Merge pull request #46 from micolous/fix-nonce

[proxmark3-svn] / client / cmdhfmf.c

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 6ddf845aa446ab7fbaf00117eb9e7631d694e404..99a91ced7a8418e95665ffdc6eae7dc218cffae7 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -31,6 +31,7 @@ int usage_hf14_mf1ksim(void){
        PrintAndLog("      n    (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");\r
        PrintAndLog("      i    (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");\r
        PrintAndLog("      x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r
+       PrintAndLog("      e    (Optional) Fill simulator keys from what we crack");\r
        PrintAndLog("samples:");\r
        PrintAndLog("           hf mf sim u 0a0a0a0a");\r
        PrintAndLog("           hf mf sim u 11223344556677");\r
@@ -475,6 +476,7 @@ int CmdHF14AMfDump(const char *Cmd) {
                if ( bytes_read == 0) {\r
                        PrintAndLog("File reading error.");\r
                        fclose(fin);\r
+                       fin = NULL;\r
                        return 2;\r
                }\r
        }\r
@@ -485,12 +487,14 @@ int CmdHF14AMfDump(const char *Cmd) {
                if ( bytes_read == 0) {\r
                        PrintAndLog("File reading error.");\r
                        fclose(fin);\r
+                       fin = NULL;\r
                        return 2;\r
                }\r
        }\r
        \r
        fclose(fin);\r
-\r
+       fin = NULL;\r
+                       \r
        PrintAndLog("|-----------------------------------------|");\r
        PrintAndLog("|------ Reading sector access bits...-----|");\r
        PrintAndLog("|-----------------------------------------|");\r
@@ -596,6 +600,7 @@ int CmdHF14AMfDump(const char *Cmd) {
                uint16_t numblocks = FirstBlockOfSector(numSectors - 1) + NumBlocksPerSector(numSectors - 1);\r
                fwrite(carddata, 1, 16*numblocks, fout);\r
                fclose(fout);\r
+               fout = NULL;            \r
                PrintAndLog("Dumped %d blocks (%d bytes) to file dumpdata.bin", numblocks, 16*numblocks);\r
        }\r
                \r
@@ -644,6 +649,7 @@ int CmdHF14AMfRestore(const char *Cmd) {
                if ( bytes_read == 0) {\r
                        PrintAndLog("File reading error (dumpkeys.bin).");\r
                        fclose(fkeys);\r
+                       fkeys = NULL;\r
                        return 2;\r
                }\r
        }\r
@@ -653,6 +659,7 @@ int CmdHF14AMfRestore(const char *Cmd) {
                if ( bytes_read == 0) {\r
                        PrintAndLog("File reading error (dumpkeys.bin).");\r
                        fclose(fkeys);\r
+                       fkeys = NULL;\r
                        return 2;\r
                }\r
        }\r
@@ -673,6 +680,7 @@ int CmdHF14AMfRestore(const char *Cmd) {
                        if ( bytes_read == 0) {\r
                                PrintAndLog("File reading error (dumpdata.bin).");\r
                                fclose(fdump);\r
+                               fdump = NULL;                           \r
                                return 2;\r
                        }\r
                                        \r
@@ -708,6 +716,7 @@ int CmdHF14AMfRestore(const char *Cmd) {
        }\r
        \r
        fclose(fdump);\r
+       fdump = NULL;   \r
        return 0;\r
 }\r
 \r
@@ -1376,7 +1385,9 @@ void readerAttack(nonces_t data[], bool setEmulatorMem) {
        printf("enter reader attack\n");\r
        for (uint8_t i = 0; i < ATTACK_KEY_COUNT; ++i) {\r
                if (data[i].ar2 > 0) {\r
-                       \r
+\r
+                       // We can probably skip this, mfkey32v2 is more reliable.\r
+#ifdef HFMF_TRYMFK32\r
                        if (tryMfk32(data[i], &key)) {\r
                                PrintAndLog("Found Key%s for sector %02d: [%012"llx"]"\r
                                        , (data[i].keytype) ? "B" : "A"\r
@@ -1392,22 +1403,43 @@ void readerAttack(nonces_t data[], bool setEmulatorMem) {
                                        uint8_t memBlock[16] = {0,0,0,0,0,0, 0xff, 0x0F, 0x80, 0x69, 0,0,0,0,0,0};\r
                                        num_to_bytes( k_sector[i].Key[0], 6, memBlock);\r
                                        num_to_bytes( k_sector[i].Key[1], 6, memBlock+10);\r
-                                       mfEmlSetMem( memBlock, i*4 + 3, 1);\r
                                        PrintAndLog("Setting Emulator Memory Block %02d: [%s]"\r
-                                               , i*4 + 3\r
+                                               , ((data[i].sector)*4) + 3\r
                                                , sprint_hex( memBlock, sizeof(memBlock))\r
                                                );\r
+                                       mfEmlSetMem( memBlock, ((data[i].sector)*4) + 3, 1);\r
                                }\r
-                               break;\r
+                               continue;\r
                        }\r
+#endif\r
                        //moebius attack                        \r
-                       // if (tryMfk32_moebius(data[i+ATTACK_KEY_COUNT], &key)) {\r
-                               // PrintAndLog("M-Found Key%s for sector %02d: [%012"llx"]"\r
-                                       // ,(data[i+ATTACK_KEY_COUNT].keytype) ? "B" : "A"\r
-                                       // , data[i+ATTACK_KEY_COUNT].sector\r
-                                       // , key\r
-                               // );\r
-                       // }\r
+                       if (tryMfk32_moebius(data[i+ATTACK_KEY_COUNT], &key)) {\r
+                               uint8_t sectorNum = data[i+ATTACK_KEY_COUNT].sector;\r
+                               uint8_t keyType = data[i+ATTACK_KEY_COUNT].keytype;\r
+\r
+                               PrintAndLog("M-Found Key%s for sector %02d: [%012"llx"]"\r
+                                       , keyType ? "B" : "A"\r
+                                       , sectorNum\r
+                                       , key\r
+                               );\r
+\r
+                               k_sector[sectorNum].Key[keyType] = key;\r
+                               k_sector[sectorNum].foundKey[keyType] = TRUE;\r
+\r
+                               //set emulator memory for keys\r
+                               if (setEmulatorMem) {\r
+                                       uint8_t memBlock[16] = {0,0,0,0,0,0, 0xff, 0x0F, 0x80, 0x69, 0,0,0,0,0,0};\r
+                                       num_to_bytes( k_sector[sectorNum].Key[0], 6, memBlock);\r
+                                       num_to_bytes( k_sector[sectorNum].Key[1], 6, memBlock+10);\r
+                                       PrintAndLog("Setting Emulator Memory Block %02d: [%s]"\r
+                                               , (sectorNum*4) + 3\r
+                                               , sprint_hex( memBlock, sizeof(memBlock))\r
+                                               );\r
+                                       mfEmlSetMem( memBlock, (sectorNum*4) + 3, 1);\r
+                               }\r
+                               continue;\r
+                       }\r
+\r
                }\r
        }\r
 }\r
@@ -1498,6 +1530,7 @@ int CmdHF14AMf1kSim(const char *Cmd) {
                if (k_sector != NULL) {\r
                        printKeyTable(k_sectorsCount, k_sector );\r
                        free(k_sector);\r
+                       k_sector = NULL;\r
                }\r
        }\r
        return 0;\r