search

RfidResearchGroup / proxmark3

Iceman Fork - Proxmark3
http://www.icedev.se
GNU General Public License v3.0
4.01k stars 1.05k forks source link

Unable to detect EM 4x50 tags. #1684

Closed T0py closed 2 years ago

T0py commented 2 years ago

Describe the bug I am no longer able to read a known (and functional) EM 4x50 tag after upgrading from an old firmware.

To Reproduce Steps to reproduce the behaviour: Fresh install of MacOS Monterey on a 2015 MBP

  1. Download and install xCode 13.4 (extract .xip and move app into applications folder)
  2. Download and install Command Line Tools for xCode 13.4
  3. Install ‘brew’ 
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
  4. brew install git readline qt5 pkgconfig coreutils openssl
  5. brew install recode
  6. brew install astyle
  7. brew install RfidResearchGroup/proxmark3/arm-none-eabi-gcc
  8. git clone https://github.com/RfidResearchGroup/proxmark3.git
  9. cd proxmark3
  10. cp Makefile.platform.sample Makefile.platform
  11. Edit Makefile.platform, uncomment the line #PLATFORM_EXTRAS=BTADDON by removing the #. Note, I tried compilation with and without this line uncommented.
  12. make clean; make -j
  13. ./pm3-flash-fullimage

In order to flash the full image, button needs to be held down as device is plugged into PC.

Once connected, I run the following commands for diagnostics:

[usb] pm3 --> hw status
[#] Memory
[#]   BigBuf_size............. 38832
[#]   Available memory........ 38832
[#] Tracing
[#]   tracing ................ 1
[#]   traceLen ............... 0
[#] Current FPGA image
[#]   mode.................... HF image 2s30vq100 2022-03-23 17:21:16
[#] Flash memory
[#]   Baudrate................ 24 MHz
[#]   Init.................... OK
[#]   Memory size............. 2 mbits / 256 kb
[#]   Unique ID............... 0xD5690C23DF8D402A
[#] Smart card module (ISO 7816)
[#]   version................. v3.10
[#] LF Sampling config
[#]   [q] divisor............. 95 ( 125.00 kHz )
[#]   [b] bits per sample..... 8
[#]   [d] decimation.......... 1
[#]   [a] averaging........... yes
[#]   [t] trigger threshold... 0
[#]   [s] samples to skip..... 0 
[#] 
[#] LF T55XX config
[#]            [r]               [a]   [b]   [c]   [d]   [e]   [f]   [g]
[#]            mode            |start|write|write|write| read|write|write
[#]                            | gap | gap |  0  |  1  | gap |  2  |  3
[#] ---------------------------+-----+-----+-----+-----+-----+-----+------
[#] fixed bit length (default) |  29 |  17 |  15 |  47 |  15 | N/A | N/A | 
[#]     long leading reference |N/A | N/A | N/A | N/A | N/A | N/A | N/A | 
[#]               leading zero |N/A | N/A | N/A | N/A | N/A | N/A | N/A | 
[#]    1 of 4 coding reference |N/A | N/A | N/A | N/A | N/A | N/A | N/A | 
[#] 
[#] HF 14a config
[#]   [a] Anticol override.... std    ( follow standard )
[#]   [b] BCC override........ std    ( follow standard )
[#]   [2] CL2 override........ std    ( follow standard )
[#]   [3] CL3 override........ std    ( follow standard )
[#]   [r] RATS override....... std    ( follow standard )
[#] Transfer Speed
[#]   Sending packets to client...
[#]   Time elapsed................... 500ms
[#]   Bytes transferred.............. 294400
[#]   Transfer Speed PM3 -> Client... 588800 bytes/s
[#] Various
[#]   Max stack usage......... 4088 / 8480 bytes
[#]   Debug log level......... 1 ( error )
[#]   ToSendMax............... -1
[#]   ToSend BUFFERSIZE....... 2308
[#]   Slow clock.............. 33104 Hz
[#] Installed StandAlone Mode
[#]   LF HID26 standalone - aka SamyRun (Samy Kamkar)
[#] Flash memory dictionary loaded
[#] 

[usb] pm3 --> hw version

 [ Proxmark3 RFID instrument ]

 [ CLIENT ]
  Iceman/master/v4.14831-621-g171133803 2022-06-10 06:02:50 370eb7151
  compiled with............. Clang/LLVM Apple LLVM 13.1.6 (clang-1316.0.21.2.5)
  platform.................. OSX / x86_64
  Readline support.......... present
  QT GUI support............ present
  native BT support......... absent
  Python script support..... absent
  Lua SWIG support.......... present
  Python SWIG support....... absent

 [ PROXMARK3 ]
  device.................... RDV4
  firmware.................. RDV4
  external flash............ present
  smartcard reader.......... present
  FPC USART for BT add-on... present

 [ ARM ]
  bootrom: Iceman/master/v4.14831-621-g171133803 2022-06-10 06:02:32 370eb7151
       os: Iceman/master/v4.14831-621-g171133803 2022-06-10 06:02:46 370eb7151
  compiled with GCC 10.2.1 20201103 (release)

 [ FPGA ] 
  LF image 2s30vq100 2022-03-23 17:21:05
  HF image 2s30vq100 2022-03-23 17:21:16
  HF FeliCa image 2s30vq100 2022-03-23 17:21:27
  HF 15 image 2s30vq100 2022-03-23 17:21:38

 [ Hardware ]
  --= uC: AT91SAM7S512 Rev A
  --= Embedded Processor: ARM7TDMI
  --= Internal SRAM size: 64K bytes
  --= Architecture identifier: AT91SAM7Sxx Series
  --= Embedded flash memory 512K bytes ( 65% used )

[usb] pm3 --> data tune
[=] ---------- Reminder ------------------------
[=] `hw tune` doesn't actively tune your antennas,
[=] it's only informative.
[=] Measuring antenna characteristics, please wait...
 🕛   9
[=] ---------- LF Antenna ----------
[+] LF antenna: 37.58 V - 125.00 kHz
[+] LF antenna: 27.33 V - 134.83 kHz
[+] LF optimal: 37.58 V - 125.00 kHz
[+] Approx. Q factor (*): 5.7 by frequency bandwidth measurement
[+] Approx. Q factor (*): 6.6 by peak voltage measurement
[+] LF antenna is OK
[=] ---------- HF Antenna ----------
[+] HF antenna: 44.98 V - 13.56 MHz
[+] Approx. Q factor (*): 7.8 by peak voltage measurement
[+] HF antenna is OK

(*) Q factor must be measured without tag on the antenna

[+] Displaying LF tuning graph. Divisor 88 (blue) is 134.83 kHz, 95 (red) is 125.00 kHz.

[!] ⚠️  You appear to be on a MacOS device without XQuartz.
[!] ⚠️  You may need to install XQuartz (https://www.xquartz.org/) to make the plot work.

Everything looks okay as far as I can tell. Lets try some known standard cards:

[usb] pm3 --> lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=] 
[=] Checking for known tags...
[=] 
[+] [H10301  ] HID H10301 26-bit                FC: 111  CN: 77777  parity ( ok )
[+] [ind26   ] Indala 26-bit                    FC: 111  CN: 77  parity ( ok )
[=] found 2 matching formats
[+] DemodBuffer:
[+] <REDACTED>

[=] raw: <REDACTED>

[+] Valid HID Prox ID found!

[=] Couldn't identify a chipset

And HF:

[usb] pm3 --> hf search
 🕛  Searching for iCLASS / PicoPass tag...   
[+] iCLASS / Picopass CSN: 00 11 22 33 44 55 66 EE 

[+] Valid iCLASS tag / PicoPass tag found

Both are working as expected:

Let's put the em 4x50 tag back on: 

[usb] pm3 --> lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=] 
[=] Checking for known tags...
[=] 
 🕑 Searching for COTAG tag......

[-] ⛔ No data found!
[?] Maybe not an LF tag?

Nothing

Expected behavior A previous firmware from around 2020 was used to take the following dump of the em 4x50 tag:

[fpc] pm3 --> lf em 4x50_info

[=] --- Tag Information ---------------------------
[=] -------------------------------------------------------------

[=] EM4x50 data:

