CHG: saw @menshiyun 's change to localtime on github.
CHG: make sure that the 'iceman' label is in the version text. This is purely to make sure if they are using my fork or not.
CHG: according to measureement by @wilrn the actual timing for receiving tag data, is 90us (ONE) and 100us (ZERO) which is not mentioned anywhere before. What a find!
CHG: lowered the timout again, but re-added the spindelay since 14a requires 5ms powerup before entering the idle-state where tag starts to listen.
CHG: fix the ticks compare xx > 1 into xx >= 1
FIX: "hf 14a read" / "hf mf *" / "hf mfdes info" and failure when calling these commands serveral times in row.
For long transactions the sspclock compare with >1 instead of >=1 .. Now the timer resets properly.
CHG: use some #define constants for iso-commands.
FIX: This commit fixes the broken LF since I change the spindelay calls. The original problem is that spindelayus calls is incremented with21.3us each step, making it very hard to find exact timings found in the datasheets for T55x7, HID etcetc. When @marshmellow and I looked into this 2014, I had this on my back of my mind but forgot it since I didn't know how the source code / pm3 worked. This behavior in spindelayus has given the bit-period for ON/OFF measured in (us) very hard to find. Its kind of magic that it worked so far so good. Well until I started to look into the "hf legic" bitbanging ASK ON/OFF keying and that one needs a much more precis timer. Same goes for the PCF7931 code.
I've added a precise timer in the new files ticks.c and moved some older stuff from util.c to have a solid base for this.
UNTESTED, and the timings measured for t55x7 in lfops.c and other parts has not been adjusted to this "correct" timer.
CHG: reverted back from the idea of measureing in (us) microseconds, the timer is too raw, gives 10-15us delays. Now we are measuring ticks, which is (1 us = 1.5ticks)
like it was before. ie: 80us = 80*1.5 = 120ticks.
iceman1001 [Wed, 31 Aug 2016 17:17:39 +0000 (19:17 +0200)]
FIX: Forget that the prng was 0x8000 length and not 0xFFFF. Sorry. Also returned to the decomposed loop. Don't know if this armsrc optimises this at compilation time. Does someone know?
CHG: returned the iso14443a_setup order, it might influence my older PM3 device.
*Note* my Elechouse revisions PM3 works great with this but my older xpfga (green pcb) is hopeless. It can't fix onto the nonces in 'hf mf mifare' I think its too slow.
iceman1001 [Wed, 24 Aug 2016 10:37:31 +0000 (12:37 +0200)]
FIX: the underlaying bug on deviceside code. The SSPCLOCK wasn't reset to zero sometimes. More specific, TC2 wasn't reset cause all sorts of timing issues for the device side randomly. Like 'hf mf mifare', like iclass, like 'hf mf sim' etc etc.
iceman1001 [Sun, 21 Aug 2016 18:51:29 +0000 (20:51 +0200)]
CHG: updated Reveng version from 1.4.0 -> 1.4.4 .
---snippet from their update log:
1.4.4 27 July 2016
Added 5 new algorithms, CRC-8/AUTOSAR, CRC-8/OPENSAFETY, CRC-16/OPENSAFETY-A, CRC-16/OPENSAFETY-B and CRC-32/AUTOSAR from the CRC Catalogue.
Added a build option to verify the order of the preset and alias tables at compile time.
1.4.3 14 July 2016
Added algorithm CRC-16/CMS from the CRC Catalogue.
1.4.2 8 July 2016
Added algorithm CRC-16/PROFIBUS from the CRC Catalogue.
1.4.1a 29 June 2016
Fixed a regression that caused the Windows release to crash on older systems.
1.4.1 27 June 2016
-P sets the Width value just like -k.
pcmp() quickly returns when the comparands are identical.
Added resources for the Windows executable.
iceman1001 [Sun, 14 Aug 2016 15:04:40 +0000 (17:04 +0200)]
ADD: added a sanity check in T55x7 commands info/trace/detect against useing the commands when device is in offline but user didn't use '1' in arguments.
iceman1001 [Wed, 10 Aug 2016 14:23:59 +0000 (16:23 +0200)]
CHG: on a slow usb connection it seems the pingcmd which stops the bruteforce on deviceside doesnt get there. Lets send three pings to make sure the device gets it.
iceman1001 [Tue, 9 Aug 2016 09:56:06 +0000 (11:56 +0200)]
ADD: 'lf awid brute' is now possible to give a starting cardnumber. if given, the bruteforce loops from it as a mid point. Testing one step up, then one step down until it reaches 65535 and 0.
CHG: 'lf awid brute' inputs are now changed, take notice to new format.
iceman1001 [Mon, 8 Aug 2016 15:49:30 +0000 (17:49 +0200)]
ADD: J-Run's 2nd phase tool mf_key_brute ref: https://github.com/J-Run/mf_key_brute Estimated time to search keyspace is ~18min.
J_Run's 2nd phase of multiple sector nested authentication key recovery
You have a known 4 last bytes of a key recovered with mf_nonce_brute tool.
First 2 bytes of key will be bruteforced
Usage: hf mf keybrute [h] <block number> <A|B> <key>
options:
h this help
<block number> target block number
<A|B> target key type
<key> candidate key from mf_nonce_brute tool
samples:
hf mf keybrute 1 A 000011223344