]>
Commit | Line | Data |
---|---|---|
9ca155ba | 1 | //-----------------------------------------------------------------------------\r |
b62a5a84 | 2 | // Copyright (C) 2011,2012 Merlok\r |
9ca155ba M |
3 | //\r |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or,\r | |
5 | // at your option, any later version. See the LICENSE.txt file for the text of\r | |
6 | // the license.\r | |
7 | //-----------------------------------------------------------------------------\r | |
8 | // High frequency MIFARE commands\r | |
9 | //-----------------------------------------------------------------------------\r | |
10 | \r | |
11 | #include "cmdhfmf.h"\r | |
c188b1b9 | 12 | #include "cmdhfmfhard.h"\r |
46cd801c | 13 | #include "nonce2key/nonce2key.h"\r |
9ca155ba M |
14 | \r |
15 | static int CmdHelp(const char *Cmd);\r | |
16 | \r | |
9ca155ba M |
17 | int CmdHF14AMifare(const char *Cmd)\r |
18 | {\r | |
19 | uint32_t uid = 0;\r | |
1c611bbd | 20 | uint32_t nt = 0, nr = 0;\r |
9ca155ba | 21 | uint64_t par_list = 0, ks_list = 0, r_key = 0;\r |
c830303d | 22 | int16_t isOK = 0;\r |
aea4d766 | 23 | \r |
1c611bbd | 24 | UsbCommand c = {CMD_READER_MIFARE, {true, 0, 0}};\r |
25 | \r | |
26 | // message\r | |
27 | printf("-------------------------------------------------------------------------\n");\r | |
28 | printf("Executing command. Expected execution time: 25sec on average :-)\n");\r | |
c830303d | 29 | printf("Press button on the proxmark3 device to abort both proxmark3 and client.\n");\r |
1c611bbd | 30 | printf("-------------------------------------------------------------------------\n");\r |
aea4d766 | 31 | \r |
9ca155ba | 32 | \r |
aea4d766 | 33 | start:\r |
e772353f | 34 | clearCommandBuffer();\r |
35 | SendCommand(&c);\r | |
9ca155ba M |
36 | \r |
37 | //flush queue\r | |
0de8e387 | 38 | while (ukbhit()) getchar();\r |
9ca155ba | 39 | \r |
9ca155ba M |
40 | // wait cycle\r |
41 | while (true) {\r | |
1c611bbd | 42 | printf(".");\r |
aea4d766 | 43 | fflush(stdout);\r |
9ca155ba M |
44 | if (ukbhit()) {\r |
45 | getchar();\r | |
46 | printf("\naborted via keyboard!\n");\r | |
47 | break;\r | |
48 | }\r | |
49 | \r | |
902cb3c0 | 50 | UsbCommand resp;\r |
1c611bbd | 51 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {\r |
c830303d | 52 | isOK = resp.arg[0];\r |
902cb3c0 | 53 | uid = (uint32_t)bytes_to_num(resp.d.asBytes + 0, 4);\r |
54 | nt = (uint32_t)bytes_to_num(resp.d.asBytes + 4, 4);\r | |
55 | par_list = bytes_to_num(resp.d.asBytes + 8, 8);\r | |
56 | ks_list = bytes_to_num(resp.d.asBytes + 16, 8);\r | |
1c611bbd | 57 | nr = bytes_to_num(resp.d.asBytes + 24, 4);\r |
9ca155ba | 58 | printf("\n\n");\r |
c830303d | 59 | switch (isOK) {\r |
60 | case -1 : PrintAndLog("Button pressed. Aborted.\n"); break;\r | |
61 | case -2 : PrintAndLog("Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests).\n"); break;\r | |
62 | case -3 : PrintAndLog("Card is not vulnerable to Darkside attack (its random number generator is not predictable).\n"); break;\r | |
3bc7b13d | 63 | case -4 : PrintAndLog("Card is not vulnerable to Darkside attack (its random number generator seems to be based on the wellknown");\r |
d08faa4e | 64 | PrintAndLog("generating polynomial with 16 effective bits only, but shows unexpected behaviour.\n"); break;\r |
c830303d | 65 | default: ;\r |
66 | }\r | |
9ca155ba M |
67 | break;\r |
68 | }\r | |
69 | } \r | |
1c611bbd | 70 | \r |
9ca155ba M |
71 | printf("\n");\r |
72 | \r | |
73 | // error\r | |
74 | if (isOK != 1) return 1;\r | |
75 | \r | |
76 | // execute original function from util nonce2key\r | |
b915fda3 | 77 | if (nonce2key(uid, nt, nr, par_list, ks_list, &r_key)) {\r |
bfaecce6 M |
78 | isOK = 2;\r |
79 | PrintAndLog("Key not found (lfsr_common_prefix list is null). Nt=%08x", nt); \r | |
1c611bbd | 80 | PrintAndLog("Failing is expected to happen in 25%% of all cases. Trying again with a different reader nonce...");\r |
81 | c.arg[0] = false;\r | |
aea4d766 | 82 | goto start;\r |
b10a759f | 83 | } else {\r |
84 | isOK = 0;\r | |
85 | printf("------------------------------------------------------------------\n");\r | |
0de8e387 | 86 | PrintAndLog("Found valid key: %012"llx" \n", r_key);\r |
aea4d766 | 87 | }\r |
9ca155ba | 88 | \r |
3fe4ff4f | 89 | PrintAndLog("");\r |
9ca155ba M |
90 | return 0;\r |
91 | }\r | |
92 | \r | |
93 | int CmdHF14AMfWrBl(const char *Cmd)\r | |
94 | {\r | |
95 | uint8_t blockNo = 0;\r | |
96 | uint8_t keyType = 0;\r | |
97 | uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r | |
98 | uint8_t bldata[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};\r | |
99 | \r | |
100 | char cmdp = 0x00;\r | |
101 | \r | |
102 | if (strlen(Cmd)<3) {\r | |
103 | PrintAndLog("Usage: hf mf wrbl <block number> <key A/B> <key (12 hex symbols)> <block data (32 hex symbols)>");\r | |
104 | PrintAndLog(" sample: hf mf wrbl 0 A FFFFFFFFFFFF 000102030405060708090A0B0C0D0E0F");\r | |
105 | return 0;\r | |
106 | } \r | |
107 | \r | |
108 | blockNo = param_get8(Cmd, 0);\r | |
109 | cmdp = param_getchar(Cmd, 1);\r | |
110 | if (cmdp == 0x00) {\r | |
111 | PrintAndLog("Key type must be A or B");\r | |
112 | return 1;\r | |
113 | }\r | |
114 | if (cmdp != 'A' && cmdp != 'a') keyType = 1;\r | |
115 | if (param_gethex(Cmd, 2, key, 12)) {\r | |
116 | PrintAndLog("Key must include 12 HEX symbols");\r | |
117 | return 1;\r | |
118 | }\r | |
119 | if (param_gethex(Cmd, 3, bldata, 32)) {\r | |
120 | PrintAndLog("Block data must include 32 HEX symbols");\r | |
121 | return 1;\r | |
122 | }\r | |
baeaf579 | 123 | PrintAndLog("--block no:%d, key type:%c, key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));\r |
9ca155ba M |
124 | PrintAndLog("--data: %s", sprint_hex(bldata, 16));\r |
125 | \r | |
2285d9dd | 126 | UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};\r |
9ca155ba M |
127 | memcpy(c.d.asBytes, key, 6);\r |
128 | memcpy(c.d.asBytes + 10, bldata, 16);\r | |
2285d9dd | 129 | clearCommandBuffer();\r |
130 | SendCommand(&c);\r | |
9ca155ba | 131 | \r |
902cb3c0 | 132 | UsbCommand resp;\r |
133 | if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r | |
134 | uint8_t isOK = resp.arg[0] & 0xff;\r | |
9ca155ba M |
135 | PrintAndLog("isOk:%02x", isOK);\r |
136 | } else {\r | |
137 | PrintAndLog("Command execute timeout");\r | |
138 | }\r | |
139 | \r | |
d2f487af | 140 | return 0;\r |
141 | }\r | |
142 | \r | |
d2f487af | 143 | int CmdHF14AMfRdBl(const char *Cmd)\r |
144 | {\r | |
145 | uint8_t blockNo = 0;\r | |
9ca155ba M |
146 | uint8_t keyType = 0;\r |
147 | uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r | |
148 | \r | |
149 | char cmdp = 0x00;\r | |
150 | \r | |
151 | \r | |
152 | if (strlen(Cmd)<3) {\r | |
153 | PrintAndLog("Usage: hf mf rdbl <block number> <key A/B> <key (12 hex symbols)>");\r | |
154 | PrintAndLog(" sample: hf mf rdbl 0 A FFFFFFFFFFFF ");\r | |
155 | return 0;\r | |
156 | } \r | |
157 | \r | |
158 | blockNo = param_get8(Cmd, 0);\r | |
159 | cmdp = param_getchar(Cmd, 1);\r | |
160 | if (cmdp == 0x00) {\r | |
161 | PrintAndLog("Key type must be A or B");\r | |
162 | return 1;\r | |
163 | }\r | |
164 | if (cmdp != 'A' && cmdp != 'a') keyType = 1;\r | |
165 | if (param_gethex(Cmd, 2, key, 12)) {\r | |
166 | PrintAndLog("Key must include 12 HEX symbols");\r | |
167 | return 1;\r | |
168 | }\r | |
baeaf579 | 169 | PrintAndLog("--block no:%d, key type:%c, key:%s ", blockNo, keyType?'B':'A', sprint_hex(key, 6));\r |
9ca155ba | 170 | \r |
2285d9dd | 171 | UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};\r |
9ca155ba | 172 | memcpy(c.d.asBytes, key, 6);\r |
2285d9dd | 173 | clearCommandBuffer();\r |
174 | SendCommand(&c);\r | |
9ca155ba | 175 | \r |
902cb3c0 | 176 | UsbCommand resp;\r |
177 | if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r | |
baeaf579 | 178 | uint8_t isOK = resp.arg[0] & 0xff;\r |
179 | uint8_t *data = resp.d.asBytes;\r | |
9ca155ba M |
180 | \r |
181 | if (isOK)\r | |
182 | PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 16));\r | |
183 | else\r | |
184 | PrintAndLog("isOk:%02x", isOK);\r | |
185 | } else {\r | |
186 | PrintAndLog("Command execute timeout");\r | |
187 | }\r | |
188 | \r | |
d2f487af | 189 | return 0;\r |
190 | }\r | |
191 | \r | |
d2f487af | 192 | int CmdHF14AMfRdSc(const char *Cmd)\r |
193 | {\r | |
194 | int i;\r | |
9ca155ba M |
195 | uint8_t sectorNo = 0;\r |
196 | uint8_t keyType = 0;\r | |
197 | uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r | |
9ca155ba | 198 | uint8_t isOK = 0;\r |
baeaf579 | 199 | uint8_t *data = NULL;\r |
9ca155ba M |
200 | char cmdp = 0x00;\r |
201 | \r | |
202 | if (strlen(Cmd)<3) {\r | |
203 | PrintAndLog("Usage: hf mf rdsc <sector number> <key A/B> <key (12 hex symbols)>");\r | |
204 | PrintAndLog(" sample: hf mf rdsc 0 A FFFFFFFFFFFF ");\r | |
205 | return 0;\r | |
206 | } \r | |
207 | \r | |
208 | sectorNo = param_get8(Cmd, 0);\r | |
baeaf579 | 209 | if (sectorNo > 39) {\r |
210 | PrintAndLog("Sector number must be less than 40");\r | |
9ca155ba M |
211 | return 1;\r |
212 | }\r | |
213 | cmdp = param_getchar(Cmd, 1);\r | |
baeaf579 | 214 | if (cmdp != 'a' && cmdp != 'A' && cmdp != 'b' && cmdp != 'B') {\r |
9ca155ba M |
215 | PrintAndLog("Key type must be A or B");\r |
216 | return 1;\r | |
217 | }\r | |
218 | if (cmdp != 'A' && cmdp != 'a') keyType = 1;\r | |
219 | if (param_gethex(Cmd, 2, key, 12)) {\r | |
220 | PrintAndLog("Key must include 12 HEX symbols");\r | |
221 | return 1;\r | |
222 | }\r | |
baeaf579 | 223 | PrintAndLog("--sector no:%d key type:%c key:%s ", sectorNo, keyType?'B':'A', sprint_hex(key, 6));\r |
9ca155ba | 224 | \r |
baeaf579 | 225 | UsbCommand c = {CMD_MIFARE_READSC, {sectorNo, keyType, 0}};\r |
9ca155ba | 226 | memcpy(c.d.asBytes, key, 6);\r |
2285d9dd | 227 | clearCommandBuffer();\r |
baeaf579 | 228 | SendCommand(&c);\r |
9ca155ba M |
229 | PrintAndLog(" ");\r |
230 | \r | |
902cb3c0 | 231 | UsbCommand resp;\r |
232 | if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r | |
233 | isOK = resp.arg[0] & 0xff;\r | |
234 | data = resp.d.asBytes;\r | |
9ca155ba M |
235 | \r |
236 | PrintAndLog("isOk:%02x", isOK);\r | |
baeaf579 | 237 | if (isOK) {\r |
238 | for (i = 0; i < (sectorNo<32?3:15); i++) {\r | |
239 | PrintAndLog("data : %s", sprint_hex(data + i * 16, 16));\r | |
9ca155ba | 240 | }\r |
baeaf579 | 241 | PrintAndLog("trailer: %s", sprint_hex(data + (sectorNo<32?3:15) * 16, 16));\r |
242 | }\r | |
9ca155ba | 243 | } else {\r |
baeaf579 | 244 | PrintAndLog("Command execute timeout");\r |
9ca155ba M |
245 | }\r |
246 | \r | |
baeaf579 | 247 | return 0;\r |
248 | }\r | |
9ca155ba | 249 | \r |
baeaf579 | 250 | uint8_t FirstBlockOfSector(uint8_t sectorNo)\r |
251 | {\r | |
252 | if (sectorNo < 32) {\r | |
253 | return sectorNo * 4;\r | |
9ca155ba | 254 | } else {\r |
baeaf579 | 255 | return 32 * 4 + (sectorNo - 32) * 16;\r |
9ca155ba | 256 | }\r |
9ca155ba M |
257 | }\r |
258 | \r | |
baeaf579 | 259 | uint8_t NumBlocksPerSector(uint8_t sectorNo)\r |
260 | {\r | |
261 | if (sectorNo < 32) {\r | |
262 | return 4;\r | |
263 | } else {\r | |
264 | return 16;\r | |
265 | }\r | |
266 | }\r | |
267 | \r | |
aea4d766 | 268 | int CmdHF14AMfDump(const char *Cmd)\r |
26fdb4ab | 269 | {\r |
baeaf579 | 270 | uint8_t sectorNo, blockNo;\r |
26fdb4ab | 271 | \r |
aea4d766 | 272 | uint8_t keyA[40][6];\r |
273 | uint8_t keyB[40][6];\r | |
274 | uint8_t rights[40][4];\r | |
79db03ef | 275 | uint8_t carddata[256][16];\r |
baeaf579 | 276 | uint8_t numSectors = 16;\r |
26fdb4ab | 277 | \r |
26fdb4ab | 278 | FILE *fin;\r |
279 | FILE *fout;\r | |
280 | \r | |
902cb3c0 | 281 | UsbCommand resp;\r |
baeaf579 | 282 | \r |
283 | char cmdp = param_getchar(Cmd, 0);\r | |
284 | switch (cmdp) {\r | |
285 | case '0' : numSectors = 5; break;\r | |
286 | case '1' : \r | |
287 | case '\0': numSectors = 16; break;\r | |
288 | case '2' : numSectors = 32; break;\r | |
289 | case '4' : numSectors = 40; break;\r | |
290 | default: numSectors = 16;\r | |
291 | } \r | |
292 | \r | |
293 | if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {\r | |
294 | PrintAndLog("Usage: hf mf dump [card memory]");\r | |
295 | PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");\r | |
296 | PrintAndLog("");\r | |
297 | PrintAndLog("Samples: hf mf dump");\r | |
298 | PrintAndLog(" hf mf dump 4");\r | |
299 | return 0;\r | |
300 | }\r | |
26fdb4ab | 301 | \r |
302 | if ((fin = fopen("dumpkeys.bin","rb")) == NULL) {\r | |
aea4d766 | 303 | PrintAndLog("Could not find file dumpkeys.bin");\r |
26fdb4ab | 304 | return 1;\r |
305 | }\r | |
306 | \r | |
3fe4ff4f | 307 | // Read keys A from file\r |
baeaf579 | 308 | for (sectorNo=0; sectorNo<numSectors; sectorNo++) {\r |
309 | if (fread( keyA[sectorNo], 1, 6, fin ) == 0) {\r | |
310 | PrintAndLog("File reading error.");\r | |
97d582a6 | 311 | fclose(fin);\r |
759c16b3 | 312 | return 2;\r |
baeaf579 | 313 | }\r |
26fdb4ab | 314 | }\r |
baeaf579 | 315 | \r |
3fe4ff4f | 316 | // Read keys B from file\r |
baeaf579 | 317 | for (sectorNo=0; sectorNo<numSectors; sectorNo++) {\r |
318 | if (fread( keyB[sectorNo], 1, 6, fin ) == 0) {\r | |
319 | PrintAndLog("File reading error.");\r | |
97d582a6 | 320 | fclose(fin);\r |
759c16b3 | 321 | return 2;\r |
baeaf579 | 322 | }\r |
26fdb4ab | 323 | }\r |
b915fda3 | 324 | \r |
97d582a6 | 325 | fclose(fin);\r |
baeaf579 | 326 | \r |
26fdb4ab | 327 | PrintAndLog("|-----------------------------------------|");\r |
328 | PrintAndLog("|------ Reading sector access bits...-----|");\r | |
329 | PrintAndLog("|-----------------------------------------|");\r | |
330 | \r | |
baeaf579 | 331 | for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {\r |
332 | UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 0, 0}};\r | |
333 | memcpy(c.d.asBytes, keyA[sectorNo], 6);\r | |
2285d9dd | 334 | clearCommandBuffer();\r |
26fdb4ab | 335 | SendCommand(&c);\r |
26fdb4ab | 336 | \r |
baeaf579 | 337 | if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r |
902cb3c0 | 338 | uint8_t isOK = resp.arg[0] & 0xff;\r |
339 | uint8_t *data = resp.d.asBytes;\r | |
26fdb4ab | 340 | if (isOK){\r |
c626c56e | 341 | rights[sectorNo][0] = ((data[7] & 0x10)>>2) | ((data[8] & 0x1)<<1) | ((data[8] & 0x10)>>4); // C1C2C3 for data area 0\r |
342 | rights[sectorNo][1] = ((data[7] & 0x20)>>3) | ((data[8] & 0x2)<<0) | ((data[8] & 0x20)>>5); // C1C2C3 for data area 1\r | |
343 | rights[sectorNo][2] = ((data[7] & 0x40)>>4) | ((data[8] & 0x4)>>1) | ((data[8] & 0x40)>>6); // C1C2C3 for data area 2\r | |
344 | rights[sectorNo][3] = ((data[7] & 0x80)>>5) | ((data[8] & 0x8)>>2) | ((data[8] & 0x80)>>7); // C1C2C3 for sector trailer\r | |
baeaf579 | 345 | } else {\r |
79db03ef | 346 | PrintAndLog("Could not get access rights for sector %2d. Trying with defaults...", sectorNo);\r |
c626c56e | 347 | rights[sectorNo][0] = rights[sectorNo][1] = rights[sectorNo][2] = 0x00;\r |
348 | rights[sectorNo][3] = 0x01;\r | |
26fdb4ab | 349 | }\r |
baeaf579 | 350 | } else {\r |
79db03ef | 351 | PrintAndLog("Command execute timeout when trying to read access rights for sector %2d. Trying with defaults...", sectorNo);\r |
c626c56e | 352 | rights[sectorNo][0] = rights[sectorNo][1] = rights[sectorNo][2] = 0x00;\r |
353 | rights[sectorNo][3] = 0x01;\r | |
26fdb4ab | 354 | }\r |
355 | }\r | |
356 | \r | |
26fdb4ab | 357 | PrintAndLog("|-----------------------------------------|");\r |
358 | PrintAndLog("|----- Dumping all blocks to file... -----|");\r | |
359 | PrintAndLog("|-----------------------------------------|");\r | |
360 | \r | |
79db03ef | 361 | bool isOK = true;\r |
362 | for (sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {\r | |
363 | for (blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r | |
baeaf579 | 364 | bool received = false;\r |
3fe4ff4f | 365 | \r |
baeaf579 | 366 | if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. At least the Access Conditions can always be read with key A. \r |
367 | UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};\r | |
368 | memcpy(c.d.asBytes, keyA[sectorNo], 6);\r | |
2285d9dd | 369 | clearCommandBuffer();\r |
26fdb4ab | 370 | SendCommand(&c);\r |
baeaf579 | 371 | received = WaitForResponseTimeout(CMD_ACK,&resp,1500);\r |
372 | } else { // data block. Check if it can be read with key A or key B\r | |
373 | uint8_t data_area = sectorNo<32?blockNo:blockNo/5;\r | |
c626c56e | 374 | if ((rights[sectorNo][data_area] == 0x03) || (rights[sectorNo][data_area] == 0x05)) { // only key B would work\r |
baeaf579 | 375 | UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 1, 0}};\r |
376 | memcpy(c.d.asBytes, keyB[sectorNo], 6);\r | |
26fdb4ab | 377 | SendCommand(&c);\r |
baeaf579 | 378 | received = WaitForResponseTimeout(CMD_ACK,&resp,1500);\r |
c626c56e | 379 | } else if (rights[sectorNo][data_area] == 0x07) { // no key would work\r |
79db03ef | 380 | isOK = false;\r |
381 | PrintAndLog("Access rights do not allow reading of sector %2d block %3d", sectorNo, blockNo);\r | |
baeaf579 | 382 | } else { // key A would work\r |
79db03ef | 383 | UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};\r |
384 | memcpy(c.d.asBytes, keyA[sectorNo], 6);\r | |
2285d9dd | 385 | clearCommandBuffer();\r |
79db03ef | 386 | SendCommand(&c);\r |
387 | received = WaitForResponseTimeout(CMD_ACK,&resp,1500);\r | |
26fdb4ab | 388 | }\r |
389 | }\r | |
390 | \r | |
902cb3c0 | 391 | if (received) {\r |
79db03ef | 392 | isOK = resp.arg[0] & 0xff;\r |
902cb3c0 | 393 | uint8_t *data = resp.d.asBytes;\r |
baeaf579 | 394 | if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. Fill in the keys.\r |
395 | data[0] = (keyA[sectorNo][0]);\r | |
396 | data[1] = (keyA[sectorNo][1]);\r | |
397 | data[2] = (keyA[sectorNo][2]);\r | |
398 | data[3] = (keyA[sectorNo][3]);\r | |
399 | data[4] = (keyA[sectorNo][4]);\r | |
400 | data[5] = (keyA[sectorNo][5]);\r | |
401 | data[10] = (keyB[sectorNo][0]);\r | |
402 | data[11] = (keyB[sectorNo][1]);\r | |
403 | data[12] = (keyB[sectorNo][2]);\r | |
404 | data[13] = (keyB[sectorNo][3]);\r | |
405 | data[14] = (keyB[sectorNo][4]);\r | |
406 | data[15] = (keyB[sectorNo][5]);\r | |
3d77fdfa | 407 | }\r |
26fdb4ab | 408 | if (isOK) {\r |
79db03ef | 409 | memcpy(carddata[FirstBlockOfSector(sectorNo) + blockNo], data, 16);\r |
410 | PrintAndLog("Successfully read block %2d of sector %2d.", blockNo, sectorNo);\r | |
baeaf579 | 411 | } else {\r |
412 | PrintAndLog("Could not read block %2d of sector %2d", blockNo, sectorNo);\r | |
79db03ef | 413 | break;\r |
26fdb4ab | 414 | }\r |
415 | }\r | |
416 | else {\r | |
79db03ef | 417 | isOK = false;\r |
418 | PrintAndLog("Command execute timeout when trying to read block %2d of sector %2d.", blockNo, sectorNo);\r | |
419 | break;\r | |
26fdb4ab | 420 | }\r |
421 | }\r | |
422 | }\r | |
79db03ef | 423 | \r |
424 | if (isOK) {\r | |
425 | if ((fout = fopen("dumpdata.bin","wb")) == NULL) { \r | |
426 | PrintAndLog("Could not create file name dumpdata.bin");\r | |
427 | return 1;\r | |
428 | }\r | |
429 | uint16_t numblocks = FirstBlockOfSector(numSectors - 1) + NumBlocksPerSector(numSectors - 1);\r | |
430 | fwrite(carddata, 1, 16*numblocks, fout);\r | |
431 | fclose(fout);\r | |
432 | PrintAndLog("Dumped %d blocks (%d bytes) to file dumpdata.bin", numblocks, 16*numblocks);\r | |
433 | }\r | |
434 | \r | |
baeaf579 | 435 | return 0;\r |
26fdb4ab | 436 | }\r |
437 | \r | |
aea4d766 | 438 | int CmdHF14AMfRestore(const char *Cmd)\r |
26fdb4ab | 439 | {\r |
baeaf579 | 440 | uint8_t sectorNo,blockNo;\r |
26fdb4ab | 441 | uint8_t keyType = 0;\r |
83602aff | 442 | uint8_t key[6] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};\r |
b915fda3 | 443 | uint8_t bldata[16] = {0x00};\r |
baeaf579 | 444 | uint8_t keyA[40][6];\r |
445 | uint8_t keyB[40][6];\r | |
446 | uint8_t numSectors;\r | |
26fdb4ab | 447 | \r |
26fdb4ab | 448 | FILE *fdump;\r |
449 | FILE *fkeys;\r | |
baeaf579 | 450 | \r |
451 | char cmdp = param_getchar(Cmd, 0);\r | |
452 | switch (cmdp) {\r | |
453 | case '0' : numSectors = 5; break;\r | |
454 | case '1' : \r | |
455 | case '\0': numSectors = 16; break;\r | |
456 | case '2' : numSectors = 32; break;\r | |
457 | case '4' : numSectors = 40; break;\r | |
458 | default: numSectors = 16;\r | |
459 | } \r | |
460 | \r | |
461 | if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {\r | |
462 | PrintAndLog("Usage: hf mf restore [card memory]");\r | |
463 | PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");\r | |
464 | PrintAndLog("");\r | |
465 | PrintAndLog("Samples: hf mf restore");\r | |
466 | PrintAndLog(" hf mf restore 4");\r | |
467 | return 0;\r | |
468 | }\r | |
469 | \r | |
26fdb4ab | 470 | if ((fkeys = fopen("dumpkeys.bin","rb")) == NULL) {\r |
aea4d766 | 471 | PrintAndLog("Could not find file dumpkeys.bin");\r |
26fdb4ab | 472 | return 1;\r |
473 | }\r | |
474 | \r | |
baeaf579 | 475 | for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {\r |
476 | if (fread(keyA[sectorNo], 1, 6, fkeys) == 0) {\r | |
477 | PrintAndLog("File reading error (dumpkeys.bin).");\r | |
31d1caa5 | 478 | fclose(fkeys);\r |
759c16b3 | 479 | return 2;\r |
baeaf579 | 480 | }\r |
26fdb4ab | 481 | }\r |
baeaf579 | 482 | \r |
483 | for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {\r | |
484 | if (fread(keyB[sectorNo], 1, 6, fkeys) == 0) {\r | |
485 | PrintAndLog("File reading error (dumpkeys.bin).");\r | |
31d1caa5 | 486 | fclose(fkeys);\r |
759c16b3 | 487 | return 2;\r |
baeaf579 | 488 | }\r |
26fdb4ab | 489 | }\r |
b915fda3 | 490 | \r |
ca4714cd | 491 | fclose(fkeys);\r |
79db03ef | 492 | \r |
b915fda3 | 493 | if ((fdump = fopen("dumpdata.bin","rb")) == NULL) {\r |
494 | PrintAndLog("Could not find file dumpdata.bin");\r | |
495 | return 1;\r | |
496 | } \r | |
9d710943 | 497 | PrintAndLog("Restoring dumpdata.bin to card");\r |
26fdb4ab | 498 | \r |
baeaf579 | 499 | for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {\r |
500 | for(blockNo = 0; blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r | |
501 | UsbCommand c = {CMD_MIFARE_WRITEBL, {FirstBlockOfSector(sectorNo) + blockNo, keyType, 0}};\r | |
26fdb4ab | 502 | memcpy(c.d.asBytes, key, 6);\r |
503 | \r | |
759c16b3 | 504 | if (fread(bldata, 1, 16, fdump) == 0) {\r |
baeaf579 | 505 | PrintAndLog("File reading error (dumpdata.bin).");\r |
ca4714cd | 506 | fclose(fdump);\r |
baeaf579 | 507 | return 2;\r |
508 | }\r | |
26fdb4ab | 509 | \r |
baeaf579 | 510 | if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer\r |
511 | bldata[0] = (keyA[sectorNo][0]);\r | |
512 | bldata[1] = (keyA[sectorNo][1]);\r | |
513 | bldata[2] = (keyA[sectorNo][2]);\r | |
514 | bldata[3] = (keyA[sectorNo][3]);\r | |
515 | bldata[4] = (keyA[sectorNo][4]);\r | |
516 | bldata[5] = (keyA[sectorNo][5]);\r | |
517 | bldata[10] = (keyB[sectorNo][0]);\r | |
518 | bldata[11] = (keyB[sectorNo][1]);\r | |
519 | bldata[12] = (keyB[sectorNo][2]);\r | |
520 | bldata[13] = (keyB[sectorNo][3]);\r | |
521 | bldata[14] = (keyB[sectorNo][4]);\r | |
522 | bldata[15] = (keyB[sectorNo][5]);\r | |
26fdb4ab | 523 | } \r |
524 | \r | |
baeaf579 | 525 | PrintAndLog("Writing to block %3d: %s", FirstBlockOfSector(sectorNo) + blockNo, sprint_hex(bldata, 16));\r |
26fdb4ab | 526 | \r |
527 | memcpy(c.d.asBytes + 10, bldata, 16);\r | |
2285d9dd | 528 | clearCommandBuffer();\r |
26fdb4ab | 529 | SendCommand(&c);\r |
26fdb4ab | 530 | \r |
902cb3c0 | 531 | UsbCommand resp;\r |
baeaf579 | 532 | if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r |
902cb3c0 | 533 | uint8_t isOK = resp.arg[0] & 0xff;\r |
26fdb4ab | 534 | PrintAndLog("isOk:%02x", isOK);\r |
535 | } else {\r | |
536 | PrintAndLog("Command execute timeout");\r | |
537 | }\r | |
538 | }\r | |
539 | }\r | |
540 | \r | |
541 | fclose(fdump);\r | |
26fdb4ab | 542 | return 0;\r |
543 | }\r | |
544 | \r | |
9ca155ba M |
545 | int CmdHF14AMfNested(const char *Cmd)\r |
546 | {\r | |
547 | int i, j, res, iterations;\r | |
baeaf579 | 548 | sector *e_sector = NULL;\r |
9ca155ba M |
549 | uint8_t blockNo = 0;\r |
550 | uint8_t keyType = 0;\r | |
551 | uint8_t trgBlockNo = 0;\r | |
552 | uint8_t trgKeyType = 0;\r | |
baeaf579 | 553 | uint8_t SectorsCnt = 0;\r |
9ca155ba | 554 | uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r |
2696349f | 555 | uint8_t keyBlock[14*6];\r |
9ca155ba | 556 | uint64_t key64 = 0;\r |
baeaf579 | 557 | bool transferToEml = false;\r |
9ca155ba | 558 | \r |
baeaf579 | 559 | bool createDumpFile = false;\r |
26fdb4ab | 560 | FILE *fkeys;\r |
21156267 | 561 | uint8_t standart[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};\r |
562 | uint8_t tempkey[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};\r | |
26fdb4ab | 563 | \r |
9ca155ba M |
564 | char cmdp, ctmp;\r |
565 | \r | |
566 | if (strlen(Cmd)<3) {\r | |
567 | PrintAndLog("Usage:");\r | |
26fdb4ab | 568 | PrintAndLog(" all sectors: hf mf nested <card memory> <block number> <key A/B> <key (12 hex symbols)> [t,d]");\r |
0014cb46 M |
569 | PrintAndLog(" one sector: hf mf nested o <block number> <key A/B> <key (12 hex symbols)>");\r |
570 | PrintAndLog(" <target block number> <target key A/B> [t]");\r | |
9ca155ba | 571 | PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");\r |
8556b852 | 572 | PrintAndLog("t - transfer keys into emulator memory");\r |
26fdb4ab | 573 | PrintAndLog("d - write keys to binary file");\r |
9ca155ba M |
574 | PrintAndLog(" ");\r |
575 | PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF ");\r | |
79db03ef | 576 | PrintAndLog(" sample2: hf mf nested 1 0 A FFFFFFFFFFFF t ");\r |
577 | PrintAndLog(" sample3: hf mf nested 1 0 A FFFFFFFFFFFF d ");\r | |
578 | PrintAndLog(" sample4: hf mf nested o 0 A FFFFFFFFFFFF 4 A");\r | |
9ca155ba M |
579 | return 0;\r |
580 | } \r | |
581 | \r | |
582 | cmdp = param_getchar(Cmd, 0);\r | |
583 | blockNo = param_get8(Cmd, 1);\r | |
584 | ctmp = param_getchar(Cmd, 2);\r | |
b915fda3 | 585 | \r |
baeaf579 | 586 | if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {\r |
9ca155ba M |
587 | PrintAndLog("Key type must be A or B");\r |
588 | return 1;\r | |
589 | }\r | |
b915fda3 | 590 | \r |
591 | if (ctmp != 'A' && ctmp != 'a') \r | |
592 | keyType = 1;\r | |
593 | \r | |
9ca155ba M |
594 | if (param_gethex(Cmd, 3, key, 12)) {\r |
595 | PrintAndLog("Key must include 12 HEX symbols");\r | |
596 | return 1;\r | |
597 | }\r | |
598 | \r | |
8556b852 | 599 | if (cmdp == 'o' || cmdp == 'O') {\r |
9ca155ba M |
600 | cmdp = 'o';\r |
601 | trgBlockNo = param_get8(Cmd, 4);\r | |
602 | ctmp = param_getchar(Cmd, 5);\r | |
baeaf579 | 603 | if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {\r |
9ca155ba M |
604 | PrintAndLog("Target key type must be A or B");\r |
605 | return 1;\r | |
606 | }\r | |
b915fda3 | 607 | if (ctmp != 'A' && ctmp != 'a') \r |
608 | trgKeyType = 1;\r | |
9ca155ba | 609 | } else {\r |
b915fda3 | 610 | \r |
9ca155ba M |
611 | switch (cmdp) {\r |
612 | case '0': SectorsCnt = 05; break;\r | |
613 | case '1': SectorsCnt = 16; break;\r | |
614 | case '2': SectorsCnt = 32; break;\r | |
baeaf579 | 615 | case '4': SectorsCnt = 40; break;\r |
9ca155ba M |
616 | default: SectorsCnt = 16;\r |
617 | }\r | |
618 | }\r | |
8556b852 M |
619 | \r |
620 | ctmp = param_getchar(Cmd, 4);\r | |
baeaf579 | 621 | if (ctmp == 't' || ctmp == 'T') transferToEml = true;\r |
622 | else if (ctmp == 'd' || ctmp == 'D') createDumpFile = true;\r | |
21156267 | 623 | \r |
8556b852 M |
624 | ctmp = param_getchar(Cmd, 6);\r |
625 | transferToEml |= (ctmp == 't' || ctmp == 'T');\r | |
21156267 | 626 | transferToEml |= (ctmp == 'd' || ctmp == 'D');\r |
9ca155ba | 627 | \r |
9ca155ba | 628 | if (cmdp == 'o') {\r |
baeaf579 | 629 | PrintAndLog("--target block no:%3d, target key type:%c ", trgBlockNo, trgKeyType?'B':'A');\r |
c830303d | 630 | int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true);\r |
631 | if (isOK) {\r | |
632 | switch (isOK) {\r | |
633 | case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;\r | |
634 | case -2 : PrintAndLog("Button pressed. Aborted.\n"); break;\r | |
635 | case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (random numbers are not predictable).\n"); break;\r | |
636 | default : PrintAndLog("Unknown Error.\n");\r | |
637 | }\r | |
9ca155ba M |
638 | return 2;\r |
639 | }\r | |
9492e0b0 | 640 | key64 = bytes_to_num(keyBlock, 6);\r |
641 | if (key64) {\r | |
125a98a1 | 642 | PrintAndLog("Found valid key:%012"llx, key64);\r |
8556b852 M |
643 | \r |
644 | // transfer key to the emulator\r | |
645 | if (transferToEml) {\r | |
baeaf579 | 646 | uint8_t sectortrailer;\r |
647 | if (trgBlockNo < 32*4) { // 4 block sector\r | |
648 | sectortrailer = (trgBlockNo & 0x03) + 3;\r | |
649 | } else { // 16 block sector\r | |
650 | sectortrailer = (trgBlockNo & 0x0f) + 15;\r | |
651 | }\r | |
652 | mfEmlGetMem(keyBlock, sectortrailer, 1);\r | |
8556b852 M |
653 | \r |
654 | if (!trgKeyType)\r | |
655 | num_to_bytes(key64, 6, keyBlock);\r | |
656 | else\r | |
657 | num_to_bytes(key64, 6, &keyBlock[10]);\r | |
baeaf579 | 658 | mfEmlSetMem(keyBlock, sectortrailer, 1); \r |
8556b852 M |
659 | }\r |
660 | } else {\r | |
9ca155ba | 661 | PrintAndLog("No valid key found");\r |
8556b852 | 662 | }\r |
21156267 | 663 | }\r |
664 | else { // ------------------------------------ multiple sectors working\r | |
9492e0b0 | 665 | clock_t time1;\r |
666 | time1 = clock();\r | |
667 | \r | |
9ca155ba M |
668 | e_sector = calloc(SectorsCnt, sizeof(sector));\r |
669 | if (e_sector == NULL) return 1;\r | |
670 | \r | |
baeaf579 | 671 | //test current key and additional standard keys first\r |
9ca155ba | 672 | memcpy(keyBlock, key, 6);\r |
9492e0b0 | 673 | num_to_bytes(0xffffffffffff, 6, (uint8_t*)(keyBlock + 1 * 6));\r |
674 | num_to_bytes(0x000000000000, 6, (uint8_t*)(keyBlock + 2 * 6));\r | |
675 | num_to_bytes(0xa0a1a2a3a4a5, 6, (uint8_t*)(keyBlock + 3 * 6));\r | |
676 | num_to_bytes(0xb0b1b2b3b4b5, 6, (uint8_t*)(keyBlock + 4 * 6));\r | |
9ca155ba | 677 | num_to_bytes(0xaabbccddeeff, 6, (uint8_t*)(keyBlock + 5 * 6));\r |
787b5bd8 | 678 | num_to_bytes(0x4d3a99c351dd, 6, (uint8_t*)(keyBlock + 6 * 6));\r |
679 | num_to_bytes(0x1a982c7e459a, 6, (uint8_t*)(keyBlock + 7 * 6));\r | |
680 | num_to_bytes(0xd3f7d3f7d3f7, 6, (uint8_t*)(keyBlock + 8 * 6));\r | |
681 | num_to_bytes(0x714c5c886e97, 6, (uint8_t*)(keyBlock + 9 * 6));\r | |
682 | num_to_bytes(0x587ee5f9350f, 6, (uint8_t*)(keyBlock + 10 * 6));\r | |
683 | num_to_bytes(0xa0478cc39091, 6, (uint8_t*)(keyBlock + 11 * 6));\r | |
684 | num_to_bytes(0x533cb6c723f6, 6, (uint8_t*)(keyBlock + 12 * 6));\r | |
685 | num_to_bytes(0x8fd0a4f256e9, 6, (uint8_t*)(keyBlock + 13 * 6));\r | |
9ca155ba M |
686 | \r |
687 | PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt);\r | |
688 | for (i = 0; i < SectorsCnt; i++) {\r | |
689 | for (j = 0; j < 2; j++) {\r | |
690 | if (e_sector[i].foundKey[j]) continue;\r | |
691 | \r | |
b10a759f | 692 | res = mfCheckKeys(FirstBlockOfSector(i), j, true, 6, keyBlock, &key64);\r |
9ca155ba M |
693 | \r |
694 | if (!res) {\r | |
695 | e_sector[i].Key[j] = key64;\r | |
696 | e_sector[i].foundKey[j] = 1;\r | |
697 | }\r | |
698 | }\r | |
9492e0b0 | 699 | }\r |
700 | \r | |
9ca155ba M |
701 | // nested sectors\r |
702 | iterations = 0;\r | |
703 | PrintAndLog("nested...");\r | |
9492e0b0 | 704 | bool calibrate = true;\r |
9ca155ba | 705 | for (i = 0; i < NESTED_SECTOR_RETRY; i++) {\r |
baeaf579 | 706 | for (uint8_t sectorNo = 0; sectorNo < SectorsCnt; sectorNo++) {\r |
9ca155ba | 707 | for (trgKeyType = 0; trgKeyType < 2; trgKeyType++) { \r |
baeaf579 | 708 | if (e_sector[sectorNo].foundKey[trgKeyType]) continue;\r |
9492e0b0 | 709 | PrintAndLog("-----------------------------------------------");\r |
c830303d | 710 | int16_t isOK = mfnested(blockNo, keyType, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate);\r |
711 | if(isOK) {\r | |
712 | switch (isOK) {\r | |
713 | case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;\r | |
714 | case -2 : PrintAndLog("Button pressed. Aborted.\n"); break;\r | |
715 | case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (random numbers are not predictable).\n"); break;\r | |
716 | default : PrintAndLog("Unknown Error.\n");\r | |
717 | }\r | |
3fe4ff4f | 718 | free(e_sector);\r |
c830303d | 719 | return 2;\r |
720 | } else {\r | |
9492e0b0 | 721 | calibrate = false;\r |
722 | }\r | |
9ca155ba M |
723 | \r |
724 | iterations++;\r | |
9492e0b0 | 725 | \r |
726 | key64 = bytes_to_num(keyBlock, 6);\r | |
727 | if (key64) {\r | |
125a98a1 | 728 | PrintAndLog("Found valid key:%012"llx, key64);\r |
baeaf579 | 729 | e_sector[sectorNo].foundKey[trgKeyType] = 1;\r |
730 | e_sector[sectorNo].Key[trgKeyType] = key64;\r | |
9ca155ba M |
731 | }\r |
732 | }\r | |
9492e0b0 | 733 | }\r |
9ca155ba M |
734 | }\r |
735 | \r | |
a0041115 | 736 | printf("Time in nested: %1.3f (%1.3f sec per key)\n\n", ((float)clock() - time1)/CLOCKS_PER_SEC, ((float)clock() - time1)/iterations/CLOCKS_PER_SEC);\r |
9492e0b0 | 737 | \r |
738 | PrintAndLog("-----------------------------------------------\nIterations count: %d\n\n", iterations);\r | |
9ca155ba M |
739 | //print them\r |
740 | PrintAndLog("|---|----------------|---|----------------|---|");\r | |
741 | PrintAndLog("|sec|key A |res|key B |res|");\r | |
742 | PrintAndLog("|---|----------------|---|----------------|---|");\r | |
743 | for (i = 0; i < SectorsCnt; i++) {\r | |
125a98a1 | 744 | PrintAndLog("|%03d| %012"llx" | %d | %012"llx" | %d |", i,\r |
9ca155ba M |
745 | e_sector[i].Key[0], e_sector[i].foundKey[0], e_sector[i].Key[1], e_sector[i].foundKey[1]);\r |
746 | }\r | |
747 | PrintAndLog("|---|----------------|---|----------------|---|");\r | |
748 | \r | |
8556b852 M |
749 | // transfer them to the emulator\r |
750 | if (transferToEml) {\r | |
751 | for (i = 0; i < SectorsCnt; i++) {\r | |
baeaf579 | 752 | mfEmlGetMem(keyBlock, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1);\r |
8556b852 | 753 | if (e_sector[i].foundKey[0])\r |
ab8b654e | 754 | num_to_bytes(e_sector[i].Key[0], 6, keyBlock);\r |
8556b852 M |
755 | if (e_sector[i].foundKey[1])\r |
756 | num_to_bytes(e_sector[i].Key[1], 6, &keyBlock[10]);\r | |
baeaf579 | 757 | mfEmlSetMem(keyBlock, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1);\r |
8556b852 M |
758 | } \r |
759 | }\r | |
760 | \r | |
21156267 | 761 | // Create dump file\r |
26fdb4ab | 762 | if (createDumpFile) {\r |
763 | if ((fkeys = fopen("dumpkeys.bin","wb")) == NULL) { \r | |
aea4d766 | 764 | PrintAndLog("Could not create file dumpkeys.bin");\r |
26fdb4ab | 765 | free(e_sector);\r |
766 | return 1;\r | |
767 | }\r | |
baeaf579 | 768 | PrintAndLog("Printing keys to binary file dumpkeys.bin...");\r |
769 | for(i=0; i<SectorsCnt; i++) {\r | |
21156267 | 770 | if (e_sector[i].foundKey[0]){\r |
771 | num_to_bytes(e_sector[i].Key[0], 6, tempkey);\r | |
772 | fwrite ( tempkey, 1, 6, fkeys );\r | |
773 | }\r | |
774 | else{\r | |
775 | fwrite ( &standart, 1, 6, fkeys );\r | |
776 | }\r | |
26fdb4ab | 777 | }\r |
baeaf579 | 778 | for(i=0; i<SectorsCnt; i++) {\r |
21156267 | 779 | if (e_sector[i].foundKey[1]){\r |
780 | num_to_bytes(e_sector[i].Key[1], 6, tempkey);\r | |
781 | fwrite ( tempkey, 1, 6, fkeys );\r | |
782 | }\r | |
783 | else{\r | |
784 | fwrite ( &standart, 1, 6, fkeys );\r | |
785 | }\r | |
26fdb4ab | 786 | }\r |
787 | fclose(fkeys);\r | |
788 | }\r | |
