]> git.zerfleddert.de Git - proxmark3-svn/blame_incremental - client/cmdhfmf.c
FIX: CoverityScan 123358 and 133864 - Unchecked return value
[proxmark3-svn] / client / cmdhfmf.c
... / ...
CommitLineData
1//-----------------------------------------------------------------------------\r
2// Copyright (C) 2011,2012 Merlok\r
3//\r
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
5// at your option, any later version. See the LICENSE.txt file for the text of\r
6// the license.\r
7//-----------------------------------------------------------------------------\r
8// High frequency MIFARE commands\r
9//-----------------------------------------------------------------------------\r
10\r
11#include "cmdhfmf.h"\r
12#include "cmdhfmfhard.h"\r
13#include "nonce2key/nonce2key.h"\r
14\r
15static int CmdHelp(const char *Cmd);\r
16int usage_hf14_mifare(void){\r
17 PrintAndLog("Usage: hf mf mifare [h] <block number>");\r
18 PrintAndLog("options:");\r
19 PrintAndLog(" h this help");\r
20 PrintAndLog(" <block number> (Optional) target other key A than block 0.");\r
21 PrintAndLog("samples:");\r
22 PrintAndLog(" hf mf mifare");\r
23 PrintAndLog(" hf mf mifare 16");\r
24 return 0;\r
25}\r
26int usage_hf14_mf1ksim(void){\r
27 PrintAndLog("Usage: hf mf sim [h] u <uid (8,14,20 hex symbols)> n <numreads> i x");\r
28 PrintAndLog("options:");\r
29 PrintAndLog(" h this help");\r
30 PrintAndLog(" u (Optional) UID 4,7 or 10bytes. If not specified, the UID 4b from emulator memory will be used");\r
31 PrintAndLog(" n (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");\r
32 PrintAndLog(" i (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");\r
33 PrintAndLog(" x (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r
34 PrintAndLog("samples:");\r
35 PrintAndLog(" hf mf sim u 0a0a0a0a");\r
36 PrintAndLog(" hf mf sim u 11223344556677");\r
37 PrintAndLog(" hf mf sim u 112233445566778899AA"); \r
38 return 0;\r
39}\r
40int usage_hf14_dbg(void){\r
41 PrintAndLog("Usage: hf mf dbg [h] <debug level>");\r
42 PrintAndLog("options:");\r
43 PrintAndLog(" h this help"); \r
44 PrintAndLog(" <debug level> (Optional) see list for valid levels");\r
45 PrintAndLog(" 0 - no debug messages");\r
46 PrintAndLog(" 1 - error messages");\r
47 PrintAndLog(" 2 - plus information messages");\r
48 PrintAndLog(" 3 - plus debug messages");\r
49 PrintAndLog(" 4 - print even debug messages in timing critical functions");\r
50 PrintAndLog(" Note: this option therefore may cause malfunction itself");\r
51 PrintAndLog("samples:");\r
52 PrintAndLog(" hf mf dbg 3");\r
53 return 0;\r
54}\r
55int usage_hf14_sniff(void){\r
56 PrintAndLog("It continuously gets data from the field and saves it to: log, emulator, emulator file.");\r
57 PrintAndLog("Usage: hf mf sniff [h] [l] [d] [f]");\r
58 PrintAndLog("options:");\r
59 PrintAndLog(" h this help");\r
60 PrintAndLog(" l save encrypted sequence to logfile `uid.log`");\r
61 PrintAndLog(" d decrypt sequence and put it to log file `uid.log`");\r
62// PrintAndLog(" n/a e decrypt sequence, collect read and write commands and save the result of the sequence to emulator memory");\r
63 PrintAndLog(" f decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`");\r
64 PrintAndLog("sample:");\r
65 PrintAndLog(" hf mf sniff l d f");\r
66 return 0;\r
67}\r
68int usage_hf14_nested(void){\r
69 PrintAndLog("Usage:");\r
70 PrintAndLog(" all sectors: hf mf nested <card memory> <block number> <key A/B> <key (12 hex symbols)> [t,d]");\r
71 PrintAndLog(" one sector: hf mf nested o <block number> <key A/B> <key (12 hex symbols)>");\r
72 PrintAndLog(" <target block number> <target key A/B> [t]");\r
73 PrintAndLog("options:");\r
74 PrintAndLog(" h this help");\r
75 PrintAndLog(" card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");\r
76 PrintAndLog(" t transfer keys into emulator memory");\r
77 PrintAndLog(" d write keys to binary file");\r
78 PrintAndLog(" ");\r
79 PrintAndLog("samples:");\r
80 PrintAndLog(" hf mf nested 1 0 A FFFFFFFFFFFF ");\r
81 PrintAndLog(" hf mf nested 1 0 A FFFFFFFFFFFF t ");\r
82 PrintAndLog(" hf mf nested 1 0 A FFFFFFFFFFFF d ");\r
83 PrintAndLog(" hf mf nested o 0 A FFFFFFFFFFFF 4 A");\r
84 return 0;\r
85}\r
86int usage_hf14_hardnested(void){\r
87 PrintAndLog("Usage:");\r
88 PrintAndLog(" hf mf hardnested <block number> <key A|B> <key (12 hex symbols)>");\r
89 PrintAndLog(" <target block number> <target key A|B> [known target key (12 hex symbols)] [w] [s]");\r
90 PrintAndLog(" or hf mf hardnested r [known target key]");\r
91 PrintAndLog(" ");\r
92 PrintAndLog("options:");\r
93 PrintAndLog(" h this help"); \r
94 PrintAndLog(" w acquire nonces and write them to binary file nonces.bin");\r
95 PrintAndLog(" s slower acquisition (required by some non standard cards)");\r
96 PrintAndLog(" r read nonces.bin and start attack");\r
97 PrintAndLog(" t tests?");\r
98 PrintAndLog(" ");\r
99 PrintAndLog("samples:");\r
100 PrintAndLog(" hf mf hardnested 0 A FFFFFFFFFFFF 4 A");\r
101 PrintAndLog(" hf mf hardnested 0 A FFFFFFFFFFFF 4 A w");\r
102 PrintAndLog(" hf mf hardnested 0 A FFFFFFFFFFFF 4 A w s");\r
103 PrintAndLog(" hf mf hardnested r");\r
104 PrintAndLog(" hf mf hardnested r a0a1a2a3a4a5");\r
105 PrintAndLog(" ");\r
106 PrintAndLog("Add the known target key to check if it is present in the remaining key space:");\r
107 PrintAndLog(" sample5: hf mf hardnested 0 A A0A1A2A3A4A5 4 A FFFFFFFFFFFF");\r
108 return 0;\r
109}\r
110int usage_hf14_chk(void){\r
111 PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d] [<key (12 hex symbols)>] [<dic (*.dic)>]");\r
112 PrintAndLog("options:");\r
113 PrintAndLog(" h this help"); \r
114 PrintAndLog(" * all sectors based on card memory, other values then below defaults to 1k");\r
115 PrintAndLog(" 0 - MINI(320 bytes)");\r
116 PrintAndLog(" 1 - 1K");\r
117 PrintAndLog(" 2 - 2K");\r
118 PrintAndLog(" 4 - 4K");\r
119 PrintAndLog(" d write keys to binary file");\r
120 PrintAndLog(" t write keys to emulator memory\n");\r
121 PrintAndLog(" ");\r
122 PrintAndLog("samples:");\r
123 PrintAndLog(" hf mf chk 0 A 1234567890ab keys.dic -- target block 0, Key A");\r
124 PrintAndLog(" hf mf chk *1 ? t -- target all blocks, all keys, 1K, write to emul");\r
125 PrintAndLog(" hf mf chk *1 ? d -- target all blocks, all keys, 1K, write to file");\r
126 return 0;\r
127}\r
128\r
129int CmdHF14AMifare(const char *Cmd) {\r
130 uint32_t uid = 0;\r
131 uint32_t nt = 0, nr = 0;\r
132 uint64_t par_list = 0, ks_list = 0, r_key = 0;\r
133 int16_t isOK = 0;\r
134 int tmpchar; \r
135 uint8_t blockNo = 0;\r
136 \r
137 char cmdp = param_getchar(Cmd, 0); \r
138 if ( cmdp == 'H' || cmdp == 'h') return usage_hf14_mifare();\r
139 \r
140 blockNo = param_get8(Cmd, 0);\r
141 UsbCommand c = {CMD_READER_MIFARE, {true, blockNo, 0}};\r
142\r
143 // message\r
144 printf("-------------------------------------------------------------------------\n");\r
145 printf("Executing darkside attack. Expected execution time: 25sec on average :-)\n");\r
146 printf("Press button on the proxmark3 device to abort both proxmark3 and client.\n");\r
147 printf("-------------------------------------------------------------------------\n");\r
148 clock_t t1 = clock();\r
149 time_t start, end;\r
150 time(&start);\r
151 \r
152start:\r
153 clearCommandBuffer();\r
154 SendCommand(&c);\r
155 \r
156 //flush queue\r
157 while (ukbhit()) {\r
158 tmpchar = getchar();\r
159 (void)tmpchar;\r
160 }\r
161\r
162 // wait cycle\r
163 while (true) {\r
164 printf(".");\r
165 fflush(stdout);\r
166 if (ukbhit()) {\r
167 tmpchar = getchar();\r
168 (void)tmpchar;\r
169 printf("\naborted via keyboard!\n");\r
170 break;\r
171 }\r
172 \r
173 UsbCommand resp;\r
174 if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {\r
175 isOK = resp.arg[0];\r
176 printf("\n");\r
177 uid = (uint32_t)bytes_to_num(resp.d.asBytes + 0, 4);\r
178 nt = (uint32_t)bytes_to_num(resp.d.asBytes + 4, 4);\r
179 par_list = bytes_to_num(resp.d.asBytes + 8, 8);\r
180 ks_list = bytes_to_num(resp.d.asBytes + 16, 8);\r
181 nr = bytes_to_num(resp.d.asBytes + 24, 4);\r
182\r
183 switch (isOK) {\r
184 case -1 : PrintAndLog("Button pressed. Aborted.\n"); break;\r
185 case -2 : PrintAndLog("Card isn't vulnerable to Darkside attack (doesn't send NACK on authentication requests).\n"); break;\r
186 case -3 : PrintAndLog("Card isn't vulnerable to Darkside attack (its random number generator is not predictable).\n"); break;\r
187 case -4 : PrintAndLog("Card isn't vulnerable to Darkside attack (its random number generator seems to be based on the wellknown");\r
188 PrintAndLog("generating polynomial with 16 effective bits only, but shows unexpected behaviour.\n"); break;\r
189 default: ;\r
190 }\r
191 break;\r
192 }\r
193 } \r
194 printf("\n");\r
195 \r
196 // par == 0\r
197 if (isOK == -1 && par_list == 0) {\r
198 if (!nonce2key_ex(uid, nt, nr, ks_list, &r_key) ){\r
199 PrintAndLog("Found valid key: %012"llx" \n", r_key);\r
200 goto END;\r
201 }\r
202 }\r
203 \r
204 // error\r
205 if (isOK != 1) return 1;\r
206 \r
207 // execute original function from util nonce2key\r
208 if (nonce2key(uid, nt, nr, par_list, ks_list, &r_key)) {\r
209 isOK = 2;\r
210 PrintAndLog("Key not found (lfsr_common_prefix list is null). Nt=%08x", nt); \r
211 PrintAndLog("Failing is expected to happen in 25%% of all cases. Trying again with a different reader nonce...");\r
212 c.arg[0] = false;\r
213 goto start;\r
214 } else {\r
215 PrintAndLog("Found valid key: %012"llx" \n", r_key);\r
216 }\r
217END:\r
218 t1 = clock() - t1;\r
219 time(&end);\r
220 unsigned long elapsed_time = difftime(end, start); \r
221 if ( t1 > 0 )\r
222 PrintAndLog("Time in darkside: %.0f ticks %u seconds\n", (float)t1, elapsed_time);\r
223 return 0;\r
224}\r
225\r
226int CmdHF14AMfWrBl(const char *Cmd) {\r
