Skip to content

hf mfu info can return with no output at all (silent MFU_TT_UL_ERROR) #3466

Description

@mcfly777

Suggested fixes:

  • re-enable the commented-out message so the wrong-tag-type case is not silent
  • print something at NORMAL level when the select fails
  • optionally add a retry loop in ul_select() analogous to cmdhf14a.c

To Reproduce

  1. Use a tag with weak coupling (e.g. an NTAG216 implant) or, for the wrong-type path, a MIFARE Classic card (SAK 08).
  2. Run hf 14a reader -@ — the tag is read reliably.
  3. Press Enter to stop, leave the tag in exactly the same position.
  4. Run hf mfu info.
  5. The command returns immediately with no output whatsoever.
  6. Run data setdebugmode -1 and repeat step 4 — now the select failure becomes visible.

Expected behavior

hf mfu info should print a message explaining why it stopped — either "tag is not an Ultralight/NTAG" or "select failed" — instead of returning silently.

Screenshots

n/a

Desktop

  • OS: macOS 27.0 (Apple Silicon)
  • Client: Iceman/proxmark5/v4.9237-13102-g6468d2f1d
  • Hardware: Proxmark5 (PM5), built from the proxmark5 branch of xianglin1998/proxmark3. Note: the cmdhfmfu.c code path in question is unchanged from RfidResearchGroup master.

[usb] pm3 --> hw status
[#] Memory
[#] BigBuf_size............. 498028
[#] Available memory........ 495720
[#] Tracing
[#] tracing ................ 1
[#] traceLen ............... 1044
[#] Current FPGA image
[#] mode.................... All-In-One
[#] Flash memory
[#] Baudrate................ 24 MHz
[#] Init.................... ok
[#] Mfr ID / Dev ID......... EF / 14
[#] JEDEC Mfr ID / Dev ID... EF / 4015
[#] Memory size............. 2048 Kb ( 32 pages * 64k )
[#] Unique ID (be).......... 0xE6656038E31B9423
[#] LF Sampling config
[#] [q] divisor............. 95 ( 125.00 kHz )
[#] [b] bits per sample..... 8
[#] [d] decimation.......... 1
[#] [a] averaging........... yes
[#] [t] trigger threshold... 0
[#] [s] samples to skip..... 0
[#]
[#] LF T55XX config
[#] [r] [a] [b] [c] [d] [e] [f] [g]
[#] mode |start|write|write|write| read|write|write
[#] | gap | gap | 0 | 1 | gap | 2 | 3
[#] ---------------------------+-----+-----+-----+-----+-----+-----+------
[#] fixed bit length (default) | 29 | 17 | 15 | 47 | 15 | n/a | n/a |
[#] long leading reference | 29 | 17 | 15 | 47 | 15 | n/a | n/a |
[#] leading zero | 29 | 17 | 15 | 40 | 15 | n/a | n/a |
[#] 1 of 4 coding reference | 29 | 17 | 15 | 31 | 15 | 47 | 63 |
[#]
[#] HF 14a config
[#] [a] Anticol override........... std ( follow standard )
[#] [b] BCC override............... std ( follow standard )
[#] [2] CL2 override............... std ( follow standard )
[#] [3] CL3 override............... std ( follow standard )
[#] [r] RATS override.............. std ( follow standard )
[#] [m] Magsafe polling............ disabled
[#] [p] Polling loop annotation.... disabled 00000000000000000000000000000000
[#] HF 14b config
[#] [p] Polling loop annotation.... disabled 00000000000000000000000000000000
[#] Transfer Speed
[#] Sending packets to client...
[#] Time elapsed................... 500ms
[#] Bytes transferred.............. 454144
[#] Transfer Speed PM3 -> Client... 908288 bytes/s
[#] Various
[#] Max stack usage..... 4336 / 8480 bytes
[#] Debug log level..... 1 ( error )
[#] ToSendMax........... 48
[#] ToSend BUFFERSIZE... 2308
[#] Installed StandAlone Mode
[#] LF HID26 standalone - aka SamyRun (Samy Kamkar)
[#] Flash memory dictionary loaded
[#] Mifare... 0 keys - dict_mf.bin
[#] T55xx.... 0 keys - dict_t55xx.bin
[#] iClass... 0 keys - dict_iclass.bin
[#] UL-C..... 0 keys - dict_mfulc.bin
[#] UL-AES... 0 keys - dict_mfulaes.bin
[#]
[usb] pm3 --> hw tune

[=] -------- Reminder ----------------------------
[=] hw tune doesn't actively tune your antennas.
[=] It's only informative.
[=] Measuring antenna characteristics...
[/] 10

[=] -------- LF Antenna ----------
[+] 125.00 kHz ........... 23.50 V
[+] 134.83 kHz ........... 18.11 V
[+] 120.00 kHz optimal.... 23.83 V
[+]
[+] Approx. Q factor measurement
[+] Frequency bandwidth... 3.7
[+] Peak voltage.......... 6.9
[!] Contradicting measures seem to indicate you're running a PM3GENERIC firmware on a RDV4
[!] False positives is possible but please check your setup
[+] LF antenna............ ok

[=] -------- HF Antenna ----------
[+] 13.56 MHz............. 37.09 V
[+]
[+] Approx. Q factor measurement
[+] Peak voltage.......... 10.8
[+] HF antenna ( ok )

[=] -------- LF tuning graph ------------
[+] Orange line - divisor 95 / 125.00 kHz
[+] Blue line - divisor 88 / 134.83 kHz

No GUI in this build!

[=] Q factor must be measured without tag on the antenna

[usb] pm3 -->

Additional context

The PM5 hardware abstraction is still in development (PR #3449), which is why the client reports cosmetic placeholders such as "PM3 GENERIC" and "ARM7TDMI". That is unrelated to this issue — the cmdhfmfu.c code path is identical in master.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions