Merge branch 'master' of https://github.com/iceman1001/proxmark3

[proxmark3-svn] / client / cmdhfmf.c

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 0a24f6da33c72a1e8036c4baa662144624147dd0..272f1ade2d2c47a619f90a81a1a27fa0afa240c4 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -799,14 +799,16 @@ int CmdHF14AMfNestedHard(const char *Cmd)
        uint8_t trgBlockNo = 0;\r
        uint8_t trgKeyType = 0;\r
        uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r
        uint8_t trgBlockNo = 0;\r
        uint8_t trgKeyType = 0;\r
        uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r

+       uint8_t trgkey[6] = {0, 0, 0, 0, 0, 0};\r

        \r
        char ctmp;\r
        ctmp = param_getchar(Cmd, 0);\r
        \r
        char ctmp;\r
        ctmp = param_getchar(Cmd, 0);\r

+\r

        if (ctmp != 'R' && ctmp != 'r' && strlen(Cmd) < 20) {\r
                PrintAndLog("Usage:");\r
                PrintAndLog("      hf mf hardnested <block number> <key A|B> <key (12 hex symbols)>");\r
        if (ctmp != 'R' && ctmp != 'r' && strlen(Cmd) < 20) {\r
                PrintAndLog("Usage:");\r
                PrintAndLog("      hf mf hardnested <block number> <key A|B> <key (12 hex symbols)>");\r

-               PrintAndLog("                       <target block number> <target key A|B> [w] [s]");\r
-               PrintAndLog("  or  hf mf hardnested r");\r
+               PrintAndLog("                       <target block number> <target key A|B> [known target key (12 hex symbols)] [w] [s]");\r
+               PrintAndLog("  or  hf mf hardnested r [known target key]");\r

                PrintAndLog(" ");\r
                PrintAndLog("Options: ");\r
                PrintAndLog("      w: Acquire nonces and write them to binary file nonces.bin");\r
                PrintAndLog(" ");\r
                PrintAndLog("Options: ");\r
                PrintAndLog("      w: Acquire nonces and write them to binary file nonces.bin");\r


@@ -817,17 +819,22 @@ int CmdHF14AMfNestedHard(const char *Cmd)
                PrintAndLog("      sample2: hf mf hardnested 0 A FFFFFFFFFFFF 4 A w");\r
                PrintAndLog("      sample3: hf mf hardnested 0 A FFFFFFFFFFFF 4 A w s");\r
                PrintAndLog("      sample4: hf mf hardnested r");\r
                PrintAndLog("      sample2: hf mf hardnested 0 A FFFFFFFFFFFF 4 A w");\r
                PrintAndLog("      sample3: hf mf hardnested 0 A FFFFFFFFFFFF 4 A w s");\r
                PrintAndLog("      sample4: hf mf hardnested r");\r

-\r
+               PrintAndLog(" ");\r
+               PrintAndLog("Add the known target key to check if it is present in the remaining key space:");\r
+               PrintAndLog("      sample5: hf mf hardnested 0 A A0A1A2A3A4A5 4 A FFFFFFFFFFFF");\r

                return 0;\r
        }       \r
        \r
                return 0;\r
        }       \r
        \r

+       bool know_target_key = false;\r

        bool nonce_file_read = false;\r
        bool nonce_file_write = false;\r
        bool slow = false;\r
        \r
        if (ctmp == 'R' || ctmp == 'r') {\r
        bool nonce_file_read = false;\r
        bool nonce_file_write = false;\r
        bool slow = false;\r
        \r
        if (ctmp == 'R' || ctmp == 'r') {\r

-\r

                nonce_file_read = true;\r
                nonce_file_read = true;\r

+               if (!param_gethex(Cmd, 1, trgkey, 12)) {\r
+                       know_target_key = true;\r
+               }\r

 \r
        } else {\r
 \r
 \r
        } else {\r
 \r


@@ -857,6 +864,12 @@ int CmdHF14AMfNestedHard(const char *Cmd)
                }\r
 \r
                uint16_t i = 5;\r
                }\r
 \r
                uint16_t i = 5;\r

+\r
+               if (!param_gethex(Cmd, 5, trgkey, 12)) {\r
+                       know_target_key = true;\r
+                       i++;\r
+               }\r
+\r

                while ((ctmp = param_getchar(Cmd, i))) {\r
                        if (ctmp == 's' || ctmp == 'S') {\r
                                slow = true;\r
                while ((ctmp = param_getchar(Cmd, i))) {\r
                        if (ctmp == 's' || ctmp == 'S') {\r
                                slow = true;\r


