search

RfidResearchGroup / proxmark3

Iceman Fork - Proxmark3
http://www.icedev.se
GNU General Public License v3.0
4.03k stars 1.06k forks source link

Broken Proxmark3 kit after flashing #314

Closed SmartLayer closed 5 years ago

SmartLayer commented 5 years ago

Describe the bug Flashing the device with the latest code (cloned today) causes the device to power-cycle.

To Reproduce Steps to reproduce the behavior:

  1. flash the bootrom 
    
$ sudo client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf 
Loading ELF file 'bootrom/obj/bootrom.elf'...
Loading usable ELF segments:
0: V 0x00100000 P 0x00100000 (0x00000200->0x00000200) [R X] @0x94
1: V 0x00200000 P 0x00100200 (0x00000c84->0x00000c84) [R X] @0x298

Waiting for Proxmark to appear on /dev/ttyACM0 . Found.

db# unknown command:: 0xc10d410d

db# unknown command:: 0xc10d4154

Entering bootloader... (Press and release the button only to abort) Waiting for Proxmark to appear on /dev/ttyACM0 ....... Found.

Flashing... Writing segments for file: bootrom/obj/bootrom.elf 0x00100000..0x001001ff [0x200 / 1 blocks]. OK 0x00100200..0x00100e83 [0xc84 / 7 blocks]....... OK

Resetting hardware... All done.

Have a nice day!

2. Flash the full image;

$ sudo client/flasher /dev/ttyACM0 armsrc/obj/fullimage.elf Loading ELF file 'armsrc/obj/fullimage.elf'... Loading usable ELF segments: 0: V 0x00102000 P 0x00102000 (0x0002f070->0x0002f070) [R X] @0x94 1: V 0x00200000 P 0x00131070 (0x000018e0->0x000018e0) [RW ] @0x2f104 Note: Extending previous segment from 0x2f070 to 0x30950 bytes

Waiting for Proxmark to appear on /dev/ttyACM0 . Found. Entering bootloader... (Press and release the button only to abort) Waiting for Proxmark to appear on /dev/ttyACM0 ....... Found.

Flashing... Writing segments for file: armsrc/obj/fullimage.elf 0x00102000..0x0013294f [0x30950 / 389 blocks]............................Waiting for a response from the proxmark...
You can cancel this operation by pressing the pm3 button
^C


I used ^C to stop because after waiting for ~10 minutes the device is already audibly power-cycling (there seems to be a relay in it to produce the clicking sound once 5 seconds).

3. Attempt to redo the flashing by pressing the button down and holding it while reconnecting it to the USB port:

$ sudo client/flasher /dev/ttyACM0 armsrc/obj/fullimage.elf Loading ELF file 'armsrc/obj/fullimage.elf'... Loading usable ELF segments: 0: V 0x00102000 P 0x00102000 (0x0002bb80->0x0002bb80) [R X] @0x94 1: V 0x00200000 P 0x0012db80 (0x00001960->0x00001960) [RW ] @0x2bc14 Note: Extending previous segment from 0x2bb80 to 0x2d4e0 bytes

Waiting for Proxmark to appear on /dev/ttyACM0 . Found. Waiting for a response from the proxmark...
You can cancel this operation by pressing the pm3 button
^C


I quit with `^C` because the device has reset, evident by the audible clicking sound from a relay + `dmesg` shows the device hopped to `ttyACM1`

**Expected behavior**
Flash elf successfully.

**Screenshots**
![IMAG0072](https://user-images.githubusercontent.com/548435/62849027-55a5a400-bd21-11e9-83ec-bcb9c1dff55e.jpeg)

**Desktop (please complete the following information):**
 - OS: Ubuntu 19.04.

I could do `hw version` and `hw status` because it no longger works. But before I flash it, it works fine reading and cloning my devices (using viking)

**Additional context**
The repair procedure I took is copied from [another bug](https://github.com/RfidResearchGroup/proxmark3/issues/35#issuecomment-431681848) in which it worked. In my case, it didn't.

