Back to Proxmark3

Standalone Modes

armsrc/Standalone/readme.md

4.923711.8 KB
Original Source

Standalone Modes

<a id="Top"></a>

Table of Contents

Standalone modes run directly on the Proxmark3 device without a connected host computer. See Developing Standalone Modes for how to build your own.

Only one (1) mode can be compiled into the firmware at a time (except via DANKARMULTI).

Individual Mode Documentation

LF (Low Frequency — 125 kHz) Standalone Modes

Mode IDDocumentDescriptionHardware
LF_SAMYRUNSamyRunHID26 read/clone/simulate (Samy Kamkar)Generic
LF_EM4100EMULEM4100 EmulatorSimulate predefined EM4100 tag IDsGeneric
LF_EM4100RSWBEM4100 RSWBRead/simulate/write/brute EM4100 (4 slots)RDV4 (flash)
LF_EM4100RSWWEM4100 RSWWRead/simulate/write/wipe/validate EM4100RDV4 (flash)
LF_EM4100RWCEM4100 RWCRead/simulate/clone EM4100 (16 slots)RDV4 (flash)
LF_HIDBRUTEHID Corporate BruteHID Corporate 1000 card number bruteforceGeneric
LF_HIDFCBRUTEHID FC BruteHID facility code bruteforce (0–255)RDV4 (flash)
LF_ICEHIDIceHID CollectorMulti-format LF credential collector to flashRDV4 (flash)
LF_MULTIHIDMultiHIDHID 26-bit multi-card simulatorGeneric
LF_NEDAP_SIMNedap SimulatorNedap RFID simple tag simulatorGeneric
LF_NEXIDNexID CollectorNexwatch credential collector to flashRDV4 (flash)
LF_PROXBRUTEProxBruteHID ProxII card number bruteforceGeneric
LF_PROX2BRUTEProx2BruteHID ProxII bruteforce v2 (faster, configurable)Generic
LF_THAREXDETharexde EM4x50EM4x50 simulate/read/collectRDV4 (flash)
LF_SKELETONSkeleton TemplateDevelopment template for new LF modesGeneric

HF (High Frequency — 13.56 MHz) Standalone Modes

Mode IDDocumentDescriptionHardware
HF_14ASNIFF14A SnifferISO14443A passive sniffer to flashRDV4 (flash)
HF_14BSNIFF14B SnifferISO14443B passive sniffer to flashRDV4 (flash)
HF_15SNIFF15693 SnifferISO15693 sniffer to flashRDV4 (flash)
HF_15SIM15693 SimulatorISO15693 dump and simulateRDV4 (flash)
HF_AVEFULAveful UL ReaderMIFARE Ultralight read and emulateGeneric
HF_BOGBogitoRun Auth Sniffer14A sniff with ULC/ULEV1/NTAG auth captureRDV4 (flash)
HF_CARDHOPPERCardHopper RelayLong-range 14A relay over serial/IPRDV4 (BT)
HF_COLINVIGIKPWNMIFARE Classic ultra-fast sniff/sim/cloneRDV4 (flash)
HF_CRAFTBYTECraftByte UID StealerScan and emulate ISO14443A UIDsGeneric
HF_DOEGOX_AUTH0UL-C/UL-AES UnlockerUnlock password-protected Ultralight tagsGeneric
HF_EMVPNGEMV Visa Reader/EmulatorRead Visa EMV cards and emulate transactionsRDV4 (flash)
HF_ICECLASSIceClass iCLASSiCLASS multi-mode: sim/dump/attack/configRDV4 (flash)
HF_LEGICLegic Prime ReaderRead and simulate Legic Prime tagsGeneric
HF_LEGICSIMLegic Prime SimulatorSimulate Legic Prime dumps from flash (15 slots)RDV4 (flash)
HF_MATTYRUNMattyRun MFC CloneMIFARE Classic key check, dump, and emulateGeneric
HF_MFCSIMMFC SimulatorSimulate MIFARE Classic 1K from flash (15 slots)RDV4 (flash)
HF_MSDSALMSD Visa ReaderRead and emulate Visa MSD cardsGeneric
HF_REBLAYReblay BT RelayISO14443A relay over BluetoothRDV4 (BT)
HF_ST25_TEAROFFST25TB Tear-offST25TB store/restore with counter tear-offRDV4 (flash)
HF_TCPRSTIKEA RothultIKEA Rothult ST25TA master key dump/emulationGeneric
HF_TMUDFORDISO15693 UID EmulatorRead and emulate ISO15693 UIDsGeneric
HF_UNISNIFFUniversal SnifferMulti-protocol sniffer (14A/14B/15/iCLASS)RDV4 (flash)
HF_YOUNGYoung MFC Sniff/SimMIFARE sniff/simulation with 2-bank storageGeneric

Multi-Mode Loader

Mode IDDocumentDescription
DANKARMULTIDankarmulti LoaderCombine multiple standalone modes into one firmware image

Developing Standalone Modes

This contains functionality for different StandAlone modes. The fullimage will be built given the correct compiler flags used. Build targets for these files are contained in Makefile.inc and Makefile.hal

If you want to implement a new standalone mode, you need to implement the methods provided in standalone.h. Have a look at the skeleton standalone mode, in the file lf_skeleton.c.

