Minor fix, sometimes when data is sent without the pm3 is connected, it causes a...

[proxmark3-svn] / client / scripts / mifare_autopwn.lua

diff --git a/client/scripts/mifare_autopwn.lua b/client/scripts/mifare_autopwn.lua
index ccb46c5301b1b83295a8b0f4db126e2b3aa8cd92..8d0d358fa72590936992ac147dff9cab4c55d015 100644 (file)
--- a/client/scripts/mifare_autopwn.lua
+++ b/client/scripts/mifare_autopwn.lua
@@ -123,8 +123,20 @@ function mfcrack_inner()
        return nil, "Aborted by user"
 end
 
-function nested(key)
-       local cmd = string.format("hf mf nested 1 0 A %s d",key)
+function nested(key,sak)
+       local typ = 1
+       if 0x18 == sak then --NXP MIFARE Classic 4k | Plus 4k
+               typ = 4
+       elseif 0x08 == sak then -- NXP MIFARE CLASSIC 1k | Plus 2k
+               typ= 1
+       elseif 0x09 == sak then -- NXP MIFARE Mini 0.3k
+               typ = 0
+       elseif  0x10 == sak then-- "NXP MIFARE Plus 2k"
+               typ = 2
+       else
+               print("I don't know how many sectors there are on this type of card, defaulting to 16")
+       end
+       local cmd = string.format("hf mf nested %d 0 A %s d",typ,key)
        core.console(cmd)
 end
 
@@ -149,7 +161,7 @@ end
 function main(args)
 
 
-       local verbose, exit,res,uid,err,_
+       local verbose, exit,res,uid,err,_,sak
        local seen_uids = {}
 
        -- Read the parameters
@@ -163,6 +175,7 @@ function main(args)
                if err then return oops(err) end
                -- Seen already?
                uid = res.uid
+               sak = res.sak
                if not seen_uids[uid] then
                        -- Store it
                        seen_uids[uid] = uid
@@ -171,11 +184,16 @@ function main(args)
                        local key, cnt
                        res,err = mfcrack()
                        if not res then return oops(err) end
-                       _,key = bin.unpack("H6",res)
+                       -- The key is actually 8 bytes, so a 
+                       -- 6-byte key is sent as 00XXXXXX
+                       -- This means we unpack it as first
+                       -- two bytes, then six bytes actual key data
+                       -- We can discard first and second return values
+                       _,_,key = bin.unpack("H2H6",res)
                        print("Key ", key)
 
                        -- Use nested attack
-                       nested(key)
+                       nested(key,sak)
                        -- Dump info
                        dump(uid)
                end