Flashing And Configuring The Proxmark 3 Easy
In this previous article, we took a look at how to use an Android phone to look at and configure certain types of NFC cards. While this is a cheap and easy way to get started exploring NFC communications, it’s also pretty basic.
Thankfully, we’re lucky enough in today’s world to have cheap access to much more useful tools, and today, we’ll be looking at one.
Known as the Proxmark Easy, it’s a workhorse of the security industry.
It’s able to interact with both Medium and Low Frequency tags, has the ability to work as a standalone system, yet can also be connected to your computer to allow much deeper analysis work.
Flashing it with the Iceman firmware gives us a ready-to-go NFC tool with a heap of utility.
Get One
The Proxmark comes in a few different models, and thanks to recent development, there’s even a Proxmark Five variant. Today we'll be working with the budget-friendly Proxmark 3 Easy 512.
It’s worth pointing out that this is certainly not the most modern reader. Better versions exist. What it is, though, is dirt cheap, freely available and still great for teaching you how the basics work.
Find them on eBay or AliExpress. Look for the 512KB version and ensure that you get a kit that comes with at least a few cards.
Let’s face it, it’s not going to win any beauty contests, but it's still a great tool for the lab.
And considering the absolute theft that is the cost of some replacement cards, it’s often handy outside the lab as well.
Setup & Flash
First we’ll need to install the dependencies. On Linux, we can use:
apt install --no-install-recommends git ca-certificates build-essential pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev liblz4-dev libbluetooth-dev libpython3-dev libssl-dev libgd-dev
Once that is sorted, we’ll need to grab the repository.
git clone https://github.com/RfidResearchGroup/proxmark3.git ~/proxmark3
Next, we want to set the config so everything works correctly. First, copy the file.
cp ~/proxmark3/Makefile.platform.sample ~/proxmark3/Makefile.platform
Then we’ll need to set it to the generic easy variant within.
PLATFORM=PM3GENERIC
Now we’re ready to make. Depending on your system, this might take a few minutes.
make -C ~/proxmark3 clean && make -C ~/proxmark3 -j4
And once you’re done
Version info: Iceman/master/v4.23346-116-gcea810820 Platform name: Proxmark3 generic target PLATFORM: PM3GENERIC PLATFORM_FPGA: xc2s30 PLATFORM_SIZE: 512 Platform extras: No extra selected Included options: LF HITAG EM4x50 EM4x70 ZX8211 GENERAL_HF ISO15693 LEGICRF ISO14443b ISO14443a DESFIRE_SIM ICLASS SEOS FELICA NFCBARCODE HFSNIFF HFPLOT COMPRESSION Standalone mode: LF_SAMYRUN
Success. Now we’re ready to flash the firmware.
cd ~/proxmark3 && ./pm3-flash-all
Most of the bootloaders on these are pretty old. Don’t be surprised if you get a warning.
🚨 ====================== OBS ! =========================================== 🚨 Note: Your bootloader does not understand the new CMD_BL_VERSION command ⚠️ Your bootloader is outdated, but this operation will update it 🚨 Bootloader does not support CMD_CHIP_TYPE, assuming AT91 platform Available memory on this board: UNKNOWN
The flash should take care of the bootloader and the actual firmware.
You can check out the sweet ASC art while you wait.
[+] Flashing...
&&&X$& .++
+&&&X+x$$+&& + ;
xxxXX;&&&:&X$$&$&& ;::: ; .+
x;: xX&:;:$+X&$& X+;X ++ ;: .+ ; :+
+;..Xx+..:+ +$::+: $ $+XXX. +: : ;: ;+ +. ;+
+: $;:::..:;;;:+XxX:.x;;; :&;:X+ + :+ +: :+ +. :; ; +
+: $;:.:::+:.. .:xXxx;;;+&X&:.::: + : ; : : ; ; ;:
+; $+:;;++++++;:::......+X&&&$$ ; ; : ; : . ;:
+; ;$+:xx$$X+;;+;++:: ..Xx&& : ; ; ; : :. ::
+:;: $X+X :;; ;x;::;;;;X&$&:+. ; + : ; ; . ;:
: ; : :: :; + XXxXX$&& +X + : ; + . :; ; ;:
+: :: ::+: &+.$$+ x+ +: + + + : +
x; ::+; $+$$$+ +: + +: ;+ +. ;+
; +&x::: ;:x XX+;$. ;; ;: .; +; :+
.+;;.+ x&$Xx+;:;XX+: ;:;. : .+
x+:: :++.:;&&&&&;x::; + ;
Xx;::: :::;x&X$&x::x :; x+
$x:: x: :&+X&;x;:. +.
