PrintAndLog("Command execute timeout");\r
}\r
\r
- return 0;
-}
-
-int CmdHF14AMfUWrBl(const char *Cmd)
-{
- uint8_t blockNo = 0;
- uint8_t bldata[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
- UsbCommand resp;
-
- if (strlen(Cmd)<3) {
- PrintAndLog("Usage: hf mf uwrbl <block number> <block data (8 hex symbols)>");
- PrintAndLog(" sample: hf mf uwrbl 0 01020304");
- return 0;
- }
-
- blockNo = param_get8(Cmd, 0);
- if (param_gethex(Cmd, 1, bldata, 8)) {
- PrintAndLog("Block data must include 8 HEX symbols");
- return 1;
- }
-
- switch(blockNo)
- {
- case 0:
- PrintAndLog("Access Denied");
- break;
- case 1:
- PrintAndLog("Access Denied");
- break;
- case 2:
- PrintAndLog("--specialblock no:%02x", blockNo);
- PrintAndLog("--data: %s", sprint_hex(bldata, 4));
- UsbCommand c = {CMD_MIFAREU_WRITEBL, {blockNo}};
- memcpy(c.d.asBytes, bldata, 4);
- SendCommand(&c);
-
- if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
- uint8_t isOK = resp.arg[0] & 0xff;
- PrintAndLog("isOk:%02x", isOK);
- } else {
- PrintAndLog("Command execute timeout");
- }
- break;
- case 3:
- PrintAndLog("--specialblock no:%02x", blockNo);
- PrintAndLog("--data: %s", sprint_hex(bldata, 4));
- UsbCommand d = {CMD_MIFAREU_WRITEBL, {blockNo}};
- memcpy(d.d.asBytes,bldata, 4);
- SendCommand(&d);
-
- if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
- uint8_t isOK = resp.arg[0] & 0xff;
- PrintAndLog("isOk:%02x", isOK);
- } else {
- PrintAndLog("Command execute timeout");
- }
- break;
- default:
- PrintAndLog("--block no:%02x", blockNo);
- PrintAndLog("--data: %s", sprint_hex(bldata, 4));
- //UsbCommand e = {CMD_MIFAREU_WRITEBL_COMPAT, {blockNo}};
- //memcpy(e.d.asBytes,bldata, 16);
- UsbCommand e = {CMD_MIFAREU_WRITEBL, {blockNo}};
- memcpy(e.d.asBytes,bldata, 4);
- SendCommand(&e);
-
- if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
- uint8_t isOK = resp.arg[0] & 0xff;
- PrintAndLog("isOk:%02x", isOK);
- } else {
- PrintAndLog("Command execute timeout");
- }
- break;
- }
- return 0;
-}
-
-int CmdHF14AMfRdBl(const char *Cmd)
-{
- uint8_t blockNo = 0;
+ return 0;\r
+}\r
+\r
+int CmdHF14AMfUWrBl(const char *Cmd)\r
+{\r
+ uint8_t blockNo = 0;\r
+ uint8_t bldata[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};\r
+ UsbCommand resp;\r
+ \r
+ if (strlen(Cmd)<3) {\r
+ PrintAndLog("Usage: hf mf uwrbl <block number> <block data (8 hex symbols)>");\r
+ PrintAndLog(" sample: hf mf uwrbl 0 01020304");\r
+ return 0;\r
+ } \r
+\r
+ blockNo = param_get8(Cmd, 0);\r
+ if (param_gethex(Cmd, 1, bldata, 8)) {\r
+ PrintAndLog("Block data must include 8 HEX symbols");\r
+ return 1;\r
+ }\r
+\r
+ switch(blockNo)\r
+ {\r
+ case 0:\r
+ PrintAndLog("Access Denied");\r
+ break;\r
+ case 1:\r
+ PrintAndLog("Access Denied");\r
+ break;\r
+ case 2:\r
+ PrintAndLog("--specialblock no:%02x", blockNo);\r
+ PrintAndLog("--data: %s", sprint_hex(bldata, 4));\r
+ UsbCommand c = {CMD_MIFAREU_WRITEBL, {blockNo}};\r
+ memcpy(c.d.asBytes, bldata, 4);\r
+ SendCommand(&c);\r
+\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ uint8_t isOK = resp.arg[0] & 0xff;\r
+ PrintAndLog("isOk:%02x", isOK);\r
+ } else {\r
+ PrintAndLog("Command execute timeout");\r
+ }\r
+ break;\r
+ case 3:\r
+ PrintAndLog("--specialblock no:%02x", blockNo);\r
+ PrintAndLog("--data: %s", sprint_hex(bldata, 4));\r
+ UsbCommand d = {CMD_MIFAREU_WRITEBL, {blockNo}};\r
+ memcpy(d.d.asBytes,bldata, 4);\r
+ SendCommand(&d);\r
+\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ uint8_t isOK = resp.arg[0] & 0xff;\r
+ PrintAndLog("isOk:%02x", isOK);\r
+ } else {\r
+ PrintAndLog("Command execute timeout");\r
+ }\r
+ break;\r
+ default: \r
+ PrintAndLog("--block no:%02x", blockNo);\r
+ PrintAndLog("--data: %s", sprint_hex(bldata, 4)); \r
+ //UsbCommand e = {CMD_MIFAREU_WRITEBL_COMPAT, {blockNo}};\r
+ //memcpy(e.d.asBytes,bldata, 16);\r
+ UsbCommand e = {CMD_MIFAREU_WRITEBL, {blockNo}};\r
+ memcpy(e.d.asBytes,bldata, 4);\r
+ SendCommand(&e);\r
+\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ uint8_t isOK = resp.arg[0] & 0xff;\r
+ PrintAndLog("isOk:%02x", isOK);\r
+ } else {\r
+ PrintAndLog("Command execute timeout");\r
+ }\r
+ break;\r
+ }\r
+ return 0;\r
+}\r
+\r
+int CmdHF14AMfRdBl(const char *Cmd)\r
+{\r
+ uint8_t blockNo = 0;\r
uint8_t keyType = 0;\r
uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r
\r
PrintAndLog("Command execute timeout");\r
}\r
\r
- return 0;
-}
-
-int CmdHF14AMfURdBl(const char *Cmd)
-{
- uint8_t blockNo = 0;
-
- if (strlen(Cmd)<1) {
- PrintAndLog("Usage: hf mf urdbl <block number>");
- PrintAndLog(" sample: hf mf urdbl 0");
- return 0;
- }
-
- blockNo = param_get8(Cmd, 0);
- PrintAndLog("--block no:%02x", blockNo);
-
- UsbCommand c = {CMD_MIFAREU_READBL, {blockNo}};
- SendCommand(&c);
-
- UsbCommand resp;
- if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
- uint8_t isOK = resp.arg[0] & 0xff;
- uint8_t * data = resp.d.asBytes;
-
- if (isOK)
- PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
- else
- PrintAndLog("isOk:%02x", isOK);
- } else {
- PrintAndLog("Command execute timeout");
- }
-
- return 0;
-}
-
-int CmdHF14AMfURdCard(const char *Cmd)
-{
- int i;
- uint8_t sectorNo = 0;
- uint8_t *lockbytes_t=NULL;
- uint8_t lockbytes[2]={0,0};
- bool bit[16]={0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
-
- uint8_t isOK = 0;
- uint8_t * data = NULL;
-
- if (sectorNo > 15) {
- PrintAndLog("Sector number must be less than 16");
- return 1;
- }
- PrintAndLog("Attempting to Read Ultralight... ");
-
- UsbCommand c = {CMD_MIFAREU_READCARD, {sectorNo}};
- SendCommand(&c);
-
- UsbCommand resp;
- if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
- isOK = resp.arg[0] & 0xff;
- data = resp.d.asBytes;
-
- PrintAndLog("isOk:%02x", isOK);
- if (isOK)
- for (i = 0; i < 16; i++) {
- switch(i){
- case 2:
- //process lock bytes
- lockbytes_t=data+(i*4);
- lockbytes[0]=lockbytes_t[2];
- lockbytes[1]=lockbytes_t[3];
- for(int j=0; j<16; j++){
- bit[j]=lockbytes[j/8] & ( 1 <<(7-j%8));
- }
- //PrintAndLog("LB %02x %02x", lockbytes[0],lockbytes[1]);
- //PrintAndLog("LB2b %02x %02x %02x %02x %02x %02x %02x %02x",bit[8],bit[9],bit[10],bit[11],bit[12],bit[13],bit[14],bit[15]);
- PrintAndLog("Block %02x:%s ", i,sprint_hex(data + i * 4, 4));
- break;
- case 3:
- PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[4]);
- break;
- case 4:
- PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[3]);
- break;
- case 5:
- PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[2]);
- break;
- case 6:
- PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[1]);
- break;
- case 7:
- PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[0]);
- break;
- case 8:
- PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[15]);
- break;
- case 9:
- PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[14]);
- break;
- case 10:
- PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[13]);
- break;
- case 11:
- PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[12]);
- break;
- case 12:
- PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[11]);
- break;
- case 13:
- PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[10]);
- break;
- case 14:
- PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[9]);
- break;
- case 15:
- PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[8]);
- break;
- default:
- PrintAndLog("Block %02x:%s ", i,sprint_hex(data + i * 4, 4));
- break;
- }
- }
- } else {
- PrintAndLog("Command1 execute timeout");
- }
- return 0;
-}
-
-int CmdHF14AMfRdSc(const char *Cmd)
-{
- int i;
+ return 0;\r
+}\r
+\r
+int CmdHF14AMfURdBl(const char *Cmd)\r
+{\r
+ uint8_t blockNo = 0;\r
+\r
+ if (strlen(Cmd)<1) {\r
+ PrintAndLog("Usage: hf mf urdbl <block number>");\r
+ PrintAndLog(" sample: hf mf urdbl 0");\r
+ return 0;\r
+ } \r
+ \r
+ blockNo = param_get8(Cmd, 0);\r
+ PrintAndLog("--block no:%02x", blockNo);\r
+ \r
+ UsbCommand c = {CMD_MIFAREU_READBL, {blockNo}};\r
+ SendCommand(&c);\r
+\r
+ UsbCommand resp;\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ uint8_t isOK = resp.arg[0] & 0xff;\r
+ uint8_t * data = resp.d.asBytes;\r
+\r
+ if (isOK)\r
+ PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));\r
+ else\r
+ PrintAndLog("isOk:%02x", isOK);\r
+ } else {\r
+ PrintAndLog("Command execute timeout");\r
+ }\r
+\r
+ return 0;\r
+}\r
+\r
+int CmdHF14AMfURdCard(const char *Cmd)\r
+{\r
+ int i;\r
+ uint8_t sectorNo = 0;\r
+ uint8_t *lockbytes_t=NULL;\r
+ uint8_t lockbytes[2]={0,0};\r
+ bool bit[16]={0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};\r
+ \r
+ uint8_t isOK = 0;\r
+ uint8_t * data = NULL;\r
+\r
+ if (sectorNo > 15) {\r
+ PrintAndLog("Sector number must be less than 16");\r
+ return 1;\r
+ }\r
+ PrintAndLog("Attempting to Read Ultralight... ");\r
+ \r
+ UsbCommand c = {CMD_MIFAREU_READCARD, {sectorNo}};\r
+ SendCommand(&c);\r
+\r
+ UsbCommand resp;\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ isOK = resp.arg[0] & 0xff;\r
+ data = resp.d.asBytes;\r
+\r
+ PrintAndLog("isOk:%02x", isOK);\r
+ if (isOK) \r
+ for (i = 0; i < 16; i++) {\r
+ switch(i){\r
+ case 2:\r
+ //process lock bytes\r
+ lockbytes_t=data+(i*4);\r
+ lockbytes[0]=lockbytes_t[2];\r
+ lockbytes[1]=lockbytes_t[3];\r
+ for(int j=0; j<16; j++){\r
+ bit[j]=lockbytes[j/8] & ( 1 <<(7-j%8));\r
