X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/760157f50bbb2c9b4f2ab01a74d76d062fc418ba..165b92dc3558e43e61c3625e748e15cb270e7ab3:/client/cmdhfmf.c

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index c25ba32b..04998e18 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -24,17 +24,20 @@ int usage_hf14_mifare(void){
 	return 0;
 }
 int usage_hf14_mf1ksim(void){
-	PrintAndLog("Usage:  hf mf sim  [h] u <uid (8,14,20 hex symbols)> n <numreads> i x");
+	PrintAndLog("Usage:  hf mf sim [h] u <uid> n <numreads> [i] [x] [e] [v]");
 	PrintAndLog("options:");
 	PrintAndLog("      h    this help");
 	PrintAndLog("      u    (Optional) UID 4,7 or 10bytes. If not specified, the UID 4b from emulator memory will be used");
 	PrintAndLog("      n    (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");
 	PrintAndLog("      i    (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");
-	PrintAndLog("      x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");
+	PrintAndLog("      x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a reader");
+	PrintAndLog("      e    (Optional) Fill simulator keys from found keys");
+	PrintAndLog("      v    (Optional) Verbose");
 	PrintAndLog("samples:");
 	PrintAndLog("           hf mf sim u 0a0a0a0a");
 	PrintAndLog("           hf mf sim u 11223344556677");
 	PrintAndLog("           hf mf sim u 112233445566778899AA");	
+	PrintAndLog("           hf mf sim u 11223344 i x");	
 	return 0;
 }
 int usage_hf14_dbg(void){
@@ -212,25 +215,22 @@ start:
 		}
 	}	
 	printf("\n");
+	// error
+	if (isOK != 1) return 1;
 	
-	// par == 0,  and -4
-	if (isOK == -4 && par_list == 0) {
+	if (par_list == 0 && ks_list != 0) {
 		// this special attack when parities is zero, uses checkkeys. Which now with block/keytype option also needs. 
 		// but it uses 0|1 instead of 0x60|0x61...
 		if (nonce2key_ex(blockNo, keytype - 0x60 , uid, nt, nr, ks_list, &r_key) ){
-			PrintAndLog("Key not found (lfsr_common_prefix list is null).");	
-			PrintAndLog("Failing is expected to happen in 25%% of all cases. Trying again with a different reader nonce...");
+			PrintAndLog("Trying again with a different reader nonce...");
 			c.arg[0] = false;
 			goto start;
 		} else {
-			PrintAndLog("Found valid key: %012"llx" \n", r_key);
+			PrintAndLog("Found valid key: %012" PRIx64 " \n", r_key);
 			goto END;
 		}
 	}
-	
-	// error
-	if (isOK != 1) return 1;
-	
+
 	// execute original function from util nonce2key
 	if (nonce2key(uid, nt, nr, par_list, ks_list, &r_key)) {
 		isOK = 2;
@@ -246,11 +246,10 @@ start:
 		uint64_t key64 = 0;
 		int res = mfCheckKeys(blockNo, keytype - 0x60 , false, 1, keyblock, &key64);
 		if ( res > 0 ) {
-			PrintAndLog("Candidate Key found (%012"llx")", r_key);	
-			PrintAndLog("Failing is expected to happen. Trying again ...");
+			PrintAndLog("Candidate Key found (%012" PRIx64 ") - Test authentication failed. [%d] Restarting darkside attack", r_key, res);	
 			goto start;
 		}
-		PrintAndLog("Found valid key: %012"llx" \n", r_key);
+		PrintAndLog("Found valid key: %012" PRIx64 " \n", r_key);
 	}
 END:
 	t1 = clock() - t1;
@@ -314,9 +313,7 @@ int CmdHF14AMfRdBl(const char *Cmd) {
 	uint8_t blockNo = 0;
 	uint8_t keyType = 0;
 	uint8_t key[6] = {0, 0, 0, 0, 0, 0};
-	
-	char cmdp	= 0x00;
-
+	char cmdp = 0x00;
 
