X-Git-Url: http://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/baeaf57950c5f1434ec496b2f7c8ef8597a70e7d..6a1f2d82bb7d33cd49f9c191f36144ca10d5b629:/client/cmdhfmf.c diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index 7fbcad24..6d0bebd7 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -343,10 +343,6 @@ int CmdHF14AMfURdCard(const char *Cmd) uint8_t isOK = 0; uint8_t * data = NULL; - if (sectorNo > 15) { - PrintAndLog("Sector number must be less than 16"); - return 1; - } PrintAndLog("Attempting to Read Ultralight... "); UsbCommand c = {CMD_MIFAREU_READCARD, {sectorNo}}; @@ -359,64 +355,24 @@ int CmdHF14AMfURdCard(const char *Cmd) PrintAndLog("isOk:%02x", isOK); if (isOK) - for (i = 0; i < 16; i++) { - switch(i){ - case 2: - //process lock bytes - lockbytes_t=data+(i*4); - lockbytes[0]=lockbytes_t[2]; - lockbytes[1]=lockbytes_t[3]; - for(int j=0; j<16; j++){ - bit[j]=lockbytes[j/8] & ( 1 <<(7-j%8)); - } - //PrintAndLog("LB %02x %02x", lockbytes[0],lockbytes[1]); - //PrintAndLog("LB2b %02x %02x %02x %02x %02x %02x %02x %02x",bit[8],bit[9],bit[10],bit[11],bit[12],bit[13],bit[14],bit[15]); - PrintAndLog("Block %3d:%s ", i,sprint_hex(data + i * 4, 4)); - break; - case 3: - PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[4]); - break; - case 4: - PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[3]); - break; - case 5: - PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[2]); - break; - case 6: - PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[1]); - break; - case 7: - PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[0]); - break; - case 8: - PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[15]); - break; - case 9: - PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[14]); - break; - case 10: - PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[13]); - break; - case 11: - PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[12]); - break; - case 12: - PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[11]); - break; - case 13: - PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[10]); - break; - case 14: - PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[9]); - break; - case 15: - PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[8]); - break; - default: - PrintAndLog("Block %3d:%s ", i,sprint_hex(data + i * 4, 4)); - break; + { // bit 0 and 1 + PrintAndLog("Block %3d:%s ", 0,sprint_hex(data + 0 * 4, 4)); + PrintAndLog("Block %3d:%s ", 1,sprint_hex(data + 1 * 4, 4)); + // bit 2 + //process lock bytes + lockbytes_t=data+(2*4); + lockbytes[0]=lockbytes_t[2]; + lockbytes[1]=lockbytes_t[3]; + for(int j=0; j<16; j++){ + bit[j]=lockbytes[j/8] & ( 1 <<(7-j%8)); } - } + //remaining + for (i = 3; i < 16; i++) { + int bitnum = (23-i) % 16; + PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[bitnum]); + } + + } } else { PrintAndLog("Command execute timeout"); } @@ -509,6 +465,7 @@ int CmdHF14AMfDump(const char *Cmd) uint8_t keyA[40][6]; uint8_t keyB[40][6]; uint8_t rights[40][4]; + uint8_t carddata[256][16]; uint8_t numSectors = 16; FILE *fin; @@ -540,16 +497,12 @@ int CmdHF14AMfDump(const char *Cmd) return 1; } - if ((fout = fopen("dumpdata.bin","wb")) == NULL) { - PrintAndLog("Could not create file name dumpdata.bin"); - return 1; - } - // Read key file for (sectorNo=0; sectorNo>4) | ((data[8] & 0x1)<<1) | ((data[8] & 0x10)>>2); - rights[sectorNo][1] = ((data[7] & 0x20)>>5) | ((data[8] & 0x2)<<0) | ((data[8] & 