}\r
if (isOK) {\r
fwrite ( data, 1, 16, fout );\r
+ PrintAndLog("Dumped card data into 'dumpdata.bin'");\r
+\r
}\r
else {\r
PrintAndLog("Could not get access rights for block %d", i);\r
\r
fclose(fin);\r
fclose(fout);\r
- \r
return 0;\r
}\r
\r
\r
for (i=0 ; i<16 ; i++) {\r
if (fread(keyA[i], 1, 6, fkeys) == 0) {\r
- PrintAndLog("File reading error.");\r
+ PrintAndLog("File reading error.");\r
return 2;\r
}\r
}\r
for (i=0 ; i<16 ; i++) {\r
if (fread(keyB[i], 1, 6, fkeys) == 0) {\r
- PrintAndLog("File reading error.");\r
+ PrintAndLog("File reading error.");\r
return 2;\r
}\r
}\r
memcpy(c.d.asBytes, key, 6);\r
\r
if (fread(bldata, 1, 16, fdump) == 0) {\r
- PrintAndLog("File reading error.");\r
- return 2;\r
+ PrintAndLog("File reading error.");\r
+ return 2;\r
}\r
\r
if (j == 3) {\r
SendCommand(&c);\r
\r
UsbCommand resp;\r
- if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
uint8_t isOK = resp.arg[0] & 0xff;\r
PrintAndLog("isOk:%02x", isOK);\r
} else {\r
uint8_t blDiff = 0;\r
int SectorsCnt = 0;\r
uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r
- uint8_t keyBlock[16 * 6];\r
+ uint8_t keyBlock[6*6];\r
uint64_t key64 = 0;\r
int transferToEml = 0;\r
\r
PrintAndLog("--target block no:%02x target key type:%02x ", trgBlockNo, trgKeyType);\r
\r
if (cmdp == 'o') {\r
- if (mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock)) {\r
+ if (mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true)) {\r
PrintAndLog("Nested error.");\r
return 2;\r
}\r
-\r
- for (i = 0; i < 16; i++) {\r
- PrintAndLog("count=%d key= %s", i, sprint_hex(keyBlock + i * 6, 6));\r
- }\r
- \r
- // test keys\r
- res = mfCheckKeys(trgBlockNo, trgKeyType, 8, keyBlock, &key64);\r
- if (res)\r
- res = mfCheckKeys(trgBlockNo, trgKeyType, 8, &keyBlock[6 * 8], &key64);\r
- if (!res) {\r
+ key64 = bytes_to_num(keyBlock, 6);\r
+ if (key64) {\r
PrintAndLog("Found valid key:%012"llx, key64);\r
\r
// transfer key to the emulator\r
}\r
}\r
else { // ------------------------------------ multiple sectors working\r
+ clock_t time1;\r
+ time1 = clock();\r
+\r
blDiff = blockNo % 4;\r
PrintAndLog("Block shift=%d", blDiff);\r
e_sector = calloc(SectorsCnt, sizeof(sector));\r
\r
//test current key 4 sectors\r
memcpy(keyBlock, key, 6);\r
- num_to_bytes(0xa0a1a2a3a4a5, 6, (uint8_t*)(keyBlock + 1 * 6));\r
- num_to_bytes(0xb0b1b2b3b4b5, 6, (uint8_t*)(keyBlock + 2 * 6));\r
- num_to_bytes(0xffffffffffff, 6, (uint8_t*)(keyBlock + 3 * 6));\r
- num_to_bytes(0x000000000000, 6, (uint8_t*)(keyBlock + 4 * 6));\r
+ num_to_bytes(0xffffffffffff, 6, (uint8_t*)(keyBlock + 1 * 6));\r
+ num_to_bytes(0x000000000000, 6, (uint8_t*)(keyBlock + 2 * 6));\r
+ num_to_bytes(0xa0a1a2a3a4a5, 6, (uint8_t*)(keyBlock + 3 * 6));\r
