Iceman Fork - Proxmark3
This report summarizes scanner evidence for RfidResearchGroup/proxmark3, a C project with 6,136 GitHub stars. SynthScan examined 906,648 lines of code across 1894 source files, recording 3631 pattern matches distributed across 21 syntactic categories. The legacy adjusted pattern signal is 4.3 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 3376 finding(s).
Are imports declared and package/API names verified? 92 finding(s).
Are wrappers, guards, and repeated structures necessary? 474 finding(s).
Which changes need focused human review? 3631 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 3631 distinct pattern matches across 21 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | CONTRIBUTING.md | 261 | For these reasons, vague and general filenames (e.g. `util.*`, `global.*`, `misc.*`, | COMMENT |
| LOW | common_fpga/fpga.h | 1 | //----------------------------------------------------------------------------- | COMMENT |
| LOW | common_fpga/fpga.h | 21 | #include <inttypes.h> | COMMENT |
| LOW | armsrc/iso14443a.c | 1 | //----------------------------------------------------------------------------- | COMMENT |
| LOW | armsrc/iso14443a.c | 21 | COMMENT | |
| LOW | armsrc/iso14443a.c | 61 | // minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56MHz) cycles | COMMENT |
| LOW | armsrc/iso14443a.c | 81 | // 8*16 ticks until the SHR is transferred to the Sending Shift Register | COMMENT |
| LOW | armsrc/iso14443a.c | 101 | COMMENT | |
| LOW | armsrc/iso14443a.c | 121 | static uint32_t NextTransferTime; | COMMENT |
| LOW | armsrc/iso14443a.c | 361 | // The reader will generate "pauses" by temporarily switching of the field. | COMMENT |
| LOW | armsrc/iso14443a.c | 561 | //============================================================================= | COMMENT |
| LOW | armsrc/iso14443a.c | 821 | // Finally, a `sniffer' for ISO 14443 Type A | COMMENT |
| LOW | armsrc/iso14443a.c | 1221 | // This will need the following byte array for a modulation sequence | COMMENT |
| LOW | armsrc/iso14443a.c | 1701 | { .response = rVERSION, .response_n = sizeof(rVERSION) }, // EV1/NTAG GET_VERSION response | COMMENT |
| LOW | armsrc/iso14443a.c | 1801 | // pool and BigBuf_malloc() won't hand out memory the trace still occupies. | COMMENT |
| LOW | armsrc/iso14443a.c | 1881 | COMMENT | |
| LOW | armsrc/iso14443a.c | 3401 | // Precomputed answers. Modulating a frame takes long enough that the reader's | COMMENT |
| LOW | armsrc/iso14443a.c | 3421 | #define ANTIFUZZ_RESP_BASE 2 | COMMENT |
| LOW | armsrc/iso14443a.c | 3481 | // reader counts the cascade levels the ATQA promised and throws the card away | COMMENT |
| LOW | armsrc/buzzer_disabled.c | 1 | //----------------------------------------------------------------------------- | COMMENT |
| LOW | armsrc/felicasim.c | 1 | //----------------------------------------------------------------------------- | COMMENT |
| LOW | armsrc/felicasim.c | 21 | #include "util.h" | COMMENT |
| LOW | armsrc/bwm_wifi.c | 1 | //----------------------------------------------------------------------------- | COMMENT |
| LOW | armsrc/bwm_wifi.c | 461 | // startup, so the caller reboots the ESP afterwards to make it take effect. | COMMENT |
| LOW | armsrc/bwm_frame.c | 1 | //----------------------------------------------------------------------------- | COMMENT |
| LOW | armsrc/em4x50.c | 1 | //----------------------------------------------------------------------------- | COMMENT |
| LOW | armsrc/em4x50.c | 21 | #include "fpga_apis.h" | COMMENT |
| LOW | armsrc/em4x50.c | 41 | #define EM4X50_T_TAG_HALF_PERIOD 32 | COMMENT |
| LOW | armsrc/em4x50.c | 61 | COMMENT | |
| LOW | armsrc/printf.c | 1 | //----------------------------------------------------------------------------- | COMMENT |
| LOW | armsrc/mifaresniff_disabled.h | 1 | //----------------------------------------------------------------------------- | COMMENT |
| LOW | armsrc/mifaresniff_disabled.h | 21 | #define __MIFARESNIFF_H | COMMENT |
| LOW | armsrc/pcf7931.c | 1 | //----------------------------------------------------------------------------- | COMMENT |
| LOW | armsrc/pcf7931.c | 21 | #include "fpga_loader.h" | COMMENT |
| LOW | armsrc/pcf7931.c | 41 | COMMENT | |
| LOW | armsrc/pcf7931.c | 321 | // for (i = 0; i < single_blocks_cnt; ++i) { | COMMENT |
| LOW | armsrc/pcf7931.c | 341 | COMMENT | |
| LOW | armsrc/pcf7931.c | 361 | // // handle the following blocks | COMMENT |
| LOW | armsrc/pcf7931.c | 381 | // if (++found_blocks >= maxBlocks) goto end; | COMMENT |
| LOW | armsrc/desfiresim.c | 1 | //----------------------------------------------------------------------------- | COMMENT |
| LOW | armsrc/desfiresim.c | 21 | // | COMMENT |
| LOW | armsrc/desfiresim.c | 41 | // What is implemented so far is the unauthenticated half: a reader can find the | COMMENT |
| LOW | armsrc/desfiresim.c | 61 | #include "fpga_apis.h" | COMMENT |
| LOW | armsrc/desfiresim.c | 301 | if (k->app == app && k->num == keyno) { | COMMENT |
| LOW | armsrc/desfiresim.c | 561 | Dbprintf("DESFire sim: authenticated app index %d key %u", st->selected, st->auth_keyno); | COMMENT |
| LOW | armsrc/desfiresim.c | 661 | *comm = keyed ? (f->flags & DESFIRE_EM_FILE_COMM_MASK) : DESFIRE_SIM_COMM_PLAIN; | COMMENT |
| LOW | armsrc/desfiresim.c | 2161 | // The session CMAC covers every command and response in order, so it is | COMMENT |
| LOW | armsrc/desfiresim.c | 3441 | #define ISO7816_SW_OK 0x9000 | COMMENT |
| LOW | armsrc/desfiresim.c | 3641 | COMMENT | |
| LOW | armsrc/desfiresim.c | 3661 | // Get the bitstream in place before anything is allocated. iso14443a_setup() | COMMENT |
| LOW | armsrc/desfiresim.c | 3781 | // Field state. A DESFire is passively powered, so when the field goes away | COMMENT |
