Do not treat gcc's "misleading-indentation" warning as error (fixes #187).

[proxmark3-svn] / client / cmdhfmf.c

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index c565a7cf222bac705e1cb21a1b4d7227b6eba719..36c8e6c370eb121fab1ecb8c0b6027b210b640ad 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -1016,166 +1016,273 @@ int CmdHF14AMfChk(const char *Cmd)
        return 0;\r
 }\r
 \r
        return 0;\r
 }\r
 \r

-int usage_hf14_mf1ksim(void){\r
-       PrintAndLog("Usage:  hf mf sim  [h] u <uid (8,14 hex symbols)> n <numreads> i x");\r
+void readerAttack(nonces_t ar_resp[], bool setEmulatorMem) {\r
+       #define ATTACK_KEY_COUNT 8 // keep same as define in iso14443a.c -> Mifare1ksim()\r
+       uint64_t key = 0;\r
+       typedef struct {\r
+                       uint64_t keyA;\r
+                       uint64_t keyB;\r
+       } st_t;\r
+       st_t sector_trailer[ATTACK_KEY_COUNT];\r
+       memset(sector_trailer, 0x00, sizeof(sector_trailer));\r
+\r
+       uint8_t stSector[ATTACK_KEY_COUNT];\r
+       memset(stSector, 0x00, sizeof(stSector));\r
+       uint8_t key_cnt[ATTACK_KEY_COUNT];\r
+       memset(key_cnt, 0x00, sizeof(key_cnt));\r
+\r
+       for (uint8_t i = 0; i<ATTACK_KEY_COUNT; i++) {\r
+               if (ar_resp[i].ar2 > 0) {\r
+                       //PrintAndLog("DEBUG: Trying sector %d, cuid %08x, nt %08x, ar %08x, nr %08x, ar2 %08x, nr2 %08x",ar_resp[i].sector, ar_resp[i].cuid,ar_resp[i].nonce,ar_resp[i].ar,ar_resp[i].nr,ar_resp[i].ar2,ar_resp[i].nr2);\r
+                       if (mfkey32(ar_resp[i], &key)) {\r
+                               PrintAndLog("  Found Key%s for sector %02d: [%04x%08x]", (ar_resp[i].keytype) ? "B" : "A", ar_resp[i].sector, (uint32_t) (key>>32), (uint32_t) (key &0xFFFFFFFF));\r
+\r
+                               for (uint8_t ii = 0; ii<ATTACK_KEY_COUNT; ii++) {\r
+                                       if (key_cnt[ii]==0 || stSector[ii]==ar_resp[i].sector) {\r
+                                               if (ar_resp[i].keytype==0) {\r
+                                                       //keyA\r
+                                                       sector_trailer[ii].keyA = key;\r
+                                                       stSector[ii] = ar_resp[i].sector;\r
+                                                       key_cnt[ii]++;\r
+                                                       break;\r
+                                               } else {\r
+                                                       //keyB\r
+                                                       sector_trailer[ii].keyB = key;\r
+                                                       stSector[ii] = ar_resp[i].sector;\r
+                                                       key_cnt[ii]++;\r
+                                                       break;\r
+                                               }\r
+                                       }\r
+                               }\r
+                       }\r
+               }\r
+       }\r
+       //set emulator memory for keys\r
+       if (setEmulatorMem) {\r
+               for (uint8_t i = 0; i<ATTACK_KEY_COUNT; i++) {\r
+                       if (key_cnt[i]>0) {\r
+                               uint8_t memBlock[16];\r
+                               memset(memBlock, 0x00, sizeof(memBlock));\r
+                               char cmd1[36];\r
+                               memset(cmd1,0x00,sizeof(cmd1));\r
+                               snprintf(cmd1,sizeof(cmd1),"%04x%08xFF078069%04x%08x",(uint32_t) (sector_trailer[i].keyA>>32), (uint32_t) (sector_trailer[i].keyA &0xFFFFFFFF),(uint32_t) (sector_trailer[i].keyB>>32), (uint32_t) (sector_trailer[i].keyB &0xFFFFFFFF));\r
+                               PrintAndLog("Setting Emulator Memory Block %02d: [%s]",stSector[i]*4+3, cmd1);\r
+                               if (param_gethex(cmd1, 0, memBlock, 32)) {\r
+                                       PrintAndLog("block data must include 32 HEX symbols");\r
+                                       return;\r
+                               }\r
+                               \r
+                               UsbCommand c = {CMD_MIFARE_EML_MEMSET, {(stSector[i]*4+3), 1, 0}};\r
+                               memcpy(c.d.asBytes, memBlock, 16);\r
+                               clearCommandBuffer();\r
+                               SendCommand(&c);                        \r
+                       }\r
+               }\r
+       }\r
+       /*\r
+       //un-comment to use as well moebius attack\r
+       for (uint8_t i = ATTACK_KEY_COUNT; i<ATTACK_KEY_COUNT*2; i++) {\r
+               if (ar_resp[i].ar2 > 0) {\r
+                       if (tryMfk32_moebius(ar_resp[i], &key)) {\r
+                               PrintAndLog("M-Found Key%s for sector %02d: [%04x%08x]", (ar_resp[i].keytype) ? "B" : "A", ar_resp[i].sector, (uint32_t) (key>>32), (uint32_t) (key &0xFFFFFFFF));\r
+                       }\r
+               }\r
+       }*/\r
+}\r
+\r
+int usage_hf14_mf1ksim(void) {\r
+       PrintAndLog("Usage:  hf mf sim h u <uid (8, 14, or 20 hex symbols)> n <numreads> i x");\r