+ num_to_bytes(0xb0b1b2b3b4b5, 6, (uint8_t*)(keyBlock + 4 * 6));\r
num_to_bytes(0xaabbccddeeff, 6, (uint8_t*)(keyBlock + 5 * 6));\r
\r
PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt);\r
e_sector[i].foundKey[j] = 1;\r
}\r
}\r
- } \r
+ }\r
+ \r
\r
// nested sectors\r
iterations = 0;\r
PrintAndLog("nested...");\r
+ bool calibrate = true;\r
for (i = 0; i < NESTED_SECTOR_RETRY; i++) {\r
- for (trgBlockNo = blDiff; trgBlockNo < SectorsCnt * 4; trgBlockNo = trgBlockNo + 4) \r
+ for (trgBlockNo = blDiff; trgBlockNo < SectorsCnt * 4; trgBlockNo = trgBlockNo + 4) {\r
for (trgKeyType = 0; trgKeyType < 2; trgKeyType++) { \r
if (e_sector[trgBlockNo / 4].foundKey[trgKeyType]) continue;\r
- if (mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock)) continue;\r
+ PrintAndLog("-----------------------------------------------");\r
+ if(mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, calibrate)) {\r
+ PrintAndLog("Nested error.\n");\r
+ return 2;\r
+ }\r
+ else {\r
+ calibrate = false;\r
+ }\r
\r
iterations++;\r
- \r
- //try keys from nested\r
- res = mfCheckKeys(trgBlockNo, trgKeyType, 8, keyBlock, &key64);\r
- if (res)\r
- res = mfCheckKeys(trgBlockNo, trgKeyType, 8, &keyBlock[6 * 8], &key64);\r
- if (!res) {\r
+\r
+ key64 = bytes_to_num(keyBlock, 6);\r
+ if (key64) {\r
PrintAndLog("Found valid key:%012"llx, key64);\r
e_sector[trgBlockNo / 4].foundKey[trgKeyType] = 1;\r
e_sector[trgBlockNo / 4].Key[trgKeyType] = key64;\r
}\r
}\r
+ }\r
}\r
\r
- PrintAndLog("Iterations count: %d", iterations);\r
+ printf("Time in nested: %1.3f (%1.3f sec per key)\n\n", ((float)clock() - time1)/CLOCKS_PER_SEC, ((float)clock() - time1)/iterations/CLOCKS_PER_SEC);\r
+ \r
+ PrintAndLog("-----------------------------------------------\nIterations count: %d\n\n", iterations);\r
//print them\r
PrintAndLog("|---|----------------|---|----------------|---|");\r
PrintAndLog("|sec|key A |res|key B |res|");\r
keyBlock = calloc(stKeyBlock, 6);\r
if (keyBlock == NULL) return 1;\r
\r
- num_to_bytes(0xffffffffffff, 6, (uint8_t*)(keyBlock + 0 * 6)); // Default key (first key used by program if no user defined key)\r
- num_to_bytes(0x000000000000, 6, (uint8_t*)(keyBlock + 1 * 6)); // Blank key\r
- num_to_bytes(0xa0a1a2a3a4a5, 6, (uint8_t*)(keyBlock + 2 * 6)); // NFCForum MAD key\r
- num_to_bytes(0xb0b1b2b3b4b5, 6, (uint8_t*)(keyBlock + 3 * 6));\r
- num_to_bytes(0xaabbccddeeff, 6, (uint8_t*)(keyBlock + 4 * 6));\r
- num_to_bytes(0x4d3a99c351dd, 6, (uint8_t*)(keyBlock + 5 * 6));\r
- num_to_bytes(0x1a982c7e459a, 6, (uint8_t*)(keyBlock + 6 * 6));\r
- num_to_bytes(0xd3f7d3f7d3f7, 6, (uint8_t*)(keyBlock + 7 * 6));\r
- num_to_bytes(0x714c5c886e97, 6, (uint8_t*)(keyBlock + 8 * 6));\r
- num_to_bytes(0x587ee5f9350f, 6, (uint8_t*)(keyBlock + 9 * 6));\r
- num_to_bytes(0xa0478cc39091, 6, (uint8_t*)(keyBlock + 10 * 6));\r
- num_to_bytes(0x533cb6c723f6, 6, (uint8_t*)(keyBlock + 11 * 6));\r
- num_to_bytes(0x8fd0a4f256e9, 6, (uint8_t*)(keyBlock + 12 * 6));\r
+ uint64_t defaultKeys[] =\r
+ {\r
+ 0xffffffffffff, // Default key (first key used by program if no user defined key)\r
+ 0x000000000000, // Blank key\r
+ 0xa0a1a2a3a4a5, // NFCForum MAD key\r
+ 0xb0b1b2b3b4b5,\r
+ 0xaabbccddeeff,\r
+ 0x4d3a99c351dd,\r
+ 0x1a982c7e459a,\r
+ 0xd3f7d3f7d3f7,\r
+ 0x714c5c886e97,\r
+ 0x587ee5f9350f,\r
+ 0xa0478cc39091,\r
+ 0x533cb6c723f6,\r
+ 0x8fd0a4f256e9\r
+ };\r
+ int defaultKeysSize = (sizeof(defaultKeys) / 7) - 1;\r
+\r
+ for (int defaultKeyCounter = 0; defaultKeyCounter < defaultKeysSize; defaultKeyCounter++)\r
+ {\r
+ num_to_bytes(defaultKeys[defaultKeyCounter], 6, (uint8_t*)(keyBlock + defaultKeyCounter * 6));\r
+ }\r
\r
if (strlen(Cmd)<3) {\r
PrintAndLog("Usage: hf mf chk <block number>/<*card memory> <key type (A/B/?)> [t] [<key (12 hex symbols)>] [<dic (*.dic)>]");\r
}\r
\r
if ( (f = fopen( filename , "r")) ) {\r
- while( !feof(f) ){\r
- memset(buf, 0, sizeof(buf));\r
- if (fgets(buf, sizeof(buf), f) == NULL) {\r
- PrintAndLog("File reading error.");\r
- return 2;\r
- }\r
- \r
+ while( fgets(buf, sizeof(buf), f) ){\r
if (strlen(buf) < 12 || buf[11] == '\n')\r
continue;\r
\r
while (fgetc(f) != '\n' && !feof(f)) ; //goto next line\r
\r
- if( buf[0]=='#' ) continue; //The line start with # is remcommnet,skip\r
+ if( buf[0]=='#' ) continue; //The line start with # is comment, skip\r
\r
if (!isxdigit(buf[0])){\r
PrintAndLog("File content error. '%s' must include 12 HEX symbols",buf);\r
num_to_bytes(strtoll(buf, NULL, 16), 6, keyBlock + 6*keycnt);\r
PrintAndLog("chk custom key[%d] %012"llx, keycnt, bytes_to_num(keyBlock + 6*keycnt, 6));\r
keycnt++;\r
+ memset(buf, 0, sizeof(buf));\r
}\r
} else {\r
PrintAndLog("File: %s: not found or locked.", filename);\r
\r
if (keycnt == 0) {\r
PrintAndLog("No key specified,try default keys");\r
- for (;keycnt <=12; keycnt++)\r
+ for (;keycnt < defaultKeysSize; keycnt++)\r
PrintAndLog("chk default key[%d] %02x%02x%02x%02x%02x%02x", keycnt,\r
(keyBlock + 6*keycnt)[0],(keyBlock + 6*keycnt)[1], (keyBlock + 6*keycnt)[2],\r
(keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4], (keyBlock + 6*keycnt)[5], 6);\r
int b=blockNo;\r
for (int i=0; i<SectorsCnt; ++i) {\r
PrintAndLog("--SectorsCnt:%d block no:0x%02x key type:%C key count:%d ", i, b, t?'B':'A', keycnt);\r
- int size = keycnt>8?8:keycnt;\r
- for (int c = 0; c < keycnt; c+=size) {\r
- size=keycnt-c>8?8:keycnt-c; \r
- res = mfCheckKeys(b, t, size, keyBlock +6*c, &key64);\r