227 uint8_t blockNo = 0;\r
228 uint8_t keyType = 0;\r
229 uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r
230 uint8_t bldata[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};\r
231 \r
232 char cmdp = 0x00;\r
233\r
234 if (strlen(Cmd)<3) {\r
235 PrintAndLog("Usage: hf mf wrbl <block number> <key A/B> <key (12 hex symbols)> <block data (32 hex symbols)>");\r
236 PrintAndLog(" sample: hf mf wrbl 0 A FFFFFFFFFFFF 000102030405060708090A0B0C0D0E0F");\r
237 return 0;\r
238 } \r
239\r
240 blockNo = param_get8(Cmd, 0);\r
241 cmdp = param_getchar(Cmd, 1);\r
242 if (cmdp == 0x00) {\r
243 PrintAndLog("Key type must be A or B");\r
244 return 1;\r
245 }\r
246 if (cmdp != 'A' && cmdp != 'a') keyType = 1;\r
247 if (param_gethex(Cmd, 2, key, 12)) {\r
248 PrintAndLog("Key must include 12 HEX symbols");\r
249 return 1;\r
250 }\r
251 if (param_gethex(Cmd, 3, bldata, 32)) {\r
252 PrintAndLog("Block data must include 32 HEX symbols");\r
253 return 1;\r
254 }\r
255 PrintAndLog("--block no:%d, key type:%c, key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));\r
256 PrintAndLog("--data: %s", sprint_hex(bldata, 16));\r
257 \r
258 UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};\r
259 memcpy(c.d.asBytes, key, 6);\r
260 memcpy(c.d.asBytes + 10, bldata, 16);\r
261 clearCommandBuffer();\r
262 SendCommand(&c);\r
263\r
264 UsbCommand resp;\r
265 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
266 uint8_t isOK = resp.arg[0] & 0xff;\r
267 PrintAndLog("isOk:%02x", isOK);\r
268 } else {\r
269 PrintAndLog("Command execute timeout");\r
270 }\r
271\r
272 return 0;\r
273}\r
274\r
275int CmdHF14AMfRdBl(const char *Cmd) {\r
276 uint8_t blockNo = 0;\r
277 uint8_t keyType = 0;\r
278 uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r
279 \r
280 char cmdp = 0x00;\r
281\r
282\r
283 if (strlen(Cmd)<3) {\r
284 PrintAndLog("Usage: hf mf rdbl <block number> <key A/B> <key (12 hex symbols)>");\r
285 PrintAndLog(" sample: hf mf rdbl 0 A FFFFFFFFFFFF ");\r
286 return 0;\r
287 } \r
288 \r
289 blockNo = param_get8(Cmd, 0);\r
290 cmdp = param_getchar(Cmd, 1);\r
291 if (cmdp == 0x00) {\r
292 PrintAndLog("Key type must be A or B");\r
293 return 1;\r
294 }\r
295 if (cmdp != 'A' && cmdp != 'a') keyType = 1;\r
296 if (param_gethex(Cmd, 2, key, 12)) {\r
297 PrintAndLog("Key must include 12 HEX symbols");\r
298 return 1;\r
299 }\r
300 PrintAndLog("--block no:%d, key type:%c, key:%s ", blockNo, keyType?'B':'A', sprint_hex(key, 6));\r
301 \r
302 UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};\r
303 memcpy(c.d.asBytes, key, 6);\r
304 clearCommandBuffer();\r
305 SendCommand(&c);\r
306\r
307 UsbCommand resp;\r
308 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
309 uint8_t isOK = resp.arg[0] & 0xff;\r
310 uint8_t *data = resp.d.asBytes;\r
311\r
312 if (isOK)\r
313 PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 16));\r
314 else\r
315 PrintAndLog("isOk:%02x", isOK);\r
316 } else {\r
317 PrintAndLog("Command execute timeout");\r
318 }\r
319\r
320 return 0;\r
321}\r
322\r
323int CmdHF14AMfRdSc(const char *Cmd) {\r
324 int i;\r
325 uint8_t sectorNo = 0;\r
326 uint8_t keyType = 0;\r
327 uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r
328 uint8_t isOK = 0;\r
329 uint8_t *data = NULL;\r
330 char cmdp = 0x00;\r
331\r
332 if (strlen(Cmd)<3) {\r
333 PrintAndLog("Usage: hf mf rdsc <sector number> <key A/B> <key (12 hex symbols)>");\r
334 PrintAndLog(" sample: hf mf rdsc 0 A FFFFFFFFFFFF ");\r
335 return 0;\r
336 } \r
337 \r
338 sectorNo = param_get8(Cmd, 0);\r
339 if (sectorNo > 39) {\r
340 PrintAndLog("Sector number must be less than 40");\r
341 return 1;\r
342 }\r
343 cmdp = param_getchar(Cmd, 1);\r
344 if (cmdp != 'a' && cmdp != 'A' && cmdp != 'b' && cmdp != 'B') {\r
345 PrintAndLog("Key type must be A or B");\r
346 return 1;\r
347 }\r
348 if (cmdp != 'A' && cmdp != 'a') keyType = 1;\r
349 if (param_gethex(Cmd, 2, key, 12)) {\r
350 PrintAndLog("Key must include 12 HEX symbols");\r
351 return 1;\r
352 }\r
353 PrintAndLog("--sector no:%d key type:%c key:%s ", sectorNo, keyType?'B':'A', sprint_hex(key, 6));\r
354 \r
355 UsbCommand c = {CMD_MIFARE_READSC, {sectorNo, keyType, 0}};\r
356 memcpy(c.d.asBytes, key, 6);\r
357 clearCommandBuffer();\r
358 SendCommand(&c);\r
359 PrintAndLog(" ");\r
360\r
361 UsbCommand resp;\r
362 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
363 isOK = resp.arg[0] & 0xff;\r
364 data = resp.d.asBytes;\r
365\r
366 PrintAndLog("isOk:%02x", isOK);\r
367 if (isOK) {\r
368 for (i = 0; i < (sectorNo<32?3:15); i++) {\r
369 PrintAndLog("data : %s", sprint_hex(data + i * 16, 16));\r
370 }\r
371 PrintAndLog("trailer: %s", sprint_hex(data + (sectorNo<32?3:15) * 16, 16));\r
372 }\r
373 } else {\r
374 PrintAndLog("Command execute timeout");\r
375 }\r
376\r
377 return 0;\r
378}\r
379\r
380uint8_t FirstBlockOfSector(uint8_t sectorNo) {\r
381 if (sectorNo < 32) {\r
382 return sectorNo * 4;\r
383 } else {\r
384 return 32 * 4 + (sectorNo - 32) * 16;\r
385 }\r
386}\r
387\r
388uint8_t NumBlocksPerSector(uint8_t sectorNo) {\r
389 if (sectorNo < 32) {\r
390 return 4;\r
391 } else {\r
392 return 16;\r
393 }\r
394}\r
395\r
396int CmdHF14AMfDump(const char *Cmd) {\r
397 uint8_t sectorNo, blockNo;\r
398 \r
399 uint8_t keyA[40][6];\r
400 uint8_t keyB[40][6];\r
401 uint8_t rights[40][4];\r
402 uint8_t carddata[256][16];\r
403 uint8_t numSectors = 16;\r
404 \r
405 FILE *fin;\r
406 FILE *fout;\r
407 \r
408 UsbCommand resp;\r
409\r
410 char cmdp = param_getchar(Cmd, 0);\r
411 switch (cmdp) {\r
412 case '0' : numSectors = 5; break;\r
413 case '1' : \r
414 case '\0': numSectors = 16; break;\r
415 case '2' : numSectors = 32; break;\r
416 case '4' : numSectors = 40; break;\r
417 default: numSectors = 16;\r
418 } \r
419 \r
420 if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {\r
421 PrintAndLog("Usage: hf mf dump [card memory]");\r
422 PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");\r
423 PrintAndLog("");\r
424 PrintAndLog("Samples: hf mf dump");\r
425 PrintAndLog(" hf mf dump 4");\r
426 return 0;\r
427 }\r
428 \r
429 if ((fin = fopen("dumpkeys.bin","rb")) == NULL) {\r
430 PrintAndLog("Could not find file dumpkeys.bin");\r
431 return 1;\r
432 }\r
433 \r
434 // Read keys A from file\r
435 size_t bytes_read;\r
436 for (sectorNo=0; sectorNo<numSectors; sectorNo++) {\r
437 bytes_read = fread( keyA[sectorNo], 1, 6, fin );\r
438 if ( bytes_read == 0) {\r
439 PrintAndLog("File reading error.");\r
440 fclose(fin);\r
441 return 2;\r
442 }\r
443 }\r
444 \r
445 // Read keys B from file\r
446 for (sectorNo=0; sectorNo<numSectors; sectorNo++) {\r
447 bytes_read = fread( keyB[sectorNo], 1, 6, fin );\r
448 if ( bytes_read == 0) {\r
449 PrintAndLog("File reading error.");\r
450 fclose(fin);\r
451 return 2;\r
452 }\r
453 }\r
454 \r
455 fclose(fin);\r
456\r
457 PrintAndLog("|-----------------------------------------|");\r
458 PrintAndLog("|------ Reading sector access bits...-----|");\r
459 PrintAndLog("|-----------------------------------------|");\r
460 \r
461 for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {\r
462 UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 0, 0}};\r
463 memcpy(c.d.asBytes, keyA[sectorNo], 6);\r
464 clearCommandBuffer();\r
465 SendCommand(&c);\r
466\r
467 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
468 uint8_t isOK = resp.arg[0] & 0xff;\r
469 uint8_t *data = resp.d.asBytes;\r
470 if (isOK){\r
471 rights[sectorNo][0] = ((data[7] & 0x10)>>2) | ((data[8] & 0x1)<<1) | ((data[8] & 0x10)>>4); // C1C2C3 for data area 0\r
472 rights[sectorNo][1] = ((data[7] & 0x20)>>3) | ((data[8] & 0x2)<<0) | ((data[8] & 0x20)>>5); // C1C2C3 for data area 1\r
473 rights[sectorNo][2] = ((data[7] & 0x40)>>4) | ((data[8] & 0x4)>>1) | ((data[8] & 0x40)>>6); // C1C2C3 for data area 2\r
474 rights[sectorNo][3] = ((data[7] & 0x80)>>5) | ((data[8] & 0x8)>>2) | ((data[8] & 0x80)>>7); // C1C2C3 for sector trailer\r
475 } else {\r
476 PrintAndLog("Could not get access rights for sector %2d. Trying with defaults...", sectorNo);\r
477 rights[sectorNo][0] = rights[sectorNo][1] = rights[sectorNo][2] = 0x00;\r
478 rights[sectorNo][3] = 0x01;\r
479 }\r
480 } else {\r
481 PrintAndLog("Command execute timeout when trying to read access rights for sector %2d. Trying with defaults...", sectorNo);\r
482 rights[sectorNo][0] = rights[sectorNo][1] = rights[sectorNo][2] = 0x00;\r
483 rights[sectorNo][3] = 0x01;\r
484 }\r
485 }\r
486 \r
487 PrintAndLog("|-----------------------------------------|");\r
488 PrintAndLog("|----- Dumping all blocks to file... -----|");\r
489 PrintAndLog("|-----------------------------------------|");\r
490 \r
491 bool isOK = true;\r
492 for (sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {\r
493 for (blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
494 bool received = false;\r
495 \r
496 if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. At least the Access Conditions can always be read with key A. \r
497 UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};\r
498 memcpy(c.d.asBytes, keyA[sectorNo], 6);\r
499 clearCommandBuffer();\r
500 SendCommand(&c);\r
501 received = WaitForResponseTimeout(CMD_ACK,&resp,1500);\r
502 } else { // data block. Check if it can be read with key A or key B\r
503 uint8_t data_area = sectorNo<32?blockNo:blockNo/5;\r
504 if ((rights[sectorNo][data_area] == 0x03) || (rights[sectorNo][data_area] == 0x05)) { // only key B would work\r
505 UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 1, 0}};\r
506 memcpy(c.d.asBytes, keyB[sectorNo], 6);\r
507 SendCommand(&c);\r
508 received = WaitForResponseTimeout(CMD_ACK,&resp,1500);\r
509 } else if (rights[sectorNo][data_area] == 0x07) { // no key would work\r
510 isOK = false;\r
