You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-[X] File format issues when Track 2 data exists but Track 1 is left empty; doesn't seem to be setting the Track 2 field with anything (doesn't overwrite existing data). However, `flipper_format_read_string()` doesn't seem to return `false`. Is the bug in my code, or with `flipper_format`?
4
+
-[X] Review how it's done in [unirfremix (Sub-GHz Remote)](https://github.com/DarkFlippers/unleashed-firmware/blob/dev/applications/main/unirfremix/unirfremix_app.c), as IIRC that can handle empty keys, despite using the `flipper_format` lib for parsing.
5
+
-[X] Attempting to play a track that doesn't have data results in a crash (as one might expect). Need to lock out users from selecting empty tracks in the config menu or do better error handling (*Doesn't crash now, but still should probably prevent users from being able to select*)
6
+
-[ ] Custom text input scene with expanded characterset (Add Manually) has odd behavior when navigating the keys near the numpad
7
+
8
+
Emulation:
9
+
-[X] Validate arha's bitmap changes, transition over to it fully
-[X] Finish emulation config scene (reverse track functionality; possibly expand settings list to include prefix/between/suffix options)
20
+
-[ ] "Edit" scene (generalize `input_value`)
21
+
-[ ] "Rename" scene (generalize `input_name`)
22
+
23
+
File management:
24
+
-[ ] Update Add Manually flow to reflect new file format (currently only sets Track 2)
25
+
-[ ] Validation of card track data?
26
+
-[ ] Parsing loaded files into human-readable fields? (would we need to specify card type to decode correctly?)
27
+
28
+
## Skunkworks ideas
29
+
Internal TX improvements:
30
+
-[ ] Attempt downstream modulation techniques in addition to upstream, like the LF RFID worker does when writing.
31
+
-[ ] Implement using the timer system, rather than direct-writing to pins
32
+
-[X] Use the NFC (HF RFID) coil instead of or in addition to the LF coil (likely unfruitful from initial tests; we can enable/disable the oscillating field, but even with transparent mode to the ST25R3916, it seems we don't get low-enough-level control to pull it high/low correctly)
33
+
-[ ] Add "subcarriers" to each half-bit transmitted (wiggle the pin high and low rapidly)
34
+
-[ ] Piezo subcarrier tests
35
+
-[ ] LF subcarrier tests
36
+
-[X] Retry NFC oscillating field?
37
+
38
+
External RX options:
39
+
1.[TTL / PS/2 mag reader connected to UART](https://www.alibaba.com/product-detail/Mini-portable-12-3-tracks-usb_60679900708.html) (bulky, harder to source, but likely easiest to read over GPIO, and means one can read all tracks)
40
+
2. Square audio jack mag reader (this may be DOA; seems like newer versions of the Square modules have some form of preprocessing that also modifies the signal, perhaps in an effort to discourage folks using their hardware independent of their software. Thanks arha for your work investigating this)
41
+
3. Some [read-head](https://www.alibaba.com/product-detail/POS-1-2-3-triple-track_60677205741.html) directly connected to GPIO, ADC'd, and parsed all on the Flipper. Likely the most compact and cheapest module option, but also would require some signal-processing cleverness.
42
+
4. USB HID input over pre-existing USB C port infeasible; seems the FZ cannot act as an HID host (MCU is the STM32WB55RGV6TR).
43
+
5. Custom USB HID host hat based on the [MAX3421E](https://www.analog.com/en/products/max3421e.html) (USB Host Controller w/ SPI), like the [Arduino USB Host Shield](https://docs.arduino.cc/retired/shields/arduino-usb-host-shield). Would be a large but worthwhile project in its own right, and would let one connect any USB HID reader they desire (or other HID devices for other projects). Suggestion credit to arha.
44
+
6. Implement a software/firmware USB host solution over GPIO like [esp32_usb_soft_host (for ESP32)](https://github.com/sdima1357/esp32_usb_soft_host) or [V-USB (for AVR)](https://www.obdev.at/products/vusb/index.html). Suggestion credit to arha. Also a massive undertaking, but valuable in and of itself.
45
+
46
+
## arha todo & notes
47
+
Attempting to exploit flipper hardware to some extent
48
+
49
+
-[X] Preprocess all MSR data into bitwise arrays, including manchester encoding.
50
+
-[ ] Feed bits from timers
51
+
-[ ] Sync to the lfrfid timer and experiment representing a field flip with a few cycles of a high frequency carrier, like the 125khz lfrfid one. Perhaps mag readers' frontends will lowpass such signals, and keep only the low frequency component, in an attempt to drown out nearby noise?
52
+
-[X] Can the CC1101 radio be used in any way? Driving it from GD0 can achieve 50us, or about 10khz. Probably more with sync/packet mode. **Currently under testing**. The signal is extra noisy with a very wide bandwidth, but, in theory, it can work
53
+
-[ ] Can the 5V pin act as a coil driver? I've read reports it can drive 0.4A, other reports it can drive 2A. It boils down to bq25896 being fast enough. Ref: bq25896_enable_otg, which will probably need bypassing kernel libs and calling furi_hal_i2c_tx/furi_hal_i2c_tx whatever calls from Cube libs.
54
+
-[ ] Investigate transparent mode on 3916
55
+
-[ ] Can the piezo be used at its resonant frequency? I've seen LF signals being emulated with [nothing but headphones](https://github.com/smre/DCF77/blob/master/DCF77.py#L124) running a subharmonic; the wheel brake on some carts seems to react to audiofreq signals (or the RF emission from driving a speaker)
56
+
57
+
## Hummus's Fork
58
+
I made this fork initially to add reading capability using UART magnetic card readers.
59
+
60
+
Things that changed in this fork:
61
+
- Added a basic card reading ability
62
+
- Added a function to parse a new MagDevice from a Card String (%Track1?;Track2;Track3?;)
63
+
- Swapped the pins between A6 to A7 on the card that I'm using, might add this to configuration scene later on
64
+
- Adapted some of the APIs to the most recent firmware changes.
WIP of MagSpoof for the Flipper Zero. Basic TX of saved files confirmed working against an MSR90 with an external H-bridge module mirroring Samy Kamkar's design. RFID coil output weaker; able to be picked up/detected by more compact mag readers such as Square, but yet to have success with it being decoded/parsed properly. Additional investigation into alternate internal TX options (CC1101, ST25R3916, piezo) underway; tentatively, RFID coil + speaker (`LF + P` config setting) results in the strongest internal TX tested to date but still weaker than a dedicated external module or an actual card swipe (and sounds like a dial-up modem from hell). Sample files with test data are included in `assets` for anyone wishing to experiment.
1
+
# magspoof_flipper
2
+
WIP of MagSpoof for the Flipper Zero. Basic TX of saved files confirmed working against an MSR90 with an external H-bridge module mirroring Samy Kamkar's design. Sample files are included in `resources`.
3
3
4
-
Disclaimer: use responsibly, and at your own risk. While in my testing, I've seen no reason to believe this could damage the RFID (or other) hardware, this is inherently driving the coil in ways it was not designed or intended for; I take no responsibility for fried/bricked Flippers. Similarly, please only use this with magstripe cards and mag readers you own — this is solely meant as a proof of concept for educational purposes. I neither condone nor am sympathetic to malicious uses of my code.
4
+
RFID coil output weaker; able to be picked up/detected by more compact mag readers such as Square, but yet to have success with it being decoded/parsed properly. Additional investigation was made into alternate internal TX options (CC1101, ST25R3916, piezo); tentatively, RFID coil + speaker (`LF + P` config setting) results in the strongest internal TX tested to date but still weaker than a dedicated external module or an actual card swipe (and sounds like a dial-up modem from hell). For information on the state of internal TX &/or misc TODOs, known bugs, etc, confer `NOTES.md`.
5
5
6
-
## Hummus's Fork
7
-
I made this fork initially to add reading capability using UART magnetic card readers.
