Skip to content

Proxmark5 & Proxmark3 Hardware abstraction layer - #3449

Draft
xianglin1998 wants to merge 99 commits into
RfidResearchGroup:masterfrom
xianglin1998:proxmark5
Draft

Proxmark5 & Proxmark3 Hardware abstraction layer#3449
xianglin1998 wants to merge 99 commits into
RfidResearchGroup:masterfrom
xianglin1998:proxmark5

Conversation

@xianglin1998

@xianglin1998 xianglin1998 commented Aug 1, 2026

Copy link
Copy Markdown
Contributor
  1. Some hardware abstractions are still incomplete; all 'TODO DXL' items need to be addressed.
  2. Certain timeout mechanisms (timeout--) are not cross-platform compatible. If timeout-- is not used with additional clock conditions, please replace it with a timeout mechanism tied to a specific clock source, as the main clock frequency varies across different platforms.
  3. The ADC waveform is inverted, which differs from the RDV4.
  4. All future modifications to ARM should consider cross-platform compatibility.
  5. Please avoid modifying /armsrc/fpgaloader.c and files within the common_arm directory before this PR is merged into the master branch.
  6. The client-side logic for identifying the chip capacity of the AT32F435 is not yet complete, which may result in an incorrect estimation of the CODE FLASH capacity.
  7. To maintain compatibility with the PM5 power button, the bootrom behavior has been changed: instead of entering flash mode immediately upon power-up when the button is pressed, it will now enter flash mode only after the button is held for 3 seconds.

    After pressing and holding the button, connect to the USB and wait for 3 seconds. After 3 seconds, LED_B and LED_D will light up. Release the button. At this time, the device has entered FLASH mode and can perform firmware FLASH.

  8. The Proxmark5 does not require J-Link or similar tools for unbricking. Simply connect it via USB, power it on, and hold the button for 6 seconds to enter ISP mode. You can then use the AT32 ISP tool to flash the complete firmware.
  9. The FPGA code for the Proxmark5 has not yet been pushed to the repository and is currently being organized. A new PR will be created for merging once the cleanup is complete.
  10. Chinese comments will remain in the code temporarily. You may translate them into English, but please ensure the 'TODO DXL' tags are preserved, otherwise we might lose track of pending tasks.
  11. The armsrc can only build by cmake, the client can only build by makefile. it is need to be addressed.
  12. The 'hw fpga config' command can be used to configure the FPGA firmware.
  13. The 'hw fpga pwrpwm' command can be used to adjust the antenna's drive voltage.
  14. The hw ant_pm5 -m <8bit data> command can be used to modify the frequency and Q value. Note: High Q is only allowed at 125kHz/134kHz to prevent excessive resonant voltage from damaging the device.

    8bit map: 125 134 250 375 500 HFLED LFLED Q (lsb)

  15. We will release documentation for the RGB controller and antenna controller as soon as possible.
  16. The bootrom depends on version_pm3.c, but currently there is no logic in the bootrom's CMakeLists.txt to generate this source file, so the bootrom project cannot be compiled yet.
  17. Currently, only the client and firmware of this PR can support PM5. Please do not use the client and firmware from the master branch to flash PM5 for the time being.
  18. If you flashed the wrong firmware to PM5 using the xxx link probe, or if the PM5 firmware fails to run for unknown reasons, you can try the following methods to fix it:
    1. Download AT32 ISP tool GO & Extract
    2. Install the driver for ISP USB(The driver is in the Artery_DFU_DriverInstall dir)
    3. Connect the USB to the USB port on the same side as the button (instead of the CEP port).
    4. Press and hold the button for 6-8 seconds. The device will reboot to ISP mode, usb will startup.
    5. To open the Artery ISP Programmer to select HEX file to flash, the bootrom & fullimage is required.
    6. When flash done, disconnect usb and reconnect for restart device to exit ISP mode.
    7. Open the proxmark client to try to connect to verify your device is re-working.
  19. [IMPORTANT]: After the PM5 starts up, it needs to immediately pull PB0 high to enable power supply. If PB0 is released during the enable process, it means that the device needs to be shut down. This causes a problem. The CMD_HARDWARE_RESET command calls the void ResetChip(void) function, which is implemented using NVIC Reset in the factory firmware. According to the AT32 manual, NVIC RESET takes up to 10-25ms to start. During this period, PB0 has already been released for a long time, so the RESET operation becomes a shutdown. Therefore, the flash process will fail.