+ uint32_t max_keys = keycnt>USB_CMD_DATA_SIZE/6?USB_CMD_DATA_SIZE/6:keycnt;\r
+ for (uint32_t c = 0; c < keycnt; c+=max_keys) {\r
+ uint32_t size = keycnt-c>max_keys?max_keys:keycnt-c;\r
+ res = mfCheckKeys(b, t, size, &keyBlock[6*c], &key64);\r
if (res !=1) {\r
if (!res) {\r
PrintAndLog("Found valid key:[%012"llx"]",key64);\r
num_to_bytes(key64, 6, block + t*10);\r
mfEmlSetMem(block, get_trailer_block(b), 1);\r
}\r
- break;\r
- }\r
- else {\r
- printf("Not found yet, keycnt:%d\r", c+size);\r
- fflush(stdout);\r
}\r
} else {\r
PrintAndLog("Command execute timeout");\r
\r
int CmdHF14AMf1kSim(const char *Cmd)\r
{\r
- uint8_t uid[4] = {0, 0, 0, 0};\r
- \r
+ uint8_t uid[7] = {0, 0, 0, 0, 0, 0, 0};\r
+ uint8_t exitAfterNReads = 0;\r
+ uint8_t flags = 0;\r
+\r
if (param_getchar(Cmd, 0) == 'h') {\r
- PrintAndLog("Usage: hf mf sim <uid (8 hex symbols)>");\r
+ PrintAndLog("Usage: hf mf sim u <uid (8 hex symbols)> n <numreads> i x");\r
+ PrintAndLog(" u (Optional) UID. If not specified, the UID from emulator memory will be used");\r
+ PrintAndLog(" n (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");\r
+ PrintAndLog(" i (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");\r
+ PrintAndLog(" x (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r
PrintAndLog(" sample: hf mf sim 0a0a0a0a ");\r
return 0;\r
- } \r
- \r
- if (param_getchar(Cmd, 0) && param_gethex(Cmd, 0, uid, 8)) {\r
- PrintAndLog("UID must include 8 HEX symbols");\r
- return 1;\r
}\r
- PrintAndLog(" uid:%s ", sprint_hex(uid, 4));\r
- \r
- UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {0, 0, 0}};\r
- memcpy(c.d.asBytes, uid, 4);\r
+ uint8_t pnr = 0;\r
+ if (param_getchar(Cmd, pnr) == 'u') {\r
+ if(param_gethex(Cmd, pnr+1, uid, 8) == 0)\r
+ {\r
+ flags |=FLAG_4B_UID_IN_DATA; // UID from packet\r
+ }else if(param_gethex(Cmd,pnr+1,uid,14) == 0)\r
+ {\r
+ flags |= FLAG_7B_UID_IN_DATA;// UID from packet\r
+ }else\r
+ {\r
+ PrintAndLog("UID, if specified, must include 8 or 14 HEX symbols");\r
+ return 1;\r
+ }\r
+ pnr +=2;\r
+ }\r
+ if (param_getchar(Cmd, pnr) == 'n') {\r
+ exitAfterNReads = param_get8(Cmd,pnr+1);\r
+ pnr += 2;\r
+ }\r
+ if (param_getchar(Cmd, pnr) == 'i' ) {\r
+ //Using a flag to signal interactiveness, least significant bit\r
+ flags |= FLAG_INTERACTIVE;\r
+ pnr++;\r
+ }\r
+\r
+ if (param_getchar(Cmd, pnr) == 'x' ) {\r
+ //Using a flag to signal interactiveness, least significant bit\r
+ flags |= FLAG_NR_AR_ATTACK;\r
+ }\r
+ PrintAndLog(" uid:%s, numreads:%d, flags:%d (0x%02x) ",\r
+ flags & FLAG_4B_UID_IN_DATA ? sprint_hex(uid,4):\r
+ flags & FLAG_7B_UID_IN_DATA ? sprint_hex(uid,7): "N/A"\r
+ , exitAfterNReads, flags,flags);\r
+\r
+\r
+ UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};\r