+ }\r
+ //PrintAndLog("LB %02x %02x", lockbytes[0],lockbytes[1]);\r
+ //PrintAndLog("LB2b %02x %02x %02x %02x %02x %02x %02x %02x",bit[8],bit[9],bit[10],bit[11],bit[12],bit[13],bit[14],bit[15]); \r
+ PrintAndLog("Block %02x:%s ", i,sprint_hex(data + i * 4, 4));\r
+ break;\r
+ case 3: \r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[4]);\r
+ break;\r
+ case 4:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[3]);\r
+ break;\r
+ case 5:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[2]);\r
+ break;\r
+ case 6:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[1]);\r
+ break;\r
+ case 7:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[0]);\r
+ break;\r
+ case 8:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[15]);\r
+ break;\r
+ case 9:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[14]);\r
+ break;\r
+ case 10:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[13]);\r
+ break;\r
+ case 11:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[12]);\r
+ break;\r
+ case 12:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[11]);\r
+ break;\r
+ case 13:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[10]);\r
+ break;\r
+ case 14:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[9]);\r
+ break;\r
+ case 15:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[8]);\r
+ break;\r
+ default:\r
+ PrintAndLog("Block %02x:%s ", i,sprint_hex(data + i * 4, 4));\r
+ break;\r
+ }\r
+ }\r
+ } else {\r
+ PrintAndLog("Command1 execute timeout");\r
+ }\r
+ return 0;\r
+}\r
+\r
+int CmdHF14AMfRdSc(const char *Cmd)\r
+{\r
+ int i;\r
uint8_t sectorNo = 0;\r
uint8_t keyType = 0;\r
uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r
\r
int CmdHF14AMf1kSim(const char *Cmd)\r
{\r
- uint8_t uid[4] = {0, 0, 0, 0};\r
- \r
+ uint8_t uid[7] = {0, 0, 0, 0,0,0,0};\r
+ uint8_t exitAfterNReads = 0;\r
+ uint8_t flags = 0;\r
+\r
if (param_getchar(Cmd, 0) == 'h') {\r
- PrintAndLog("Usage: hf mf sim <uid (8 hex symbols)>");\r
+ PrintAndLog("Usage: hf mf sim u <uid (8 hex symbols)> n <numreads> i x");\r
+ PrintAndLog(" u (Optional) UID. If not specified, the UID from emulator memory will be used");\r
+ PrintAndLog(" n (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");\r
+ PrintAndLog(" i (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");\r
+ PrintAndLog(" x (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r
PrintAndLog(" sample: hf mf sim 0a0a0a0a ");\r
return 0;\r
- } \r
- \r
- if (param_getchar(Cmd, 0) && param_gethex(Cmd, 0, uid, 8)) {\r
- PrintAndLog("UID must include 8 HEX symbols");\r
- return 1;\r
}\r
- PrintAndLog(" uid:%s ", sprint_hex(uid, 4));\r
- \r
- UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {0, 0, 0}};\r
- memcpy(c.d.asBytes, uid, 4);\r
+ uint8_t pnr = 0;\r
+ if (param_getchar(Cmd, pnr) == 'u') {\r
+ if(param_gethex(Cmd, pnr+1, uid, 8) == 0)\r
+ {\r
+ flags |=FLAG_4B_UID_IN_DATA; // UID from packet\r
+ }else if(param_gethex(Cmd,pnr+1,uid,14) == 0)\r
+ {\r
+ flags |= FLAG_7B_UID_IN_DATA;// UID from packet\r
+ }else\r
+ {\r