X;:: .;xxxxX&$X&:: . :x
;;: .X&X$&:;xx. :: : .x
XX: .;xXXX&&+$&;: ::+: : :x
xx;x; :+$ &&:$&$$$xX:;: :: +
x;:;::: :;X $:$$ Xx: ;: :+
+:::. :: ;X; :.:;:. :+
;:: .;;+X: +;:: ::.
x+.;x;: .;xX +: ::+.
X;::x; :;;+ ;XXXXX
X+ .+x: ;;::+ X+:;+
X+:. :. x::;+
X;: ..: x;.:..;
X+;;;+:; X;:; . .:.+x
X+$+$+ XXXXXXXX
X+$+$+ XXXXXXXX
Flashing [=======================================================================================================================] 100%
When the flash shows as complete, we can start the terminal to go with it.
./pm3
Now we’re ready to rock.
Reading Tags
Opening the terminal and running the easy is the first thing we need to do to get started. To identify any cards that we can engage with, simply run
auto
There’s a stack in the lab that has been acquired from conferences, old jobs, events and the like, so there’s a good range to check out. The first search results give us this.
[\] Searching for ISO14443-A tag... [=] ---------- ISO14443-A Information ---------- [+] UID: 04 57 3A 52 XX XX XX( double ) [+] ATQA: 00 44 [+] SAK: 00 [2] [+] NXP Semiconductors Germany [+] Possible types: [+] NTAG 2xx [=] [=] Proprietary non iso14443-4 card found [=] RATS not supported
We can expand on that more by running
hf mfu info
which gives us a much larger dump
[=] --- Tag Information -------------------------- [+] TYPE: NTAG 213 144bytes (NT2H1311G0DU) [+] UID: 04 57 3A XX XX XX XX [+] UID[0]: 04, NXP Semiconductors Germany [+] BCC0: E1 ( ok ) [+] BCC1: XX( ok ) [+] Internal: 48 ( default ) [+] Lock: 00 00 - 0000000000000000 [+] OTP: E1 10 12 00 - 11100001000100000001001000000000 [=] --- NDEF Message [+] Capability Container: E1101200 [+] E1: NDEF Magic Number [+] 10: version 0.1 supported by tag [+] : Read access granted without any security / Write access granted without any security [+] 12: Physical Memory Size: 144 bytes [+] 12: NDEF Memory Size: 144 bytes [+] 00: Additional feature information [+] 00000000 [+] 000 .... - RFU [+] ...0 ... - Don't support special frame [+] ....0 .. - Don't support lock block [+] .....00 - RFU [+] .......0 - IC don't support multiple block reads [=] --- Tag Silicon Information [=] Wafer Counter: 19102666 ( 0x1237BCA ) [=] Wafer Coordinates: x XXX, y XX(0xXXX, 0xXX) [=] Test Site: X [=] --- Tag Counter [=] [02]: 00 00 00 [=] --- Tag Signature [=] IC signature public key name: NXP NTAG21x [=] IC signature public key value: 04494E1A386D3D3CFE3DC10E5DE68A49 [=] : 9B1C202DB5B132393E89ED19FE5BE8BC [=] : 61 [=] Elliptic curve parameters: secp128r1 [=] TAG IC Signature: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX [=] : XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX [+] Signature verification: successful [=] --- Tag Version [=] Raw bytes: 0004040201000F03 [=] Vendor ID: 04, NXP Semiconductors Germany [=] Product type: NTAG [=] Product subtype: 02, 50pF [=] Major version: 01 [=] Minor version: 00 [=] Size: 0F, (256 - 128 bytes) [=] Protocol type: 03, ISO14443-3 Compliant [=] --- Tag Configuration [=] cfg0 [41/0x29]: 040000FF [=] - strong modulation mode enabled [=] - pages don't need authentication [=] cfg1 [42/0x2A]: 00050000 [=] - Unlimited password attempts [=] - NFC counter disabled [=] - NFC counter not protected [=] - user configuration writeable [=] - write access is protected with password [=] - 05, Virtual Card Type Identifier is default [=] PWD [43/0x2B]: 00000000 ( cannot be read ) [=] PACK [44/0x2C]: 0000 ( cannot be read ) [=] RFU [44/0x2C]: 0000 ( cannot be read ) [+] --- Known EV1/NTAG passwords [+] Password... FFFFFFFF pack... 0000 [=] [=] --- Fingerprint [=] n/a
This gives us a much bigger data set to work with. Some information has been redacted, but we can still see a few interesting points that are worth exploring. The most interesting one is that we can read/write without any security checks required. Let’s have some fun with that first by flashing it with a new message.
Iceman firmware lets us do it with a single command
hf mfu ndefwrite --text "Radio Hacking is Fun"
A successful write will give us this output
[=] --- NDEF Message [+] Capability Container: E1101200 [+] E1: NDEF Magic Number [+] 10: version 0.1 supported by tag [+] : Read access granted without any security / Write access granted without any security [+] 12: Physical Memory Size: 144 bytes [+] 12: NDEF Memory Size: 144 bytes [+] 00: Additional feature information [+] 00000000 [+] 000 .... - RFU [+] ...0 ... - Don't support special frame [+] ....0 .. - Don't support lock block [+] .....00 - RFU [+] .......0 - IC don't support multiple block reads [=] Writing 8 blocks ( 32 bytes ) from block 4 [=] Press <Enter> to abort [-] Block 8 / 8 [+] Write ( ok )
We can then reverify that it took the write with a fresh dump.
=] --- NDEF Message [+] Capability Container: E1101200 [+] E1: NDEF Magic Number [+] 10: version 0.1 supported by tag [+] : Read access granted without any security / Write access granted without any security [+] 12: Physical Memory Size: 144 bytes [+] 12: NDEF Memory Size: 144 bytes [+] 00: Additional feature information [+] 00000000 [+] 000 .... - RFU [+] ...0 ... - Don't support special frame [+] ....0 .. - Don't support lock block [+] .....00 - RFU [+] .......0 - IC don't support multiple block reads [=] --- NDEF parsing ---------------- [+] --- NDEF Message --- [+] Found NDEF message ( 27 bytes ) [+] Record 1 [=] ----------------------------------------------------- [=] [=] Text [=] UTF 8... en, Radio Hacking is Fun [=] [usb] pm3 -->
As the magic machine says, Radio Hacking is fun. It is, isn’t it?
Get Comfy In The Terminal
If you’ve got this far, you’ve got a configured Easy 3 and the ability to read and write an unsecured card. That’s a good start, but the Easy is capable of much more than that, and we’ll start to explore this more in future articles.
The Easy does have a selection of GUI tools if you prefer to use them, but it works best in the terminal. It also comes with hint mode, so if you feel out of your comfort zone, things won’t get too crazy.
It’s also worth taking the time to learn this for one specific reason. NFC tags and readers power physical access control systems across much of the modern world. It’s also used in payment systems and authentication tokens, meaning that despite its short range, the attack surface is broad, varied and seen everywhere.
More than a few contact systems are powered by legacy designs that are known to have weaknesses. The Mifare Classic has cryptographic issues, and the EM4100/EM4102 generally transmit without authentication. These are well documented, and modern systems tend to be more resilient.
Despite this, the humble NFC tag has plenty of interesting things to offer interested researchers.
We’ll learn more about these in the next article.
Investigator515 explores the RF spectrum, cybersecurity, and the hidden tech behind modern espionage.
Follow for new content weekly
Bluesky • X • Substack
You might also like,
- OSINT Investigators Guide to Self Care & Resilience
- Spies In The Mud: The RF-111 Aardvark
- What The Tech?! Space Shuttles
Stuff From The Lab
- HackRF One Portapack
- Nano VNA
- TinySA Ultra