789 | \r | |
9ca155ba M |
790 | free(e_sector);\r |
791 | }\r | |
9ca155ba M |
792 | return 0;\r |
793 | }\r | |
794 | \r | |
c188b1b9 | 795 | int CmdHF14AMfNestedHard(const char *Cmd)\r |
796 | {\r | |
797 | uint8_t blockNo = 0;\r | |
798 | uint8_t keyType = 0;\r | |
799 | uint8_t trgBlockNo = 0;\r | |
800 | uint8_t trgKeyType = 0;\r | |
801 | uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r | |
f8ada309 | 802 | uint8_t trgkey[6] = {0, 0, 0, 0, 0, 0};\r |
c188b1b9 | 803 | \r |
804 | char ctmp;\r | |
805 | ctmp = param_getchar(Cmd, 0);\r | |
f8ada309 | 806 | \r |
c188b1b9 | 807 | if (ctmp != 'R' && ctmp != 'r' && strlen(Cmd) < 20) {\r |
808 | PrintAndLog("Usage:");\r | |
809 | PrintAndLog(" hf mf hardnested <block number> <key A|B> <key (12 hex symbols)>");\r | |
f8ada309 | 810 | PrintAndLog(" <target block number> <target key A|B> [known target key (12 hex symbols)] [w] [s]");\r |
811 | PrintAndLog(" or hf mf hardnested r [known target key]");\r | |
c188b1b9 | 812 | PrintAndLog(" ");\r |
813 | PrintAndLog("Options: ");\r | |
814 | PrintAndLog(" w: Acquire nonces and write them to binary file nonces.bin");\r | |
815 | PrintAndLog(" s: Slower acquisition (required by some non standard cards)");\r | |
816 | PrintAndLog(" r: Read nonces.bin and start attack");\r | |
817 | PrintAndLog(" ");\r | |
818 | PrintAndLog(" sample1: hf mf hardnested 0 A FFFFFFFFFFFF 4 A");\r | |
819 | PrintAndLog(" sample2: hf mf hardnested 0 A FFFFFFFFFFFF 4 A w");\r | |
820 | PrintAndLog(" sample3: hf mf hardnested 0 A FFFFFFFFFFFF 4 A w s");\r | |
821 | PrintAndLog(" sample4: hf mf hardnested r");\r | |
f8ada309 | 822 | PrintAndLog(" ");\r |
823 | PrintAndLog("Add the known target key to check if it is present in the remaining key space:");\r | |
824 | PrintAndLog(" sample5: hf mf hardnested 0 A A0A1A2A3A4A5 4 A FFFFFFFFFFFF");\r | |
c188b1b9 | 825 | return 0;\r |
826 | } \r | |
827 | \r | |
f8ada309 | 828 | bool know_target_key = false;\r |
c188b1b9 | 829 | bool nonce_file_read = false;\r |
830 | bool nonce_file_write = false;\r | |
831 | bool slow = false;\r | |
832 | \r | |
833 | if (ctmp == 'R' || ctmp == 'r') {\r | |
c188b1b9 | 834 | nonce_file_read = true;\r |
f8ada309 | 835 | if (!param_gethex(Cmd, 1, trgkey, 12)) {\r |
836 | know_target_key = true;\r | |
837 | }\r | |
c188b1b9 | 838 | \r |
839 | } else {\r | |
840 | \r | |
841 | blockNo = param_get8(Cmd, 0);\r | |
842 | ctmp = param_getchar(Cmd, 1);\r | |
843 | if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {\r | |
844 | PrintAndLog("Key type must be A or B");\r | |
845 | return 1;\r | |
846 | }\r | |
847 | if (ctmp != 'A' && ctmp != 'a') { \r | |
848 | keyType = 1;\r | |
849 | }\r | |
850 | \r | |
851 | if (param_gethex(Cmd, 2, key, 12)) {\r | |
852 | PrintAndLog("Key must include 12 HEX symbols");\r | |
853 | return 1;\r | |
854 | }\r | |
855 | \r | |
856 | trgBlockNo = param_get8(Cmd, 3);\r | |
857 | ctmp = param_getchar(Cmd, 4);\r | |
858 | if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {\r | |
859 | PrintAndLog("Target key type must be A or B");\r | |
860 | return 1;\r | |
861 | }\r | |
862 | if (ctmp != 'A' && ctmp != 'a') {\r | |
863 | trgKeyType = 1;\r | |
864 | }\r | |
865 | \r | |
866 | uint16_t i = 5;\r | |
f8ada309 | 867 | \r |
868 | if (!param_gethex(Cmd, 5, trgkey, 12)) {\r | |
869 | know_target_key = true;\r | |
870 | i++;\r | |
871 | }\r | |
872 | \r | |
c188b1b9 | 873 | while ((ctmp = param_getchar(Cmd, i))) {\r |
874 | if (ctmp == 's' || ctmp == 'S') {\r | |
875 | slow = true;\r | |
876 | } else if (ctmp == 'w' || ctmp == 'W') {\r | |
877 | nonce_file_write = true;\r | |
878 | } else {\r | |
879 | PrintAndLog("Possible options are w and/or s");\r | |
880 | return 1;\r | |
881 | }\r | |
882 | i++;\r | |
883 | }\r | |
884 | }\r | |
885 | \r | |
f8ada309 | 886 | PrintAndLog("--target block no:%3d, target key type:%c, known target key: 0x%02x%02x%02x%02x%02x%02x%s, file action: %s, Slow: %s ", \r |
c188b1b9 | 887 | trgBlockNo, \r |
888 | trgKeyType?'B':'A', \r | |
f8ada309 | 889 | trgkey[0], trgkey[1], trgkey[2], trgkey[3], trgkey[4], trgkey[5],\r |
890 | know_target_key?"":" (not set)",\r | |
c188b1b9 | 891 | nonce_file_write?"write":nonce_file_read?"read":"none",\r |
892 | slow?"Yes":"No");\r | |
f8ada309 | 893 | \r |
894 | int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key?trgkey:NULL, nonce_file_read, nonce_file_write, slow);\r | |
895 | \r | |
c188b1b9 | 896 | if (isOK) {\r |
897 | switch (isOK) {\r | |
898 | case 1 : PrintAndLog("Error: No response from Proxmark.\n"); break;\r | |
899 | case 2 : PrintAndLog("Button pressed. Aborted.\n"); break;\r | |
900 | default : break;\r | |
901 | }\r | |
902 | return 2;\r | |
903 | }\r | |
904 | \r | |
905 | return 0;\r | |
906 | }\r | |
907 | \r | |
9ca155ba M |
908 | int CmdHF14AMfChk(const char *Cmd)\r |
909 | {\r | |
90e278d3 | 910 | if (strlen(Cmd)<3) {\r |
e3c23565 | 911 | PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d] [<key (12 hex symbols)>] [<dic (*.dic)>]");\r |
90e278d3 MHS |
912 | PrintAndLog(" * - all sectors");\r |
913 | PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");\r | |
fab0b379 | 914 | PrintAndLog("d - write keys to binary file");\r |
915 | PrintAndLog("t - write keys to emulator memory\n");\r | |
90e278d3 MHS |
916 | PrintAndLog(" sample: hf mf chk 0 A 1234567890ab keys.dic");\r |
917 | PrintAndLog(" hf mf chk *1 ? t");\r | |
e3c23565 | 918 | PrintAndLog(" hf mf chk *1 ? d");\r |
90e278d3 MHS |
919 | return 0;\r |
920 | } \r | |
921 | \r | |
aea4d766 | 922 | FILE * f;\r |
b915fda3 | 923 | char filename[FILE_PATH_SIZE]={0};\r |
83613803 | 924 | char buf[13];\r |
aea4d766 | 925 | uint8_t *keyBlock = NULL, *p;\r |
926 | uint8_t stKeyBlock = 20;\r | |
927 | \r | |
9ca155ba M |
928 | int i, res;\r |
929 | int keycnt = 0;\r | |
930 | char ctmp = 0x00;\r | |
931 | uint8_t blockNo = 0;\r | |
aea4d766 | 932 | uint8_t SectorsCnt = 1;\r |
9ca155ba | 933 | uint8_t keyType = 0;\r |
9ca155ba | 934 | uint64_t key64 = 0;\r |
aea4d766 | 935 | \r |
936 | int transferToEml = 0;\r | |
937 | int createDumpFile = 0;\r | |
9ca155ba | 938 | \r |
aea4d766 | 939 | keyBlock = calloc(stKeyBlock, 6);\r |
940 | if (keyBlock == NULL) return 1;\r | |
941 | \r | |
0c12504a | 942 | uint64_t defaultKeys[] =\r |
943 | {\r | |
944 | 0xffffffffffff, // Default key (first key used by program if no user defined key)\r | |
945 | 0x000000000000, // Blank key\r | |
946 | 0xa0a1a2a3a4a5, // NFCForum MAD key\r | |
947 | 0xb0b1b2b3b4b5,\r | |
948 | 0xaabbccddeeff,\r | |
949 | 0x4d3a99c351dd,\r | |
950 | 0x1a982c7e459a,\r | |
951 | 0xd3f7d3f7d3f7,\r | |
952 | 0x714c5c886e97,\r | |
953 | 0x587ee5f9350f,\r | |
954 | 0xa0478cc39091,\r | |
955 | 0x533cb6c723f6,\r | |
956 | 0x8fd0a4f256e9\r | |
957 | };\r | |
baeaf579 | 958 | int defaultKeysSize = sizeof(defaultKeys) / sizeof(uint64_t);\r |
0c12504a | 959 | \r |
960 | for (int defaultKeyCounter = 0; defaultKeyCounter < defaultKeysSize; defaultKeyCounter++)\r | |
961 | {\r | |
962 | num_to_bytes(defaultKeys[defaultKeyCounter], 6, (uint8_t*)(keyBlock + defaultKeyCounter * 6));\r | |
963 | }\r | |
aea4d766 | 964 | \r |
aea4d766 | 965 | if (param_getchar(Cmd, 0)=='*') {\r |
966 | blockNo = 3;\r | |
967 | switch(param_getchar(Cmd+1, 0)) {\r | |
968 | case '0': SectorsCnt = 5; break;\r | |
969 | case '1': SectorsCnt = 16; break;\r | |
970 | case '2': SectorsCnt = 32; break;\r | |
971 | case '4': SectorsCnt = 40; break;\r | |
972 | default: SectorsCnt = 16;\r | |
973 | }\r | |
974 | }\r | |
975 | else\r | |
976 | blockNo = param_get8(Cmd, 0);\r | |
977 | \r | |
9ca155ba | 978 | ctmp = param_getchar(Cmd, 1);\r |
aea4d766 | 979 | switch (ctmp) { \r |
980 | case 'a': case 'A':\r | |
981 | keyType = !0;\r | |
982 | break;\r | |
983 | case 'b': case 'B':\r | |
984 | keyType = !1;\r | |
985 | break;\r | |
986 | case '?':\r | |
987 | keyType = 2;\r | |
988 | break;\r | |
989 | default:\r | |
990 | PrintAndLog("Key type must be A , B or ?");\r | |
9ca155ba | 991 | return 1;\r |
aea4d766 | 992 | };\r |
9ca155ba | 993 | \r |
aea4d766 | 994 | ctmp = param_getchar(Cmd, 2);\r |
995 | if (ctmp == 't' || ctmp == 'T') transferToEml = 1;\r | |
996 | else if (ctmp == 'd' || ctmp == 'D') createDumpFile = 1;\r | |
997 | \r | |
998 | for (i = transferToEml || createDumpFile; param_getchar(Cmd, 2 + i); i++) {\r | |
999 | if (!param_gethex(Cmd, 2 + i, keyBlock + 6 * keycnt, 12)) {\r | |
1000 | if ( stKeyBlock - keycnt < 2) {\r | |
1001 | p = realloc(keyBlock, 6*(stKeyBlock+=10));\r | |
1002 | if (!p) {\r | |
1003 | PrintAndLog("Cannot allocate memory for Keys");\r | |
1004 | free(keyBlock);\r | |
1005 | return 2;\r | |
1006 | }\r | |
1007 | keyBlock = p;\r | |
1008 | }\r | |
baeaf579 | 1009 | PrintAndLog("chk key[%2d] %02x%02x%02x%02x%02x%02x", keycnt,\r |
aea4d766 | 1010 | (keyBlock + 6*keycnt)[0],(keyBlock + 6*keycnt)[1], (keyBlock + 6*keycnt)[2],\r |
1011 | (keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4], (keyBlock + 6*keycnt)[5], 6);\r | |
1012 | keycnt++;\r | |
1013 | } else {\r | |
1014 | // May be a dic file\r | |
b915fda3 | 1015 | if ( param_getstr(Cmd, 2 + i,filename) >= FILE_PATH_SIZE ) {\r |
aea4d766 | 1016 | PrintAndLog("File name too long");\r |
1017 | free(keyBlock);\r | |
1018 | return 2;\r | |
1019 | }\r | |
1020 | \r | |
aea4d766 | 1021 | if ( (f = fopen( filename , "r")) ) {\r |
0c12504a | 1022 | while( fgets(buf, sizeof(buf), f) ){\r |
99a71a0d | 1023 | if (strlen(buf) < 12 || buf[11] == '\n')\r |
1024 | continue;\r | |
aea4d766 | 1025 | \r |
99a71a0d | 1026 | while (fgetc(f) != '\n' && !feof(f)) ; //goto next line\r |
1027 | \r | |
9492e0b0 | 1028 | if( buf[0]=='#' ) continue; //The line start with # is comment, skip\r |
9ca155ba | 1029 | \r |
99a71a0d | 1030 | if (!isxdigit(buf[0])){\r |
1031 | PrintAndLog("File content error. '%s' must include 12 HEX symbols",buf);\r | |
aea4d766 | 1032 | continue;\r |
1033 | }\r | |
1034 | \r | |
99a71a0d | 1035 | buf[12] = 0;\r |
aea4d766 | 1036 | \r |
1037 | if ( stKeyBlock - keycnt < 2) {\r | |
1038 | p = realloc(keyBlock, 6*(stKeyBlock+=10));\r | |
1039 | if (!p) {\r | |
1040 | PrintAndLog("Cannot allocate memory for defKeys");\r | |
1041 | free(keyBlock);\r | |
1042 | return 2;\r | |
1043 | }\r | |
1044 | keyBlock = p;\r | |
1045 | }\r | |
1046 | memset(keyBlock + 6 * keycnt, 0, 6);\r | |
99a71a0d | 1047 | num_to_bytes(strtoll(buf, NULL, 16), 6, keyBlock + 6*keycnt);\r |
baeaf579 | 1048 | PrintAndLog("chk custom key[%2d] %012"llx, keycnt, bytes_to_num(keyBlock + 6*keycnt, 6));\r |
aea4d766 | 1049 | keycnt++;\r |
0c12504a | 1050 | memset(buf, 0, sizeof(buf));\r |
aea4d766 | 1051 | }\r |
90e278d3 | 1052 | fclose(f);\r |
aea4d766 | 1053 | } else {\r |
1054 | PrintAndLog("File: %s: not found or locked.", filename);\r | |
1055 | free(keyBlock);\r | |
1056 | return 1;\r | |
3fe4ff4f | 1057 | \r |
aea4d766 | 1058 | }\r |
9ca155ba | 1059 | }\r |
9ca155ba M |
1060 | }\r |
1061 | \r | |
1062 | if (keycnt == 0) {\r | |
baeaf579 | 1063 | PrintAndLog("No key specified, trying default keys");\r |
0c12504a | 1064 | for (;keycnt < defaultKeysSize; keycnt++)\r |
baeaf579 | 1065 | PrintAndLog("chk default key[%2d] %02x%02x%02x%02x%02x%02x", keycnt,\r |
79db03ef | 1066 | (keyBlock + 6*keycnt)[0],(keyBlock + 6*keycnt)[1], (keyBlock + 6*keycnt)[2],\r |
1067 | (keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4], (keyBlock + 6*keycnt)[5], 6);\r | |
1068 | }\r | |
1069 | \r | |
1070 | // initialize storage for found keys\r | |
1071 | bool validKey[2][40];\r | |
1072 | uint8_t foundKey[2][40][6];\r | |
1073 | for (uint16_t t = 0; t < 2; t++) {\r | |
1074 | for (uint16_t sectorNo = 0; sectorNo < SectorsCnt; sectorNo++) {\r | |
1075 | validKey[t][sectorNo] = false;\r | |
1076 | for (uint16_t i = 0; i < 6; i++) {\r | |
