return 0;\r
}\r
\r
+int CmdHF14AMfUWrBl(const char *Cmd)\r
+{\r
+ uint8_t blockNo = 0;\r
+ bool chinese_card=0;\r
+ uint8_t bldata[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};\r
+ UsbCommand resp;\r
+ \r
+ if (strlen(Cmd)<3) {\r
+ PrintAndLog("Usage: hf mf uwrbl <block number> <block data (8 hex symbols)> <w>");\r
+ PrintAndLog(" sample: hf mf uwrbl 0 01020304");\r
+ return 0;\r
+ } \r
+\r
+ blockNo = param_get8(Cmd, 0);\r
+ if (param_gethex(Cmd, 1, bldata, 8)) {\r
+ PrintAndLog("Block data must include 8 HEX symbols");\r
+ return 1;\r
+ }\r
+ \r
+ if (strchr(Cmd,'w') != 0) {\r
+ chinese_card=1;\r
+ }\r
+ \r
+ switch(blockNo){\r
+ case 0:\r
+ if (!chinese_card){\r
+ PrintAndLog("Access Denied");\r
+ }else{\r
+ PrintAndLog("--specialblock no:%02x", blockNo);\r
+ PrintAndLog("--data: %s", sprint_hex(bldata, 4));\r
+ UsbCommand d = {CMD_MIFAREU_WRITEBL, {blockNo}};\r
+ memcpy(d.d.asBytes,bldata, 4);\r
+ SendCommand(&d);\r
+\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ uint8_t isOK = resp.arg[0] & 0xff;\r
+ PrintAndLog("isOk:%02x", isOK);\r
+ } else {\r
+ PrintAndLog("Command execute timeout");\r
+ }\r
+ }\r
+ break;\r
+ case 1:\r
+ if (!chinese_card){\r
+ PrintAndLog("Access Denied");\r
+ }else{\r
+ PrintAndLog("--specialblock no:%02x", blockNo);\r
+ PrintAndLog("--data: %s", sprint_hex(bldata, 4));\r
+ UsbCommand d = {CMD_MIFAREU_WRITEBL, {blockNo}};\r
+ memcpy(d.d.asBytes,bldata, 4);\r
+ SendCommand(&d);\r
+\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ uint8_t isOK = resp.arg[0] & 0xff;\r
+ PrintAndLog("isOk:%02x", isOK);\r
+ } else {\r
+ PrintAndLog("Command execute timeout");\r
+ }\r
+ }\r
+ break;\r
+ case 2:\r
+ if (!chinese_card){\r
+ PrintAndLog("Access Denied");\r
+ }else{\r
+ PrintAndLog("--specialblock no:%02x", blockNo);\r
+ PrintAndLog("--data: %s", sprint_hex(bldata, 4));\r
+ UsbCommand c = {CMD_MIFAREU_WRITEBL, {blockNo}};\r
+ memcpy(c.d.asBytes, bldata, 4);\r
+ SendCommand(&c);\r
+\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ uint8_t isOK = resp.arg[0] & 0xff;\r
+ PrintAndLog("isOk:%02x", isOK);\r
+ } else {\r
+ PrintAndLog("Command execute timeout");\r
+ }\r
+ }\r
+ break;\r
+ case 3:\r
+ PrintAndLog("--specialblock no:%02x", blockNo);\r
+ PrintAndLog("--data: %s", sprint_hex(bldata, 4));\r
+ UsbCommand d = {CMD_MIFAREU_WRITEBL, {blockNo}};\r
+ memcpy(d.d.asBytes,bldata, 4);\r
+ SendCommand(&d);\r
+\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ uint8_t isOK = resp.arg[0] & 0xff;\r
+ PrintAndLog("isOk:%02x", isOK);\r
+ } else {\r
+ PrintAndLog("Command execute timeout");\r
+ }\r
+ break;\r
+ default: \r
+ PrintAndLog("--block no:%02x", blockNo);\r
+ PrintAndLog("--data: %s", sprint_hex(bldata, 4)); \r
+ UsbCommand e = {CMD_MIFAREU_WRITEBL, {blockNo}};\r
+ memcpy(e.d.asBytes,bldata, 4);\r
+ SendCommand(&e);\r
+\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ uint8_t isOK = resp.arg[0] & 0xff;\r
+ PrintAndLog("isOk:%02x", isOK);\r
+ } else {\r
+ PrintAndLog("Command execute timeout");\r
+ }\r
