Merge pull request #46 from micolous/fix-nonce

[proxmark3-svn] / client / cmdhfmf.c

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index dc8f78982dca416c58f756928932077760d9678a..99a91ced7a8418e95665ffdc6eae7dc218cffae7 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -31,6 +31,7 @@ int usage_hf14_mf1ksim(void){
        PrintAndLog("      n    (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");\r
        PrintAndLog("      i    (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");\r
        PrintAndLog("      x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r
+       PrintAndLog("      e    (Optional) Fill simulator keys from what we crack");\r
        PrintAndLog("samples:");\r
        PrintAndLog("           hf mf sim u 0a0a0a0a");\r
        PrintAndLog("           hf mf sim u 11223344556677");\r
@@ -1384,7 +1385,9 @@ void readerAttack(nonces_t data[], bool setEmulatorMem) {
        printf("enter reader attack\n");\r
        for (uint8_t i = 0; i < ATTACK_KEY_COUNT; ++i) {\r
                if (data[i].ar2 > 0) {\r
-                       \r
+\r
+                       // We can probably skip this, mfkey32v2 is more reliable.\r
+#ifdef HFMF_TRYMFK32\r
                        if (tryMfk32(data[i], &key)) {\r
                                PrintAndLog("Found Key%s for sector %02d: [%012"llx"]"\r
                                        , (data[i].keytype) ? "B" : "A"\r
@@ -1400,22 +1403,43 @@ void readerAttack(nonces_t data[], bool setEmulatorMem) {
                                        uint8_t memBlock[16] = {0,0,0,0,0,0, 0xff, 0x0F, 0x80, 0x69, 0,0,0,0,0,0};\r
                                        num_to_bytes( k_sector[i].Key[0], 6, memBlock);\r
                                        num_to_bytes( k_sector[i].Key[1], 6, memBlock+10);\r
-                                       mfEmlSetMem( memBlock, i*4 + 3, 1);\r
                                        PrintAndLog("Setting Emulator Memory Block %02d: [%s]"\r
-                                               , i*4 + 3\r
+                                               , ((data[i].sector)*4) + 3\r
                                                , sprint_hex( memBlock, sizeof(memBlock))\r
                                                );\r
+                                       mfEmlSetMem( memBlock, ((data[i].sector)*4) + 3, 1);\r
                                }\r
-                               break;\r
+                               continue;\r
                        }\r
+#endif\r
                        //moebius attack                        \r
-                       // if (tryMfk32_moebius(data[i+ATTACK_KEY_COUNT], &key)) {\r
-                               // PrintAndLog("M-Found Key%s for sector %02d: [%012"llx"]"\r
-                                       // ,(data[i+ATTACK_KEY_COUNT].keytype) ? "B" : "A"\r
-                                       // , data[i+ATTACK_KEY_COUNT].sector\r
-                                       // , key\r
-                               // );\r
-                       // }\r
+                       if (tryMfk32_moebius(data[i+ATTACK_KEY_COUNT], &key)) {\r
+                               uint8_t sectorNum = data[i+ATTACK_KEY_COUNT].sector;\r
+                               uint8_t keyType = data[i+ATTACK_KEY_COUNT].keytype;\r
+\r
+                               PrintAndLog("M-Found Key%s for sector %02d: [%012"llx"]"\r
+                                       , keyType ? "B" : "A"\r
+                                       , sectorNum\r
+                                       , key\r
+                               );\r
+\r
+                               k_sector[sectorNum].Key[keyType] = key;\r
+                               k_sector[sectorNum].foundKey[keyType] = TRUE;\r
+\r
+                               //set emulator memory for keys\r
+                               if (setEmulatorMem) {\r
+                                       uint8_t memBlock[16] = {0,0,0,0,0,0, 0xff, 0x0F, 0x80, 0x69, 0,0,0,0,0,0};\r
+                                       num_to_bytes( k_sector[sectorNum].Key[0], 6, memBlock);\r
+                                       num_to_bytes( k_sector[sectorNum].Key[1], 6, memBlock+10);\r
+                                       PrintAndLog("Setting Emulator Memory Block %02d: [%s]"\r
+                                               , (sectorNum*4) + 3\r
+                                               , sprint_hex( memBlock, sizeof(memBlock))\r
+                                               );\r
+                                       mfEmlSetMem( memBlock, (sectorNum*4) + 3, 1);\r
+                               }\r
+                               continue;\r
+                       }\r
+\r
                }\r
        }\r
 }\r
@@ -1506,6 +1530,7 @@ int CmdHF14AMf1kSim(const char *Cmd) {
                if (k_sector != NULL) {\r
                        printKeyTable(k_sectorsCount, k_sector );\r
                        free(k_sector);\r
+                       k_sector = NULL;\r
                }\r
        }\r
        return 0;\r