[=]   # | word (msb)  | word (lsb)  | desc
[=] ----+-------------+-------------+--------------------
[=]   0 | 00 00 00 00 | 00 00 00 00 | password, write only
[=]   1 | 00 00 00 00 | 00 00 00 00 | protection cfg (locked)
[=]   2 | 00 00 00 00 | 00 00 00 00 | control cfg (locked)
[=]   3 | 00 00 00 00 | 00 00 00 00 | user data
[=]   4 | 00 00 00 00 | 00 00 00 00 | user data
[=]   5 | 00 00 00 00 | 00 00 00 00 | user data
[=]   6 | 00 00 00 00 | 00 00 00 00 | user data
[=]   7 | 00 00 00 00 | 00 00 00 00 | user data
[=]   8 | 00 00 00 00 | 00 00 00 00 | user data
[=]   9 | 00 00 00 00 | 00 00 00 00 | user data
[=]  10 | 00 00 00 00 | 00 00 00 00 | user data
[=]  11 | 00 00 00 00 | 00 00 00 00 | user data
[=]  12 | 00 00 00 00 | 00 00 00 00 | user data
[=]  13 | 00 00 00 00 | 00 00 00 00 | user data
[=]  14 | 00 00 00 00 | 00 00 00 00 | user data
[=]  15 | 00 00 00 00 | 00 00 00 00 | user data
[=]  16 | 00 00 00 00 | 00 00 00 00 | user data
[=]  17 | 00 00 00 00 | 00 00 00 00 | user data
[=]  18 | 00 00 00 00 | 00 00 00 00 | user data
[=]  19 | 00 00 00 81 | 81 00 00 00 | user data
[=]  20 | 81 81 80 80 | 01 01 81 81 | user data
[=]  21 | 82 81 81 81 | 81 81 81 41 | user data
[=]  22 | 81 81 81 81 | 81 81 81 81 | user data
[=]  23 | 80 80 81 81 | 81 81 01 01 | user data
[=]  24 | 81 81 82 82 | 41 41 81 81 | user data
[=]  25 | 81 82 82 81 | 81 41 41 81 | user data
[=]  26 | 82 82 82 81 | 81 41 41 41 | user data
[=]  27 | 82 82 81 81 | 81 81 41 41 | user data
[=]  28 | 81 81 80 80 | 01 01 81 81 | user data
[=]  29 | 81 81 81 81 | 81 81 81 81 | user data
[=]  30 | 81 80 80 81 | 81 01 01 81 | user data
[=]  31 | 80 80 81 81 | 81 81 01 01 | user data
[=]  32 | 81 81 82 81 | 81 41 81 81 | device serial number (read only)
[=]  33 | 81 81 81 81 | 81 81 81 81 | device identification (read only)
[=] ----+-------------+-------------+--------------------

[=] ---- Configuration ----
[=] first word read    0
[=] last word read     0
[=] password check   off
[=] read after write off

[=] --------- Protection ---------
[=] first word read protected    0
[=] last word read protected     0
[=] first word write inhibited   0
[=] last word write inhibited    0

[=] zero values may indicate read protection

[fpc] pm3 --> lf em 4x50_dump
[=] reading EM4x50 tag
[=] EM4x50 data:

[=]   # | word (msb)  | word (lsb)  | desc
[=] ----+-------------+-------------+--------------------
[=]   0 | 00 00 00 00 | 00 00 00 00 | password, write only
[=]   1 | 00 00 00 00 | 00 00 00 00 | protection cfg (locked)
[=]   2 | 00 00 00 00 | 00 00 00 00 | control cfg (locked)
[=]   3 | 00 00 00 00 | 00 00 00 00 | user data
[=]   4 | 00 00 00 00 | 00 00 00 00 | user data
[=]   5 | 00 00 00 00 | 00 00 00 00 | user data
[=]   6 | 00 00 00 00 | 00 00 00 00 | user data
[=]   7 | 00 00 00 00 | 00 00 00 00 | user data
[=]   8 | 00 00 00 00 | 00 00 00 00 | user data
[=]   9 | 00 00 00 00 | 00 00 00 00 | user data
[=]  10 | 00 00 00 00 | 00 00 00 00 | user data
[=]  11 | 00 00 00 00 | 00 00 00 00 | user data
[=]  12 | 00 00 00 00 | 00 00 00 00 | user data
[=]  13 | 00 00 00 00 | 00 00 00 00 | user data
[=]  14 | 00 00 00 00 | 00 00 00 00 | user data
[=]  15 | 00 00 00 00 | 00 00 00 00 | user data
[=]  16 | 00 00 00 00 | 00 00 00 00 | user data
[=]  17 | 00 00 00 00 | 00 00 00 00 | user data
[=]  18 | 00 00 00 00 | 00 00 00 00 | user data
[=]  19 | 00 00 00 81 | 81 00 00 00 | user data
[=]  20 | 81 81 80 80 | 01 01 81 81 | user data
[=]  21 | 82 81 81 81 | 81 81 81 41 | user data
[=]  22 | 81 81 81 81 | 81 81 81 81 | user data
[=]  23 | 80 80 81 81 | 81 81 01 01 | user data
[=]  24 | 81 81 82 82 | 41 41 81 81 | user data
[=]  25 | 81 82 82 81 | 81 41 41 81 | user data
[=]  26 | 82 82 82 81 | 81 41 41 41 | user data
[=]  27 | 82 82 81 81 | 81 81 41 41 | user data
[=]  28 | 81 81 80 80 | 01 01 81 81 | user data
[=]  29 | 81 81 81 81 | 81 81 81 81 | user data
[=]  30 | 81 80 80 81 | 81 01 01 81 | user data
[=]  31 | 80 80 81 81 | 81 81 01 01 | user data
[=]  32 | 81 81 82 81 | 81 41 81 81 | device serial number (read only)
[=]  33 | 81 81 81 81 | 81 81 81 81 | device identification (read only)
[=] ----+-------------+-------------+--------------------
[=] Using UID as filename
[+] saved 34 blocks to text file lf-4x50-81818281-dump.eml
[+] saved 136 bytes to binary file lf-4x50-81818281-dump.bin