| LOW | armsrc/desfire_crypto.c | 1 | //----------------------------------------------------------------------------- | COMMENT |
| LOW | armsrc/desfire_crypto.c | 21 | * | COMMENT |
| LOW | armsrc/iclass.h | 1 | //----------------------------------------------------------------------------- | COMMENT |
| LOW | armsrc/iclass.h | 21 | #include "common.h" | COMMENT |
| LOW | armsrc/optimized_cipherutils.h | 1 | //----------------------------------------------------------------------------- | COMMENT |
| LOW | armsrc/optimized_cipherutils.h | 21 | // | COMMENT |
| LOW | armsrc/lfadc.c | 1 | //----------------------------------------------------------------------------- | COMMENT |
| LOW | armsrc/lfadc.c | 21 | #include "fpga_loader.h" | COMMENT |
| LOW | armsrc/lfadc.c | 101 | DBG Dbprintf("LF ADC average %u, max %u, min %u, diff %u (threshold is +/-%u counts)", | COMMENT |
| 2863 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/dfc_converter_test.py | 16 | def test_credentials_round_trip(self): | CODE |
| LOW | tools/dfc_converter_test.py | 31 | def test_rejects_direction_without_known_extensions(self): | CODE |
| LOW | tools/pm3_online_tests.sh | 274 | function CheckMfHidEncodeRoundTrip() { | STRING |
| LOW | tools/ePassport/epassport/app.py | 70 | def apply_minimum_window_size(window) -> None: | CODE |
| LOW | tools/ePassport/epassport/emrtd/mrz.py | 421 | def _extended_document_number( | CODE |
| LOW⚡ | tools/ePassport/tests/test_camera.py | 10 | def test_device_label_is_index_plus_name() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_camera.py | 15 | def test_device_label_marks_a_node_that_delivers_nothing() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_camera.py | 23 | def test_listing_without_probe_opens_nothing(monkeypatch) -> None: | CODE |
| LOW | tools/ePassport/tests/test_camera.py | 36 | def test_listing_sorts_working_devices_first(monkeypatch) -> None: | CODE |
| LOW | tools/ePassport/tests/test_camera.py | 48 | def test_no_devices_at_all_yields_an_empty_list(monkeypatch) -> None: | CODE |
| LOW | tools/ePassport/tests/test_camera.py | 57 | def test_sysfs_parsing_reads_names_and_skips_junk(tmp_path) -> None: | CODE |
| LOW | tools/ePassport/tests/test_camera.py | 78 | def test_missing_sysfs_falls_back_to_numbered_indices(tmp_path) -> None: | CODE |
| LOW | tools/ePassport/tests/test_camera.py | 83 | def test_capture_node_sorts_before_metadata_node(tmp_path) -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_camera.py | 121 | def test_setting_the_label_does_not_count_as_a_user_selection() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_camera.py | 128 | def test_a_real_user_selection_is_honoured() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_camera.py | 135 | def test_empty_selection_is_ignored() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_dg_parse.py | 69 | def test_extract_image_finds_jpeg_after_a_cbeff_header() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_dg_parse.py | 79 | def test_extract_image_on_empty_and_imageless_input() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_dg_parse.py | 85 | def test_full_record_from_sample_dump(record) -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_dg_parse.py | 94 | def test_portrait_and_signature_decode(record) -> None: | CODE |
| LOW | tools/ePassport/tests/test_dg_parse.py | 112 | def test_sod_hashes_all_match(record) -> None: | CODE |
| LOW | tools/ePassport/tests/test_dg_parse.py | 130 | def test_eac_groups_are_protected_not_errors(record) -> None: | CODE |
| LOW | tools/ePassport/tests/test_dg_parse.py | 148 | def test_empty_directory_yields_a_warning(tmp_path: Path) -> None: | CODE |
| LOW | tools/ePassport/tests/test_dg_parse.py | 162 | def test_uppercase_bin_suffix_is_accepted(tmp_path: Path, td3: Path) -> None: | CODE |
| LOW | tools/ePassport/tests/test_dg_parse.py | 187 | def test_personal_number_falls_back_to_the_mrz_optional_field( | CODE |
| LOW⚡ | tools/ePassport/tests/test_dg_parse.py | 204 | def test_present_optional_groups_are_not_marked_missing(record) -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_dg_parse.py | 213 | def test_image_for_returns_the_decoded_picture(record) -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_dg_parse.py | 219 | def test_image_for_is_case_insensitive_like_file_lookup(record) -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_dg_parse.py | 223 | def test_image_for_is_empty_for_files_that_carry_no_picture(record) -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_dg_parse.py | 229 | def test_a_dump_with_files_is_not_empty(record) -> None: | CODE |
| LOW | tools/ePassport/tests/test_scan_integration.py | 59 | def test_the_pipeline_reads_a_frame_framed_by_the_guide() -> None: | CODE |
| LOW | tools/ePassport/tests/test_scan_integration.py | 73 | def test_acceptance_needs_two_frames_then_yields_bac_input() -> None: | CODE |
| LOW | tools/ePassport/tests/test_scan_integration.py | 92 | def test_a_blank_frame_is_never_accepted() -> None: | CODE |
| LOW | tools/ePassport/tests/test_scan_integration.py | 101 | def test_ocr_scratch_files_stay_out_of_slash_tmp() -> None: | CODE |
| LOW | tools/ePassport/tests/test_scan_integration.py | 122 | def test_camera_thread_stops_cleanly_without_a_camera(monkeypatch) -> None: | CODE |
| LOW | tools/ePassport/tests/test_entry.py | 15 | def test_docnum_is_uppercased_filtered_and_capped() -> None: | CODE |
| LOW | tools/ePassport/tests/test_entry.py | 22 | def test_date_is_digits_only_and_capped() -> None: | CODE |
| LOW | tools/ePassport/tests/test_entry.py | 45 | def test_date_problem_messages(value: str, expected: str) -> None: | CODE |
| LOW | tools/ePassport/tests/test_entry.py | 59 | def test_a_can_alone_is_enough_to_read() -> None: | CODE |