+ break;\r
+ }\r
+ return 0;\r
+}\r
+\r
int CmdHF14AMfRdBl(const char *Cmd)\r
{\r
uint8_t blockNo = 0;\r
return 0;\r
}\r
\r
+int CmdHF14AMfURdBl(const char *Cmd)\r
+{\r
+ uint8_t blockNo = 0;\r
+\r
+ if (strlen(Cmd)<1) {\r
+ PrintAndLog("Usage: hf mf urdbl <block number>");\r
+ PrintAndLog(" sample: hf mf urdbl 0");\r
+ return 0;\r
+ } \r
+ \r
+ blockNo = param_get8(Cmd, 0);\r
+ PrintAndLog("--block no:%02x", blockNo);\r
+ \r
+ UsbCommand c = {CMD_MIFAREU_READBL, {blockNo}};\r
+ SendCommand(&c);\r
+\r
+ UsbCommand resp;\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ uint8_t isOK = resp.arg[0] & 0xff;\r
+ uint8_t * data = resp.d.asBytes;\r
+\r
+ if (isOK)\r
+ PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));\r
+ else\r
+ PrintAndLog("isOk:%02x", isOK);\r
+ } else {\r
+ PrintAndLog("Command execute timeout");\r
+ }\r
+\r
+ return 0;\r
+}\r
+\r
+int CmdHF14AMfURdCard(const char *Cmd)\r
+{\r
+ int i;\r
+ uint8_t sectorNo = 0;\r
+ uint8_t *lockbytes_t=NULL;\r
+ uint8_t lockbytes[2]={0,0};\r
+ bool bit[16]={0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};\r
+ \r
+ uint8_t isOK = 0;\r
+ uint8_t * data = NULL;\r
+\r
+ if (sectorNo > 15) {\r
+ PrintAndLog("Sector number must be less than 16");\r
+ return 1;\r
+ }\r
+ PrintAndLog("Attempting to Read Ultralight... ");\r
+ \r
+ UsbCommand c = {CMD_MIFAREU_READCARD, {sectorNo}};\r
+ SendCommand(&c);\r
+\r
+ UsbCommand resp;\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ isOK = resp.arg[0] & 0xff;\r
+ data = resp.d.asBytes;\r
+\r
+ PrintAndLog("isOk:%02x", isOK);\r
+ if (isOK) \r
+ for (i = 0; i < 16; i++) {\r
+ switch(i){\r
+ case 2:\r
+ //process lock bytes\r
+ lockbytes_t=data+(i*4);\r
+ lockbytes[0]=lockbytes_t[2];\r
+ lockbytes[1]=lockbytes_t[3];\r
+ for(int j=0; j<16; j++){\r
+ bit[j]=lockbytes[j/8] & ( 1 <<(7-j%8));\r
+ }\r
+ //PrintAndLog("LB %02x %02x", lockbytes[0],lockbytes[1]);\r
+ //PrintAndLog("LB2b %02x %02x %02x %02x %02x %02x %02x %02x",bit[8],bit[9],bit[10],bit[11],bit[12],bit[13],bit[14],bit[15]); \r
+ PrintAndLog("Block %02x:%s ", i,sprint_hex(data + i * 4, 4));\r
+ break;\r
+ case 3: \r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[4]);\r
+ break;\r
+ case 4:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[3]);\r
+ break;\r
+ case 5:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[2]);\r
+ break;\r
+ case 6:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[1]);\r
+ break;\r
+ case 7:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[0]);\r
+ break;\r
+ case 8:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[15]);\r
+ break;\r
+ case 9:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[14]);\r
+ break;\r
+ case 10:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[13]);\r
+ break;\r
+ case 11:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[12]);\r
+ break;\r
+ case 12:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[11]);\r
+ break;\r
+ case 13:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[10]);\r
+ break;\r