    The latest commit resolves this issue, and users can fix it by forcibly entering FLASH MODE to update BOOTROM+FULLIMAGE according to the instructions in item 7.

  20. To make debugging easier, I disabled standalone mod. Now, when the device is powered on, pressing and holding the button for a few seconds will start displaying a running light, and then releasing the button will power off the device. This is suitable for users who have installed BWM.

@github-actions

github-actions Bot commented Aug 1, 2026

Copy link
Copy Markdown

You are welcome to add an entry to the CHANGELOG.md as well

@xianglin1998 xianglin1998 changed the title Proxmark5 & Proxmark3 HAL Proxmark5 & Proxmark3 Hardware abstraction layer Aug 1, 2026
This achieves the goal of cross-platform compatibility.
@xianglin1998

xianglin1998 commented Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

even bootrom with cmake doesn't use/find my arm-none-eabi-gcc and fails. (cd bootrom; mkdir build; cd build; cmake ..; make)

I also tried from the root path (mkdir build; cd build; cmake ..) and cmake fails on CMake Error at armsrc/CMakeLists.txt:217 (include): include could not find requested file: Standalone/StandaloneSource.cmake

What is the supposed way to compile bootrom and fw with cmake ?

In the project root directory, use msys2 to compile the latest commit (test compilation of RDV4, armsrc & bootrom):

  1. mkdir build && cd build

  2. cmake .. or cmake -DPLATFORM:STRING=PM5 ..

  3. cmake --build .
    After compilation, the output file will be placed in ProjectRoot/build/obj/

In the bootrom directory, use msys2 to build bootrom:

  1. mkdir build && cd build

  2. cmake -DCMAKE_TOOLCHAIN_FILE=../../tools/ToolchainForArm.cmake .. or cmake -DPLATFORM=PM5 -DCMAKE_TOOLCHAIN_FILE=../../tools/ToolchainForArm.cmake ..

  3. cmake --build .
    After compilation, the output file will be placed in ProjectRoot/bootrom/build/obj/

Build for armsrc

Same with bootrom. change dir to armsrc to run cmd.


The CMakeLists.txt file in the project root directory automatically includes ToolchainForArm.cmake, so -DCMAKE_TOOLCHAIN_FILE=../../tools/ToolchainForArm.cmake is not needed.


I'm not sure why, but the .gitignore file is ignoring *.cmake files. If there are any missing *.cmake files, I apologize and will commit them as soon as possible.

@doegox
doegox marked this pull request as draft August 4, 2026 10:57
@doegox

doegox commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

@xianglin1998 nice progression :)
Could you migrate all standalone modes? Many still contain "fpgaloader.h" and "ticks.h" and might need some more changes.
See tools/build_all_firmwares.sh

@xianglin1998

xianglin1998 commented Aug 6, 2026 via email

Copy link
Copy Markdown
Contributor Author

@xianglin1998

Copy link
Copy Markdown
Contributor Author

@doegox All standalone modes have been migrated successfully.

Comment thread client/src/cmdhw.c Outdated

if (datalen != resp.length) {
PrintAndLogEx(WARNING, _RED_("The length of the data to write (%d) does not match the length "
"of the factory data read from device (%d)."), datalen, resp.length);
Comment thread common_arm/usb/usb_read_ng.c Outdated
len -= packetSize;

size_t to_buffer = (available < g_config->buffer_size) ? available : g_config->buffer_size;
for (uint16_t i = 0; i < to_buffer; i++) {
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants