X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/6067df30c59dc58dd4bb0bb922fd28087d3f58f9..7dcd37fc2e4b0deeda46c22b1604b1e089dff43e:/client/cmdhfmf.c?ds=sidebyside

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 65c9dcb7..0ea171af 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -31,6 +31,8 @@ int usage_hf14_mf1ksim(void){
 	PrintAndLog("      n    (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");
 	PrintAndLog("      i    (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");
 	PrintAndLog("      x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");
+	PrintAndLog("      e    (Optional) Fill simulator keys from what we crack");
+	PrintAndLog("      v    (Optional) Show maths used for cracking reader. Useful for debugging.");
 	PrintAndLog("samples:");
 	PrintAndLog("           hf mf sim u 0a0a0a0a");
 	PrintAndLog("           hf mf sim u 11223344556677");
@@ -212,14 +214,14 @@ start:
 		}
 	}	
 	printf("\n");
+	// error
+	if (isOK != 1) return 1;
 	
-	// par == 0,  and -4
-	if (isOK == -4 && par_list == 0) {
+	if (par_list == 0 && ks_list != 0) {
 		// this special attack when parities is zero, uses checkkeys. Which now with block/keytype option also needs. 
 		// but it uses 0|1 instead of 0x60|0x61...
 		if (nonce2key_ex(blockNo, keytype - 0x60 , uid, nt, nr, ks_list, &r_key) ){
-			PrintAndLog("Key not found (lfsr_common_prefix list is null).");	
-			PrintAndLog("Failing is expected to happen in 25%% of all cases. Trying again with a different reader nonce...");
+			PrintAndLog("Trying again with a different reader nonce...");
 			c.arg[0] = false;
 			goto start;
 		} else {
@@ -227,10 +229,7 @@ start:
 			goto END;
 		}
 	}
-	
-	// error
-	if (isOK != 1) return 1;
-	
+
 	// execute original function from util nonce2key
 	if (nonce2key(uid, nt, nr, par_list, ks_list, &r_key)) {
 		isOK = 2;
@@ -239,6 +238,16 @@ start:
 		c.arg[0] = false;
 		goto start;
 	} else {
+		
+		// nonce2key found a candidate key.  Lets verify it.
+		uint8_t keyblock[] = {0,0,0,0,0,0};
+		num_to_bytes(r_key, 6, keyblock);
+		uint64_t key64 = 0;
+		int res = mfCheckKeys(blockNo, keytype - 0x60 , false, 1, keyblock, &key64);
+		if ( res > 0 ) {
+			PrintAndLog("Candidate Key found (%012"llx") - Test authentication failed. [%d] Restarting darkside attack", r_key, res);	
+			goto start;
+		}
 		PrintAndLog("Found valid key: %012"llx" \n", r_key);
 	}
 END:
@@ -465,6 +474,7 @@ int CmdHF14AMfDump(const char *Cmd) {
 		if ( bytes_read == 0) {
 			PrintAndLog("File reading error.");
 			fclose(fin);
+			fin = NULL;
 			return 2;
 		}
 	}
@@ -475,12 +485,14 @@ int CmdHF14AMfDump(const char *Cmd) {
 		if ( bytes_read == 0) {
 			PrintAndLog("File reading error.");
 			fclose(fin);
+			fin = NULL;
 			return 2;
 		}
 	}
 	
 	fclose(fin);
-
+	fin = NULL;
+			
 	PrintAndLog("|-----------------------------------------|");
 	PrintAndLog("|------ Reading sector access bits...-----|");
 	PrintAndLog("|-----------------------------------------|");
@@ -586,6 +598,7 @@ int CmdHF14AMfDump(const char *Cmd) {
 		uint16_t numblocks = FirstBlockOfSector(numSectors - 1) + NumBlocksPerSector(numSectors - 1);
 		fwrite(carddata, 1, 16*numblocks, fout);
 		fclose(fout);
+		fout = NULL;		
 		PrintAndLog("Dumped %d blocks (%d bytes) to file dumpdata.bin", numblocks, 16*numblocks);
 	}
 		
