-
-
Notifications
You must be signed in to change notification settings - Fork 980
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
LF HITAG - fails #124
Comments
Looking at hitag.c in armsrc, gives you that it uses its own clock definition. |
More ppl has also notice this, see Proxmark/proxmark3#798 |
A missing TC0 init and bobs your uncle. |
Not quite :)
|
For it works for me.
|
The reading distance is crap. I must have it direct on antenna. |
As seen below, I need to position the tag until it reads.
|
Sorry for capturing this post, but what do you mean by highQ and lowQ antenna?
Is meant the signal quality or a special antenna.
Thanks.
Gesendet von ProtonMail mobile
…-------- Original-Nachricht --------
An 13. März 2019, 12:20, Philippe Teuwen schrieb:
Not quite :)
- RRG loaded on Pm3 Easy : 👍
- RRG loaded on Pm3 rdv4 : 👎
- With original highQ antenna : nothing
- With lowQ antenna : sometimes it gets some part of the frame, but not all
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, [view it on GitHub](#124 (comment)), or [mute the thread](https://github.com/notifications/unsubscribe-auth/ANOycY9FiPvEK41K83QRjILxeuAyHXhvks5vWN8AgaJpZM4bnGYM).
|
@gtpy they're referring to antennas with different Q factors. As far as I know the highQ antenna is the one that currently comes with the PM3 RDV4, and the lowQ antenna I believe is a new one currently in development. @iceman1001 have you got a photo of your tag position when it's getting a solid reading? |
That would be the new prototypes for LF antennas. The old one had HighQ which communicated with T55X7 cards badly. The new prototype has lower Q value with less general reading distances but much better communications with t55x7 https://pbs.twimg.com/media/D0tnnqkV4AAtybM.png:large And there is prototype to replace the dual antenna, a medium and a large prototype. |
Tested offical repo on RDV4, works but equal crappy distance and need to find a sweetspot with the tag. |
Thanks for information @Danyc0 @iceman1001 |
So my latest tests:
|
The current LF peak detection could be better if I understand the comments I have gotten on Twitter etc. |
@doegox just showed a 9cm readout, but its done manually. |
FTR:
I'm missing the very last bit, probably Edit : last bit was a bug in Manchester decoder, now fixed |
I like the workaround of @doegox but I do not get the connection of 000111 to Start_Auth [11000] ? |
Hehe someone noticed, good catch @bosb .
The leading symbol can be a "0" or "1", it doesn't matter, it's just to introduce a first pause in front of the actual signal. |
Hello, i got an proxmark3 rdv4 end of 2018. Only problem is that rdv4.0 was shipped end of 2018 with the hiQ antenna. Thanks, |
For hitag I don't think you need the lowQ antenna. The HitagS is already in this repo. but the state of how they work is unknown since there seem to be few ppl who has a Hitag reader & cards & proxmark to play with. I think most of hitag problems is software related, given @doegox 's success using lf cmdread.. |
well the state of hitagS here can't handle tags in standard mode, only advance mode.. I submitted last year a refactoring to normal proxmark3 repo, and would merge it here. regarding to doegox comment
i didn't try a lot with my antennas, so i will write some dummy code this week and play around with my antennas if its really just software related i should get any signal. Same time i wrote the stores if its possible to just order the antennas (cause i can't find the products) i will keep you updated, if i will get signal with dummy code i will refactor the hitag code at this weekend. |
yup, I never took your changes since the core hitag code desperate needs a refactoring. |
can you may provide me code samples? would for sure help.. you can mail it to my private e-mail username @ gmail ;) well im not so sure if the original rdv4 antenna is just a software problem but i will find out when starting refactoring. but even with the command i have to place the hitags card really precisely on the antenna. with old (non rdv4 proxmark) i can even hame some space between antenna and tag |
@doegox are you sure the manchester decoder last bit is fixed? My UID last bit is a 0 using your sample code, while |
Well it worked on my UID, I didn't do intensive tests and I have one single Hitag... |
@doegox Got a branch for you to test |
Hitag read / write should work better but it is untested for crypto mode / password mode. |
I've tested HITAG2 wakeup, reading in crypto and password mode, and it works perfectly! |
that is the big issue. We have the bigbuff... which is shared for tracelog and the signal decoding. Good thing it works again. |
My intuition would be to simply reserve a (configurable?) chunk of the bigbuf for raw samples and opportunistically log to it until that area is full. For all situations a small chunk of analog samples would already be really helpful and should not interfere with space for the tracelog, as the amount of trace data generated is relatively small in all LF applications (AFAIK). For some situations you might want to choose between fully analog or fully digital logging. As a user, I think it would be great if I could just configure a setting that sets a dividing line between the digital and analog sample area. The rest of the code should just respect that boundary and use 2 separate logging interfaces to log data to each area. How does the EM4x50 reader accomplish the trick of showing me digital data and an annotated modulation waveform? Trickery that goes outside of this dual log interface I imagine it should have? |
64kb ram, whereas recent mods to stack size and bigbuffer making it adjustable. Around 41kb at the momemt. We havent sorted out all different usages and documented it yet. Then those needs to be adapted if possible. Which is all another story but it relates as it touches the same problem about LF for tracelog/raw signal data. Let me first highlight what is possible today. The tracelog part isn't large if you look at normal comms for hitag. Its when you start trying to log and implement the attacks that you start get into troubles. If you gonna do the extended attack, its gonna eat up some 2-4kb. For just log, Now, for the attacks you can not simply keep the raw signal for it. We just don't have space. We have space for about one-two transactions raw signal. So you compromise which raw signal parts you wanna see, but you never gonna see the signal from a whole extended attack. The proxmark way of saving raw signals on device side is an issue about available RAM. HF parts of proxmark usually don't save raw signals. With the 30kb inside fpga being able to log the last samples, is what we can do there but difference is the decoding is done much more on FPGA side, leading to smaller memory requirements on the device side. With more RAM available for simulation memory, tracelog, crypto etc. Maybe add a custom HITAG decode for the FPGA to save some space, but loose raw samples... I am not sure at all what you suggest the em 4x50_read command does. It certainly doesn't use the tracelog. Feel free to come up with a better solution! |
Keeping analog samples when running attacks or other intensive work makes no sense. It's most useful when building an emulator of the reader or the tag, and may also be helpful when sniffing to get the full picture. That's the use case I'm thinking about. I think it can also be useful as a teaching aid.
This is what I want. I simply want to run regular LF commands and see a glimpse of the raw samples collected along the way.
This is what I meant by sending the sample buffer to the host. This seems useful for my usecase and most non-standalone use cases that don't need to send a lot of data back and forth to the tag. Thanks for claryfing. I understand a hitag solution has to work differently.
I agree HF is out of scope here. |
look at signal
look at tracelog.
|
The first parts of samples == tracelog |
Oh man. I was expecting the sample data at the start of the buffer when doing 'data samples'. This is honestly pretty confusing. |
Before there was only two parts... some noice in the beginning of bigbuf (samples) which is the trace log data. Now it seems a signal seems to be inside... |
Describe the bug
the lf hitag commands fails to work
To Reproduce
Steps to reproduce the behavior:
Expected behavior
fully functional / verified working card operations with pm3 and a hitag card.
Desktop (please complete the following information):
Additional context
This problem has existed for a while, @doegox brought this to my attention some days ago.
found a hitag2 card today and could verify that the hitag2 commands doesn't work.
The text was updated successfully, but these errors were encountered: