Proxmark3 fullimage not flashing because of Lock Bits, but bootloader works!

[masr]

Hi! I have a Proxmark3 Easy with 512MB space. Somehow, there are Lock Bits set at the end of the 512MB. The bootloader is working! I can flash a small 256MB firmware, but if I flash a bigger version, flashing doesn´t work, because of the Lock Bits at the end. I don’t have extra hardware to remove them. I read in the Internet, that as long as the bootloader is working, I can fix all problems just over USB. How can I remove the Lock Bits? Here is my output:

pm3 ~/proxmark3$ pm3-flash-fullimage
[=] Waiting for Proxmark3 to appear…
[=] Session log C:\ProxSpace\pm3/.proxmark3/logs/log_20220627.txt
[+] loaded from JSON file C:\ProxSpace\pm3/.proxmark3/preferences.json
[+] About to use the following file:
[+] C:\ProxSpace\pm3\proxmark3\client…/armsrc/obj/fullimage.elf
[+] Loading ELF file C:\ProxSpace\pm3\proxmark3\client…/armsrc/obj/fullimage.elf
[+] ELF file version Iceman/master/v4.14831-675-g636a85017 2022-06-27 00:55:26 f0adc4a2c

[+] Waiting for Proxmark3 to appear on COM3
[|] 59 found
[=] Available memory on this board: 512K bytes

[=] Permitted flash range: 0x00102000-0x00180000
[+] Loading usable ELF segments:
[+] 0: V 0x00102000 P 0x00102000 (0x00046c4c->0x00046c4c) [R X] @0x98
[+] 1: V 0x00200000 P 0x00148c4c (0x00001b08->0x00001b08) [R X] @0x46ce8
[=] Note: Extending previous segment from 0x46c4c to 0x48754 bytes

[+] Flashing…
[+] Writing segments for file: C:\ProxSpace\pm3\proxmark3\client…/armsrc/obj/fullimage.elf
[+] 0x00102000…0x0014a753 [0x48754 / 580 blocks]
mm Lock Error

Lock Bits: 0xffff
[!] The flashing procedure failed, follow the suggested steps!
[+] All done

[=] Have a nice day!

[!!] Error: Unexpected reply 0x00fe NACK (expected ACK)
[!!] Error writing block 496 of 580
pm3 ~/proxmark3$

[Equipter]

start by flashing bootrom by itself and then by flashing fullimage separately

[masr]

I already flashed the bootrom by itself, but when I then just flash the fullimage after that, I cannot flash it because of the lock bits. And a smaller image (256MB), I can flash without problems, because the lock bits are at the end.

[amal]

I’ve never heard of this… anyone use a jtag programmer to get around this? I wasn’t even aware there were lock bytes on this thing.

[GlennB]

I am having the exact same issue - Now I have my proxmark3 blinking all lights all the time.

Holding the button down I can do .pm3-flash-bootrom, but not -fullimage or -all…
I am getting the same error:

[!!] Error: Unexpected reply 0x00fe NACK (expected ACK)
[!!] Error writing block 496 of 587

Any thoughts?

[Pilgrimsmaster]

@GlennB

Any thoughts?

@GlennB

Holding the button down I can do .pm3-flash-bootrom, but not -fullimage

Are these the mothods you have tried?

FlexMT HF Reading Issues

I have had tons of problems getting various Easy models to load rrg properly… it honestly takes a slog of different variations to get it working… I have two different Easy models both with 512k and both required slightly different approaches… one of these approaches tend to work; hold button down, power up, keep holding, run pm3-flash-bootrom, once finished, let go of button but let it flash lights and do whatever the heck it wants to do, see if com port comes back eventually, if com port app…

Where did you get your PM3 from?
What guide did you follow to set up your PM3?

