uint64_t key64 = 0;\r
int res = mfCheckKeys(blockNo, keytype - 0x60 , false, 1, keyblock, &key64);\r
if ( res > 0 ) {\r
- PrintAndLog("Candidate Key found (%012"llx") - Test authentication failed. Starting over darkside attack", r_key); \r
+ PrintAndLog("Candidate Key found (%012"llx") - Test authentication failed. [%d] Restarting darkside attack", r_key, res); \r
goto start;\r
}\r
PrintAndLog("Found valid key: %012"llx" \n", r_key);\r
slow ? "Yes" : "No",\r
tests);\r
\r
- int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key ? trgkey : NULL, nonce_file_read, nonce_file_write, slow, tests);\r
+ uint64_t foundkey = 0;\r
+ int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key ? trgkey : NULL, nonce_file_read, nonce_file_write, slow, tests, &foundkey);\r
\r
if (isOK) {\r
switch (isOK) {\r
\r
printf("enter reader attack\n");\r
for (uint8_t i = 0; i < ATTACK_KEY_COUNT; ++i) {\r
- if (data[i].ar2 > 0) {\r
+ \r
+ // if no-collected data \r
+ if (data[i].ar2 == 0) continue;\r
\r
- // We can probably skip this, mfkey32v2 is more reliable.\r
+ // We can probably skip this, mfkey32v2 is more reliable.\r
#ifdef HFMF_TRYMFK32\r
- if (tryMfk32(data[i], &key, verbose)) {\r
- PrintAndLog("Found Key%s for sector %02d: [%012"llx"]"\r
- , (data[i].keytype) ? "B" : "A"\r
- , data[i].sector\r
- , key\r
- );\r
-\r
- k_sector[i].Key[data[i].keytype] = key;\r
- k_sector[i].foundKey[data[i].keytype] = TRUE;\r
- \r
- //set emulator memory for keys\r
- if (setEmulatorMem) {\r
- uint8_t memBlock[16] = {0,0,0,0,0,0, 0xff, 0x0F, 0x80, 0x69, 0,0,0,0,0,0};\r
- num_to_bytes( k_sector[i].Key[0], 6, memBlock);\r
- num_to_bytes( k_sector[i].Key[1], 6, memBlock+10);\r
- PrintAndLog("Setting Emulator Memory Block %02d: [%s]"\r
- , ((data[i].sector)*4) + 3\r
- , sprint_hex( memBlock, sizeof(memBlock))\r
- );\r
- mfEmlSetMem( memBlock, ((data[i].sector)*4) + 3, 1);\r
- }\r
- continue;\r
+ if (tryMfk32(data[i], &key, verbose)) {\r
+ PrintAndLog("Found Key%s for sector %02d: [%012"llx"]"\r
+ , (data[i].keytype) ? "B" : "A"\r
+ , data[i].sector\r
+ , key\r
+ );\r
+\r
+ k_sector[i].Key[data[i].keytype] = key;\r
+ k_sector[i].foundKey[data[i].keytype] = TRUE;\r
+ \r
+ //set emulator memory for keys\r
+ if (setEmulatorMem) {\r
+ uint8_t memBlock[16] = {0,0,0,0,0,0, 0xff, 0x0F, 0x80, 0x69, 0,0,0,0,0,0};\r
+ num_to_bytes( k_sector[i].Key[0], 6, memBlock);\r
+ num_to_bytes( k_sector[i].Key[1], 6, memBlock+10);\r
+ PrintAndLog("Setting Emulator Memory Block %02d: [%s]"\r
+ , ((data[i].sector)*4) + 3\r
+ , sprint_hex( memBlock, sizeof(memBlock))\r
+ );\r
+ mfEmlSetMem( memBlock, ((data[i].sector)*4) + 3, 1);\r
}\r
+ continue;\r
+ }\r
#endif\r
- //moebius attack \r
- if (tryMfk32_moebius(data[i+ATTACK_KEY_COUNT], &key, verbose)) {\r
- uint8_t sectorNum = data[i+ATTACK_KEY_COUNT].sector;\r
- uint8_t keyType = data[i+ATTACK_KEY_COUNT].keytype;\r
-\r
- PrintAndLog("M-Found Key%s for sector %02d: [%012"llx"]"\r
- , keyType ? "B" : "A"\r
- , sectorNum\r
- , key\r
- );\r
-\r
- k_sector[sectorNum].Key[keyType] = key;\r
- k_sector[sectorNum].foundKey[keyType] = TRUE;\r
-\r
- //set emulator memory for keys\r
- if (setEmulatorMem) {\r
- uint8_t memBlock[16] = {0,0,0,0,0,0, 0xff, 0x0F, 0x80, 0x69, 0,0,0,0,0,0};\r
- num_to_bytes( k_sector[sectorNum].Key[0], 6, memBlock);\r
- num_to_bytes( k_sector[sectorNum].Key[1], 6, memBlock+10);\r
- PrintAndLog("Setting Emulator Memory Block %02d: [%s]"\r
- , (sectorNum*4) + 3\r
- , sprint_hex( memBlock, sizeof(memBlock))\r
- );\r
- mfEmlSetMem( memBlock, (sectorNum*4) + 3, 1);\r
- }\r
- continue;\r
+ \r
+ //moebius attack \r
+ if (tryMfk32_moebius(data[i+ATTACK_KEY_COUNT], &key, verbose)) {\r
+ uint8_t sectorNum = data[i+ATTACK_KEY_COUNT].sector;\r
+ uint8_t keyType = data[i+ATTACK_KEY_COUNT].keytype;\r
+\r
+ PrintAndLog("Found Key%s for sector %02d: [%012"llx"]"\r
+ , keyType ? "B" : "A"\r
+ , sectorNum\r
+ , key\r
+ );\r
+\r
+ k_sector[sectorNum].Key[keyType] = key;\r
+ k_sector[sectorNum].foundKey[keyType] = TRUE;\r
+\r
+ //set emulator memory for keys\r
+ if (setEmulatorMem) {\r
+ uint8_t memBlock[16] = {0,0,0,0,0,0, 0xff, 0x0F, 0x80, 0x69, 0,0,0,0,0,0};\r
+ num_to_bytes( k_sector[sectorNum].Key[0], 6, memBlock);\r
+ num_to_bytes( k_sector[sectorNum].Key[1], 6, memBlock+10);\r
+ //iceman, guessing this will not work so well for 4K tags.\r
+ PrintAndLog("Setting Emulator Memory Block %02d: [%s]"\r
+ , (sectorNum*4) + 3\r
+ , sprint_hex( memBlock, sizeof(memBlock))\r
+ );\r
+ mfEmlSetMem( memBlock, (sectorNum*4) + 3, 1);\r
}\r
-\r
+ continue;\r
}\r
}\r
}\r