        PrintAndLog("options:");\r
        PrintAndLog("      h    this help");\r
        PrintAndLog("options:");\r
        PrintAndLog("      h    this help");\r

-       PrintAndLog("      u    (Optional) UID 4,7 bytes. If not specified, the UID 4b from emulator memory will be used");\r
+       PrintAndLog("      u    (Optional) UID 4,7 or 10 bytes. If not specified, the UID 4B from emulator memory will be used");\r

        PrintAndLog("      n    (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");\r
        PrintAndLog("      i    (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");\r
        PrintAndLog("      x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r
        PrintAndLog("      n    (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");\r
        PrintAndLog("      i    (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");\r
        PrintAndLog("      x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r

-       PrintAndLog("      e    (Optional) set keys found from 'reader attack' to emulator memory");\r
+       PrintAndLog("      e    (Optional) set keys found from 'reader attack' to emulator memory (implies x and i)");\r
+       PrintAndLog("      f    (Optional) get UIDs to use for 'reader attack' from file 'f <filename.txt>' (implies x and i)");\r

        PrintAndLog("samples:");\r
        PrintAndLog("           hf mf sim u 0a0a0a0a");\r
        PrintAndLog("           hf mf sim u 11223344556677");\r
        PrintAndLog("samples:");\r
        PrintAndLog("           hf mf sim u 0a0a0a0a");\r
        PrintAndLog("           hf mf sim u 11223344556677");\r

-       //PrintAndLog("           hf mf sim u 112233445566778899AA");   \r
+       PrintAndLog("           hf mf sim u 112233445566778899AA");\r
+       PrintAndLog("           hf mf sim f uids.txt");\r
+       PrintAndLog("           hf mf sim u 0a0a0a0a e");\r
+               \r

        return 0;\r
 }\r
 \r
        return 0;\r
 }\r
 \r

-int CmdHF14AMf1kSim(const char *Cmd)\r
-{\r
-       #define ATTACK_KEY_COUNT 8\r
+int CmdHF14AMf1kSim(const char *Cmd) {\r
+       UsbCommand resp;\r

        uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};\r
        uint8_t exitAfterNReads = 0;\r
        uint8_t flags = 0;\r
        int uidlen = 0;\r
        uint8_t pnr = 0;\r
        bool setEmulatorMem = false;\r
        uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};\r
        uint8_t exitAfterNReads = 0;\r
        uint8_t flags = 0;\r
        int uidlen = 0;\r
        uint8_t pnr = 0;\r
        bool setEmulatorMem = false;\r

-\r
-       char cmdp = param_getchar(Cmd, pnr);\r
-       \r
-       if (cmdp == 'h' || cmdp == 'H') return usage_hf14_mf1ksim();\r
-\r
-       if (cmdp == 'u' || cmdp == 'U') {\r
-               param_gethex_ex(Cmd, pnr+1, uid, &uidlen);\r
-               switch(uidlen){\r
-                       //case 20: flags = FLAG_10B_UID_IN_DATA;        break; //not complete\r
-                       case 14: flags = FLAG_7B_UID_IN_DATA; break;\r
-                       case  8: flags = FLAG_4B_UID_IN_DATA; break;\r
-                       default: return usage_hf14_mf1ksim();\r
+       bool attackFromFile = false;\r
+       FILE *f;\r
+       char filename[FILE_PATH_SIZE];\r
+       memset(filename, 0x00, sizeof(filename));\r
+       int len = 0;\r
+       char buf[64];\r
+\r
+       uint8_t cmdp = 0;\r
+       bool errors = false;\r
+\r
+       while(param_getchar(Cmd, cmdp) != 0x00) {\r
+               switch(param_getchar(Cmd, cmdp)) {\r
+               case 'e':\r
+               case 'E':\r
+                       setEmulatorMem = true;\r
+                       //implies x and i\r
+                       flags |= FLAG_INTERACTIVE;\r
+                       flags |= FLAG_NR_AR_ATTACK;\r
+                       cmdp++;\r
+                       break;\r
+               case 'f':\r
+               case 'F':\r
+                       len = param_getstr(Cmd, cmdp+1, filename);\r
+                       if (len < 1) {\r
+                               PrintAndLog("error no filename found");\r
+                               return 0;\r
+                       }\r
+                       attackFromFile = true;\r
+                       //implies x and i\r
+                       flags |= FLAG_INTERACTIVE;\r
+                       flags |= FLAG_NR_AR_ATTACK;\r
+                       cmdp += 2;\r
+                       break;\r
+               case 'h':\r
+               case 'H':\r
+                       return usage_hf14_mf1ksim();\r
+               case 'i':\r
+               case 'I':\r
+                       flags |= FLAG_INTERACTIVE;\r
+                       cmdp++;\r
+                       break;\r
+               case 'n':\r
+               case 'N':\r
+                       exitAfterNReads = param_get8(Cmd, pnr+1);\r
+                       cmdp += 2;\r
+                       break;\r
+               case 'u':\r
+               case 'U':\r
+                       param_gethex_ex(Cmd, cmdp+1, uid, &uidlen);\r
+                       switch(uidlen) {\r
+                               case 20: flags = FLAG_10B_UID_IN_DATA;  break; //not complete\r
+                               case 14: flags = FLAG_7B_UID_IN_DATA; break;\r
+                               case  8: flags = FLAG_4B_UID_IN_DATA; break;\r
+                               default: return usage_hf14_mf1ksim();\r
+                       }\r
+                       cmdp += 2;\r
+                       break;\r
+               case 'x':\r
+               case 'X':\r
+                       flags |= FLAG_NR_AR_ATTACK;\r
+                       cmdp++;\r
+                       break;\r
+               default:\r
+                       PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
+                       errors = true;\r
+                       break;\r