Screenshots If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

Additional context I have also compiled, flashed and tried the following firmwares: Release v4.9237 Release v4.13441 Current release

The same issue also occurs when installing and flashing via homebrew using the following commands

1. brew tap rfidresearchgroup/proxmark3
    * brew install proxmark3
        * For stable release
    * brew install --HEAD proxmark3
        * For latest non-stable from GitHub (use this if previous command fails)
    * brew install --with-blueshark proxmark3 
        * For blueshark support, stable release
    * brew install --HEAD --with-blueshark proxmark3 
        * For blueshark support, latest non-stable from GitHub (use this if previous command fails)
iceman1001 commented 2 years ago

As a side note, I notice you haven't followed the installation guide for your RDV4.

lets see, on discord you said you tried without the btaddon.
However now I get the feeling you are using latest repo with the rfid app. That will not work if you are. The rfid app needs its own older firmware version.

Please verify running with usb cable against latest source here, that 4x50 doesn't work.

T0py commented 2 years ago

I can confirm that all of the tests I have performed so far are via the USB cable against the latest source, Release v4.9237 and Release v4.13441 and the current release v4.14831.

image

What part of the installation guide did I not follow? These are the instructions I followed:

https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Installation_Instructions/Mac-OS-X-Homebrew-Installation-Instructions.md#homebrew-mac-os-x-developer-installation

With regards to the BT addon, that appears to be an issue with me not setting up the client correctly, not the compilation/building of the firmware and mac client.

T0py commented 2 years ago

Just adding a picture of the EM tag I'm using: image

As well as images of the readers this tag works with (two of which are clearly Indala/ASP readers). image image image

I can confirm that I've been able to use those readers since this issue has come up.

Also of note, 1) I repeatedly got the same em4x50 dumps/info output previously. 2) I am not seeing anything in the data plot to indicate the tag is energizing. 3) The tag isn't being detected as Indala either.

I've included the output of:

data plot
lf read
data save -f xxxxxx

Here: image

And this is the saved data data-read-1.pm3.zip

I can confirm that the PM is reading T55xx cards reliably image

And I've also tried (just for fun) switching the Q and F values on the antenna and re-running those tests. In case it's magically at 134kHz or something. No change. I'm also no longer compiling with the BT addon. I've got two RDV4's with me. Both are functioning the same way. So I don't believe it's a device/hardware specific issue either. Nor does it seem to be exclusive to Ubuntu/Mac OS as I've compiled and flashed from both. I've also tried using different USB cables in case there was something wrong.

Let me know if there's anything else I can do to test. I'm working on getting a second tag to test with, as well as multiple blank EM4x50 tags.

iceman1001 commented 2 years ago

I see in the guide that the programmer part of the guide doesn't have the same steps in the end.
image

Returning to your issue at hand, it's odd. The users @tharexde who wrote the EM4x50 impl tested latest w/o issues. Looking at your dumps from the 2020 fw, they look not correct. EM4x50 functions has improved since, so it might has been a false positive. Indala LF does PSK... What does lf indala reader say? And your lf read shows no signal at all. Which would be an indication its a bad coupling (given the small token) or not LF or it needs a awake command before...

T0py commented 2 years ago

Oh, okay. Yeah, I didn't know to run [usb] pm3 --> script run init_rdv4 or to do a 'smart card module upgrade'. I've not done either before.

I had v3.10 of the smart card module. I've now upgraded it to v3.11. 

[#] Smart card module (ISO 7816)
[#]   version.................v3.11

running lf indala reader returns signal looks like noise As a response.

The token is small, but like, i've written/read to smaller implants before. The reader pictures I posted above are all definitely LF readers. They do support some non-standard frequencies though I believe. But again, I'm not sure how I managed to capture repeatable dumps using the older firmware if it was a false positive? That's what's confusing here to me.

iceman1001 commented 2 years ago

Can you do a lf sniff ?

T0py commented 2 years ago

I purchased some em4x50 and em410x tags online and these all work fine.

image

So this would suggest that this issue has been a false positive from the start with the older software incorrectly identifying the tag as em 4x50.

Just an update for anyone who's interested...

I did some more research and managed to get my hands on two other tags from this system. The small keyfob one provided no new/additional information. But the vehicle transponder...

image

image

A bit of googling later leads me to this:

https://www.digikey.ca/en/products/detail/texas-instruments/RI-TRP-R9UR-30/1768347#product-details-substitutes

I'll close this issue now as the issue is not with the EM4x50 functionality, but with reading this particular type of tag. I'm still not sure how this tag was detected as EM4x50 repeatedly before and how it now wont even apparently energise (and yeah, I've tried using the 134khz mode as well). But I'll take this to discord for further discussion.

Thanks for your help.