gdmgetcfg not working on gen4 gdm card

[allanarguelles]

Describe the bug
A clear and concise description of what the bug is.
Please include text output of the bug happening.

hf mf gdmgetcfg doesn't work like gdmcfg. It was working fine but now I get an error [#] wupGDM1 error.
I tried with --gdm flag as well and its still the same error.

To Reproduce
[+] Using UART port /dev/tty.usbmodem1401
[+] Communicating with PM3 over USB-CDC

8888888b. 888b d888 .d8888b.
888 Y88b 8888b d8888 d88P Y88b
888 888 88888b.d88888 .d88P
888 d88P 888Y88888P888 8888"
8888888P" 888 Y888P 888 "Y8b.
888 888 Y8P 888 888 888
888 888 " 888 Y88b d88P
888 888 888 "Y8888P"

[ Reading you. Standby! ☕ ]

[ Proxmark3 ]

MCU....... AT91SAM7S512 Rev A
Memory.... 512 KB ( 83% used )
Target.... RDV4

Client.... Iceman/master/v4.21611-636-gda509461b 2026-08-09 06:52:55
Bootrom... Iceman/master/v4.21611-636-gda509461b-suspect 2026-08-04 22:14:17 567cf9c5f
OS........ Iceman/master/v4.21611-636-gda509461b-suspect 2026-08-04 22:14:17 567cf9c5f

[usb] pm3 --> hf mf gdmgetcfg
[#] wupGDM1 error
[usb] pm3 --> hf mf gdmgetcfg --gdm
[#] wupGDM1 error

Expected behavior
[+] Using UART port /dev/tty.usbmodem1401
^[[A[+] Communicating with PM3 over USB-CDC

8888888b. 888b d888 .d8888b.
888 Y88b 8888b d8888 d88P Y88b
888 888 88888b.d88888 .d88P
888 d88P 888Y88888P888 8888"
8888888P" 888 Y888P 888 "Y8b.
888 888 Y8P 888 888 888
888 888 " 888 Y88b d88P
888 888 888 "Y8888P"

Release... v4.21611 - BREAKMEIFYOUCAN!

[ 343 Gulity Spark: offline! ☕ ]

[ Proxmark3 ]

MCU....... AT91SAM7S512 Rev A
Memory.... 512 KB ( 83% used )
Target.... RDV4

Client.... Iceman/master/v4.21611 2026-04-14 10:19:30
Bootrom... Iceman/master/v4.21611-636-gda509461b-suspect 2026-08-04 22:14:17 567cf9c5f
OS........ Iceman/master/v4.21611-636-gda509461b-suspect 2026-08-04 22:14:17 567cf9c5f

[!] ⚠️ --> ARM firmware does not match the source at the time the client was compiled
[!] ⚠️ --> Make sure to flash a correct and up-to-date version

[usb] pm3 --> hf mf gdmcfg

[+] ------------------- GDM Gen4 Configuration -----------------------------------------
[+] 85000000000000000000005A00000008
[+] 8500............................ Magic wakeup disabled
[+] ....00.......................... Magic wakeup style Gen1a 40(7)/43
[+] ......000000.................... unknown
[+] ............00.................. Key B use allowed when readable by ACL
[+] ..............00................ CUID Disabled
[+] ................00.............. n/a
[+] ..................00............ MFC EV1 perso. 4B UID from Block 0
[+] ....................00.......... Shadow mode disabled
[+] ......................5A........ Magic auth enabled
[+] ........................00...... Static encrypted nonce disabled
[+] ..........................00.... MFC EV1 signature disabled
[+] ............................00.. n/a
[+] ..............................08 SAK

Desktop (please complete the following information):

• OS: [e.g. iOS] Mac OS 26.5.2
• inside proxmark3 client run the following commands and paste the output here.
• hw version
  [usb] pm3 --> hw version

[ Proxmark3 ]

[ Client ]
Iceman/master/v4.21611-636-gda509461b-suspect 2026-08-09 06:52:55 567cf9c5f
Compiler.................. Clang/LLVM Apple LLVM 21.0.0 (clang-2100.1.1.101)
Platform.................. OSX / aarch64
Readline support.......... present
QT GUI support............ present
Native BT support......... absent
Python script support..... present ( 3.14.6 )
Python SWIG support....... present
Lua script support........ present ( 5.4.7 )
Lua SWIG support.......... present

[ Model ]
Device.................... RDV4
Firmware.................. RDV4
External flash............ present
Smartcard reader.......... present
FPC USART for BT add-on... absent

[ ARM ]
Bootrom.... Iceman/master/v4.21611-636-gda509461b-suspect 2026-08-04 22:14:17 567cf9c5f
OS......... Iceman/master/v4.21611-636-gda509461b-suspect 2026-08-04 22:14:17 567cf9c5f
Compiler... GCC 13.3.1 20240614

[ FPGA ]
fpga_pm3_hf.ncd image 2s30vq100 04-08-2026 22:09:33
fpga_pm3_lf.ncd image 2s30vq100 04-08-2026 22:09:33
fpga_pm3_felica.ncd image 2s30vq100 04-08-2026 22:09:33
fpga_pm3_hf_15.ncd image 2s30vq100 04-08-2026 22:09:33

[ Hardware ]
--= uC: AT91SAM7S512 Rev A
--= Embedded Processor: ARM7TDMI
--= Internal SRAM size: 64K bytes
--= Architecture identifier: AT91SAM7Sxx Series
--= Embedded flash memory 512K bytes ( 83% used )

• hw status
  [usb] pm3 --> hw status
  [#] Memory
  [#] BigBuf_size............. 36236
  [#] Available memory........ 36236
  [#] Tracing
  [#] tracing ................ 0
  [#] traceLen ............... 0
  [#] Current FPGA image
  [#] mode.................... fpga_pm3_hf.ncd image 2s30vq100 04-08-2026 22:09:33
  [#] Flash memory
  [#] Baudrate................ 24 MHz
  [#] Init.................... ok
  [#] Mfr ID / Dev ID......... EF / 11
  [#] JEDEC Mfr ID / Dev ID... EF / 3012
  [#] Memory size............. 256 Kb ( 4 pages * 64k )
  [#] Unique ID (be).......... 0x37A09353175462D5
  [#] Smart card module (ISO 7816)
  [#] version................. v3.10 ( Outdated )
  [#] LF Sampling config
  [#] [q] divisor............. 95 ( 125.00 kHz )
  [#] [b] bits per sample..... 8
  [#] [d] decimation.......... 1
  [#] [a] averaging........... yes
  [#] [t] trigger threshold... 0
  [#] [s] samples to skip..... 0
  [#]
  [#] LF T55XX config
  [#] [r] [a] [b] [c] [d] [e] [f] [g]
  [#] mode |start|write|write|write| read|write|write
  [#] | gap | gap | 0 | 1 | gap | 2 | 3
  [#] ---------------------------+-----+-----+-----+-----+-----+-----+------
  [#] fixed bit length (default) | 29 | 17 | 15 | 47 | 15 | n/a | n/a |
  [#] long leading reference | 29 | 17 | 15 | 47 | 15 | n/a | n/a |
  [#] leading zero | 29 | 17 | 15 | 40 | 15 | n/a | n/a |
  [#] 1 of 4 coding reference | 29 | 17 | 15 | 31 | 15 | 47 | 63 |
  [#]
  [#] HF 14a config
  [#] [a] Anticol override........... std ( follow standard )
  [#] [b] BCC override............... std ( follow standard )
  [#] [2] CL2 override............... std ( follow standard )
  [#] [3] CL3 override............... std ( follow standard )
  [#] [r] RATS override.............. std ( follow standard )
  [#] [m] Magsafe polling............ disabled
  [#] [p] Polling loop annotation.... disabled 00000000000000000000000000000000
  [#] HF 14b config
  [#] [p] Polling loop annotation.... disabled 00000000000000000000000000000000
  [#] Transfer Speed
  [#] Sending packets to client...
  [#] Time elapsed................... 500ms
  [#] Bytes transferred.............. 354304
  [#] Transfer Speed PM3 -> Client... 708608 bytes/s
  [#] Various
  [#] Max stack usage..... 4248 / 8480 bytes
  [#] Debug log level..... 1 ( error )
  [#] ToSendMax........... 39
  [#] ToSend BUFFERSIZE... 2308
  [#] Slow clock.......... 31049 Hz
  [#] Installed StandAlone Mode
  [#] LF HID26 standalone - aka SamyRun (Samy Kamkar)
  [#] Flash memory dictionary loaded
  [#] Mifare... 2325 keys - dict_mf.bin
  [#] T55xx.... 125 keys - dict_t55xx.bin
  [#] iClass... 29 keys - dict_iclass.bin
  [#] UL-C..... 0 keys - dict_mfulc.bin
  [#] UL-AES... 0 keys - dict_mfulaes.bin
  [#]