 	if (strlen(Cmd)<3) {
 		PrintAndLog("Usage:  hf mf rdbl    <block number> <key A/B> <key (12 hex symbols)>");
@@ -473,7 +470,7 @@ int CmdHF14AMfDump(const char *Cmd) {
 	size_t bytes_read;
 	for (sectorNo=0; sectorNo<numSectors; sectorNo++) {
 		bytes_read = fread( keyA[sectorNo], 1, 6, fin );
-		if ( bytes_read == 0) {
+		if ( bytes_read != 6) {
 			PrintAndLog("File reading error.");
 			fclose(fin);
 			return 2;
@@ -483,7 +480,7 @@ int CmdHF14AMfDump(const char *Cmd) {
 	// Read keys B from file
 	for (sectorNo=0; sectorNo<numSectors; sectorNo++) {
 		bytes_read = fread( keyB[sectorNo], 1, 6, fin );
-		if ( bytes_read == 0) {
+		if ( bytes_read != 6) {
 			PrintAndLog("File reading error.");
 			fclose(fin);
 			return 2;
@@ -491,7 +488,7 @@ int CmdHF14AMfDump(const char *Cmd) {
 	}
 	
 	fclose(fin);
-
+			
 	PrintAndLog("|-----------------------------------------|");
 	PrintAndLog("|------ Reading sector access bits...-----|");
 	PrintAndLog("|-----------------------------------------|");
@@ -597,6 +594,7 @@ int CmdHF14AMfDump(const char *Cmd) {
 		uint16_t numblocks = FirstBlockOfSector(numSectors - 1) + NumBlocksPerSector(numSectors - 1);
 		fwrite(carddata, 1, 16*numblocks, fout);
 		fclose(fout);
+		fout = NULL;		
 		PrintAndLog("Dumped %d blocks (%d bytes) to file dumpdata.bin", numblocks, 16*numblocks);
 	}
 		
@@ -642,7 +640,7 @@ int CmdHF14AMfRestore(const char *Cmd) {
 	size_t bytes_read;
 	for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {
 		bytes_read = fread( keyA[sectorNo], 1, 6, fkeys );
-		if ( bytes_read == 0) {
+		if ( bytes_read != 6) {
 			PrintAndLog("File reading error (dumpkeys.bin).");
 			fclose(fkeys);
 			return 2;
@@ -651,7 +649,7 @@ int CmdHF14AMfRestore(const char *Cmd) {
 
 	for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {
 		bytes_read = fread( keyB[sectorNo], 1, 6, fkeys );
-		if ( bytes_read == 0) {
+		if ( bytes_read != 6) {
 			PrintAndLog("File reading error (dumpkeys.bin).");
 			fclose(fkeys);
 			return 2;
@@ -671,9 +669,10 @@ int CmdHF14AMfRestore(const char *Cmd) {
 			UsbCommand c = {CMD_MIFARE_WRITEBL, {FirstBlockOfSector(sectorNo) + blockNo, keyType, 0}};
 			memcpy(c.d.asBytes, key, 6);			
 			bytes_read = fread(bldata, 1, 16, fdump);
-			if ( bytes_read == 0) {
+			if ( bytes_read != 16) {
 				PrintAndLog("File reading error (dumpdata.bin).");
 				fclose(fdump);
+				fdump = NULL;				
 				return 2;
 			}
 					
@@ -784,7 +783,7 @@ int CmdHF14AMfNested(const char *Cmd) {
 		switch (isOK) {
 			case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;
 			case -2 : PrintAndLog("Button pressed. Aborted.\n"); break;
-			case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (its random number generator is not predictable).\n"); break;
+			case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (random number generator is not predictable).\n"); break;
 			case -4 : PrintAndLog("No valid key found"); break;
 			case -5 : 
 				key64 = bytes_to_num(keyBlock, 6);
@@ -1051,7 +1050,8 @@ int CmdHF14AMfNestedHard(const char *Cmd) {
 			slow ? "Yes" : "No",
 			tests);
 