@@ -870,12 +883,16 @@ int CmdHF14AMfNestedHard(const char *Cmd)
                }\r
        }\r
 \r
                }\r
        }\r
 \r

-       PrintAndLog("--target block no:%3d, target key type:%c, file action: %s, Slow: %s ", \r
+       PrintAndLog("--target block no:%3d, target key type:%c, known target key: 0x%02x%02x%02x%02x%02x%02x%s, file action: %s, Slow: %s ", \r

                        trgBlockNo, \r
                        trgKeyType?'B':'A', \r
                        trgBlockNo, \r
                        trgKeyType?'B':'A', \r

+                       trgkey[0], trgkey[1], trgkey[2], trgkey[3], trgkey[4], trgkey[5],\r
+                       know_target_key?"":" (not set)",\r

                        nonce_file_write?"write":nonce_file_read?"read":"none",\r
                        slow?"Yes":"No");\r
                        nonce_file_write?"write":nonce_file_read?"read":"none",\r
                        slow?"Yes":"No");\r

-       int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, nonce_file_read, nonce_file_write, slow);\r
+\r
+       int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key?trgkey:NULL, nonce_file_read, nonce_file_write, slow);\r
+\r

        if (isOK) {\r
                switch (isOK) {\r
                        case 1 : PrintAndLog("Error: No response from Proxmark.\n"); break;\r
        if (isOK) {\r
                switch (isOK) {\r
                        case 1 : PrintAndLog("Error: No response from Proxmark.\n"); break;\r


@@ -1178,15 +1195,21 @@ int CmdHF14AMf1kSim(const char *Cmd)
 \r
        if(flags & FLAG_INTERACTIVE)\r
        {               \r
 \r
        if(flags & FLAG_INTERACTIVE)\r
        {               \r

-               PrintAndLog("Press pm3-button to abort simulation");\r
-               \r

                uint8_t data[40];\r
                uint8_t key[6];\r
 \r
                UsbCommand resp;                \r
                uint8_t data[40];\r
                uint8_t key[6];\r
 \r
                UsbCommand resp;                \r

+               PrintAndLog("Press pm3-button or send another cmd to abort simulation");\r
+               //while(! WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+                       //We're waiting only 1.5 s at a time, otherwise we get the\r
+                       // annoying message about "Waiting for a response... "\r
+               //}\r

                while(!ukbhit() ){\r
                while(!ukbhit() ){\r

-                       if ( WaitForResponseTimeout(CMD_ACK,&resp,1500) ) {\r
-                               if ( (resp.arg[0] & 0xffff) == CMD_SIMULATE_MIFARE_CARD ){\r
+                       if (!WaitForResponseTimeout(CMD_ACK,&resp,1500) ) continue;\r
+\r
+                       if ( !(flags & FLAG_NR_AR_ATTACK) ) break;\r
+                       if ( (resp.arg[0] & 0xffff) != CMD_SIMULATE_MIFARE_CARD ) break;\r
+\r

                                        memset(data, 0x00, sizeof(data));\r
                                        memset(key, 0x00, sizeof(key));\r
                                        int len = (resp.arg[1] > sizeof(data)) ? sizeof(data) : resp.arg[1];\r
                                        memset(data, 0x00, sizeof(data));\r
                                        memset(key, 0x00, sizeof(key));\r
                                        int len = (resp.arg[1] > sizeof(data)) ? sizeof(data) : resp.arg[1];\r


@@ -1196,8 +1219,8 @@ int CmdHF14AMf1kSim(const char *Cmd)
                                        uint64_t corr_uid = 0;\r
                                        if ( memcmp(data, "\x00\x00\x00\x00", 4) == 0 ) {\r
                                                corr_uid = (data[3] << 24) | (data[2] << 16) | (data[1] << 8) | data[0];\r
                                        uint64_t corr_uid = 0;\r
                                        if ( memcmp(data, "\x00\x00\x00\x00", 4) == 0 ) {\r
                                                corr_uid = (data[3] << 24) | (data[2] << 16) | (data[1] << 8) | data[0];\r

-                                       }\r
-                                       else {\r
+                               tryMfk32(corr_uid, data, key);\r
+                       } else {\r

                                                corr_uid |= (uint64_t)data[2] << 48; \r
                                                corr_uid |= (uint64_t)data[1] << 40; \r
                                                corr_uid |= (uint64_t)data[0] << 32;\r
                                                corr_uid |= (uint64_t)data[2] << 48; \r
                                                corr_uid |= (uint64_t)data[1] << 40; \r
                                                corr_uid |= (uint64_t)data[0] << 32;\r


