Skip to content

Commit acc3de9

Browse files
authored
Update README.md
1 parent c347fc5 commit acc3de9

File tree

1 file changed

+28
-30
lines changed

1 file changed

+28
-30
lines changed

README.md

Lines changed: 28 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,45 @@
11
# magspoof_flipper
2-
WIP of MagSpoof for the Flipper Zero. Currently rewriting from the ground up; basic TX of saved files should now work over both RFID (using the Flipper's internal coil) and GPIO (pins A6 and A7: such that one can connect an H-bridge and external coil). A sample file with test data is included in `assets`, for anyone wishing to experiment. Using this README as coarse notes of what remains to be done; anyone is welcome to contribute!
2+
WIP of MagSpoof for the Flipper Zero. Basic TX of saved files confirmed working against an MSR90 with an external H-bridge module mirroring Samy Kamkar's design (wired to 5V, GND, A7, A6, and A4; will include a wiring diagram soon). RFID coil output weaker; able to be picked up/detected by more compact mag readers such as Square, but yet to have success with it being decoded/parsed properly. Additional WIP investigation into alternate internal TX options (CC1101, ST25R3916, piezo) underway, courtesy of arha. Sample files with test data are included in `assets` for anyone wishing to experiment.
33

44
Disclaimer: use responsibly, and at your own risk. While in my testing, I've seen no reason to believe this could damage the RFID hardware, this is inherently driving the coil in ways it was not designed or intended for; I take no responsibility for fried/bricked Flippers. Similarly, please only use this with magstripe cards and mag readers you own — this is solely meant as a proof of concept for educational purposes. I neither condone nor am sympathetic to malicious uses of my code.
55

66
## TODO
7+
Known bugs:
8+
- [ ] File format issues when Track 2 data exists but Track 1 is left empty; doesn't seem to be setting the Track 2 field with anything (doesn't overwrite existing data). However, `flipper_format_read_string()` doesn't seem to return `false`. Is the bug in my code, or with `flipper_format`?
9+
- [ ] Attempting to play a track that doesn't have data results in a crash (as one might expect). Need to lock out users from selecting empty tracks in the config menu or do better error handling
10+
- [ ] Custom text input scene with expanded characterset (Add Manually) has odd behavior when navigating the keys near the numpad
11+
712
Emulation:
8-
- Fix signal truncation issue! *Edit: Tentative fix in place*
9-
- General code cleanup
10-
- Reverse track precompute & replay
11-
- Prefix/between/suffix addition to config menu
12-
- Parameter tuning, find best defaults, troubleshoot improperly parsed TX
13-
- Implement/integrate better bitmap than hacky first pass? Boilerplate from [antirez](https://github.com/antirez)'s better approach (from [ProtoView](https://github.com/antirez/protoview)) included at the bottom of `helpers/mag_helpers.c`
14-
- Should the main timing-sensitive section be branchless? (Remove `if` and `switch` statements from the `FURI_CRITICAL...` section of `mag_spoof()`?)
15-
- Pursue skunkworks TX improvement ideas listed below
13+
- [ ] Validate arha's bitmap changes, transition over to it fully
14+
- [ ] General code cleanup
15+
- [ ] Reverse track precompute & replay (should be simple with new bitmap approach; just iterate through bytes backwards, bits forwards?)
16+
- [ ] Prefix/between/suffix addition to config menu
17+
- [ ] Parameter tuning, find best defaults, troubleshoot improperly parsed TX
18+
- [ ] Pursue skunkworks TX improvement ideas listed below
1619

1720
Scenes:
18-
- Finish emulation config scene (reverse track functionality; possibly expand settings list to include prefix/between/suffix options)
19-
- "Edit" scene (generalize "Add manually")
20-
- "Rename" scene (generalize input_name)
21+
- [ ] Finish emulation config scene (reverse track functionality; possibly expand settings list to include prefix/between/suffix options)
22+
- [ ] "Edit" scene (generalize "Add manually")
23+
- [ ] "Rename" scene (generalize input_name)
2124

