Setting Up a Proxmark3 on Windows with WSL2
I recently set up a Proxmark3 RDV4 on a Windows 11 machine and decided to document the process. My setup uses WSL2/Ubuntu for building and running the Proxmark3 client, while Windows handles the USB connection through usbipd-win.
The examples below are focused on working with tags that I own or blank test tags. The goal is to learn how different RFID technologies work rather than bypass an access-control system.
Hardware and software
My setup was:
- Proxmark3 RDV4
- Windows 11
- WSL2
- Ubuntu
- Iceman Proxmark3 repository
- A USB connection exposed to WSL using
usbipd
The Iceman repository is available at RfidResearchGroup/proxmark3.
1. Build the client in WSL
After cloning the repository, the first problem I encountered was:
The ARM compiler is required to build the Proxmark3 firmware. On Ubuntu, install the ARM toolchain and the host development dependencies:
sudo apt update
sudo apt install gcc-arm-none-eabi binutils-arm-none-eabi libnewlib-arm-none-eabi
sudo apt install liblz4-dev libbz2-dev libssl-dev
sudo apt install usbutils
Verify the ARM compiler:
I also hit missing headers during compilation:
lz4frame.h: No such file or directory
bzlib.h: No such file or directory
openssl/evp.h: No such file or directory
Those were resolved by installing the corresponding development packages above.
Then build the generic target:
A successful build produces, among other files:
2. Connect the Proxmark3 to WSL
Windows sees the Proxmark3 as a USB serial device. In PowerShell:
Look for the Proxmark3. In my case it appeared as:
Attach it to WSL:
If usbipd is not installed, install usbipd-win on Windows first.
Back in Ubuntu, verify that the device is visible:
I got:
Then check for the serial device:
Typically it will be:
If necessary, add your user to the dialout group:
Then restart the WSL session.
3. Start the Proxmark3 client
From the repository:
The client can also be started without a device:
That starts OFFLINE mode, which is useful for looking at commands but does not communicate with the hardware.
The command-line help is useful:
4. Flashing firmware
One important lesson from the setup was that the client and firmware versions should match. The client initially reported that the ARM firmware did not match the source used to compile the client.
The build produced:
The client can flash the firmware using the generated image. The exact flashing procedure can vary by Proxmark3 hardware and firmware version, so it is worth checking the current Iceman documentation before using --unlock-bootloader.
After flashing, reconnect to the client and check:
and:
A healthy connection should return the Proxmark3 hardware information rather than a communication timeout.
5. Check the antennas
The command:
is useful for checking the antenna characteristics.
It does not actively tune the antenna. It measures the antenna response.
For my device, both the LF and HF antennas were reported as OK. The LF antenna showed a strong response around the 125 kHz region and the HF antenna around 13.56 MHz.
6. Basic LF tag discovery
For a 125 kHz tag, the first command to try is:
This attempts to identify common LF tag technologies.
For example, a programmable LF tag may be identified as:
The important distinction is that a chip type and a credential format are not necessarily the same thing. For example, a T55x7 can be configured to emulate several different LF protocols.
7. T55x7 basics
T55x7 is a particularly useful tag for experimentation because its memory and RF configuration are programmable.
To detect a T55xx tag:
For a T55x7 configured for a common 125 kHz setup, the output can look like:
Chip type......... T55x7
Modulation........ ASK
Bit rate.......... 2 - RF/32
Inverted.......... No
Offset............ 32
Seq. terminator... Yes
Block0............ 000880E8
Downlink mode..... default/fixed bit length
Password set...... No
To inspect the configuration:
And to read the tag memory:
The T55x7 configuration is stored in block 0. The remaining blocks contain the programmable tag data.
8. Understanding block 0
One thing that initially caused confusion was treating block 0 like ordinary credential data.
For the test tag used during this setup, block 0 was:
lf t55xx info decoded this as:
So block 0 primarily describes how the tag should transmit its data. It is not simply the tag's ID.
For that reason, don't overwrite block 0 casually. If experimenting with a blank T55x7, record its original configuration first.
9. Writing a test T55x7
For experiments on a blank tag, individual blocks can be written with:
Then read the memory back:
This is a good way to understand the relationship between the Proxmark3 command and the physical tag memory.
Use a blank/test tag for write experiments. Don't experiment by writing arbitrary data into a live access credential.
10. AWID and other LF formats
The Proxmark3 can recognize several LF formats. One example is AWID.
A tag may be reported as something like:
The important concept is that:
These are different layers. A T55x7 configured for Manchester at RF/32 does not automatically contain an AWID credential simply because the correct configuration is present in block 0.
For learning, it is much easier to start with blank programmable tags and use the Proxmark3's read/detect commands to see how different formats are represented.
11. Useful command cheat sheet
Hardware
General LF
T55xx
AWID
The exact command set depends on the version of the Iceman client and firmware, so use the built-in help when in doubt:
or, for a command family:
12. Troubleshooting USB communication
Running the Proxmark3 through WSL2 adds another layer between the hardware and the client. If commands start timing out, check the connection from the bottom up.
On Windows:
The Proxmark3 should show as Attached.
In WSL:
If the USB device disappears, detach and attach it again from PowerShell.
If the device exists but the Proxmark3 client reports communication timeouts, restarting the client and reconnecting the USB device is often a good first step.
I also found that repeatedly issuing commands while the device was already unresponsive could leave the USB transport in a bad state. In that situation, restarting the client and re-attaching the USB device was more useful than continuing to issue commands.
What's next?
The Proxmark3 supports much more than 125 kHz LF tags. Some good next experiments are:
- EM4100/EM4102
- EM4305/EM4469
- Q5/T5555
- HID Prox
- MIFARE Classic
- MIFARE Ultralight
- NTAG213/215/216
- ISO15693
- ISO14443A/B
Starting with T5577 + EM4100 + NTAG gives a nice introduction to programmable LF, simple LF identification, and modern NFC.
The most important lesson from this setup: identify the tag technology first, understand its memory/configuration model, and experiment on tags you own or blank test tags.