0x20)>>3); - rights[sectorNo][2] = ((data[7] & 0x40)>>6) | ((data[8] & 0x4)>>1) | ((data[8] & 0x40)>>4); - rights[sectorNo][3] = ((data[7] & 0x80)>>7) | ((data[8] & 0x8)>>2) | ((data[8] & 0x80)>>5); + rights[sectorNo][0] = ((data[7] & 0x10)>>2) | ((data[8] & 0x1)<<1) | ((data[8] & 0x10)>>4); // C1C2C3 for data area 0 + rights[sectorNo][1] = ((data[7] & 0x20)>>3) | ((data[8] & 0x2)<<0) | ((data[8] & 0x20)>>5); // C1C2C3 for data area 1 + rights[sectorNo][2] = ((data[7] & 0x40)>>4) | ((data[8] & 0x4)>>1) | ((data[8] & 0x40)>>6); // C1C2C3 for data area 2 + rights[sectorNo][3] = ((data[7] & 0x80)>>5) | ((data[8] & 0x8)>>2) | ((data[8] & 0x80)>>7); // C1C2C3 for sector trailer } else { - PrintAndLog("Could not get access rights for sector %2d.", sectorNo); + PrintAndLog("Could not get access rights for sector %2d. Trying with defaults...", sectorNo); + rights[sectorNo][0] = rights[sectorNo][1] = rights[sectorNo][2] = 0x00; + rights[sectorNo][3] = 0x01; } } else { - PrintAndLog("Command execute timeout"); + PrintAndLog("Command execute timeout when trying to read access rights for sector %2d. Trying with defaults...", sectorNo); + rights[sectorNo][0] = rights[sectorNo][1] = rights[sectorNo][2] = 0x00; + rights[sectorNo][3] = 0x01; } } @@ -594,9 +552,9 @@ int CmdHF14AMfDump(const char *Cmd) PrintAndLog("|----- Dumping all blocks to file... -----|"); PrintAndLog("|-----------------------------------------|"); - - for (sectorNo = 0; sectorNo < numSectors; sectorNo++) { - for (blockNo = 0; blockNo < NumBlocksPerSector(sectorNo); blockNo++) { + bool isOK = true; + for (sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) { + for (blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) { bool received = false; if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. At least the Access Conditions can always be read with key A. UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}}; @@ -605,23 +563,24 @@ int CmdHF14AMfDump(const char *Cmd) received = WaitForResponseTimeout(CMD_ACK,&resp,1500); } else { // data block. Check if it can be read with key A or key B uint8_t data_area = sectorNo<32?blockNo:blockNo/5; - if ((rights[sectorNo][data_area] == 3) || (rights[sectorNo][data_area] == 5)) { // only key B would work + if ((rights[sectorNo][data_area] == 0x03) || (rights[sectorNo][data_area] == 0x05)) { // only key B would work UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 1, 0}}; memcpy(c.d.asBytes, keyB[sectorNo], 6); SendCommand(&c); received = WaitForResponseTimeout(CMD_ACK,&resp,1500); - } else if (rights[sectorNo][data_area] == 7) { // no key would work - PrintAndLog("Access rights do not allow reading of sector %2d block %3d", sectorNo, blockNo); + } else if (rights[sectorNo][data_area] == 0x07) { // no key would work + isOK = false; + PrintAndLog("Access rights do not allow reading of sector %2d block %3d", sectorNo, blockNo); } else { // key A would work - UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}}; - memcpy(c.d.asBytes, keyA[sectorNo], 6); - SendCommand(&c); - received = WaitForResponseTimeout(CMD_ACK,&resp,1500); + UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}}; + memcpy(c.d.asBytes, keyA[sectorNo], 6); + SendCommand(&c); + received = WaitForResponseTimeout(CMD_ACK,&resp,1500); } } if (received) { - uint8_t isOK = resp.arg[0] & 0xff; + isOK = resp.arg[0] & 0xff; uint8_t *data = resp.d.asBytes; if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. Fill in the keys. data[0] = (keyA[sectorNo][0]); @@ -638,21 +597,33 @@ int CmdHF14AMfDump(const char *Cmd) data[15] = (keyB[sectorNo][5]); } if (isOK) { - fwrite ( data, 1, 16, fout ); - PrintAndLog("Dumped block %2d of sector %2d into 'dumpdata.bin'"); + memcpy(carddata[FirstBlockOfSector(sectorNo) + blockNo], data, 16); + PrintAndLog("Successfully read block %2d of sector %2d.", blockNo, sectorNo); } else { PrintAndLog("Could not read block %2d of sector %2d", blockNo, sectorNo); + break; } } else { - PrintAndLog("Command execute timeout"); + isOK = false; + PrintAndLog("Command execute timeout when trying to read block %2d of sector %2d.", blockNo, sectorNo); + break; } } } - - fclose(fin); - fclose(fout); + + if (isOK) { + if ((fout = fopen("dumpdata.bin","wb")) == NULL) { + PrintAndLog("Could not create file name dumpdata.bin"); + return 1; + } + uint16_t numblocks = FirstBlockOfSector(numSectors - 1) + NumBlocksPerSector(numSectors - 1); + fwrite(carddata, 1, 16*numblocks, fout); + fclose(fout); + PrintAndLog("Dumped %d blocks (%d bytes) to file dumpdata.bin", numblocks, 16*numblocks); + } + return 0; } @@ -696,12 +667,15 @@ int CmdHF14AMfRestore(const char *Cmd) } if ((fkeys = fopen("dumpkeys.bin","rb")) == NULL) { PrintAndLog("Could not find file dumpkeys.bin"); + fclose(fdump); return 1; } for (sectorNo = 0; sectorNo < numSectors; sectorNo++) { if (fread(keyA[sectorNo], 1, 6, fkeys) == 0) { PrintAndLog("File reading error (dumpkeys.bin)."); + fclose(fdump); + fclose(fkeys); return 2; } } @@ -709,10 +683,13 @@ int CmdHF14AMfRestore(const char *Cmd) for (sectorNo = 0; sectorNo < numSectors; sectorNo++) { if (fread(keyB[sectorNo], 1, 6, fkeys) == 0) { PrintAndLog("File reading error (dumpkeys.bin)."); + fclose(fdump); + fclose(fkeys); return 2; } } - + fclose(fkeys); + PrintAndLog("Restoring dumpdata.bin to card"); for (sectorNo = 0; sectorNo < numSectors; sectorNo++) { @@ -722,6 +699,7 @@ int CmdHF14AMfRestore(const char *Cmd) if (fread(bldata, 1, 16, fdump) == 0) { PrintAndLog("File reading error (dumpdata.bin)."); + fclose(fdump); return 2; } @@ -756,7 +734,6 @@ int CmdHF14AMfRestore(const char *Cmd) } fclose(fdump); - fclose(fkeys); return 0; } @@ -792,9 +769,9 @@ int CmdHF14AMfNested(const char *Cmd) PrintAndLog("d - write keys to binary file"); PrintAndLog(" "); PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF "); - PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF t "); - PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF d "); - PrintAndLog(" sample2: hf mf nested o 0 A FFFFFFFFFFFF 4 A"); + PrintAndLog(" sample2: hf mf nested 1 0 A FFFFFFFFFFFF t "); + PrintAndLog(" sample3: hf mf nested 1 0 A FFFFFFFFFFFF d "); + PrintAndLog(" sample4: hf mf nested o 0 A FFFFFFFFFFFF 4 A"); return 0; } @@ -988,21 +965,18 @@ int CmdHF14AMfNested(const char *Cmd) } -static uint32_t get_trailer_block (uint32_t uiBlock) -{ - // Test if we are in the small or big sectors - uint32_t trailer_block = 0; - if (uiBlock < 128) { - trailer_block = uiBlock + (3 - (uiBlock % 4)); - } else { - trailer_block = uiBlock + (15 - (uiBlock % 16)); - } - return trailer_block; -} - - int CmdHF14AMfChk(const char *Cmd) { + if (strlen(Cmd)<3) { + PrintAndLog("Usage: hf mf chk |<*card memory> [t] [] []"); + PrintAndLog(" * - all sectors"); + PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, - 1K"); + PrintAndLog("d - write keys to binary file\n"); + PrintAndLog(" sample: hf mf chk 0 A 1234567890ab keys.dic"); + PrintAndLog(" hf mf chk *1 ? t"); + return 0; + } + FILE * f; char filename[256]={0}; char buf[13]; @@ -1020,6 +994,7 @@ int CmdHF14AMfChk(const char *Cmd) int transferToEml = 0; int createDumpFile = 0; + keyBlock = calloc(stKeyBlock, 6); if (keyBlock == NULL) return 1; @@ -1046,16 +1021,6 @@ int CmdHF14AMfChk(const char *Cmd) num_to_bytes(defaultKeys[defaultKeyCounter], 6, (uint8_t*)(keyBlock + defaultKeyCounter * 6)); } - if (strlen(Cmd)<3) { - PrintAndLog("Usage: hf mf chk |<*card memory> [t] [] []"); - PrintAndLog(" * - all sectors"); - PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, - 1K"); -// PrintAndLog("d - write keys to binary file\n"); - - PrintAndLog(" sample: hf mf chk 0 A 1234567890ab keys.dic"); - PrintAndLog(" hf mf chk *1 ? t"); - return 0; - } if (param_getchar(Cmd, 0)=='*') { blockNo = 3; @@ -1144,11 +1109,11 @@ int CmdHF14AMfChk(const char *Cmd) keycnt++; memset(buf, 0, sizeof(buf)); } + fclose(f); } else { PrintAndLog("File: %s: not found or locked.", filename); free(keyBlock); return 1; - fclose(f); } } } @@ -1157,14 +1122,26 @@ int CmdHF14AMfChk(const char *Cmd) PrintAndLog("No key specified, trying default keys"); for (;keycnt < defaultKeysSize; keycnt++) PrintAndLog("chk default key[%2d] %02x%02x%02x%02x%02x%02x", keycnt, - (keyBlock + 6*keycnt)[0],(keyBlock + 6*keycnt)[1], (keyBlock + 6*keycnt)[2], - (keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4], (keyBlock + 6*keycnt)[5], 6); + (keyBlock + 6*keycnt)[0],(keyBlock + 6*keycnt)[1], (keyBlock + 6*keycnt)[2], + (keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4], (keyBlock + 6*keycnt)[5], 6); + } + + // initialize storage for found keys + bool validKey[2][40]; + uint8_t foundKey[2][40][6]; + for (uint16_t t = 0; t < 2; t++) { + for (uint16_t sectorNo = 0; sectorNo < SectorsCnt; sectorNo++) { + validKey[t][sectorNo] = false; + for (uint16_t i = 0; i < 6; i++) { + foundKey[t][sectorNo][i] = 0xff; + } + } } for ( int t = !keyType; t < 2; keyType==2?(t++):(t=2) ) { int b=blockNo; for (int i = 0; i < SectorsCnt; ++i) { - PrintAndLog("--SectorsCnt:%2d, block no:%3d, key type:%C, key count:%2d ", i, b, t?'B':'A', keycnt); + PrintAndLog("--sector:%2d, block:%3d, key type:%C, key count:%2d ", i, b, t?'B':'A', keycnt); uint32_t max_keys = keycnt>USB_CMD_DATA_SIZE/6?USB_CMD_DATA_SIZE/6:keycnt; for (uint32_t c = 0; c < keycnt; c+=max_keys) { uint32_t size = keycnt-c>max_keys?max_keys:keycnt-c; @@ -1172,13 +1149,9 @@ int CmdHF14AMfChk(const char *Cmd) if (res != 1) { if (!res) { PrintAndLog("Found valid key:[%012"llx"]",key64); - if (transferToEml) { - uint8_t block[16]; - mfEmlGetMem(block, get_trailer_block(b), 1); - num_to_bytes(key64, 6, block + t*10); - mfEmlSetMem(block, get_trailer_block(b), 1); - } - } + num_to_bytes(key64, 6, foundKey[t][i]); + validKey[t][i] = true; + } } else { PrintAndLog("Command execute timeout"); } @@ -1186,42 +1159,43 @@ int CmdHF14AMfChk(const char *Cmd) b<127?