2225
File management:
23-
- Validation of card track data?
24-
- Parsing loaded files into human-readable fields (would we need to specify card type to decode correctly?)
25-
- Update Add Manually flow to reflect new file format (currently only sets Track 2)
26-
27-
Known bugs:
28-
- From debug logging output, seems precomputed signal is getting truncated somehow! This is priority \#1 to fix. *Edit: Tentative fix in place*
29-
- Custom text input scene with expanded characterset (Add Manually) has odd behavior when navigating the keys near the numpad
30-
- File format issues when Track 2 data exists but Track 1 is left empty; doesn't seem to be setting the Track 2 field with anything (doesn't overwrite existing data). However, `flipper_format_read_string()` doesn't seem to return `false`. Is the bug in my code, or with `flipper_format`?
31-
- Attempting to play a track that doesn't have data results in a crash (as one might expect). Need to lock out users from selecting empty tracks in the config menu or do better error handling
26+
- [ ] Update Add Manually flow to reflect new file format (currently only sets Track 2)
27+
- [ ] Validation of card track data?
28+
- [ ] Parsing loaded files into human-readable fields? (would we need to specify card type to decode correctly?)
3229

3330
## Skunkworks ideas
3431
Internal TX improvements:
35-
- Attempt downstream modulation techniques, in addition to upstream, like the LF RFID worker does when writing, for stronger signal
36-
- Implement using the timer system, rather than direct-writing to pins
37-
- Use the NFC (HF RFID) coil instead of or in addition to the LF coil (likely unfruitful from initial tests; we can enable/disable the oscillating field, but even with transparent mode to the ST25R3916, it seems we don't get low-enough-level control to pull it high/low correctly)
32+
- [ ] Attempt downstream modulation techniques, in addition to upstream, like the LF RFID worker does when writing, for stronger signal
33+
- [ ] Implement using the timer system, rather than direct-writing to pins
34+
- [ ] Use the NFC (HF RFID) coil instead of or in addition to the LF coil (likely unfruitful from initial tests; we can enable/disable the oscillating field, but even with transparent mode to the ST25R3916, it seems we don't get low-enough-level control to pull it high/low correctly)
3835

3936
External RX options:
40-
- UART-connected mag reader (bulky, but likely easiest to read over GPIO, and means one can read all tracks)
41-
- Square audio jack mag reader (this may be DOA; seems like newer versions of the Square modules have some form of preprocessing that also modifies the signal, perhaps in an effort to discourage folks using their hardware independent of their software. Thanks [@arha](https://github.com/arha) for your work investigating this)
42-
- Some read-head directly connected to GPIO, ADC'd, and parsed all on the Flipper. Likely the most compact and cheapest module option, but also would require the most work.
43-
- USB HID input likely infeasible; seems the FZ cannot act as an HID host.
37+
1. UART-connected mag reader (bulky, but likely easiest to read over GPIO, and means one can read all tracks)
38+
2. Square audio jack mag reader (this may be DOA; seems like newer versions of the Square modules have some form of preprocessing that also modifies the signal, perhaps in an effort to discourage folks using their hardware independent of their software. Thanks [@arha](https://github.com/arha) for your work investigating this)
39+
3. Some read-head directly connected to GPIO, ADC'd, and parsed all on the Flipper. Likely the most compact and cheapest module option, but also would require the most work.
40+
4. USB HID input likely infeasible; seems the FZ cannot act as an HID host.
4441

45-
## arha-bitwise branch todo & notes
42+
## arha todo & notes
4643
Attempting to exploit flipper hardware to some extent
4744

4845
- [X] Preprocess all MSR data into bitwise arrays, including manchester encoding.
@@ -58,9 +55,10 @@ Attempting to exploit flipper hardware to some extent
5855
This project interpolates work from [Samy Kamkar's original MagSpoof project](https://github.com/samyk/magspoof), [dunaevai135 & AlexYaro's Flipper hackathon project](https://github.com/dunaevai135/flipperzero-firmware), and the Flipper team's [LF RFID](https://github.com/flipperdevices/flipperzero-firmware/tree/dev/applications/main/lfrfid) and [SubGhz](https://github.com/flipperdevices/flipperzero-firmware/tree/dev/applications/main/subghz) apps.
5956

6057
Many thanks to everyone who has helped in addition to those above, most notably:
58+
- [arha](https://github.com/arha) for bitmapping work and skunkworks testing (now a collaborator!)
6159
- [antirez](https://github.com/antirez) for bitmapping suggestions and general C wisdom
6260
- [skotopes](https://github.com/skotopes) for RFID consultation
6361
- [NVX](https://github.com/nvx) + dlz for NFC consultation
64-
- davethepirate + [arha](https://github.com/arha) for EE insight and acting as sounding boards
62+
- davethepirate for EE insight and acting as a sounding board
6563
- [cool4uma](https://github.com/cool4uma) for their work on custom text_input scenes
6664
- Everyone else I've had the pleasure of chatting with!

0 commit comments

Comments
 (0)