github RfidResearchGroup/proxmark3 v4.23346
proxmark3-v4.23346
on GitHub

3 hours ago

Release v4.23346
Nickname "Frosty Lemon"

CHANGELOG - [Frosty Lemon][2026-09-18]

  • Fixed hf mfdes sim - the ATS now advertises 106 kbit/s only, PPS to a higher rate is refused, a selected card ignores REQA/WUPA, and ISO-DEP block recovery now follows the card sequence (@mistial-dev)
  • Added hf mfdes sim - answers ISO 7816 SELECT by DF name or file id with real status words, so a reader that opens with a SELECT reaches the card (@mistial-dev)
  • Fixed hf mfdes sim - a session opened with the 0x0A legacy authentication now uses the legacy secure messaging: 4 byte DES MAC, CRC16, no MAC on plain answers (@mistial-dev)
  • Fixed hf mfdes sim - the 0x0A legacy authentication now enciphers the reader token and RndA' from a zero IV as a card does, so the session key and final frame match genuine silicon (@mistial-dev)
  • Added hf mfdes etest - drives the DESFire simulation over USB without RF, with injectable RndB / random UID (@mistial-dev)
  • Fixed USB receive stalling on a zero-length OUT packet and missing a command already buffered behind another (@cindersocket)
  • Fixed dictionary loading to skip keys longer than the requested key size instead of truncating them (@iceman1001)
  • Changed hf mfdes chk to check every key number the application declares, not only the ones a file's access rights name (@iceman1001)
  • Changed hf mfdes chk to report when no keys were found and to stop spending a card round trip on an exhausted dictionary (@iceman1001)
  • Changed hf mfu cchk and hf mfu aeschk into one hf mfu chk which detects UL-C vs UL-AES (@iceman1001)
  • Added hf 14b view - MyKey / COGES keys on SRIX4K now decode (@iceman1001)
  • Added hf 14b view --selftest - runs the MyKey parser self tests (@iceman1001)
  • Removed hf 14b valid - the SRIX4K scrambler stub it wrapped is finished and lives in the MyKey parser (@iceman1001)
  • Fixed build too large for 256kb images by guarding WITH_DESFIRE_SIM (@iceman1001)
  • Fixed pm3 flash - the progress bar no longer keeps SIGINT after it finishes, CTRL-C works again afterwards (@iceman1001)
  • Fixed CTRL-C / CTRL-Z - the client owns its signals instead of letting readline re-raise them, CTRL-C quits cleanly saving the history and CTRL-Z suspends reliably (@iceman1001)
  • Fixed CTRL-C / CTRL-Z - readline re-raised caught signals to itself, which in a threaded client looped instead of quitting or suspending (@iceman1001)
  • Fixed pm3 flash - the progress bar no longer keeps SIGINT after it finishes, CTRL-C works again afterwards (@iceman1001)
  • Changed pm3 history - written after every command, so it survives a kill instead of only a clean exit (@iceman1001)
  • Changed memset - the device's own implementation now fills a word at a time, the same treatment memcpy got. (@iceman1001)
  • Changed receive_ng - the command payload is zeroed when a packet actually arrives rather than on every idle pass of the main loop. Thanks @Msprg (@iceman1001)
  • Changed hf mfdes chk - runs with no arguments now, falling back to the bundled dictionary the way hf mfdes detect already does (@iceman1001)
  • Changed hf mfdes chk - tidier output(@iceman1001)
  • Fixed hf mfdes sim - a chained write is answered instead of being refused with 91 1C on its second frame. (@iceman1001)
  • Fixed hf mfdes sim - an error status now ends the authenticated session, as M134034 7.3.4 requires of a card (@iceman1001)
  • Fixed hf mfdes sim - answers are sized from the frame size the reader asks for in its RATS instead of a fixed 96 bytes (@iceman1001)
  • Fixed hf mfdes sim - the length of a write is taken from the 3 byte length the command carries rather than guessed from how full a frame looked (@iceman1001)
  • Fixed hf mfdes detect - the same cipher is no longer sent to the card twice, cutting a PICC level scan with the bundled dictionary from 99 authentications to 63 (@iceman1001)
  • Changed hf mfdes detect - a single key number is printed as one value instead of a range of one, so a PICC level scan reads key num 0x00 (@iceman1001)