                }\r
                }\r

-               pnr +=2;\r
+               if(errors) break;\r

        }\r
        }\r

+       //Validations\r
+       if(errors) return usage_hf14_mf1ksim();\r

 \r
 \r

-       cmdp = param_getchar(Cmd, pnr);\r
-       if (cmdp == 'n' || cmdp == 'N') {\r
-               exitAfterNReads = param_get8(Cmd, pnr+1);\r
-               pnr += 2;\r
-       }\r
+       //get uid from file\r
+       if (attackFromFile) {\r
+               int count = 0;\r
+               // open file\r
+               f = fopen(filename, "r");\r
+               if (f == NULL) {\r
+                       PrintAndLog("File %s not found or locked", filename);\r
+                       return 1;\r
+               }\r
+               PrintAndLog("Loading file and simulating. Press keyboard to abort");\r
+               while(!feof(f) && !ukbhit()){\r
+                       memset(buf, 0, sizeof(buf));\r
+                       memset(uid, 0, sizeof(uid));\r

 \r
 \r

-       cmdp = param_getchar(Cmd, pnr);\r
-       if (cmdp == 'i' || cmdp == 'I' ) {\r
-               flags |= FLAG_INTERACTIVE;\r
-               pnr++;\r
-       }\r
+                       if (fgets(buf, sizeof(buf), f) == NULL) {                       \r
+                               if (count > 0) break;\r
+                               \r
+                               PrintAndLog("File reading error.");\r
+                               fclose(f);\r
+                               return 2;\r
+                       }\r
+                       if(!strlen(buf) && feof(f)) break;\r
+\r
+                       uidlen = strlen(buf)-1;\r
+                       switch(uidlen) {\r
+                               case 20: flags |= FLAG_10B_UID_IN_DATA; break; //not complete\r
+                               case 14: flags |= FLAG_7B_UID_IN_DATA; break;\r
+                               case  8: flags |= FLAG_4B_UID_IN_DATA; break;\r
+                               default: \r
+                                       PrintAndLog("uid in file wrong length at %d (length: %d) [%s]",count, uidlen, buf);\r
+                                       fclose(f);\r
+                                       return 2;\r
+                       }\r

 \r
 \r

-       cmdp = param_getchar(Cmd, pnr);\r
-       if (cmdp == 'x' || cmdp == 'X') {\r
-               flags |= FLAG_NR_AR_ATTACK;\r
-               pnr++;\r
-       }\r
+                       for (uint8_t i = 0; i < uidlen; i += 2) {\r
+                               sscanf(&buf[i], "%02x", (unsigned int *)&uid[i / 2]);\r
+                       }\r
+                       \r
+                       PrintAndLog("mf 1k sim uid: %s, numreads:%d, flags:%d (0x%02x) - press button to abort",\r
+                                       flags & FLAG_4B_UID_IN_DATA ? sprint_hex(uid,4):\r
+                                               flags & FLAG_7B_UID_IN_DATA     ? sprint_hex(uid,7): \r
+                                                       flags & FLAG_10B_UID_IN_DATA ? sprint_hex(uid,10): "N/A"\r
+                                       , exitAfterNReads, flags, flags);\r
+\r
+                       UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};\r
+                       memcpy(c.d.asBytes, uid, sizeof(uid));\r
+                       clearCommandBuffer();\r
+                       SendCommand(&c);\r

 \r
 \r

-       cmdp = param_getchar(Cmd, pnr);\r
-       if (cmdp == 'e' || cmdp == 'E') {\r
-               setEmulatorMem = true;\r
-       }\r
+                       while(! WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+                               //We're waiting only 1.5 s at a time, otherwise we get the\r
+                               // annoying message about "Waiting for a response... "\r
+                       }\r
+                       //got a response\r
+                       nonces_t ar_resp[ATTACK_KEY_COUNT*2];\r
+                       memcpy(ar_resp, resp.d.asBytes, sizeof(ar_resp));\r
+                       readerAttack(ar_resp, setEmulatorMem);\r
+                       if ((bool)resp.arg[1]) {\r
+                               PrintAndLog("Device button pressed - quitting");\r
+                               fclose(f);\r
+                               return 4;\r
+                       }\r
+                       count++;\r
+               }\r
+               fclose(f);\r
+       } else { //not from file\r

