git.zerfleddert.de Git - proxmark3-svn/blobdiff

index eb145123801d7f227ef150be27fb576303991336..5e0f47603f2498521b1cad4ab7e0aebb2f2522d7 100644 (file)

--- a/client/mifarehost.c

+++ b/client/mifarehost.c

@@ -12,10 +12,43 @@

#include <stdlib.h> \r

#include <string.h>\r

#include <pthread.h>\r

#include <stdlib.h> \r

#include <string.h>\r

#include <pthread.h>\r

-#include "mifarehost.h"\r

+\r

+#include "nonce2key/crapto1.h"\r

#include "proxmark3.h"\r

+#include "usb_cmd.h"\r

+#include "cmdmain.h"\r

+#include "ui.h"\r

+#include "util.h"\r

+#include "iso14443crc.h"\r

+#include "mifarehost.h"\r

+\r

+// mifare tracer flags used in mfTraceDecode()\r

+#define TRACE_IDLE 0x00\r

+#define TRACE_AUTH1 0x01\r

+#define TRACE_AUTH2 0x02\r

+#define TRACE_AUTH_OK 0x03\r

+#define TRACE_READ_DATA 0x04\r

+#define TRACE_WRITE_OK 0x05\r

+#define TRACE_WRITE_DATA 0x06\r

+#define TRACE_ERROR 0xFF\r

+\r

// MIFARE\r

+int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key){\r

+\r

+ *key = 0;\r

+\r

+ UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType&0xff)<<8)), clear_trace, keycnt}};\r

+ memcpy(c.d.asBytes, keyBlock, 6 * keycnt);\r

+ SendCommand(&c);\r

+\r

+ UsbCommand resp;\r

+ if (!WaitForResponseTimeout(CMD_ACK,&resp,3000)) return 1;\r

+ if ((resp.arg[0] & 0xff) != 0x01) return 2;\r

+ *key = bytes_to_num(resp.d.asBytes, 6);\r

+ return 0;\r

+}\r

+\r

int compar_int(const void * a, const void * b) {\r

// didn't work: (the result is truncated to 32 bits)\r

//return (*(uint64_t*)b - *(uint64_t*)a);\r

int compar_int(const void * a, const void * b) {\r

// didn't work: (the result is truncated to 32 bits)\r

//return (*(uint64_t*)b - *(uint64_t*)a);\r

@@ -193,21 +226,6 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo

return 0;\r

}\r

return 0;\r

}\r

-int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key){\r

-\r

- *key = 0;\r

-\r

- UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType&0xff)<<8)), clear_trace, keycnt}};\r

- memcpy(c.d.asBytes, keyBlock, 6 * keycnt);\r

- SendCommand(&c);\r

-\r

- UsbCommand resp;\r

- if (!WaitForResponseTimeout(CMD_ACK,&resp,3000)) return 1;\r

- if ((resp.arg[0] & 0xff) != 0x01) return 2;\r

- *key = bytes_to_num(resp.d.asBytes, 6);\r

- return 0;\r

-}\r

-\r

// EMULATOR\r

int mfEmlGetMem(uint8_t *data, int blockNum, int blocksCount) {\r

// EMULATOR\r

int mfEmlGetMem(uint8_t *data, int blockNum, int blocksCount) {\r

@@ -229,32 +247,22 @@ int mfEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {

// "MAGIC" CARD\r

-int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool wantWipe) {\r

- uint8_t oldblock0[16] = {0x00};\r

- uint8_t block0[16] = {0x00};\r

+int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params) {\r

+ uint8_t isOK = 0;\r

- int old = mfCGetBlock(0, oldblock0, CSETBLOCK_SINGLE_OPER);\r

- if (old == 0) {\r

- memcpy(block0, oldblock0, 16);\r

- PrintAndLog("old block 0: %s", sprint_hex(block0,16));\r

- } else {\r

- PrintAndLog("Couldn't get old data. Will write over the last bytes of Block 0.");\r

- }\r

+ UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};\r

+ SendCommand(&c);\r

- // fill in the new values\r

- // UID\r

- memcpy(block0, uid, 4); \r

- // Mifare UID BCC\r

- block0[4] = block0[0]^block0[1]^block0[2]^block0[3];\r

- // mifare classic SAK(byte 5) and ATQA(byte 6 and 7, reversed)\r

- if (sak!=NULL)\r

- block0[5]=sak[0];\r

- if (atqa!=NULL) {\r

- block0[6]=atqa[1];\r

- block0[7]=atqa[0];\r

+ UsbCommand resp;\r

+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r

+ isOK = resp.arg[0] & 0xff;\r

+ memcpy(data, resp.d.asBytes, 16);\r

+ if (!isOK) return 2;\r

+ } else {\r

+ PrintAndLog("Command execute timeout");\r

+ return 1;\r

}\r

- PrintAndLog("new block 0: %s", sprint_hex(block0,16));\r

- return mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER);\r

+ return 0;\r

}\r

int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, bool wantWipe, uint8_t params) {\r

}\r

int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, bool wantWipe, uint8_t params) {\r

@@ -278,22 +286,32 @@ int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, bool wantWipe, uin

return 0;\r

}\r

return 0;\r

}\r

-int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params) {\r

- uint8_t isOK = 0;\r

-\r

- UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};\r

- SendCommand(&c);\r

+int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool wantWipe) {\r

+ uint8_t oldblock0[16] = {0x00};\r

+ uint8_t block0[16] = {0x00};\r

- UsbCommand resp;\r

- if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r

- isOK = resp.arg[0] & 0xff;\r

- memcpy(data, resp.d.asBytes, 16);\r

- if (!isOK) return 2;\r

+ int old = mfCGetBlock(0, oldblock0, CSETBLOCK_SINGLE_OPER);\r

+ if (old == 0) {\r

+ memcpy(block0, oldblock0, 16);\r

+ PrintAndLog("old block 0: %s", sprint_hex(block0,16));\r

} else {\r

- PrintAndLog("Command execute timeout");\r

- return 1;\r

+ PrintAndLog("Couldn't get old data. Will write over the last bytes of Block 0.");\r

}\r

- return 0;\r

+\r

+ // fill in the new values\r

+ // UID\r

+ memcpy(block0, uid, 4); \r

+ // Mifare UID BCC\r

+ block0[4] = block0[0]^block0[1]^block0[2]^block0[3];\r

+ // mifare classic SAK(byte 5) and ATQA(byte 6 and 7, reversed)\r

+ if (sak!=NULL)\r

+ block0[5]=sak[0];\r

+ if (atqa!=NULL) {\r

+ block0[6]=atqa[1];\r

+ block0[7]=atqa[0];\r

+ }\r

+ PrintAndLog("new block 0: %s", sprint_hex(block0,16));\r

+ return mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER);\r

}\r

// SNIFFER\r

}\r

// SNIFFER\r

@@ -337,6 +355,23 @@ int isBlockTrailer(int blockN) {

return ((blockN & 0x03) == 0x03);\r

}\r

return ((blockN & 0x03) == 0x03);\r

}\r

+int saveTraceCard(void) {\r

+ FILE * f;\r

+ \r

+ if ((!strlen(traceFileName)) || (isTraceCardEmpty())) return 0;\r

+ \r

+ f = fopen(traceFileName, "w+");\r

+ if ( !f ) return 1;\r

+ \r

+ for (int i = 0; i < 64; i++) { // blocks\r

+ for (int j = 0; j < 16; j++) // bytes\r

+ fprintf(f, "%02x", *(traceCard + i * 16 + j)); \r

+ fprintf(f,"\n");\r

+ }\r

+ fclose(f);\r

+ return 0;\r

+}\r

+\r

int loadTraceCard(uint8_t *tuid) {\r

FILE * f;\r

char buf[64] = {0x00};\r

int loadTraceCard(uint8_t *tuid) {\r

FILE * f;\r

char buf[64] = {0x00};\r

@@ -383,23 +418,6 @@ int loadTraceCard(uint8_t *tuid) {

return 0;\r

}\r

return 0;\r

}\r

-int saveTraceCard(void) {\r

- FILE * f;\r

- \r

- if ((!strlen(traceFileName)) || (isTraceCardEmpty())) return 0;\r

- \r

- f = fopen(traceFileName, "w+");\r

- if ( !f ) return 1;\r

- \r

- for (int i = 0; i < 64; i++) { // blocks\r

- for (int j = 0; j < 16; j++) // bytes\r

- fprintf(f, "%02x", *(traceCard + i * 16 + j)); \r

- fprintf(f,"\n");\r

- }\r

- fclose(f);\r

- return 0;\r

-}\r

-\r

int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile) {\r

if (traceCrypto1) \r

int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile) {\r

if (traceCrypto1) \r

@@ -619,3 +637,23 @@ int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {

return 0;\r

}\r

return 0;\r

}\r

+\r

+int tryDecryptWord(uint32_t nt, uint32_t ar_enc, uint32_t at_enc, uint8_t *data, int len){\r

+ /*\r

+ uint32_t nt; // tag challenge\r

+ uint32_t ar_enc; // encrypted reader response\r

+ uint32_t at_enc; // encrypted tag response\r

+ */\r

+ if (traceCrypto1) {\r

+ crypto1_destroy(traceCrypto1);\r

+ }\r

+ ks2 = ar_enc ^ prng_successor(nt, 64);\r

+ ks3 = at_enc ^ prng_successor(nt, 96);\r

+ traceCrypto1 = lfsr_recovery64(ks2, ks3);\r

+\r

+ mf_crypto1_decrypt(traceCrypto1, data, len, 0);\r

+\r

+ PrintAndLog("Decrypted data: [%s]", sprint_hex(data,len) );\r

+ crypto1_destroy(traceCrypto1);\r

+ return 0;\r

+}\r