Suggested fixes:
- re-enable the commented-out message so the wrong-tag-type case is not silent
- print something at NORMAL level when the select fails
- optionally add a retry loop in
ul_select() analogous to cmdhf14a.c
To Reproduce
- Use a tag with weak coupling (e.g. an NTAG216 implant) or, for the wrong-type path, a MIFARE Classic card (SAK 08).
- Run
hf 14a reader -@ — the tag is read reliably.
- Press Enter to stop, leave the tag in exactly the same position.
- Run
hf mfu info.
- The command returns immediately with no output whatsoever.
- Run
data setdebugmode -1 and repeat step 4 — now the select failure becomes visible.
Expected behavior
hf mfu info should print a message explaining why it stopped — either "tag is not an Ultralight/NTAG" or "select failed" — instead of returning silently.
Screenshots
n/a
Desktop
- OS: macOS 27.0 (Apple Silicon)
- Client: Iceman/proxmark5/v4.9237-13102-g6468d2f1d
- Hardware: Proxmark5 (PM5), built from the
proxmark5 branch of xianglin1998/proxmark3. Note: the cmdhfmfu.c code path in question is unchanged from RfidResearchGroup master.
[usb] pm3 --> hw status
[#] Memory
[#] BigBuf_size............. 498028
[#] Available memory........ 495720
[#] Tracing
[#] tracing ................ 1
[#] traceLen ............... 1044
[#] Current FPGA image
[#] mode.................... All-In-One
[#] Flash memory
[#] Baudrate................ 24 MHz
[#] Init.................... ok
[#] Mfr ID / Dev ID......... EF / 14
[#] JEDEC Mfr ID / Dev ID... EF / 4015
[#] Memory size............. 2048 Kb ( 32 pages * 64k )
[#] Unique ID (be).......... 0xE6656038E31B9423
[#] LF Sampling config
[#] [q] divisor............. 95 ( 125.00 kHz )
[#] [b] bits per sample..... 8
[#] [d] decimation.......... 1
[#] [a] averaging........... yes
[#] [t] trigger threshold... 0
[#] [s] samples to skip..... 0
[#]
[#] LF T55XX config
[#] [r] [a] [b] [c] [d] [e] [f] [g]
[#] mode |start|write|write|write| read|write|write
[#] | gap | gap | 0 | 1 | gap | 2 | 3
[#] ---------------------------+-----+-----+-----+-----+-----+-----+------
[#] fixed bit length (default) | 29 | 17 | 15 | 47 | 15 | n/a | n/a |
[#] long leading reference | 29 | 17 | 15 | 47 | 15 | n/a | n/a |
[#] leading zero | 29 | 17 | 15 | 40 | 15 | n/a | n/a |
[#] 1 of 4 coding reference | 29 | 17 | 15 | 31 | 15 | 47 | 63 |
[#]
[#] HF 14a config
[#] [a] Anticol override........... std ( follow standard )
[#] [b] BCC override............... std ( follow standard )
[#] [2] CL2 override............... std ( follow standard )
[#] [3] CL3 override............... std ( follow standard )
[#] [r] RATS override.............. std ( follow standard )
[#] [m] Magsafe polling............ disabled
[#] [p] Polling loop annotation.... disabled 00000000000000000000000000000000
[#] HF 14b config
[#] [p] Polling loop annotation.... disabled 00000000000000000000000000000000
[#] Transfer Speed
[#] Sending packets to client...
[#] Time elapsed................... 500ms
[#] Bytes transferred.............. 454144
[#] Transfer Speed PM3 -> Client... 908288 bytes/s
[#] Various
[#] Max stack usage..... 4336 / 8480 bytes
[#] Debug log level..... 1 ( error )
[#] ToSendMax........... 48
[#] ToSend BUFFERSIZE... 2308
[#] Installed StandAlone Mode
[#] LF HID26 standalone - aka SamyRun (Samy Kamkar)
[#] Flash memory dictionary loaded
[#] Mifare... 0 keys - dict_mf.bin
[#] T55xx.... 0 keys - dict_t55xx.bin
[#] iClass... 0 keys - dict_iclass.bin
[#] UL-C..... 0 keys - dict_mfulc.bin
[#] UL-AES... 0 keys - dict_mfulaes.bin
[#]
[usb] pm3 --> hw tune
[=] -------- Reminder ----------------------------
[=] hw tune doesn't actively tune your antennas.
[=] It's only informative.
[=] Measuring antenna characteristics...
[/] 10
[=] -------- LF Antenna ----------
[+] 125.00 kHz ........... 23.50 V
[+] 134.83 kHz ........... 18.11 V
[+] 120.00 kHz optimal.... 23.83 V
[+]
[+] Approx. Q factor measurement
[+] Frequency bandwidth... 3.7
[+] Peak voltage.......... 6.9
[!] Contradicting measures seem to indicate you're running a PM3GENERIC firmware on a RDV4
[!] False positives is possible but please check your setup
[+] LF antenna............ ok
[=] -------- HF Antenna ----------
[+] 13.56 MHz............. 37.09 V
[+]
[+] Approx. Q factor measurement
[+] Peak voltage.......... 10.8
[+] HF antenna ( ok )
[=] -------- LF tuning graph ------------
[+] Orange line - divisor 95 / 125.00 kHz
[+] Blue line - divisor 88 / 134.83 kHz
No GUI in this build!