• hw tune
  [usb] pm3 --> hw tune

[=] -------- Reminder ----------------------------
[=] hw tune doesn't actively tune your antennas.
[=] It's only informative.
[=] Measuring antenna characteristics...
🕛 9

[=] -------- LF Antenna ----------
[+] 125.00 kHz ........... 36.76 V
[+] 134.83 kHz ........... 25.45 V
[+] 123.71 kHz optimal.... 37.00 V
[+]
[+] Approx. Q factor measurement
[+] Frequency bandwidth... 5.7
[+] Peak voltage.......... 6.5
[+] LF antenna............ ok

[=] -------- HF Antenna ----------
[+] 13.56 MHz............. 46.96 V
[+]
[+] Approx. Q factor measurement
[+] Peak voltage.......... 8.2
[+] HF antenna ( ok )

[=] -------- LF tuning graph ------------
[+] Orange line - divisor 95 / 125.00 kHz
[+] Blue line - divisor 88 / 134.83 kHz

[=] Q factor must be measured without tag on the antenna

Additional context
I've only started getting into gen4 stuff so I may be missing or using wrong terms.

[allanarguelles]

I forgot to add that I see the changes in f0c3dcc but I'm over my head trying to figure out how that broke it.

[allanarguelles]

It worked with

[usb] pm3 --> hf mf gdmgetcfg --wupa -k 000000000000

[+] ------------------- GDM Gen4 Configuration -----------------------------------------
[+] 85000000000000000000005A00000008
[+] 8500............................ Magic wakeup disabled
[+] ....00.......................... Magic wakeup style Gen1a 40(7)/43
[+] ......000000.................... unknown
[+] ............00.................. Key B use allowed when readable by ACL
[+] ..............00................ CUID Disabled
[+] ................00.............. n/a
[+] ..................00............ MFC EV1 perso. 4B UID from Block 0
[+] ....................00.......... Shadow mode disabled
[+] ......................5A........ Magic auth enabled
[+] ........................00...... Static encrypted nonce disabled
[+] ..........................00.... MFC EV1 signature disabled
[+] ............................00.. n/a
[+] ..............................08 SAK

As I'm not sure if this is the intended behavior or it's supposed to be the previous behavior, I'll leave the ticket open for the devs to see.

[0x6r1an0y]

Your config 8500… decodes to "Magic wakeup disabled",so both the --gdm (20/23) and --gen1a (40/43) backdoor wakeups are off on this card. Only magic auth is enabled (…5A… at byte 11). That's why --wupa -k 000000000000 is the one that works.

What changed in f0c3dcc :
The old gdmcfg defaulted to WUPA + magic auth, whereas the new gdmgetcfg defaults to the GDM-alt wakeup, so the new default can't reach a wakeup-disabled card. Use hf mf gdmgetcfg --wupa -k 000000000000 for now. I'll look at making the read commands fall back across wakeup modes so it works again.

[0x6r1an0y]

Fixed in #3493.