I have found that sometimes, a fresh install can be faster and less painfull than fault finding.
Thats what I would do if the issue persists

I would follow one of these
Full and complete instructions

Getting started with the proxmark3 easy

This is a Getting Started walk-through for our Proxmark3 Easy hardware on Windows. MacOS MacOS users check here for the RRG official installation guide, or check here for the short version. Proxmark3 on Windows Video Guide Walkthrough I walk through the process outlined in this guide! [Getting Started Guide for Proxmark3 Easy on Windows] Guide Outline If you are setting up a newly acquired Proxmark3 Easy purchased from us, DO NOT SKIP ANY STEP… especially the Makefile.platform s…

Abridged version
https://forum.dangerousthings.com/t/handy-dandy-tips-and-tricks/13041/14?u=pilgrimsmaster

[stillashortusername]

I had the same issue as I used a chinese clone.
I had to unlock the second flash bank.
I used openocd (from Olimex-site v0.9.0-rc1 - I know, quite old - here under Software on the right) with the Olimex ARM-USB-OCD.

openocd.exe -f ..\scripts\interface\ftdi\olimex-arm-usb-ocd.cfg -f ..\scripts\target\at91sam7sx.cfg

I had to edit the olimex-arm-usb-ocd.cfg and added a adapter_khz 6000.
After that, connect via telnet telnet localhost 4444, and enter the following commands:

reset halt
flash info 0
flash info 1
# for the second one, I`ve had "Pages in lock region: 1024", the first one hadn't any locks
# now unlocking the flash pages
flash protect 0 0 15 off
flash protect 1 0 15 off

you can try the flash info 1 again after unlocking and you should get “Pages in lock region: 0”.
Now you should be able to flash the fullimage.

You can also use any other JTAG-programmer that works with openocd, but you have to adjust the first configuration-file in the openocd-call above.

[luhy]

hello, i have the same issue so i tried what you said, but it dosn’t work!
when i enter the commande : ```
openocd.exe -f …\scripts\interface\ftdi\olimex-arm-usb-ocd.cfg -f …\scripts\target\at91sam7sx.cfg

it says : Warn : Flash driver of at91sam7s.flash does not support free_driver_priv()
 and
Error: no device found
Error: unable to open ftdi device with vid 15ba, pid 0003, description 'Olimex OpenOCD JTAG', serial '*' at bus location '*'

can you help me?

[LOCOSP]

Hi there,
today I’ve received my PROXMARK bought in my country and have no idea if it’s original or chinese clone,
but I am trapped in same issue…
First, I had an old bootloader so flashed pm3-flash-bootrom after that pm3-flash-all and bam!

🚨 Error: Unexpected reply 0x00fe NACK (expected ACK)
       Lock Error


       Lock Bits:      0xffff
[!!] 🚨 Error writing block 496 of 588

I’m using MacOS

PLZ HELP!

[Equipter]

change the cable you’re using and use bootloader mode

[LOCOSP]

I was able to flash with this firmware: GitHub - Proxmark/homebrew-proxmark3: Homebrew Tap for OS X users
and i know that my PM3 is 512k

Nonvolatile Program Memory Size: 512K bytes. Used: 197222 bytes (38). Free: 327066 bytes (62).

I will try with another cable…

[LOCOSP]

Sorry but nothing has changed.

[LOCOSP]

Do I need additional hardware for this operation?

[LOCOSP]

Little Support UPDATE

I was mange to flash iceman firmware to my PM3e after few adventures…
I did all it is written in this awesome tutorial, just notice the best practice is to start from scratch:

• fresh RaspOS
• new cable
• fresh pinout etc.

How to unbrick a PM3 easy!

Hey everyone, in light of @StrwbrrySam’s topic about his bricked PM3 easy, I thought I’d post a guide on how I recovered my PM3 after purposefully bricking it (yes I’m crazy, but it was as a test of the process). First: DO NOT BOTHER WITH THE BUSPIRATE - while it is recommended elsewhere as an easy / cheap option, it was painful to use and did NOT work (for me). Please feel free to make suggestions / give feedback. If you are trying to follow this guide, feel free to PM me here, message in thi…

Cheers!

#EDIT

I’ll continue in this thread, tell me please if I should do something with the config of PM3 easy because it read all but not my NExT implant. As i know, might be a problem reading LF(hard to locate best spot) but it doesn’t see NTAG216 neither. Please give me some clues.