X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/5247c0c193eb0b66e57946589c1d05cc67f56b22..61f97ca7ad5d1f06289fd053ecdabe4b52f37032:/client/cmdhfmfu.c diff --git a/client/cmdhfmfu.c b/client/cmdhfmfu.c index aad7f886..336fd64a 100644 --- a/client/cmdhfmfu.c +++ b/client/cmdhfmfu.c @@ -100,6 +100,38 @@ uint32_t ul_ev1_pwdgenB(uint8_t* uid) { return (uint32_t)bytes_to_num(pwd, 4); } +// Certain pwd generation algo nickname C. +uint32_t ul_ev1_pwdgenC(uint8_t* uid){ + uint32_t pwd = 0; + uint8_t base[] = { + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x28, + 0x63, 0x29, 0x20, 0x43, 0x6f, 0x70, 0x79, 0x72, + 0x69, 0x67, 0x68, 0x74, 0x20, 0x4c, 0x45, 0x47, + 0x4f, 0x20, 0x32, 0x30, 0x31, 0x34, 0xaa, 0xaa + }; + + memcpy(base, uid, 7); + + for (int i = 0; i < 32; i += 4) { + uint32_t b = *(uint32_t *)(base + i); + pwd = b + ROTR(pwd, 25) + ROTR(pwd, 10) - pwd; + } + return BSWAP_32(pwd); +} + +// pack generation for algo 1-3 +uint16_t ul_ev1_packgenA(uint8_t* uid){ + uint16_t pack = (uid[0] ^ uid[1] ^ uid[2]) << 8 | (uid[2] ^ 8); + return pack; +} +uint16_t ul_ev1_packgenB(uint8_t* uid){ + return 0x8080; +} +uint16_t ul_ev1_packgenC(uint8_t* uid){ + return 0xaa55; +} + + void ul_ev1_pwdgen_selftest(){ uint8_t uid1[] = {0x04,0x11,0x12,0x11,0x12,0x11,0x10}; @@ -109,6 +141,10 @@ void ul_ev1_pwdgen_selftest(){ uint8_t uid2[] = {0x04,0x1f,0x98,0xea,0x1e,0x3e,0x81}; uint32_t pwd2 = ul_ev1_pwdgenB(uid2); PrintAndLog("UID | %s | %08X | %s", sprint_hex(uid2,7), pwd2, (pwd2 == 0x5fd37eca)?"OK":"->5fd37eca<--"); + + uint8_t uid3[] = {0x04,0x62, 0xB6, 0x8A, 0xB4, 0x42, 0x80}; + uint32_t pwd3 = ul_ev1_pwdgenC(uid3); + PrintAndLog("UID | %s | %08X | %s", sprint_hex(uid3,7), pwd3, (pwd3 == 0x5a349515)?"OK":"->5a349515<--"); return; } @@ -257,7 +293,7 @@ static int ul_auth_select( iso14a_card_select_t *card, TagTypeUL_t tagtype, bool if ( !ul_select(card) ) return 0; if (hasAuthKey) { - if (ulev1_requestAuthentication(authenticationkey, pack, packSize) < 1) { + if (ulev1_requestAuthentication(authenticationkey, pack, packSize) < 2) { ul_switch_off_field(); PrintAndLog("Error: Authentication Failed UL-EV1/NTAG"); return 0; @@ -915,6 +951,14 @@ int CmdHF14AMfUInfo(const char *Cmd){ PrintAndLog("Found a default password: %s || Pack: %02X %02X",sprint_hex(key, 4), pack[0], pack[1]); } if (!ul_auth_select( &card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack))) return -1; + + // test pwd gen C + num_to_bytes( ul_ev1_pwdgenC(card.uid), 4, key); + len = ulev1_requestAuthentication(key, pack, sizeof(pack)); + if (len >= 1) { + PrintAndLog("Found a default password: %s || Pack: %02X %02X",sprint_hex(key, 4), pack[0], pack[1]); + } + if (!ul_auth_select( &card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack))) return -1; for (uint8_t i = 0; i < KEYS_PWD_COUNT; ++i ) { key = default_pwd_pack[i]; @@ -1203,14 +1247,13 @@ int usage_hf_mfu_dump(void) { PrintAndLog("NTAG 203, NTAG 210, NTAG 212, NTAG 213, NTAG 215, NTAG 216"); PrintAndLog("and saves binary dump into the file `filename.bin` or `cardUID.bin`"); PrintAndLog("It autodetects card type.