(b+=4):(b+=16); } } - - free(keyBlock); -/* - // Create dump file + if (transferToEml) { + uint8_t block[16]; + for (uint16_t sectorNo = 0; sectorNo < SectorsCnt; sectorNo++) { + if (validKey[0][sectorNo] || validKey[1][sectorNo]) { + mfEmlGetMem(block, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1); + for (uint16_t t = 0; t < 2; t++) { + if (validKey[t][sectorNo]) { + memcpy(block + t*10, foundKey[t][sectorNo], 6); + } + } + mfEmlSetMem(block, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1); + } + } + PrintAndLog("Found keys have been transferred to the emulator memory"); + } + if (createDumpFile) { - if ((fkeys = fopen("dumpkeys.bin","wb")) == NULL) { + FILE *fkeys = fopen("dumpkeys.bin","wb"); + if (fkeys == NULL) { PrintAndLog("Could not create file dumpkeys.bin"); - free(e_sector); + free(keyBlock); return 1; } - PrintAndLog("Printing keys to binary file dumpkeys.bin..."); - for(i=0; i<16; i++) { - if (e_sector[i].foundKey[0]){ - num_to_bytes(e_sector[i].Key[0], 6, tempkey); - fwrite ( tempkey, 1, 6, fkeys ); - } - else{ - fwrite ( &standart, 1, 6, fkeys ); - } - } - for(i=0; i<16; i++) { - if (e_sector[i].foundKey[1]){ - num_to_bytes(e_sector[i].Key[1], 6, tempkey); - fwrite ( tempkey, 1, 6, fkeys ); - } - else{ - fwrite ( &standart, 1, 6, fkeys ); - } + for (uint16_t t = 0; t < 2; t++) { + fwrite(foundKey[t], 1, 6*SectorsCnt, fkeys); } fclose(fkeys); + PrintAndLog("Found keys have been dumped to file dumpkeys.bin. 0xffffffffffff has been inserted for unknown keys."); } -*/ - return 0; + + free(keyBlock); + + return 0; } + int CmdHF14AMf1kSim(const char *Cmd) { uint8_t uid[7] = {0, 0, 0, 0, 0, 0, 0}; @@ -1421,12 +1395,14 @@ int CmdHF14AMfELoad(const char *Cmd) break; } PrintAndLog("File reading error."); + fclose(f); return 2; } if (strlen(buf) < 32){ if(strlen(buf) && feof(f)) break; PrintAndLog("File content error. Block data must include 32 HEX symbols"); + fclose(f); return 2; } for (i = 0; i < 32; i += 2) { @@ -1435,6 +1411,7 @@ int CmdHF14AMfELoad(const char *Cmd) } if (mfEmlSetMem(buf8, blockNum, 1)) { PrintAndLog("Cant set emul block: %3d", blockNum); + fclose(f); return 3; } blockNum++; @@ -1577,8 +1554,8 @@ int CmdHF14AMfEKeyPrn(const char *Cmd) int CmdHF14AMfCSetUID(const char *Cmd) { uint8_t wipeCard = 0; - uint8_t uid[8]; - uint8_t oldUid[8]; + uint8_t uid[8] = {0}; + uint8_t oldUid[8]= {0}; int res; if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') { @@ -1917,7 +1894,6 @@ int CmdHF14AMfSniff(const char *Cmd){ uint8_t atqa[2]; uint8_t sak; bool isTag; - uint32_t parity; uint8_t buf[3000]; uint8_t * bufPtr = buf; memset(buf, 0x00, 3000); @@ -1984,14 +1960,17 @@ int CmdHF14AMfSniff(const char *Cmd){ printf(">\n"); PrintAndLog("received trace len: %d packages: %d", blockLen, pckNum); num = 0; - while (bufPtr - buf + 9 < blockLen) { - isTag = bufPtr[3] & 0x80 ? true:false; - bufPtr += 4; - parity = *((uint32_t *)(bufPtr)); - bufPtr += 4; - len = bufPtr[0]; - bufPtr++; - if ((len == 14) && (bufPtr[0] == 0xff) && (bufPtr[1] == 0xff)) { + while (bufPtr - buf < blockLen) { + bufPtr += 6; // ignore void timing information + len = *((uint16_t *)bufPtr); + if(len & 0x8000) { + isTag = true; + len &= 0x7fff; + } else { + isTag = false; + } + bufPtr += 2; + if ((len == 14) && (bufPtr[0] == 0xff) && (bufPtr[1] == 0xff) && (bufPtr[12] == 0xff) && (bufPtr[13] == 0xff)) { memcpy(uid, bufPtr + 2, 7); memcpy(atqa, bufPtr + 2 + 7, 2); uid_len = (atqa[0] & 0xC0) == 0x40 ? 7 : 4; @@ -2010,9 +1989,10 @@ int CmdHF14AMfSniff(const char *Cmd){ } else { PrintAndLog("%s(%d):%s", isTag ? "TAG":"RDR", num, sprint_hex(bufPtr, len)); if (wantLogToFile) AddLogHex(logHexFileName, isTag ? "TAG: ":"RDR: ", bufPtr, len); - if (wantDecrypt) mfTraceDecode(bufPtr, len, parity, wantSaveToEmlFile); + if (wantDecrypt) mfTraceDecode(bufPtr, len, wantSaveToEmlFile); } bufPtr += len; + bufPtr += ((len-1)/8+1); // ignore parity num++; } }