+ case 14:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[9]);\r
+ break;\r
+ case 15:\r
+ PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[8]);\r
+ break;\r
+ default:\r
+ PrintAndLog("Block %02x:%s ", i,sprint_hex(data + i * 4, 4));\r
+ break;\r
+ }\r
+ }\r
+ } else {\r
+ PrintAndLog("Command1 execute timeout");\r
+ }\r
+ return 0;\r
+}\r
+\r
int CmdHF14AMfRdSc(const char *Cmd)\r
{\r
int i;\r
}\r
if (isOK) {\r
fwrite ( data, 1, 16, fout );\r
+ PrintAndLog("Dumped card data into 'dumpdata.bin'");\r
+\r
}\r
else {\r
PrintAndLog("Could not get access rights for block %d", i);\r
\r
fclose(fin);\r
fclose(fout);\r
- \r
return 0;\r
}\r
\r
}\r
}\r
\r
- printf("Time in nested: %1.3f (%1.3f sec per key)\n\n", ((float)clock() - time1)/1000.0, ((float)clock() - time1)/iterations/1000.0);\r
+ printf("Time in nested: %1.3f (%1.3f sec per key)\n\n", ((float)clock() - time1)/CLOCKS_PER_SEC, ((float)clock() - time1)/iterations/CLOCKS_PER_SEC);\r
\r
PrintAndLog("-----------------------------------------------\nIterations count: %d\n\n", iterations);\r
//print them\r
keyBlock = calloc(stKeyBlock, 6);\r
if (keyBlock == NULL) return 1;\r
\r
- num_to_bytes(0xffffffffffff, 6, (uint8_t*)(keyBlock + 0 * 6)); // Default key (first key used by program if no user defined key)\r
- num_to_bytes(0x000000000000, 6, (uint8_t*)(keyBlock + 1 * 6)); // Blank key\r
- num_to_bytes(0xa0a1a2a3a4a5, 6, (uint8_t*)(keyBlock + 2 * 6)); // NFCForum MAD key\r
- num_to_bytes(0xb0b1b2b3b4b5, 6, (uint8_t*)(keyBlock + 3 * 6));\r
- num_to_bytes(0xaabbccddeeff, 6, (uint8_t*)(keyBlock + 4 * 6));\r
- num_to_bytes(0x4d3a99c351dd, 6, (uint8_t*)(keyBlock + 5 * 6));\r
- num_to_bytes(0x1a982c7e459a, 6, (uint8_t*)(keyBlock + 6 * 6));\r
- num_to_bytes(0xd3f7d3f7d3f7, 6, (uint8_t*)(keyBlock + 7 * 6));\r
- num_to_bytes(0x714c5c886e97, 6, (uint8_t*)(keyBlock + 8 * 6));\r
- num_to_bytes(0x587ee5f9350f, 6, (uint8_t*)(keyBlock + 9 * 6));\r
- num_to_bytes(0xa0478cc39091, 6, (uint8_t*)(keyBlock + 10 * 6));\r
- num_to_bytes(0x533cb6c723f6, 6, (uint8_t*)(keyBlock + 11 * 6));\r
- num_to_bytes(0x8fd0a4f256e9, 6, (uint8_t*)(keyBlock + 12 * 6));\r
+ uint64_t defaultKeys[] =\r
+ {\r
+ 0xffffffffffff, // Default key (first key used by program if no user defined key)\r
+ 0x000000000000, // Blank key\r
+ 0xa0a1a2a3a4a5, // NFCForum MAD key\r
+ 0xb0b1b2b3b4b5,\r
+ 0xaabbccddeeff,\r
+ 0x4d3a99c351dd,\r
+ 0x1a982c7e459a,\r
+ 0xd3f7d3f7d3f7,\r
+ 0x714c5c886e97,\r
+ 0x587ee5f9350f,\r
+ 0xa0478cc39091,\r
+ 0x533cb6c723f6,\r
+ 0x8fd0a4f256e9\r
+ };\r
+ int defaultKeysSize = (sizeof(defaultKeys) / 7) - 1;\r
+\r
+ for (int defaultKeyCounter = 0; defaultKeyCounter < defaultKeysSize; defaultKeyCounter++)\r
+ {\r
+ num_to_bytes(defaultKeys[defaultKeyCounter], 6, (uint8_t*)(keyBlock + defaultKeyCounter * 6));\r
+ }\r
\r
if (strlen(Cmd)<3) {\r
PrintAndLog("Usage: hf mf chk <block number>/<*card memory> <key type (A/B/?)> [t] [<key (12 hex symbols)>] [<dic (*.dic)>]");\r
}\r
\r
if ( (f = fopen( filename , "r")) ) {\r
- while( !feof(f) ){\r
- memset(buf, 0, sizeof(buf));\r