\n"); - PrintAndLog("Usage: hf mfu dump k l n "); - PrintAndLog(" Options : "); + PrintAndLog("Usage: hf mfu dump k l n p q <#pages>"); + PrintAndLog(" Options :"); PrintAndLog(" k : (optional) key for authentication [UL-C 16bytes, EV1/NTAG 4bytes]"); PrintAndLog(" l : (optional) swap entered key's endianness"); PrintAndLog(" n : filename w/o .bin to save the dump as"); PrintAndLog(" p : starting Page number to manually set a page to start the dump at"); PrintAndLog(" q : number of Pages to manually set how many pages to dump"); - PrintAndLog(""); PrintAndLog(" sample : hf mfu dump"); PrintAndLog(" : hf mfu dump n myfile"); @@ -1248,14 +1291,31 @@ int usage_hf_mfu_wrbl(void) { } int usage_hf_mfu_eload(void) { - PrintAndLog("It loads emulator dump from the file `filename.eml`\n"); - PrintAndLog("Usage: hf mfu eload t i \n"); - PrintAndLog(" Options:"); - PrintAndLog(" t : Tag memorysize/type"); - PrintAndLog(" i : file name w/o `.eml`"); + PrintAndLog("It loads emul dump from the file `filename.eml`"); + PrintAndLog("Hint: See script dumptoemul-mfu.lua to convert the .bin to the eml"); + PrintAndLog("Usage: hf mfu eload u [numblocks]"); + PrintAndLog(" Options:"); + PrintAndLog(" h : this help"); + PrintAndLog(" u : UL (required)"); + PrintAndLog(" [filename] : without `.eml` (required)"); + PrintAndLog(" numblocks : number of blocks to load from eml file (optional)"); PrintAndLog(""); - PrintAndLog(" sample : hf mfu eload filename"); - PrintAndLog(" : hf mfu eload 4 filename"); + PrintAndLog(" sample: hf mfu eload u filename"); + PrintAndLog(" hf mfu eload u filename 57"); + return 0; +} + +int usage_hf_mfu_sim(void) { + PrintAndLog("\nEmulating Ultralight tag from emulator memory\n"); + PrintAndLog("\nBe sure to load the emulator memory first!\n"); + PrintAndLog("Usage: hf mfu sim t 7 u "); + PrintAndLog(" Options:"); + PrintAndLog(" h : this help"); + PrintAndLog(" t 7 : 7 = NTAG or Ultralight sim (required)"); + PrintAndLog(" u : 4 or 7 byte UID (optional)"); + PrintAndLog("\n sample : hf mfu sim t 7"); + PrintAndLog(" : hf mfu sim t 7 u 1122344556677\n"); + return 0; } @@ -1300,8 +1360,16 @@ int usage_hf_mfu_gendiverse(void){ return 0; } -// +int usage_hf_mfu_pwdgen(void){ + PrintAndLog("Usage: hf mfu pwdgen "); + PrintAndLog(""); + PrintAndLog("sample: hf mfu pwdgen 11223344556677"); + PrintAndLog(""); + return 0; +} +#define DUMP_PREFIX_LENGTH 48 +// // Mifare Ultralight / Ultralight-C / Ultralight-EV1 // Read and Dump Card Contents, using auto detection of tag size. int CmdHF14AMfUDump(const char *Cmd){ @@ -1323,6 +1391,7 @@ int CmdHF14AMfUDump(const char *Cmd){ uint8_t dataLen = 0; uint8_t cmdp = 0; uint8_t authenticationkey[16] = {0x00}; + memset(authenticationkey, 0x00, sizeof(authenticationkey)); uint8_t *authKeyPtr = authenticationkey; size_t fileNlen = 0; bool errors = false; @@ -1364,7 +1433,7 @@ int CmdHF14AMfUDump(const char *Cmd){ cmdp += 2; break; case 'p': - case 'P': + case 'P': //set start page startPage = param_get8(Cmd, cmdp+1); manualPages = true; cmdp += 2; @@ -1386,6 +1455,7 @@ int CmdHF14AMfUDump(const char *Cmd){ //Validations if(errors) return usage_hf_mfu_dump(); + //if we entered a key in little endian and set the swapEndian switch - switch it... if (swapEndian && hasAuthKey) authKeyPtr = SwapEndian64(authenticationkey, dataLen, (dataLen == 16) ? 8 : 4); @@ -1452,8 +1522,51 @@ int CmdHF14AMfUDump(const char *Cmd){ } } - // add keys to block dump + uint8_t get_pack[] = {0,0}; + iso14a_card_select_t card; + uint8_t dump_file_data[1024+DUMP_PREFIX_LENGTH] = {0x00}; + uint8_t get_version[] = {0,0,0,0,0,0,0,0,0}; + uint8_t get_tearing[] = {0,0,0}; + uint8_t get_counter[] = {0,0,0}; + uint8_t dummy_pack[] = {0,0}; + uint8_t get_signature[32]; + memset( get_signature, 0, sizeof(get_signature) ); + + // not ul_c and not std ul then attempt to get deeper info + if (!(tagtype & UL_C || tagtype & UL)) { + //attempt to read pack + if (!ul_auth_select( &card, tagtype, true, authKeyPtr, get_pack, sizeof(get_pack))) { + //reset pack + get_pack[0]=0; + get_pack[1]=0; + } + ul_switch_off_field(); + // add pack to block read + memcpy(data + (Pages*4) - 4, get_pack, sizeof(get_pack)); + if ( hasAuthKey ) + ul_auth_select( &card, tagtype, hasAuthKey, authKeyPtr, dummy_pack, sizeof(dummy_pack)); + else + ul_select(&card); + + ulev1_getVersion( get_version, sizeof(get_version) ); + for ( uint8_t i = 0; i<3; ++i) { + ulev1_readTearing(i, get_tearing+i, 1); + ulev1_readCounter(i, get_counter, sizeof(get_counter) ); + } + ul_switch_off_field(); + if ( hasAuthKey ) + ul_auth_select( &card, tagtype, hasAuthKey, authKeyPtr, dummy_pack, sizeof(dummy_pack)); + else + ul_select(&card); + ulev1_readSignature( get_signature, sizeof(get_signature)); + ul_switch_off_field(); + } + + // format and add keys to block dump output if (hasAuthKey) { + // if we didn't swapendian before - do it now for the sprint_hex call + // NOTE: default entry is bigendian (unless swapped), sprint_hex outputs little endian + // need to swap to keep it the same if (!swapEndian){ authKeyPtr = SwapEndian64(authenticationkey, dataLen, (dataLen == 16) ? 8 : 4); } else { @@ -1468,11 +1581,40 @@ int CmdHF14AMfUDump(const char *Cmd){ } } + //add *special* blocks to dump + //get version + memcpy(dump_file_data, get_version, sizeof(get_version)); + //tearing + memcpy(dump_file_data+10, get_tearing, sizeof(get_tearing)); + //pack + memcpy(dump_file_data+13, get_pack, sizeof(get_pack)); + //signature + memcpy(dump_file_data+16, get_signature, sizeof(get_signature)); + //add regular block read data to dump + memcpy(dump_file_data+DUMP_PREFIX_LENGTH, data, Pages*4); + + PrintAndLog("\n*Special* block data:"); + PrintAndLog("\nDataType| Data | | Ascii"); + PrintAndLog("---------------------------------"); + PrintAndLog("GetVer-1| %s| | %.4s", sprint_hex(dump_file_data, 4), dump_file_data); + PrintAndLog("GetVer-2| %s| | %.4s", sprint_hex(dump_file_data+4, 4), dump_file_data+4); + PrintAndLog("TBD | 00 00 | | "); + PrintAndLog("Tearing | %s| | %.3s", sprint_hex(dump_file_data+10, 3), dump_file_data+10); + PrintAndLog("Pack | %s | | %.2s", sprint_hex(dump_file_data+13, 2), dump_file_data+13); + PrintAndLog("TBD | 00 | | "); + PrintAndLog("Sig-1 | %s| | %.4s", sprint_hex(dump_file_data+16, 4), dump_file_data+16); + PrintAndLog("Sig-2 | %s| | %.4s", sprint_hex(dump_file_data+20, 