-	int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key?trgkey:NULL, nonce_file_read, nonce_file_write, slow, tests);
+	uint64_t foundkey = 0;
+	int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key ? trgkey : NULL, nonce_file_read, nonce_file_write, slow, tests, &foundkey);
 
 	if (isOK) {
 		switch (isOK) {
@@ -1199,7 +1199,7 @@ int CmdHF14AMfChk(const char *Cmd) {
 					}
 					memset(keyBlock + 6 * keycnt, 0, 6);
 					num_to_bytes(strtoll(buf, NULL, 16), 6, keyBlock + 6*keycnt);
-					PrintAndLog("check key[%2d] %012"llx, keycnt, bytes_to_num(keyBlock + 6*keycnt, 6));
+					PrintAndLog("check key[%2d] %012" PRIx64, keycnt, bytes_to_num(keyBlock + 6*keycnt, 6));
 					keycnt++;
 					memset(buf, 0, sizeof(buf));
 				}
@@ -1353,18 +1353,16 @@ int CmdHF14AMfChk(const char *Cmd) {
 	PrintAndLog("");
 	return 0;
 }
-#define ATTACK_KEY_COUNT 8
+
 sector *k_sector = NULL;
 uint8_t k_sectorsCount = 16;
-void readerAttack(nonces_t data[], bool setEmulatorMem) {
+static void emptySectorTable(){
 
 	// initialize storage for found keys
 	if (k_sector == NULL)
 		k_sector = calloc(k_sectorsCount, sizeof(sector));
 	if (k_sector == NULL) 
 		return;
-
-	uint64_t key = 0;
 		
 	// empty e_sector
 	for(int i = 0; i < k_sectorsCount; ++i){
@@ -1373,42 +1371,47 @@ void readerAttack(nonces_t data[], bool setEmulatorMem) {
 		k_sector[i].foundKey[0] = FALSE;
 		k_sector[i].foundKey[1] = FALSE;
 	}
+}
+void showSectorTable(){
+	if (k_sector != NULL) {
+		printKeyTable(k_sectorsCount, k_sector);
+		free(k_sector);
+		k_sector = NULL;
+	}
+}
+void readerAttack(nonces_t data, bool setEmulatorMem, bool verbose) {
 
-	printf("enter reader attack\n");
-	for (uint8_t i = 0; i < ATTACK_KEY_COUNT; ++i) {
-		if (data[i].ar2 > 0) {
-			
-			if (tryMfk32(data[i], &key)) {
-				PrintAndLog("Found Key%s for sector %02d: [%012"llx"]"
-					, (data[i].keytype) ? "B" : "A"
-					, data[i].sector
-					, key
-				);
+	uint64_t key = 0;	
+	bool success = FALSE;
+	
+	if (k_sector == NULL)
+		emptySectorTable();
 