  • Fixed hf mfdes sim - an enciphered read longer than one frame is chained instead of refused, the init vector carrying from frame to frame (@iceman1001)
  • Fixed lf read - a realtime read no longer ends early when the host falls behind, and the device no longer goes silent until it is replugged (@iceman1001)
  • Fixed lf read - a realtime read ending on a full USB packet now delivers its last 64 bytes, an odd packet count was silently one packet short (@iceman1001)
  • Fixed lf read - a transfer that stops short says so, instead of being presented as a complete read (@iceman1001)
  • Changed lf read / lf sniff - the sample count is capped to the graph buffer size, the surplus was streamed and then thrown away (@iceman1001)
  • Added hf mfdes sim - SetConfiguration is answered, so a reader can disable FormatPICC, switch the card to a random id, or give it a user defined ATS (@iceman1001)
  • Added hf mfdes sim - ReadSignature is answered for a card image of a generation that has one, and refused the way a genuine EV1 refuses it (@iceman1001)
  • Added hf mfdes sim - GetKeyVersion is answered, so a reader can read the version of any key without knowing the key itself (@iceman1001)
  • Added hf mfdes sim - ChangeKeySettings is answered, enciphered and master key only, and clearing the configuration changeable bit is one way as it is on a card (@iceman1001)
  • Added hf mfdes sim - ChangeKey is answered, both the plain and the XORed key frame, so a reader can rekey the simulated card and the new keys are in what hf mfdes esave writes out (@iceman1001)
  • Added hf mfdes sim - ChangeFileSettings is answered, plain when the change access right is free and enciphered under the key it names otherwise (@iceman1001)
  • Added hf mfdes esave - --keep saves applications and files a reader deleted, which are otherwise left out so the dump is the card as a reader sees it (@iceman1001)
  • Added hf mfdes sim - CreateFile in all five EV1 flavours and DeleteFile are answered, so a reader can lay out an application's file system on the simulated card (@iceman1001)
  • Added hf mfdes sim - CreateApplication and DeleteApplication are answered, so a reader can add and remove applications on the simulated card (@iceman1001)
  • Added hf mfdes sim - FormatPICC is answered, releasing every application and file and handing the memory back, with the PICC master key and its settings kept (@iceman1001)
  • Fixed hf mfdes esave - the ATS was saved as zeros, a sizeof() of the 256 byte destination cast to uint8_t wrapped to 0 and the copy was skipped while its length was still reported (@iceman1001)
  • Added hf mfdes sim - DESFire EV1 simulation now answers authentication, secure messaging, file reads, writes and transactions from the card image in emulator memory (@iceman1001)
  • Fixed hf mfdes sim - a 2TDEA key whose two halves match is handled as a single DES key, session key generation included, so the session key matches what a genuine PICC derives (@iceman1001)
  • Fixed hf mfdes sim - the CMAC of a chained answer is taken over the whole transfer instead of being restarted on every 0xAF continuation (@iceman1001)
  • Fixed PLATFORM_EXTRAS=BWM - a command started over the Proxmark5 wireless module can be aborted again. (@tweathers-sec)
  • Fixed lf search - a leftover debug print no longer reports DEBUG: detectindala | <n> on every failed Indala demodulation (@tweathers-sec)
  • Changed memcpy - the device's own implementation now copies a word at a time when source and destination allow it (@iceman1001)
  • Changed NG replies - the outgoing frame is offset so its payload lands word aligned, taking USB transfer speed from 630 to 789 kB/s on RDV4 (@iceman1001)
  • Fixed AT91F_USB_SendStall - waiting for the host to collect the STALL is now bounded (@iceman1001)
  • Fixed GET_LINE_CODING - the CDC line coding struct is now packed to the 7 bytes the spec defines (@iceman1001)
  • Fixed USB control transfers - a descriptor whose length is an exact multiple of the 8 byte control endpoint now ends with a zero length packet (@iceman1001)
  • Fixed USB WCID descriptors - the device advertised Microsoft OS descriptor support in string 0xEE but stalled the vendor request that follows (@iceman1001)
  • Added hf mfdes sim - answers GetDFNames and GetISOFileIDs, so a reader sees the ISO file ids and DF names of the simulated card (@iceman1001)
  • Fixed hf 14a - an FPGA bitstream download no longer destroys the emulator memory that eload just filled (@iceman1001)
  • Changed hf mfdes sim - now a self contained DESFire simulation, answering both native and ISO 7816 wrapped commands (@iceman1001)
  • Fixed hf mfdes - GetDFNames is no longer sent inside an authenticated session, which permanently disabled DESFire EV1 cards (@iceman1001)
  • Added hf mfdes - the five DESFire status codes that mean the card damaged or disabled itself are now named instead of reported as -20 (@iceman1001)
  • Fixed hf mfdes - a command error now drops the client's secure channel, since the PICC has already ended the authentication (@iceman1001)
  • Fixed hf mfdes - file settings that could not be read are no longer reported and dumped as a zero byte standard data file (@iceman1001)
  • Fixed hf mfdes pc - the proximity check commands now check the card's status byte instead of treating an error as success (@iceman1001)
  • Changed hf mfdes sim - now runs through the shared ISO14443-A simulation loop as tag type 3 (@iceman1001)
  • Added hf mfdes eload/esave/eview - load a DESFire card dump into emulator memory (@iceman1001)
  • Fixed PLATFORM=PM3ICOPYX - builds again, it has no FPGA power switch and the AT91 GPIO layer used the pin unconditionally (@iceman1001)
  • Fixed fpga_compress - PM3ULTIMATE builds again, its bitstreams are an exact multiple of the interleave size (@iceman1001)
  • Fixed hf legic eload - an upload after a command that left a different FPGA bitstream loaded now writes the whole image (@iceman1001)
  • Fixed hf legic sim - no longer wipes the emulator memory that hf legic eload just filled (@iceman1001)
  • Changed emulator memory - raised from 4096 to 8192 bytes (@iceman1001)
  • Fixed hf 14a sim - a dynamic response now gets a modulation buffer sized to fit it, instead of one 68 bytes too small (or 1788 too large for ST25TA) (@iceman1001)
  • Fixed BigBuf_malloc - takes a uint32_t, so a request of 64KB or more fails instead of wrapping to zero (@iceman1001)
  • Fixed BigBuf_max_traceLen - returns a uint32_t, so LF sampling on a device with more than 64KB of BigBuf is not handed a truncated buffer (@iceman1001)
  • Changed hf mf view - now show which VIGIK fields are RSA signed (@iceman1001)
  • Changed hw status - now reports EMULATOR memory (@iceman1001)
  • Changed hf mf view - Urmet Captiv cards now decode their number field and data regions (@iceman1001)
  • Changed hf mf view --selftest - now also checks the Hexact payload decoder, both ways (@iceman1001)
  • Changed hf mf view - Hexact sector 9,11 payload is now decoded and cross checked against sector 0,15 and UID (@iceman1001)
  • Added hf mfdes dump - now walks the whole PICC and saves a hf-mfdes-<UID>-dump.json card image, picking up hf-mfdes-<UID>-keys.json on its own (@iceman1001)
  • Added hf mfdes view - print a DESFire card dump file, no device needed (@iceman1001)
  • Fixed sprint_hex - a buffer twice the old size, so printing a long block no longer runs off the end of the static buffer (@iceman1001)
  • Added vigik_recover_pk.py - recover public keys from RSA signatures (@iceman1001)
  • Fixed hf mf autopwn - a sector that cannot be cracked no longer discards the keys already recovered (@iceman1001)
  • Fixed hf mf nested - a NAK from the tag now ends the nonce collection instead of retrying until the client times out (@iceman1001)
  • Fixed hf mfdes - select / authenticate failures are now reported once, naming the AID and the failing step (@iceman1001)
  • Fixed -f <fn> - a filename given with its own extension is now used as-is on both load and save (@iceman1001)
  • Fixed hf mf view - VIGIK signature verification now recovers the ISO 9796-1 message and checks it against the card (@iceman1001)
  • Added hf mf view --selftest - recovers and checks the signature of a known good expired VIGIK card (@iceman1001)
  • Changed hf mf view / hf mf dump --ns - identify VIGIK family systems (@iceman1001)
  • Added parsehid.c - HID PACS decoding for MIFARE Classic dumps
  • Added parsevigik.c - VIGIK PACS decoding for MIFARE Classic dumps (@iceman1001)
  • Changed hf mf view - now decode a HID PACS credential (@iceman1001)
  • Changed hf mf dump --ns - now decode a HID PACS credential (@iceman1001)
  • Fixed fpga_compress -d - a single bitstream archive was unpacked 2384 bytes short, the trailing partial interleave chunk was dropped (@iceman1001)
  • Fixed fpga_compress - a build with only one FPGA bitstream (SKIP_LF, SKIP_FELICA, SKIP_ISO15693) packed it as a single 1 MB block the ARM could not decompress (@iceman1001)
  • Fixed FpgaDownloadAndGo - a failed FPGA decompress leaked the ring buffer, leaving BigBuf 16 kB short for the rest of the session (@iceman1001)
  • Added hf mf dump --sk - save extracted keys to binary file (@iceman1001)
  • Changed hf mf dump --ns - now runs the same analysis as hf mf view(@iceman1001)
  • Changed tools/pm3_online_tests.sh desfire_value - the plain/mac assertion pairs sent byte identical APDUs (@iceman1001)
  • Fixed smart raw --t1 - a card runs the protocol its ATR names until a PPS changes it (@iceman1001)
  • Fixed tools/pm3_online_tests.sh smartcard - the T=0 checks used the non existent -0 flag (@iceman1001)
  • Fixed hf mfdes dump - the ISO file id probe ends the PICC session on applications without ISO file ids (@iceman1001)
  • Changed hf mfdes lsfiles / hf mfdes dump - no longer warn about a missing ISO file id list (@iceman1001)
  • Fixed hf mfdes read / hf mfdes write - a file whose access right is free (0x0E) is served in plain by the PICC (@iceman1001)
  • Fixed hf mfdes value - credit/debit/limitedcredit used a fixed comm mode, now look on card (@iceman1001)
  • Fixed hf mfdes value -o get / hf mfdes dump - a value file read in the wrong comm mode printed a silently wrong value instead of failing (@iceman1001)
  • Fixed lf idteck demod - without --raw it decoded a zeroed stack buffer instead of the graphbuffer, always reporting card id 0 (@mfcarroll)
  • Fixed lf idteck demod - a raw frame without the Idteck preamble printed No genuine IDTECK found and then announced a tag anyway (@mfcarroll)
  • Changed lf idteck demod - no longer prints an HID H10301 credential built from the Idteck card id (@mfcarroll)
  • Added trace clear - clears the tracebuffer (@iceman1001)
  • Changed trace save -1 - now downloads from device by default (@iceman1001)
  • Added hf 14a antifuzz --coll - the UID collides from the 9th bit (@iceman1001)
  • Changed trace list -t 14a - decodes SEL 0x99..0x9F, shows how many UID bits a bit oriented ANTICOLL claims (@iceman1001)
  • Fixed hf iclass encode / hf iclass tagsim / hf mf encodehid / lf hid sim / lf hid clone / lf hid brute - --cn was read with a 32 bit getter (@iceman1001)
  • Changed hf mf eload - the device now zeroes the emulator memory before the upload (@iceman1001)
  • Fixed hf mf sim / hf 14a sim - the anticollision responses were prepared in BigBuf before iso14443a_setup() (@iceman1001)
  • Changed CAPABILITIES_VERSION to 10 - hf mf eload sends a flags byte the device did not have before, so client and firmware must be flashed as a pair (@iceman1001)
  • Changed mem spiffs upload - the file is held open across packets instead of being reopened by name for each one (@iceman1001)
  • Added hf thinfilm sniff - passively records the frames a Thinfilm / NFC Barcode tag beams at a reader (@iceman1001)
  • Fixed hf thinfilm sim - it now holds the genuine tag's measured 65536 carrier period frame rate instead of a fixed delay (@iceman1001)
  • Changed mem spiffs upload/mem spiffs dump - both now print inline progress, and a refused write is reported with the byte it stopped at instead of claiming success (@iceman1001)
  • Changed real-time LF sample reads lf read, lf sniff, lf cotag reader(@iceman1001)
  • Changed the INPLACE spinner prefix (@iceman1001)
  • Fixed mem spiffs dump - a file of 64K or more wrapped the uint16_t BigBuf_calloc() takes, the download now streams one frame at a time (@iceman1001)
  • Fixed SPIFFS flash layer - a failed erase was reported to SPIFFS as success, letting it write into an un-erased sector where NOR AND-semantics silently mangled file data (@iceman1001)
  • Fixed hf thinfilm sim - a 32 sample field read between every frame cost 3.8ms and nearly doubled the frame repeat period (@iceman1001)
  • Added hf thinfilm sim - it now traces, so trace list -t thinfilm works on the sim side (@iceman1001)
  • Fixed hf texkom reader -v - now no ovewflow in the general decoder (@iceman1001)
  • Changed trace list - the Hitag U and Hitag S annotators now build their text with the strlen() offset (@iceman1001)
  • Fixed hf felica - the service code footer wrote its closing bar past the end of a 128 byte buffer (@iceman1001)
  • Fixed trace list - a Hitag U LOGIN or WRITE SINGLE BLOCK frame could write up to 17 bytes past the end of the 60 byte annotation buffer (@iceman1001)
  • Fixed hf mf autopwn - it now re-authenticates and retries the block with the other key (@iceman1001)
  • Fixed hf mf hardnested - the device declared num_nonces * 4 bytes but packs 9 bytes per nonce pair. Thanks @TheArchitect0880 (@iceman1001)
  • Changed hf mfdes detect - with no -n it now sweeps every key number the application declares instead of only key 0 (@iceman1001)
  • Fixed hf mfdes detect - the card error counter was shared by every key type, so a bad run during the DES pass could abort the AES pass (@iceman1001)
  • Fixed hf mfdes detect - with no -f it drew candidates from the MIFARE Plus 16 byte key list, it now defaults to the bundled mfdes_default_keys dictionary (@iceman1001)
  • Fixed hf mfdes detect - LRP was only found when the key settings happened to be unreadable (@iceman1001)
  • Added hf mfdes chk --schann - now detect the secure channel EV/EV2/LRP mode; detected per application and can be overridden (@iceman1001)
  • Fixed hf mfdes chk - found keys were tracked per key number instead of per application, so a key number recovered on one AID was skipped later (@iceman1001)
  • Fixed data modulation - the 160 sample antenna settle trim was never undone, so the graph buffer stayed short for everything after it (@mfcarroll)
  • Changed tests/lf_t55xx_writetest.lua - reads each block three times and names how a bad read differs (rol1, ror5, inverted, shr1) instead of only pass/fail (@mfcarroll)
  • Fixed lf t55xx detect - PSK1 now detects at every bit rate and subcarrier. (@iceman1001)
  • Fixed lf t55xx detect - FSK was skipped entirely when the field-clock pair measured as neither legal pair, losing FSK1 at RF/32 and RF/40 and every variant at RF/16 (@iceman1001)
  • Fixed lf t55xx detect - the block 0 rotation was picked by scan order; the measured broadcast period now settles it (@mfcarroll)
  • Fixed lf t55xx detect - the psk antenna-settle trim left the graph 160 samples short, so the graph-sample anchor was discarded on most block reads (@mfcarroll)
  • Fixed lf psk demod - lead-in samples were accepted as a phase shift, complementing the rest of the word (@mfcarroll)
  • Fixed lf fsk demod - a leading run too short to be a bit was forced to one, fabricating a bit and shifting the word (@mfcarroll)
  • Fixed lf nrz demod - the samples before the first level change were counted as bits, rotating the word whenever that edge moved (@mfcarroll)
  • Fixed lf t55xx dump/read - blocks were extracted at a bit offset cached from the last detect The offset is now anchored in graph samples (@iceman1001)
  • Fixed lf t55xx write --verify - a successful write could be reported as a validation failure (@iceman1001)
  • Fixed lf t55xx detect - the automatic detect after a block 0 write reported a password that was never supplied (@iceman1001)
  • Fixed hf emrtd info - now correctly pretty print algos (@iceman1001)
  • Fixed trace list -t topaz - now parses topaz reader frames up to 16 bytes (@iceman1001)
  • Fixed hw bwm - doc and comment references still named the flat hw bwmsetcap/bwmcharge/bwmautooff commands from before the subgroup move (@xilni)
  • Added TA1=96 support via pwm to sim module sim024.bin - v4.66 (@Antiklesys)
  • Added hf mfu ndefformat - NDEF format Ultralight/NTAG tags, restores the NXP factory Capability Container for the detected type (@0x6r1an0y)
  • Changed lf hitag - refactoring hitag2 operations and now they work much better (@iceman1001)
  • Fixed lf hitag list - now prints in same style like the rest (@iceman1001)
  • Changed pathing - client now supports ~/ tilde sign in paths (@iceman1001)
  • Added hf_legic_rdv4 - Standalone mode for managing 7 persistent legic dumps (@digitalhoax)
  • Fixed lf t55xx detect - dropped the psk3 candidates (@mfcarroll)
  • Fixed lf t55xx detect - a psk3 tag read back as psk2 with a block 0 one bit out (@mfcarroll)
  • Added doc/md/PM5_Start_Here/Getting_Started_With_PM5.md now exists as a starting point for those who have their PM5 (@innocentbystanderproxmark)
  • Fixed tools/ePassport - the personal number read from the MRZ optional-data field showed a filler character where a space belonged (@pkilar)
  • Fixed tools/ePassport - the detail tabs named the files their data came from as fixed text, so a document without EF_DG11 was told otherwise, and the personal-number caption wrapped (@pkilar)
  • Added tools/ePassport - EF_DG13 is decoded, and a Polish document's PESEL is shown as the personal number when it carries no EF_DG11 (@pkilar)
  • Fixed tools/ePassport - a disabled button drew Kivy's banded disabled texture, which left its label unreadable (@pkilar)
  • Fixed hf 14b - a card asking for a waiting time extension of 4 or more left the timeout at zero, so any ISO14443-B card needing time to answer looked like it had stopped responding (@pkilar)
  • Fixed hf mfdes chk - now handles -k user supplied keys properly (@iceman1001)
  • Fixed BigBuf_Clear_keep_EM() - now also clear the trace length set (@iceman1001)
  • Fixed BTADDON - rx ring reported empty when filled to exactly its size, silently dropping 1kB of received data; now read straight from the PDC banks (@iceman1001)
  • Changed hf 15|iclass - poll for an abort once per 1024 sample bytes helps BTADDON builds stop blowing the DMA circular buffer (@iceman1001)
  • Fixed tools/ePassport - a read that dumped nothing is now reported as a failure with the client log kept beside the dump, and EF_CardAccess/DG14 protocols are decoded and correctly named (@pkilar)
  • Fixed tools/ePassport - FILES and LOG panes no longer go blank on long content, and picture files now show the picture (@pkilar)
  • Fixed hf xerox view - now rejects a dump file too small to contain the info blocks instead of reading past it (@munzzyy)
  • Changed NG frame layout to align better with 64bytes frames. From 512 -> 624bytes (@iceman1001)
  • Changed hf plot - converted to NG frame (@iceman1001)
  • Fixed hf mfu cchk - now 3-pass key check all keys sent to device (@iceman1001)
  • Changed iso15693 on device side to share one response buffer across the reader helpers (@iceman1001)
  • Changed version data on device side to not be inlined, freeing 1.5kB of stack in the main loop (@iceman1001)
  • Changed lf pcf7931 - now use bigbuf_calloc and much smaller array (@iceman1001)
  • Changed hf 15 sniff - now uses bigbuf_calloc and lessen ram footprint on device (@iceman1001)
  • Added individual json dump formats for ht2, ht1, htS, htU. No more .bin files either for hitag (@iceman1001)
  • Change NG: iso14a_raw_cmd_t, convert hf 14a raw, dual-mode reader handler (@iceman1001)
  • Support for flipper ISO15693.nfc dump files (@iceman100)
  • Change NG: convert CMD_LF_EM4X50_ESET to em4x50_eset_t (@iceman1001)
  • Change NG: convert CMD_LF_T55XX_SET_CONFIG to t55xx_setconfig_t (@iceman1001)
  • Added a new ISo15693 v5 dump file format to handle 0x100 number of pages and 8 byte pages better (@iceman1001)
  • Fixed ISO15693 v4 file handling and converting to v5 (@iceman1001)
  • Fixed clock SpinDelayUsPrecision to not wrap. Now more 43ms issues (@iceman1001)
  • Changed hf felica raw - now can stream per-window envelope for better measurments (@iceman1001)
  • Updated fpga_pm3_felica.bit - FeliCa signal handling got refactored. (@iceman1001)
  • Changed client tab completion - vocabulary is now built at runtime from the live command tree and uses the same availability rules as help (@Msprg)
  • Fixed standalone modes - the one second button hold trigger was a no-op on all non-PM5 platforms, leaving hw standalone over USB as the only entry point (@ShawInnes)