511 PrintAndLog("Access rights do not allow reading of sector %2d block %3d", sectorNo, blockNo);\r
512 } else { // key A would work\r
513 UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};\r
514 memcpy(c.d.asBytes, keyA[sectorNo], 6);\r
515 clearCommandBuffer();\r
516 SendCommand(&c);\r
517 received = WaitForResponseTimeout(CMD_ACK,&resp,1500);\r
518 }\r
519 }\r
520\r
521 if (received) {\r
522 isOK = resp.arg[0] & 0xff;\r
523 uint8_t *data = resp.d.asBytes;\r
524 if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. Fill in the keys.\r
525 data[0] = (keyA[sectorNo][0]);\r
526 data[1] = (keyA[sectorNo][1]);\r
527 data[2] = (keyA[sectorNo][2]);\r
528 data[3] = (keyA[sectorNo][3]);\r
529 data[4] = (keyA[sectorNo][4]);\r
530 data[5] = (keyA[sectorNo][5]);\r
531 data[10] = (keyB[sectorNo][0]);\r
532 data[11] = (keyB[sectorNo][1]);\r
533 data[12] = (keyB[sectorNo][2]);\r
534 data[13] = (keyB[sectorNo][3]);\r
535 data[14] = (keyB[sectorNo][4]);\r
536 data[15] = (keyB[sectorNo][5]);\r
537 }\r
538 if (isOK) {\r
539 memcpy(carddata[FirstBlockOfSector(sectorNo) + blockNo], data, 16);\r
540 PrintAndLog("Successfully read block %2d of sector %2d.", blockNo, sectorNo);\r
541 } else {\r
542 PrintAndLog("Could not read block %2d of sector %2d", blockNo, sectorNo);\r
543 break;\r
544 }\r
545 }\r
546 else {\r
547 isOK = false;\r
548 PrintAndLog("Command execute timeout when trying to read block %2d of sector %2d.", blockNo, sectorNo);\r
549 break;\r
550 }\r
551 }\r
552 }\r
553\r
554 if (isOK) {\r
555 if ((fout = fopen("dumpdata.bin","wb")) == NULL) { \r
556 PrintAndLog("Could not create file name dumpdata.bin");\r
557 return 1;\r
558 }\r
559 uint16_t numblocks = FirstBlockOfSector(numSectors - 1) + NumBlocksPerSector(numSectors - 1);\r
560 fwrite(carddata, 1, 16*numblocks, fout);\r
561 fclose(fout);\r
562 PrintAndLog("Dumped %d blocks (%d bytes) to file dumpdata.bin", numblocks, 16*numblocks);\r
563 }\r
564 \r
565 return 0;\r
566}\r
567\r
568int CmdHF14AMfRestore(const char *Cmd) {\r
569 uint8_t sectorNo,blockNo;\r
570 uint8_t keyType = 0;\r
571 uint8_t key[6] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};\r
572 uint8_t bldata[16] = {0x00};\r
573 uint8_t keyA[40][6];\r
574 uint8_t keyB[40][6];\r
575 uint8_t numSectors;\r
576 \r
577 FILE *fdump;\r
578 FILE *fkeys;\r
579\r
580 char cmdp = param_getchar(Cmd, 0);\r
581 switch (cmdp) {\r
582 case '0' : numSectors = 5; break;\r
583 case '1' : \r
584 case '\0': numSectors = 16; break;\r
585 case '2' : numSectors = 32; break;\r
586 case '4' : numSectors = 40; break;\r
587 default: numSectors = 16;\r
588 } \r
589\r
590 if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {\r
591 PrintAndLog("Usage: hf mf restore [card memory]");\r
592 PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");\r
593 PrintAndLog("");\r
594 PrintAndLog("Samples: hf mf restore");\r
595 PrintAndLog(" hf mf restore 4");\r
596 return 0;\r
597 }\r
598\r
599 if ((fkeys = fopen("dumpkeys.bin","rb")) == NULL) {\r
600 PrintAndLog("Could not find file dumpkeys.bin");\r
601 return 1;\r
602 }\r
603 \r
604 size_t bytes_read;\r
605 for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {\r
606 bytes_read = fread( keyA[sectorNo], 1, 6, fkeys );\r
607 if ( bytes_read == 0) {\r
608 PrintAndLog("File reading error (dumpkeys.bin).");\r
609 fclose(fkeys);\r
610 return 2;\r
611 }\r
612 }\r
613\r
614 for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {\r
615 bytes_read = fread( keyB[sectorNo], 1, 6, fkeys );\r
616 if ( bytes_read == 0) {\r
617 PrintAndLog("File reading error (dumpkeys.bin).");\r
618 fclose(fkeys);\r
619 return 2;\r
620 }\r
621 }\r
622\r
623 fclose(fkeys);\r
624\r
625 if ((fdump = fopen("dumpdata.bin","rb")) == NULL) {\r
626 PrintAndLog("Could not find file dumpdata.bin");\r
627 return 1;\r
628 } \r
629 PrintAndLog("Restoring dumpdata.bin to card");\r
630\r
631 for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {\r
632 for(blockNo = 0; blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
633 UsbCommand c = {CMD_MIFARE_WRITEBL, {FirstBlockOfSector(sectorNo) + blockNo, keyType, 0}};\r
634 memcpy(c.d.asBytes, key, 6); \r
635 bytes_read = fread(bldata, 1, 16, fdump);\r
636 if ( bytes_read == 0) {\r
637 PrintAndLog("File reading error (dumpdata.bin).");\r
638 fclose(fdump);\r
639 return 2;\r
640 }\r
641 \r
642 if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer\r
643 bldata[0] = (keyA[sectorNo][0]);\r
644 bldata[1] = (keyA[sectorNo][1]);\r
645 bldata[2] = (keyA[sectorNo][2]);\r
646 bldata[3] = (keyA[sectorNo][3]);\r
647 bldata[4] = (keyA[sectorNo][4]);\r
648 bldata[5] = (keyA[sectorNo][5]);\r
649 bldata[10] = (keyB[sectorNo][0]);\r
650 bldata[11] = (keyB[sectorNo][1]);\r
651 bldata[12] = (keyB[sectorNo][2]);\r
652 bldata[13] = (keyB[sectorNo][3]);\r
653 bldata[14] = (keyB[sectorNo][4]);\r
654 bldata[15] = (keyB[sectorNo][5]);\r
655 } \r
656 \r
657 PrintAndLog("Writing to block %3d: %s", FirstBlockOfSector(sectorNo) + blockNo, sprint_hex(bldata, 16));\r
658 \r
659 memcpy(c.d.asBytes + 10, bldata, 16);\r
660 clearCommandBuffer();\r
661 SendCommand(&c);\r
662\r
663 UsbCommand resp;\r
664 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
665 uint8_t isOK = resp.arg[0] & 0xff;\r
666 PrintAndLog("isOk:%02x", isOK);\r
667 } else {\r
668 PrintAndLog("Command execute timeout");\r
669 }\r
670 }\r
671 }\r
672 \r
673 fclose(fdump);\r
674 return 0;\r
675}\r
676\r
677int CmdHF14AMfNested(const char *Cmd) {\r
678 int i, j, res, iterations;\r
679 sector *e_sector = NULL;\r
680 uint8_t blockNo = 0;\r
681 uint8_t keyType = 0;\r
682 uint8_t trgBlockNo = 0;\r
683 uint8_t trgKeyType = 0;\r
684 uint8_t SectorsCnt = 0;\r
685 uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r
686 uint8_t keyBlock[6*6];\r
687 uint64_t key64 = 0;\r
688 bool transferToEml = false;\r
689 \r
690 bool createDumpFile = false;\r
691 FILE *fkeys;\r
692 uint8_t standart[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};\r
693 uint8_t tempkey[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};\r
694\r
695 if (strlen(Cmd)<3) return usage_hf14_nested();\r
696 \r
697 char cmdp, ctmp;\r
698 cmdp = param_getchar(Cmd, 0);\r
699 blockNo = param_get8(Cmd, 1);\r
700 ctmp = param_getchar(Cmd, 2);\r
701\r
702 if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {\r
703 PrintAndLog("Key type must be A or B");\r
704 return 1;\r
705 }\r
706 \r
707 if (ctmp != 'A' && ctmp != 'a') \r
708 keyType = 1;\r
709 \r
710 if (param_gethex(Cmd, 3, key, 12)) {\r
711 PrintAndLog("Key must include 12 HEX symbols");\r
712 return 1;\r
713 }\r
714 \r
715 if (cmdp == 'o' || cmdp == 'O') {\r
716 cmdp = 'o';\r
717 trgBlockNo = param_get8(Cmd, 4);\r
718 ctmp = param_getchar(Cmd, 5);\r
719 if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {\r
720 PrintAndLog("Target key type must be A or B");\r
721 return 1;\r
722 }\r
723 if (ctmp != 'A' && ctmp != 'a') \r
724 trgKeyType = 1;\r
725 } else {\r
726 \r
727 switch (cmdp) {\r
728 case '0': SectorsCnt = 05; break;\r
729 case '1': SectorsCnt = 16; break;\r
730 case '2': SectorsCnt = 32; break;\r
731 case '4': SectorsCnt = 40; break;\r
732 default: SectorsCnt = 16;\r
733 }\r
734 }\r
735\r
736 ctmp = param_getchar(Cmd, 4);\r
737 if (ctmp == 't' || ctmp == 'T') transferToEml = true;\r
738 else if (ctmp == 'd' || ctmp == 'D') createDumpFile = true;\r
739 \r
740 ctmp = param_getchar(Cmd, 6);\r
741 transferToEml |= (ctmp == 't' || ctmp == 'T');\r
742 transferToEml |= (ctmp == 'd' || ctmp == 'D');\r
743 \r
744 if (cmdp == 'o') {\r
745 int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true);\r
746 switch (isOK) {\r
747 case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;\r
748 case -2 : PrintAndLog("Button pressed. Aborted.\n"); break;\r
749 case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (its random number generator is not predictable).\n"); break;\r
750 case -4 : PrintAndLog("No valid key found"); break;\r
751 case -5 : \r
752 key64 = bytes_to_num(keyBlock, 6);\r
753\r
754 // transfer key to the emulator\r
755 if (transferToEml) {\r
756 uint8_t sectortrailer;\r
757 if (trgBlockNo < 32*4) { // 4 block sector\r
758 sectortrailer = (trgBlockNo & 0x03) + 3;\r
759 } else { // 16 block sector\r
760 sectortrailer = (trgBlockNo & 0x0f) + 15;\r
761 }\r
762 mfEmlGetMem(keyBlock, sectortrailer, 1);\r
763 \r
764 if (!trgKeyType)\r
765 num_to_bytes(key64, 6, keyBlock);\r
766 else\r
767 num_to_bytes(key64, 6, &keyBlock[10]);\r
768 mfEmlSetMem(keyBlock, sectortrailer, 1); \r
769 }\r
770 return 0;\r
771 default : PrintAndLog("Unknown Error.\n");\r
772 }\r
773 return 2;\r
774 }\r
775 else { // ------------------------------------ multiple sectors working\r
776 clock_t t1 = clock();\r
777 unsigned long elapsed_time;\r
778 time_t start, end;\r
779 time(&start);\r
780 \r
781 e_sector = calloc(SectorsCnt, sizeof(sector));\r
782 if (e_sector == NULL) return 1;\r
783 \r
784 //test current key and additional standard keys first\r
785 memcpy(keyBlock, key, 6);\r
786 num_to_bytes(0xffffffffffff, 6, (uint8_t*)(keyBlock + 1 * 6));\r
787 num_to_bytes(0x000000000000, 6, (uint8_t*)(keyBlock + 2 * 6));\r
788 num_to_bytes(0xa0a1a2a3a4a5, 6, (uint8_t*)(keyBlock + 3 * 6));\r
789 num_to_bytes(0xb0b1b2b3b4b5, 6, (uint8_t*)(keyBlock + 4 * 6));\r
790 num_to_bytes(0xaabbccddeeff, 6, (uint8_t*)(keyBlock + 5 * 6));\r
791\r
792 PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt);\r
793 for (i = 0; i < SectorsCnt; i++) {\r
794 for (j = 0; j < 2; j++) {\r
795 if (e_sector[i].foundKey[j]) continue;\r
796 \r
797 res = mfCheckKeys(FirstBlockOfSector(i), j, true, 6, keyBlock, &key64);\r
798 \r
799 if (!res) {\r
800 e_sector[i].Key[j] = key64;\r
801 e_sector[i].foundKey[j] = TRUE;\r
802 }\r
803 }\r
804 }\r
805 clock_t t2 = clock() - t1;\r
806 time(&end);\r
807 elapsed_time = difftime(end, start); \r
808 if ( t2 > 0 )\r
809 PrintAndLog("Time to check 6 known keys: %.0f ticks %u seconds\n", (float)t2 , elapsed_time);\r
810 \r
811 PrintAndLog("enter nested..."); \r
812 \r
813 // nested sectors\r
814 iterations = 0;\r
815 bool calibrate = true;\r
816\r
817 for (i = 0; i < NESTED_SECTOR_RETRY; i++) {\r
818 for (uint8_t sectorNo = 0; sectorNo < SectorsCnt; ++sectorNo) {\r
819 for (trgKeyType = 0; trgKeyType < 2; ++trgKeyType) { \r
820\r
821 if (e_sector[sectorNo].foundKey[trgKeyType]) continue;\r
822 \r
823 int16_t isOK = mfnested(blockNo, keyType, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate);\r
824 switch (isOK) {\r
825 case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;\r
826 case -2 : PrintAndLog("Button pressed. Aborted.\n"); break;\r
827 case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (its random number generator is not predictable).\n"); break;\r
828 case -4 : //key not found\r
829 calibrate = false;\r
830 iterations++;\r
831 continue; \r
832 case -5 :\r
833 calibrate = false;\r
834 iterations++;\r
835 e_sector[sectorNo].foundKey[trgKeyType] = 1;\r
836 e_sector[sectorNo].Key[trgKeyType] = bytes_to_num(keyBlock, 6);\r
837 continue;\r
838 \r
839 default : PrintAndLog("Unknown Error.\n");\r
840 }\r
841 free(e_sector);\r
842 return 2;\r
843 }\r
844 }\r
845 }\r
846 \r
847 t1 = clock() - t1;\r
848 time(&end);\r
849 elapsed_time = difftime(end, start); \r
850 if ( t1 > 0 )\r
851 PrintAndLog("Time in nested: %.0f ticks %u seconds\n", (float)t1, elapsed_time);\r
852\r
853\r
854 // 20160116 If Sector A is found, but not Sector B, try just reading it of the tag?\r
855 PrintAndLog("trying to read key B...");\r
856 for (i = 0; i < SectorsCnt; i++) {\r
857 // KEY A but not KEY B\r
858 if ( e_sector[i].foundKey[0] && !e_sector[i].foundKey[1] ) {\r
859 \r
860 uint8_t sectrail = (FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1);\r
861 \r
862 PrintAndLog("Reading block %d", sectrail);\r
863 \r
864 UsbCommand c = {CMD_MIFARE_READBL, {sectrail, 0, 0}};\r
865 num_to_bytes(e_sector[i].Key[0], 6, c.d.asBytes); // KEY A\r
866 clearCommandBuffer();\r
867 SendCommand(&c);\r
868\r
869 UsbCommand resp;\r
870 if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500)) continue;\r
871 \r
872 uint8_t isOK = resp.arg[0] & 0xff;\r
873 if (!isOK) continue;\r
874\r
875 uint8_t *data = resp.d.asBytes;\r
876 key64 = bytes_to_num(data+10, 6);\r
877 if (key64) {\r
878 PrintAndLog("Data:%s", sprint_hex(data+10, 6));\r
879 e_sector[i].foundKey[1] = TRUE;\r
880 e_sector[i].Key[1] = key64;\r
881 }\r
882 }\r
883 }\r
884\r
885 \r
886 //print them\r
887 printKeyTable( SectorsCnt, e_sector );\r
888 \r
889 // transfer them to the emulator\r
890 if (transferToEml) {\r
891 for (i = 0; i < SectorsCnt; i++) {\r
892 mfEmlGetMem(keyBlock, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1);\r
893 if (e_sector[i].foundKey[0])\r
894 num_to_bytes(e_sector[i].Key[0], 6, keyBlock);\r
895 if (e_sector[i].foundKey[1])\r
896 num_to_bytes(e_sector[i].Key[1], 6, &keyBlock[10]);\r
897 mfEmlSetMem(keyBlock, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1);\r
898 } \r
899 }\r
900 \r
901 // Create dump file\r
902 if (createDumpFile) {\r
903 if ((fkeys = fopen("dumpkeys.bin","wb")) == NULL) { \r
904 PrintAndLog("Could not create file dumpkeys.bin");\r
905 free(e_sector);\r
906 return 1;\r
907 }\r
908 PrintAndLog("Printing keys to binary file dumpkeys.bin...");\r
909 for(i=0; i<SectorsCnt; i++) {\r
910 if (e_sector[i].foundKey[0]){\r
911 num_to_bytes(e_sector[i].Key[0], 6, tempkey);\r
912 fwrite ( tempkey, 1, 6, fkeys );\r
913 }\r
914 else{\r
915 fwrite ( &standart, 1, 6, fkeys );\r
916 }\r
917 }\r
918 for(i=0; i<SectorsCnt; i++) {\r
919 if (e_sector[i].foundKey[1]){\r
920 num_to_bytes(e_sector[i].Key[1], 6, tempkey);\r
921 fwrite ( tempkey, 1, 6, fkeys );\r
922 }\r
923 else{\r
924 fwrite ( &standart, 1, 6, fkeys );\r
925 }\r
926 }\r
927 fclose(fkeys);\r
928 }\r
929 \r
930 free(e_sector);\r
931 }\r
932 return 0;\r
933}\r
934\r
935int CmdHF14AMfNestedHard(const char *Cmd) {\r
936 uint8_t blockNo = 0;\r
937 uint8_t keyType = 0;\r
938 uint8_t trgBlockNo = 0;\r
939 uint8_t trgKeyType = 0;\r
940 uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r
941 uint8_t trgkey[6] = {0, 0, 0, 0, 0, 0};\r
942 \r
943 char ctmp;\r
944 ctmp = param_getchar(Cmd, 0);\r
945 if (ctmp == 'H' || ctmp == 'h' ) return usage_hf14_hardnested();\r
946 if (ctmp != 'R' && ctmp != 'r' && ctmp != 'T' && ctmp != 't' && strlen(Cmd) < 20) return usage_hf14_hardnested();\r
947 \r
948 bool know_target_key = false;\r
949 bool nonce_file_read = false;\r
950 bool nonce_file_write = false;\r
951 bool slow = false;\r
952 int tests = 0;\r
953 \r
954 if (ctmp == 'R' || ctmp == 'r') {\r
955 nonce_file_read = true;\r
956 if (!param_gethex(Cmd, 1, trgkey, 12)) {\r
957 know_target_key = true;\r
958 }\r
959 } else if (ctmp == 'T' || ctmp == 't') {\r
960 tests = param_get32ex(Cmd, 1, 100, 10);\r
961 } else {\r
962 blockNo = param_get8(Cmd, 0);\r
963 ctmp = param_getchar(Cmd, 1);\r
964 if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {\r
965 PrintAndLog("Key type must be A or B");\r
966 return 1;\r
967 }\r
968 if (ctmp != 'A' && ctmp != 'a') { \r
969 keyType = 1;\r
970 }\r
971 \r
972 if (param_gethex(Cmd, 2, key, 12)) {\r
973 PrintAndLog("Key must include 12 HEX symbols");\r
974 return 1;\r
975 }\r
976 \r
977 trgBlockNo = param_get8(Cmd, 3);\r
978 ctmp = param_getchar(Cmd, 4);\r
979 if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {\r
980 PrintAndLog("Target key type must be A or B");\r
981 return 1;\r
982 }\r
983 if (ctmp != 'A' && ctmp != 'a') {\r
984 trgKeyType = 1;\r
985 }\r
986\r
987 uint16_t i = 5;\r
988\r
989 if (!param_gethex(Cmd, 5, trgkey, 12)) {\r
990 know_target_key = true;\r
991 i++;\r
992 }\r
993\r
994 while ((ctmp = param_getchar(Cmd, i))) {\r
995 if (ctmp == 's' || ctmp == 'S') {\r
996 slow = true;\r
997 } else if (ctmp == 'w' || ctmp == 'W') {\r
998 nonce_file_write = true;\r
999 } else {\r
1000 PrintAndLog("Possible options are w and/or s");\r
1001 return 1;\r
1002 }\r
1003 i++;\r
1004 }\r
1005 }\r
1006\r
1007 PrintAndLog("--target block no:%3d, target key type:%c, known target key: 0x%02x%02x%02x%02x%02x%02x%s, file action: %s, Slow: %s, Tests: %d ", \r
1008 trgBlockNo, \r
1009 trgKeyType?'B':'A', \r
1010 trgkey[0], trgkey[1], trgkey[2], trgkey[3], trgkey[4], trgkey[5],\r
1011 know_target_key ? "" : " (not set)",\r
1012 nonce_file_write ? "write": nonce_file_read ? "read" : "none",\r
1013 slow ? "Yes" : "No",\r
1014 tests);\r
1015\r
1016 int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key?trgkey:NULL, nonce_file_read, nonce_file_write, slow, tests);\r
1017\r
1018 if (isOK) {\r
1019 switch (isOK) {\r
1020 case 1 : PrintAndLog("Error: No response from Proxmark.\n"); break;\r
1021 case 2 : PrintAndLog("Button pressed. Aborted.\n"); break;\r
1022 default : break;\r
1023 }\r
1024 return 2;\r
1025 }\r
1026\r
1027 return 0;\r
1028}\r
1029\r
1030int CmdHF14AMfChk(const char *Cmd) {\r
1031\r
1032 if (strlen(Cmd)<3) return usage_hf14_chk();\r
1033\r
1034 FILE * f;\r
1035 char filename[FILE_PATH_SIZE]={0};\r
1036 char buf[13];\r
1037 uint8_t *keyBlock = NULL, *p;\r
1038 uint8_t stKeyBlock = 20;\r
1039 \r
1040 sector *e_sector = NULL;\r
1041 \r
1042 int i, res;\r
1043 int keycnt = 0;\r
1044 char ctmp = 0x00;\r
1045 uint8_t blockNo = 0;\r
1046 uint8_t SectorsCnt = 1;\r
1047 uint8_t keyType = 0;\r
1048 uint64_t key64 = 0;\r
1049 \r
1050 uint8_t tempkey[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};\r
1051 \r
1052 int transferToEml = 0;\r
1053 int createDumpFile = 0;\r
1054\r
1055 keyBlock = calloc(stKeyBlock, 6);\r
1056 if (keyBlock == NULL) return 1;\r
1057\r
1058 uint64_t defaultKeys[] = {\r
1059 0xffffffffffff, // Default key (first key used by program if no user defined key)\r
1060 0x000000000000, // Blank key\r
1061 0xa0a1a2a3a4a5, // NFCForum MAD key\r
1062 0xb0b1b2b3b4b5,\r
1063 0xaabbccddeeff,\r
1064 0x4d3a99c351dd,\r
1065 0x1a982c7e459a,\r
1066 0xd3f7d3f7d3f7,\r
1067 0x714c5c886e97,\r
1068 0x587ee5f9350f,\r
1069 0xa0478cc39091,\r
1070 0x533cb6c723f6,\r
1071 0x8fd0a4f256e9\r
1072 };\r
1073 int defaultKeysSize = sizeof(defaultKeys) / sizeof(uint64_t);\r
1074\r
1075 for (int defaultKeyCounter = 0; defaultKeyCounter < defaultKeysSize; defaultKeyCounter++)\r
1076 num_to_bytes(defaultKeys[defaultKeyCounter], 6, (uint8_t*)(keyBlock + defaultKeyCounter * 6));\r
1077\r
1078 \r
1079 if (param_getchar(Cmd, 0)=='*') {\r
1080 blockNo = 3;\r
1081 switch(param_getchar(Cmd+1, 0)) {\r
1082 case '0': SectorsCnt = 5; break;\r
1083 case '1': SectorsCnt = 16; break;\r
1084 case '2': SectorsCnt = 32; break;\r
1085 case '4': SectorsCnt = 40; break;\r
1086 default: SectorsCnt = 16;\r
1087 }\r
1088 } else {\r
1089 blockNo = param_get8(Cmd, 0);\r
1090 }\r
1091 \r
1092 ctmp = param_getchar(Cmd, 1);\r
1093 switch (ctmp) { \r
1094 case 'a': case 'A':\r
1095 keyType = !0;\r
1096 break;\r
1097 case 'b': case 'B':\r
1098 keyType = !1;\r
1099 break;\r
1100 case '?':\r
1101 keyType = 2;\r
1102 break;\r
1103 default:\r
1104 PrintAndLog("Key type must be A , B or ?");\r
1105 free(keyBlock);\r
1106 return 1;\r
1107 };\r
1108 \r
1109 ctmp = param_getchar(Cmd, 2);\r
1110 if (ctmp == 't' || ctmp == 'T') transferToEml = 1;\r
1111 else if (ctmp == 'd' || ctmp == 'D') createDumpFile = 1;\r
1112 \r
1113 for (i = transferToEml || createDumpFile; param_getchar(Cmd, 2 + i); i++) {\r
1114 if (!param_gethex(Cmd, 2 + i, keyBlock + 6 * keycnt, 12)) {\r
1115 if ( stKeyBlock - keycnt < 2) {\r
1116 p = realloc(keyBlock, 6*(stKeyBlock+=10));\r
1117 if (!p) {\r
1118 PrintAndLog("Cannot allocate memory for Keys");\r
1119 free(keyBlock);\r
1120 return 2;\r
1121 }\r
1122 keyBlock = p;\r
1123 }\r
1124 PrintAndLog("key[%2d] %02x%02x%02x%02x%02x%02x", keycnt,\r
1125 (keyBlock + 6*keycnt)[0],(keyBlock + 6*keycnt)[1], (keyBlock + 6*keycnt)[2],\r
1126 (keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4], (keyBlock + 6*keycnt)[5], 6);\r
1127 keycnt++;\r
1128 } else {\r
1129 // May be a dic file\r
1130 if ( param_getstr(Cmd, 2 + i,filename) >= FILE_PATH_SIZE ) {\r
1131 PrintAndLog("File name too long");\r
1132 free(keyBlock);\r
1133 return 2;\r
1134 }\r
1135 \r
1136 if ( (f = fopen( filename , "r")) ) {\r
1137 while( fgets(buf, sizeof(buf), f) ){\r
1138 if (strlen(buf) < 12 || buf[11] == '\n')\r
1139 continue;\r
1140 \r
1141 while (fgetc(f) != '\n' && !feof(f)) ; //goto next line\r
1142 \r
1143 if( buf[0]=='#' ) continue; //The line start with # is comment, skip\r
1144\r
1145 if (!isxdigit(buf[0])){\r
1146 PrintAndLog("File content error. '%s' must include 12 HEX symbols",buf);\r
1147 continue;\r
1148 }\r
1149 \r
1150 buf[12] = 0;\r
1151\r
1152 if ( stKeyBlock - keycnt < 2) {\r
1153 p = realloc(keyBlock, 6*(stKeyBlock+=10));\r
1154 if (!p) {\r
1155 PrintAndLog("Cannot allocate memory for defKeys");\r
1156 free(keyBlock);\r
1157 fclose(f);\r
1158 return 2;\r
1159 }\r
1160 keyBlock = p;\r
1161 }\r
1162 memset(keyBlock + 6 * keycnt, 0, 6);\r
1163 num_to_bytes(strtoll(buf, NULL, 16), 6, keyBlock + 6*keycnt);\r
1164 PrintAndLog("check key[%2d] %012"llx, keycnt, bytes_to_num(keyBlock + 6*keycnt, 6));\r
1165 keycnt++;\r
1166 memset(buf, 0, sizeof(buf));\r
1167 }\r
1168 fclose(f);\r
1169 } else {\r
1170 PrintAndLog("File: %s: not found or locked.", filename);\r
1171 free(keyBlock);\r
1172 return 1;\r
1173 \r
1174 }\r
1175 }\r
1176 }\r
1177 \r
1178 if (keycnt == 0) {\r
1179 PrintAndLog("No key specified, trying default keys");\r
1180 for (;keycnt < defaultKeysSize; keycnt++)\r
1181 PrintAndLog("key[%2d] %02x%02x%02x%02x%02x%02x", keycnt,\r
1182 (keyBlock + 6*keycnt)[0],(keyBlock + 6*keycnt)[1], (keyBlock + 6*keycnt)[2],\r
1183 (keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4], (keyBlock + 6*keycnt)[5], 6);\r
1184 }\r
1185 \r
1186 // initialize storage for found keys\r
1187 e_sector = calloc(SectorsCnt, sizeof(sector));\r
1188 if (e_sector == NULL) {\r
1189 free(keyBlock);\r
1190 return 1;\r
1191 }\r
1192\r
1193 // empty e_sector\r
1194 for(int i = 0; i < SectorsCnt; ++i){\r
1195 e_sector[i].Key[0] = 0xffffffffffff;\r
1196 e_sector[i].Key[1] = 0xffffffffffff;\r
1197 e_sector[i].foundKey[0] = FALSE;\r
1198 e_sector[i].foundKey[1] = FALSE;\r
1199 }\r
1200 \r
1201 \r
1202 uint8_t trgKeyType = 0;\r
1203 uint32_t max_keys = keycnt > (USB_CMD_DATA_SIZE/6) ? (USB_CMD_DATA_SIZE/6) : keycnt;\r
1204 \r
1205 // time\r
1206 clock_t t1 = clock();\r
1207 time_t start, end;\r
1208 time(&start);\r
1209 \r
1210 // check keys.\r
1211 for (trgKeyType = !keyType; trgKeyType < 2; (keyType==2) ? (++trgKeyType) : (trgKeyType=2) ) {\r
1212\r
1213 int b = blockNo;\r
1214 for (int i = 0; i < SectorsCnt; ++i) {\r
1215 \r
1216 // skip already found keys.\r
1217 if (e_sector[i].foundKey[trgKeyType]) continue;\r
1218 \r
1219 for (uint32_t c = 0; c < keycnt; c += max_keys) {\r
1220 printf(".");\r
1221 fflush(stdout); \r
1222 uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c;\r
1223 \r
1224 res = mfCheckKeys(b, trgKeyType, true, size, &keyBlock[6*c], &key64);\r
1225 if (!res) {\r
1226 e_sector[i].Key[trgKeyType] = key64;\r
1227 e_sector[i].foundKey[trgKeyType] = TRUE;\r
1228 break;\r
1229 }\r
1230 }\r
1231 b < 127 ? ( b +=4 ) : ( b += 16 ); \r
1232 }\r
1233 }\r
1234 t1 = clock() - t1;\r
1235 time(&end);\r
1236 unsigned long elapsed_time = difftime(end, start); \r
1237 if ( t1 > 0 )\r
1238 PrintAndLog("\nTime in checkkeys: %.0f ticks %u seconds\n", (float)t1, elapsed_time);\r
1239\r
1240 \r
1241 // 20160116 If Sector A is found, but not Sector B, try just reading it of the tag?\r
1242 if ( keyType != 1 ) {\r
1243 PrintAndLog("testing to read key B...");\r
1244 for (i = 0; i < SectorsCnt; i++) {\r
1245 // KEY A but not KEY B\r
1246 if ( e_sector[i].foundKey[0] && !e_sector[i].foundKey[1] ) {\r
1247 \r
1248 uint8_t sectrail = (FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1);\r
1249 \r
1250 PrintAndLog("Reading block %d", sectrail);\r
1251 \r
1252 UsbCommand c = {CMD_MIFARE_READBL, {sectrail, 0, 0}};\r
1253 num_to_bytes(e_sector[i].Key[0], 6, c.d.asBytes); // KEY A\r
1254 clearCommandBuffer();\r
1255 SendCommand(&c);\r
1256\r
1257 UsbCommand resp;\r
1258 if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500)) continue;\r
1259 \r
1260 uint8_t isOK = resp.arg[0] & 0xff;\r
1261 if (!isOK) continue;\r
1262\r
1263 uint8_t *data = resp.d.asBytes;\r
1264 key64 = bytes_to_num(data+10, 6);\r
1265 if (key64) {\r
1266 PrintAndLog("Data:%s", sprint_hex(data+10, 6));\r
1267 e_sector[i].foundKey[1] = 1;\r
1268 e_sector[i].Key[1] = key64;\r
1269 }\r
1270 }\r
1271 }\r
1272 }\r
1273\r
1274\r
1275 //print them\r
1276 printKeyTable( SectorsCnt, e_sector );\r
1277 \r
1278 if (transferToEml) {\r
1279 uint8_t block[16] = {0x00};\r
1280 for (uint8_t i = 0; i < SectorsCnt; ++i ) {\r
1281 mfEmlGetMem(block, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1);\r
1282 if (e_sector[i].foundKey[0])\r
1283 num_to_bytes(e_sector[i].Key[0], 6, block);\r
1284 if (e_sector[i].foundKey[1])\r
1285 num_to_bytes(e_sector[i].Key[1], 6, block+10);\r
1286 mfEmlSetMem(block, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1);\r
1287 }\r
1288 PrintAndLog("Found keys have been transferred to the emulator memory");\r
1289 }\r
1290 \r
1291 if (createDumpFile) {\r
1292 FILE *fkeys = fopen("dumpkeys.bin","wb");\r
1293 if (fkeys == NULL) { \r
1294 PrintAndLog("Could not create file dumpkeys.bin");\r
1295 free(keyBlock);\r
1296 free(e_sector);\r
1297 return 1;\r
1298 }\r
1299 PrintAndLog("Printing keys to binary file dumpkeys.bin...");\r
1300 \r
1301 for( i=0; i<SectorsCnt; i++) {\r
1302 num_to_bytes(e_sector[i].Key[0], 6, tempkey);\r
1303 fwrite ( tempkey, 1, 6, fkeys );\r
1304 }\r
1305 for(i=0; i<SectorsCnt; i++) {\r
1306 num_to_bytes(e_sector[i].Key[1], 6, tempkey);\r
1307 fwrite ( tempkey, 1, 6, fkeys );\r
1308 }\r
1309 fclose(fkeys);\r
1310 PrintAndLog("Found keys have been dumped to file dumpkeys.bin. 0xffffffffffff has been inserted for unknown keys."); \r
1311 }\r
1312 \r
1313 free(keyBlock);\r
1314 free(e_sector);\r
1315 PrintAndLog("");\r
1316 return 0;\r
1317}\r
1318\r
1319int CmdHF14AMf1kSim(const char *Cmd) {\r
1320 uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};\r
1321 uint8_t exitAfterNReads = 0;\r
1322 uint8_t flags = (FLAG_UID_IN_EMUL | FLAG_4B_UID_IN_DATA);\r
1323 int uidlen = 0;\r
1324 uint8_t pnr = 0;\r
1325 uint8_t cmdp = param_getchar(Cmd, 0);\r
1326\r
1327 if (cmdp == 'h' || cmdp == 'H') return usage_hf14_mf1ksim();\r
1328\r
1329 cmdp = param_getchar(Cmd, pnr);\r
1330 if (cmdp == 'u' || cmdp == 'U') {\r
1331 param_gethex_ex(Cmd, pnr+1, uid, &uidlen);\r
1332 switch(uidlen){\r
1333 case 20: flags = FLAG_10B_UID_IN_DATA; break;\r
1334 case 14: flags = FLAG_7B_UID_IN_DATA; break;\r
1335 case 8: flags = FLAG_4B_UID_IN_DATA; break;\r
1336 default: return usage_hf14_mf1ksim();\r
1337 }\r
1338 pnr +=2;\r
1339 }\r
1340\r
1341 cmdp = param_getchar(Cmd, pnr); \r
1342 if (cmdp == 'n' || cmdp == 'N') {\r
1343 exitAfterNReads = param_get8(Cmd, pnr+1);\r
1344 pnr += 2;\r
1345 }\r
1346\r
1347 cmdp = param_getchar(Cmd, pnr); \r
1348 if (cmdp == 'i' || cmdp == 'I' ) {\r
1349 flags |= FLAG_INTERACTIVE;\r
1350 pnr++;\r
1351 }\r
1352\r
1353 cmdp = param_getchar(Cmd, pnr); \r
1354 if (cmdp == 'x' || cmdp == 'X') {\r
1355 flags |= FLAG_NR_AR_ATTACK;\r
1356 }\r
1357 \r
1358 PrintAndLog(" uid:%s, numreads:%d, flags:%d (0x%02x) "\r
1359 , (uidlen == 0 ) ? "N/A" : sprint_hex(uid, uidlen>>1)\r
1360 , exitAfterNReads\r
1361 , flags\r
1362 , flags);\r
1363\r
1364 UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads, 0}};\r
1365 memcpy(c.d.asBytes, uid, sizeof(uid));\r
1366 clearCommandBuffer();\r
1367 SendCommand(&c);\r
1368\r
1369 if(flags & FLAG_INTERACTIVE) { \r
1370 uint8_t data[32];\r
1371 uint64_t key;\r
1372 UsbCommand resp; \r
1373 PrintAndLog("Press pm3-button or send another cmd to abort simulation");\r
1374 while( !ukbhit() ){\r
1375 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500) ) continue;\r
1376\r
1377 if ( !(flags & FLAG_NR_AR_ATTACK) ) break;\r
1378 if ( (resp.arg[0] & 0xffff) != CMD_SIMULATE_MIFARE_CARD ) break;\r
1379\r
1380 memset(data, 0x00, sizeof(data)); \r
1381 int len = (resp.arg[1] > sizeof(data)) ? sizeof(data) : resp.arg[1];\r
1382\r
1383 memcpy(data, resp.d.asBytes, len); \r
1384 key = 0;\r
1385 bool found = tryMfk32(data, &key);\r
1386 found ^= tryMfk32_moebius(data, &key);\r
1387 if ( found ) break;\r
1388 }\r
1389 }\r
1390 return 0;\r
1391}\r
1392\r
1393int CmdHF14AMfSniff(const char *Cmd){\r
1394 bool wantLogToFile = FALSE;\r
1395 bool wantDecrypt = FALSE;\r
1396 //bool wantSaveToEml = FALSE; TODO\r
1397 bool wantSaveToEmlFile = FALSE;\r
1398\r
1399 //var \r
1400 int tmpchar;\r
1401 int res = 0;\r
1402 int len = 0;\r
1403 int blockLen = 0;\r
1404 int pckNum = 0;\r
1405 int num = 0;\r
1406 uint8_t uid[10];\r
1407 uint8_t uid_len = 0;\r
1408 uint8_t atqa[2] = {0x00, 0x00};\r
1409 uint8_t sak = 0;\r
1410 bool isTag = FALSE;\r
1411 uint8_t *buf = NULL;\r
1412 uint16_t bufsize = 0;\r
1413 uint8_t *bufPtr = NULL;\r
1414 uint16_t traceLen = 0;\r
1415 \r
1416 memset(uid, 0x00, sizeof(uid));\r
1417 \r
1418 char ctmp = param_getchar(Cmd, 0);\r
1419 if ( ctmp == 'h' || ctmp == 'H' ) return usage_hf14_sniff();\r
1420 \r
1421 for (int i = 0; i < 4; i++) {\r
1422 ctmp = param_getchar(Cmd, i);\r
1423 if (ctmp == 'l' || ctmp == 'L') wantLogToFile = true;\r
1424 if (ctmp == 'd' || ctmp == 'D') wantDecrypt = true;\r
1425 //if (ctmp == 'e' || ctmp == 'E') wantSaveToEml = true; TODO\r
