From e0c635d19c58423d88ae698788a31c865e5554ab Mon Sep 17 00:00:00 2001 From: "Merlokbr@gmail.com" Date: Tue, 17 Jul 2012 11:28:12 +0000 Subject: [PATCH] `hf mf sniff` - working with emulator files --- client/cmdhfmf.c | 12 +++--- client/mifarehost.c | 96 +++++++++++++++++++++++++++++++++++++++++---- client/mifarehost.h | 13 +++++- client/util.c | 6 +-- client/util.h | 2 +- 5 files changed, 108 insertions(+), 21 deletions(-) diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index 6abfdda2..c27ba56c 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -1543,8 +1543,8 @@ int CmdHF14AMfCSave(const char *Cmd) { int CmdHF14AMfSniff(const char *Cmd){ // params - bool wantLogToFile = 0; - bool wantDecrypt = 0; + bool wantLogToFile = 1; + bool wantDecrypt = 1; bool wantSaveToEml = 0; bool wantSaveToEmlFile = 0; @@ -1568,7 +1568,7 @@ int CmdHF14AMfSniff(const char *Cmd){ PrintAndLog(" l - save encrypted sequence to logfile `uid.log`"); PrintAndLog(" d - decrypt sequence and put it to log file `uid.log`"); PrintAndLog(" n/a e - decrypt sequence, collect read and write commands and save the result of the sequence to emulator memory"); - PrintAndLog(" n/a r - decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`"); + PrintAndLog(" r - decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`"); PrintAndLog("Usage: hf mf sniff [l][d][e][r]"); PrintAndLog(" sample: hf mf sniff l d e"); return 0; @@ -1635,14 +1635,14 @@ int CmdHF14AMfSniff(const char *Cmd){ PrintAndLog("tag select uid:%s atqa:%02x %02x sak:0x%02x", sprint_hex(uid, 7), atqa[0], atqa[1], sak); if (wantLogToFile) { - FillFileNameByUID(logHexFileName, uid, ".log"); + FillFileNameByUID(logHexFileName, uid, ".log", 7); AddLogCurrentDT(logHexFileName); } - if (wantDecrypt) mfTraceInit(uid, atqa, sak); + if (wantDecrypt) mfTraceInit(uid, atqa, sak, wantSaveToEmlFile); } else { PrintAndLog("%s(%d):%s", isTag ? "TAG":"RDR", num, sprint_hex(bufPtr, len)); if (wantLogToFile) AddLogHex(logHexFileName, isTag ? "TAG: ":"RDR: ", bufPtr, len); - if (wantDecrypt) mfTraceDecode(bufPtr, len); + if (wantDecrypt) mfTraceDecode(bufPtr, len, wantSaveToEmlFile); } bufPtr += len; num++; diff --git a/client/mifarehost.c b/client/mifarehost.c index cfcc17ba..fc29e10e 100644 --- a/client/mifarehost.c +++ b/client/mifarehost.c @@ -275,9 +275,13 @@ int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params) { // SNIFFER +// constants +static uint8_t trailerAccessBytes[4] = {0x08, 0x77, 0x8F, 0x00}; + // variables char logHexFileName[200] = {0x00}; -static uint8_t traceCard[4096]; +static uint8_t traceCard[4096] = {0x00}; +static char traceFileName[20]; static int traceState = TRACE_IDLE; static uint8_t traceCurBlock = 0; static uint8_t traceCurKey = 0; @@ -295,13 +299,79 @@ uint32_t nr_enc; // encrypted reader challenge uint32_t ar_enc; // encrypted reader response uint32_t at_enc; // encrypted tag response -int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak) { +int isTraceCardEmpty(void) { + return ((traceCard[0] == 0) && (traceCard[1] == 0) && (traceCard[2] == 0) && (traceCard[3] == 0)); +} - if (traceCrypto1) crypto1_destroy(traceCrypto1); - traceCrypto1 = NULL; +int isBlockEmpty(int blockN) { + for (int i = 0; i < 16; i++) + if (traceCard[blockN * 16 + i] != 0) return 0; + return 1; +} + +int isBlockTrailer(int blockN) { + return ((blockN & 0x03) == 0x03); +} + +int loadTraceCard(uint8_t *tuid) { + FILE * f; + char buf[64]; + uint8_t buf8[64]; + int i, blockNum; + + if (!isTraceCardEmpty()) saveTraceCard(); memset(traceCard, 0x00, 4096); memcpy(traceCard, tuid + 3, 4); + FillFileNameByUID(traceFileName, tuid, ".eml", 7); + + f = fopen(traceFileName, "r"); + if (!f) return 1; + + blockNum = 0; + while(!feof(f)){ + memset(buf, 0, sizeof(buf)); + fgets(buf, sizeof(buf), f); + + if (strlen(buf) < 32){ + if (feof(f)) break; + PrintAndLog("File content error. Block data must include 32 HEX symbols"); + return 2; + } + for (i = 0; i < 32; i += 2) + sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]); + + memcpy(traceCard + blockNum * 16, buf8, 16); + + blockNum++; + } + fclose(f); + + return 0; +} + +int saveTraceCard(void) { + FILE * f; + + if ((!strlen(traceFileName)) || (isTraceCardEmpty())) return 0; + + f = fopen(traceFileName, "w+"); + for (int i = 0; i < 64; i++) { // blocks + for (int j = 0; j < 16; j++) // bytes + fprintf(f, "%02x", *(traceCard + i * 16 + j)); + fprintf(f,"\n"); + } + fclose(f); + + return 0; +} + +int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile) { + + if (traceCrypto1) crypto1_destroy(traceCrypto1); + traceCrypto1 = NULL; + + if (wantSaveToEmlFile) loadTraceCard(tuid); traceCard[4] = traceCard[0] ^ traceCard[1] ^ traceCard[2] ^ traceCard[3]; traceCard[5] = sak; memcpy(&traceCard[6], atqa, 2); @@ -331,7 +401,7 @@ void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len, bool i } -int mfTraceDecode(uint8_t *data_src, int len) { +int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) { uint8_t data[64]; if (traceState == TRACE_ERROR) return 1; @@ -386,7 +456,12 @@ int mfTraceDecode(uint8_t *data_src, int len) { if (len == 18) { traceState = TRACE_IDLE; - memcpy(traceCard + traceCurBlock * 16, data, 16); + if (isBlockTrailer(traceCurBlock)) { + memcpy(traceCard + traceCurBlock * 16 + 6, data + 6, 4); + } else { + memcpy(traceCard + traceCurBlock * 16, data, 16); + } + if (wantSaveToEmlFile) saveTraceCard(); return 0; } else { traceState = TRACE_ERROR; @@ -410,6 +485,7 @@ int mfTraceDecode(uint8_t *data_src, int len) { traceState = TRACE_IDLE; memcpy(traceCard + traceCurBlock * 16, data, 16); + if (wantSaveToEmlFile) saveTraceCard(); return 0; } else { traceState = TRACE_ERROR; @@ -470,11 +546,15 @@ int mfTraceDecode(uint8_t *data_src, int len) { printf("key> %x%x\n", (unsigned int)((lfsr & 0xFFFFFFFF00000000) >> 32), (unsigned int)(lfsr & 0xFFFFFFFF)); AddLogUint64(logHexFileName, "key> ", lfsr); + int blockShift = ((traceCurBlock & 0xFC) + 3) * 16; + if (isBlockEmpty((traceCurBlock & 0xFC) + 3)) memcpy(traceCard + blockShift + 6, trailerAccessBytes, 4); + if (traceCurKey) { - num_to_bytes(lfsr, 6, traceCard + traceCurBlock * 16 + 10); + num_to_bytes(lfsr, 6, traceCard + blockShift + 10); } else { - num_to_bytes(lfsr, 6, traceCard + traceCurBlock * 16); + num_to_bytes(lfsr, 6, traceCard + blockShift); } + if (wantSaveToEmlFile) saveTraceCard(); if (traceCrypto1) { crypto1_destroy(traceCrypto1); diff --git a/client/mifarehost.h b/client/mifarehost.h index 4d382409..64fc9339 100644 --- a/client/mifarehost.h +++ b/client/mifarehost.h @@ -63,10 +63,19 @@ extern char logHexFileName[200]; int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t * ResultKeys); int mfCheckKeys (uint8_t blockNo, uint8_t keyType, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key); + int mfEmlGetMem(uint8_t *data, int blockNum, int blocksCount); int mfEmlSetMem(uint8_t *data, int blockNum, int blocksCount); + int mfCSetUID(uint8_t *uid, uint8_t *oldUID, int wantWipe); int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, int wantWipe, uint8_t params); int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params); -int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak); -int mfTraceDecode(uint8_t *data_src, int len); + +int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile); +int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile); + +int isTraceCardEmpty(void); +int isBlockEmpty(int blockN); +int isBlockTrailer(int blockN); +int loadTraceCard(uint8_t *tuid); +int saveTraceCard(void); diff --git a/client/util.c b/client/util.c index 8a62e361..0673f181 100644 --- a/client/util.c +++ b/client/util.c @@ -80,15 +80,13 @@ void AddLogCurrentDT(char *fileName) { AddLogLine(fileName, "\nanticollision: ", buff); } -void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext) { +void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext, int byteCount) { char * fnameptr = fileName; memset(fileName, 0x00, 200); - for (int j = 0; j < 7; j++, fnameptr += 2) + for (int j = 0; j < byteCount; j++, fnameptr += 2) sprintf(fnameptr, "%02x", uid[j]); sprintf(fnameptr, "%s", ext); - - printf("fname:%s", fileName); } // printing and converting functions diff --git a/client/util.h b/client/util.h index cec187cf..22e83471 100644 --- a/client/util.h +++ b/client/util.h @@ -22,7 +22,7 @@ void AddLogLine(char *fileName, char *extData, char *c); void AddLogHex(char *fileName, char *extData, const uint8_t * data, const size_t len); void AddLogUint64(char *fileName, char *extData, const uint64_t data); void AddLogCurrentDT(char *fileName); -void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext); +void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext, int byteCount); void print_hex(const uint8_t * data, const size_t len); char * sprint_hex(const uint8_t * data, const size_t len); -- 2.39.2