| LOW | tools/ePassport/tests/test_entry.py | 71 | def test_the_mrz_triple_alone_is_enough() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_entry.py | 83 | def test_an_untouched_form_is_invalid_but_says_nothing_alarming() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_entry.py | 90 | def test_a_can_plus_mrz_is_refused_with_a_usable_message() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_entry.py | 96 | def test_a_can_of_the_wrong_length_is_refused() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_entry.py | 101 | def test_an_unusual_can_length_is_allowed_but_flagged() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_entry.py | 107 | def test_an_incomplete_triple_keeps_read_disabled() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_entry.py | 113 | def test_a_bad_date_keeps_read_disabled() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_entry.py | 125 | def test_forcing_bac_with_a_can_is_refused() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_entry.py | 131 | def test_forcing_pace_with_nothing_is_refused() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_entry.py | 136 | def test_the_hint_describes_the_chosen_mode() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_entry.py | 143 | def test_mode_is_carried_into_the_command() -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_entry.py | 153 | def test_the_note_explains_why_read_is_disabled() -> None: | CODE |
| LOW | tools/ePassport/tests/test_pm3_client.py | 567 | def test_both_mechanisms_failing_is_still_a_failure() -> None: | CODE |
| LOW | tools/ePassport/tests/test_pm3_client.py | 579 | def test_a_real_dump_run_leaves_its_log(tmp_path: Path) -> None: | CODE |
| LOW | tools/ePassport/tests/test_pm3_client.py | 600 | def test_a_card_that_stops_answering_is_not_an_mrz_problem() -> None: | CODE |
| LOW | tools/ePassport/tests/test_pm3_client.py | 621 | def test_a_document_that_rejects_the_key_is_still_an_mrz_problem() -> None: | CODE |
| LOW | tools/ePassport/tests/test_pm3_client.py | 636 | def test_no_card_in_field_says_so(line: str) -> None: | CODE |
| LOW⚡ | tools/ePassport/tests/test_pm3_client.py | 107 | def test_shell_metacharacters_are_rejected(bad: str) -> None: | STRING |
| LOW⚡ | tools/ePassport/tests/test_pm3_client.py | 112 | def test_valid_document_number_is_uppercased() -> None: | STRING |
| LOW⚡ | tools/ePassport/tests/test_pm3_client.py | 117 | def test_document_number_length_cap() -> None: | STRING |
| LOW⚡ | tools/ePassport/tests/test_pm3_client.py | 150 | def test_build_command_is_one_string_with_all_three_bac_fields() -> None: | STRING |
| 249 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tools/recover_pk.py | 59 | except ValueError: | CODE |
| HIGH | tools/recover_pk.py | 70 | except ValueError: | CODE |
| HIGH | tools/external_sam_read.py | 164 | except ReaderError: | CODE |
| HIGH | tools/external_sam_read.py | 304 | except Exception: | CODE |
| HIGH | tools/ePassport/epassport/app.py | 706 | except Exception: | CODE |
| HIGH | tools/ePassport/epassport/ui/scan.py | 328 | except Exception: | CODE |
| HIGH | tools/ePassport/epassport/ui/dialogs.py | 225 | except OSError: | CODE |
| HIGH | tools/ePassport/epassport/ocr/mrz_ocr.py | 44 | except OSError: | CODE |
| HIGH | tools/ePassport/epassport/ocr/mrz_ocr.py | 59 | except OSError: | CODE |
| HIGH | tools/ePassport/epassport/emrtd/images.py | 116 | except OSError: | CODE |
| HIGH | tools/ePassport/epassport/pm3/client.py | 472 | except subprocess.TimeoutExpired: | CODE |
| HIGH | tools/ePassport/epassport/pm3/client.py | 479 | except OSError: | CODE |
| HIGH | tools/mfc/pm3_key_file_diff.py | 73 | except AttributeError: | CODE |
| HIGH | tools/mfc/pm3_gen_dictionary.py | 66 | except AttributeError: | CODE |
| HIGH | client/pm5_ble_bridge.py | 105 | except Exception: | CODE |
| HIGH | client/pm5_ble_bridge.py | 118 | except Exception: | CODE |
| HIGH | client/pm5_ble_bridge.py | 152 | except Exception: | CODE |
| HIGH | client/pm5_ble_bridge.py | 180 | except OSError: | CODE |
| HIGH | client/pm5_ble_bridge.py | 214 | except OSError: | CODE |
| HIGH | client/pm5_ble_bridge.py | 240 | except Exception: | CODE |
| HIGH | client/pm5_ble_bridge.py | 342 | except Exception: | CODE |
| HIGH | client/pm5_ble_bridge.py | 372 | except OSError: | CODE |
| HIGH | client/pm5_ble_bridge.py | 383 | except (NotImplementedError, RuntimeError): | CODE |
| HIGH | client/pm5_ble_bridge.py | 157 | except Exception: | CODE |
| HIGH | client/pm5_ble_bridge.py | 162 | except Exception: | CODE |
| HIGH | client/pm5_ble_bridge.py | 166 | except Exception: | CODE |
| HIGH | client/pm5_ble_bridge.py | 246 | except Exception: | CODE |
| HIGH | client/pm5_ble_bridge.py | 300 | except Exception: | CODE |
| HIGH | client/pm5_ble_bridge.py | 348 | except Exception: | CODE |
| HIGH | client/pm5_ble_bridge.py | 282 | except asyncio.TimeoutError: | CODE |
| HIGH | client/pyscripts/fm11rf08s_recovery.py | 258 | except FileNotFoundError: | CODE |
| HIGH | client/pyscripts/pm3_nfc2eml.py | 110 | except: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | armsrc/CMakeLists.txt | 32 | # --------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | armsrc/CMakeLists.txt | 354 | # ===================================================== | COMMENT |
| MEDIUM | armsrc/CMakeLists.txt | 369 | # ===================================================== | COMMENT |
| MEDIUM | tools/vigik_recover_pk.py | 2 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/build_all_firmwares.sh | 3 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/build_all_firmwares.sh | 17 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/pm3_edit_trace.py | 41 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/pm3_edit_trace.py | 43 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/pm3_edit_trace.py | 81 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/pm3_edit_trace.py | 83 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/pm3_edit_trace.py | 118 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/pm3_edit_trace.py | 120 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/pm3_edit_trace.py | 147 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/pm3_edit_trace.py | 149 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/pm3_edit_trace.py | 202 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/pm3_edit_trace.py | 204 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/pm3_edit_trace.py | 429 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/pm3_edit_trace.py | 431 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/pm3_edit_trace.py | 442 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/pm3_edit_trace.py | 444 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/pm3_edit_trace.py | 541 | # --------------------------------------------------------------------------- | STRING |
| MEDIUM | tools/pm3_edit_trace.py | 543 | # --------------------------------------------------------------------------- | STRING |
| MEDIUM | tools/kgh/CMakeLists.txt | 1 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/kgh/CMakeLists.txt | 15 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | common/get_lz4.sh | 1 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | common/get_lz4.sh | 15 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | fpga/tests/plot_edgedetect.py | 2 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | fpga/tests/plot_edgedetect.py | 8 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | client/CMakeLists.txt | 1 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | client/CMakeLists.txt | 15 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | client/emojis_scrap_github.py | 3 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | client/emojis_scrap_github.py | 19 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | client/atr_scrap_pcsctools.py | 3 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | client/atr_scrap_pcsctools.py | 17 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | client/pm5_ble_bridge.py | 2 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | client/pm5_ble_bridge.py | 27 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | client/experimental_lib/CMakeLists.txt | 1 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | client/experimental_lib/CMakeLists.txt | 15 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | client/pyscripts/fm11rf08s_full.py | 4 | # ------------------------------------------------------------------------------ | COMMENT |
| MEDIUM | client/pyscripts/fm11rf08s_full.py | 920 | # ============================================================================== | COMMENT |
| MEDIUM⚡ | client/pyscripts/mfuev1_counter_reset.py | 2 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | client/pyscripts/mfuev1_counter_reset.py | 11 | #----------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | client/pyscripts/mfuev1_counter_reset.py | 17 | #----------------------------------------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/external_sam_read.py | 267 | except Exception as exc: # pyscard raises backend-specific errors | CODE |
| LOW⚡ | tools/external_sam_read.py | 283 | except Exception as exc: | CODE |
| LOW⚡ | tools/external_sam_read.py | 288 | except Exception: | CODE |
| LOW⚡ | tools/external_sam_read.py | 296 | except Exception as exc: | CODE |
| LOW⚡ | tools/external_sam_read.py | 304 | except Exception: | CODE |
| MEDIUM | tools/external_sam_read.py | 161 | def drop_field(self) -> None: | CODE |
| LOW | tools/ePassport/epassport/app.py | 382 | except Exception as exc: # a bad dump must not crash the app | CODE |
| LOW | tools/ePassport/epassport/app.py | 448 | except Exception as exc: | CODE |
| LOW | tools/ePassport/epassport/app.py | 706 | except Exception: | CODE |
| MEDIUM | tools/ePassport/epassport/app.py | 445 | def work() -> None: | CODE |
| LOW | tools/ePassport/epassport/ui/scan.py | 328 | except Exception: | CODE |
| LOW | tools/ePassport/epassport/ui/widgets/portrait.py | 22 | except Exception: | CODE |
| LOW | tools/ePassport/epassport/ocr/camera.py | 154 | except Exception: # a bad consumer must not kill capture | CODE |
| LOW | tools/ePassport/epassport/ocr/mrz_ocr.py | 81 | except Exception: | CODE |
| LOW | tools/ePassport/epassport/ocr/mrz_ocr.py | 100 | except Exception: | CODE |
| LOW | tools/ePassport/epassport/ocr/mrz_ocr.py | 490 | except Exception as exc: | CODE |
| LOW | tools/ePassport/epassport/ocr/mrz_ocr.py | 499 | except Exception as exc: | CODE |
| LOW | tools/ePassport/epassport/emrtd/dg.py | 218 | except Exception: | CODE |
| LOW | tools/ePassport/epassport/emrtd/dg.py | 254 | except Exception as exc: | CODE |
| LOW⚡ | tools/ePassport/epassport/emrtd/sod.py | 49 | except Exception as exc: | CODE |
| LOW⚡ | tools/ePassport/epassport/emrtd/sod.py | 57 | except Exception as exc: # never let a weird cert kill the whole tab | CODE |
| LOW⚡ | tools/ePassport/epassport/emrtd/sod.py | 63 | except Exception as exc: | CODE |
| LOW | tools/ePassport/epassport/emrtd/images.py | 86 | except Exception as exc: # a truncated portrait must not kill the render | CODE |
| LOW | tools/ePassport/epassport/emrtd/images.py | 109 | except Exception as exc: | CODE |
| LOW | tools/ePassport/epassport/emrtd/securityinfos.py | 152 | except Exception: | CODE |
| LOW | tools/ePassport/epassport/pm3/client.py | 413 | except Exception as exc: # pragma: no cover - defensive | CODE |
| MEDIUM | client/update_amiibo_tools_lua.py | 47 | print("Error fetching data: ", error.decode()) | CODE |
