Add EM410x bruteforcing function by simulating EM410x tags (1 UID/s)

[proxmark3-svn] / client / scripts / mfkeys.lua

diff --git a/client/scripts/mfkeys.lua b/client/scripts/mfkeys.lua
index 9471ad4bf3f8fb0283635a57427e518948ee5346..c54f6e6777766182c5b03aa1d674baf995d2b78e 100644 (file)
--- a/client/scripts/mfkeys.lua
+++ b/client/scripts/mfkeys.lua
@@ -86,6 +86,7 @@ function checkBlock(blockNo, keys, keyType)
        -- The command data is only 512 bytes, each key is 6 bytes, meaning that we can send max 85 keys in one go. 
        -- If there's more, we need to split it up
        local start, remaining= 1, #keys
+       local arg1 = bit32.bor(bit32.lshift(keyType, 8), blockNo)
        local packets = {}
        while remaining > 0 do
                local n,data = remaining, nil
@@ -95,8 +96,8 @@ function checkBlock(blockNo, keys, keyType)
                --print("data len", #data)
                print(("Testing block %d, keytype %d, with %d keys"):format(blockNo, keyType, n))
                local command = Command:new{cmd = cmds.CMD_MIFARE_CHKKEYS, 
-                                                               arg1 = blockNo, 
-                                                               arg2 = keyType, 
+                                                               arg1 = arg1, 
+                                                               arg2 = 1, 
                                                                arg3 = n, 
                                                                data = data}
                local status = checkCommand(command)