Brak opisu

Zachary Weiss d12fff7cdf NFC notes 3 lat temu
imgs 3556b956ce Initial commit 3 lat temu
scenes d12fff7cdf NFC notes 3 lat temu
.gitattributes 3556b956ce Initial commit 3 lat temu
README.md d12fff7cdf NFC notes 3 lat temu
application.fam 3556b956ce Initial commit 3 lat temu
mag.c 018c190179 README addition, disable string_element test 3 lat temu
mag_10px.png 3556b956ce Initial commit 3 lat temu
mag_i.h 3556b956ce Initial commit 3 lat temu

README.md

magspoof_flipper

Very early WIP of MagSpoof for the Flipper Zero. Currently rewriting from the ground up.

Interpolates work from Samy Kamkar's original MagSpoof project, dunaevai135's Flipper hackathon project, and the Flipper team's LF RFID app.

Courses of action to try in the event the LF coil signal is too weak:

  • Attempt downstream modulation techniques, in addition to upstream, like the LF RFID worker does when writing
  • Introduce a subcarrier at ~125kHz, and OOK modulate it at the desired freq of bits (~4kHz)
  • Implement using the timer system, rather than direct-writing to pins
  • Use the NFC (HF RFID) coil instead of or in addition to the LF coil (this is promising in my mind; Samsung Wallet's discontinued magstripe emulation would've been over their NFC coil, most likely)
  • Scrap all this and stick to using an external module for TX (could likely simplify to just a resistor and some coiled wire, rather than the full H-bridge build)

Other misc things to investigate / build:

  • File format, manual add, saving / loading
  • Ideal timing / speed
  • Precomputing bit output, and then sending ("RedSpoof" by devBioS does this, as they say they had timing issues when computing the bits live)
  • Reverse-track emulate?
  • Tuning of parameters like pre-signal zeros?
  • "Interpacket delay" like the RedSpoof implementation?
  • (Less important) Any way to easily wrap text on screen, without having to manually calculate the number of chars that fit and splicing the string accordingly into lines?

HF coil notes: NFC reader field can be turned on / off with furi_hal_nfc_field_on(); and furi_hal_nfc_field_off(); respectively, as seen in nfc_scene_field.c (used for debug purposes). At a lower level, that consists of furi_hal_nfc_exit_sleep(); and st25r3916TxRxOn(); to turn on, and st25r3916TxRxOff(); and furi_hal_nfc_start_sleep(); to turn off. May be worth trying directly (wake from sleep at setup, toggle on and off corresponding with bit direction, send to sleep on exit). If this doesn't work, will likely need to consider lower-level control.