| MEDIUM | client/update_amiibo_tools_lua.py | 103 | print(f"Error deleting file {filename}: ", e) | CODE |
| MEDIUM | client/pm5_ble_bridge.py | 191 | def on_master_readable(): | CODE |
| MEDIUM | client/pm5_ble_bridge.py | 314 | def on_master_readable(): | CODE |
| LOW⚡ | client/pm5_ble_bridge.py | 144 | except Exception as e: | CODE |
| LOW⚡ | client/pm5_ble_bridge.py | 152 | except Exception: | CODE |
| LOW⚡ | client/pm5_ble_bridge.py | 157 | except Exception: | CODE |
| LOW⚡ | client/pm5_ble_bridge.py | 162 | except Exception: | CODE |
| LOW⚡ | client/pm5_ble_bridge.py | 166 | except Exception: | CODE |
| LOW | client/pm5_ble_bridge.py | 105 | except Exception: | CODE |
| LOW | client/pm5_ble_bridge.py | 118 | except Exception: | CODE |
| LOW | client/pm5_ble_bridge.py | 240 | except Exception: | CODE |
| LOW | client/pm5_ble_bridge.py | 246 | except Exception: | CODE |
| LOW | client/pm5_ble_bridge.py | 278 | except Exception as e: | CODE |
| LOW | client/pm5_ble_bridge.py | 294 | except Exception as e: | CODE |
| LOW | client/pm5_ble_bridge.py | 300 | except Exception: | CODE |
| LOW | client/pm5_ble_bridge.py | 342 | except Exception: | CODE |
| LOW | client/pm5_ble_bridge.py | 348 | except Exception: | CODE |
| LOW | client/pm5_ble_bridge.py | 402 | except Exception as e: | CODE |
| MEDIUM | client/experimental_lib/example_lua/test.lua | 22 | print("Error decoding JSON: ", err) | CODE |
| LOW | client/pyscripts/des_talk.py | 58 | except Exception: | CODE |
| LOW | client/pyscripts/des_talk.py | 456 | except Exception: | CODE |
| MEDIUM | client/pyscripts/paxton_switch.py | 67 | print("Error: Data must be 4 bytes (8 characters) in hex. Try again.") | CODE |
| LOW | client/pyscripts/fm11rf08s_full.py | 482 | except Exception as e: | CODE |
| LOW | client/pyscripts/fm11rf08s_full.py | 505 | except Exception: | CODE |
| LOW | client/pyscripts/fm11rf08s_full.py | 710 | except Exception: | CODE |
| LOW | client/pyscripts/fm11rf08s_full.py | 838 | except Exception as e: | CODE |
| LOW | client/pyscripts/fm11rf08s_full.py | 1048 | except Exception as e: | CODE |
| LOW | client/pyscripts/read_t-union.py | 642 | except Exception as e: | CODE |
| MEDIUM | client/pyscripts/paxton_net.py | 81 | print("Error: Data must be 4 bytes (8 characters) in hex. Try again.") | CODE |
| MEDIUM | client/pyscripts/paxton_convert.py | 102 | print("Error: Data must be 4 bytes (8 characters) in hex. Try again.") | CODE |
| LOW | client/pyscripts/mfuev1_counter_reset.py | 619 | except Exception as exc: | CODE |
| MEDIUM | client/pyscripts/ntag22x_suncmac_recovery.py | 250 | print("Error: --json argument is required in single step mode") | CODE |
| LOW | client/pyscripts/mfulc_counterfeit_recovery.py | 203 | except Exception as e: | CODE |
| 13 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/pm3_online_check.py | 31 | CODE | |
| LOW | tools/pm3_online_check.py | 32 | CODE | |
| LOW | tools/external_sam_read.py | 20 | CODE | |
| LOW | tools/pm3_edit_trace.py | 35 | CODE | |
| LOW | tools/pm3_reblay-emulating.py | 16 | CODE | |
| LOW | tools/pm3_reblay-emulating.py | 17 | CODE | |
| LOW | tools/pm3_reblay-emulating.py | 18 | CODE | |
| LOW | tools/ePassport/tools_screenshot.py | 6 | CODE | |
| LOW | tools/ePassport/tools_gen_countries.py | 12 | CODE | |
| LOW | tools/ePassport/tools_render_page.py | 6 | CODE | |
| LOW | tools/ePassport/tools_make_sample.py | 10 | CODE | |
| LOW | tools/ePassport/ePassport.py | 13 | CODE | |
| LOW | tools/ePassport/epassport/config.py | 7 | CODE | |
| LOW | tools/ePassport/epassport/app.py | 12 | CODE | |
| LOW | tools/ePassport/epassport/app.py | 48 | CODE | |
| LOW | tools/ePassport/epassport/app.py | 54 | CODE | |
| LOW | tools/ePassport/epassport/__main__.py | 7 | CODE | |
| LOW | tools/ePassport/epassport/ui/theme.py | 7 | CODE | |
| LOW | tools/ePassport/epassport/ui/passport.py | 7 | CODE | |
| LOW | tools/ePassport/epassport/ui/__init__.py | 3 | CODE | |
| LOW | tools/ePassport/epassport/ui/entry.py | 3 | CODE | |
| LOW | tools/ePassport/epassport/ui/scan.py | 3 | CODE | |
| LOW | tools/ePassport/epassport/ui/dialogs.py | 7 | CODE | |
| LOW | tools/ePassport/epassport/ui/dialogs.py | 144 | CODE | |
| LOW | tools/ePassport/epassport/ui/tabs/tabs.py | 7 | CODE | |
| LOW | tools/ePassport/epassport/ui/tabs/tabs.py | 21 | CODE | |
| LOW | tools/ePassport/epassport/ui/tabs/pages.py | 3 | CODE | |
| LOW | tools/ePassport/epassport/ui/widgets/textblocks.py | 9 | CODE | |
| LOW | tools/ePassport/epassport/ui/widgets/fields.py | 3 | CODE | |
| LOW | tools/ePassport/epassport/ui/widgets/guilloche.py | 8 | CODE | |
| LOW | tools/ePassport/epassport/ui/widgets/portrait.py | 3 | CODE | |
| LOW | tools/ePassport/epassport/ui/widgets/binbutton.py | 8 | CODE | |
| LOW | tools/ePassport/epassport/ui/widgets/logpane.py | 3 | CODE | |
| LOW | tools/ePassport/epassport/ui/widgets/mrzstrip.py | 7 | CODE | |
| LOW | tools/ePassport/epassport/ui/widgets/hexview.py | 3 | CODE | |
| LOW | tools/ePassport/epassport/ui/widgets/hexview.py | 14 | CODE | |
| LOW | tools/ePassport/epassport/ocr/camera.py | 7 | CODE | |
| LOW | tools/ePassport/epassport/ocr/mrz_ocr.py | 8 | CODE | |
| LOW | tools/ePassport/epassport/ocr/mrz_ocr.py | 11 | CODE | |
| LOW | tools/ePassport/epassport/ocr/mrz_ocr.py | 12 | CODE | |
| LOW | tools/ePassport/epassport/emrtd/countries.py | 13 | CODE | |
| LOW | tools/ePassport/epassport/emrtd/dg.py | 7 | CODE | |
| LOW | tools/ePassport/epassport/emrtd/dg.py | 13 | CODE | |
| LOW | tools/ePassport/epassport/emrtd/model.py | 8 | CODE | |
| LOW | tools/ePassport/epassport/emrtd/sod.py | 7 | CODE | |
| LOW | tools/ePassport/epassport/emrtd/tlv.py | 9 | CODE | |
| LOW | tools/ePassport/epassport/emrtd/images.py | 8 | CODE | |
