Merge pull request #884 from pwpiwi/fix_iclass_snoop

[proxmark3-svn] / client / scripts / mifare_autopwn.lua

diff --git a/client/scripts/mifare_autopwn.lua b/client/scripts/mifare_autopwn.lua
index 8d0d358fa72590936992ac147dff9cab4c55d015..d743f21eb53a10ff0767da4947d59bf830ea15a0 100644 (file)
--- a/client/scripts/mifare_autopwn.lua
+++ b/client/scripts/mifare_autopwn.lua
@@ -8,7 +8,7 @@ author = "Martin Holst Swende"
 
 desc =
 [[
 
 desc =
 [[

-This is a which automates cracking and dumping mifare classic cards. It sets itself into 
+This is a script which automates cracking and dumping mifare classic cards. It sets itself into 

 'listening'-mode, after which it cracks and dumps any mifare classic card that you 
 place by the device. 
 
 'listening'-mode, after which it cracks and dumps any mifare classic card that you 
 place by the device. 
 


@@ -56,73 +56,13 @@ end
 -- @return if unsuccessfull : nil, error
 function wait_for_mifare()
        while not core.ukbhit() do
 -- @return if unsuccessfull : nil, error
 function wait_for_mifare()
        while not core.ukbhit() do

-               res, err = reader.read1443a()
+               res, err = reader.read14443a(false, true)

                if res then return res end
                -- err means that there was no response from card
        end
        return nil, "Aborted by user"
 end
 
                if res then return res end
                -- err means that there was no response from card
        end
        return nil, "Aborted by user"
 end
 

-function mfcrack()
-       core.clearCommandBuffer()
-       -- Build the mifare-command
-       local cmd = Command:new{cmd = cmds.CMD_READER_MIFARE, arg1 = 1}
-       
-       local retry = true
-       while retry do
-               core.SendCommand(cmd:getBytes())
-               local key, errormessage = mfcrack_inner()
-               -- Success?
-               if key then return key end
-               -- Failure? 
-               if errormessage then return nil, errormessage end
-               -- Try again..set arg1 to 0 this time. 
-
-               cmd = Command:new{cmd = cmds.CMD_READER_MIFARE, arg1 = 0}
-       end     
-       return nil, "Aborted by user"
-end
-
-
-function mfcrack_inner()
-       while not core.ukbhit() do              
-               local result = core.WaitForResponseTimeout(cmds.CMD_ACK,1000)
-               if result then
-                       -- Unpacking the three arg-parameters
-                       local count,cmd,isOK = bin.unpack('LL',result)
-
-                       if isOK ~= 1 then return nil, "Error occurred" end
-
-
-                       -- The data-part is left
-                       -- Starts 32 bytes in, at byte 33
-                       local data = result:sub(33)
-
-                       -- A little helper
-                       local get = function(num)
-                               local x = data:sub(1,num)
-                               data = data:sub(num+1)
-                               return x
-                       end
-
-                       local uid,nt,pl = get(4),get(4),get(8)
-                       local ks,nr = get(8),get(4)
-
-                       local status, key = core.nonce2key(uid,nt, nr, pl,ks)
-                       if not status then return status,key end
-
-                       if status > 0 then 
-                               print("Key not found (lfsr_common_prefix problem)")
-                               -- try again
-                               return nil,nil
-                       else
-                               return key
-                       end
-               end
-       end
-       return nil, "Aborted by user"
-end
-

 function nested(key,sak)
        local typ = 1
        if 0x18 == sak then --NXP MIFARE Classic 4k | Plus 4k
 function nested(key,sak)
        local typ = 1
        if 0x18 == sak then --NXP MIFARE Classic 4k | Plus 4k


@@ -133,6 +73,8 @@ function nested(key,sak)
                typ = 0
        elseif  0x10 == sak then-- "NXP MIFARE Plus 2k"
                typ = 2
                typ = 0
        elseif  0x10 == sak then-- "NXP MIFARE Plus 2k"
                typ = 2

+       elseif  0x01 == sak then-- "NXP MIFARE TNP3xxx 1K"
+               typ = 1

        else
                print("I don't know how many sectors there are on this type of card, defaulting to 16")
        end
        else
                print("I don't know how many sectors there are on this type of card, defaulting to 16")
        end


@@ -182,8 +124,15 @@ function main(args)
                        print("Card found, commencing crack", uid)
                        -- Crack it
                        local key, cnt
                        print("Card found, commencing crack", uid)
                        -- Crack it
                        local key, cnt

-                       res,err = mfcrack()
-                       if not res then return oops(err) end
+                       err, res = core.mfDarkside()
+                       if     err == -1 then return oops("Button pressed. Aborted.") 
+                       elseif err == -2 then return oops("Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests).")
+                       elseif err == -3 then return oops("Card is not vulnerable to Darkside attack (its random number generator is not predictable).")
+                       elseif err == -4 then return oops([[
+Card is not vulnerable to Darkside attack (its random number generator seems to be based on the wellknown
+generating polynomial with 16 effective bits only, but shows unexpected behaviour.]])
+                       elseif err == -5 then return oops("Aborted via keyboard.")
+                       end

                        -- The key is actually 8 bytes, so a 
                        -- 6-byte key is sent as 00XXXXXX
                        -- This means we unpack it as first
                        -- The key is actually 8 bytes, so a 
                        -- 6-byte key is sent as 00XXXXXX
                        -- This means we unpack it as first