@@ -634,6 +647,7 @@ int CmdHF14AMfRestore(const char *Cmd) {
 		if ( bytes_read == 0) {
 			PrintAndLog("File reading error (dumpkeys.bin).");
 			fclose(fkeys);
+			fkeys = NULL;
 			return 2;
 		}
 	}
@@ -643,6 +657,7 @@ int CmdHF14AMfRestore(const char *Cmd) {
 		if ( bytes_read == 0) {
 			PrintAndLog("File reading error (dumpkeys.bin).");
 			fclose(fkeys);
+			fkeys = NULL;
 			return 2;
 		}
 	}
@@ -663,6 +678,7 @@ int CmdHF14AMfRestore(const char *Cmd) {
 			if ( bytes_read == 0) {
 				PrintAndLog("File reading error (dumpdata.bin).");
 				fclose(fdump);
+				fdump = NULL;				
 				return 2;
 			}
 					
@@ -698,6 +714,7 @@ int CmdHF14AMfRestore(const char *Cmd) {
 	}
 	
 	fclose(fdump);
+	fdump = NULL;	
 	return 0;
 }
 
@@ -1040,7 +1057,8 @@ int CmdHF14AMfNestedHard(const char *Cmd) {
 			slow ? "Yes" : "No",
 			tests);
 
-	int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key?trgkey:NULL, nonce_file_read, nonce_file_write, slow, tests);
+	uint64_t foundkey = 0;
+	int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key ? trgkey : NULL, nonce_file_read, nonce_file_write, slow, tests, &foundkey);
 
 	if (isOK) {
 		switch (isOK) {
@@ -1345,7 +1363,7 @@ int CmdHF14AMfChk(const char *Cmd) {
 #define ATTACK_KEY_COUNT 8
 sector *k_sector = NULL;
 uint8_t k_sectorsCount = 16;
-void readerAttack(nonces_t data[], bool setEmulatorMem) {
+void readerAttack(nonces_t data[], bool setEmulatorMem, bool verbose) {
 
 	// initialize storage for found keys
 	if (k_sector == NULL)
@@ -1366,8 +1384,10 @@ void readerAttack(nonces_t data[], bool setEmulatorMem) {
 	printf("enter reader attack\n");
 	for (uint8_t i = 0; i < ATTACK_KEY_COUNT; ++i) {
 		if (data[i].ar2 > 0) {
-			
-			if (tryMfk32(data[i], &key)) {
+
+			// We can probably skip this, mfkey32v2 is more reliable.
+#ifdef HFMF_TRYMFK32
+			if (tryMfk32(data[i], &key, verbose)) {
 				PrintAndLog("Found Key%s for sector %02d: [%012"llx"]"
 					, (data[i].keytype) ? "B" : "A"
 					, data[i].sector
@@ -1382,22 +1402,43 @@ void readerAttack(nonces_t data[], bool setEmulatorMem) {
 					uint8_t	memBlock[16] = {0,0,0,0,0,0, 0xff, 0x0F, 0x80, 0x69, 0,0,0,0,0,0};
 					num_to_bytes( k_sector[i].Key[0], 6, memBlock);
 					num_to_bytes( k_sector[i].Key[1], 6, memBlock+10);
-					mfEmlSetMem( memBlock, i*4 + 3, 1);
 					PrintAndLog("Setting Emulator Memory Block %02d: [%s]"
-						, i*4 + 3
+						, ((data[i].sector)*4) + 3
 						, sprint_hex( memBlock, sizeof(memBlock))
 						);
+					mfEmlSetMem( memBlock, ((data[i].sector)*4) + 3, 1);
 				}
-				break;
+				continue;
 			}
+#endif
 			//moebius attack			
-			// if (tryMfk32_moebius(data[i+ATTACK_KEY_COUNT], &key)) {
-				// PrintAndLog("M-Found Key%s for sector %02d: [%012"llx"]"
-					// ,(data[i+ATTACK_KEY_COUNT].keytype) ? "B" : "A"
-					// , data[i+ATTACK_KEY_COUNT].sector
-					// , key
-				// );
-			// }
+			if (tryMfk32_moebius(data[i+ATTACK_KEY_COUNT], &key, verbose)) {
+				uint8_t sectorNum = data[i+ATTACK_KEY_COUNT].sector;
+				uint8_t keyType = data[i+ATTACK_KEY_COUNT].keytype;
+
+				PrintAndLog("M-Found Key%s for sector %02d: [%012"llx"]"
+					, keyType ? "B" : "A"
+					, sectorNum
+					, key
+				);
+
+				k_sector[sectorNum].Key[keyType] = key;
+				k_sector[sectorNum].foundKey[keyType] = TRUE;
+
+				//set emulator memory for keys
+				if (setEmulatorMem) {
+					uint8_t	memBlock[16] = {0,0,0,0,0,0, 0xff, 0x0F, 0x80, 0x69, 0,0,0,0,0,0};
+					num_to_bytes( k_sector[sectorNum].Key[0], 6, memBlock);
+					num_to_bytes( k_sector[sectorNum].Key[1], 6, memBlock+10);
+					PrintAndLog("Setting Emulator Memory Block %02d: [%s]"
+						, (sectorNum*4) + 3
+						, sprint_hex( memBlock, sizeof(memBlock))
+						);
+					mfEmlSetMem( memBlock, (sectorNum*4) + 3, 1);
+				}
+				continue;
+			}
+
 		}
 	}
 }
@@ -1407,11 +1448,14 @@ int CmdHF14AMf1kSim(const char *Cmd) {
 	uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
 	uint8_t exitAfterNReads = 0;
 	uint8_t flags = (FLAG_UID_IN_EMUL | FLAG_4B_UID_IN_DATA);
-	int uidlen = 0;	
+	int uidlen = 0;
 	bool setEmulatorMem = false;
 	uint8_t cmdp = 0;
 	bool errors = false;
 