+ PrintAndLog("UID, if specified, must include 8 or 14 HEX symbols");\r
+ return 1;\r
+ }\r
+ pnr +=2;\r
+ }\r
+ if (param_getchar(Cmd, pnr) == 'n') {\r
+ exitAfterNReads = param_get8(Cmd,pnr+1);\r
+ pnr += 2;\r
+ }\r
+ if (param_getchar(Cmd, pnr) == 'i' ) {\r
+ //Using a flag to signal interactiveness, least significant bit\r
+ flags |= FLAG_INTERACTIVE;\r
+ pnr++;\r
+ }\r
+\r
+ if (param_getchar(Cmd, pnr) == 'x' ) {\r
+ //Using a flag to signal interactiveness, least significant bit\r
+ flags |= FLAG_NR_AR_ATTACK;\r
+ }\r
+ PrintAndLog(" uid:%s, numreads:%d, flags:%d (0x%02x) ",\r
+ flags & FLAG_4B_UID_IN_DATA ? sprint_hex(uid,4):\r
+ flags & FLAG_7B_UID_IN_DATA ? sprint_hex(uid,7): "N/A"\r
+ , exitAfterNReads, flags,flags);\r
+\r
+\r
+ UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};\r
+ memcpy(c.d.asBytes, uid, sizeof(uid));\r
SendCommand(&c);\r
\r
+ if(flags & 1)\r
+ {\r
+ UsbCommand resp;\r
+ PrintAndLog("Press pm3-button to abort simulation");\r
+ while(! WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ //We're waiting only 1.5 s at a time, otherwise we get the\r
+ // annoying message about "Waiting for a response... "\r
+ }\r
+ }\r
+\r
return 0;\r
}\r
\r
while(!feof(f)){\r
memset(buf, 0, sizeof(buf));\r
if (fgets(buf, sizeof(buf), f) == NULL) {\r
- PrintAndLog("File reading error.");\r
+ if(blockNum == 16 * 4)\r
+ {\r
+ break;\r
+ }\r
+ PrintAndLog("File reading error.");\r
return 2;\r
}\r
\r
PrintAndLog("File content error. There must be 64 blocks");\r
return 4;\r
}\r
- PrintAndLog("Loaded from file: %s", filename);\r
+ PrintAndLog("Loaded %d blocks from file: %s", blockNum, filename);\r
return 0;\r
}\r
\r
\r
static command_t CommandTable[] =\r
{\r
- {"help", CmdHelp, 1, "This help"},
- {"dbg", CmdHF14AMfDbg, 0, "Set default debug mode"},
- {"rdbl", CmdHF14AMfRdBl, 0, "Read MIFARE classic block"},
- {"urdbl", CmdHF14AMfURdBl, 0, "Read MIFARE Ultralight block"},
- {"urdcard", CmdHF14AMfURdCard, 0,"Read MIFARE Ultralight Card"},
- {"uwrbl", CmdHF14AMfUWrBl, 0,"Write MIFARE Ultralight block"},
- {"rdsc", CmdHF14AMfRdSc, 0, "Read MIFARE classic sector"},
- {"dump", CmdHF14AMfDump, 0, "Dump MIFARE classic tag to binary file"},
- {"restore", CmdHF14AMfRestore, 0, "Restore MIFARE classic binary file to BLANK tag"},
+ {"help", CmdHelp, 1, "This help"},\r
+ {"dbg", CmdHF14AMfDbg, 0, "Set default debug mode"},\r
+ {"rdbl", CmdHF14AMfRdBl, 0, "Read MIFARE classic block"},\r
+ {"urdbl", CmdHF14AMfURdBl, 0, "Read MIFARE Ultralight block"},\r
+ {"urdcard", CmdHF14AMfURdCard, 0,"Read MIFARE Ultralight Card"},\r
+ {"uwrbl", CmdHF14AMfUWrBl, 0,"Write MIFARE Ultralight block"},\r
+ {"rdsc", CmdHF14AMfRdSc, 0, "Read MIFARE classic sector"},\r
+ {"dump", CmdHF14AMfDump, 0, "Dump MIFARE classic tag to binary file"},\r
+ {"restore", CmdHF14AMfRestore, 0, "Restore MIFARE classic binary file to BLANK tag"},\r
{"wrbl", CmdHF14AMfWrBl, 0, "Write MIFARE classic block"},\r
{"chk", CmdHF14AMfChk, 0, "Test block keys"},\r
{"mifare", CmdHF14AMifare, 0, "Read parity error messages. param - <used card nonce>"},\r
projects / proxmark3-svn / blobdiff