| LOW | tools/ePassport/epassport/emrtd/__main__.py | 8 | CODE | |
| LOW | tools/ePassport/epassport/emrtd/securityinfos.py | 9 | CODE | |
| LOW | tools/ePassport/epassport/emrtd/mrz.py | 7 | CODE | |
| LOW | tools/ePassport/epassport/pm3/client.py | 8 | CODE | |
| LOW | tools/ePassport/epassport/pm3/errors.py | 3 | CODE | |
| LOW | tools/ePassport/tests/test_camera.py | 3 | CODE | |
| LOW | tools/ePassport/tests/test_camera.py | 5 | CODE | |
| LOW | tools/ePassport/tests/conftest.py | 9 | CODE | |
| LOW | tools/ePassport/tests/test_dg_parse.py | 3 | CODE | |
| LOW | tools/ePassport/tests/test_scan_integration.py | 7 | CODE | |
| LOW | tools/ePassport/tests/test_scan_integration.py | 10 | CODE | |
| LOW | tools/ePassport/tests/test_entry.py | 3 | CODE | |
| LOW | tools/ePassport/tests/test_pm3_client.py | 3 | CODE | |
| 22 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | client/pyscripts/fm11rf08s_full.py | 943 | aclkh.append("| | read ¦ write || read ¦ write || read ¦ write |") | CODE |
| HIGH⚡ | client/pyscripts/fm11rf08s_full.py | 946 | aclk[0] = "| -- ¦ KeyA || KeyA ¦ -- || KeyA ¦ KeyA | [000]" # noqa: E222 | CODE |
| HIGH⚡ | client/pyscripts/fm11rf08s_full.py | 947 | aclk[1] = "| -- ¦ KeyA || KeyA ¦ KeyA || KeyA ¦ KeyA | [001]" # noqa: E222 | CODE |
| HIGH⚡ | client/pyscripts/fm11rf08s_full.py | 949 | aclk[3] = "| -- ¦ KeyB || A+B ¦ KeyB || -- ¦ KeyB | [011]" # noqa: E222 | CODE |
| HIGH⚡ | client/pyscripts/fm11rf08s_full.py | 950 | aclk[4] = "| -- ¦ KeyB || A+B ¦ -- || -- ¦ KeyB | [100]" # noqa: E222 | CODE |
| HIGH⚡ | client/pyscripts/fm11rf08s_full.py | 962 | acldh.append("| Block | Data || Counter |") | CODE |
| HIGH⚡ | client/pyscripts/fm11rf08s_full.py | 963 | acldh.append("| | read ¦ write || Inc ¦ Dec |") | CODE |
| HIGH⚡ | client/pyscripts/fm11rf08s_full.py | 966 | acld[0] = "| A+B ¦ A+B || A+B ¦ A+B | [000]" # noqa: E222 | CODE |
| HIGH⚡ | client/pyscripts/fm11rf08s_full.py | 972 | acld[6] = "| A+B ¦ KeyB || KeyB ¦ A+B | [110]" # noqa: E222 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | armsrc/cmac_3des.c | 47 | // Step 1: L = 3DES-ENC(0^64) | COMMENT |
| LOW⚡ | armsrc/cmac_3des.c | 50 | // Step 2: K1 = L << 1 (with conditional XOR with 0x1B) | COMMENT |
| LOW⚡ | armsrc/cmac_3des.c | 57 | // Step 3: K2 = K1 << 1 (with conditional XOR with 0x1B) | COMMENT |
| LOW⚡ | armsrc/cmac_calc.c | 79 | // Step 1: L = AES-ENC(0^128) | COMMENT |
| LOW⚡ | armsrc/cmac_calc.c | 82 | // Step 2: K1 = L << 1 (with conditional XOR with 0x87) | COMMENT |
| LOW⚡ | armsrc/cmac_calc.c | 89 | // Step 3: K2 = K1 << 1 (with conditional XOR with 0x87) | COMMENT |
| LOW | armsrc/hitagu.c | 751 | // Step 2: Process the actual command | COMMENT |
| LOW | armsrc/hitagu.c | 873 | // Step 2: Send write command | COMMENT |
| LOW | tools/mfc/pm3_mf7b_wipe.py | 18 | # Step 1: Dumping original card and making a Mifare 7byte UID clone using S50 7byte UID | COMMENT |
| LOW | tools/mfc/pm3_mf7b_wipe.py | 40 | # Step 2: Recovering S50 7byte UID card to the blank state | COMMENT |
| LOW | doc/fm11rf08s_manual_recovery.md | 24 | ## Step 1: Identify the Card | COMMENT |
| LOW | doc/fm11rf08s_manual_recovery.md | 49 | ## Step 2: Run Autopwn for Known Keys | COMMENT |
| LOW | doc/fm11rf08s_manual_recovery.md | 62 | ## Step 3: Collect Static Encrypted Nonces | COMMENT |
| LOW | doc/fm11rf08s_manual_recovery.md | 83 | ## Step 4: Generate Key Candidates (Offline) | COMMENT |
| LOW | doc/fm11rf08s_manual_recovery.md | 112 | ## Step 5: Brute Force Against the Card | COMMENT |
| LOW | doc/fm11rf08s_manual_recovery.md | 131 | ## Step 6: Full Dump | COMMENT |
| LOW | doc/fm11rf08s_manual_recovery.md | 154 | ## Step 7: Analyze the Dump | COMMENT |
| LOW⚡ | client/src/cmdhfmf.c | 10557 | // Step 1: Read Config | COMMENT |
| LOW⚡ | client/src/cmdhfmf.c | 10565 | // Step 2: Prepare payloads | COMMENT |
| LOW⚡ | client/src/cmdhfmf.c | 10632 | // Step 3: Write config if needed | COMMENT |
| LOW⚡ | client/src/cmdhfmf.c | 10640 | // Step 4: Write hidden block (for 7 byte UID) | COMMENT |
| LOW | client/src/cmdhfmf.c | 10067 | // Step 1: Read config - reuse the block already read while auto-probing the wakeup. | COMMENT |
| LOW | client/src/cmdhfmf.c | 10130 | // Step 2: Write config | COMMENT |
| LOW | client/src/cmdhfmf.c | 10655 | // Step 5: Write regular block 0 / 1 | COMMENT |
| LOW | client/src/cmdhfmf.c | 10713 | // Step 1: Write Config (gen1a + wupa + 4B UID) | COMMENT |
| LOW | client/src/cmdhfmf.c | 10740 | // Step 2: Wipe sectors | COMMENT |
| LOW | client/src/cmdhfmf.c | 10857 | // Step 1: Write signature part 1 (block 5) | COMMENT |
| LOW | client/src/cmdhfmf.c | 10876 | // Step 2: Write signature part 2 (block 6) | COMMENT |
| LOW | client/src/cmdhfmf.c | 10888 | // Step 3: Read config and enable signature sector | COMMENT |
| LOW | client/src/cmdhfmf.c | 10904 | // Step 4: Ensure hidden block 7 (signature sector trailer) holds the known-good value | COMMENT |
| LOW⚡ | client/src/cmdhfmfdes.c | 10265 | // Step 1: Select application using the requested/default route. | COMMENT |
| LOW⚡ | client/src/cmdhfmfdes.c | 10274 | // Step 2: Build ISO Internal Authenticate APDU | COMMENT |
| LOW⚡ | client/src/cmdhfmfdes.c | 10275 | // Step 3: Parse TLV response | COMMENT |
| LOW⚡ | client/src/cmdhfmfdes.c | 10284 | // Step 4: Verify signature if public key provided | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | armsrc/cmac_3des.c | 47 | // Step 1: L = 3DES-ENC(0^64) | COMMENT |
| LOW⚡ | armsrc/cmac_3des.c | 50 | // Step 2: K1 = L << 1 (with conditional XOR with 0x1B) | COMMENT |
| LOW⚡ | armsrc/cmac_3des.c | 57 | // Step 3: K2 = K1 << 1 (with conditional XOR with 0x1B) | COMMENT |
| LOW⚡ | armsrc/cmac_calc.c | 79 | // Step 1: L = AES-ENC(0^128) | COMMENT |
