- Requirements
- Notes
- Setup
- PC-like method
- TCP bridge method
- Compiling and Flashing a Proxmark3 Firmware from non-root Android
^Top
- Android phone
- Termux
- Proxmark3 RDV4 (https://www.proxmark.com/proxmark-3-hardware/proxmark-3-rdv4)
- Blueshark Standalone Module (Bluetooth ONLY) (https://www.proxmark.com/proxmark-news/proxmark3-blueshark-bluetooth-released)
- Proxmark with BTADDON compiled Firmware (Bluetooth ONLY) (https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md#platform_extras)
^Top From official Proxmark3 wiki:
In any case, you would need a USB-C to A or USB-OTG cable to connect Proxmark3 to your Android device. Some Android devices may not supply enough power (USB-OTG = 100mA), and need a USB Y-cable and external battery, otherwise they will get strange failures. ref : https://github.com/Proxmark/proxmark3/wiki/android
^Top
^Top
Install Termux and start it
^Top
Run the following commands:
pkg install proxmark3
Run the following commands:
pkg install proxmark3-git
pkg install make clang readline libc++ git binutils
git clone https://github.com/RfidResearchGroup/proxmark3.git
cd proxmark3
make clean && make client
^Top
^Top
- Kernel with one of:
- USB_ACM driver
- module loading enabled
- published sources
- Root
termux shell:
pkg install tsu
^Top
You need the USB_ACM
driver enabled and working to communicate with the Proxmark3. To see if it's working, run tsudo ls /dev/tty*
and it should list /dev/ttyACM0
(or similar). If you see this, congratulations, skip this step!
^Top
If your kernel has module loading enabled, you should be able to build the module separately and load it on your system without any changes. Otherwise, grab your kernel sources and edit your build config to include CONFIG_USB_ACM=y
. On the tested kernel, this was under: android_kernel_oneplus_msm8998/arch/arm64/configs/omni_oneplus5_defconfig
^Top
If using a custom kernel, refer to the build instructions provided by its maintainer. Otherwise, follow the standard Linux kernel build procedure
^Top
You can flash the kernel however it suits you. On the tested device, this was achieved using TWRP, the most popular custom recovery
^Top
Open Termux and start the Proxmark3 client:
tsudo proxmark3/client/proxmark3 /dev/ttyACM0
Everything should work just like if it was your PC!
^Top
dmesg | grep usb
- useful debug info/proc/config.gz
- contains your kernel's build configuration. Look forCONFIG_USB_ACM
, which should be enabled
^Top
Termux doesn't come with usb serial neither bluetooth serial drivers. However, it is fully integrated with phone's network, so we need to talk to the proxmark using serial to tcp sockets (carried out by android apps).
^Top
^Top
Install this free TCPUART app on the Play Store
The app lets you choose the baudrate. Default value (115 200 baud) is fine. Plug the PM3 in and click connect. Set the toggle in server mode and choose a random port not used by system (e.g. 4321) and start the server.
Alternatively, use the paid version of the BT/USB/TCP Bridge app which includes USB bridge as well.
In this app, select TCP server as 'Device A' and choose an unused port (e.g. 4321). Choose your registered PM3 device as 'Device B' -> 'Connect to USB device'. Ensure 'Retransmission' is set to 'both ways'. It is possible to record the config as autostart, cf 'Settings' -> 'Autostart setting'.
^Top
^Top
Install this free app or the paid version (which includes usb bridge)
You need to pair the proxmark3 in the Android settings. In the app, select TCP server as 'Device A' and choose an unused port (e.g. 4321). Choose your registered PM3 device as 'Device B' -> 'Connect to classic Bluetooth device'. Ensure 'Retransmission' is set to 'both ways'. It is possible to record the config as autostart, cf 'Settings' -> 'Autostart setting'.
^Top
Start a new session, then:
proxmark3 tcp:localhost:<chosenPort>
Alternatively, if you have made the client in the git repo:
./client/proxmark3 tcp:localhost:<chosenPort>
^Top
^Top
- Phone and pm3 are connected, blue led is on and not blinking
- BTUART Tool TCP Server at Port 4321
- Using proxmark3 in termux shows the following error message:
$ proxmark3 tcp:localhost:4321
[=] Session log /data/data/com.termux/files/home/.suroot /.proxmark3/log_20210519.txt
[=] Loading Preferences...
[+] loaded from JSON file /data/data/com.termux/files/ho me/.suroot/.proxmark3/preferences.json
Using UART port tcp:localhost:4321
[!!] ERROR: cannot communicate with the Proxmark
Solution:
Make sure you have installed a firmware with BTADDON compiled. See: https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md#platform_extras
READ ME:
- If you can compile and flash your device from a PC, do it! It's probably much confortable than following this method.
- Flashing is possible only via USB-UART, not via BT-UART
- Avoid flashing the Bootloader from non-root Android as the connection is probably less stable than with pure USB and you don't want to brick your device...
Assuming we're using the Github repo sources as explained above.
pkg install make clang readline libc++ git binutils
cd
git clone https://github.com/RfidResearchGroup/proxmark3.git
cd proxmark3
make clean && make -j client
Termux doesn't have the ARM cross-compiler, so we'll install a Debian within Termux.
$ pkg install proot-distro
$ proot-distro install debian
$ proot-distro login debian --termux-home
At this point we should be on a Debian root prompt in the user directory. We install only the requirements to compile the Proxmark3 firmware.
# apt-get update
# apt-get install -y --no-install-recommends make gcc g++ libc6-dev gcc-arm-none-eabi libnewlib-dev
# cd proxmark3
# make -j fullimage
# exit
At this point we're back to the Termux prompt.
Plug the Proxmark3 while pressing the button, to enter into bootloader mode manually.
Activate the USB-UART to TCP Bridge with one of the applications as explained above.
cd proxmark3
./client/proxmark3 tcp:localhost:<chosenPort> --flash --image armsrc/obj/fullimage.elf
Once the Proxmark3 has rebooted, reconnect it to the bridge in the app. The freshly flashed device is now ready to be used.
./client/proxmark3 tcp:localhost:<chosenPort>