1426 if (ctmp == 'f' || ctmp == 'F') wantSaveToEmlFile = true;\r
1427 }\r
1428 \r
1429 printf("-------------------------------------------------------------------------\n");\r
1430 printf("Executing mifare sniffing command. \n");\r
1431 printf("Press the key on the proxmark3 device to abort both proxmark3 and client.\n");\r
1432 printf("Press the key on pc keyboard to abort the client.\n");\r
1433 printf("-------------------------------------------------------------------------\n");\r
1434\r
1435 UsbCommand c = {CMD_MIFARE_SNIFFER, {0, 0, 0}};\r
1436 clearCommandBuffer();\r
1437 SendCommand(&c);\r
1438\r
1439 // wait cycle\r
1440 while (true) {\r
1441 printf(".");\r
1442 fflush(stdout);\r
1443 if (ukbhit()) {\r
1444 tmpchar = getchar();\r
1445 (void)tmpchar;\r
1446 printf("\naborted via keyboard!\n");\r
1447 break;\r
1448 }\r
1449 \r
1450 UsbCommand resp;\r
1451 if (WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {\r
1452 res = resp.arg[0] & 0xff;\r
1453 traceLen = resp.arg[1];\r
1454 len = resp.arg[2];\r
1455\r
1456 // we are done?\r
1457 if (res == 0) {\r
1458 free(buf);\r
1459 return 0;\r
1460 }\r
1461\r
1462 if (res == 1) { // there is (more) data to be transferred\r
1463 if (pckNum == 0) { // first packet, (re)allocate necessary buffer\r
1464 if (traceLen > bufsize) {\r
1465 uint8_t *p;\r
1466 if (buf == NULL) // not yet allocated\r
1467 p = malloc(traceLen);\r
1468 else // need more memory\r
1469 p = realloc(buf, traceLen);\r
1470 \r
1471 if (p == NULL) {\r
1472 PrintAndLog("Cannot allocate memory for trace");\r
1473 free(buf);\r
1474 return 2;\r
1475 }\r
1476 buf = p;\r
1477 }\r
1478 bufPtr = buf;\r
1479 bufsize = traceLen;\r
1480 memset(buf, 0x00, traceLen);\r
1481 }\r
1482 if (bufPtr == NULL) {\r
1483 PrintAndLog("Cannot allocate memory for trace");\r
1484 free(buf);\r
1485 return 2;\r
1486 }\r
1487 // what happens if LEN is bigger then TRACELEN --iceman\r
1488 memcpy(bufPtr, resp.d.asBytes, len);\r
1489 bufPtr += len;\r
1490 pckNum++;\r
1491 }\r
1492\r
1493 if (res == 2) { // received all data, start displaying\r
1494 blockLen = bufPtr - buf;\r
1495 bufPtr = buf;\r
1496 printf(">\n");\r
1497 PrintAndLog("received trace len: %d packages: %d", blockLen, pckNum);\r
1498 while (bufPtr - buf < blockLen) {\r
1499 bufPtr += 6; // skip (void) timing information\r
1500 len = *((uint16_t *)bufPtr);\r
1501 if(len & 0x8000) {\r
1502 isTag = true;\r
1503 len &= 0x7fff;\r
1504 } else {\r
1505 isTag = false;\r
1506 }\r
1507 bufPtr += 2;\r
1508 if ((len == 17) && (bufPtr[0] == 0xff) && (bufPtr[1] == 0xff) && (bufPtr[15] == 0xff) && (bufPtr[16] == 0xff)) {\r
1509 memcpy(uid, bufPtr + 2, 10);\r
1510 memcpy(atqa, bufPtr + 2 + 10, 2);\r
1511 switch (atqa[0] & 0xC0) {\r
1512 case 0x80: uid_len = 10; break;\r
1513 case 0x40: uid_len = 7; break;\r
1514 default: uid_len = 4; break;\r
1515 }\r
1516 sak = bufPtr[14];\r
1517 PrintAndLog("tag select uid| %s atqa:0x%02x%02x sak:0x%02x", \r
1518 sprint_hex(uid, uid_len),\r
1519 atqa[1], \r
1520 atqa[0], \r
1521 sak);\r
1522 if (wantLogToFile || wantDecrypt) {\r
1523 FillFileNameByUID(logHexFileName, uid, ".log", uid_len);\r
1524 AddLogCurrentDT(logHexFileName);\r
1525 } \r
1526 if (wantDecrypt)\r
1527 mfTraceInit(uid, uid_len, atqa, sak, wantSaveToEmlFile);\r
1528 } else {\r
1529 PrintAndLog("%03d| %s |%s", num, isTag ? "TAG" : "RDR", sprint_hex(bufPtr, len));\r
1530 if (wantLogToFile) \r
1531 AddLogHex(logHexFileName, isTag ? "TAG| ":"RDR| ", bufPtr, len);\r
1532 if (wantDecrypt) \r
1533 mfTraceDecode(bufPtr, len, wantSaveToEmlFile);\r
1534 num++; \r
1535 }\r
1536 bufPtr += len;\r
1537 bufPtr += ((len-1)/8+1); // ignore parity\r
1538 }\r
1539 pckNum = 0;\r
1540 }\r
1541 } // resp not NULL\r
1542 } // while (true)\r
1543\r
1544 free(buf);\r
1545 return 0;\r
1546}\r
1547\r
1548int CmdHF14AMfDbg(const char *Cmd) {\r
1549\r
1550 char ctmp = param_getchar(Cmd, 0);\r
1551 if (strlen(Cmd) < 1 || ctmp == 'h'|| ctmp == 'H') return usage_hf14_dbg();\r
1552 \r
1553 uint8_t dbgMode = param_get8ex(Cmd, 0, 0, 10);\r
1554 if (dbgMode > 4) return usage_hf14_dbg();\r
1555\r
1556 UsbCommand c = {CMD_MIFARE_SET_DBGMODE, {dbgMode, 0, 0}};\r
1557 SendCommand(&c);\r
1558 return 0;\r
1559}\r
1560\r
1561void printKeyTable( uint8_t sectorscnt, sector *e_sector ){\r
1562 PrintAndLog("|---|----------------|---|----------------|---|");\r
1563 PrintAndLog("|sec|key A |res|key B |res|");\r
1564 PrintAndLog("|---|----------------|---|----------------|---|");\r
1565 for (uint8_t i = 0; i < sectorscnt; ++i) {\r
1566 PrintAndLog("|%03d| %012"llx" | %d | %012"llx" | %d |", i,\r
1567 e_sector[i].Key[0], e_sector[i].foundKey[0], \r
1568 e_sector[i].Key[1], e_sector[i].foundKey[1]\r
1569 );\r
1570 }\r
1571 PrintAndLog("|---|----------------|---|----------------|---|");\r
1572}\r
1573\r
1574// EMULATOR COMMANDS\r
1575\r
1576int CmdHF14AMfEGet(const char *Cmd)\r
1577{\r
1578 uint8_t blockNo = 0;\r
1579 uint8_t data[16] = {0x00};\r
1580\r
1581 if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {\r
1582 PrintAndLog("Usage: hf mf eget <block number>");\r
1583 PrintAndLog(" sample: hf mf eget 0 ");\r
1584 return 0;\r
1585 } \r
1586 \r
1587 blockNo = param_get8(Cmd, 0);\r
1588\r
1589 PrintAndLog(" ");\r
1590 if (!mfEmlGetMem(data, blockNo, 1)) {\r
1591 PrintAndLog("data[%3d]:%s", blockNo, sprint_hex(data, 16));\r
1592 } else {\r
1593 PrintAndLog("Command execute timeout");\r
1594 }\r
1595\r
1596 return 0;\r
1597}\r
1598\r
1599int CmdHF14AMfEClear(const char *Cmd)\r
1600{\r
1601 if (param_getchar(Cmd, 0) == 'h') {\r
1602 PrintAndLog("Usage: hf mf eclr");\r
1603 PrintAndLog("It set card emulator memory to empty data blocks and key A/B FFFFFFFFFFFF \n");\r
1604 return 0;\r
1605 } \r
1606\r
1607 UsbCommand c = {CMD_MIFARE_EML_MEMCLR, {0, 0, 0}};\r
1608 SendCommand(&c);\r
1609 return 0;\r
1610}\r
1611\r
1612int CmdHF14AMfESet(const char *Cmd)\r
1613{\r
1614 uint8_t memBlock[16];\r
1615 uint8_t blockNo = 0;\r
1616\r
1617 memset(memBlock, 0x00, sizeof(memBlock));\r
1618\r
1619 if (strlen(Cmd) < 3 || param_getchar(Cmd, 0) == 'h') {\r
1620 PrintAndLog("Usage: hf mf eset <block number> <block data (32 hex symbols)>");\r
1621 PrintAndLog(" sample: hf mf eset 1 000102030405060708090a0b0c0d0e0f ");\r
1622 return 0;\r
1623 } \r
1624 \r
1625 blockNo = param_get8(Cmd, 0);\r
1626 \r
1627 if (param_gethex(Cmd, 1, memBlock, 32)) {\r
1628 PrintAndLog("block data must include 32 HEX symbols");\r
1629 return 1;\r
1630 }\r
1631 \r
1632 // 1 - blocks count\r
1633 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNo, 1, 0}};\r
1634 memcpy(c.d.asBytes, memBlock, 16);\r
1635 SendCommand(&c);\r
1636 return 0;\r
1637}\r
1638\r
1639int CmdHF14AMfELoad(const char *Cmd)\r
1640{\r
1641 FILE * f;\r
1642 char filename[FILE_PATH_SIZE];\r
1643 char *fnameptr = filename;\r
1644 char buf[64] = {0x00};\r
1645 uint8_t buf8[64] = {0x00};\r
1646 int i, len, blockNum, numBlocks;\r
1647 int nameParamNo = 1;\r
1648 uint8_t blockWidth = 32;\r
1649 char ctmp = param_getchar(Cmd, 0);\r
1650 \r
1651 if ( ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) {\r
1652 PrintAndLog("It loads emul dump from the file `filename.eml`");\r
1653 PrintAndLog("Usage: hf mf eload [card memory] <file name w/o `.eml`> [numblocks]");\r
1654 PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K, u = UL");\r
1655 PrintAndLog("");\r
1656 PrintAndLog(" sample: hf mf eload filename");\r
1657 PrintAndLog(" hf mf eload 4 filename");\r
1658 return 0;\r
1659 } \r
1660\r
1661 switch (ctmp) {\r
1662 case '0' : numBlocks = 5*4; break;\r
1663 case '1' : \r
1664 case '\0': numBlocks = 16*4; break;\r
1665 case '2' : numBlocks = 32*4; break;\r
1666 case '4' : numBlocks = 256; break;\r
1667 case 'U' : // fall through\r
1668 case 'u' : numBlocks = 255; blockWidth = 8; break;\r
1669 default: {\r
1670 numBlocks = 16*4;\r
1671 nameParamNo = 0;\r
1672 }\r
1673 }\r
1674 uint32_t numblk2 = param_get32ex(Cmd,2,0,10);\r
1675 if (numblk2 > 0) numBlocks = numblk2; \r
1676\r
1677 len = param_getstr(Cmd,nameParamNo,filename);\r
1678 \r
1679 if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r
1680\r
1681 fnameptr += len;\r
1682\r
1683 sprintf(fnameptr, ".eml"); \r
1684 \r
1685 // open file\r
1686 f = fopen(filename, "r");\r
1687 if (f == NULL) {\r
1688 PrintAndLog("File %s not found or locked", filename);\r
1689 return 1;\r
1690 }\r
1691 \r
1692 blockNum = 0;\r
1693 while(!feof(f)){\r
1694 memset(buf, 0, sizeof(buf));\r
1695 \r
1696 if (fgets(buf, sizeof(buf), f) == NULL) {\r
1697 \r
1698 if (blockNum >= numBlocks) break;\r
1699 \r
1700 PrintAndLog("File reading error.");\r
1701 fclose(f);\r
1702 return 2;\r
1703 }\r
1704 \r
1705 if (strlen(buf) < blockWidth){\r
1706 if(strlen(buf) && feof(f))\r
1707 break;\r
1708 PrintAndLog("File content error. Block data must include %d HEX symbols", blockWidth);\r
1709 fclose(f);\r
1710 return 2;\r
1711 }\r
1712 \r
1713 for (i = 0; i < blockWidth; i += 2) {\r
1714 sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]);\r
1715 }\r
1716 if (mfEmlSetMem_xt(buf8, blockNum, 1, blockWidth/2)) {\r
1717 PrintAndLog("Cant set emul block: %3d", blockNum);\r
1718 fclose(f);\r
1719 return 3;\r
1720 }\r
1721 printf(".");\r
1722 blockNum++;\r
1723 \r
1724 if (blockNum >= numBlocks) break;\r
1725 }\r
1726 fclose(f);\r
1727 printf("\n");\r
1728 \r
1729 if ((blockNum != numBlocks)) {\r
1730 PrintAndLog("File content error. Got %d must be %d blocks.",blockNum, numBlocks);\r
1731 return 4;\r
1732 }\r
1733 PrintAndLog("Loaded %d blocks from file: %s", blockNum, filename);\r
1734 return 0;\r
1735}\r
1736\r
1737int CmdHF14AMfESave(const char *Cmd)\r
1738{\r
1739 FILE * f;\r
1740 char filename[FILE_PATH_SIZE];\r
1741 char * fnameptr = filename;\r
1742 uint8_t buf[64];\r
1743 int i, j, len, numBlocks;\r
1744 int nameParamNo = 1;\r
1745 \r
1746 memset(filename, 0, sizeof(filename));\r
1747 memset(buf, 0, sizeof(buf));\r
1748\r
1749 char ctmp = param_getchar(Cmd, 0);\r
1750 \r
1751 if ( ctmp == 'h' || ctmp == 'H') {\r
1752 PrintAndLog("It saves emul dump into the file `filename.eml` or `cardID.eml`");\r
1753 PrintAndLog(" Usage: hf mf esave [card memory] [file name w/o `.eml`]");\r
1754 PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");\r
1755 PrintAndLog("");\r
1756 PrintAndLog(" sample: hf mf esave ");\r
1757 PrintAndLog(" hf mf esave 4");\r
1758 PrintAndLog(" hf mf esave 4 filename");\r
1759 return 0;\r
1760 } \r
1761\r
1762 switch (ctmp) {\r
1763 case '0' : numBlocks = 5*4; break;\r
1764 case '1' : \r
1765 case '\0': numBlocks = 16*4; break;\r
1766 case '2' : numBlocks = 32*4; break;\r
1767 case '4' : numBlocks = 256; break;\r
1768 default: {\r
1769 numBlocks = 16*4;\r
1770 nameParamNo = 0;\r
1771 }\r
1772 }\r
1773\r
1774 len = param_getstr(Cmd,nameParamNo,filename);\r
1775 \r
1776 if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r
1777 \r
1778 // user supplied filename?\r
1779 if (len < 1) {\r
1780 // get filename (UID from memory)\r
1781 if (mfEmlGetMem(buf, 0, 1)) {\r
1782 PrintAndLog("Can\'t get UID from block: %d", 0);\r
1783 len = sprintf(fnameptr, "dump");\r
1784 fnameptr += len;\r
1785 }\r
1786 else {\r
1787 for (j = 0; j < 7; j++, fnameptr += 2)\r
1788 sprintf(fnameptr, "%02X", buf[j]);\r
1789 }\r
1790 } else {\r
1791 fnameptr += len;\r
1792 }\r
1793\r
1794 // add file extension\r
1795 sprintf(fnameptr, ".eml"); \r
1796 \r
1797 // open file\r
1798 f = fopen(filename, "w+");\r
1799\r
1800 if ( !f ) {\r
1801 PrintAndLog("Can't open file %s ", filename);\r
1802 return 1;\r
1803 }\r
1804 \r
1805 // put hex\r
1806 for (i = 0; i < numBlocks; i++) {\r
1807 if (mfEmlGetMem(buf, i, 1)) {\r
1808 PrintAndLog("Cant get block: %d", i);\r
1809 break;\r
1810 }\r
1811 for (j = 0; j < 16; j++)\r
1812 fprintf(f, "%02X", buf[j]); \r
1813 fprintf(f,"\n");\r
1814 }\r
1815 fclose(f);\r
1816 \r
1817 PrintAndLog("Saved %d blocks to file: %s", numBlocks, filename);\r
1818 \r
1819 return 0;\r
1820}\r
1821\r
1822int CmdHF14AMfECFill(const char *Cmd)\r
1823{\r
1824 uint8_t keyType = 0;\r
1825 uint8_t numSectors = 16;\r
1826 \r
1827 if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {\r
1828 PrintAndLog("Usage: hf mf ecfill <key A/B> [card memory]");\r
1829 PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");\r
1830 PrintAndLog("");\r
1831 PrintAndLog("samples: hf mf ecfill A");\r
1832 PrintAndLog(" hf mf ecfill A 4");\r
1833 PrintAndLog("Read card and transfer its data to emulator memory.");\r
1834 PrintAndLog("Keys must be laid in the emulator memory. \n");\r
1835 return 0;\r
1836 } \r
1837\r
1838 char ctmp = param_getchar(Cmd, 0);\r
1839 if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {\r
1840 PrintAndLog("Key type must be A or B");\r
1841 return 1;\r
1842 }\r
1843 if (ctmp != 'A' && ctmp != 'a') keyType = 1;\r
1844\r
1845 ctmp = param_getchar(Cmd, 1);\r
1846 switch (ctmp) {\r
1847 case '0' : numSectors = 5; break;\r
1848 case '1' : \r
1849 case '\0': numSectors = 16; break;\r
1850 case '2' : numSectors = 32; break;\r
1851 case '4' : numSectors = 40; break;\r
1852 default: numSectors = 16;\r
1853 } \r
1854\r
1855 printf("--params: numSectors: %d, keyType:%d", numSectors, keyType);\r
1856 UsbCommand c = {CMD_MIFARE_EML_CARDLOAD, {numSectors, keyType, 0}};\r
1857 SendCommand(&c);\r
1858 return 0;\r
1859}\r
1860\r
1861int CmdHF14AMfEKeyPrn(const char *Cmd)\r
1862{\r
1863 int i;\r
1864 uint8_t numSectors;\r
1865 uint8_t data[16];\r
1866 uint64_t keyA, keyB;\r
1867\r
1868 char cmdp = param_getchar(Cmd, 0);\r
1869 \r
1870 if ( cmdp == 'h' || cmdp == 'H' ) {\r
1871 PrintAndLog("It prints the keys loaded in the emulator memory");\r
1872 PrintAndLog("Usage: hf mf ekeyprn [card memory]");\r
1873 PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");\r
1874 PrintAndLog("");\r
1875 PrintAndLog(" sample: hf mf ekeyprn 1");\r
1876 return 0;\r
1877 } \r
1878\r
1879 switch (cmdp) {\r
1880 case '0' : numSectors = 5; break;\r
1881 case '1' : \r
1882 case '\0': numSectors = 16; break;\r
1883 case '2' : numSectors = 32; break;\r
1884 case '4' : numSectors = 40; break;\r
1885 default: numSectors = 16;\r
1886 } \r
1887 \r
1888 PrintAndLog("|---|----------------|----------------|");\r
1889 PrintAndLog("|sec|key A |key B |");\r
1890 PrintAndLog("|---|----------------|----------------|");\r
1891 for (i = 0; i < numSectors; i++) {\r
1892 if (mfEmlGetMem(data, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1)) {\r
1893 PrintAndLog("error get block %d", FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1);\r
1894 break;\r
1895 }\r
1896 keyA = bytes_to_num(data, 6);\r
1897 keyB = bytes_to_num(data + 10, 6);\r
1898 PrintAndLog("|%03d| %012"llx" | %012"llx" |", i, keyA, keyB);\r
1899 }\r
1900 PrintAndLog("|---|----------------|----------------|");\r
1901 \r
1902 return 0;\r
1903}\r
1904\r
1905// CHINESE MAGIC COMMANDS \r
1906\r
1907int CmdHF14AMfCSetUID(const char *Cmd) {\r
1908 uint8_t wipeCard = 0;\r
1909 uint8_t uid[8] = {0x00};\r
1910 uint8_t oldUid[8] = {0x00};\r
1911 uint8_t atqa[2] = {0x00};\r
1912 uint8_t sak[1] = {0x00};\r
1913 uint8_t atqaPresent = 1;\r
1914 int res;\r
1915 char ctmp;\r
1916 int argi=0;\r
1917\r
1918 if (strlen(Cmd) < 1 || param_getchar(Cmd, argi) == 'h') {\r
1919 PrintAndLog("Set UID, ATQA, and SAK for magic Chinese card (only works with such cards)");\r
1920 PrintAndLog("If you also want to wipe the card then add 'w' at the end of the command line.");\r
1921 PrintAndLog("");\r
1922 PrintAndLog("Usage: hf mf csetuid <UID 8 hex symbols> [ATQA 4 hex symbols SAK 2 hex symbols] [w]");\r
1923 PrintAndLog("");\r
1924 PrintAndLog("sample: hf mf csetuid 01020304");\r
1925 PrintAndLog(" hf mf csetuid 01020304 0004 08 w");\r
1926 return 0;\r
1927 }\r
1928\r
1929 if (param_getchar(Cmd, argi) && param_gethex(Cmd, argi, uid, 8)) {\r
1930 PrintAndLog("UID must include 8 HEX symbols");\r
1931 return 1;\r
1932 }\r
1933 argi++;\r
1934\r
1935 ctmp = param_getchar(Cmd, argi);\r
1936 if (ctmp == 'w' || ctmp == 'W') {\r
1937 wipeCard = 1;\r
1938 atqaPresent = 0;\r
1939 }\r
1940\r
1941 if (atqaPresent) {\r
1942 if (param_getchar(Cmd, argi)) {\r
1943 if (param_gethex(Cmd, argi, atqa, 4)) {\r
1944 PrintAndLog("ATQA must include 4 HEX symbols");\r
1945 return 1;\r
1946 }\r
1947 argi++;\r
1948 if (!param_getchar(Cmd, argi) || param_gethex(Cmd, argi, sak, 2)) {\r
1949 PrintAndLog("SAK must include 2 HEX symbols");\r
1950 return 1;\r
1951 }\r
1952 argi++;\r
1953 } else\r
1954 atqaPresent = 0;\r
1955 }\r
1956\r
1957 if(!wipeCard) {\r
1958 ctmp = param_getchar(Cmd, argi);\r
1959 if (ctmp == 'w' || ctmp == 'W') {\r
1960 wipeCard = 1;\r
1961 }\r
1962 }\r
1963\r
1964 PrintAndLog("--wipe card:%s uid:%s", (wipeCard)?"YES":"NO", sprint_hex(uid, 4));\r
1965\r
1966 res = mfCSetUID(uid, (atqaPresent) ? atqa : NULL, (atqaPresent) ? sak : NULL, oldUid, wipeCard);\r
1967 if (res) {\r
1968 PrintAndLog("Can't set UID. error=%d", res);\r
1969 return 1;\r
1970 }\r
1971 \r
1972 PrintAndLog("old UID:%s", sprint_hex(oldUid, 4));\r
1973 PrintAndLog("new UID:%s", sprint_hex(uid, 4));\r
1974 return 0;\r
1975}\r
1976\r
1977int CmdHF14AMfCSetBlk(const char *Cmd) {\r
1978 uint8_t block[16] = {0x00};\r
1979 uint8_t blockNo = 0;\r
1980 uint8_t params = MAGIC_SINGLE;\r
1981 int res;\r
1982\r
1983 if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {\r
1984 PrintAndLog("Usage: hf mf csetblk <block number> <block data (32 hex symbols)> [w]");\r
1985 PrintAndLog("sample: hf mf csetblk 1 01020304050607080910111213141516");\r
1986 PrintAndLog("Set block data for magic Chinese card (only works with such cards)");\r
1987 PrintAndLog("If you also want wipe the card then add 'w' at the end of the command line");\r
1988 return 0;\r
1989 } \r
1990\r
1991 blockNo = param_get8(Cmd, 0);\r
1992\r
1993 if (param_gethex(Cmd, 1, block, 32)) {\r
1994 PrintAndLog("block data must include 32 HEX symbols");\r
1995 return 1;\r
1996 }\r
1997\r
1998 char ctmp = param_getchar(Cmd, 2);\r
1999 if (ctmp == 'w' || ctmp == 'W')\r
2000 params |= MAGIC_WIPE;\r
2001 \r
2002 PrintAndLog("--block number:%2d data:%s", blockNo, sprint_hex(block, 16));\r
2003\r
2004 res = mfCSetBlock(blockNo, block, NULL, params);\r
2005 if (res) {\r
2006 PrintAndLog("Can't write block. error=%d", res);\r
2007 return 1;\r
2008 }\r
2009 return 0;\r
2010}\r
2011\r
2012int CmdHF14AMfCLoad(const char *Cmd) {\r
2013 FILE * f;\r
2014 char filename[FILE_PATH_SIZE];\r
2015 char * fnameptr = filename;\r
2016 char buf[64] = {0x00};\r
2017 uint8_t buf8[64] = {0x00};\r
2018 uint8_t fillFromEmulator = 0;\r
2019 int i, len, blockNum, flags=0;\r
2020\r
2021 memset(filename, 0, sizeof(filename));\r
2022 \r
2023 char ctmp = param_getchar(Cmd, 0);\r
2024 \r
2025 if (ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) {\r
2026 PrintAndLog("It loads magic Chinese card from the file `filename.eml`");\r
2027 PrintAndLog("or from emulator memory (option `e`)");\r
2028 PrintAndLog("Usage: hf mf cload <file name w/o `.eml`>");\r
2029 PrintAndLog(" or: hf mf cload e ");\r
2030 PrintAndLog(" sample: hf mf cload filename");\r
2031 return 0;\r
2032 } \r
2033\r
2034 if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;\r
2035 \r
2036 if (fillFromEmulator) {\r
2037 for (blockNum = 0; blockNum < 16 * 4; blockNum += 1) {\r
2038 if (mfEmlGetMem(buf8, blockNum, 1)) {\r
2039 PrintAndLog("Cant get block: %d", blockNum);\r
2040 return 2;\r
2041 }\r
2042 if (blockNum == 0) flags = MAGIC_INIT + MAGIC_WUPC; // switch on field and send magic sequence\r
2043 if (blockNum == 1) flags = 0; // just write\r