| LOW⚡ | armsrc/cmac_calc.c | 82 | // Step 2: K1 = L << 1 (with conditional XOR with 0x87) | COMMENT |
| LOW⚡ | armsrc/cmac_calc.c | 89 | // Step 3: K2 = K1 << 1 (with conditional XOR with 0x87) | COMMENT |
| LOW | armsrc/emvsim.c | 206 | // We have passed the reader's query to the card, but before we return it, we need to check if we need to modify | COMMENT |
| LOW | armsrc/hitagu.c | 751 | // Step 2: Process the actual command | COMMENT |
| LOW | armsrc/hitagu.c | 873 | // Step 2: Send write command | COMMENT |
| LOW | tools/mfc/pm3_mf7b_wipe.py | 18 | # Step 1: Dumping original card and making a Mifare 7byte UID clone using S50 7byte UID | COMMENT |
| LOW | tools/mfc/pm3_mf7b_wipe.py | 40 | # Step 2: Recovering S50 7byte UID card to the blank state | COMMENT |
| LOW | bootrom/bootrom.c | 250 | // If a valid magic is passed in, we need to check if the magic is the same as the current firmware. | COMMENT |
| LOW | client/lualibs/commands.lua | 35 | -- We need to check if it is correct length, otherwise pad it | CODE |
| LOW⚡ | client/src/cmdhfmf.c | 10557 | // Step 1: Read Config | COMMENT |
| LOW⚡ | client/src/cmdhfmf.c | 10565 | // Step 2: Prepare payloads | COMMENT |
| LOW⚡ | client/src/cmdhfmf.c | 10632 | // Step 3: Write config if needed | COMMENT |
| LOW⚡ | client/src/cmdhfmf.c | 10640 | // Step 4: Write hidden block (for 7 byte UID) | COMMENT |
| LOW | client/src/cmdhfmf.c | 10067 | // Step 1: Read config - reuse the block already read while auto-probing the wakeup. | COMMENT |
| LOW | client/src/cmdhfmf.c | 10130 | // Step 2: Write config | COMMENT |
| LOW | client/src/cmdhfmf.c | 10655 | // Step 5: Write regular block 0 / 1 | COMMENT |
| LOW | client/src/cmdhfmf.c | 10713 | // Step 1: Write Config (gen1a + wupa + 4B UID) | COMMENT |
| LOW | client/src/cmdhfmf.c | 10740 | // Step 2: Wipe sectors | COMMENT |
| LOW | client/src/cmdhfmf.c | 10857 | // Step 1: Write signature part 1 (block 5) | COMMENT |
| LOW | client/src/cmdhfmf.c | 10876 | // Step 2: Write signature part 2 (block 6) | COMMENT |
| LOW | client/src/cmdhfmf.c | 10888 | // Step 3: Read config and enable signature sector | COMMENT |
| LOW | client/src/cmdhfmf.c | 10904 | // Step 4: Ensure hidden block 7 (signature sector trailer) holds the known-good value | COMMENT |
| LOW⚡ | client/src/cmdhfmfdes.c | 10265 | // Step 1: Select application using the requested/default route. | COMMENT |
| LOW⚡ | client/src/cmdhfmfdes.c | 10274 | // Step 2: Build ISO Internal Authenticate APDU | COMMENT |
| LOW⚡ | client/src/cmdhfmfdes.c | 10275 | // Step 3: Parse TLV response | COMMENT |
| LOW⚡ | client/src/cmdhfmfdes.c | 10284 | // Step 4: Verify signature if public key provided | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/pm3_online_check.py | 146 | CODE | |
| LOW | tools/recover_pk.py | 25 | CODE | |
| LOW | tools/recover_pk.py | 45 | CODE | |
| LOW | tools/recover_pk.py | 98 | CODE | |
| LOW | tools/external_sam_read.py | 505 | CODE | |
| LOW | tools/dfc_converter.py | 154 | CODE | |
| LOW | tools/dfc_converter.py | 333 | CODE | |
| LOW | tools/pm3_edit_trace.py | 462 | CODE | |
| LOW | tools/pm3_tears_for_fears.py | 374 | CODE | |
| LOW | tools/ePassport/epassport/ui/tabs/pages.py | 206 | CODE | |
| LOW | tools/ePassport/epassport/ui/widgets/guilloche.py | 20 | CODE | |
| LOW | tools/ePassport/epassport/ocr/camera.py | 112 | CODE | |
| LOW | tools/mfc/pm3_gen_dictionary.py | 70 | CODE | |
| LOW | tools/mfc/pm3_eml_mfd_test.py | 29 | CODE | |
| LOW | tools/mfc/pm3_mfdread.py | 55 | CODE | |
| LOW | tools/mfc/pm3_mfdread.py | 141 | CODE | |
| LOW | client/atr_scrap_pcsctools.py | 74 | CODE | |
| LOW | client/pm5_ble_bridge.py | 264 | CODE | |
| LOW | client/pyscripts/des_talk.py | 102 | CODE | |
| LOW | client/pyscripts/des_talk.py | 202 | CODE | |
| LOW | client/pyscripts/des_talk.py | 346 | CODE | |
| LOW | client/pyscripts/des_talk.py | 472 | CODE | |
| LOW | client/pyscripts/ntag22x_libsuncmac.py | 120 | CODE | |
| LOW | client/pyscripts/ntag22x_libsuncmac.py | 123 | CODE | |
| LOW | client/pyscripts/fm11rf08s_full.py | 270 | CODE | |
| LOW | client/pyscripts/fm11rf08s_full.py | 391 | CODE | |
| LOW | client/pyscripts/fm11rf08s_full.py | 412 | CODE | |
| LOW | client/pyscripts/fm11rf08s_full.py | 581 | CODE | |
| LOW | client/pyscripts/fm11rf08s_full.py | 1028 | CODE | |
| LOW | client/pyscripts/pm3_eml_mfd_test.py | 27 | CODE | |
| LOW | client/pyscripts/mfuev1_counter_reset.py | 391 | CODE | |
| LOW | client/pyscripts/mfulc_counterfeit_recovery.py | 270 | CODE | |
| LOW | client/pyscripts/mfulc_counterfeit_recovery.py | 476 | CODE | |
| LOW | client/pyscripts/fm11rf08s_recovery.py | 74 | CODE | |
| LOW | client/pyscripts/pm3_resources.py | 56 | CODE | |
| LOW | client/pyscripts/mfulaes_mask_recovery.py | 44 | CODE | |
| LOW | client/pyscripts/mfulaes_mask_recovery.py | 120 | CODE | |
| LOW | client/pyscripts/pm5_battery_test.py | 89 | CODE | |
| LOW | client/pyscripts/dc34.py | 960 | CODE | |
| LOW | client/pyscripts/dc34.py | 464 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tools/mfc/pm3_eml2mfd.py | 0 | # andrei costin <zveriu@gmail.com>, 2011 # pm3_eml2mfd.py # converts pm3 mifare classic mfd binary dump file to emulator | STRING |
| HIGH | client/pyscripts/pm3_eml2mfd.py | 0 | # andrei costin <zveriu@gmail.com>, 2011 # pm3_eml2mfd.py # converts pm3 mifare classic mfd binary dump file to emulator | STRING |
| HIGH | tools/mfc/pm3_mfd2eml.py | 0 | # andrei costin <zveriu@gmail.com>, 2011 # pm3_eml2mfd.py # converts pm3 mifare classic mfd binary dump file to emulator | STRING |
| HIGH | client/pyscripts/pm3_mfd2eml.py | 0 | # andrei costin <zveriu@gmail.com>, 2011 # pm3_eml2mfd.py # converts pm3 mifare classic mfd binary dump file to emulator | STRING |
