X-Git-Url: http://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/73ab92d14c8d80f1313f54d9a9b939cd9452b91b..76ef5273d84d043288e22c91d941558e75fcb793:/client/cmdhfmf.c

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 07d2ab26..9f337a5b 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -1017,11 +1017,10 @@ int CmdHF14AMfChk(const char *Cmd)
 }
 
 void readerAttack(nonces_t ar_resp[], bool setEmulatorMem) {
-	#define ATTACK_KEY_COUNT 8
+	#define ATTACK_KEY_COUNT 8 // keep same as define in iso14443a.c -> Mifare1ksim()
 	uint64_t key = 0;
 	typedef struct {
 			uint64_t keyA;
-			uint32_t security;
 			uint64_t keyB;
 	} st_t;
 	st_t sector_trailer[ATTACK_KEY_COUNT];
@@ -1034,9 +1033,9 @@ void readerAttack(nonces_t ar_resp[], bool setEmulatorMem) {
 
 	for (uint8_t i = 0; i<ATTACK_KEY_COUNT; i++) {
 		if (ar_resp[i].ar2 > 0) {
-			//PrintAndLog("Trying sector %d, cuid %08x, nt %08x, ar %08x, nr %08x, ar2 %08x, nr2 %08x",ar_resp[i].sector, ar_resp[i].cuid,ar_resp[i].nonce,ar_resp[i].ar,ar_resp[i].nr,ar_resp[i].ar2,ar_resp[i].nr2);
+			//PrintAndLog("DEBUG: Trying sector %d, cuid %08x, nt %08x, ar %08x, nr %08x, ar2 %08x, nr2 %08x",ar_resp[i].sector, ar_resp[i].cuid,ar_resp[i].nonce,ar_resp[i].ar,ar_resp[i].nr,ar_resp[i].ar2,ar_resp[i].nr2);
 			if (mfkey32(ar_resp[i], &key)) {
-				PrintAndLog("Found Key%s for sector %02d: [%04x%08x]", (ar_resp[i].keytype) ? "B" : "A", ar_resp[i].sector, (uint32_t) (key>>32), (uint32_t) (key &0xFFFFFFFF));
+				PrintAndLog("  Found Key%s for sector %02d: [%04x%08x]", (ar_resp[i].keytype) ? "B" : "A", ar_resp[i].sector, (uint32_t) (key>>32), (uint32_t) (key &0xFFFFFFFF));
 
 				for (uint8_t ii = 0; ii<ATTACK_KEY_COUNT; ii++) {
 					if (key_cnt[ii]==0 || stSector[ii]==ar_resp[i].sector) {
@@ -1062,7 +1061,6 @@ void readerAttack(nonces_t ar_resp[], bool setEmulatorMem) {
 	if (setEmulatorMem) {
 		for (uint8_t i = 0; i<ATTACK_KEY_COUNT; i++) {
 			if (key_cnt[i]>0) {
-				//PrintAndLog	("block %d, keyA:%04x%08x, keyb:%04x%08x",stSector[i]*4+3, (uint32_t) (sector_trailer[i].keyA>>32), (uint32_t) (sector_trailer[i].keyA &0xFFFFFFFF),(uint32_t) (sector_trailer[i].keyB>>32), (uint32_t) (sector_trailer[i].keyB &0xFFFFFFFF));
 				uint8_t	memBlock[16];
 				memset(memBlock, 0x00, sizeof(memBlock));
 				char cmd1[36];
@@ -1092,19 +1090,22 @@ void readerAttack(nonces_t ar_resp[], bool setEmulatorMem) {
 }
 
 int usage_hf14_mf1ksim(void) {
-	PrintAndLog("Usage:  hf mf sim  [h] u <uid (8,14 hex symbols)> n <numreads> i x");
+	PrintAndLog("Usage:  hf mf sim h u <uid (8, 14, or 20 hex symbols)> n <numreads> i x");
 	PrintAndLog("options:");
 	PrintAndLog("      h    this help");
-	PrintAndLog("      u    (Optional) UID 4,7 bytes. If not specified, the UID 4b from emulator memory will be used");
+	PrintAndLog("      u    (Optional) UID 4,7 or 10 bytes. If not specified, the UID 4B from emulator memory will be used");
 	PrintAndLog("      n    (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");
 	PrintAndLog("      i    (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");
 	PrintAndLog("      x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");
-	PrintAndLog("      e    (Optional) set keys found from 'reader attack' to emulator memory");
+	PrintAndLog("      e    (Optional) set keys found from 'reader attack' to emulator memory (implies x and i)");
 	PrintAndLog("      f    (Optional) get UIDs to use for 'reader attack' from file 'f <filename.txt>' (implies x and i)");
 	PrintAndLog("samples:");
 	PrintAndLog("           hf mf sim u 0a0a0a0a");
 	PrintAndLog("           hf mf sim u 11223344556677");
-	PrintAndLog("           hf mf sim u 112233445566778899AA");	
+	PrintAndLog("           hf mf sim u 112233445566778899AA");
+	PrintAndLog("           hf mf sim f uids.txt");
+	PrintAndLog("           hf mf sim u 0a0a0a0a e");
+		
 	return 0;
 }
 
@@ -1132,6 +1133,9 @@ int CmdHF14AMf1kSim(const char *Cmd) {
 		case 'e':
 		case 'E':
 			setEmulatorMem = true;
+			//implies x and i
+			flags |= FLAG_INTERACTIVE;
+			flags |= FLAG_NR_AR_ATTACK;
 			cmdp++;
 			break;
 		case 'f':
@@ -1142,7 +1146,10 @@ int CmdHF14AMf1kSim(const char *Cmd) {
 				return 0;
 			}
 			attackFromFile = true;
-			cmdp+=2;
+			//implies x and i
+			flags |= FLAG_INTERACTIVE;
+			flags |= FLAG_NR_AR_ATTACK;
+			cmdp += 2;
 			break;
 		case 'h':
 		case 'H':
@@ -1166,7 +1173,7 @@ int CmdHF14AMf1kSim(const char *Cmd) {
 				case  8: flags = FLAG_4B_UID_IN_DATA; break;
 				default: return usage_hf14_mf1ksim();
 			}
-			cmdp +=2;
+			cmdp += 2;
 			break;
 		case 'x':
 		case 'X':
@@ -1183,9 +1190,6 @@ int CmdHF14AMf1kSim(const char *Cmd) {
 	//Validations
 	if(errors) return usage_hf14_mf1ksim();
 
-	// attack from file implies nr ar attack and interactive...
-	if (!(flags & FLAG_NR_AR_ATTACK) && attackFromFile) flags |= FLAG_NR_AR_ATTACK | FLAG_INTERACTIVE;
-	
 	//get uid from file
 	if (attackFromFile) {
 		int count = 0;
@@ -1243,7 +1247,7 @@ int CmdHF14AMf1kSim(const char *Cmd) {
 			nonces_t ar_resp[ATTACK_KEY_COUNT*2];
 			memcpy(ar_resp, resp.d.asBytes, sizeof(ar_resp));
 			readerAttack(ar_resp, setEmulatorMem);
-			if (resp.arg[1]) {
+			if ((bool)resp.arg[1]) {
 				PrintAndLog("Device button pressed - quitting");
 				fclose(f);
 				return 4;
@@ -1251,7 +1255,7 @@ int CmdHF14AMf1kSim(const char *Cmd) {
 			count++;
 		}
 		fclose(f);
-	} else {
+	} else { //not from file
 
 		PrintAndLog("mf 1k sim uid: %s, numreads:%d, flags:%d (0x%02x) ",
 				flags & FLAG_4B_UID_IN_DATA ? sprint_hex(uid,4):