2044 if (blockNum == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF; // Done. Magic Halt and switch off field.\r
2045\r
2046 if (mfCSetBlock(blockNum, buf8, NULL, flags)) {\r
2047 PrintAndLog("Cant set magic card block: %d", blockNum);\r
2048 return 3;\r
2049 }\r
2050 }\r
2051 return 0;\r
2052 } else {\r
2053 len = strlen(Cmd);\r
2054 if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r
2055\r
2056 memcpy(filename, Cmd, len);\r
2057 fnameptr += len;\r
2058\r
2059 sprintf(fnameptr, ".eml"); \r
2060 \r
2061 // open file\r
2062 f = fopen(filename, "r");\r
2063 if (f == NULL) {\r
2064 PrintAndLog("File not found or locked.");\r
2065 return 1;\r
2066 }\r
2067 \r
2068 blockNum = 0;\r
2069 while(!feof(f)){\r
2070 \r
2071 memset(buf, 0, sizeof(buf));\r
2072 \r
2073 if (fgets(buf, sizeof(buf), f) == NULL) {\r
2074 fclose(f);\r
2075 PrintAndLog("File reading error.");\r
2076 return 2;\r
2077 }\r
2078\r
2079 if (strlen(buf) < 32) {\r
2080 if(strlen(buf) && feof(f))\r
2081 break;\r
2082 PrintAndLog("File content error. Block data must include 32 HEX symbols");\r
2083 fclose(f);\r
2084 return 2;\r
2085 }\r
2086 for (i = 0; i < 32; i += 2)\r
2087 sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]);\r
2088\r
2089 if (blockNum == 0) flags = MAGIC_INIT + MAGIC_WUPC; // switch on field and send magic sequence\r
2090 if (blockNum == 1) flags = 0; // just write\r
2091 if (blockNum == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF; // Done. Switch off field.\r
2092\r
2093 if (mfCSetBlock(blockNum, buf8, NULL, flags)) {\r
2094 PrintAndLog("Can't set magic card block: %d", blockNum);\r
2095 fclose(f);\r
2096 return 3;\r
2097 }\r
2098 blockNum++;\r
2099 \r
2100 if (blockNum >= 16 * 4) break; // magic card type - mifare 1K\r
2101 }\r
2102 fclose(f);\r
2103 \r
2104 // 64 or 256blocks.\r
2105 if (blockNum != 16 * 4 && blockNum != 32 * 4 + 8 * 16){\r
2106 PrintAndLog("File content error. There must be 64 blocks");\r
2107 return 4;\r
2108 }\r
2109 PrintAndLog("Loaded from file: %s", filename);\r
2110 return 0;\r
2111 }\r
2112 return 0;\r
2113}\r
2114\r
2115int CmdHF14AMfCGetBlk(const char *Cmd) {\r
2116 uint8_t data[16];\r
2117 uint8_t blockNo = 0;\r
2118 int res;\r
2119 memset(data, 0x00, sizeof(data));\r
2120 char ctmp = param_getchar(Cmd, 0);\r
2121\r
2122 if (strlen(Cmd) < 1 || ctmp == 'h' || ctmp == 'H') {\r
2123 PrintAndLog("Usage: hf mf cgetblk <block number>");\r
2124 PrintAndLog("sample: hf mf cgetblk 1");\r
2125 PrintAndLog("Get block data from magic Chinese card (only works with such cards)\n");\r
2126 return 0;\r
2127 } \r
2128\r
2129 blockNo = param_get8(Cmd, 0);\r
2130\r
2131 PrintAndLog("--block number:%2d ", blockNo);\r
2132\r
2133 res = mfCGetBlock(blockNo, data, MAGIC_SINGLE);\r
2134 if (res) {\r
2135 PrintAndLog("Can't read block. error=%d", res);\r
2136 return 1;\r
2137 }\r
2138 \r
2139 PrintAndLog("data: %s", sprint_hex(data, sizeof(data)));\r
2140 return 0;\r
2141}\r
2142\r
2143int CmdHF14AMfCGetSc(const char *Cmd) {\r
2144 uint8_t data[16];\r
2145 uint8_t sectorNo = 0;\r
2146 int i, res, flags;\r
2147 memset(data, 0x00, sizeof(data));\r
2148 char ctmp = param_getchar(Cmd, 0);\r
2149 \r
2150 if (strlen(Cmd) < 1 || ctmp == 'h' || ctmp == 'H') {\r
2151 PrintAndLog("Usage: hf mf cgetsc <sector number>");\r
2152 PrintAndLog("sample: hf mf cgetsc 0");\r
2153 PrintAndLog("Get sector data from magic Chinese card (only works with such cards)\n");\r
2154 return 0;\r
2155 } \r
2156\r
2157 sectorNo = param_get8(Cmd, 0);\r
2158 if (sectorNo > 15) {\r
2159 PrintAndLog("Sector number must be in [0..15] as in MIFARE classic.");\r
2160 return 1;\r
2161 }\r
2162\r
2163 PrintAndLog("--sector number:%d ", sectorNo);\r
2164 PrintAndLog("block | data");\r
2165\r
2166 flags = MAGIC_INIT + MAGIC_WUPC;\r
2167 for (i = 0; i < 4; i++) {\r
2168 if (i == 1) flags = 0;\r
2169 if (i == 3) flags = MAGIC_HALT + MAGIC_OFF;\r
2170\r
2171 res = mfCGetBlock(sectorNo * 4 + i, data, flags);\r
2172 if (res) {\r
2173 PrintAndLog("Can't read block. %d error=%d", sectorNo * 4 + i, res);\r
2174 return 1;\r
2175 } \r
2176 PrintAndLog(" %3d | %s", sectorNo * 4 + i, sprint_hex(data, sizeof(data)));\r
2177 }\r
2178 return 0;\r
2179}\r
2180\r
2181int CmdHF14AMfCSave(const char *Cmd) {\r
2182\r
2183 FILE * f;\r
2184 char filename[FILE_PATH_SIZE];\r
2185 char * fnameptr = filename;\r
2186 uint8_t fillFromEmulator = 0;\r
2187 uint8_t buf[64];\r
2188 int i, j, len, flags;\r
2189 \r
2190 memset(filename, 0, sizeof(filename));\r
2191 memset(buf, 0, sizeof(buf));\r
2192 char ctmp = param_getchar(Cmd, 0);\r
2193 \r
2194 if ( ctmp == 'h' || ctmp == 'H' ) {\r
2195 PrintAndLog("It saves `magic Chinese` card dump into the file `filename.eml` or `cardID.eml`");\r
2196 PrintAndLog("or into emulator memory (option `e`)");\r
2197 PrintAndLog("Usage: hf mf esave [file name w/o `.eml`][e]");\r
2198 PrintAndLog(" sample: hf mf esave ");\r
2199 PrintAndLog(" hf mf esave filename");\r
2200 PrintAndLog(" hf mf esave e \n");\r
2201 return 0;\r
2202 } \r
2203 if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;\r
2204\r
2205 if (fillFromEmulator) {\r
2206 // put into emulator\r
2207 flags = MAGIC_INIT + MAGIC_WUPC;\r
2208 for (i = 0; i < 16 * 4; i++) {\r
2209 if (i == 1) flags = 0;\r
2210 if (i == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF;\r
2211 \r
2212 if (mfCGetBlock(i, buf, flags)) {\r
2213 PrintAndLog("Cant get block: %d", i);\r
2214 break;\r
2215 }\r
2216 \r
2217 if (mfEmlSetMem(buf, i, 1)) {\r
2218 PrintAndLog("Cant set emul block: %d", i);\r
2219 return 3;\r
2220 }\r
2221 }\r
2222 return 0;\r
2223 } else {\r
2224 len = strlen(Cmd);\r
2225 if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r
2226 \r
2227 // get filename based on UID\r
2228 if (len < 1) {\r
2229 \r
2230 if (mfCGetBlock(0, buf, MAGIC_SINGLE)) {\r
2231 PrintAndLog("Cant get block: %d", 0);\r
2232 len = sprintf(fnameptr, "dump");\r
2233 fnameptr += len;\r
2234 } else {\r
2235 for (j = 0; j < 7; j++, fnameptr += 2)\r
2236 sprintf(fnameptr, "%02x", buf[j]); \r
2237 }\r
2238 } else {\r
2239 memcpy(filename, Cmd, len);\r
2240 fnameptr += len;\r
2241 }\r
2242\r
2243 // add .eml extension\r
2244 sprintf(fnameptr, ".eml"); \r
2245 \r
2246 // open file\r
2247 f = fopen(filename, "w+");\r
2248\r
2249 if (f == NULL) {\r
2250 PrintAndLog("File not found or locked.");\r
2251 return 1;\r
2252 }\r
2253\r
2254 // put hex\r
2255 flags = MAGIC_INIT + MAGIC_WUPC;\r
2256 for (i = 0; i < 16 * 4; i++) {\r
2257 if (i == 1) flags = 0;\r
2258 if (i == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF;\r
2259 \r
2260 if (mfCGetBlock(i, buf, flags)) {\r
2261 PrintAndLog("Cant get block: %d", i);\r
2262 break;\r
2263 }\r
2264 for (j = 0; j < 16; j++)\r
2265 fprintf(f, "%02x", buf[j]); \r
2266 fprintf(f,"\n");\r
2267 }\r
2268 fflush(f);\r
2269 fclose(f);\r
2270 PrintAndLog("Saved to file: %s", filename);\r
2271 return 0;\r
2272 }\r
2273}\r
2274\r
2275//needs nt, ar, at, Data to decrypt\r
2276int CmdHf14MfDecryptBytes(const char *Cmd){\r
2277 uint8_t data[50];\r
2278 uint32_t nt = param_get32ex(Cmd,0,0,16);\r
2279 uint32_t ar_enc = param_get32ex(Cmd,1,0,16);\r
2280 uint32_t at_enc = param_get32ex(Cmd,2,0,16);\r
2281\r
2282 int len = 0;\r
2283 param_gethex_ex(Cmd, 3, data, &len);\r
2284 \r
2285 len /= 2; \r
2286 int limit = sizeof(data) / 2;\r
2287 \r
2288 if ( len >= limit )\r
2289 len = limit;\r
2290 \r
2291 return tryDecryptWord( nt, ar_enc, at_enc, data, len);\r
2292}\r
2293\r
2294static command_t CommandTable[] = {\r
2295 {"help", CmdHelp, 1, "This help"},\r
2296 {"dbg", CmdHF14AMfDbg, 0, "Set default debug mode"},\r
2297 {"rdbl", CmdHF14AMfRdBl, 0, "Read MIFARE classic block"},\r
2298 {"rdsc", CmdHF14AMfRdSc, 0, "Read MIFARE classic sector"},\r
2299 {"dump", CmdHF14AMfDump, 0, "Dump MIFARE classic tag to binary file"},\r
2300 {"restore", CmdHF14AMfRestore, 0, "Restore MIFARE classic binary file to BLANK tag"},\r
2301 {"wrbl", CmdHF14AMfWrBl, 0, "Write MIFARE classic block"},\r
2302 {"chk", CmdHF14AMfChk, 0, "Test block keys"},\r
2303 {"mifare", CmdHF14AMifare, 0, "Read parity error messages."},\r
2304 {"nested", CmdHF14AMfNested, 0, "Test nested authentication"},\r
2305 {"hardnested", CmdHF14AMfNestedHard, 0, "Nested attack for hardened Mifare cards"},\r
2306 {"sniff", CmdHF14AMfSniff, 0, "Sniff card-reader communication"},\r
2307 {"sim", CmdHF14AMf1kSim, 0, "Simulate MIFARE card"},\r
2308 {"eclr", CmdHF14AMfEClear, 0, "Clear simulator memory block"},\r
2309 {"eget", CmdHF14AMfEGet, 0, "Get simulator memory block"},\r
2310 {"eset", CmdHF14AMfESet, 0, "Set simulator memory block"},\r
2311 {"eload", CmdHF14AMfELoad, 0, "Load from file emul dump"},\r
2312 {"esave", CmdHF14AMfESave, 0, "Save to file emul dump"},\r
2313 {"ecfill", CmdHF14AMfECFill, 0, "Fill simulator memory with help of keys from simulator"},\r
2314 {"ekeyprn", CmdHF14AMfEKeyPrn, 0, "Print keys from simulator memory"},\r
2315 {"csetuid", CmdHF14AMfCSetUID, 0, "Set UID for magic Chinese card"},\r
2316 {"csetblk", CmdHF14AMfCSetBlk, 0, "Write block - Magic Chinese card"},\r
2317 {"cgetblk", CmdHF14AMfCGetBlk, 0, "Read block - Magic Chinese card"},\r
2318 {"cgetsc", CmdHF14AMfCGetSc, 0, "Read sector - Magic Chinese card"},\r
2319 {"cload", CmdHF14AMfCLoad, 0, "Load dump into magic Chinese card"},\r
2320 {"csave", CmdHF14AMfCSave, 0, "Save dump from magic Chinese card into file or emulator"},\r
2321 {"decrypt", CmdHf14MfDecryptBytes, 1, "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace"},\r
2322 {NULL, NULL, 0, NULL}\r
2323};\r
2324\r
2325int CmdHFMF(const char *Cmd) {\r
2326 clearCommandBuffer();\r
2327 CmdsParse(CommandTable, Cmd);\r
2328 return 0;\r
2329}\r
2330\r
2331int CmdHelp(const char *Cmd) {\r
2332 CmdsHelp(CommandTable);\r
2333 return 0;\r
2334}\r
Impressum, Datenschutz