4), dump_file_data+20); + PrintAndLog("Sig-3 | %s| | %.4s", sprint_hex(dump_file_data+24, 4), dump_file_data+24); + PrintAndLog("Sig-4 | %s| | %.4s", sprint_hex(dump_file_data+28, 4), dump_file_data+28); + PrintAndLog("Sig-5 | %s| | %.4s", sprint_hex(dump_file_data+32, 4), dump_file_data+32); + PrintAndLog("Sig-6 | %s| | %.4s", sprint_hex(dump_file_data+36, 4), dump_file_data+36); + PrintAndLog("Sig-7 | %s| | %.4s", sprint_hex(dump_file_data+40, 4), dump_file_data+40); + PrintAndLog("Sig-8 | %s| | %.4s", sprint_hex(dump_file_data+44, 4), dump_file_data+44); PrintAndLog("\nBlock# | Data |lck| Ascii"); PrintAndLog("---------------------------------"); for (i = 0; i < Pages; ++i) { if ( i < 3 ) { - PrintAndLog("%02d/0x%02X | %s| | ", i+startPage, i+startPage, sprint_hex(data + i * 4, 4)); + PrintAndLog("%02d/0x%02X | %s| | %.4s", i+startPage, i+startPage, sprint_hex(data + i * 4, 4), data + i * 4 ); continue; } switch(i){ @@ -1536,10 +1678,10 @@ int CmdHF14AMfUDump(const char *Cmd){ PrintAndLog("Could not create file name %s", filename); return 1; } - fwrite( data, 1, Pages*4, fout ); + fwrite( dump_file_data, 1, Pages*4 + DUMP_PREFIX_LENGTH, fout ); fclose(fout); - PrintAndLog("Dumped %d pages, wrote %d bytes to %s", Pages, Pages*4, filename); + PrintAndLog("Dumped %d pages, wrote %d bytes to %s", Pages+(DUMP_PREFIX_LENGTH/4), Pages*4 + DUMP_PREFIX_LENGTH, filename); return 0; } @@ -1547,7 +1689,6 @@ int CmdHF14AMfUDump(const char *Cmd){ // Ultralight C Methods //------------------------------------------------------------------------------- - // // Ultralight C Authentication Demo {currently uses hard-coded key} // @@ -1561,7 +1702,7 @@ int CmdHF14AMfucAuth(const char *Cmd){ //Change key to user defined one if (cmdp == 'k' || cmdp == 'K'){ keyNo = param_get8(Cmd, 1); - if(keyNo > KEYS_3DES_COUNT) + if(keyNo >= KEYS_3DES_COUNT) errors = true; } @@ -1697,14 +1838,13 @@ int CmdHF14AMfucSetPwd(const char *Cmd){ UsbCommand resp; if (WaitForResponseTimeout(CMD_ACK,&resp,1500) ) { - if ( (resp.arg[0] & 0xff) == 1) + if ( (resp.arg[0] & 0xff) == 1) { PrintAndLog("Ultralight-C new password: %s", sprint_hex(pwd,16)); - else{ + } else { PrintAndLog("Failed writing at block %d", resp.arg[1] & 0xff); return 1; } - } - else { + } else { PrintAndLog("command execution time out"); return 1; } @@ -1720,6 +1860,7 @@ int CmdHF14AMfucSetUid(const char *Cmd){ UsbCommand resp; uint8_t uid[7] = {0x00}; char cmdp = param_getchar(Cmd, 0); + if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_hf_mfu_ucsetuid(); if (param_gethex(Cmd, 0, uid, 14)) { @@ -1787,7 +1928,6 @@ int CmdHF14AMfucSetUid(const char *Cmd){ int CmdHF14AMfuGenDiverseKeys(const char *Cmd){ uint8_t uid[4]; - char cmdp = param_getchar(Cmd, 0); if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_hf_mfu_gendiverse(); @@ -1873,119 +2013,56 @@ int CmdHF14AMfuGenDiverseKeys(const char *Cmd){ return 0; } -// static void GenerateUIDe( uint8_t *uid, uint8_t len){ - // for (int i=0; i FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4; +int CmdHF14AMfUSim(const char *Cmd) { + char ctmp = param_getchar(Cmd, 0); + if ( ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) return usage_hf_mfu_sim(); + return CmdHF14ASim(Cmd); +} - fnameptr += len; +int CmdHF14AMfuPwdGen(const char *Cmd){ + uint8_t uid[7] = {0x00}; + char cmdp = param_getchar(Cmd, 0); + if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_hf_mfu_pwdgen(); - sprintf(fnameptr, ".eml"); + if (param_gethex(Cmd, 0, uid, 14)) return usage_hf_mfu_pwdgen(); - // open file - f = fopen(filename, "r"); - if (f == NULL) { - PrintAndLog("File %s not found or locked", filename); - return 1; - } - - blockNum = 0; - while(!feof(f)){ - memset(buf, 0, sizeof(buf)); - - if (fgets(buf, sizeof(buf), f) == NULL) { - - if (blockNum >= numBlocks) break; - - PrintAndLog("File reading error."); - fclose(f); - return 2; - } - - if (strlen(buf) < 32){ - if(strlen(buf) && feof(f)) - break; - PrintAndLog("File content error. Block data must include 32 HEX symbols"); - fclose(f); - return 2; - } - - for (i = 0; i < 32; i += 2) { - sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]); - } - - if (mfEmlSetMem(buf8, blockNum, 1)) { - PrintAndLog("Cant set emul block: %3d", blockNum); - fclose(f); - return 3; - } - printf("."); - blockNum++; - - if (blockNum >= numBlocks) break; - } - fclose(f); - printf("\n"); - - if ((blockNum != numBlocks)) { - PrintAndLog("File content error. Got %d must be %d blocks.",blockNum, numBlocks); - return 4; - } - PrintAndLog("Loaded %d blocks from file: %s", blockNum, filename); - */ + PrintAndLog(" algo | pwd | pack"); + PrintAndLog("------+----------+-----"); + PrintAndLog(" EV1 | %08X | %04X", ul_ev1_pwdgenA(uid), ul_ev1_packgenA(uid)); + PrintAndLog(" Ami | %08X | %04X", ul_ev1_pwdgenB(uid), ul_ev1_packgenB(uid)); + PrintAndLog(" LD | %08X | %04X", ul_ev1_pwdgenC(uid), ul_ev1_packgenC(uid)); return 0; } - +//------------------------------------ +// Menu Stuff +//------------------------------------ static command_t CommandTable[] = { {"help", CmdHelp, 1, "This help"}, {"dbg", CmdHF14AMfDbg, 0, "Set default debug mode"}, {"info", CmdHF14AMfUInfo, 0, "Tag information"}, {"dump", CmdHF14AMfUDump, 0, "Dump Ultralight / Ultralight-C / NTAG tag to binary file"}, + {"eload", CmdHF14AMfUeLoad, 0, "load Ultralight .eml dump file into emulator memory"}, {"rdbl", CmdHF14AMfURdBl, 0, "Read block"}, {"wrbl", CmdHF14AMfUWrBl, 0, "Write block"}, - {"eload", CmdHF14AMfuELoad, 0, " Load from file emulator dump"}, {"cauth", CmdHF14AMfucAuth, 0, "Authentication - Ultralight C"}, - {"setpwd", CmdHF14AMfucSetPwd, 1, "Set 3des password - Ultralight-C"}, - {"setuid", CmdHF14AMfucSetUid, 1, "Set UID - MAGIC tags only"}, + {"setpwd", CmdHF14AMfucSetPwd, 0, "Set 3des password - Ultralight-C"}, + {"setuid", CmdHF14AMfucSetUid, 0, "Set UID - MAGIC tags only"}, + {"sim", CmdHF14AMfUSim, 0, "Simulate Ultralight from emulator memory"}, {"gen", CmdHF14AMfuGenDiverseKeys , 1, "Generate 3des mifare diversified keys"}, + {"pwdgen", CmdHF14AMfuPwdGen, 1, "Generate pwd from known algos"}, {NULL, NULL, 0, NULL} }; int CmdHFMFUltra(const char *Cmd){ - WaitForResponseTimeout(CMD_ACK,NULL,100); + clearCommandBuffer(); + //WaitForResponseTimeout(CMD_ACK,NULL,100); CmdsParse(CommandTable, Cmd); return 0; }