X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/0de8e3874d6524379550a50a4d9c29faf2d239ea..acd7ccdbc9b98f2e10df25e7cf2a6d17824f1b7e:/client/cmdhfmf.c

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 76fd1b7e..e41afb6a 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -59,7 +59,8 @@ start:
 				case -1 : PrintAndLog("Button pressed. Aborted.\n"); break;
 				case -2 : PrintAndLog("Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests).\n"); break;
 				case -3 : PrintAndLog("Card is not vulnerable to Darkside attack (its random number generator is not predictable).\n"); break;
-				case -4 : PrintAndLog("The card's random number generator is vulnerable but behaves somewhat weird (Mifare clone?). This needs to be fixed.\n"); break;
+				case -4 : PrintAndLog("Card is not vulnerable to Darkside attack (its random number generator seems to be based on the wellknown");
+							PrintAndLog("generating polynomial with 16 effective bits only, but shows unexpected behaviour.\n"); break;
 				default: ;
 			}
 			break;
@@ -121,10 +122,11 @@ int CmdHF14AMfWrBl(const char *Cmd)
 	PrintAndLog("--block no:%d, key type:%c, key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));
 	PrintAndLog("--data: %s", sprint_hex(bldata, 16));
 	
-  UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};
+	UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};
 	memcpy(c.d.asBytes, key, 6);
 	memcpy(c.d.asBytes + 10, bldata, 16);
-  SendCommand(&c);
+	clearCommandBuffer();
+	SendCommand(&c);
 
 	UsbCommand resp;
 	if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
@@ -165,9 +167,10 @@ int CmdHF14AMfRdBl(const char *Cmd)
 	}
 	PrintAndLog("--block no:%d, key type:%c, key:%s ", blockNo, keyType?'B':'A', sprint_hex(key, 6));
 	
-  UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};
+	UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};
 	memcpy(c.d.asBytes, key, 6);
-  SendCommand(&c);
+	clearCommandBuffer();
+	SendCommand(&c);
 
 	UsbCommand resp;
 	if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
@@ -220,6 +223,7 @@ int CmdHF14AMfRdSc(const char *Cmd)
 	
 	UsbCommand c = {CMD_MIFARE_READSC, {sectorNo, keyType, 0}};
 	memcpy(c.d.asBytes, key, 6);
+	clearCommandBuffer();
 	SendCommand(&c);
 	PrintAndLog(" ");
 
@@ -326,6 +330,7 @@ int CmdHF14AMfDump(const char *Cmd)
 	for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {
 		UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 0, 0}};
 		memcpy(c.d.asBytes, keyA[sectorNo], 6);
+		clearCommandBuffer();
 		SendCommand(&c);
 
 		if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
@@ -360,6 +365,7 @@ int CmdHF14AMfDump(const char *Cmd)
 			if (blockNo == NumBlocksPerSector(sectorNo) - 1) {		// sector trailer. At least the Access Conditions can always be read with key A. 
 				UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};
 				memcpy(c.d.asBytes, keyA[sectorNo], 6);
+				clearCommandBuffer();
 				SendCommand(&c);
 				received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
 			} else {												// data block. Check if it can be read with key A or key B
@@ -375,6 +381,7 @@ int CmdHF14AMfDump(const char *Cmd)
 				} else {																				// key A would work
 					UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};
 					memcpy(c.d.asBytes, keyA[sectorNo], 6);
+					clearCommandBuffer();
 					SendCommand(&c);
 					received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
 				}
@@ -467,7 +474,6 @@ int CmdHF14AMfRestore(const char *Cmd)
 	for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {
 		if (fread(keyA[sectorNo], 1, 6, fkeys) == 0) {
 			PrintAndLog("File reading error (dumpkeys.bin).");
-
 			fclose(fkeys);
 			return 2;
 		}
@@ -518,6 +524,7 @@ int CmdHF14AMfRestore(const char *Cmd)
 			PrintAndLog("Writing to block %3d: %s", FirstBlockOfSector(sectorNo) + blockNo, sprint_hex(bldata, 16));
 			
 			memcpy(c.d.asBytes + 10, bldata, 16);
+			clearCommandBuffer();
 			SendCommand(&c);
 
 			UsbCommand resp;
@@ -1023,8 +1030,6 @@ int CmdHF14AMf1kSim(const char *Cmd)
 	
 	uint8_t cmdp = param_getchar(Cmd, 0);
 
