PMIII, a Proxmark3 revisited (or how to make your device heavy) - Pentestmag

PMIII, a Proxmark3 revisited (or how to make your device heavy)


When I first borrowed the Proxmark3.0 X from @unrooted, the tinkerer part of me decided to do something with it, as the amount of both free time and spare parts around me was tremendous. This short entry will highlight some hardware modifications applied to this marvelous device.

Initial preparations

The product of finest craftsmanship by MToolsTec originates from a small batch of devices with 512 mb flash + reliable SPIFFS filesystem, which can easily fit even the most extensive dictionaries of keys, LF tag IDs and UIDs.
First, I decided to place a cooler and a HST socket for an external Li-Po on the top of the main board.
Exporting the JTAG right now is a necessity too, because later it's soldering pads will be covered by other components.
This model of Proxmark3 consists of six elements:

    I)   The main board
    II)  BT add-on
    III) LF antenna
    IV)  Li-Po cell
    V)   Flat inter-connector tape
    VI) screws and poles

Frankly, I didn't want to dismantle the poles and screws whenever adding new stuff, that's why I rotated (I) and (II) so that all vital internals of (I) face the outside of the device, while also making quite some free space in-between. I have also bent (V) to the outside and secured it with duct tape, allowing for those new arrangements.
I noticed that during flashing via JTAG, the area around the FPGA was often hot. To overcome this, the cooler was mounted above it.

LF Antenna

This was probably the most practical addition so far - without the antenna on top, the device became a bit thinner, and carrying a screwdriver to attach/detach it was no longer a necessity. I used 1.2 mm single-core wire to ensure stable data transmission. Two crocodile clip cables allow connecting the antenna to the middle-pair of the poles without any hassle.

The front

In order to access the D+ and D- pads of the connected micro-USB cable, I have changed the position of the Li-Po cell on the BT add-on.
Fortunately, the manufacturer made sure that the cell's wires are long enough to allow this. Same as with the main Proxmark board, the JTAG and serial lines were mounted on the top with female sockets. A small feather, glued below the Li-Po, actively protects the device from influence of various unholy forces.

The rear

On the bottom-facing part of the device, the cooler is operated by Wemos D1 Mini Pro, powered by a rechargable 3.7V Li-Po (single cell) and a micro-USB charger. A temp + humidity sensors launch the cooling routine once a specific treshold is met. By simply removing the pink control jumper, the cooler can enter a state in which it permanently cools the FPGA side,  Whenever the device is moved, a tilt sensor communicates this fact to the Wemos, which in turn sends the motion force value using a plain HTTP webhook.
th sensors, as well as the secondary HST socket and some of the cables, are enclosed by the SRBOT 2.4 GHz wifi jammer - it tightens all of the elements together.

The mighty Peltier

Initially, the cooler was powered by an external power source, only later I have attached it to Wemos for more granular control. The power (~3.7V) to this specific cell is delivered in bursts, with polarity change happening between each of them (mass becomes Vcc for a while, and other way round). This way, both FPGA-facing and board-facing surfaces of the cooler act interchangeably - one cools while other heats, and vice versa. This way, none of them remains hot for too long, and heat is well distributed. 
It is important to keep the cooler away from the power sources, and introduce some space above one of the planes to
prevent overheating. As suggested by mighty redditors, a radiator is a necessity here for optimal operation. I plan on adding it and a T555 timer unit to allow manual setting of how many seconds pass between each polarity change.

Update: a few days later

I somehow managed to burn the Wemos while fixing the SMA socket - after removing almost everything from the rear of the device, I replaced the Li-Po charger with a more potent one (USB Type C with two indicator LEDs) and changed the position of the temperature sensor. The Vcc and GND of the charger, tightened with a slim piece of duct tape, serve as an auxiliary power source whenever USB-C is connected, and fits nicely into the Peltier's socket. Two OUT[+|-] cables (red and yellow) attached freely to the top of the cooler currently await for the arrival of the FPGA 2040 and some extra parts to replace the broken Wemos. Stay tuned.

This was certainly a fun project that gave me some insight into the inner workings of Proxmark3 and helped me further develop my crafts. Thanks for reading, and see you.

June 15, 2023


Latest Articles
Notify of

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Inline Feedbacks
View all comments
© HAKIN9 MEDIA SP. Z O.O. SP. K. 2023