6
+
**Disclaimer**: use responsibly, and at your own risk. ***I neither condone nor am sympathetic to malicious uses of my code.*** Please only use this with magstripe cards and mag readers you own — this is solely meant as a proof of concept for educational purposes. Similarly, if using internal TX: while in my testing, I've seen no reason to believe this could damage the RFID (or other) hardware, this is inherently driving the coil in ways it was not designed or intended for; I take no responsibility for fried/bricked Flippers.
8
7
9
-
Things that changed in this fork:
10
-
- Added a basic card reading ability
11
-
- Added a function to parse a new MagDevice from a Card String (%Track1?;Track2;Track3?;)
12
-
- Swapped the pins between A6 to A7 on the card that I'm using, might add this to configuration scene later on
13
-
- Adapted some of the APIs to the most recent firmware changes.
14
8
15
-
## Optional GPIO TX Module
16
-
For those desiring better TX than the internal RFID coil can offer, one can build the module below, consisting of an H-bridge, a capacitor, and a coil.
9
+
## GPIO TX Module
10
+
For those desiring better TX than the internal RFID coil can offer, one can build the module below, consisting of an H-bridge, a capacitor, and a coil. Custom GPIO pin selection is a planned future feature.
-[X] File format issues when Track 2 data exists but Track 1 is left empty; doesn't seem to be setting the Track 2 field with anything (doesn't overwrite existing data). However, `flipper_format_read_string()` doesn't seem to return `false`. Is the bug in my code, or with `flipper_format`?
24
-
-[X] Review how it's done in [unirfremix (Sub-GHz Remote)](https://github.com/DarkFlippers/unleashed-firmware/blob/dev/applications/main/unirfremix/unirfremix_app.c), as IIRC that can handle empty keys, despite using the `flipper_format` lib for parsing.
25
-
-[X] Attempting to play a track that doesn't have data results in a crash (as one might expect). Need to lock out users from selecting empty tracks in the config menu or do better error handling (*Doesn't crash now, but still should probably prevent users from being able to select*)
26
-
-[ ] Custom text input scene with expanded characterset (Add Manually) has odd behavior when navigating the keys near the numpad
27
-
28
-
Emulation:
29
-
-[X] Validate arha's bitmap changes, transition over to it fully
-[X] Finish emulation config scene (reverse track functionality; possibly expand settings list to include prefix/between/suffix options)
40
-
-[ ] "Edit" scene (generalize `input_value`)
41
-
-[ ] "Rename" scene (generalize `input_name`)
42
-
43
-
File management:
44
-
-[ ] Update Add Manually flow to reflect new file format (currently only sets Track 2)
45
-
-[ ] Validation of card track data?
46
-
-[ ] Parsing loaded files into human-readable fields? (would we need to specify card type to decode correctly?)
47
-
48
-
## Skunkworks ideas
49
-
Internal TX improvements:
50
-
-[ ] Attempt downstream modulation techniques in addition to upstream, like the LF RFID worker does when writing.
51
-
-[ ] Implement using the timer system, rather than direct-writing to pins
52
-
-[X] Use the NFC (HF RFID) coil instead of or in addition to the LF coil (likely unfruitful from initial tests; we can enable/disable the oscillating field, but even with transparent mode to the ST25R3916, it seems we don't get low-enough-level control to pull it high/low correctly)
53
-
-[ ] Add "subcarriers" to each half-bit transmitted (wiggle the pin high and low rapidly)
54
-
-[ ] Piezo subcarrier tests
55
-
-[ ] LF subcarrier tests
56
-
-[X] Retry NFC oscillating field?
57
-
58
-
External RX options:
59
-
1.[TTL / PS/2 mag reader connected to UART](https://www.alibaba.com/product-detail/Mini-portable-12-3-tracks-usb_60679900708.html) (bulky, harder to source, but likely easiest to read over GPIO, and means one can read all tracks)
60
-
2. Square audio jack mag reader (this may be DOA; seems like newer versions of the Square modules have some form of preprocessing that also modifies the signal, perhaps in an effort to discourage folks using their hardware independent of their software. Thanks arha for your work investigating this)
61
-
3. Some [read-head](https://www.alibaba.com/product-detail/POS-1-2-3-triple-track_60677205741.html) directly connected to GPIO, ADC'd, and parsed all on the Flipper. Likely the most compact and cheapest module option, but also would require some signal-processing cleverness.
