termux_notes.md

Proxmark 3 on Android

Table of Contents

• Requirements
• Notes
• Tested setups
  • OnePlus 5 (arm64, USB-C)
  • Nexus 5X (arm64, USB-C)
  • Xiaomi Mi Mix 2S (arm64, USB-C)
  • OnePlus 5T (arm64, USB-C)
  • Samsung Galaxy Tab S2 (arm64, MicroUSB)
• Setup
  • Setting up Termux
  • Install Proxmark3 package
• PC-like method
  • Specific requirements
  • USB_ACM
  • Enable the driver
  • Building the kernel
  • Flashing the kernel
  • Testing
  • Troubleshooting
• TCP bridge method
  • USB connection
  • USB-UART bridge application
  • Setting up usb socket
  • Bluetooth connection
  • BT-UART bridge application
  • Setting up bt socket
  • Termux connection

Requirements

^Top

• Android phone
• Termux
• Proxmark3 RDV4 (https://www.proxmark.com/proxmark-3-hardware/proxmark-3-rdv4)
• Blueshark Standalone Module (Bluetooth ONLY) (https://www.proxmark.com/proxmark-news/proxmark3-blueshark-bluetooth-released)
• Proxmark with BTADDON compiled Firmware (Bluetooth ONLY) (https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md#platform_extras)

Notes

^Top From official Proxmark3 wiki:

In any case, you would need a USB-C to A or USB-OTG cable to connect Proxmark3 to your Android device. Some Android devices may not supply enough power (USB-OTG = 100mA), and need a USB Y-cable and external battery, otherwise they will get strange failures. ref : https://github.com/Proxmark/proxmark3/wiki/android

Tested setups

^Top

• OnePlus 5 (arm64, USB-C)

  • OmniROM (Android 9)
  • OmniROM kernel
  • Magisk 19.3

• Nexus 5X (arm64, USB-C)

  • LineageOS (Android 8.1)
  • LineageOS kernel
  • Magisk 19.3

• Xiaomi Mi Mix 2S (arm64, USB-C)

  • LineageOS (Android 9.0)
  • Magisk 20.3

• OnePlus 5T (arm64, USB-C)

  • LineageOS (Android 9.0)
  • Franko Kernel
  • Magisk 20.3

• Samsung Galaxy Tab S2 (arm64, MicroUSB)

  • LineageOS (Android 9.0)
  • LineageOS kernel
  • Magisk 20.3

Setup

^Top

Setting up Termux

^Top

Install Termux and start it

Install Proxmark3 package which follows tagged releases

^Top

Run the following commands:

pkg install proxmark3

Install Proxmark3 package which offers a more up to date version from git master branch

Run the following commands:

pkg install proxmark3-git

Optional: Building Proxmark3 client from source

pkg install make clang readline libc++ git
git clone https://github.com/RfidResearchGroup/proxmark3.git
cd proxmark
make clean && make client

PC-like method

^Top

Specific requirements

^Top

• Kernel with one of:
  • USB_ACM driver
  • module loading enabled
  • published sources
• Root

termux shell:

pkg install tsu

USB_ACM

^Top

You need the USB_ACM driver enabled and working to communicate with the Proxmark3. To see if it's working, run tsudo ls /dev/tty* and it should list /dev/ttyACM0 (or similar). If you see this, congratulations, skip this step!

Enable the driver

^Top

If your kernel has module loading enabled, you should be able to build the module separately and load it on your system without any changes. Otherwise, grab your kernel sources and edit your build config to include CONFIG_USB_ACM=y. On the tested kernel, this was under: android_kernel_oneplus_msm8998/arch/arm64/configs/omni_oneplus5_defconfig

Building the kernel

^Top

If using a custom kernel, refer to the build instructions provided by its maintainer. Otherwise, follow the standard Linux kernel build procedure

Flashing the kernel

^Top

You can flash the kernel however it suits you. On the tested device, this was achieved using TWRP, the most popular custom recovery

Testing

^Top

Open Termux and start the Proxmark3 client:

tsudo proxmark3/client/proxmark3 /dev/ttyACM0

Everything should work just like if it was your PC!

Troubleshooting

^Top

• dmesg | grep usb - useful debug info
• /proc/config.gz - contains your kernel's build configuration. Look for CONFIG_USB_ACM, which should be enabled

TCP bridge method

^Top

Termux doesn't come with usb serial neither bluetooth serial drivers. However, it is fully integrated with phone's network, so we need to talk to the proxmark using serial to tcp sockets (carried out by android apps).

USB connection

^Top

USB-UART Bridge Application

^Top

Install this free app on the Play Store

Setting up usb socket

^Top

The app lets you choose the baudrate. Default value (115 200 baud) is fine. Plug the PM3 in and click connect. Set the toggle in server mode and choose a random port not used by system (e.g. 4321) and start the server.

Bluetooth connection

^Top

BT-UART Bridge Application

^Top

Install this free app or the paid version (which includes usb bridge)

Setting up bt socket

^Top

You need to pair the proxmark3 in the Android settings. In the app choose your registered PM3 device as 'device A'. Select TCP server as 'Device B' and choose an unused port (e.g. 4321). Ensure 'Retransmission' is set to 'both ways'.

Termux connection

^Top

Start a new session, then:

proxmark3 tcp:localhost:<chosenPort>

Alternatively, if you have made the client in the git repo:

./client/proxmark3 tcp:localhost:<chosenPort>

Troubleshooting

^Top

BTADDON Missing in Firmware of PM3

^Top

1. Phone and pm3 are connected, blue led is on and not blinking
2. BTUART Tool TCP Server at Port 4321
3. Using proxmark3 in termux shows the following error message:

$ proxmark3 tcp:localhost:4321

[=] Session log /data/data/com.termux/files/home/.suroot /.proxmark3/log_20210519.txt

[=] Loading Preferences...

[+] loaded from JSON file /data/data/com.termux/files/ho me/.suroot/.proxmark3/preferences.json

Using UART port tcp:localhost:4321

[!!] ERROR: cannot communicate with the Proxmark

Solution:

Make sure you have installed a firmware with BTADDON compiled. See: https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md#platform_extras