Skip to content
This repository has been archived by the owner on Jul 28, 2024. It is now read-only.

Commit

Permalink
Squashed 'magspoof/' changes from 2e91ae3..5aa6220
Browse files Browse the repository at this point in the history
5aa6220 New naming fixes part 1
a26aa0f fix 5v power mag
d67a689 update apps
7ad5259 move apps
REVERT: 2e91ae3 Fixed compilation, uart
REVERT: c732f08 Reader message, missing free
REVERT: 8284fa9 Update README.md
REVERT: be79a9e MagSpoof read PoC
REVERT: a4df68c Merge pull request #3 from zacharyweiss/alt_tx
REVERT: c954330 Bump ver
REVERT: 312355e Fixed zero playback bug, initial wiggling tests
REVERT: 474b29a HF tests pt2 (unfruitful)
REVERT: 21a3a06 Merge pull request #2 from zacharyweiss/alt_tx
REVERT: 3330b8f Numerous updates
REVERT: 17c8e3b File loading fix
REVERT: 5785c75 Missed a spot
REVERT: cb247c7 Initial piezo tests
REVERT: 83bd29d More brainstorming, better credits attribution
REVERT: dadb4b6 Typo + link
REVERT: 8d0e336 Ver bump, new icon, RX brainstorming
REVERT: 156a415 Icon update
REVERT: c6f16c6 Create wiring_diagram.png
REVERT: 2941854 Update README.md
REVERT: 982a926 Bump version, new file icon, small fixes
REVERT: c643942 Minor cleanup
REVERT: acc3de9 Update README.md
REVERT: c347fc5 Merge pull request #1 from arha/arha-bitwise
REVERT: 33fcf44 timing fix for rf emulation
REVERT: a9dac27 experimental emulation over RF. slow down bit time for better RXing on a sdr
REVERT: 81ae28b process bits before emulating them, implement them with bitwise operations + remove magic pattern
REVERT: 727a009 process bits before emulating them, implement them with bitwise operations
REVERT: fd112e3 Gone bug-huntin'
REVERT: 7f0b477 UI improvements, precompute bug found
REVERT: f5f09f6 Update README.md
REVERT: c489477 Emulate scene UI improvements
REVERT: ee15eb7 Added About scene, updated Info scene
REVERT: 92a601d Misc cleanup and README updates
REVERT: 366030e Debug logging and minor cleanup
REVERT: d84391b Update README.md
REVERT: bb8df8e Update README.md
REVERT: 461cb55 Update FUNDING.yml
REVERT: 5035f1d Create FUNDING.yml
REVERT: 79550cf Create LICENSE
REVERT: 5410ddb Update README.md
REVERT: 3d56fb2 Add sample file
REVERT: 692fac8 Update README.md
REVERT: ecf253a Saved emulate 90% functional
REVERT: d0faf35 File format overhaul, config backend
REVERT: 9d20ab6 Update application.fam
REVERT: 00fdfce Quick value_index import fixes?
REVERT: 436db4b Quick saved track2 emulate tests
REVERT: 52c51f6 WIP saved emulate+config scenes
REVERT: 7f3f3ad Config scene initial testing
REVERT: 90804b1 Add manually, emulate refactor WIP
REVERT: f36b54d Update README.md
REVERT: f02ad79 README typo
REVERT: 5d6168e Notes, improved info scene
REVERT: 3e646d9 Info & delete scenes
REVERT: ca5a553 Remove debugging gunk
REVERT: 8f642df mag_device overhaul, file loading
REVERT: 0187d20 Missed a spot!
REVERT: 9d92e65 Quick HF tests, initial mag_device commit
REVERT: 8770ff6 Update README.md
REVERT: d12fff7 NFC notes
REVERT: 018c190 README addition, disable string_element test
REVERT: 5c8557f Remove unused file, name input boilerplate
REVERT: 376436c Additional README notes
REVERT: 258e46b Update mag_scene_emulate_test.c
REVERT: 3a13a51 Quick messy emulation edits/fixes
REVERT: 8449706 README typo fix
REVERT: 8f95729 Update README.md
REVERT: ef1cb1b Added historical spoofing implementation to the hardcoded emulation test ground
REVERT: f23ac31 Update README.md
REVERT: 9bea56c Create README.md
REVERT: 3556b95 Initial commit

git-subtree-dir: magspoof
git-subtree-split: 5aa6220
  • Loading branch information
Willy-JL committed Nov 12, 2023
1 parent 2e91ae3 commit 56c42d1
Show file tree
Hide file tree
Showing 6 changed files with 22 additions and 21 deletions.
11 changes: 1 addition & 10 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,17 +1,8 @@
# magspoof_flipper by Zachary Weiss
# magspoof_flipper
WIP of MagSpoof for the Flipper Zero. Basic TX of saved files confirmed working against an MSR90 with an external H-bridge module mirroring Samy Kamkar's design. RFID coil output weaker; able to be picked up/detected by more compact mag readers such as Square, but yet to have success with it being decoded/parsed properly. Additional investigation into alternate internal TX options (CC1101, ST25R3916, piezo) underway; tentatively, RFID coil + speaker (`LF + P` config setting) results in the strongest internal TX tested to date but still weaker than a dedicated external module or an actual card swipe (and sounds like a dial-up modem from hell). Sample files with test data are included in `assets` for anyone wishing to experiment.

Disclaimer: use responsibly, and at your own risk. While in my testing, I've seen no reason to believe this could damage the RFID (or other) hardware, this is inherently driving the coil in ways it was not designed or intended for; I take no responsibility for fried/bricked Flippers. Similarly, please only use this with magstripe cards and mag readers you own — this is solely meant as a proof of concept for educational purposes. I neither condone nor am sympathetic to malicious uses of my code.

## Hummus's Fork
I made this fork initially to add reading capability using UART magnetic card readers.

Things that changed in this fork:
- Added a basic card reading ability
- Added a function to parse a new MagDevice from a Card String (%Track1?;Track2;Track3?;)
- Swapped the pins between A6 to A7 on the card that I'm using, might add this to configuration scene later on
- Adapted some of the APIs to the most recent firmware changes.

## Optional GPIO TX Module
For those desiring better TX than the internal RFID coil can offer, one can build the module below, consisting of an H-bridge, a capacitor, and a coil.

Expand Down
11 changes: 5 additions & 6 deletions helpers/mag_helpers.c
Original file line number Diff line number Diff line change
Expand Up @@ -126,8 +126,6 @@ void play_track(uint8_t* bits_manchester, uint16_t n_bits, MagSetting* setting,
void tx_init_rfid() {
// initialize RFID system for TX

// OTG needed for RFID? Or just legacy from GPIO?
// furi_hal_power_enable_otg();
furi_hal_ibutton_pin_configure();

// furi_hal_ibutton_start_drive();
Expand Down Expand Up @@ -155,7 +153,6 @@ void tx_deinit_rfid() {
furi_hal_gpio_write(RFID_PIN_OUT, 0);

furi_hal_rfid_pins_reset();
furi_hal_power_disable_otg();
}

void tx_init_rf(int hz) {
Expand Down Expand Up @@ -189,7 +186,6 @@ bool tx_init(MagSetting* setting) {
tx_init_rfid();
break;
case MagTxStateGPIO:
furi_hal_power_enable_otg();
// gpio_item_configure_all_pins(GpioModeOutputPushPull);
furi_hal_gpio_init(GPIO_PIN_A, GpioModeOutputPushPull, GpioPullNo, GpioSpeedLow);
furi_hal_gpio_init(GPIO_PIN_B, GpioModeOutputPushPull, GpioPullNo, GpioSpeedLow);
Expand Down Expand Up @@ -234,9 +230,12 @@ bool tx_deinit(MagSetting* setting) {
furi_hal_gpio_write(GPIO_PIN_B, 0);
furi_hal_gpio_write(GPIO_PIN_ENABLE, 0);

// set back to analog output mode?
// set back to analog output mode? - YES
furi_hal_gpio_init(GPIO_PIN_A, GpioModeAnalog, GpioPullNo, GpioSpeedLow);
furi_hal_gpio_init(GPIO_PIN_B, GpioModeAnalog, GpioPullNo, GpioSpeedLow);
furi_hal_gpio_init(GPIO_PIN_ENABLE, GpioModeAnalog, GpioPullNo, GpioSpeedLow);

//gpio_item_configure_all_pins(GpioModeAnalog);
furi_hal_power_disable_otg();
break;
case MagTxStatePiezo:
tx_deinit_piezo();
Expand Down
13 changes: 13 additions & 0 deletions mag.c
Original file line number Diff line number Diff line change
Expand Up @@ -179,11 +179,24 @@ int32_t mag_app(void* p) {

mag_make_app_folder(mag);

// Enable 5v power, multiple attempts to avoid issues with power chip protection false triggering
uint8_t attempts = 0;
bool otg_was_enabled = furi_hal_power_is_otg_enabled();
while(!furi_hal_power_is_otg_enabled() && attempts++ < 5) {
furi_hal_power_enable_otg();
furi_delay_ms(10);
}

view_dispatcher_attach_to_gui(mag->view_dispatcher, mag->gui, ViewDispatcherTypeFullscreen);
scene_manager_next_scene(mag->scene_manager, MagSceneStart);

view_dispatcher_run(mag->view_dispatcher);

// Disable 5v power
if(furi_hal_power_is_otg_enabled() && !otg_was_enabled) {
furi_hal_power_disable_otg();
}

mag_free(mag);

return 0;
Expand Down
4 changes: 2 additions & 2 deletions scenes/mag_scene_input_name.c
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#include <lib/toolbox/random_name.h>
#include <toolbox/name_generator.h>
#include "../mag_i.h"

void mag_scene_input_name_on_enter(void* context) {
Expand All @@ -13,7 +13,7 @@ void mag_scene_input_name_on_enter(void* context) {

if(name_is_empty) {
furi_string_set(mag->file_path, MAG_APP_FOLDER);
set_random_name(mag->text_store, MAG_TEXT_STORE_SIZE);
name_generator_make_auto(mag->text_store, MAG_TEXT_STORE_SIZE, "Mag");
furi_string_set(folder_path, MAG_APP_FOLDER);
} else {
// TODO: compatible types etc
Expand Down
2 changes: 1 addition & 1 deletion scenes/mag_scene_read.c
Original file line number Diff line number Diff line change
Expand Up @@ -182,4 +182,4 @@ void mag_scene_read_on_exit(void* context) {
// furi_hal_console_enable();

notification_message(mag->notifications, &sequence_blink_stop);
}
}
2 changes: 0 additions & 2 deletions scenes/mag_scene_saved_menu.c
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,6 @@ void mag_scene_saved_menu_on_enter(void* context) {
Mag* mag = context;
Submenu* submenu = mag->submenu;

notification_message(mag->notifications, &sequence_blink_cyan_10);

// messy code to quickly check which tracks are available for emulation/display
// there's likely a better spot to do this, but the MagDevice functions don't have access to the full mag struct...
bool is_empty_t1 = furi_string_empty(mag->mag_dev->dev_data.track[0].str);
Expand Down

0 comments on commit 56c42d1

Please sign in to comment.