| HIGH | client/pyscripts/ntag22x_libsuncmac.py | 0 | compute the hamming weight (number of set bits) of an integer. | STRING |
| HIGH | client/pyscripts/ntag22x_suncmac_recovery.py | 0 | compute the hamming weight (number of set bits) of an integer. | STRING |
| HIGH | client/pyscripts/mfulaes_mask_recovery.py | 0 | compute the hamming weight (number of set bits) of an integer. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | common/mbedtls/error.c | 224 | /* Begin Auto-Generated Code. */ | COMMENT |
| HIGH | common/mbedtls/error.c | 567 | /* End Auto-Generated Code. */ | COMMENT |
| HIGH | common/mbedtls/error.c | 586 | /* Begin Auto-Generated Code. */ | COMMENT |
| HIGH | common/mbedtls/error.c | 883 | /* End Auto-Generated Code. */ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/pm3_online_tests.sh | 129 | # Check if file exists | STRING |
| LOW | tools/mfc/pm3_gen_dictionary.py | 79 | # Check if the directory exists | COMMENT |
| LOW | tools/mfc/pm3_gen_dictionary.py | 98 | # Check if the file name starts with the given prefix | COMMENT |
| LOW | client/update_amiibo_tools_lua.py | 67 | # Open the file | COMMENT |
| LOW | client/pyscripts/des_talk.py | 144 | if aids: # Check if there are any AIDs | CODE |
| LOW | client/pyscripts/des_talk.py | 385 | # Check if byte falls in printable ASCII range | COMMENT |
| LOW | client/pyscripts/read_t-union.py | 294 | # Check if we have enough bytes for tag and length | COMMENT |
| LOW | client/pyscripts/read_t-union.py | 306 | # Check if we have enough bytes for value | COMMENT |
| LOW | client/pyscripts/paxton_net.py | 87 | # Check if the second nibble of the second byte in block 5 is 'F' | COMMENT |
| LOW | client/pyscripts/mfulc_counterfeit_recovery.py | 196 | # Check if all blocks are cracked | COMMENT |
| LOW | client/pyscripts/pm3_nfc2eml.py | 27 | # Check if the input file is a text file based on its content | COMMENT |
| LOW⚡ | client/pyscripts/pm3_nfc2eml.py | 59 | # Check if the target file exists | COMMENT |
| LOW⚡ | client/pyscripts/pm3_nfc2eml.py | 68 | # Check if the input file name has the .nfc extension | COMMENT |
| LOW⚡ | client/pyscripts/pm3_nfc2eml.py | 75 | # Check if the directory of the output file is writable | COMMENT |
| LOW⚡ | client/pyscripts/pm3_nfc2eml.py | 80 | # Check if the output file name has the .eml extension | COMMENT |
| LOW | client/pyscripts/dc34.py | 801 | # Check if game was won/lost | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | covbuild.sh | 25 | # make sure to do client after ARM because Coverity retains one build info per file | COMMENT |
| LOW | armsrc/felica.c | 236 | case STATE_FULL: //ignore byte. Don't forget to clear frame to receive next one... | CODE |
| MEDIUM | tools/hitag2crack/common/hitagcrypto.h | 118 | * parties as discussed above. If you wish to specify special license * | COMMENT |
| MEDIUM | tools/hitag2crack/common/hitagcrypto.c | 118 | * parties as discussed above. If you wish to specify special license * | COMMENT |
| LOW | common/mbedtls/blowfish.h | 40 | #define MBEDTLS_BLOWFISH_ROUNDS 16 /**< Rounds to use. When increasing this value, make sure to extend the | COMMENT |
| LOW | client/deps/openjpeg/t2.c | 577 | /* don't forget to release pi */ | COMMENT |
| LOW | client/src/cmdhfmfu.h | 112 | // Don't forget to fill UL_TYPES_ARRAY and UL_MEMORY_ARRAY if new types are added | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | client/pyscripts/ntag22x_libsuncmac.py | 146 | chunk_size = 2**20 # Define a smaller chunk size | CODE |
| MEDIUM | client/pyscripts/pm3_nfc2eml.py | 42 | # Create an argument parser | COMMENT |
| MEDIUM | client/pyscripts/dc34.py | 348 | # This class is represented by a single WasGuessCorrect byte (0x00 == wrong, 0x01 == correct), | COMMENT |
| MEDIUM | client/pyscripts/dc34.py | 419 | # Define a base class for the HF 14a commands. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | armsrc/iso15693.c | 231 | // is designed for more robust communication over longer distances | COMMENT |
| MEDIUM | tools/pm3_tears_for_fears.py | 318 | # No bits can be used as leverage | COMMENT |
| MEDIUM | tools/pm3_tears_for_fears.py | 355 | # No bits can be used as leverage | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/external_sam_read.py | 443 | def _set_detected_card(self) -> None: | CODE |
| LOW | tools/external_sam_read.py | 542 | def set_bit(self, position: int, value: int) -> None: | CODE |
| LOW | tools/ePassport/epassport/app.py | 391 | def _set_progress(self, done: int, total: int, name: str) -> None: | CODE |
| LOW | tools/ePassport/epassport/ui/entry.py | 301 | def set_field(self, field_id: str, text: str) -> None: | CODE |
| LOW | tools/ePassport/epassport/ui/entry.py | 313 | def set_line2(self, text: str) -> None: | CODE |
| LOW | tools/ePassport/epassport/ui/scan.py | 244 | def _set_label(self, label: str) -> None: | CODE |
| LOW | tools/ePassport/epassport/ui/tabs/pages.py | 38 | def set_rows(self, pairs: list[tuple[str, str]]) -> None: | CODE |
| LOW | tools/ePassport/tests/test_camera.py | 102 | def _set_label(self, label: str) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | armsrc/em4x70.c | 39 | // Example usage: | COMMENT |
| LOW | tools/mfc/pm3_gen_dictionary.py | 35 | # Usage: | STRING |
| LOW | tools/mfc/pm3_mfdread.py | 12 | #Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | client/update_amiibo_tools_lua.py | 89 | CODE | |
| LOW | client/pyscripts/fm11rf08s_recovery.py | 74 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | armsrc/iso14443a.c | 2066 | // TODO: implement cyclic memory if we reach AUTH0 and AUTH1=0 and unauth on ULC/ULAES, or if we rea | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | client/resources/ecplist.json | 131 | "key": ["demo", "placeholder"], | CODE |