-				k_sector[i].Key[data[i].keytype] = key;
-				k_sector[i].foundKey[data[i].keytype] = TRUE;
-				
-				//set emulator memory for keys
-				if (setEmulatorMem) {
-					uint8_t	memBlock[16] = {0,0,0,0,0,0, 0xff, 0x0F, 0x80, 0x69, 0,0,0,0,0,0};
-					num_to_bytes( k_sector[i].Key[0], 6, memBlock);
-					num_to_bytes( k_sector[i].Key[1], 6, memBlock+10);
-					mfEmlSetMem( memBlock, i*4 + 3, 1);
-					PrintAndLog("Setting Emulator Memory Block %02d: [%s]"
-						, i*4 + 3
-						, sprint_hex( memBlock, sizeof(memBlock))
-						);
-				}
-				break;
-			}
-			//moebius attack			
-			// if (tryMfk32_moebius(data[i+ATTACK_KEY_COUNT], &key)) {
-				// PrintAndLog("M-Found Key%s for sector %02d: [%012"llx"]"
-					// ,(data[i+ATTACK_KEY_COUNT].keytype) ? "B" : "A"
-					// , data[i+ATTACK_KEY_COUNT].sector
-					// , key
-				// );
-			// }
+	success = tryMfk32_moebius(data, &key, verbose);
+	if (success) {
+		uint8_t sector = data.sector;
+		uint8_t keytype = data.keytype;
+
+		PrintAndLog("Reader is trying authenticate with: Key %s, sector %02d: [%012" PRIx64 "]"
+			, keytype ? "B" : "A"
+			, sector
+			, key
+		);
+
+		k_sector[sector].Key[keytype] = key;
+		k_sector[sector].foundKey[keytype] = TRUE;
+
+		//set emulator memory for keys
+		if (setEmulatorMem) {
+			uint8_t	memBlock[16] = {0,0,0,0,0,0, 0xff, 0x0F, 0x80, 0x69, 0,0,0,0,0,0};
+			num_to_bytes( k_sector[sector].Key[0], 6, memBlock);
+			num_to_bytes( k_sector[sector].Key[1], 6, memBlock+10);
+			//iceman,  guessing this will not work so well for 4K tags.
+			PrintAndLog("Setting Emulator Memory Block %02d: [%s]"
+				, (sector*4) + 3
+				, sprint_hex( memBlock, sizeof(memBlock))
+				);
+			mfEmlSetMem( memBlock, (sector*4) + 3, 1);
 		}
 	}
 }
@@ -1418,16 +1421,18 @@ int CmdHF14AMf1kSim(const char *Cmd) {
 	uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
 	uint8_t exitAfterNReads = 0;
 	uint8_t flags = (FLAG_UID_IN_EMUL | FLAG_4B_UID_IN_DATA);
-	int uidlen = 0;	
-	bool setEmulatorMem = false;
+	int uidlen = 0;
 	uint8_t cmdp = 0;
-	bool errors = false;
-
+	bool errors = FALSE;
+	bool verbose = FALSE;
+	bool setEmulatorMem = FALSE;
+	nonces_t data[1];
+		
 	while(param_getchar(Cmd, cmdp) != 0x00) {
 		switch(param_getchar(Cmd, cmdp)) {
 		case 'e':
 		case 'E':
-			setEmulatorMem = true;
+			setEmulatorMem = TRUE;
 			cmdp++;
 			break;
 		case 'h':
@@ -1452,7 +1457,12 @@ int CmdHF14AMf1kSim(const char *Cmd) {
 				case  8: flags = FLAG_4B_UID_IN_DATA; break;
 				default: return usage_hf14_mf1ksim();
 			}
-			cmdp +=2;
+			cmdp += 2;
+			break;
+		case 'v':
+		case 'V':
+			verbose = TRUE;
+			cmdp++;
 			break;
 		case 'x':
 		case 'X':
@@ -1461,7 +1471,7 @@ int CmdHF14AMf1kSim(const char *Cmd) {
 			break;
 		default:
 			PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-			errors = true;
+			errors = TRUE;
 			break;
 		}
 		if(errors) break;
@@ -1479,27 +1489,20 @@ int CmdHF14AMf1kSim(const char *Cmd) {
 	memcpy(c.d.asBytes, uid, sizeof(uid));
 	clearCommandBuffer();
 	SendCommand(&c);
+	UsbCommand resp;		
 
-	if(flags & FLAG_INTERACTIVE) {		
+	if(flags & FLAG_INTERACTIVE) {
 		PrintAndLog("Press pm3-button or send another cmd to abort simulation");
 
-		nonces_t data[ATTACK_KEY_COUNT*2];
-		UsbCommand resp;		
-
 		while( !ukbhit() ){
 			if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500) ) continue;
-
 			if ( !(flags & FLAG_NR_AR_ATTACK) ) break;
 			if ( (resp.arg[0] & 0xffff) != CMD_SIMULATE_MIFARE_CARD ) break;
 