+ memcpy(c.d.asBytes, uid, sizeof(uid));\r
SendCommand(&c);\r
\r
+ if(flags & FLAG_INTERACTIVE)\r
+ {\r
+ UsbCommand resp;\r
+ PrintAndLog("Press pm3-button to abort simulation");\r
+ while(! WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ //We're waiting only 1.5 s at a time, otherwise we get the\r
+ // annoying message about "Waiting for a response... "\r
+ }\r
+ }\r
+\r
return 0;\r
}\r
\r
int CmdHF14AMfELoad(const char *Cmd)\r
{\r
FILE * f;\r
- char filename[20];\r
+ char filename[255];\r
char * fnameptr = filename;\r
char buf[64];\r
uint8_t buf8[64];\r
int i, len, blockNum;\r
+ bool 4kcard = 0;\r
\r
memset(filename, 0, sizeof(filename));\r
memset(buf, 0, sizeof(buf));\r
\r
if (param_getchar(Cmd, 0) == 'h' || param_getchar(Cmd, 0)== 0x00) {\r
PrintAndLog("It loads emul dump from the file `filename.eml`");\r
- PrintAndLog("Usage: hf mf eload <file name w/o `.eml`>");\r
- PrintAndLog(" sample: hf mf eload filename");\r
+ PrintAndLog("Usage: hf mf eload <file name w/o `.eml`> <4 - 4kcard>");\r
+ PrintAndLog(" sample: hf mf eload filename [4]");\r
return 0;\r
} \r
\r
+ size = param_getchar(Cmd, 1);\r
+ if (size == '4') 4kcard = 1;\r
+\r
len = strlen(Cmd);\r
- if (len > 14) len = 14;\r
+ if (len > 254) len = 254;\r
\r
memcpy(filename, Cmd, len);\r
fnameptr += len;\r
while(!feof(f)){\r
memset(buf, 0, sizeof(buf));\r
if (fgets(buf, sizeof(buf), f) == NULL) {\r
- PrintAndLog("File reading error.");\r
+ if(blockNum == 16 * 4)\r
+ {\r
+ break;\r
+ }\r
+ PrintAndLog("File reading error.");\r
return 2;\r
}\r
\r
}\r
fclose(f);\r
\r
- if (blockNum != 16 * 4 && blockNum != 32 * 4 + 8 * 16){\r
- PrintAndLog("File content error. There must be 64 blocks");\r
- return 4;\r
+ if(4kcard){\r
+ if (blockNum != 32 * 4 + 8 * 16){\r
+ PrintAndLog("File content error. There must be 64 blocks");\r
+ return 4;\r
+ }\r
+ }else{\r
+ if (blockNum != 16 * 4 && blockNum != 32 * 4 + 8 * 16){\r
+ PrintAndLog("File content error. There must be 64 blocks");\r
+ return 4;\r
+ }\r
}\r
- PrintAndLog("Loaded from file: %s", filename);\r
+ PrintAndLog("Loaded %d blocks from file: %s", blockNum, filename);\r
return 0;\r
}\r
\r
int CmdHF14AMfESave(const char *Cmd)\r
{\r
FILE * f;\r
- char filename[20];\r
+ char filename[255];\r
char * fnameptr = filename;\r
uint8_t buf[64];\r
int i, j, len;\r
} \r
\r
len = strlen(Cmd);\r
- if (len > 14) len = 14;\r
+ if (len > 254) len = 254;\r
\r
if (len < 1) {\r
// get filename\r
PrintAndLog("received trace len: %d packages: %d", blockLen, pckNum);\r
num = 0;\r
while (bufPtr - buf + 9 < blockLen) {\r
- isTag = bufPtr[3] & 0x80 ? true:false;\r
+ isTag = bufPtr[3] & 0x80 ? true:false;\r
bufPtr += 4;\r
parity = *((uint32_t *)(bufPtr));\r
bufPtr += 4;\r
static command_t CommandTable[] =\r
{\r
{"help", CmdHelp, 1, "This help"},\r
- {"dbg", CmdHF14AMfDbg, 0, "Set default debug mode"},\r
+ {"dbg", CmdHF14AMfDbg, 0, "Set default debug mode"},\r
{"rdbl", CmdHF14AMfRdBl, 0, "Read MIFARE classic block"},\r
{"rdsc", CmdHF14AMfRdSc, 0, "Read MIFARE classic sector"},\r
{"dump", CmdHF14AMfDump, 0, "Dump MIFARE classic tag to binary file"},\r
- {"restore", CmdHF14AMfRestore, 0, "Restore MIFARE classic binary file to BLANK tag"},\r
+ {"restore", CmdHF14AMfRestore, 0, "Restore MIFARE classic binary file to BLANK tag"},\r
{"wrbl", CmdHF14AMfWrBl, 0, "Write MIFARE classic block"},\r
- {"chk", CmdHF14AMfChk, 0, "Test block keys"},\r
- {"mifare", CmdHF14AMifare, 0, "Read parity error messages. param - <used card nonce>"},\r
- {"nested", CmdHF14AMfNested, 0, "Test nested authentication"},\r
+ {"chk", CmdHF14AMfChk, 0, "Test block keys"},\r
+ {"mifare", CmdHF14AMifare, 0, "Read parity error messages."},\r
+ {"nested", CmdHF14AMfNested, 0, "Test nested authentication"},\r
{"sniff", CmdHF14AMfSniff, 0, "Sniff card-reader communication"},\r
- {"sim", CmdHF14AMf1kSim, 0, "Simulate MIFARE card"},\r
+ {"sim", CmdHF14AMf1kSim, 0, "Simulate MIFARE card"},\r
{"eclr", CmdHF14AMfEClear, 0, "Clear simulator memory block"},\r
{"eget", CmdHF14AMfEGet, 0, "Get simulator memory block"},\r
{"eset", CmdHF14AMfESet, 0, "Set simulator memory block"},\r
{"eload", CmdHF14AMfELoad, 0, "Load from file emul dump"},\r
{"esave", CmdHF14AMfESave, 0, "Save to file emul dump"},\r
- {"ecfill", CmdHF14AMfECFill, 0, "Fill simulator memory with help of keys from simulator"},\r
- {"ekeyprn", CmdHF14AMfEKeyPrn, 0, "Print keys from simulator memory"},\r
- {"csetuid", CmdHF14AMfCSetUID, 0, "Set UID for magic Chinese card"},\r
- {"csetblk", CmdHF14AMfCSetBlk, 0, "Write block into magic Chinese card"},\r
- {"cgetblk", CmdHF14AMfCGetBlk, 0, "Read block from magic Chinese card"},\r
- {"cgetsc", CmdHF14AMfCGetSc, 0, "Read sector from magic Chinese card"},\r
+ {"ecfill", CmdHF14AMfECFill, 0, "Fill simulator memory with help of keys from simulator"},\r
+ {"ekeyprn", CmdHF14AMfEKeyPrn, 0, "Print keys from simulator memory"},\r
+ {"csetuid", CmdHF14AMfCSetUID, 0, "Set UID for magic Chinese card"},\r
+ {"csetblk", CmdHF14AMfCSetBlk, 0, "Write block into magic Chinese card"},\r
+ {"cgetblk", CmdHF14AMfCGetBlk, 0, "Read block from magic Chinese card"},\r
+ {"cgetsc", CmdHF14AMfCGetSc, 0, "Read sector from magic Chinese card"},\r
{"cload", CmdHF14AMfCLoad, 0, "Load dump into magic Chinese card"},\r
{"csave", CmdHF14AMfCSave, 0, "Save dump from magic Chinese card into file or emulator"},\r
{NULL, NULL, 0, NULL}\r
projects / proxmark3-svn / blobdiff