  • Added sim022.bin - enabled burst mode transfers, which allows us to do TA1=96 in speeds (@iceman1001)
  • Fixed hf felica liteauth - empty long option names for -c and -k made argtable read past the string (found by ASAN on --fulltext) (@Msprg)
  • Added sim020.bin - v4.60 of sim module firmware, better T=0 handling and clock etu handling (@iceman1001)
  • Fixed hf seos sam - now have a invalid pacs guard (@iceman1001)
  • Changed i2c comms to auto-negotiation and use ATR-keyed rate cache for speedier smart card comms (@iceman1001)
  • Changed emv search - now has better table output (@iceman1001)
  • Changed client side polling. Should make client more spiffy (@iceman1001)
  • Fixed trace list -t 7816 - now handles contact vs contactless annotation better (@iceman1001)
  • Added smart pps - ISO 7816-3 protocol and parameter selection exchange (@iceman1001)
  • Added sim015.bin - sim modul firmware now supports T=0 and T=1 (@iceman1001)
  • Added tools script tools/ePassport/ePassport - kivy python3 script that dumps a passport with BAC/CAN and a nice viewer (@iceman1001)
  • Added tools script external_sam_read.py enabling PM3 3 Easy and Proxmark 5 to use an external SIM/SAM reader for hf iclass sam and hf seos sam commands (@Antiklesys)
  • Added nfc encode and hf mfu ndefwrite - build NDEF URI/Text/AAR records and write them to Ultralight tags (@0x6r1an0y)
  • Fixed hf emrtd info - the picture viewer now scales images to the window instead of pinning them at native size (@iceman1001)
  • Added hf emrtd - PACE-CAM (Chip Authentication Mapping) session support. The anti-clone proof itself is not yet verified (@iceman1001)
  • Added hf emrtd test - offline regression tests for the PACE / secure messaging primitives (@iceman1001)
  • Added hf emrtd info/dump --can/--pace/--bac - PACE-ECDH-GM support with MRZ or CAN passwords, AES-CMAC-128/192/256 and 3DES-CBC-CBC secure messaging (@iceman1001)
  • Changed hf emrtd info - now shows EF_DG2 portraits for JPREG2000 via new dependecy lib (@iceman1001)
  • Changed hf emrtd info- now shows portrait, signature and other biometrics at the same time (@iceman1001)
  • Fixed pm3_grabbed_output_get - heap overflow (@jonyen)
  • Fixed hf iclass sam - removed the old implementation (@iceman1001)
  • Fixed (PM5) failing to re-enter the bootloader (@nemanjan00)
  • Fixed hw fpga config (PM5) - now powers on the FPGA 24MHz clock (@nemanjan00)
  • Fixed hf mfdes chk - now correctly check all provided keys instead of only checking a small portion (@corollary-de).
  • Fixed hf iclass unhash - now omitting valid hash0 pre-images (@trichimtrich)
  • Fixed hf iclass unhash - returning no pre-images at all for some keys, caused by check() not being invertible in a single reading (@trichimtrich)
  • Added --rgb option to hf tune / lf tune (PM5) - mirrors the antenna tuning level on the antenna RGB LED (@nemanjan00)
  • Fixed hw version / hw status (PM5) - now showing correct information for fpga images (@nemanjan00)
  • Fixed hw status [Model] section reporting "PM3 GENERIC" firmware on Proxmark5 (PM5/AT32); it now reports PM5 (@nemanjan00)
  • Added hw version / hw status - now reports Proxmark5 (PM5/AT32) correct MCU (AT32F437) (@nemanjan00)
  • Added CMake support for armsrc and bootrom (@xianglin1998)
  • Added HAL support for ARM firmware (@xianglin1998)
  • Fixed hf mf dump - preserving readable sector trailer Key B data (@oSPANNERo)
  • Changed magic_cards_notes.md - documented the USCUID-UL helper scripts (hf_mfu_uscuid / hf_mf_uscuid_prog) (@c-barron)
  • Fixed hf_mf_uscuid_prog.lua - corrected the script name shown in its usage text (@c-barron)
  • Added hf felica seacauth1 command (@kormax)
  • Added lf trovan commands to support Trovan Animal ID (@iceman1001)
  • Added support for emulating ST25TA tag (IKEA Rothult) with custom NDEF response (@Sanduuz)
  • Added hf mf gdmgetblk/gdmgethidblk/gdmsethidblk/gdmsetuid/gdmwipe/gdmsetsig (@0x6r1an0y)
  • Changed hf mf gdmparsecfg/gdmsetblk (@0x6r1an0y)
  • Renamed hf mf gdmcfg (@0x6r1an0y)
  • Added hf mfu aesgetuid for retrieving the real UID when random ID is enabled, using the UIDRetrKey. (@lolbird123)