[=] Q factor must be measured without tag on the antenna
[usb] pm3 -->
Additional context
The PM5 hardware abstraction is still in development (PR #3449), which is why the client reports cosmetic placeholders such as "PM3 GENERIC" and "ARM7TDMI". That is unrelated to this issue — the cmdhfmfu.c code path is identical in master.
Suggested fixes:
ul_select()analogous tocmdhf14a.cTo Reproduce
hf 14a reader -@— the tag is read reliably.hf mfu info.data setdebugmode -1and repeat step 4 — now the select failure becomes visible.Expected behavior
hf mfu infoshould print a message explaining why it stopped — either "tag is not an Ultralight/NTAG" or "select failed" — instead of returning silently.Screenshots
n/a
Desktop
proxmark5branch ofxianglin1998/proxmark3. Note: thecmdhfmfu.ccode path in question is unchanged from RfidResearchGroup master.[usb] pm3 --> hw status
[#] Memory
[#] BigBuf_size............. 498028
[#] Available memory........ 495720
[#] Tracing
[#] tracing ................ 1
[#] traceLen ............... 1044
[#] Current FPGA image
[#] mode.................... All-In-One
[#] Flash memory
[#] Baudrate................ 24 MHz
[#] Init.................... ok
[#] Mfr ID / Dev ID......... EF / 14
[#] JEDEC Mfr ID / Dev ID... EF / 4015
[#] Memory size............. 2048 Kb ( 32 pages * 64k )
[#] Unique ID (be).......... 0xE6656038E31B9423
[#] LF Sampling config
[#] [q] divisor............. 95 ( 125.00 kHz )
[#] [b] bits per sample..... 8
[#] [d] decimation.......... 1
[#] [a] averaging........... yes
[#] [t] trigger threshold... 0
[#] [s] samples to skip..... 0
[#]
[#] LF T55XX config
[#] [r] [a] [b] [c] [d] [e] [f] [g]
[#] mode |start|write|write|write| read|write|write
[#] | gap | gap | 0 | 1 | gap | 2 | 3
[#] ---------------------------+-----+-----+-----+-----+-----+-----+------
[#] fixed bit length (default) | 29 | 17 | 15 | 47 | 15 | n/a | n/a |
[#] long leading reference | 29 | 17 | 15 | 47 | 15 | n/a | n/a |
[#] leading zero | 29 | 17 | 15 | 40 | 15 | n/a | n/a |
[#] 1 of 4 coding reference | 29 | 17 | 15 | 31 | 15 | 47 | 63 |
[#]
[#] HF 14a config
[#] [a] Anticol override........... std ( follow standard )
[#] [b] BCC override............... std ( follow standard )
[#] [2] CL2 override............... std ( follow standard )
[#] [3] CL3 override............... std ( follow standard )
[#] [r] RATS override.............. std ( follow standard )
[#] [m] Magsafe polling............ disabled
[#] [p] Polling loop annotation.... disabled 00000000000000000000000000000000
[#] HF 14b config
[#] [p] Polling loop annotation.... disabled 00000000000000000000000000000000
[#] Transfer Speed
[#] Sending packets to client...
[#] Time elapsed................... 500ms
[#] Bytes transferred.............. 454144
[#] Transfer Speed PM3 -> Client... 908288 bytes/s
[#] Various
[#] Max stack usage..... 4336 / 8480 bytes
[#] Debug log level..... 1 ( error )
[#] ToSendMax........... 48
[#] ToSend BUFFERSIZE... 2308
[#] Installed StandAlone Mode
[#] LF HID26 standalone - aka SamyRun (Samy Kamkar)
[#] Flash memory dictionary loaded
[#] Mifare... 0 keys - dict_mf.bin
[#] T55xx.... 0 keys - dict_t55xx.bin
[#] iClass... 0 keys - dict_iclass.bin
[#] UL-C..... 0 keys - dict_mfulc.bin
[#] UL-AES... 0 keys - dict_mfulaes.bin
[#]
[usb] pm3 --> hw tune
[=] -------- Reminder ----------------------------
[=]
hw tunedoesn't actively tune your antennas.[=] It's only informative.
[=] Measuring antenna characteristics...
[/] 10
[=] -------- LF Antenna ----------
[+] 125.00 kHz ........... 23.50 V
[+] 134.83 kHz ........... 18.11 V
[+] 120.00 kHz optimal.... 23.83 V
[+]
[+] Approx. Q factor measurement
[+] Frequency bandwidth... 3.7
[+] Peak voltage.......... 6.9
[!] Contradicting measures seem to indicate you're running a PM3GENERIC firmware on a RDV4
[!] False positives is possible but please check your setup
[+] LF antenna............ ok
[=] -------- HF Antenna ----------
[+] 13.56 MHz............. 37.09 V
[+]
[+] Approx. Q factor measurement
[+] Peak voltage.......... 10.8
[+] HF antenna ( ok )
[=] -------- LF tuning graph ------------
[+] Orange line - divisor 95 / 125.00 kHz
[+] Blue line - divisor 88 / 134.83 kHz
No GUI in this build!
[=] Q factor must be measured without tag on the antenna
[usb] pm3 -->
Additional context
The PM5 hardware abstraction is still in development (PR #3449), which is why the client reports cosmetic placeholders such as "PM3 GENERIC" and "ARM7TDMI". That is unrelated to this issue — the
cmdhfmfu.ccode path is identical in master.