1077 | foundKey[t][sectorNo][i] = 0xff;\r | |
1078 | }\r | |
1079 | }\r | |
9ca155ba | 1080 | }\r |
9ca155ba | 1081 | \r |
baeaf579 | 1082 | for ( int t = !keyType; t < 2; keyType==2?(t++):(t=2) ) {\r |
aea4d766 | 1083 | int b=blockNo;\r |
baeaf579 | 1084 | for (int i = 0; i < SectorsCnt; ++i) {\r |
79db03ef | 1085 | PrintAndLog("--sector:%2d, block:%3d, key type:%C, key count:%2d ", i, b, t?'B':'A', keycnt);\r |
9492e0b0 | 1086 | uint32_t max_keys = keycnt>USB_CMD_DATA_SIZE/6?USB_CMD_DATA_SIZE/6:keycnt;\r |
1087 | for (uint32_t c = 0; c < keycnt; c+=max_keys) {\r | |
1088 | uint32_t size = keycnt-c>max_keys?max_keys:keycnt-c;\r | |
b10a759f | 1089 | res = mfCheckKeys(b, t, true, size, &keyBlock[6*c], &key64);\r |
baeaf579 | 1090 | if (res != 1) {\r |
aea4d766 | 1091 | if (!res) {\r |
125a98a1 | 1092 | PrintAndLog("Found valid key:[%012"llx"]",key64);\r |
79db03ef | 1093 | num_to_bytes(key64, 6, foundKey[t][i]);\r |
1094 | validKey[t][i] = true;\r | |
1095 | } \r | |
aea4d766 | 1096 | } else {\r |
1097 | PrintAndLog("Command execute timeout");\r | |
1098 | }\r | |
1099 | }\r | |
1100 | b<127?(b+=4):(b+=16); \r | |
1101 | }\r | |
9ca155ba M |
1102 | }\r |
1103 | \r | |
79db03ef | 1104 | if (transferToEml) {\r |
1105 | uint8_t block[16];\r | |
1106 | for (uint16_t sectorNo = 0; sectorNo < SectorsCnt; sectorNo++) {\r | |
1107 | if (validKey[0][sectorNo] || validKey[1][sectorNo]) {\r | |
1108 | mfEmlGetMem(block, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1);\r | |
1109 | for (uint16_t t = 0; t < 2; t++) {\r | |
1110 | if (validKey[t][sectorNo]) {\r | |
1111 | memcpy(block + t*10, foundKey[t][sectorNo], 6);\r | |
1112 | }\r | |
1113 | }\r | |
1114 | mfEmlSetMem(block, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1);\r | |
1115 | }\r | |
1116 | }\r | |
1117 | PrintAndLog("Found keys have been transferred to the emulator memory");\r | |
1118 | }\r | |
1119 | \r | |
aea4d766 | 1120 | if (createDumpFile) {\r |
79db03ef | 1121 | FILE *fkeys = fopen("dumpkeys.bin","wb");\r |
1122 | if (fkeys == NULL) { \r | |
aea4d766 | 1123 | PrintAndLog("Could not create file dumpkeys.bin");\r |
79db03ef | 1124 | free(keyBlock);\r |
aea4d766 | 1125 | return 1;\r |
1126 | }\r | |
79db03ef | 1127 | for (uint16_t t = 0; t < 2; t++) {\r |
1128 | fwrite(foundKey[t], 1, 6*SectorsCnt, fkeys);\r | |
aea4d766 | 1129 | }\r |
1130 | fclose(fkeys);\r | |
79db03ef | 1131 | PrintAndLog("Found keys have been dumped to file dumpkeys.bin. 0xffffffffffff has been inserted for unknown keys.");\r |
aea4d766 | 1132 | }\r |
79db03ef | 1133 | \r |
1134 | free(keyBlock);\r | |
3fe4ff4f | 1135 | PrintAndLog("");\r |
79db03ef | 1136 | return 0;\r |
9ca155ba M |
1137 | }\r |
1138 | \r | |
1139 | int CmdHF14AMf1kSim(const char *Cmd)\r | |
1140 | {\r | |
7bc95e2e | 1141 | uint8_t uid[7] = {0, 0, 0, 0, 0, 0, 0};\r |
d2f487af | 1142 | uint8_t exitAfterNReads = 0;\r |
1143 | uint8_t flags = 0;\r | |
c3c241f3 | 1144 | \r |
e3c23565 | 1145 | uint8_t cmdp = param_getchar(Cmd, 0);\r |
c3c241f3 | 1146 | \r |
e3c23565 | 1147 | if (cmdp == 'h' || cmdp == 'H') {\r |
d2f487af | 1148 | PrintAndLog("Usage: hf mf sim u <uid (8 hex symbols)> n <numreads> i x");\r |
e3c23565 | 1149 | PrintAndLog(" h this help");\r |
d2f487af | 1150 | PrintAndLog(" u (Optional) UID. If not specified, the UID from emulator memory will be used");\r |
1151 | PrintAndLog(" n (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");\r | |
1152 | PrintAndLog(" i (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");\r | |
1153 | PrintAndLog(" x (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r | |
e3c23565 | 1154 | PrintAndLog("");\r |
b03c0f2d | 1155 | PrintAndLog(" sample: hf mf sim u 0a0a0a0a ");\r |
9ca155ba | 1156 | return 0;\r |
9ca155ba | 1157 | }\r |
d2f487af | 1158 | uint8_t pnr = 0;\r |
1159 | if (param_getchar(Cmd, pnr) == 'u') {\r | |
1160 | if(param_gethex(Cmd, pnr+1, uid, 8) == 0)\r | |
1161 | {\r | |
baeaf579 | 1162 | flags |= FLAG_4B_UID_IN_DATA; // UID from packet\r |
1163 | } else if(param_gethex(Cmd,pnr+1,uid,14) == 0) {\r | |
d2f487af | 1164 | flags |= FLAG_7B_UID_IN_DATA;// UID from packet\r |
baeaf579 | 1165 | } else {\r |
1166 | PrintAndLog("UID, if specified, must include 8 or 14 HEX symbols");\r | |
1167 | return 1;\r | |
d2f487af | 1168 | }\r |
1169 | pnr +=2;\r | |
1170 | }\r | |
1171 | if (param_getchar(Cmd, pnr) == 'n') {\r | |
1172 | exitAfterNReads = param_get8(Cmd,pnr+1);\r | |
1173 | pnr += 2;\r | |
1174 | }\r | |
1175 | if (param_getchar(Cmd, pnr) == 'i' ) {\r | |
1176 | //Using a flag to signal interactiveness, least significant bit\r | |
1177 | flags |= FLAG_INTERACTIVE;\r | |
1178 | pnr++;\r | |
1179 | }\r | |
1180 | \r | |
1181 | if (param_getchar(Cmd, pnr) == 'x' ) {\r | |
1182 | //Using a flag to signal interactiveness, least significant bit\r | |
1183 | flags |= FLAG_NR_AR_ATTACK;\r | |
1184 | }\r | |
1185 | PrintAndLog(" uid:%s, numreads:%d, flags:%d (0x%02x) ",\r | |
1186 | flags & FLAG_4B_UID_IN_DATA ? sprint_hex(uid,4):\r | |
1187 | flags & FLAG_7B_UID_IN_DATA ? sprint_hex(uid,7): "N/A"\r | |
1188 | , exitAfterNReads, flags,flags);\r | |
1189 | \r | |
1190 | \r | |
baeaf579 | 1191 | UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};\r |
1192 | memcpy(c.d.asBytes, uid, sizeof(uid));\r | |
2285d9dd | 1193 | clearCommandBuffer();\r |
baeaf579 | 1194 | SendCommand(&c);\r |
d2f487af | 1195 | \r |
baeaf579 | 1196 | if(flags & FLAG_INTERACTIVE)\r |
46cd801c | 1197 | { \r |
46cd801c | 1198 | uint8_t data[40];\r |
1199 | uint8_t key[6];\r | |
1200 | \r | |
c3c241f3 | 1201 | UsbCommand resp; \r |
2b1f4228 | 1202 | PrintAndLog("Press pm3-button or send another cmd to abort simulation");\r |
1203 | //while(! WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r | |
1204 | //We're waiting only 1.5 s at a time, otherwise we get the\r | |
1205 | // annoying message about "Waiting for a response... "\r | |
1206 | //}\r | |
c3c241f3 | 1207 | while(!ukbhit() ){\r |
2b1f4228 | 1208 | if (!WaitForResponseTimeout(CMD_ACK,&resp,1500) ) continue;\r |
1209 | \r | |
1210 | if ( !(flags & FLAG_NR_AR_ATTACK) ) break;\r | |
1211 | if ( (resp.arg[0] & 0xffff) != CMD_SIMULATE_MIFARE_CARD ) break;\r | |
1212 | \r | |
c3c241f3 | 1213 | memset(data, 0x00, sizeof(data));\r |
1214 | memset(key, 0x00, sizeof(key));\r | |
1215 | int len = (resp.arg[1] > sizeof(data)) ? sizeof(data) : resp.arg[1];\r | |
1216 | \r | |
1217 | memcpy(data, resp.d.asBytes, len);\r | |
1218 | \r | |
1219 | uint64_t corr_uid = 0;\r | |
1220 | if ( memcmp(data, "\x00\x00\x00\x00", 4) == 0 ) {\r | |
1221 | corr_uid = (data[3] << 24) | (data[2] << 16) | (data[1] << 8) | data[0];\r | |
2b1f4228 | 1222 | tryMfk32(corr_uid, data, key);\r |
1223 | } else {\r | |
c3c241f3 | 1224 | corr_uid |= (uint64_t)data[2] << 48; \r |
1225 | corr_uid |= (uint64_t)data[1] << 40; \r | |
1226 | corr_uid |= (uint64_t)data[0] << 32;\r | |
1227 | corr_uid |= data[7] << 24;\r | |
1228 | corr_uid |= data[6] << 16;\r | |
1229 | corr_uid |= data[5] << 8;\r | |
1230 | corr_uid |= data[4];\r | |
2b1f4228 | 1231 | tryMfk64(corr_uid, data, key);\r |
c3c241f3 | 1232 | }\r |
c3c241f3 | 1233 | PrintAndLog("--");\r |
1234 | }\r | |
46cd801c | 1235 | }\r |
2b1f4228 | 1236 | \r |
baeaf579 | 1237 | return 0;\r |
9ca155ba M |
1238 | }\r |
1239 | \r | |
1240 | int CmdHF14AMfDbg(const char *Cmd)\r | |
1241 | {\r | |
8556b852 M |
1242 | int dbgMode = param_get32ex(Cmd, 0, 0, 10);\r |
1243 | if (dbgMode > 4) {\r | |
baeaf579 | 1244 | PrintAndLog("Max debug mode parameter is 4 \n");\r |
8556b852 M |
1245 | }\r |
1246 | \r | |
1247 | if (strlen(Cmd) < 1 || !param_getchar(Cmd, 0) || dbgMode > 4) {\r | |
9ca155ba M |
1248 | PrintAndLog("Usage: hf mf dbg <debug level>");\r |
1249 | PrintAndLog(" 0 - no debug messages");\r | |
1250 | PrintAndLog(" 1 - error messages");\r | |
b03c0f2d | 1251 | PrintAndLog(" 2 - plus information messages");\r |
1252 | PrintAndLog(" 3 - plus debug messages");\r | |
1253 | PrintAndLog(" 4 - print even debug messages in timing critical functions");\r | |
1254 | PrintAndLog(" Note: this option therefore may cause malfunction itself");\r | |
9ca155ba M |
1255 | return 0;\r |
1256 | } \r | |
1257 | \r | |
2285d9dd | 1258 | UsbCommand c = {CMD_MIFARE_SET_DBGMODE, {dbgMode, 0, 0}};\r |
1259 | SendCommand(&c);\r | |
8556b852 | 1260 | \r |
2285d9dd | 1261 | return 0;\r |
9ca155ba M |
1262 | }\r |
1263 | \r | |
1264 | int CmdHF14AMfEGet(const char *Cmd)\r | |
1265 | {\r | |
8556b852 | 1266 | uint8_t blockNo = 0;\r |
5ee70129 | 1267 | uint8_t data[16] = {0x00};\r |
8556b852 M |
1268 | \r |
1269 | if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {\r | |
1270 | PrintAndLog("Usage: hf mf eget <block number>");\r | |
1271 | PrintAndLog(" sample: hf mf eget 0 ");\r | |
1272 | return 0;\r | |
1273 | } \r | |
1274 | \r | |
1275 | blockNo = param_get8(Cmd, 0);\r | |
8556b852 M |
1276 | \r |
1277 | PrintAndLog(" ");\r | |
baeaf579 | 1278 | if (!mfEmlGetMem(data, blockNo, 1)) {\r |
1279 | PrintAndLog("data[%3d]:%s", blockNo, sprint_hex(data, 16));\r | |
8556b852 M |
1280 | } else {\r |
1281 | PrintAndLog("Command execute timeout");\r | |
1282 | }\r | |
1283 | \r | |
1284 | return 0;\r | |
1285 | }\r | |
1286 | \r | |
1287 | int CmdHF14AMfEClear(const char *Cmd)\r | |
1288 | {\r | |
1289 | if (param_getchar(Cmd, 0) == 'h') {\r | |
1290 | PrintAndLog("Usage: hf mf eclr");\r | |
1291 | PrintAndLog("It set card emulator memory to empty data blocks and key A/B FFFFFFFFFFFF \n");\r | |
1292 | return 0;\r | |
1293 | } \r | |
1294 | \r | |
2285d9dd | 1295 | UsbCommand c = {CMD_MIFARE_EML_MEMCLR, {0, 0, 0}};\r |
1296 | SendCommand(&c);\r | |
1297 | return 0;\r | |
9ca155ba M |
1298 | }\r |
1299 | \r | |
1300 | int CmdHF14AMfESet(const char *Cmd)\r | |
1301 | {\r | |
8556b852 M |
1302 | uint8_t memBlock[16];\r |
1303 | uint8_t blockNo = 0;\r | |
1304 | \r | |
1305 | memset(memBlock, 0x00, sizeof(memBlock));\r | |
1306 | \r | |
1307 | if (strlen(Cmd) < 3 || param_getchar(Cmd, 0) == 'h') {\r | |
1308 | PrintAndLog("Usage: hf mf eset <block number> <block data (32 hex symbols)>");\r | |
1309 | PrintAndLog(" sample: hf mf eset 1 000102030405060708090a0b0c0d0e0f ");\r | |
1310 | return 0;\r | |
1311 | } \r | |
1312 | \r | |
1313 | blockNo = param_get8(Cmd, 0);\r | |
8556b852 M |
1314 | \r |
1315 | if (param_gethex(Cmd, 1, memBlock, 32)) {\r | |
1316 | PrintAndLog("block data must include 32 HEX symbols");\r | |
1317 | return 1;\r | |
1318 | }\r | |
1319 | \r | |
1320 | // 1 - blocks count\r | |
baeaf579 | 1321 | UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNo, 1, 0}};\r |
8556b852 | 1322 | memcpy(c.d.asBytes, memBlock, 16);\r |
baeaf579 | 1323 | SendCommand(&c);\r |
1324 | return 0;\r | |
9ca155ba M |
1325 | }\r |
1326 | \r | |
1327 | int CmdHF14AMfELoad(const char *Cmd)\r | |
1328 | {\r | |
ab8b654e | 1329 | FILE * f;\r |
b915fda3 | 1330 | char filename[FILE_PATH_SIZE];\r |
baeaf579 | 1331 | char *fnameptr = filename;\r |
5ee70129 | 1332 | char buf[64] = {0x00};\r |
1333 | uint8_t buf8[64] = {0x00};\r | |
b915fda3 | 1334 | int i, len, blockNum, numBlocks;\r |
1335 | int nameParamNo = 1;\r | |
0de8e387 | 1336 | uint8_t blockWidth = 32;\r |
b915fda3 | 1337 | char ctmp = param_getchar(Cmd, 0);\r |
1338 | \r | |
2285d9dd | 1339 | if ( ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) {\r |
ab8b654e | 1340 | PrintAndLog("It loads emul dump from the file `filename.eml`");\r |
2b1f4228 | 1341 | PrintAndLog("Usage: hf mf eload [card memory] <file name w/o `.eml`> [numblocks]");\r |
0de8e387 | 1342 | PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K, u = UL");\r |
b915fda3 | 1343 | PrintAndLog("");\r |
ab8b654e | 1344 | PrintAndLog(" sample: hf mf eload filename");\r |
b915fda3 | 1345 | PrintAndLog(" hf mf eload 4 filename");\r |
