proxmark3 VS unleashed-firmware

I would check out the Proxmark3 Github repo [0]. They have a cheatsheet [1] with the basics on how to get started. I also did a talk about RFID security last year about the basics [2]

To get started, the basics are: low freq (LF) is usually around 125khz and is rarely encrypted (HID Prox is the most common in the US). The data is often encoded in Wiegand format for access control systems (something to keep in mind when reading the raw data).

High freq (HF) (aka NFC) is ~13Mhz and is readable by most Android phones with NFC. Not all tag data can be read however. HF cards support a lot of different options including data storage (normally in a block layout with permissions to read and write depending on keys) and encryption (iCLASS and SEOS being the HID offerings and very common). Some can be cloned (like hotel cards) while others (like SEOS) require a downgrade attack to work correctly (SEOS -> normal SEOS reader -> Weigand data -> older style card like HID Prox).

[0] https://github.com/RfidResearchGroup/proxmark3

[1] https://github.com/RfidResearchGroup/proxmark3/blob/master/d...

[2] https://www.youtube.com/watch?v=zKOAywZqisc

🔗 https://github.com/RfidResearchGroup/proxmark3/releases/tag/v4.17140

After pulling and compiling a newer proxmark3 generic firmware from the RfidResearchGroup repo I got farther but now have a new message I've not found much about with static nonces. https://github.com/RfidResearchGroup/proxmark3/

you could use linux (ubuntu) https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Installation_Instructions/Linux-Installation-Instructions.md

You will have to do the leg word, but this is a starting point: https://github.com/RfidResearchGroup/proxmark3/blob/master/client/luascripts/hf_mf_sim_hid.lua

Grab yourself a Proxmark3, read the instructions here, and you can extract your iClass elite key in a few seconds. You can pick up a PM3 easy for a few bucks.

I cloned whatever the latest commit was at https://github.com/RfidResearchGroup/proxmark3, which is what the guide on dangerous things suggests (where I bought my PM).

I got one not too long after the official launch and I've used it a decent amount (granted I am in cybersecurity and have a more real-world use cases then the average person). My favorite use case is the IR remote since phones no longer have IR blasters. It's saved me twice so far in having to buy/find a remote for something.

One thing people don't realize is that the custom firmware [0] that you can run allows you to receive and transmit on a wide range of frequencies under 1Ghz. Lots of things use that range (garage doors, gates, fan remotes, etc.) and are not very secure. I think that this will be a time looked back on where it's possible to interact with those devices without having to buy a custom PCB transmitter or somewhat expensive and complex SDR.

[0] https://github.com/DarkFlippers/unleashed-firmware

Check it out at https://github.com/DarkFlippers/unleashed-firmware/releases/tag/unlshd-043

Take a look at my IR Scope. It’s pretty simple. There’s an IR worker that handles talking to the sensor on a second “thread”. The worker has send/receive functions. https://github.com/DarkFlippers/unleashed-firmware/blob/dev/applications/external/ir_scope/ir_scope.c

Instructions for 3rd party firmware are to download the zip to files, then share with the Flipper app. I do not see the flipper app in the share sheet, or selectable if I click +. I've rebooted. I've also opened the app and force quit several times. I see I'm connected via the app to the device, so I know connectivity works. I just updated to iOS 16.4 and not tried this prior, so perhaps a 16.4 bug?https://github.com/DarkFlippers/unleashed-firmware/blob/dev/documentation/HowToInstall.md