As it is now, you can only have one standalone mode installed at the time unless you use the dankarmulti mode (see dankarmulti.c on how to use it).

To avoid clashes between standalone modes, protect all your static variables with a specific namespace. See how it is done in the existing standalone modes.

Implementing a standalone mode

^Top

We suggest you keep your standalone code inside the armsrc/Standalone folder. And that you name your files according to your standalone mode name.

The standalone.h states that you must have two functions implemented.

The ModInfo function, which is your identification of your standalone mode. This string will show when running the command hw status on the client.

The RunMod function, which is your "main" function when running. You need to check for Usb commands, in order to let the pm3 client break the standalone mode. See this basic skeleton of main function RunMod() and Modinfo() below.

void ModInfo(void) {
    DbpString("  LF good description of your mode - aka FooRun (your name)");
}

void RunMod(void) {
    // led show
    StandAloneMode();

    // Do you target LF or HF?
    FpgaDownloadAndGo(FPGA_BITSTREAM_LF);

    // main loop
    for (;;) {
        WDT_HIT();

        // exit from standalone mode, just send a usbcommand
        if (data_available()) break;

        // do your standalone stuff..
    }

Naming your standalone mode

^Top

We suggest that you follow these guidelines:

  • Use HF/LF to denote which frequency your mode is targeting.
  • Use you own github name/similar for perpetual honour to denote your mode.

sample: LF_FOO

Which indicates your mode targets LF and is called FOO.

This leads to your next step, your DEFINE name needed in Makefile.

WITH_STANDALONE_LF_FOO

Update MAKEFILE.HAL

^Top

Add your mode to the Makefile.hal help and modes list (alphabetically):

+==========================================================+
| STANDALONE      | DESCRIPTION                            |
+==========================================================+
...
+----------------------------------------------------------+
| LF_FOO          | My foobar mode will make you coffee    |
+----------------------------------------------------------+

STANDALONE_MODES := LF_... LF_FOO
STANDALONE_MODES += HF_...

If your mode is using one of the unique features of the RDV4, add it to the proper list:

STANDALONE_MODES_REQ_SMARTCARD :=
STANDALONE_MODES_REQ_FLASH :=
STANDALONE_MODES_REQ_BT :=

Please respect alphabetic order!

Update MAKEFILE.INC

^Top

Add your source code files like the following sample in the Makefile.inc

# WITH_STANDALONE_LF_SKELETON
ifneq (,$(findstring WITH_STANDALONE_LF_SKELETON,$(APP_CFLAGS)))
    SRC_STANDALONE = lf_skeleton.c
endif

# WITH_STANDALONE_LF_FOO
ifneq (,$(findstring WITH_STANDALONE_LF_FOO,$(APP_CFLAGS)))
    SRC_STANDALONE = lf_foo.c
endif

Please respect alphabetic order!

Adding identification string of your mode

^Top

Do please add a identification string in a function called ModInfo inside your source code file. This will enable an easy way to detect on client side which standalone mode has been installed on the device.

void ModInfo(void) {
    DbpString("  LF good description of your mode - aka FooRun (your name)");
}

Compiling your standalone mode

^Top

Once all this is done, you and others can now easily compile different standalone modes by just selecting one of the standalone modes (list in Makefile.hal or ) , e.g.:

  • rename Makefile.platform.sample -> Makefile.platform
  • edit the "STANDALONE" row inside Makefile.platform. You need to uncomment it and add your standalone mode name

Makefile.platform.sample

# If you want to use it, copy this file as Makefile.platform and adjust it to your needs
PLATFORM=PM3RDV4
#PLATFORM_EXTRAS=BTADDON
#STANDALONE=LF_SAMYRUN

becomes

Makefile.platform

# If you want to use it, copy this file as Makefile.platform and adjust it to your needs
PLATFORM=PM3RDV4
#PLATFORM_EXTRAS=BTADDON
STANDALONE=LF_FOO

Remember only one can be selected at a time for now.

The final steps is to

  • force recompilation of all code. make clean
  • compile make -j
  • flash your device
  • connect to your device
  • press button long time to trigger ledshow and enter your new standalone mode
  • if connected with usb / fpc , you can also see debug statements from your device in standalone mode. Useful for debugging :)

When compiling you will see a header showing what configurations your project compiled with. Make sure it says your standalone mode name.

Submitting your code

^Top

Once you're ready to share your mode, please

  • add a line in CHANGELOG.md
  • add your mode in the modes table in doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
  • add your mode in tools/build_all_firmwares.sh such that it reflects armsrc/Standalone/Makefile.hal list of firmwares to build.

Please respect alphabetic order of standalone modes everywhere!

Then submit your PR.

Once approved, add also your mode in https://github.com/RfidResearchGroup/proxmark3/wiki/Standalone-mode

Happy hacking!