possibility to decrease DCF values at address 0x05 & 0x06 on a Legic Prime Tag
+ DCF-value will be pulled from the BigBuffer (address 0x05 & 0x06) so you have to
+ load the data into the BigBuffer before with 'hf legic load <path/to/legic.dump>' & then
+ write the DCF-Values (both at once) with 'hf legic write 0x05 0x02' (icsom)
+ - Added script `legic.lua` for display and edit Data of Legic-Prime Tags (icsom)
+ - Added the experimental HITAG_S support (spenneb)
+ - Added topaz detection to `hf search` (iceman)
+ - Fixed the silent mode for 14b to be used inside `hf search` (iceman)
-
+---
+##Why don't you merged with offical PM3 Master?
+I don't actually know how to make small pull-request to github :( and that is the number one reason for me not pushing a lot of things back to the PM3 master.
+Me fiddling with the code so much, there is a nightmare in merging a PR. Luckily I have @marshmellow42 who takes some stuff and push PR's back.
+
+##Why don't you add nnnn or mmmm functionality?
Give me a hint, and I'll see if I can't merge in the stuff you have.
+
+##PM3 GUI
+I do tend to rename and move stuff around, the official PM3-GUI from Gaucho will not work so well. *sorry*
-I don't actually know how to make small pull-request to github :( and that is the number one reason for me not pushing a lot of things back to the PM3 master.
+##Development
+This fork now compiles just fine on
+ - Windows/mingw environment with Qt5.6.1 & GCC 4.8
+ - Ubuntu 1404, 1510, 1604
+ - Mac OS X
+
+##Setup and build for UBUNTU
+GC made updates to allow this to build easily on Ubuntu 14.04.2 LTS, 15.10 or 16.04
+See https://github.com/Proxmark/proxmark3/wiki/Ubuntu%20Linux
+
+A nice and cool install script made by @daveio is found here:
+https://github.com/daveio/attacksurface/blob/master/proxmark3/pm3-setup.sh
+
+- Run
+`sudo apt-get install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev gcc-arm-none-eabi`
+
+- Clone iceman fork
+`git clone https://github.com/iceman1001/proxmark3.git`
+
+- Get the latest commits
+`git pull`
+
+- Install the blacklist rules
+`make udev`
+
+- add user to dialout group (if you on a Linux/ubuntu/debian). If you do this one, you need to logout and login in again to make sure your rights got changed.
+`sudo adduser $USER dialout`
+
+- Clean and complete compilation
+`make clean && make all`
-PM3 GUI:
+- Flash the BOOTROM
+`client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf`
-I do tend to rename and move stuff around, the official PM3-GUI from Gaucho will not work so well. *sorry*
+- Flash the FULLIMAGE
+`client/flasher /dev/ttyACM0 armsrc/obj/fullimage.elf`
+
+- Change into the client folder
+`cd client`
+
+- Run the client
+`./proxmark3 /dev/ttyACM0`
+
+##Homebrew (Mac OS X)
+These instructions comes from @Chrisfu, where I got the proxmark3.rb scriptfile from.
+Further questions about Mac & Homebrew, contact @Chrisfu (https://github.com/chrisfu/)
+
+1. Install homebrew if you haven't yet already done so: http://brew.sh/
+2. Tap this repo: `brew tap iceman1001/proxmark3`
-
-DEVELOPMENT:
-
-This fork is adjusted to compile on windows/mingw environment with Qt5.3.1 & GCC 4.8
-For people with linux you will need to patch some source code and some small change to one makefile. If you are lazy, you google the forum and find asper's or holimans makefile or you find your solution below.
-
-GC made updates to allow this to build easily on Ubuntu 14.04.2 LTS.
- - See https://github.com/Proxmark/proxmark3/wiki/Ubuntu%20Linux
- - Generally speaking, if you're running a "later" Proxmark, installation is very easy.
- - Run "sudo apt-get install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget"a
- - Follow these instructions
-Get devkitARM release 41 from SourceForge (choose either the 64/32 ¿bit depending on your architecture, it is assumed you know how to check and recognize your architecture):
-
-(64-bit) http://sourceforge.net/projects/devkitpro/files/devkitARM/previous/devkitARM_r41-x86_64-linux.tar.bz2/download
-(32-bit) http://sourceforge.net/projects/devkitpro/files/devkitARM/previous/devkitARM_r41-i686-linux.tar.bz2/download
-Extract the contents of the .tar.bz2:
- tar jxvf devkitARM_r41-<arch>-linux.tar.bz2
-Create a directory for the arm dev kit:
- sudo mkdir -p /opt/devkitpro/
-Move the ARM developer kit to the newly created directory:
- sudo mv devkitARM /opt/devkitpro/
-Add the appropriate environment variable:
- export PATH=${PATH}:/opt/devkitpro/devkitARM/bin/
-Add the environment variable to your profile:
- echo 'PATH=${PATH}:/opt/devkitpro/devkitARM/bin/ ' >> ~/.bashrc
- - Use the magic build command "make UBUNTU_1404_QT4=1"
-
-Common errors linux/macOS finds
+3. Install Proxmark3: `brew install proxmark3` for stable release or `brew install --HEAD proxmark3` for latest non-stable from GitHub.
+
+##Docker container
+I recently added a docker container on Docker HUB. You find it here: https://hub.docker.com/r/iceman1001/proxmark3/
+Follow those instructions to get it up and running. No need for the old proxspace-environment anymore.
+
+[1.6.0] How to start: https://www.youtube.com/watch?v=b5Zta89Cf6Q
+[1.6.0] How to connect: https://youtu.be/0ZS2t5C-caI
+[1.6.1] How to flash: https://www.youtube.com/watch?v=WXouhuGYEiw
+
+Recommendations: Use only latest container.