  • Fixed hf iclass view reading past the end of dump files smaller than a picopass header (@munzzyy)
  • Fixed wiegand decode returning facility code 16777339 instead of the encoded value for the IR56 (@munzzyy)
  • Fixed lf em 4x05 dump writing byte-swapped (corrupted) block data to the saved dump file (@munzzyy)
  • Added hf 14b dump support for Standard ISO14443-B tags (@thisiscamk)
  • Added hf 14b ctrdbl and hf 14b ctdump commands for interacting with ASK CTS tags (@kormax)
  • Fixed hf legic migrate failing to parse the optional DCF argument as hex (@IdanHo)
  • Add support for parsing Finnish Helsinki Regional Transport (HRT) travel cards (@Sanduuz)
  • Added standalone mode HF_DOEGOX_COMMIT - DESFire suspended commit without relay (@doegox)
  • Changed hf 14b info- now support Innovatron protocol detection (@kormax)
  • Improved lf cotag reader and lf cotag demod - Reimplementation and enhancement of proxmark3 COTAG support
  • Added hf felica sim command (@kormax)
  • Added mad read, mad write, mad verify, mad decode, mad encode commands with typed struct MAD API (@AlxCzl)
  • Added hf mfdes getversion command (@kormax)
  • Fixed iCLASS emulator writes clearing previously loaded emulator memory after an FPGA reload (@cindersocket)
  • Added DES transport mode support for iCLASS credential encode/decode helpers. (@cindersocket)
  • Changed hf iclass view - now detect iCLASS SE SIO blocks from AIA values that point past block 6. (@cindersocket)
  • Changed doc/magic_cards_notes.md - updated the ID82xx / Hitag µ clone section with current Proxmark3 support, chip variations, default passwords and detection notes (@mishamyte)
  • Added two Mifare Classic keys into extensive dictionary which are hardcoded into Mifare Plus SE (@team-orangeBlue)
  • Fixed hf mfp rdbl when using "read multiple" blocks by decrypting the entire buffer instead of one block only (@team-orangeBlue)
  • Improved hf mfp dump execution speed by removing crypto+card restarts, approx. 40% faster (@team-orangeBlue)
  • Added support for non-first authentication in Mifare Plus (@team-orangeBlue)
  • Added CUDA version of tools/mfulc_des_brute (@C2Pwn)
  • Added hf mfu desbrute command: native client support for ULC key recovery (@C2Pwn)
  • Added hf mf sen command: native client support for FM11RF08S SEN recovery (@C2Pwn)
  • Fixed an issue where the COM port was sometimes not being selected on Windows (@boss-chifra)
  • Added Makefile PLATFORM_FILE variable to specify another Makefile.platform file (@doegox)
  • Added hf calypso probecmdcompat command (@kormax)
  • Added secure channel operations to hf iclass sam and fixed/improved I2C bus operations (@Antiklesys)
  • Added hf calypso list command (@kormax)
  • Added hf mfd verifycert command (@kormax)
  • Added hf calypso dump command (@kormax)
  • Added pm3trace_edit.py script for editing of pm3 trace files (@iceman1001)
  • Added hf calypso info command (@kormax)
  • Added ARM compilation support for picolibc, fixing compilation on Debian Forky (@doegox)
  • Added hf mdfes leaf command (@pcunning)
  • Added hf mfdes vdesign command (@kormax)
  • Added hf iclass liberate - simple command to remove changes to MKF or Icopy-X iclass tags (@iceman1001)
  • Fixed mfpReadSector function to decrypt received data, fixing commands like hf mfp dump (@team-orangeBlue)
  • Added hf mfdes intauth command (@kormax)
  • Improved hf iclass legbrute throughput: added a 64-wide bitsliced MAC1 sweep that tests 64 key candidates in parallel per cipher tick. Thanks @Chick3nman (@Antiklesys)
  • Improved hf iclass legbrute throughput further: added wider SIMD backends (128-lane NEON, 256-lane AVX2, 512-lane AVX-512F) Thanks @Chick3nman (@Antiklesys)
  • Added hf mfdes pc command (@kormax)
  • Fixed hf mfu ndefread NDEF data area size handling (@mjaksn)
  • Fixed hw qc_pm5 command to ensure the RGB LED is off at the conclusion of the test (@barefootdeveloper)
  • Improvedhw qc_pm5 command to support specifying a timeout (@barefootdeveloper)
Check out latest releases or
releases around RfidResearchGroup/proxmark3 v4.23346

Don't miss a new proxmark3 release

NewReleases is sending notifications on new releases.

Get notifications