- if (fgets(buf, sizeof(buf), f) == NULL) {\r
- PrintAndLog("File reading error.");\r
- return 2;\r
- }\r
- \r
+ while( fgets(buf, sizeof(buf), f) ){\r
if (strlen(buf) < 12 || buf[11] == '\n')\r
continue;\r
\r
num_to_bytes(strtoll(buf, NULL, 16), 6, keyBlock + 6*keycnt);\r
PrintAndLog("chk custom key[%d] %012"llx, keycnt, bytes_to_num(keyBlock + 6*keycnt, 6));\r
keycnt++;\r
+ memset(buf, 0, sizeof(buf));\r
}\r
} else {\r
PrintAndLog("File: %s: not found or locked.", filename);\r
\r
if (keycnt == 0) {\r
PrintAndLog("No key specified,try default keys");\r
- for (;keycnt <=12; keycnt++)\r
+ for (;keycnt < defaultKeysSize; keycnt++)\r
PrintAndLog("chk default key[%d] %02x%02x%02x%02x%02x%02x", keycnt,\r
(keyBlock + 6*keycnt)[0],(keyBlock + 6*keycnt)[1], (keyBlock + 6*keycnt)[2],\r
(keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4], (keyBlock + 6*keycnt)[5], 6);\r
\r
int CmdHF14AMf1kSim(const char *Cmd)\r
{\r
- uint8_t uid[4] = {0, 0, 0, 0};\r
- \r
+ uint8_t uid[7] = {0, 0, 0, 0, 0, 0, 0};\r
+ uint8_t exitAfterNReads = 0;\r
+ uint8_t flags = 0;\r
+\r
if (param_getchar(Cmd, 0) == 'h') {\r
- PrintAndLog("Usage: hf mf sim <uid (8 hex symbols)>");\r
+ PrintAndLog("Usage: hf mf sim u <uid (8 hex symbols)> n <numreads> i x");\r
+ PrintAndLog(" u (Optional) UID. If not specified, the UID from emulator memory will be used");\r
+ PrintAndLog(" n (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");\r
+ PrintAndLog(" i (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");\r
+ PrintAndLog(" x (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r
PrintAndLog(" sample: hf mf sim 0a0a0a0a ");\r
return 0;\r
- } \r
- \r
- if (param_getchar(Cmd, 0) && param_gethex(Cmd, 0, uid, 8)) {\r
- PrintAndLog("UID must include 8 HEX symbols");\r
- return 1;\r
}\r
- PrintAndLog(" uid:%s ", sprint_hex(uid, 4));\r
- \r
- UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {0, 0, 0}};\r
- memcpy(c.d.asBytes, uid, 4);\r
+ uint8_t pnr = 0;\r
+ if (param_getchar(Cmd, pnr) == 'u') {\r
+ if(param_gethex(Cmd, pnr+1, uid, 8) == 0)\r
+ {\r
+ flags |=FLAG_4B_UID_IN_DATA; // UID from packet\r
+ }else if(param_gethex(Cmd,pnr+1,uid,14) == 0)\r
+ {\r
+ flags |= FLAG_7B_UID_IN_DATA;// UID from packet\r
+ }else\r
+ {\r
+ PrintAndLog("UID, if specified, must include 8 or 14 HEX symbols");\r
+ return 1;\r
+ }\r
+ pnr +=2;\r
+ }\r
+ if (param_getchar(Cmd, pnr) == 'n') {\r
+ exitAfterNReads = param_get8(Cmd,pnr+1);\r
+ pnr += 2;\r
+ }\r
+ if (param_getchar(Cmd, pnr) == 'i' ) {\r
+ //Using a flag to signal interactiveness, least significant bit\r
+ flags |= FLAG_INTERACTIVE;\r
+ pnr++;\r
+ }\r
+\r
+ if (param_getchar(Cmd, pnr) == 'x' ) {\r
+ //Using a flag to signal interactiveness, least significant bit\r
+ flags |= FLAG_NR_AR_ATTACK;\r
+ }\r
+ PrintAndLog(" uid:%s, numreads:%d, flags:%d (0x%02x) ",\r
+ flags & FLAG_4B_UID_IN_DATA ? sprint_hex(uid,4):\r
+ flags & FLAG_7B_UID_IN_DATA ? sprint_hex(uid,7): "N/A"\r
+ , exitAfterNReads, flags,flags);\r
+\r
+\r
+ UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};\r
+ memcpy(c.d.asBytes, uid, sizeof(uid));\r
SendCommand(&c);\r
\r
+ if(flags & FLAG_INTERACTIVE)\r
+ {\r
+ UsbCommand resp;\r
+ PrintAndLog("Press pm3-button to abort simulation");\r
+ while(! WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ //We're waiting only 1.5 s at a time, otherwise we get the\r
+ // annoying message about "Waiting for a response... "\r
+ }\r
+ }\r
+\r
return 0;\r
}\r
\r
while(!feof(f)){\r
memset(buf, 0, sizeof(buf));\r
if (fgets(buf, sizeof(buf), f) == NULL) {\r
- PrintAndLog("File reading error.");\r
+ if(blockNum == 16 * 4)\r
+ {\r
+ break;\r
+ }\r
+ PrintAndLog("File reading error.");\r
return 2;\r
}\r
\r
PrintAndLog("File content error. There must be 64 blocks");\r
return 4;\r
}\r
- PrintAndLog("Loaded from file: %s", filename);\r
+ PrintAndLog("Loaded %d blocks from file: %s", blockNum, filename);\r
return 0;\r
}\r
\r
printf("Press the key on pc keyboard to abort the client.\n");\r
printf("-------------------------------------------------------------------------\n");\r
\r
- UsbCommand c = {CMD_MIFARE_SNIFFER, {0, 0, 0}};\r
- SendCommand(&c);\r
+ UsbCommand c = {CMD_MIFARE_SNIFFER, {0, 0, 0}};\r
+ clearCommandBuffer();\r
+ SendCommand(&c);\r
\r
// wait cycle\r
while (true) {\r
PrintAndLog("received trace len: %d packages: %d", blockLen, pckNum);\r
num = 0;\r
while (bufPtr - buf + 9 < blockLen) {\r
- isTag = bufPtr[3] & 0x80 ? true:false;\r
+ isTag = bufPtr[3] & 0x80 ? true:false;\r
bufPtr += 4;\r
parity = *((uint32_t *)(bufPtr));\r
bufPtr += 4;\r
sak = bufPtr[11];\r
\r
PrintAndLog("tag select uid:%s atqa:%02x %02x sak:0x%02x", sprint_hex(uid, 7), atqa[0], atqa[1], sak);\r
- if (wantLogToFile) {\r
+ if (wantLogToFile || wantDecrypt) {\r
FillFileNameByUID(logHexFileName, uid, ".log", 7);\r
AddLogCurrentDT(logHexFileName);\r
} \r
}\r
} // resp not NILL\r
} // while (true)\r
- return 0;\r
+ \r
+ return 0;\r
}\r
\r
static command_t CommandTable[] =\r
{"help", CmdHelp, 1, "This help"},\r
{"dbg", CmdHF14AMfDbg, 0, "Set default debug mode"},\r
{"rdbl", CmdHF14AMfRdBl, 0, "Read MIFARE classic block"},\r
+ {"urdbl", CmdHF14AMfURdBl, 0, "Read MIFARE Ultralight block"},\r
+ {"urdcard", CmdHF14AMfURdCard, 0,"Read MIFARE Ultralight Card"},\r
+ {"uwrbl", CmdHF14AMfUWrBl, 0,"Write MIFARE Ultralight block"},\r
{"rdsc", CmdHF14AMfRdSc, 0, "Read MIFARE classic sector"},\r
{"dump", CmdHF14AMfDump, 0, "Dump MIFARE classic tag to binary file"},\r
{"restore", CmdHF14AMfRestore, 0, "Restore MIFARE classic binary file to BLANK tag"},\r
{"wrbl", CmdHF14AMfWrBl, 0, "Write MIFARE classic block"},\r
{"chk", CmdHF14AMfChk, 0, "Test block keys"},\r
- {"mifare", CmdHF14AMifare, 0, "Read parity error messages. param - <used card nonce>"},\r
+ {"mifare", CmdHF14AMifare, 0, "Read parity error messages."},\r
{"nested", CmdHF14AMfNested, 0, "Test nested authentication"},\r
{"sniff", CmdHF14AMfSniff, 0, "Sniff card-reader communication"},\r
{"sim", CmdHF14AMf1kSim, 0, "Simulate MIFARE card"},\r
projects / proxmark3-svn / blobdiff