@@ -1205,14 +1228,12 @@ int CmdHF14AMf1kSim(const char *Cmd)
                                                corr_uid |= data[6] << 16;\r
                                                corr_uid |= data[5] << 8;\r
                                                corr_uid |= data[4];\r
                                                corr_uid |= data[6] << 16;\r
                                                corr_uid |= data[5] << 8;\r
                                                corr_uid |= data[4];\r

+                               tryMfk64(corr_uid, data, key);\r

                                        }\r
                                        }\r

-                                       tryMfk32(corr_uid, data, key);\r
-                                       //tryMfk64(corr_uid, data, key);\r

                                        PrintAndLog("--");\r
                                }\r
                        }\r
                                        PrintAndLog("--");\r
                                }\r
                        }\r

-               }\r
-       }\r
+       \r

        return 0;\r
 }\r
 \r
        return 0;\r
 }\r
 \r


@@ -1317,7 +1338,7 @@ int CmdHF14AMfELoad(const char *Cmd)
                \r
        if ( ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) {\r
                PrintAndLog("It loads emul dump from the file `filename.eml`");\r
                \r
        if ( ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) {\r
                PrintAndLog("It loads emul dump from the file `filename.eml`");\r

-               PrintAndLog("Usage:  hf mf eload [card memory] <file name w/o `.eml`>");\r
+               PrintAndLog("Usage:  hf mf eload [card memory] <file name w/o `.eml`> [numblocks]");\r

                PrintAndLog("  [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K, u = UL");\r
                PrintAndLog("");\r
                PrintAndLog(" sample: hf mf eload filename");\r
                PrintAndLog("  [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K, u = UL");\r
                PrintAndLog("");\r
                PrintAndLog(" sample: hf mf eload filename");\r


@@ -1331,13 +1352,15 @@ int CmdHF14AMfELoad(const char *Cmd)
                case '\0': numBlocks = 16*4; break;\r
                case '2' : numBlocks = 32*4; break;\r
                case '4' : numBlocks = 256; break;\r
                case '\0': numBlocks = 16*4; break;\r
                case '2' : numBlocks = 32*4; break;\r
                case '4' : numBlocks = 256; break;\r

-               case 'U' : // fall through  ,  NTAG 215 has 135blocks a 540 bytes.\r
-               case 'u' : numBlocks = 135; blockWidth = 8; break;\r
+               case 'U' : // fall through\r
+               case 'u' : numBlocks = 255; blockWidth = 8; break;\r

                default:  {\r
                        numBlocks = 16*4;\r
                        nameParamNo = 0;\r
                }\r
        }\r
                default:  {\r
                        numBlocks = 16*4;\r
                        nameParamNo = 0;\r
                }\r
        }\r

+       uint32_t numblk2 = param_get32ex(Cmd,2,0,10);\r
+       if (numblk2 > 0) numBlocks = numblk2;   \r

 \r
        len = param_getstr(Cmd,nameParamNo,filename);\r
        \r
 \r
        len = param_getstr(Cmd,nameParamNo,filename);\r
        \r


@@ -1799,7 +1822,7 @@ int CmdHF14AMfCGetBlk(const char *Cmd) {
                return 1;\r
        }\r
        \r
                return 1;\r
        }\r
        \r

-       PrintAndLog("data:%s", sprint_hex(data, sizeof(data)));\r
+       PrintAndLog("data: %s", sprint_hex(data, sizeof(data)));\r

        return 0;\r
 }\r
 \r
        return 0;\r
 }\r
 \r


@@ -2004,7 +2027,10 @@ int CmdHF14AMfSniff(const char *Cmd){
                        uint16_t traceLen = resp.arg[1];\r
                        len = resp.arg[2];\r
 \r
                        uint16_t traceLen = resp.arg[1];\r
                        len = resp.arg[2];\r
 \r

-                       if (res == 0) return 0;                                         // we are done\r
+                       if (res == 0) {\r
+                               free(buf);\r
+                               return 0;                                               // we are done\r
+                       }\r

 \r
                        if (res == 1) {                                                         // there is (more) data to be transferred\r
                                if (pckNum == 0) {                                              // first packet, (re)allocate necessary buffer\r
 \r
                        if (res == 1) {                                                         // there is (more) data to be transferred\r
                                if (pckNum == 0) {                                              // first packet, (re)allocate necessary buffer\r