ab8b654e M |
1346 | return 0;\r |
1347 | } \r | |
1348 | \r | |
b915fda3 | 1349 | switch (ctmp) {\r |
1350 | case '0' : numBlocks = 5*4; break;\r | |
1351 | case '1' : \r | |
1352 | case '\0': numBlocks = 16*4; break;\r | |
1353 | case '2' : numBlocks = 32*4; break;\r | |
1354 | case '4' : numBlocks = 256; break;\r | |
2b1f4228 | 1355 | case 'U' : // fall through\r |
1356 | case 'u' : numBlocks = 255; blockWidth = 8; break;\r | |
b915fda3 | 1357 | default: {\r |
1358 | numBlocks = 16*4;\r | |
1359 | nameParamNo = 0;\r | |
1360 | }\r | |
1361 | }\r | |
2b1f4228 | 1362 | uint32_t numblk2 = param_get32ex(Cmd,2,0,10);\r |
1363 | if (numblk2 > 0) numBlocks = numblk2; \r | |
b915fda3 | 1364 | \r |
1365 | len = param_getstr(Cmd,nameParamNo,filename);\r | |
1366 | \r | |
46cd801c | 1367 | if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;\r |
ab8b654e | 1368 | \r |
d23f3f2c | 1369 | fnameptr += len;\r |
ab8b654e M |
1370 | \r |
1371 | sprintf(fnameptr, ".eml"); \r | |
1372 | \r | |
1373 | // open file\r | |
1374 | f = fopen(filename, "r");\r | |
1375 | if (f == NULL) {\r | |
3fe4ff4f | 1376 | PrintAndLog("File %s not found or locked", filename);\r |
ab8b654e M |
1377 | return 1;\r |
1378 | }\r | |
1379 | \r | |
1380 | blockNum = 0;\r | |
1381 | while(!feof(f)){\r | |
1382 | memset(buf, 0, sizeof(buf));\r | |
b915fda3 | 1383 | \r |
759c16b3 | 1384 | if (fgets(buf, sizeof(buf), f) == NULL) {\r |
b915fda3 | 1385 | \r |
1386 | if (blockNum >= numBlocks) break;\r | |
1387 | \r | |
d2f487af | 1388 | PrintAndLog("File reading error.");\r |
97d582a6 | 1389 | fclose(f);\r |
759c16b3 | 1390 | return 2;\r |
baeaf579 | 1391 | }\r |
b915fda3 | 1392 | \r |
0de8e387 | 1393 | if (strlen(buf) < blockWidth){\r |
aea4d766 | 1394 | if(strlen(buf) && feof(f))\r |
1395 | break;\r | |
0de8e387 | 1396 | PrintAndLog("File content error. Block data must include %d HEX symbols", blockWidth);\r |
97d582a6 | 1397 | fclose(f);\r |
ab8b654e M |
1398 | return 2;\r |
1399 | }\r | |
b915fda3 | 1400 | \r |
0de8e387 | 1401 | for (i = 0; i < blockWidth; i += 2) {\r |
baeaf579 | 1402 | sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]);\r |
baeaf579 | 1403 | }\r |
0de8e387 | 1404 | if (mfEmlSetMem_xt(buf8, blockNum, 1, blockWidth/2)) {\r |
baeaf579 | 1405 | PrintAndLog("Cant set emul block: %3d", blockNum);\r |
97d582a6 | 1406 | fclose(f);\r |
ab8b654e M |
1407 | return 3;\r |
1408 | }\r | |
5ee70129 | 1409 | printf(".");\r |
ab8b654e M |
1410 | blockNum++;\r |
1411 | \r | |
b915fda3 | 1412 | if (blockNum >= numBlocks) break;\r |
ab8b654e M |
1413 | }\r |
1414 | fclose(f);\r | |
5ee70129 | 1415 | printf("\n");\r |
ab8b654e | 1416 | \r |
b915fda3 | 1417 | if ((blockNum != numBlocks)) {\r |
1418 | PrintAndLog("File content error. Got %d must be %d blocks.",blockNum, numBlocks);\r | |
ab8b654e M |
1419 | return 4;\r |
1420 | }\r | |
d2f487af | 1421 | PrintAndLog("Loaded %d blocks from file: %s", blockNum, filename);\r |
baeaf579 | 1422 | return 0;\r |
9ca155ba M |
1423 | }\r |
1424 | \r | |
1425 | int CmdHF14AMfESave(const char *Cmd)\r | |
1426 | {\r | |
ab8b654e | 1427 | FILE * f;\r |
b915fda3 | 1428 | char filename[FILE_PATH_SIZE];\r |
ab8b654e M |
1429 | char * fnameptr = filename;\r |
1430 | uint8_t buf[64];\r | |
b915fda3 | 1431 | int i, j, len, numBlocks;\r |
1432 | int nameParamNo = 1;\r | |
ab8b654e M |
1433 | \r |
1434 | memset(filename, 0, sizeof(filename));\r | |
1435 | memset(buf, 0, sizeof(buf));\r | |
1436 | \r | |
b915fda3 | 1437 | char ctmp = param_getchar(Cmd, 0);\r |
1438 | \r | |
1439 | if ( ctmp == 'h' || ctmp == 'H') {\r | |
ab8b654e | 1440 | PrintAndLog("It saves emul dump into the file `filename.eml` or `cardID.eml`");\r |
b915fda3 | 1441 | PrintAndLog(" Usage: hf mf esave [card memory] [file name w/o `.eml`]");\r |
1442 | PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");\r | |
1443 | PrintAndLog("");\r | |
ab8b654e | 1444 | PrintAndLog(" sample: hf mf esave ");\r |
b915fda3 | 1445 | PrintAndLog(" hf mf esave 4");\r |
1446 | PrintAndLog(" hf mf esave 4 filename");\r | |
ab8b654e M |
1447 | return 0;\r |
1448 | } \r | |
1449 | \r | |
b915fda3 | 1450 | switch (ctmp) {\r |
1451 | case '0' : numBlocks = 5*4; break;\r | |
1452 | case '1' : \r | |
1453 | case '\0': numBlocks = 16*4; break;\r | |
1454 | case '2' : numBlocks = 32*4; break;\r | |
1455 | case '4' : numBlocks = 256; break;\r | |
1456 | default: {\r | |
1457 | numBlocks = 16*4;\r | |
1458 | nameParamNo = 0;\r | |
1459 | }\r | |
1460 | }\r | |
1461 | \r | |
1462 | len = param_getstr(Cmd,nameParamNo,filename);\r | |
1463 | \r | |
46cd801c | 1464 | if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;\r |
ab8b654e | 1465 | \r |
b915fda3 | 1466 | // user supplied filename?\r |
ab8b654e | 1467 | if (len < 1) {\r |
b915fda3 | 1468 | // get filename (UID from memory)\r |
ab8b654e | 1469 | if (mfEmlGetMem(buf, 0, 1)) {\r |
b915fda3 | 1470 | PrintAndLog("Can\'t get UID from block: %d", 0);\r |
0b14440d | 1471 | len = sprintf(fnameptr, "dump");\r |
d23f3f2c | 1472 | fnameptr += len;\r |
1473 | }\r | |
1474 | else {\r | |
1475 | for (j = 0; j < 7; j++, fnameptr += 2)\r | |
0b14440d | 1476 | sprintf(fnameptr, "%02X", buf[j]);\r |
ab8b654e | 1477 | }\r |
ab8b654e | 1478 | } else {\r |
d23f3f2c | 1479 | fnameptr += len;\r |
ab8b654e M |
1480 | }\r |
1481 | \r | |
b915fda3 | 1482 | // add file extension\r |
ab8b654e M |
1483 | sprintf(fnameptr, ".eml"); \r |
1484 | \r | |
1485 | // open file\r | |
1486 | f = fopen(filename, "w+");\r | |
1487 | \r | |
b915fda3 | 1488 | if ( !f ) {\r |
1489 | PrintAndLog("Can't open file %s ", filename);\r | |
1490 | return 1;\r | |
1491 | }\r | |
1492 | \r | |
ab8b654e | 1493 | // put hex\r |
b915fda3 | 1494 | for (i = 0; i < numBlocks; i++) {\r |
ab8b654e M |
1495 | if (mfEmlGetMem(buf, i, 1)) {\r |
1496 | PrintAndLog("Cant get block: %d", i);\r | |
1497 | break;\r | |
1498 | }\r | |
1499 | for (j = 0; j < 16; j++)\r | |
3fe4ff4f | 1500 | fprintf(f, "%02X", buf[j]); \r |
ab8b654e M |
1501 | fprintf(f,"\n");\r |
1502 | }\r | |
1503 | fclose(f);\r | |
1504 | \r | |
b915fda3 | 1505 | PrintAndLog("Saved %d blocks to file: %s", numBlocks, filename);\r |
ab8b654e | 1506 | \r |
9ca155ba M |
1507 | return 0;\r |
1508 | }\r | |
1509 | \r | |
26fdb4ab | 1510 | int CmdHF14AMfECFill(const char *Cmd)\r |
1511 | {\r | |
8556b852 | 1512 | uint8_t keyType = 0;\r |
baeaf579 | 1513 | uint8_t numSectors = 16;\r |
1514 | \r | |
8556b852 | 1515 | if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {\r |
baeaf579 | 1516 | PrintAndLog("Usage: hf mf ecfill <key A/B> [card memory]");\r |
1517 | PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");\r | |
1518 | PrintAndLog("");\r | |
1519 | PrintAndLog("samples: hf mf ecfill A");\r | |
1520 | PrintAndLog(" hf mf ecfill A 4");\r | |
1521 | PrintAndLog("Read card and transfer its data to emulator memory.");\r | |
1522 | PrintAndLog("Keys must be laid in the emulator memory. \n");\r | |
8556b852 M |
1523 | return 0;\r |
1524 | } \r | |
1525 | \r | |
1526 | char ctmp = param_getchar(Cmd, 0);\r | |
baeaf579 | 1527 | if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {\r |
8556b852 M |
1528 | PrintAndLog("Key type must be A or B");\r |
1529 | return 1;\r | |
1530 | }\r | |
1531 | if (ctmp != 'A' && ctmp != 'a') keyType = 1;\r | |
1532 | \r | |
baeaf579 | 1533 | ctmp = param_getchar(Cmd, 1);\r |
1534 | switch (ctmp) {\r | |
1535 | case '0' : numSectors = 5; break;\r | |
1536 | case '1' : \r | |
1537 | case '\0': numSectors = 16; break;\r | |
1538 | case '2' : numSectors = 32; break;\r | |
1539 | case '4' : numSectors = 40; break;\r | |
1540 | default: numSectors = 16;\r | |
1541 | } \r | |
1542 | \r | |
1543 | printf("--params: numSectors: %d, keyType:%d", numSectors, keyType);\r | |
1544 | UsbCommand c = {CMD_MIFARE_EML_CARDLOAD, {numSectors, keyType, 0}};\r | |
1545 | SendCommand(&c);\r | |
1546 | return 0;\r | |
8556b852 M |
1547 | }\r |
1548 | \r | |
26fdb4ab | 1549 | int CmdHF14AMfEKeyPrn(const char *Cmd)\r |
1550 | {\r | |
baeaf579 | 1551 | int i;\r |
b915fda3 | 1552 | uint8_t numSectors;\r |
8556b852 M |
1553 | uint8_t data[16];\r |
1554 | uint64_t keyA, keyB;\r | |
2285d9dd | 1555 | \r |
1556 | char cmdp = param_getchar(Cmd, 0);\r | |
8556b852 | 1557 | \r |
2285d9dd | 1558 | if ( cmdp == 'h' || cmdp == 'H' ) {\r |
b915fda3 | 1559 | PrintAndLog("It prints the keys loaded in the emulator memory");\r |
1560 | PrintAndLog("Usage: hf mf ekeyprn [card memory]");\r | |
1561 | PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");\r | |
1562 | PrintAndLog("");\r | |
1563 | PrintAndLog(" sample: hf mf ekeyprn 1");\r | |
1564 | return 0;\r | |
1565 | } \r | |
1566 | \r | |
b915fda3 | 1567 | switch (cmdp) {\r |
1568 | case '0' : numSectors = 5; break;\r | |
1569 | case '1' : \r | |
1570 | case '\0': numSectors = 16; break;\r | |
1571 | case '2' : numSectors = 32; break;\r | |
1572 | case '4' : numSectors = 40; break;\r | |
1573 | default: numSectors = 16;\r | |
1574 | } \r | |
1575 | \r | |
8556b852 M |
1576 | PrintAndLog("|---|----------------|----------------|");\r |
1577 | PrintAndLog("|sec|key A |key B |");\r | |
1578 | PrintAndLog("|---|----------------|----------------|");\r | |
b915fda3 | 1579 | for (i = 0; i < numSectors; i++) {\r |
baeaf579 | 1580 | if (mfEmlGetMem(data, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1)) {\r |
1581 | PrintAndLog("error get block %d", FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1);\r | |
8556b852 M |
1582 | break;\r |
1583 | }\r | |
1584 | keyA = bytes_to_num(data, 6);\r | |
1585 | keyB = bytes_to_num(data + 10, 6);\r | |
125a98a1 | 1586 | PrintAndLog("|%03d| %012"llx" | %012"llx" |", i, keyA, keyB);\r |
8556b852 M |
1587 | }\r |
1588 | PrintAndLog("|---|----------------|----------------|");\r | |
1589 | \r | |
1590 | return 0;\r | |
1591 | }\r | |
1592 | \r | |
0675f200 M |
1593 | int CmdHF14AMfCSetUID(const char *Cmd)\r |
1594 | {\r | |
1595 | uint8_t wipeCard = 0;\r | |
3fe4ff4f | 1596 | uint8_t uid[8] = {0x00};\r |
1597 | uint8_t oldUid[8] = {0x00};\r | |
3bba7dea JH |
1598 | uint8_t atqa[2] = {0x00};\r |
1599 | uint8_t sak[1] = {0x00};\r | |
1600 | uint8_t atqaPresent = 1;\r | |
0675f200 | 1601 | int res;\r |
3bba7dea JH |
1602 | char ctmp;\r |
1603 | int argi=0;\r | |
1604 | \r | |
1605 | if (strlen(Cmd) < 1 || param_getchar(Cmd, argi) == 'h') {\r | |
1606 | PrintAndLog("Usage: hf mf csetuid <UID 8 hex symbols> [ATQA 4 hex symbols SAK 2 hex symbols] [w]");\r | |
1607 | PrintAndLog("sample: hf mf csetuid 01020304");\r | |
1608 | PrintAndLog("sample: hf mf csetuid 01020304 0004 08 w");\r | |
1609 | PrintAndLog("Set UID, ATQA, and SAK for magic Chinese card (only works with such cards)");\r | |
1610 | PrintAndLog("If you also want to wipe the card then add 'w' at the end of the command line.");\r | |
0675f200 | 1611 | return 0;\r |
3bba7dea | 1612 | }\r |
0675f200 | 1613 | \r |
3bba7dea | 1614 | if (param_getchar(Cmd, argi) && param_gethex(Cmd, argi, uid, 8)) {\r |
0675f200 M |
1615 | PrintAndLog("UID must include 8 HEX symbols");\r |
1616 | return 1;\r | |
1617 | }\r | |
3bba7dea JH |
1618 | argi++;\r |
1619 | \r | |
1620 | ctmp = param_getchar(Cmd, argi);\r | |
1621 | if (ctmp == 'w' || ctmp == 'W') {\r | |
1622 | wipeCard = 1;\r | |
1623 | atqaPresent = 0;\r | |
1624 | }\r | |
1625 | \r | |
1626 | if (atqaPresent) {\r | |
1627 | if (param_getchar(Cmd, argi)) {\r | |
1628 | if (param_gethex(Cmd, argi, atqa, 4)) {\r | |
1629 | PrintAndLog("ATQA must include 4 HEX symbols");\r | |
1630 | return 1;\r | |
1631 | }\r | |
1632 | argi++;\r | |
1633 | if (!param_getchar(Cmd, argi) || param_gethex(Cmd, argi, sak, 2)) {\r | |
1634 | PrintAndLog("SAK must include 2 HEX symbols");\r | |
1635 | return 1;\r | |
1636 | }\r | |
1637 | argi++;\r | |
1638 | } else\r | |
