44 Standalone mode
Iceman edited this page 2024-02-19 18:12:53 +01:00

Introduction

The most curious concept of Proxmark3 is standalone mode.

If you can power your device from battery, you can run small modules from the PM3 itself, without needing a computer running the PM3 client.

These modules are usually limited to a single function, eg: "read and emulate a Legic Prime RFID tag". This also means the user interface is limited to the LEDs and the button:

LEDS BUTTON PRESS
4 leds (A,B,C,D) short, long or multiple (twice)

All standalone modes use this differently, and it is hard to figure out what is what. Looking at the source code for each mode generally helps!

To enter the currently flashed standalone mode, press and hold the button until the LEDs play a short animation.

Warning: all standalone modes that target generic PM3 devices will lose data on power loss (or if the battery goes flat). Standalone modes that take advantage of RDV4-specific features can overcome this by storing data to flash.

Supported standalone modes

For any iceman based repo the current most popular public standalone modes is quite easy to compile and install.

In this repo its even easier than before. The default standalone mode is LF_SAMYRUN.

Table of built-in standalone modes:

Module Description Author Device target
LF_EM4100EMUL Simulate predefined EM4100 tags Artyom Gnatyuk All
LF_EM4100RSWB Read/simulate/brute/clone EM4100 tags Monster1024 All
LF_EM4100RSWW Read/write/clone/validate/wipe EM4100 tags Łukasz "zabszk" Jurczyk All
LF_EM4100RWC Read/simulate/clone EM4100 tags Artyom Gnatyuk All
LF_HIDBRUTE HID corporate 1000 bruteforce Federico dotta & Maurizio Agazzini All
LF_HIDFCBRUTE HID Facility Code bruteforce ss23 RDV4
LF_ICEHID LF HID / IOprox / AWID / EM4100 collector to flashmem Iceman1001 RDV4
LF_MULTIHID LF HID 26 Bit (H1031) multi simulator Shain Lakin All
LF_NEDAP_SIM LF Nedap ID simple simulator Benjamin gentilkiwi DELPY All
LF_NEXID Nexwatch credentials detection mode jrjgjk & Zolorah RDV4
LF_PROXBRUTE HID ProxII bruteforce Brad Antoniewicz All
LF_PROX2BRUTE HID ProxII bruteforce v2 Yann Gascuel All
LF_SAMYRUN HID26 read/clone/sim Samy Kamkar All
LF_SKELETON Standalone mode skeleton Iceman1001 All
LF_THAREXDE LF EM4x50 simulator/read standalone mode tharexde RDV4
HF_14ASNIFF HF 14a sniff to flashmem Michael Farrell RDV4
HF_14BSNIFF HF 14b sniff to flashmem Jacopo Jannone All
HF_15SNIFF HF 15693 sniff to flashmem Nathan Glaser RDV4
HF_AVEFUL MIFARE Ultralight read/simulation Ave Ozkal All
HF_BOG HF 14a sniff ULC/ULEV1/NTAG auth to flashmem Bogito RDV4
HF_CARDHOPPER Relay 14a protocols over long distances (w/ IP backbone) Sam Haskins RDV4
HF_COLIN MIFARE ultra fast sniff/sim/clone to flashmem Colin Brigato RDV4
HF_CRAFTBYTE UID stealer - Emulates scanned 14a UID Anze Jensterle All
HF_ICECLASS iCLASS 4-1 mode sim/read & dump/loclass/glitch & config to flashmem Iceman1001 RDV4
HF_LEGIC Read/simulate Legic Prime tags (RDV4: + save to flashmem) Stefanie Hofmann & Uli Heilmeier All / RDV4 *
HF_LEGICSIM Simulate Legic Prime tags Uli Heilmeier RDV4
HF_MATTYRUN MIFARE sniff/clone Matías A. Ré Medina All
HF_MFCSIM MIFARE Classic simulate Ray Lee RDV4
HF_MSDSAL (default) Read and emulate MSD Visa cards Salvador Mendoza All
HF_REBLAY 14A relay over BT Salvador Mendoza All
HF_TCPRST IKEA Rothult ST25TA, Standalone Master Key Dump/Emulation Nick Draffen All
HF_TMUDFORD Read and emulate ISO15693 card UID Tim Mudford All
HF_UNISNIFF Multimode HF sniffer with optional flashmem & runtime select Hazardousvoltage All
HF_YOUNG MIFARE sniff/simulation Craig Young All
DANKARMULTI Load multiple standalone modes Daniel Karling All

Warning: some standalone modes takes advantage of RDV4 specific features, which may not work on non-RDV4 devices. You will most likely need to read the source code to understand what is supported.

Installing a different standalone module

The standalone module can be switched in the file Makefile.platform. Only one standalone module can be chosen at a time.

  1. Copy Makefile.platform.sample to Makefile.platform

  2. Edit the STANDALONE variable inside Makefile.platform. You need to uncomment it and chose a standalone mode. For example:

    PLATFORM=PM3RDV4
    #PLATFORM_EXTRAS=BTADDON
    STANDALONE=LF_EM4100RWC
    

After changing your standalone mode, don't forget to build and flash the code to the Proxmark3:

  1. make clean
  2. make -j
  3. ./pm3-flash-fullimage

Writing your own

See: https://github.com/RfidResearchGroup/proxmark3/blob/master/armsrc/Standalone/readme.md

Additional information

Some members of our community have produced text and video walk-throughs of these modules: