#include <stdlib.h> \r
#include <string.h>\r
#include "mifarehost.h"\r
+#include "proxmark3.h"\r
\r
// MIFARE\r
-\r
int compar_int(const void * a, const void * b) {\r
return (*(uint64_t*)b - *(uint64_t*)a);\r
}\r
fnVector * vector = NULL;\r
countKeys *ck;\r
int lenVector = 0;\r
- UsbCommand * resp = NULL;\r
+ UsbCommand resp;\r
\r
memset(resultKeys, 0x00, 16 * 6);\r
\r
// flush queue\r
- while (WaitForResponseTimeout(CMD_ACK, 500) != NULL) ;\r
+ WaitForResponseTimeout(CMD_ACK,NULL,100);\r
\r
UsbCommand c = {CMD_MIFARE_NESTED, {blockNo, keyType, trgBlockNo + trgKeyType * 0x100}};\r
memcpy(c.d.asBytes, key, 6);\r
break;\r
}\r
\r
- resp = WaitForResponseTimeout(CMD_ACK, 1500);\r
-\r
- if (resp != NULL) {\r
- isEOF = resp->arg[0] & 0xff;\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ isEOF = resp.arg[0] & 0xff;\r
\r
if (isEOF) break;\r
\r
- len = resp->arg[1] & 0xff;\r
+ len = resp.arg[1] & 0xff;\r
if (len == 0) continue;\r
\r
- memcpy(&uid, resp->d.asBytes, 4); \r
- PrintAndLog("uid:%08x len=%d trgbl=%d trgkey=%x", uid, len, resp->arg[2] & 0xff, (resp->arg[2] >> 8) & 0xff);\r
+ memcpy(&uid, resp.d.asBytes, 4);\r
+ PrintAndLog("uid:%08x len=%d trgbl=%d trgkey=%x", uid, len, resp.arg[2] & 0xff, (resp.arg[2] >> 8) & 0xff);\r
vector = (fnVector *) realloc((void *)vector, (lenVector + len) * sizeof(fnVector) + 200);\r
if (vector == NULL) {\r
PrintAndLog("Memory allocation error for fnVector. len: %d bytes: %d", lenVector + len, (lenVector + len) * sizeof(fnVector)); \r
}\r
\r
for (i = 0; i < len; i++) {\r
- vector[lenVector + i].blockNo = resp->arg[2] & 0xff;\r
- vector[lenVector + i].keyType = (resp->arg[2] >> 8) & 0xff;\r
+ vector[lenVector + i].blockNo = resp.arg[2] & 0xff;\r
+ vector[lenVector + i].keyType = (resp.arg[2] >> 8) & 0xff;\r
vector[lenVector + i].uid = uid;\r
\r
- memcpy(&vector[lenVector + i].nt, (void *)(resp->d.asBytes + 8 + i * 8 + 0), 4);\r
- memcpy(&vector[lenVector + i].ks1, (void *)(resp->d.asBytes + 8 + i * 8 + 4), 4);\r
+ memcpy(&vector[lenVector + i].nt, (void *)(resp.d.asBytes + 8 + i * 8 + 0), 4);\r
+ memcpy(&vector[lenVector + i].ks1, (void *)(resp.d.asBytes + 8 + i * 8 + 4), 4);\r
}\r
\r
lenVector += len;\r
\r
UsbCommand c = {CMD_MIFARE_CHKKEYS, {blockNo, keyType, keycnt}};\r
memcpy(c.d.asBytes, keyBlock, 6 * keycnt);\r
-\r
SendCommand(&c);\r
\r
- UsbCommand * resp = WaitForResponseTimeout(CMD_ACK, 3000);\r
-\r
- if (resp == NULL) return 1;\r
- if ((resp->arg[0] & 0xff) != 0x01) return 2;\r
- *key = bytes_to_num(resp->d.asBytes, 6);\r
+ UsbCommand resp;\r
+ if (!WaitForResponseTimeout(CMD_ACK,&resp,3000)) return 1;\r
+ if ((resp.arg[0] & 0xff) != 0x01) return 2;\r
+ *key = bytes_to_num(resp.d.asBytes, 6);\r
return 0;\r
}\r
\r
\r
int mfEmlGetMem(uint8_t *data, int blockNum, int blocksCount) {\r
UsbCommand c = {CMD_MIFARE_EML_MEMGET, {blockNum, blocksCount, 0}};\r
- \r
- SendCommand(&c);\r
-\r
- UsbCommand * resp = WaitForResponseTimeout(CMD_ACK, 1500);\r
+ SendCommand(&c);\r
\r
- if (resp == NULL) return 1;\r
- memcpy(data, resp->d.asBytes, blocksCount * 16); \r
+ UsbCommand resp;\r
