A few weeks ago I updated my working directory of Proxmark3 and found
that Roel Verdult finally improved the USB stack by ditching the old
HID-based one and using USB CDC. My only problem was that having a device
running the HID bootloader and a compiled version of the CDC flasher caused a
chicken-egg problem. I only realized it when running make flash-all resulted
in the following error message.
client/flasher -b bootrom/obj/bootrom.elf armsrc/obj/osimage.elf armsrc/obj/fpgaimage.elf
Loading ELF file 'bootrom/obj/bootrom.elf'...
Loading usable ELF segments:
0: V 0x00100000 P 0x00100000 (0x00000200->0x00000200) [R X] @0x94
1: V 0x00200000 P 0x00100200 (0x00000e1c->0x00000e1c) [RWX] @0x298
Attempted to write bootloader but bootloader writes are not enabled
Error while loading bootrom/obj/bootrom.elf
I checked the flasher and found that it didn't recognize the -b command
line switch because it expected a port name (like /dev/ttyACM0) as the first
argument. So I needed an old flasher, but first, I checked if the flasher
binary depended on any Proxmark3 shared object libraries.
$ ldd client/flasher
linux-vdso.so.1 => (0x00007fff6a5df000)
libreadline.so.6 => /lib/x86_64-linux-gnu/libreadline.so.6 (0x00007fb1476d9000)
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fb1474bd000)
libstdc++.so.6 => /usr/lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007fb1471b5000)
libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007fb146f33000)
libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007fb146d1d000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fb146992000)
libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007fb146769000)
/lib64/ld-linux-x86-64.so.2 (0x00007fb147947000)
Since the above were all system libraries, I used an old flasher left behind
from the ages before I had commit access to the Proxmark3 SVN repository.
$ /path/to/old/flasher -b bootrom/obj/bootrom.elf \
armsrc/obj/osimage.elf armsrc/obj/fpgaimage.elf
Loading ELF file 'bootrom/obj/bootrom.elf'...
Loading usable ELF segments:
0: V 0x00100000 P 0x00100000 (0x00000200->0x00000200) [R X] @0x94
1: V 0x00200000 P 0x00100200 (0x00000e1c->0x00000e1c) [RWX] @0x298
Loading ELF file 'armsrc/obj/osimage.elf'...
Loading usable ELF segments:
1: V 0x00110000 P 0x00110000 (0x00013637->0x00013637) [R X] @0xb8
2: V 0x00200000 P 0x00123637 (0x00002c74->0x00002c74) [RWX] @0x136f0
Note: Extending previous segment from 0x13637 to 0x162ab bytes
Loading ELF file 'armsrc/obj/fpgaimage.elf'...
Loading usable ELF segments:
0: V 0x00102000 P 0x00102000 (0x0000a4bc->0x0000a4bc) [R ] @0xb4
Waiting for Proxmark to appear on USB...
Connected units:
1. SN: ChangeMe [002/007]
Found.
Entering bootloader...
(Press and release the button only to abort)
Waiting for Proxmark to reappear on USB....
Connected units:
1. SN: ChangeMe [002/008]
Found.
Flashing...
Writing segments for file: bootrom/obj/bootrom.elf
0x00100000..0x001001ff [0x200 / 2 blocks].. OK
0x00100200..0x0010101b [0xe1c / 15 blocks]............... OK
Writing segments for file: armsrc/obj/osimage.elf
0x00110000..0x001262aa [0x162ab / 355 blocks]................................................................................................................................................................................................................................................................................................................................................................... OK
Writing segments for file: armsrc/obj/fpgaimage.elf
0x00102000..0x0010c4bb [0xa4bc / 165 blocks]..................................................................................................................................................................... OK
Resetting hardware...
All done.
Have a nice day!
After resetting the Proxmark3, it finally got recognized by the system as a CDC
device, as it can be seen below on a dmesg snippet.
[10416.461687] usb 2-1.2: new full-speed USB device number 12 using ehci_hcd
[10416.555093] usb 2-1.2: New USB device found, idVendor=2d2d, idProduct=504d
[10416.555105] usb 2-1.2: New USB device strings: Mfr=1, Product=0, SerialNumber=0
[10416.555111] usb 2-1.2: Manufacturer: proxmark.org
[10416.555814] cdc_acm 2-1.2:1.0: This device cannot do calls on its own. It is not a modem.
[10416.555871] cdc_acm 2-1.2:1.0: ttyACM0: USB ACM device
The only change I saw at first was that the client became more responsive and it required the port name as a command line argument.
$ ./proxmark3 /dev/ttyACM0
proxmark3> hw version
#db# Prox/RFID mark3 RFID instrument
#db# bootrom: svn 699 2013-04-24 11:00:32
#db# os: svn 702 2013-04-24 11:02:43
#db# FPGA image built on 2012/ 1/ 6 at 15:27:56
Being happy as I was after having a working new CDC-based version, I started using it for the task I had in mind, but unfortunately, I managed to find a bug just by reading a block from a Mifare Classic card. It returned all zeros for all blocks, even though I knew they had non-zero bytes. I found the bug that was introduced by porting the code from HID to CDC and committed my fix, but I recommend everyone to test your favorite functionality thoroughly to ensure that changing the USB stack doesn't affect functionality in a negative way. If you don't have commit access, drop me an e-mail with a patch or open an issue on the tracker of the project.
Happy RFID hacking!