> **In short** (if your device gets enumerated on ACM0 adjust accordingly):
> 
>     1. unplug device
> 
>     2. press button and keep it pressed (IMPORTANT)
> 
>     3. plug in device
> 
>     4. run flash command  sudo client/flasher /dev/ttyACM0 armsrc/obj/fullimage.elf
> 
>     5. wait until flash is finished.
> 
>     6. release button.
> 
>     7. un/plug device.
iceman1001 commented 5 years ago

hm... have you modified your Makefile.platform file to target your device? and ran make clean; make ?

SmartLayer commented 5 years ago

ran make clean; make ?

yes, I did make clean before making. I later tried the latest release instead of git master branch to do step 3 (fixing the broken device by holding down the button and reflash) and it failed with the same behaviour.

hm... have you modified your Makefile.platform file to target your device?

No, I did not modify Makefile.platform. I went straight to make.

iceman1001 commented 5 years ago

that will be a problem... since by default this repo targets RDV4...
You will need to read https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md

iceman1001 commented 5 years ago

Have your issues resolved itself using the latest source?

javastraat commented 5 years ago

rtfm einstein, played one hour to get my PM3OTHER to work in one second ...... :) (special edition signed by the iceman) all works fine on rdv and pm3

iceman1001 commented 5 years ago

Yo Einstein! I missed you at CCCamp! And I met babak (tools founder US) at DEFCON!
And I have a lockpick now. haha, Thought you sold that one on EBAY ;)

javastraat commented 5 years ago

ah nice, had to work :( nice that you went to ccc. yeap i know babak :) no sale do too, no sale sticker from wife :) lol maybe i get rich with it

iceman1001 commented 5 years ago

I have to visit Amsterdam then. :)

iceman1001 commented 5 years ago

closed due to inactivity by OP.

SmartLayer commented 5 years ago

Okay I rebuilt and make clean and make install with the following Makefile.platform:

PLATFORM=PM3OTHER

I got

$ pm3-flash-bootrom bootrom/obj/bootrom.elf
[=] Waiting for Proxmark3 to appear...
[=] Session log /home/weiwu/.proxmark3/log_20190910.txt
[+] About to use the following file:          
[+]     /usr/local/bin/../share/proxmark3/firmware/bootrom.elf          
[+] Waiting for Proxmark3 to appear on /dev/pm3-0           
.Found           
[=] You can cancel this operation by pressing the pm3 button          
[!] Communicating with Proxmark3 device failed           
^C

There is a clicking sound from a rely in the PM3 when the last line (Communication failed) show up.

The same if I attempt to flash the full image:

$ pm3-flash-fullimage armsrc/obj/fullimage.elf
[=] Waiting for Proxmark3 to appear...
[=] Session log /home/weiwu/.proxmark3/log_20190910.txt
[+] About to use the following file:          
[+]     /usr/local/bin/../share/proxmark3/firmware/fullimage.elf          
[+] Waiting for Proxmark3 to appear on /dev/pm3-0           
.Found           
[=] Available memory on this board: 512K bytes

[=] Permitted flash range: 0x00102000-0x00180000          
[=] You can cancel this operation by pressing the pm3 button          
[!] Communicating with Proxmark3 device failed           
^C

I hope @iceman1001 can reöpen this issue. I was too busy last month to repeat the experiment & really appreciate the comments above. Thanks!

The logfile doesn't seme to provide any additional information than what is already on the commandline: log_20190910.txt

iceman1001 commented 5 years ago

Have you tried following the suggestions in the troubleshooting document? https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Installation_Instructions/Troubleshooting.md

SmartLayer commented 5 years ago

Have you tried following the suggestions in the troubleshooting document? https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Installation_Instructions/Troubleshooting.md

The list suggested running pm3-flash-bootrom which I did. But I'll switch to another computer on which I can safely remove modem-manager to retest now that you point to that as a possible culprit.

† pm3-flash-bootroom.txt