1639 | atqaPresent = 0;\r | |
1640 | }\r | |
1641 | \r | |
1642 | if(!wipeCard) {\r | |
1643 | ctmp = param_getchar(Cmd, argi);\r | |
1644 | if (ctmp == 'w' || ctmp == 'W') {\r | |
1645 | wipeCard = 1;\r | |
1646 | }\r | |
1647 | }\r | |
0675f200 | 1648 | \r |
e3c23565 | 1649 | PrintAndLog("--wipe card:%s uid:%s", (wipeCard)?"YES":"NO", sprint_hex(uid, 4));\r |
0675f200 | 1650 | \r |
3bba7dea | 1651 | res = mfCSetUID(uid, (atqaPresent)?atqa:NULL, (atqaPresent)?sak:NULL, oldUid, wipeCard);\r |
0675f200 M |
1652 | if (res) {\r |
1653 | PrintAndLog("Can't set UID. error=%d", res);\r | |
1654 | return 1;\r | |
1655 | }\r | |
1656 | \r | |
1657 | PrintAndLog("old UID:%s", sprint_hex(oldUid, 4));\r | |
3fe4ff4f | 1658 | PrintAndLog("new UID:%s", sprint_hex(uid, 4));\r |
0675f200 M |
1659 | return 0;\r |
1660 | }\r | |
1661 | \r | |
1662 | int CmdHF14AMfCSetBlk(const char *Cmd)\r | |
1663 | {\r | |
0956e0db | 1664 | uint8_t block[16] = {0x00};\r |
f774db95 | 1665 | uint8_t blockNo = 0;\r |
c2731f37 | 1666 | uint8_t params = MAGIC_SINGLE;\r |
f774db95 | 1667 | int res;\r |
f774db95 M |
1668 | \r |
1669 | if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {\r | |
664f6586 | 1670 | PrintAndLog("Usage: hf mf csetblk <block number> <block data (32 hex symbols)> [w]");\r |
f774db95 | 1671 | PrintAndLog("sample: hf mf csetblk 1 01020304050607080910111213141516");\r |
664f6586 | 1672 | PrintAndLog("Set block data for magic Chinese card (only works with such cards)");\r |
1673 | PrintAndLog("If you also want wipe the card then add 'w' at the end of the command line");\r | |
f774db95 M |
1674 | return 0;\r |
1675 | } \r | |
1676 | \r | |
1677 | blockNo = param_get8(Cmd, 0);\r | |
f774db95 | 1678 | \r |
0956e0db | 1679 | if (param_gethex(Cmd, 1, block, 32)) {\r |
f774db95 M |
1680 | PrintAndLog("block data must include 32 HEX symbols");\r |
1681 | return 1;\r | |
1682 | }\r | |
1683 | \r | |
664f6586 | 1684 | char ctmp = param_getchar(Cmd, 2);\r |
c2731f37 | 1685 | if (ctmp == 'w' || ctmp == 'W')\r |
1686 | params |= MAGIC_WIPE;\r | |
1687 | \r | |
0956e0db | 1688 | PrintAndLog("--block number:%2d data:%s", blockNo, sprint_hex(block, 16));\r |
f774db95 | 1689 | \r |
0956e0db | 1690 | res = mfCSetBlock(blockNo, block, NULL, params);\r |
f774db95 | 1691 | if (res) {\r |
664f6586 | 1692 | PrintAndLog("Can't write block. error=%d", res);\r |
1693 | return 1;\r | |
1694 | }\r | |
0675f200 M |
1695 | return 0;\r |
1696 | }\r | |
1697 | \r | |
1698 | int CmdHF14AMfCLoad(const char *Cmd)\r | |
1699 | {\r | |
208a0166 | 1700 | FILE * f;\r |
c2731f37 | 1701 | char filename[FILE_PATH_SIZE];\r |
208a0166 | 1702 | char * fnameptr = filename;\r |
b915fda3 | 1703 | char buf[64] = {0x00};\r |
1704 | uint8_t buf8[64] = {0x00};\r | |
208a0166 | 1705 | uint8_t fillFromEmulator = 0;\r |
9f7bbd24 | 1706 | int i, len, blockNum, flags=0;\r |
2285d9dd | 1707 | \r |
c2731f37 | 1708 | memset(filename, 0, sizeof(filename));\r |
1709 | \r | |
2285d9dd | 1710 | char ctmp = param_getchar(Cmd, 0);\r |
208a0166 | 1711 | \r |
2285d9dd | 1712 | if (ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) {\r |
e3c23565 | 1713 | PrintAndLog("It loads magic Chinese card from the file `filename.eml`");\r |
208a0166 M |
1714 | PrintAndLog("or from emulator memory (option `e`)");\r |
1715 | PrintAndLog("Usage: hf mf cload <file name w/o `.eml`>");\r | |
1716 | PrintAndLog(" or: hf mf cload e ");\r | |
1717 | PrintAndLog(" sample: hf mf cload filename");\r | |
1718 | return 0;\r | |
1719 | } \r | |
1720 | \r | |
208a0166 M |
1721 | if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;\r |
1722 | \r | |
1723 | if (fillFromEmulator) {\r | |
208a0166 M |
1724 | for (blockNum = 0; blockNum < 16 * 4; blockNum += 1) {\r |
1725 | if (mfEmlGetMem(buf8, blockNum, 1)) {\r | |
1726 | PrintAndLog("Cant get block: %d", blockNum);\r | |
1727 | return 2;\r | |
1728 | }\r | |
c2731f37 | 1729 | if (blockNum == 0) flags = MAGIC_INIT + MAGIC_WUPC; // switch on field and send magic sequence\r |
16a95d76 | 1730 | if (blockNum == 1) flags = 0; // just write\r |
c2731f37 | 1731 | if (blockNum == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF; // Done. Magic Halt and switch off field.\r |
208a0166 | 1732 | \r |
c2731f37 | 1733 | if (mfCSetBlock(blockNum, buf8, NULL, flags)) {\r |
208a0166 M |
1734 | PrintAndLog("Cant set magic card block: %d", blockNum);\r |
1735 | return 3;\r | |
1736 | }\r | |
1737 | }\r | |
1738 | return 0;\r | |
1739 | } else {\r | |
1740 | len = strlen(Cmd);\r | |
46cd801c | 1741 | if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;\r |
208a0166 M |
1742 | \r |
1743 | memcpy(filename, Cmd, len);\r | |
d23f3f2c | 1744 | fnameptr += len;\r |
208a0166 M |
1745 | \r |
1746 | sprintf(fnameptr, ".eml"); \r | |
1747 | \r | |
1748 | // open file\r | |
1749 | f = fopen(filename, "r");\r | |
1750 | if (f == NULL) {\r | |
1751 | PrintAndLog("File not found or locked.");\r | |
1752 | return 1;\r | |
1753 | }\r | |
1754 | \r | |
1755 | blockNum = 0;\r | |
208a0166 | 1756 | while(!feof(f)){\r |
e3c23565 | 1757 | \r |
208a0166 | 1758 | memset(buf, 0, sizeof(buf));\r |
e3c23565 | 1759 | \r |
759c16b3 | 1760 | if (fgets(buf, sizeof(buf), f) == NULL) {\r |
e6432f05 | 1761 | fclose(f);\r |
baeaf579 | 1762 | PrintAndLog("File reading error.");\r |
1763 | return 2;\r | |
1764 | }\r | |
208a0166 | 1765 | \r |
16a95d76 | 1766 | if (strlen(buf) < 32) {\r |
208a0166 M |
1767 | if(strlen(buf) && feof(f))\r |
1768 | break;\r | |
1769 | PrintAndLog("File content error. Block data must include 32 HEX symbols");\r | |
664bb5ae | 1770 | fclose(f);\r |
208a0166 M |
1771 | return 2;\r |
1772 | }\r | |
1773 | for (i = 0; i < 32; i += 2)\r | |
1774 | sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]);\r | |
1775 | \r | |
c2731f37 | 1776 | if (blockNum == 0) flags = MAGIC_INIT + MAGIC_WUPC; // switch on field and send magic sequence\r |
16a95d76 | 1777 | if (blockNum == 1) flags = 0; // just write\r |
c2731f37 | 1778 | if (blockNum == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF; // Done. Switch off field.\r |
208a0166 | 1779 | \r |
c2731f37 | 1780 | if (mfCSetBlock(blockNum, buf8, NULL, flags)) {\r |
baeaf579 | 1781 | PrintAndLog("Can't set magic card block: %d", blockNum);\r |
208a0166 M |
1782 | return 3;\r |
1783 | }\r | |
1784 | blockNum++;\r | |
1785 | \r | |
1786 | if (blockNum >= 16 * 4) break; // magic card type - mifare 1K\r | |
1787 | }\r | |
1788 | fclose(f);\r | |
1789 | \r | |
c2731f37 | 1790 | // 64 or 256blocks.\r |
b915fda3 | 1791 | if (blockNum != 16 * 4 && blockNum != 32 * 4 + 8 * 16){\r |
208a0166 M |
1792 | PrintAndLog("File content error. There must be 64 blocks");\r |
1793 | return 4;\r | |
1794 | }\r | |
1795 | PrintAndLog("Loaded from file: %s", filename);\r | |
1796 | return 0;\r | |
1797 | }\r | |
e3c23565 | 1798 | return 0;\r |
0675f200 M |
1799 | }\r |
1800 | \r | |
545a1f38 | 1801 | int CmdHF14AMfCGetBlk(const char *Cmd) {\r |
c2731f37 | 1802 | uint8_t data[16];\r |
545a1f38 M |
1803 | uint8_t blockNo = 0;\r |
1804 | int res;\r | |
c2731f37 | 1805 | memset(data, 0x00, sizeof(data));\r |
1806 | char ctmp = param_getchar(Cmd, 0);\r | |
545a1f38 | 1807 | \r |
c2731f37 | 1808 | if (strlen(Cmd) < 1 || ctmp == 'h' || ctmp == 'H') {\r |
545a1f38 M |
1809 | PrintAndLog("Usage: hf mf cgetblk <block number>");\r |
1810 | PrintAndLog("sample: hf mf cgetblk 1");\r | |
664f6586 | 1811 | PrintAndLog("Get block data from magic Chinese card (only works with such cards)\n");\r |
545a1f38 M |
1812 | return 0;\r |
1813 | } \r | |
1814 | \r | |
1815 | blockNo = param_get8(Cmd, 0);\r | |
545a1f38 | 1816 | \r |
baeaf579 | 1817 | PrintAndLog("--block number:%2d ", blockNo);\r |
545a1f38 | 1818 | \r |
c2731f37 | 1819 | res = mfCGetBlock(blockNo, data, MAGIC_SINGLE);\r |
545a1f38 | 1820 | if (res) {\r |
c2731f37 | 1821 | PrintAndLog("Can't read block. error=%d", res);\r |
1822 | return 1;\r | |
1823 | }\r | |
545a1f38 | 1824 | \r |
2b1f4228 | 1825 | PrintAndLog("data: %s", sprint_hex(data, sizeof(data)));\r |
545a1f38 M |
1826 | return 0;\r |
1827 | }\r | |
1828 | \r | |
1829 | int CmdHF14AMfCGetSc(const char *Cmd) {\r | |
c2731f37 | 1830 | uint8_t data[16];\r |
545a1f38 M |
1831 | uint8_t sectorNo = 0;\r |
1832 | int i, res, flags;\r | |
c2731f37 | 1833 | memset(data, 0x00, sizeof(data));\r |
1834 | char ctmp = param_getchar(Cmd, 0);\r | |
1835 | \r | |
1836 | if (strlen(Cmd) < 1 || ctmp == 'h' || ctmp == 'H') {\r | |
545a1f38 M |
1837 | PrintAndLog("Usage: hf mf cgetsc <sector number>");\r |
1838 | PrintAndLog("sample: hf mf cgetsc 0");\r | |
664f6586 | 1839 | PrintAndLog("Get sector data from magic Chinese card (only works with such cards)\n");\r |
545a1f38 M |
1840 | return 0;\r |
1841 | } \r | |
1842 | \r | |
1843 | sectorNo = param_get8(Cmd, 0);\r | |
1844 | if (sectorNo > 15) {\r | |
1845 | PrintAndLog("Sector number must be in [0..15] as in MIFARE classic.");\r | |
1846 | return 1;\r | |
1847 | }\r | |
1848 | \r | |
baeaf579 | 1849 | PrintAndLog("--sector number:%d ", sectorNo);\r |
c2731f37 | 1850 | PrintAndLog("block | data");\r |
545a1f38 | 1851 | \r |
c2731f37 | 1852 | flags = MAGIC_INIT + MAGIC_WUPC;\r |
545a1f38 M |
1853 | for (i = 0; i < 4; i++) {\r |
1854 | if (i == 1) flags = 0;\r | |
c2731f37 | 1855 | if (i == 3) flags = MAGIC_HALT + MAGIC_OFF;\r |
545a1f38 | 1856 | \r |
c2731f37 | 1857 | res = mfCGetBlock(sectorNo * 4 + i, data, flags);\r |
545a1f38 | 1858 | if (res) {\r |
baeaf579 | 1859 | PrintAndLog("Can't read block. %d error=%d", sectorNo * 4 + i, res);\r |
545a1f38 | 1860 | return 1;\r |
c2731f37 | 1861 | } \r |
1862 | PrintAndLog(" %3d | %s", sectorNo * 4 + i, sprint_hex(data, sizeof(data)));\r | |
545a1f38 M |
1863 | }\r |
1864 | return 0;\r | |
1865 | }\r | |
1866 | \r | |
1867 | int CmdHF14AMfCSave(const char *Cmd) {\r | |
1868 | \r | |
1869 | FILE * f;\r | |
c2731f37 | 1870 | char filename[FILE_PATH_SIZE];\r |
545a1f38 M |
1871 | char * fnameptr = filename;\r |
1872 | uint8_t fillFromEmulator = 0;\r | |
c2731f37 | 1873 | uint8_t buf[64];\r |
545a1f38 M |
1874 | int i, j, len, flags;\r |
1875 | \r | |
c2731f37 | 1876 | memset(filename, 0, sizeof(filename));\r |
1877 | memset(buf, 0, sizeof(buf));\r | |
2285d9dd | 1878 | char ctmp = param_getchar(Cmd, 0);\r |
1879 | \r | |
1880 | if ( ctmp == 'h' || ctmp == 'H' ) {\r | |
545a1f38 M |
1881 | PrintAndLog("It saves `magic Chinese` card dump into the file `filename.eml` or `cardID.eml`");\r |
1882 | PrintAndLog("or into emulator memory (option `e`)");\r | |
1883 | PrintAndLog("Usage: hf mf esave [file name w/o `.eml`][e]");\r | |
1884 | PrintAndLog(" sample: hf mf esave ");\r | |
1885 | PrintAndLog(" hf mf esave filename");\r | |
1886 | PrintAndLog(" hf mf esave e \n");\r | |
1887 | return 0;\r | |
1888 | } \r | |
545a1f38 M |
1889 | if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;\r |
1890 | \r | |
1891 | if (fillFromEmulator) {\r | |
1892 | // put into emulator\r | |
c2731f37 | 1893 | flags = MAGIC_INIT + MAGIC_WUPC;\r |
545a1f38 M |
1894 | for (i = 0; i < 16 * 4; i++) {\r |
1895 | if (i == 1) flags = 0;\r | |
c2731f37 | 1896 | if (i == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF;\r |
545a1f38 M |
1897 | \r |
1898 | if (mfCGetBlock(i, buf, flags)) {\r | |
1899 | PrintAndLog("Cant get block: %d", i);\r | |
1900 | break;\r | |
1901 | }\r | |
1902 | \r | |
1903 | if (mfEmlSetMem(buf, i, 1)) {\r | |
1904 | PrintAndLog("Cant set emul block: %d", i);\r | |
1905 | return 3;\r | |
1906 | }\r | |
1907 | }\r | |
1908 | return 0;\r | |
1909 | } else {\r | |
1910 | len = strlen(Cmd);\r | |
46cd801c | 1911 | if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;\r |
545a1f38 | 1912 | \r |
c2731f37 | 1913 | // get filename based on UID\r |
545a1f38 | 1914 | if (len < 1) {\r |