+	// If set to true, we should show our workings when doing NR_AR_ATTACK.
+	bool verbose = false;
+
 	while(param_getchar(Cmd, cmdp) != 0x00) {
 		switch(param_getchar(Cmd, cmdp)) {
 		case 'e':
@@ -1443,6 +1487,11 @@ int CmdHF14AMf1kSim(const char *Cmd) {
 			}
 			cmdp +=2;
 			break;
+		case 'v':
+		case 'V':
+			verbose = true;
+			cmdp++;
+			break;
 		case 'x':
 		case 'X':
 			flags |= FLAG_NR_AR_ATTACK;
@@ -1482,12 +1531,13 @@ int CmdHF14AMf1kSim(const char *Cmd) {
 			if ( (resp.arg[0] & 0xffff) != CMD_SIMULATE_MIFARE_CARD ) break;
 
 			memcpy( data, resp.d.asBytes, sizeof(data) );			
-			readerAttack(data, setEmulatorMem);
+			readerAttack(data, setEmulatorMem, verbose);
 		}
 		
 		if (k_sector != NULL) {
 			printKeyTable(k_sectorsCount, k_sector );
 			free(k_sector);
+			k_sector = NULL;
 		}
 	}
 	return 0;
@@ -2438,9 +2488,9 @@ static command_t CommandTable[] = {
 	{"dump",		CmdHF14AMfDump,			0, "Dump MIFARE classic tag to binary file"},
 	{"restore",		CmdHF14AMfRestore,		0, "Restore MIFARE classic binary file to BLANK tag"},
 	{"wrbl",		CmdHF14AMfWrBl,			0, "Write MIFARE classic block"},
-	{"chk",			CmdHF14AMfChk,			0, "Test block keys"},
-	{"mifare",		CmdHF14AMifare,			0, "Read parity error messages."},
-	{"nested",		CmdHF14AMfNested,		0, "Test nested authentication"},
+	{"chk",			CmdHF14AMfChk,			0, "Check keys"},
+	{"mifare",		CmdHF14AMifare,			0, "Darkside attack. read parity error messages."},
+	{"nested",		CmdHF14AMfNested,		0, "Nested attack. Test nested authentication"},
 	{"hardnested", 	CmdHF14AMfNestedHard, 	0, "Nested attack for hardened Mifare cards"},
 	{"keybrute",	CmdHF14AMfKeyBrute,		0, "J_Run's 2nd phase of multiple sector nested authentication key recovery"},
 	{"sniff",		CmdHF14AMfSniff,		0, "Sniff card-reader communication"},