+ if (!WaitForResponseTimeout(CMD_ACK,&resp,1500)) return 1;\r
+ memcpy(data, resp.d.asBytes, blocksCount * 16);\r
return 0;\r
}\r
\r
memcpy(c.d.asBytes, data, 16); \r
SendCommand(&c);\r
\r
- UsbCommand * resp = WaitForResponseTimeout(CMD_ACK, 1500);\r
-\r
- if (resp != NULL) {\r
- isOK = resp->arg[0] & 0xff;\r
- if (uid != NULL) memcpy(uid, resp->d.asBytes, 4); \r
+ UsbCommand resp;\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ isOK = resp.arg[0] & 0xff;\r
+ if (uid != NULL) memcpy(uid, resp.d.asBytes, 4);\r
if (!isOK) return 2;\r
} else {\r
PrintAndLog("Command execute timeout");\r
UsbCommand c = {CMD_MIFARE_EML_CGETBLOCK, {params, 0, blockNo}};\r
SendCommand(&c);\r
\r
- UsbCommand * resp = WaitForResponseTimeout(CMD_ACK, 1500);\r
-\r
- if (resp != NULL) {\r
- isOK = resp->arg[0] & 0xff;\r
- memcpy(data, resp->d.asBytes, 16); \r
+ UsbCommand resp;\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ isOK = resp.arg[0] & 0xff;\r
+ memcpy(data, resp.d.asBytes, 16);\r
if (!isOK) return 2;\r
} else {\r
PrintAndLog("Command execute timeout");\r
\r
// SNIFFER\r
\r
+// constants\r
+static uint8_t trailerAccessBytes[4] = {0x08, 0x77, 0x8F, 0x00};\r
+\r
// variables\r
char logHexFileName[200] = {0x00};\r
-static uint8_t traceCard[4096];\r
+static uint8_t traceCard[4096] = {0x00};\r
+static char traceFileName[20];\r
static int traceState = TRACE_IDLE;\r
static uint8_t traceCurBlock = 0;\r
static uint8_t traceCurKey = 0;\r
\r
uint32_t uid; // serial number\r
uint32_t nt; // tag challenge\r
+uint32_t nt_par; \r
uint32_t nr_enc; // encrypted reader challenge\r
uint32_t ar_enc; // encrypted reader response\r
+uint32_t nr_ar_par; \r
uint32_t at_enc; // encrypted tag response\r
+uint32_t at_par; \r
\r
-int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak) {\r
+int isTraceCardEmpty(void) {\r
+ return ((traceCard[0] == 0) && (traceCard[1] == 0) && (traceCard[2] == 0) && (traceCard[3] == 0));\r
+}\r
\r
- if (traceCrypto1) crypto1_destroy(traceCrypto1);\r
- traceCrypto1 = NULL;\r
+int isBlockEmpty(int blockN) {\r
+ for (int i = 0; i < 16; i++) \r
+ if (traceCard[blockN * 16 + i] != 0) return 0;\r
\r
+ return 1;\r
+}\r
+\r
+int isBlockTrailer(int blockN) {\r
+ return ((blockN & 0x03) == 0x03);\r
+}\r
+\r
+int loadTraceCard(uint8_t *tuid) {\r
+ FILE * f;\r
+ char buf[64];\r
+ uint8_t buf8[64];\r
+ int i, blockNum;\r
+ \r
+ if (!isTraceCardEmpty()) saveTraceCard();\r
memset(traceCard, 0x00, 4096);\r
memcpy(traceCard, tuid + 3, 4);\r
+ FillFileNameByUID(traceFileName, tuid, ".eml", 7);\r
+\r
+ f = fopen(traceFileName, "r");\r
+ if (!f) return 1;\r
+ \r
+ blockNum = 0;\r
+ while(!feof(f)){\r
+ memset(buf, 0, sizeof(buf));\r
+ fgets(buf, sizeof(buf), f);\r
+\r
+ if (strlen(buf) < 32){\r
+ if (feof(f)) break;\r
+ PrintAndLog("File content error. Block data must include 32 HEX symbols");\r
+ return 2;\r
+ }\r
+ for (i = 0; i < 32; i += 2)\r
+ sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]);\r
+\r
+ memcpy(traceCard + blockNum * 16, buf8, 16);\r
+\r
+ blockNum++;\r
+ }\r
+ fclose(f);\r
+\r
+ return 0;\r
+}\r
+\r
+int saveTraceCard(void) {\r
+ FILE * f;\r
+ \r
+ if ((!strlen(traceFileName)) || (isTraceCardEmpty())) return 0;\r
+ \r
+ f = fopen(traceFileName, "w+");\r
+ for (int i = 0; i < 64; i++) { // blocks\r
+ for (int j = 0; j < 16; j++) // bytes\r
+ fprintf(f, "%02x", *(traceCard + i * 16 + j)); \r
+ fprintf(f,"\n");\r
+ }\r
+ fclose(f);\r
+\r
+ return 0;\r
+}\r
+\r
+int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile) {\r
+\r
+ if (traceCrypto1) crypto1_destroy(traceCrypto1);\r
+ traceCrypto1 = NULL;\r
+\r
+ if (wantSaveToEmlFile) loadTraceCard(tuid);\r
traceCard[4] = traceCard[0] ^ traceCard[1] ^ traceCard[2] ^ traceCard[3];\r
traceCard[5] = sak;\r
memcpy(&traceCard[6], atqa, 2);\r
}\r
\r
\r
-int mfTraceDecode(uint8_t *data_src, int len) {\r
+int mfTraceDecode(uint8_t *data_src, int len, uint32_t parity, bool wantSaveToEmlFile) {\r
uint8_t data[64];\r
\r
if (traceState == TRACE_ERROR) return 1;\r
\r
switch (traceState) {\r
case TRACE_IDLE: \r
- // TODO: check packet crc16!\r
+ // check packet crc16!\r
+ if ((len >= 4) && (!CheckCrc14443(CRC_14443_A, data, len))) {\r
+ PrintAndLog("dec> CRC ERROR!!!");\r
+ AddLogLine(logHexFileName, "dec> ", "CRC ERROR!!!"); \r
+ traceState = TRACE_ERROR; // do not decrypt the next commands\r
+ return 1;\r
+ }\r
\r
// AUTHENTICATION\r
if ((len ==4) && ((data[0] == 0x60) || (data[0] == 0x61))) {\r
if (len == 18) {\r
traceState = TRACE_IDLE;\r
\r
- memcpy(traceCard + traceCurBlock * 16, data, 16);\r
+ if (isBlockTrailer(traceCurBlock)) {\r
+ memcpy(traceCard + traceCurBlock * 16 + 6, data + 6, 4);\r
+ } else {\r
+ memcpy(traceCard + traceCurBlock * 16, data, 16);\r
+ }\r
+ if (wantSaveToEmlFile) saveTraceCard();\r
return 0;\r
} else {\r
traceState = TRACE_ERROR;\r
traceState = TRACE_IDLE;\r
\r
memcpy(traceCard + traceCurBlock * 16, data, 16);\r
+ if (wantSaveToEmlFile) saveTraceCard();\r
return 0;\r
} else {\r
traceState = TRACE_ERROR;\r
traceState = TRACE_AUTH2;\r
\r
nt = bytes_to_num(data, 4);\r
+ nt_par = parity;\r
return 0;\r
} else {\r
traceState = TRACE_ERROR;\r
\r
nr_enc = bytes_to_num(data, 4);\r
ar_enc = bytes_to_num(data + 4, 4);\r
+ nr_ar_par = parity;\r
return 0;\r
} else {\r
traceState = TRACE_ERROR;\r
traceState = TRACE_IDLE;\r
\r
at_enc = bytes_to_num(data, 4);\r
+ at_par = parity;\r
\r
// decode key here)\r
if (!traceCrypto1) {\r
printf("key> %x%x\n", (unsigned int)((lfsr & 0xFFFFFFFF00000000) >> 32), (unsigned int)(lfsr & 0xFFFFFFFF));\r
AddLogUint64(logHexFileName, "key> ", lfsr); \r
\r
+ int blockShift = ((traceCurBlock & 0xFC) + 3) * 16;\r
+ if (isBlockEmpty((traceCurBlock & 0xFC) + 3)) memcpy(traceCard + blockShift + 6, trailerAccessBytes, 4);\r
+ \r
if (traceCurKey) {\r
- num_to_bytes(lfsr, 6, traceCard + traceCurBlock * 16 + 10);\r
+ num_to_bytes(lfsr, 6, traceCard + blockShift + 10);\r
} else {\r
- num_to_bytes(lfsr, 6, traceCard + traceCurBlock * 16);\r
+ num_to_bytes(lfsr, 6, traceCard + blockShift);\r
}\r
+ if (wantSaveToEmlFile) saveTraceCard();\r
\r
if (traceCrypto1) {\r
crypto1_destroy(traceCrypto1);\r
projects / proxmark3-svn / blobdiff