-			memcpy( data, resp.d.asBytes, sizeof(data) );			
-			readerAttack(data, setEmulatorMem);
-		}
-		
-		if (k_sector != NULL) {
-			printKeyTable(k_sectorsCount, k_sector );
-			free(k_sector);
+			memcpy(data, resp.d.asBytes, sizeof(data));
+			readerAttack(data[0], setEmulatorMem, verbose);
 		}
+		showSectorTable();
 	}
 	return 0;
 }
@@ -1575,7 +1578,7 @@ int CmdHF14AMfSniff(const char *Cmd){
 
 			if (res == 1) {								// there is (more) data to be transferred
 				if (pckNum == 0) {						// first packet, (re)allocate necessary buffer
-					if (traceLen > bufsize) {
+					if (traceLen > bufsize || buf == NULL) {
 						uint8_t *p;
 						if (buf == NULL)				// not yet allocated
 							p = malloc(traceLen);
@@ -1696,7 +1699,7 @@ int CmdHF14AMfKeyBrute(const char *Cmd) {
 	time(&start);
 	
 	if (mfKeyBrute( blockNo, keytype, key, &foundkey))
-		PrintAndLog("Found valid key: %012"llx" \n", foundkey);
+		PrintAndLog("Found valid key: %012" PRIx64 " \n", foundkey);
 	else
 		PrintAndLog("Key not found");
 	
@@ -1714,7 +1717,7 @@ void printKeyTable( uint8_t sectorscnt, sector *e_sector ){
 	PrintAndLog("|sec|key A           |res|key B           |res|");
 	PrintAndLog("|---|----------------|---|----------------|---|");
 	for (uint8_t i = 0; i < sectorscnt; ++i) {
-		PrintAndLog("|%03d|  %012"llx"  | %d |  %012"llx"  | %d |", i,
+		PrintAndLog("|%03d|  %012" PRIx64 "  | %d |  %012" PRIx64 "  | %d |", i,
 			e_sector[i].Key[0], e_sector[i].foundKey[0], 
 			e_sector[i].Key[1], e_sector[i].foundKey[1]
 		);
@@ -1763,7 +1766,6 @@ int CmdHF14AMfESet(const char *Cmd)
 {
 	uint8_t memBlock[16];
 	uint8_t blockNo = 0;
-
 	memset(memBlock, 0x00, sizeof(memBlock));
 
 	if (strlen(Cmd) < 3 || param_getchar(Cmd, 0) == 'h') {
@@ -2045,7 +2047,7 @@ int CmdHF14AMfEKeyPrn(const char *Cmd)
 		}
 		keyA = bytes_to_num(data, 6);
 		keyB = bytes_to_num(data + 10, 6);
-		PrintAndLog("|%03d|  %012"llx"  |  %012"llx"  |", i, keyA, keyB);
+		PrintAndLog("|%03d|  %012" PRIx64 "  |  %012" PRIx64 "  |", i, keyA, keyB);
 	}
 	PrintAndLog("|---|----------------|----------------|");
 	
@@ -2449,9 +2451,9 @@ static command_t CommandTable[] = {
 	{"dump",		CmdHF14AMfDump,			0, "Dump MIFARE classic tag to binary file"},
 	{"restore",		CmdHF14AMfRestore,		0, "Restore MIFARE classic binary file to BLANK tag"},
 	{"wrbl",		CmdHF14AMfWrBl,			0, "Write MIFARE classic block"},
-	{"chk",			CmdHF14AMfChk,			0, "Test block keys"},
-	{"mifare",		CmdHF14AMifare,			0, "Read parity error messages."},
-	{"nested",		CmdHF14AMfNested,		0, "Test nested authentication"},
+	{"chk",			CmdHF14AMfChk,			0, "Check keys"},
+	{"mifare",		CmdHF14AMifare,			0, "Darkside attack. read parity error messages."},
+	{"nested",		CmdHF14AMfNested,		0, "Nested attack. Test nested authentication"},
 	{"hardnested", 	CmdHF14AMfNestedHard, 	0, "Nested attack for hardened Mifare cards"},
 	{"keybrute",	CmdHF14AMfKeyBrute,		0, "J_Run's 2nd phase of multiple sector nested authentication key recovery"},
 	{"sniff",		CmdHF14AMfSniff,		0, "Sniff card-reader communication"},