 \r
 \r

-       PrintAndLog(" uid:%s, numreads:%d, flags:%d (0x%02x) ",\r
+               PrintAndLog("mf 1k sim uid: %s, numreads:%d, flags:%d (0x%02x) ",\r

                                flags & FLAG_4B_UID_IN_DATA ? sprint_hex(uid,4):\r
                                flags & FLAG_4B_UID_IN_DATA ? sprint_hex(uid,4):\r

-                                       flags & FLAG_7B_UID_IN_DATA     ? sprint_hex(uid,7): "N/A"\r
-                               , exitAfterNReads, flags,flags);\r
-\r
+                                       flags & FLAG_7B_UID_IN_DATA     ? sprint_hex(uid,7): \r
+                                               flags & FLAG_10B_UID_IN_DATA ? sprint_hex(uid,10): "N/A"\r
+                               , exitAfterNReads, flags, flags);\r

 \r
 \r

-       UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};\r
-       memcpy(c.d.asBytes, uid, sizeof(uid));\r
-       clearCommandBuffer();\r
-       SendCommand(&c);\r
+               UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};\r
+               memcpy(c.d.asBytes, uid, sizeof(uid));\r
+               clearCommandBuffer();\r
+               SendCommand(&c);\r

 \r
 \r

-       if(flags & FLAG_INTERACTIVE) {\r
-               UsbCommand resp;\r
-               PrintAndLog("Press pm3-button to abort simulation");\r
-               while(! WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
-                       //We're waiting only 1.5 s at a time, otherwise we get the\r
-                       // annoying message about "Waiting for a response... "\r
-               }\r
-               //got a response\r
-               if (flags & FLAG_NR_AR_ATTACK) {\r
-                       nonces_t ar_resp[ATTACK_KEY_COUNT*2];\r
-                       uint64_t key = 0;\r
-                       memcpy (ar_resp, resp.d.asBytes, sizeof(ar_resp));\r
-                       typedef struct {\r
-                                       uint64_t keyA;\r
-                                       uint32_t security;\r
-                                       uint64_t keyB;\r
-                       } st_t;\r
-                       st_t sector_trailer[ATTACK_KEY_COUNT];\r
-                       memset(sector_trailer, 0x00, sizeof(sector_trailer));\r
-\r
-                       uint8_t stSector[ATTACK_KEY_COUNT];\r
-                       memset(stSector, 0x00, sizeof(stSector));\r
-                       uint8_t key_cnt[ATTACK_KEY_COUNT];\r
-                       memset(key_cnt, 0x00, sizeof(key_cnt));\r
-\r
-                       for (uint8_t i = 0; i<ATTACK_KEY_COUNT; i++) {\r
-                               if (ar_resp[i].ar2 > 0) {\r
-                                       //PrintAndLog("Trying sector %d, cuid %08x, nt %08x, ar %08x, nr %08x, ar2 %08x, nr2 %08x",ar_resp[i].sector, ar_resp[i].cuid,ar_resp[i].nonce,ar_resp[i].ar,ar_resp[i].nr,ar_resp[i].ar2,ar_resp[i].nr2);\r
-                                       if (mfkey32(ar_resp[i], &key)) {\r
-                                               PrintAndLog("Found Key%s for sector %02d: [%04x%08x]", (ar_resp[i].keytype) ? "B" : "A", ar_resp[i].sector, (uint32_t) (key>>32), (uint32_t) (key &0xFFFFFFFF));\r
-\r
-                                               for (uint8_t ii = 0; ii<ATTACK_KEY_COUNT; ii++) {\r
-                                                       if (key_cnt[ii]==0 || stSector[ii]==ar_resp[i].sector) {\r
-                                                               if (ar_resp[i].keytype==0) {\r
-                                                                       //keyA\r
-                                                                       sector_trailer[ii].keyA = key;\r
-                                                                       stSector[ii] = ar_resp[i].sector;\r
-                                                                       key_cnt[ii]++;\r
-                                                                       break;\r
-                                                               } else {\r
-                                                                       //keyB\r
-                                                                       sector_trailer[ii].keyB = key;\r
-                                                                       stSector[ii] = ar_resp[i].sector;\r
-                                                                       key_cnt[ii]++;\r
-                                                                       break;\r
-                                                               }\r
-                                                       }\r
-                                               }\r
-                                       }\r
-                               }\r
+               if(flags & FLAG_INTERACTIVE) {\r
+                       PrintAndLog("Press pm3-button to abort simulation");\r
+                       while(! WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+                               //We're waiting only 1.5 s at a time, otherwise we get the\r
+                               // annoying message about "Waiting for a response... "\r

                        }\r
                        }\r

-                       //set emulator memory for keys\r
-                       if (setEmulatorMem) {\r
-                               for (uint8_t i = 0; i<ATTACK_KEY_COUNT; i++) {\r
-                                       if (key_cnt[i]>0) {\r
-                                               //PrintAndLog   ("block %d, keyA:%04x%08x, keyb:%04x%08x",stSector[i]*4+3, (uint32_t) (sector_trailer[i].keyA>>32), (uint32_t) (sector_trailer[i].keyA &0xFFFFFFFF),(uint32_t) (sector_trailer[i].keyB>>32), (uint32_t) (sector_trailer[i].keyB &0xFFFFFFFF));\r
-                                               uint8_t memBlock[16];\r
-                                               memset(memBlock, 0x00, sizeof(memBlock));\r
-                                               char cmd1[36];\r
-                                               memset(cmd1,0x00,sizeof(cmd1));\r
-                                               snprintf(cmd1,sizeof(cmd1),"%04x%08xFF078069%04x%08x",(uint32_t) (sector_trailer[i].keyA>>32), (uint32_t) (sector_trailer[i].keyA &0xFFFFFFFF),(uint32_t) (sector_trailer[i].keyB>>32), (uint32_t) (sector_trailer[i].keyB &0xFFFFFFFF));\r
-                                               PrintAndLog("Setting Emulator Memory Block %02d: [%s]",stSector[i]*4+3, cmd1);\r
-                                               if (param_gethex(cmd1, 0, memBlock, 32)) {\r
-                                                       PrintAndLog("block data must include 32 HEX symbols");\r
-                                                       return 1;\r
-                                               }\r
-                                               \r
-                                               UsbCommand c = {CMD_MIFARE_EML_MEMSET, {(stSector[i]*4+3), 1, 0}};\r
-                                               memcpy(c.d.asBytes, memBlock, 16);\r
-                                               clearCommandBuffer();\r
-                                               SendCommand(&c);                        \r
-                                       }\r
-                               }\r
-                       }\r
-                       //moebius attack\r
-                       for (uint8_t i = ATTACK_KEY_COUNT; i<ATTACK_KEY_COUNT*2; i++) {\r
-                               if (ar_resp[i].ar2 > 0) {\r
-                                       if (tryMfk32_moebius(ar_resp[i], &key)) {\r
-                                               PrintAndLog("M-Found Key%s for sector %02d: [%04x%08x]", (ar_resp[i].keytype) ? "B" : "A", ar_resp[i].sector, (uint32_t) (key>>32), (uint32_t) (key &0xFFFFFFFF));\r
-                                       }\r
-                               }\r
+                       //got a response\r
+                       if (flags & FLAG_NR_AR_ATTACK) {\r
+                               nonces_t ar_resp[ATTACK_KEY_COUNT*2];\r
+                               memcpy(ar_resp, resp.d.asBytes, sizeof(ar_resp));\r
+                               readerAttack(ar_resp, setEmulatorMem);\r

                        }\r
                }\r
        }\r
                        }\r
                }\r
        }\r

-       \r
+\r

        return 0;\r
 }\r
 \r
        return 0;\r
 }\r
 \r