c2731f37 | 1915 | \r |
1916 | if (mfCGetBlock(0, buf, MAGIC_SINGLE)) {\r | |
545a1f38 | 1917 | PrintAndLog("Cant get block: %d", 0);\r |
d23f3f2c | 1918 | len = sprintf(fnameptr, "dump");\r |
1919 | fnameptr += len;\r | |
1920 | } else {\r | |
1921 | for (j = 0; j < 7; j++, fnameptr += 2)\r | |
1922 | sprintf(fnameptr, "%02x", buf[j]); \r | |
545a1f38 | 1923 | }\r |
545a1f38 M |
1924 | } else {\r |
1925 | memcpy(filename, Cmd, len);\r | |
1926 | fnameptr += len;\r | |
1927 | }\r | |
1928 | \r | |
c2731f37 | 1929 | // add .eml extension\r |
545a1f38 M |
1930 | sprintf(fnameptr, ".eml"); \r |
1931 | \r | |
1932 | // open file\r | |
1933 | f = fopen(filename, "w+");\r | |
1934 | \r | |
b915fda3 | 1935 | if (f == NULL) {\r |
1936 | PrintAndLog("File not found or locked.");\r | |
1937 | return 1;\r | |
1938 | }\r | |
1939 | \r | |
545a1f38 | 1940 | // put hex\r |
c2731f37 | 1941 | flags = MAGIC_INIT + MAGIC_WUPC;\r |
545a1f38 M |
1942 | for (i = 0; i < 16 * 4; i++) {\r |
1943 | if (i == 1) flags = 0;\r | |
c2731f37 | 1944 | if (i == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF;\r |
545a1f38 M |
1945 | \r |
1946 | if (mfCGetBlock(i, buf, flags)) {\r | |
1947 | PrintAndLog("Cant get block: %d", i);\r | |
1948 | break;\r | |
1949 | }\r | |
1950 | for (j = 0; j < 16; j++)\r | |
1951 | fprintf(f, "%02x", buf[j]); \r | |
1952 | fprintf(f,"\n");\r | |
1953 | }\r | |
c2731f37 | 1954 | fflush(f);\r |
545a1f38 | 1955 | fclose(f);\r |
545a1f38 | 1956 | PrintAndLog("Saved to file: %s", filename);\r |
545a1f38 M |
1957 | return 0;\r |
1958 | }\r | |
1959 | }\r | |
1960 | \r | |
b62a5a84 | 1961 | int CmdHF14AMfSniff(const char *Cmd){\r |
3fe4ff4f | 1962 | \r |
c948cbde M |
1963 | bool wantLogToFile = 0;\r |
1964 | bool wantDecrypt = 0;\r | |
eede7162 | 1965 | //bool wantSaveToEml = 0; TODO\r |
55acbb2a M |
1966 | bool wantSaveToEmlFile = 0;\r |
1967 | \r | |
1968 | //var \r | |
39864b0b M |
1969 | int res = 0;\r |
1970 | int len = 0;\r | |
1971 | int blockLen = 0;\r | |
39864b0b | 1972 | int pckNum = 0;\r |
f71f4deb | 1973 | int num = 0;\r |
1974 | uint8_t uid[7];\r | |
991f13f2 | 1975 | uint8_t uid_len;\r |
5ee70129 | 1976 | uint8_t atqa[2] = {0x00};\r |
39864b0b M |
1977 | uint8_t sak;\r |
1978 | bool isTag;\r | |
f71f4deb | 1979 | uint8_t *buf = NULL;\r |
1980 | uint16_t bufsize = 0;\r | |
1981 | uint8_t *bufPtr = NULL;\r | |
b62a5a84 | 1982 | \r |
e3c23565 | 1983 | char ctmp = param_getchar(Cmd, 0);\r |
1984 | if ( ctmp == 'h' || ctmp == 'H' ) {\r | |
baeaf579 | 1985 | PrintAndLog("It continuously gets data from the field and saves it to: log, emulator, emulator file.");\r |
55acbb2a M |
1986 | PrintAndLog("You can specify:");\r |
1987 | PrintAndLog(" l - save encrypted sequence to logfile `uid.log`");\r | |
1988 | PrintAndLog(" d - decrypt sequence and put it to log file `uid.log`");\r | |
1989 | PrintAndLog(" n/a e - decrypt sequence, collect read and write commands and save the result of the sequence to emulator memory");\r | |
3fe4ff4f | 1990 | PrintAndLog(" f - decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`");\r |
1991 | PrintAndLog("Usage: hf mf sniff [l][d][e][f]");\r | |
55acbb2a | 1992 | PrintAndLog(" sample: hf mf sniff l d e");\r |
b62a5a84 M |
1993 | return 0;\r |
1994 | } \r | |
1995 | \r | |
55acbb2a | 1996 | for (int i = 0; i < 4; i++) {\r |
e3c23565 | 1997 | ctmp = param_getchar(Cmd, i);\r |
55acbb2a M |
1998 | if (ctmp == 'l' || ctmp == 'L') wantLogToFile = true;\r |
1999 | if (ctmp == 'd' || ctmp == 'D') wantDecrypt = true;\r | |
eede7162 | 2000 | //if (ctmp == 'e' || ctmp == 'E') wantSaveToEml = true; TODO\r |
55acbb2a M |
2001 | if (ctmp == 'f' || ctmp == 'F') wantSaveToEmlFile = true;\r |
2002 | }\r | |
2003 | \r | |
39864b0b M |
2004 | printf("-------------------------------------------------------------------------\n");\r |
2005 | printf("Executing command. \n");\r | |
2006 | printf("Press the key on the proxmark3 device to abort both proxmark3 and client.\n");\r | |
2007 | printf("Press the key on pc keyboard to abort the client.\n");\r | |
2008 | printf("-------------------------------------------------------------------------\n");\r | |
2009 | \r | |
d714d3ef | 2010 | UsbCommand c = {CMD_MIFARE_SNIFFER, {0, 0, 0}};\r |
2011 | clearCommandBuffer();\r | |
2012 | SendCommand(&c);\r | |
b62a5a84 | 2013 | \r |
39864b0b M |
2014 | // wait cycle\r |
2015 | while (true) {\r | |
2016 | printf(".");\r | |
2017 | fflush(stdout);\r | |
2018 | if (ukbhit()) {\r | |
2019 | getchar();\r | |
2020 | printf("\naborted via keyboard!\n");\r | |
2021 | break;\r | |
2022 | }\r | |
2023 | \r | |
f71f4deb | 2024 | UsbCommand resp;\r |
2025 | if (WaitForResponseTimeout(CMD_ACK,&resp,2000)) {\r | |
902cb3c0 | 2026 | res = resp.arg[0] & 0xff;\r |
f71f4deb | 2027 | uint16_t traceLen = resp.arg[1];\r |
2028 | len = resp.arg[2];\r | |
2029 | \r | |
c46ea881 | 2030 | if (res == 0) {\r |
2031 | free(buf);\r | |
2032 | return 0; // we are done\r | |
2033 | }\r | |
f71f4deb | 2034 | \r |
2035 | if (res == 1) { // there is (more) data to be transferred\r | |
2036 | if (pckNum == 0) { // first packet, (re)allocate necessary buffer\r | |
2037 | if (traceLen > bufsize) {\r | |
2038 | uint8_t *p;\r | |
2039 | if (buf == NULL) { // not yet allocated\r | |
2040 | p = malloc(traceLen);\r | |
2041 | } else { // need more memory\r | |
2042 | p = realloc(buf, traceLen);\r | |
2043 | }\r | |
2044 | if (p == NULL) {\r | |
2045 | PrintAndLog("Cannot allocate memory for trace");\r | |
2046 | free(buf);\r | |
2047 | return 2;\r | |
2048 | }\r | |
2049 | buf = p;\r | |
2050 | }\r | |
39864b0b | 2051 | bufPtr = buf;\r |
f71f4deb | 2052 | bufsize = traceLen;\r |
2053 | memset(buf, 0x00, traceLen);\r | |
39864b0b | 2054 | }\r |
902cb3c0 | 2055 | memcpy(bufPtr, resp.d.asBytes, len);\r |
39864b0b M |
2056 | bufPtr += len;\r |
2057 | pckNum++;\r | |
2058 | }\r | |
f71f4deb | 2059 | \r |
2060 | if (res == 2) { // received all data, start displaying\r | |
39864b0b M |
2061 | blockLen = bufPtr - buf;\r |
2062 | bufPtr = buf;\r | |
2063 | printf(">\n");\r | |
2064 | PrintAndLog("received trace len: %d packages: %d", blockLen, pckNum);\r | |
6a1f2d82 | 2065 | while (bufPtr - buf < blockLen) {\r |
f71f4deb | 2066 | bufPtr += 6; // skip (void) timing information\r |
6a1f2d82 | 2067 | len = *((uint16_t *)bufPtr);\r |
2068 | if(len & 0x8000) {\r | |
2069 | isTag = true;\r | |
2070 | len &= 0x7fff;\r | |
2071 | } else {\r | |
2072 | isTag = false;\r | |
2073 | }\r | |
2074 | bufPtr += 2;\r | |
2075 | if ((len == 14) && (bufPtr[0] == 0xff) && (bufPtr[1] == 0xff) && (bufPtr[12] == 0xff) && (bufPtr[13] == 0xff)) {\r | |
39864b0b M |
2076 | memcpy(uid, bufPtr + 2, 7);\r |
2077 | memcpy(atqa, bufPtr + 2 + 7, 2);\r | |
991f13f2 | 2078 | uid_len = (atqa[0] & 0xC0) == 0x40 ? 7 : 4;\r |
39864b0b | 2079 | sak = bufPtr[11];\r |
991f13f2 | 2080 | PrintAndLog("tag select uid:%s atqa:0x%02x%02x sak:0x%02x", \r |
2081 | sprint_hex(uid + (7 - uid_len), uid_len),\r | |
2082 | atqa[1], \r | |
2083 | atqa[0], \r | |
2084 | sak);\r | |
d714d3ef | 2085 | if (wantLogToFile || wantDecrypt) {\r |
991f13f2 | 2086 | FillFileNameByUID(logHexFileName, uid + (7 - uid_len), ".log", uid_len);\r |
55acbb2a M |
2087 | AddLogCurrentDT(logHexFileName);\r |
2088 | } \r | |
3fe4ff4f | 2089 | if (wantDecrypt) \r |
2090 | mfTraceInit(uid, atqa, sak, wantSaveToEmlFile);\r | |
39864b0b M |
2091 | } else {\r |
2092 | PrintAndLog("%s(%d):%s", isTag ? "TAG":"RDR", num, sprint_hex(bufPtr, len));\r | |
3fe4ff4f | 2093 | if (wantLogToFile) \r |
2094 | AddLogHex(logHexFileName, isTag ? "TAG: ":"RDR: ", bufPtr, len);\r | |
2095 | if (wantDecrypt) \r | |
2096 | mfTraceDecode(bufPtr, len, wantSaveToEmlFile);\r | |
f71f4deb | 2097 | num++; \r |
39864b0b M |
2098 | }\r |
2099 | bufPtr += len;\r | |
6a1f2d82 | 2100 | bufPtr += ((len-1)/8+1); // ignore parity\r |
39864b0b | 2101 | }\r |
f71f4deb | 2102 | pckNum = 0;\r |
39864b0b | 2103 | }\r |
3fe4ff4f | 2104 | } // resp not NULL\r |
39864b0b | 2105 | } // while (true)\r |
f71f4deb | 2106 | \r |
2107 | free(buf);\r | |
d714d3ef | 2108 | return 0;\r |
b62a5a84 M |
2109 | }\r |
2110 | \r | |
e98572a1 | 2111 | //needs nt, ar, at, Data to decrypt\r |
2285d9dd | 2112 | int CmdHf14MfDecryptBytes(const char *Cmd){\r |
e98572a1 | 2113 | uint8_t data[50];\r |
3bc7b13d | 2114 | \r |
2115 | uint32_t nt = param_get32ex(Cmd,0,0,16);\r | |
2116 | uint32_t ar_enc = param_get32ex(Cmd,1,0,16);\r | |
2117 | uint32_t at_enc = param_get32ex(Cmd,2,0,16);\r | |
2118 | \r | |
e98572a1 | 2119 | int len = 0;\r |
3bc7b13d | 2120 | param_gethex_ex(Cmd, 3, data, &len);\r |
2121 | \r | |
2122 | len /= 2; \r | |
2123 | int limit = sizeof(data) / 2;\r | |
2124 | \r | |
2125 | if ( len >= limit )\r | |
2126 | len = limit;\r | |
2127 | \r | |
2128 | return tryDecryptWord( nt, ar_enc, at_enc, data, len);\r | |
e98572a1 | 2129 | }\r |
f71f4deb | 2130 | \r |
26fdb4ab | 2131 | static command_t CommandTable[] =\r |
9ca155ba | 2132 | {\r |
baeaf579 | 2133 | {"help", CmdHelp, 1, "This help"},\r |
2134 | {"dbg", CmdHF14AMfDbg, 0, "Set default debug mode"},\r | |
d2f487af | 2135 | {"rdbl", CmdHF14AMfRdBl, 0, "Read MIFARE classic block"},\r |
d2f487af | 2136 | {"rdsc", CmdHF14AMfRdSc, 0, "Read MIFARE classic sector"},\r |
2137 | {"dump", CmdHF14AMfDump, 0, "Dump MIFARE classic tag to binary file"},\r | |
baeaf579 | 2138 | {"restore", CmdHF14AMfRestore, 0, "Restore MIFARE classic binary file to BLANK tag"},\r |
9ca155ba | 2139 | {"wrbl", CmdHF14AMfWrBl, 0, "Write MIFARE classic block"},\r |
baeaf579 | 2140 | {"chk", CmdHF14AMfChk, 0, "Test block keys"},\r |
7bc95e2e | 2141 | {"mifare", CmdHF14AMifare, 0, "Read parity error messages."},\r |
9ca155ba | 2142 | {"nested", CmdHF14AMfNested, 0, "Test nested authentication"},\r |
c188b1b9 | 2143 | {"hardnested", CmdHF14AMfNestedHard, 0, "Nested attack for hardened Mifare cards"},\r |
b62a5a84 | 2144 | {"sniff", CmdHF14AMfSniff, 0, "Sniff card-reader communication"},\r |
baeaf579 | 2145 | {"sim", CmdHF14AMf1kSim, 0, "Simulate MIFARE card"},\r |
545a1f38 | 2146 | {"eclr", CmdHF14AMfEClear, 0, "Clear simulator memory block"},\r |
51969283 M |
2147 | {"eget", CmdHF14AMfEGet, 0, "Get simulator memory block"},\r |
2148 | {"eset", CmdHF14AMfESet, 0, "Set simulator memory block"},\r | |
9ca155ba M |
2149 | {"eload", CmdHF14AMfELoad, 0, "Load from file emul dump"},\r |
2150 | {"esave", CmdHF14AMfESave, 0, "Save to file emul dump"},\r | |
8556b852 | 2151 | {"ecfill", CmdHF14AMfECFill, 0, "Fill simulator memory with help of keys from simulator"},\r |
baeaf579 | 2152 | {"ekeyprn", CmdHF14AMfEKeyPrn, 0, "Print keys from simulator memory"},\r |
2153 | {"csetuid", CmdHF14AMfCSetUID, 0, "Set UID for magic Chinese card"},\r | |
b915fda3 | 2154 | {"csetblk", CmdHF14AMfCSetBlk, 0, "Write block - Magic Chinese card"},\r |
2155 | {"cgetblk", CmdHF14AMfCGetBlk, 0, "Read block - Magic Chinese card"},\r | |
2156 | {"cgetsc", CmdHF14AMfCGetSc, 0, "Read sector - Magic Chinese card"},\r | |
208a0166 | 2157 | {"cload", CmdHF14AMfCLoad, 0, "Load dump into magic Chinese card"},\r |
545a1f38 | 2158 | {"csave", CmdHF14AMfCSave, 0, "Save dump from magic Chinese card into file or emulator"},\r |
2285d9dd | 2159 | {"decrypt", CmdHf14MfDecryptBytes, 1, "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace"},\r |
9ca155ba M |
2160 | {NULL, NULL, 0, NULL}\r |
2161 | };\r | |
2162 | \r | |
2163 | int CmdHFMF(const char *Cmd)\r | |
2164 | {\r | |
2165 | // flush\r | |
7dd1908b | 2166 | WaitForResponseTimeout(CMD_ACK,NULL,100);\r |
c2731f37 | 2167 | CmdsParse(CommandTable, Cmd);\r |
2168 | return 0;\r | |
9ca155ba M |
2169 | }\r |
2170 | \r | |
2171 | int CmdHelp(const char *Cmd)\r | |
2172 | {\r | |
c2731f37 | 2173 | CmdsHelp(CommandTable);\r |
2174 | return 0;\r | |
9ca155ba | 2175 | }\r |