-	clearCommandBuffer();
-	
 	if (cmdp == 'h' || cmdp == 'H') {
 		PrintAndLog("Usage:  hf mf sim  u <uid (8 hex symbols)> n <numreads> i x");
 		PrintAndLog("           h    this help");
@@ -1071,6 +1076,7 @@ int CmdHF14AMf1kSim(const char *Cmd)
 
 	UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};
 	memcpy(c.d.asBytes, uid, sizeof(uid));
+	clearCommandBuffer();
 	SendCommand(&c);
 
 	if(flags & FLAG_INTERACTIVE)
@@ -1131,10 +1137,10 @@ int CmdHF14AMfDbg(const char *Cmd)
 		return 0;
 	}	
 
-  UsbCommand c = {CMD_MIFARE_SET_DBGMODE, {dbgMode, 0, 0}};
-  SendCommand(&c);
+	UsbCommand c = {CMD_MIFARE_SET_DBGMODE, {dbgMode, 0, 0}};
+	SendCommand(&c);
 
-  return 0;
+	return 0;
 }
 
 int CmdHF14AMfEGet(const char *Cmd)
@@ -1168,12 +1174,11 @@ int CmdHF14AMfEClear(const char *Cmd)
 		return 0;
 	}	
 
-  UsbCommand c = {CMD_MIFARE_EML_MEMCLR, {0, 0, 0}};
-  SendCommand(&c);
-  return 0;
+	UsbCommand c = {CMD_MIFARE_EML_MEMCLR, {0, 0, 0}};
+	SendCommand(&c);
+	return 0;
 }
 
-
 int CmdHF14AMfESet(const char *Cmd)
 {
 	uint8_t memBlock[16];
@@ -1201,7 +1206,6 @@ int CmdHF14AMfESet(const char *Cmd)
 	return 0;
 }
 
-
 int CmdHF14AMfELoad(const char *Cmd)
 {
 	FILE * f;
@@ -1214,7 +1218,7 @@ int CmdHF14AMfELoad(const char *Cmd)
 	uint8_t blockWidth = 32;
 	char ctmp = param_getchar(Cmd, 0);
 		
-	if ( ctmp == 'h' || ctmp == 0x00) {
+	if ( ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) {
 		PrintAndLog("It loads emul dump from the file `filename.eml`");
 		PrintAndLog("Usage:  hf mf eload [card memory] <file name w/o `.eml`>");
 		PrintAndLog("  [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K, u = UL");
@@ -1230,8 +1234,8 @@ int CmdHF14AMfELoad(const char *Cmd)
 		case '\0': numBlocks = 16*4; break;
 		case '2' : numBlocks = 32*4; break;
 		case '4' : numBlocks = 256; break;
-		case 'U' : // fall through
-		case 'u' : numBlocks = 255; blockWidth = 8; break;
+		case 'U' : // fall through  ,  NTAG 215 has 135blocks a 540 bytes.
+		case 'u' : numBlocks = 135; blockWidth = 8; break;
 		default:  {
 			numBlocks = 16*4;
 			nameParamNo = 0;
@@ -1298,7 +1302,6 @@ int CmdHF14AMfELoad(const char *Cmd)
 	return 0;
 }
 
-
 int CmdHF14AMfESave(const char *Cmd)
 {
 	FILE * f;
@@ -1384,7 +1387,6 @@ int CmdHF14AMfESave(const char *Cmd)
   return 0;
 }
 
-
 int CmdHF14AMfECFill(const char *Cmd)
 {
 	uint8_t keyType = 0;
@@ -1424,15 +1426,16 @@ int CmdHF14AMfECFill(const char *Cmd)
 	return 0;
 }
 
-
 int CmdHF14AMfEKeyPrn(const char *Cmd)
 {
 	int i;
 	uint8_t numSectors;
 	uint8_t data[16];
 	uint64_t keyA, keyB;
+
+	char cmdp = param_getchar(Cmd, 0);
 	
-	if (param_getchar(Cmd, 0) == 'h') {
+	if ( cmdp == 'h' || cmdp == 'H' ) {
 		PrintAndLog("It prints the keys loaded in the emulator memory");
 		PrintAndLog("Usage:  hf mf ekeyprn [card memory]");
 		PrintAndLog("  [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");
@@ -1441,8 +1444,6 @@ int CmdHF14AMfEKeyPrn(const char *Cmd)
 		return 0;
 	}	
 
-	char cmdp = param_getchar(Cmd, 0);
-	
 	switch (cmdp) {
 		case '0' : numSectors = 5; break;
 		case '1' : 
@@ -1469,7 +1470,6 @@ int CmdHF14AMfEKeyPrn(const char *Cmd)
 	return 0;
 }
 
-
 int CmdHF14AMfCSetUID(const char *Cmd)
 {
 	uint8_t wipeCard = 0;
@@ -1573,7 +1573,6 @@ int CmdHF14AMfCSetBlk(const char *Cmd)
 	return 0;
 }
 
-
 int CmdHF14AMfCLoad(const char *Cmd)
 {
 	FILE * f;
@@ -1583,8 +1582,10 @@ int CmdHF14AMfCLoad(const char *Cmd)
 	uint8_t buf8[64] = {0x00};
 	uint8_t fillFromEmulator = 0;
 	int i, len, blockNum, flags=0;
+
+	char ctmp = param_getchar(Cmd, 0);
 	
-	if (param_getchar(Cmd, 0) == 'h' || param_getchar(Cmd, 0)== 0x00) {
+	if (ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) {
 		PrintAndLog("It loads magic Chinese card from the file `filename.eml`");
 		PrintAndLog("or from emulator memory (option `e`)");
 		PrintAndLog("Usage:  hf mf cload <file name w/o `.eml`>");
@@ -1593,7 +1594,6 @@ int CmdHF14AMfCLoad(const char *Cmd)
 		return 0;
 	}	
 
-	char ctmp = param_getchar(Cmd, 0);
 	if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;
 	
 	if (fillFromEmulator) {
@@ -1700,7 +1700,6 @@ int CmdHF14AMfCGetBlk(const char *Cmd) {
 	return 0;
 }
 
-
 int CmdHF14AMfCGetSc(const char *Cmd) {
 	uint8_t memBlock[16] = {0x00};
 	uint8_t sectorNo = 0;
@@ -1737,7 +1736,6 @@ int CmdHF14AMfCGetSc(const char *Cmd) {
 	return 0;
 }
 
-
 int CmdHF14AMfCSave(const char *Cmd) {
 
 	FILE * f;
@@ -1749,8 +1747,9 @@ int CmdHF14AMfCSave(const char *Cmd) {
 	
 	// memset(filename, 0, sizeof(filename));
 	// memset(buf, 0, sizeof(buf));
-
-	if (param_getchar(Cmd, 0) == 'h') {
+	char ctmp = param_getchar(Cmd, 0);
+	
+	if ( ctmp == 'h' || ctmp == 'H' ) {
 		PrintAndLog("It saves `magic Chinese` card dump into the file `filename.eml` or `cardID.eml`");
 		PrintAndLog("or into emulator memory (option `e`)");
 		PrintAndLog("Usage:  hf mf esave [file name w/o `.eml`][e]");
@@ -1759,8 +1758,6 @@ int CmdHF14AMfCSave(const char *Cmd) {
 		PrintAndLog("         hf mf esave e \n");
 		return 0;
 	}	
-
-	char ctmp = param_getchar(Cmd, 0);
 	if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;
 
 	if (fillFromEmulator) {
@@ -1832,7 +1829,6 @@ int CmdHF14AMfCSave(const char *Cmd) {
 	}
 }
 
-
 int CmdHF14AMfSniff(const char *Cmd){
 
 	bool wantLogToFile = 0;
@@ -1980,6 +1976,25 @@ int CmdHF14AMfSniff(const char *Cmd){
 	return 0;
 }
 
+//needs nt, ar, at, Data to decrypt
+int CmdHf14MfDecryptBytes(const char *Cmd){
+	uint8_t data[50];
+	
+	uint32_t nt 	= param_get32ex(Cmd,0,0,16);
+	uint32_t ar_enc = param_get32ex(Cmd,1,0,16);
+	uint32_t at_enc = param_get32ex(Cmd,2,0,16);
+
+	int len = 0;
+	param_gethex_ex(Cmd, 3, data, &len);
+	
+	len /= 2;	
+	int limit = sizeof(data) / 2;
+	
+	if ( len >= limit )
+		len = limit;
+	
+	return tryDecryptWord( nt, ar_enc, at_enc, data, len);
+}
 
 static command_t CommandTable[] =
 {
@@ -2008,6 +2023,7 @@ static command_t CommandTable[] =
   {"cgetsc",	CmdHF14AMfCGetSc,		0, "Read sector - Magic Chinese card"},
   {"cload",		CmdHF14AMfCLoad,		0, "Load dump into magic Chinese card"},
   {"csave",		CmdHF14AMfCSave,		0, "Save dump from magic Chinese card into file or emulator"},
+  {"decrypt",   CmdHf14MfDecryptBytes,  1, "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace"},
   {NULL, NULL, 0, NULL}
 };