62
-
4. USB HID input over pre-existing USB C port infeasible; seems the FZ cannot act as an HID host (MCU is the STM32WB55RGV6TR).
63
-
5. Custom USB HID host hat based on the [MAX3421E](https://www.analog.com/en/products/max3421e.html) (USB Host Controller w/ SPI), like the [Arduino USB Host Shield](https://docs.arduino.cc/retired/shields/arduino-usb-host-shield). Would be a large but worthwhile project in its own right, and would let one connect any USB HID reader they desire (or other HID devices for other projects). Suggestion credit to arha.
64
-
6. Implement a software/firmware USB host solution over GPIO like [esp32_usb_soft_host (for ESP32)](https://github.com/sdima1357/esp32_usb_soft_host) or [V-USB (for AVR)](https://www.obdev.at/products/vusb/index.html). Suggestion credit to arha. Also a massive undertaking, but valuable in and of itself.
65
-
66
-
## arha todo & notes
67
-
Attempting to exploit flipper hardware to some extent
68
-
69
-
-[X] Preprocess all MSR data into bitwise arrays, including manchester encoding.
70
-
-[ ] Feed bits from timers
71
-
-[ ] Sync to the lfrfid timer and experiment representing a field flip with a few cycles of a high frequency carrier, like the 125khz lfrfid one. Perhaps mag readers' frontends will lowpass such signals, and keep only the low frequency component, in an attempt to drown out nearby noise?
72
-
-[X] Can the CC1101 radio be used in any way? Driving it from GD0 can achieve 50us, or about 10khz. Probably more with sync/packet mode. **Currently under testing**. The signal is extra noisy with a very wide bandwidth, but, in theory, it can work
73
-
-[ ] Can the 5V pin act as a coil driver? I've read reports it can drive 0.4A, other reports it can drive 2A. It boils down to bq25896 being fast enough. Ref: bq25896_enable_otg, which will probably need bypassing kernel libs and calling furi_hal_i2c_tx/furi_hal_i2c_tx whatever calls from Cube libs.
74
-
-[ ] Investigate transparent mode on 3916
75
-
-[ ] Can the piezo be used at its resonant frequency? I've seen LF signals being emulated with [nothing but headphones](https://github.com/smre/DCF77/blob/master/DCF77.py#L124) running a subharmonic; the wheel brake on some carts seems to react to audiofreq signals (or the RF emission from driving a speaker)
76
-
77
15
----
78
16
## Credits
79
17
This project interpolates work from [Samy Kamkar](https://github.com/samyk/)'s [original MagSpoof project](https://github.com/samyk/magspoof), [Alexey D. (dunaevai135)](https://github.com/dunaevai135/) & [Alexandr Yaroshevich](https://github.com/AYaro)'s [Flipper hackathon project](https://github.com/dunaevai135/flipperzero-firmware/tree/dev/applications/magspoof), and the [Flipper team](https://github.com/flipperdevices)'s [LF RFID](https://github.com/flipperdevices/flipperzero-firmware/tree/dev/applications/main/lfrfid) and [SubGhz](https://github.com/flipperdevices/flipperzero-firmware/tree/dev/applications/main/subghz) apps.
@@ -86,4 +24,6 @@ Many thanks to everyone who has helped in addition to those above, most notably:
86
24
-[Tiernan (NVX)](https://github.com/nvx) + dlz for NFC consultation
87
25
- davethepirate for EE insight and acting as a sounding board
88
26
-[cool4uma](https://github.com/cool4uma) for their work on custom text_input scenes
27
+
-[hummusec](https://github.com/hummusec) for testing of UART RX
28
+
-[xMasterX](https://github.com/xMasterX) and [WillyJL](https://github.com/Willy-JL) for keeping the app updated across API changes while I was away!
89
29
- Everyone else I've had the pleasure of chatting with!
0 commit comments