+
+
+## Building on Windows
+### 1. QT Open Source
+Download QT 5.6.1: http://download.qt.io/archive/qt/5.6/5.6.1-1/qt-opensource-windows-x86-mingw492-5.6.1-1.exe
+Install to `C:\Qt` and choose the following components to be installed:
+- QT - MinGW 32 bit
+- Tools - MinGW
+
+In your shell from MSYS (see below), make sure you set QTDIR to your QT installation and add its bin to your path as well:
+`export QTDIR=/c/Qt/5.6/mingw49_32`
+`export PATH=$PATH:$QTDIR/bin`
+
+### 2. MSYS
+MSYS is a collection of GNU utilities such as bash, make, gawk and grep to allow building of applications and programs which depend on traditionally UNIX tools to be present. It is intended to supplement MinGW and the deficiencies of the cmd shell.
+
+Download MSYS: http://downloads.sourceforge.net/mingw/MSYS-1.0.11.exe
+
+Follow the installation procedure, you may want to install MSYS to `C:\Qt\msys` and when asked where is your MinGW installation and for its path answer the following: `c:/Qt/Tools/mingw492_32`
+
+### 3. Readline
+Download and unpack: https://sourceforge.net/projects/gnuwin32/files/readline/5.0-1/readline-5.0-1-bin.zip/download
+
+`bin/*` to `C:\Qt\5.6\Tools\mingw492_32\bin`
+`include/*` to `C:\Qt\5.6\Tools\mingw492_32\include`
+`lib/*` to `C:\Qt\5.6\Tools\mingw492_32\lib`
+
+### 4. LibUSB
+Download and unpack: https://sourceforge.net/projects/libusb-win32/files/latest/download?source=files
+
+`include/lusb0_usb.h` to `C:\Qt\5.6\Tools\mingw492_32\include`
+`lib/gcc/libusb.a` to `C:\Qt\5.6\Tools\mingw492_32\lib`
+
+### 5. DevkitPro
+Download and install: https://sourceforge.net/projects/devkitpro/files/latest/download?source=files
+
+You only need devkitARM, nothing more (no extra lib or anything else) to compile the firmware (ARM) side. Assuming you installed it to `C:\devkitpro`, make sure you set the `DEVKITARM` environment variable to `/c/devkitPro/devkitARM` and add its bin to your PATH:
+`export DEVKITARM=/c/devkitPro/devkitARM`
+`export PATH=$PATH:$DEVKITARM/bin`
+
+### 6. Install Strawberry Perl
+Download and install: https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/strawberry-perl/strawberry-perl-5.10.1.3.msi
+
+### 7. Build and run
+Download and install Git for Windows: https://git-scm.com/download/win
+
+- Run minimal system: `C:\Qt\msys\msys.bat`
+
+- Set the environment:
+`export DEVKITARM=/c/devkitPro/devkitARM`
+`export PATH=$PATH:$DEVKITARM/bin`
+`export QTDIR=/c/Qt/5.6/mingw49_32`
+`export PATH=$PATH:$QTDIR/bin`
+
+- Clone iceman fork
+`git clone https://github.com/iceman1001/proxmark3.git`
+
+- Get the latest commits
+`git pull`
+
+- CLEAN COMPILE
+`make clean && make all`
+
+Assuming you have Proxmark3 Windows drivers installed you can run the Proxmark software where "X" is the com port number assigned to proxmark3 under Windows.
-Error:
- * \client\makefile the parameter -lgdi32
-Solution:
- * Remove parameter.
+- Flash the BOOTROM
+`client/flasher.exe comX -b bootrom/obj/bootrom.elf`
+
+- Flash the FULLIMAGE
+`client/flasher.exe comX armsrc/obj/fullimage.elf`
-Error:
- * Using older Qt4.6 gives compilation errors.
-Solution
- * Upgrade to Qt5.3.1
- OR
- * Change these two line in \client\makefile
- CXXFLAGS = -I$(QTDIR)/include -I$(QTDIR)/include/QtCore -I$(QTDIR)/include/QtGui -I$(QTDIR)/include/QtWidgets -I/mingw/include
- QTLDLIBS = -L$(QTDIR)/lib -lQt5Core -lQt5Gui -lQt5Widgets
-
- TO
-
- CXXFLAGS = -I$(QTDIR)/include -I$(QTDIR)/include/QtCore -I$(QTDIR)/include/QtGui
- QTLDLIBS = -L$(QTDIR)/lib -lQtCore4 -lQtGui4
+- Change into the client folder
+`cd client`
+- Run the client
+`proxmark3.exe comX`
+
+##Buying a proxmark3
+The Proxmark 3 device is available for purchase (assembled and tested) from the following locations:
+
+ * http://proxmark3.tictail.com/ (For buyers in EU, most likely in Sweden)
+
+ * http://www.elechouse.com/ (new and revised hardware package 2015, located in China)
+
-An old Qt4 version makefile is found here: http://www.icesql.se/proxmark3/code/linuxmakefile.txt but this one doesn't have all new files in it. So I don't recommend it.
-
+##Enjoy
January 2015, Sweden
iceman at host iuse.se
-The Proxmark 3 is available for purchase (assembled and tested) from the
-following locations:
- * http://www.elechouse.com (new and revised hardware package 2015)
-
+##Note from Jonathan Westhues
Most of the ultra-low-volume contract assemblers could put
something like this together with a reasonable yield. A run of around
a dozen units is probably cost-effective. The BOM includes (possibly-
projects / proxmark3-svn / blobdiff