X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/ae027818ace0f74d179a1f7656b5f044cf813ee7..0d2624a0cc13dbe34392da1f8495af6c64a84ddb:/client/cmdhfmf.c?ds=inline

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 5efb4a41..5bf3324a 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -29,7 +29,7 @@
 #include "hardnested/hardnested_bf_core.h"
 #include "cliparser/cliparser.h"
 #include "cmdhf14a.h"
-#include <polarssl/aes.h>
+#include "mifare4.h"
 
 #define NESTED_SECTOR_RETRY     10			// how often we try mfested() until we give up
 
@@ -141,12 +141,26 @@ int CmdHF14AMfRdBl(const char *Cmd)
 		uint8_t isOK  = resp.arg[0] & 0xff;
 		uint8_t *data = resp.d.asBytes;
 
-		if (isOK)
+		if (isOK) {
 			PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 16));
-		else
+		} else {
 			PrintAndLog("isOk:%02x", isOK);
+			return 1;
+		}
+
+		if (mfIsSectorTrailer(blockNo) && (data[6] || data[7] || data[8])) {
+			PrintAndLogEx(NORMAL, "Trailer decoded:");
+			int bln = mfFirstBlockOfSector(mfSectorNum(blockNo));
+			int blinc = (mfNumBlocksPerSector(mfSectorNum(blockNo)) > 4) ? 5 : 1;
+			for (int i = 0; i < 4; i++) {
+				PrintAndLogEx(NORMAL, "Access block %d%s: %s", bln, ((blinc > 1) && (i < 3) ? "+" : "") , mfGetAccessConditionsDesc(i, &data[6]));
+				bln += blinc;
+			}
+			PrintAndLogEx(NORMAL, "UserData: %s", sprint_hex_inrow(&data[9], 1));
+		}
 	} else {
 		PrintAndLog("Command execute timeout");
+		return 2;
 	}
 
   return 0;
@@ -201,6 +215,15 @@ int CmdHF14AMfRdSc(const char *Cmd)
 				PrintAndLog("data   : %s", sprint_hex(data + i * 16, 16));
 			}
 			PrintAndLog("trailer: %s", sprint_hex(data + (sectorNo<32?3:15) * 16, 16));
+			
+			PrintAndLogEx(NORMAL, "Trailer decoded:");
+                        int bln = mfFirstBlockOfSector(sectorNo);
+                        int blinc = (mfNumBlocksPerSector(sectorNo) > 4) ? 5 : 1;
+                        for (i = 0; i < 4; i++) {
+                                PrintAndLogEx(NORMAL, "Access block %d%s: %s", bln, ((blinc > 1) && (i < 3) ? "+" : "") , mfGetAccessConditionsDesc(i, &(data + (sectorNo<32?3:15) * 16)[6]));
+                                bln += blinc;
+                        }
+                        PrintAndLogEx(NORMAL, "UserData: %s", sprint_hex_inrow(&(data + (sectorNo<32?3:15) * 16)[9], 1));
 		}
 	} else {
 		PrintAndLog("Command execute timeout");
@@ -253,8 +276,7 @@ int CmdHF14AMfDump(const char *Cmd)
 {
 	uint8_t sectorNo, blockNo;
 
-	uint8_t keyA[40][6];
-	uint8_t keyB[40][6];
+	uint8_t keys[2][40][6];
 	uint8_t rights[40][4];
 	uint8_t carddata[256][16];
 	uint8_t numSectors = 16;
@@ -267,38 +289,39 @@ int CmdHF14AMfDump(const char *Cmd)
 	char cmdp = param_getchar(Cmd, 0);
 	numSectors = ParamCardSizeSectors(cmdp);
 
-	if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
-		PrintAndLog("Usage:   hf mf dump [card memory]");
+	if (strlen(Cmd) > 3 || cmdp == 'h' || cmdp == 'H') {
+		PrintAndLog("Usage:   hf mf dump [card memory] [k|m]");
 		PrintAndLog("  [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");
+		PrintAndLog("  k: Always try using both Key A and Key B for each sector, even if access bits would prohibit it");
+		PrintAndLog("  m: When missing access bits or keys, replace that block with NULL");
 		PrintAndLog("");
 		PrintAndLog("Samples: hf mf dump");
 		PrintAndLog("         hf mf dump 4");
+		PrintAndLog("         hf mf dump 4 m");
 		return 0;
 	}
 
+	char opts = param_getchar(Cmd, 1);
+	bool useBothKeysAlways = false;
+	if (opts == 'k' || opts == 'K') useBothKeysAlways = true;
+	bool nullMissingKeys = false;
+	if (opts == 'm' || opts == 'M') nullMissingKeys = true;
+
 	if ((fin = fopen("dumpkeys.bin","rb")) == NULL) {
 		PrintAndLog("Could not find file dumpkeys.bin");
 		return 1;
 	}
 
-	// Read keys A from file
-	for (sectorNo=0; sectorNo<numSectors; sectorNo++) {
-		size_t bytes_read = fread(keyA[sectorNo], 1, 6, fin);
-		if (bytes_read != 6) {
-			PrintAndLog("File reading error.");
-			fclose(fin);
-			return 2;
-		}
-	}
-
-	// Read keys B from file
-	for (sectorNo=0; sectorNo<numSectors; sectorNo++) {
-		size_t bytes_read = fread(keyB[sectorNo], 1, 6, fin);
-		if (bytes_read != 6) {
-			PrintAndLog("File reading error.");
-			fclose(fin);
-			return 2;
-		}
+	// Read keys from file
+	for (int group=0; group<=1; group++) {
+		for (sectorNo=0; sectorNo<numSectors; sectorNo++) {
+			size_t bytes_read = fread(keys[group][sectorNo], 1, 6, fin);
+			if (bytes_read != 6) {
+				PrintAndLog("File reading error.");
+				fclose(fin);
+				return 2;
+			}
+		}		
 	}
 
 	fclose(fin);
@@ -310,7 +333,8 @@ int CmdHF14AMfDump(const char *Cmd)
 	for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {
 		for (tries = 0; tries < 3; tries++) {
 			UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 0, 0}};
-			memcpy(c.d.asBytes, keyA[sectorNo], 6);
+			// At least the Access Conditions can always be read with key A.
+			memcpy(c.d.asBytes, keys[0][sectorNo], 6);
 			SendCommand(&c);
 
 			if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
@@ -346,23 +370,41 @@ int CmdHF14AMfDump(const char *Cmd)
 			for (tries = 0; tries < 3; tries++) {
 				if (blockNo == NumBlocksPerSector(sectorNo) - 1) {		// sector trailer. At least the Access Conditions can always be read with key A.
 					UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};
-					memcpy(c.d.asBytes, keyA[sectorNo], 6);
+					memcpy(c.d.asBytes, keys[0][sectorNo], 6);
 					SendCommand(&c);
 					received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
+				} else if (useBothKeysAlways) {
+					// Always try both keys, even if access conditions wouldn't work.
+					for (int k=0; k<=1; k++) {
+						UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 1, 0}};
+						memcpy(c.d.asBytes, keys[k][sectorNo], 6);
+						SendCommand(&c);
+						received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
+
+						// Don't try the other one on success.
+						if (resp.arg[0] & 0xff) break;
+					}
 				} else {												// data block. Check if it can be read with key A or key B
 					uint8_t data_area = sectorNo<32?blockNo:blockNo/5;
 					if ((rights[sectorNo][data_area] == 0x03) || (rights[sectorNo][data_area] == 0x05)) {	// only key B would work
 						UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 1, 0}};
-						memcpy(c.d.asBytes, keyB[sectorNo], 6);
+						memcpy(c.d.asBytes, keys[1][sectorNo], 6);
 						SendCommand(&c);
 						received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
 					} else if (rights[sectorNo][data_area] == 0x07) {										// no key would work
-						isOK = false;
 						PrintAndLog("Access rights do not allow reading of sector %2d block %3d", sectorNo, blockNo);
-						tries = 2;
+						if (nullMissingKeys) {
+							memset(resp.d.asBytes, 0, 16);
+							resp.arg[0] = 1;
+							PrintAndLog("  ... filling the block with NULL");
+							received = true;
+						} else {
+							isOK = false;
+							tries = 2;
+						}
 					} else {																				// key A would work
 						UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};
-						memcpy(c.d.asBytes, keyA[sectorNo], 6);
+						memcpy(c.d.asBytes, keys[0][sectorNo], 6);
 						SendCommand(&c);
 						received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
 					}
@@ -377,18 +419,8 @@ int CmdHF14AMfDump(const char *Cmd)
 				isOK  = resp.arg[0] & 0xff;
 				uint8_t *data  = resp.d.asBytes;
 				if (blockNo == NumBlocksPerSector(sectorNo) - 1) {		// sector trailer. Fill in the keys.
-					data[0]  = (keyA[sectorNo][0]);
-					data[1]  = (keyA[sectorNo][1]);
-					data[2]  = (keyA[sectorNo][2]);
-					data[3]  = (keyA[sectorNo][3]);
-					data[4]  = (keyA[sectorNo][4]);
-					data[5]  = (keyA[sectorNo][5]);
-					data[10] = (keyB[sectorNo][0]);
-					data[11] = (keyB[sectorNo][1]);
-					data[12] = (keyB[sectorNo][2]);
-					data[13] = (keyB[sectorNo][3]);
-					data[14] = (keyB[sectorNo][4]);
-					data[15] = (keyB[sectorNo][5]);
+					memcpy(data, keys[0][sectorNo], 6);
+					memcpy(data + 10, keys[1][sectorNo], 6);
 				}
 				if (isOK) {
 					memcpy(carddata[FirstBlockOfSector(sectorNo) + blockNo], data, 16);
@@ -534,7 +566,7 @@ int CmdHF14AMfRestore(const char *Cmd)
 //----------------------------------------------
 
 static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, bool *paramD, uint8_t *timeout) {
-	char ctmp3[3] = {0};
+	char ctmp3[4] = {0};
 	int len = param_getlength(Cmd, indx);
 	if (len > 0 && len < 4){
 		param_getstr(Cmd, indx, ctmp3, sizeof(ctmp3));
@@ -1018,10 +1050,10 @@ int CmdHF14AMfChk(const char *Cmd)
 		PrintAndLog("Usage:  hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d|s|ss] [<key (12 hex symbols)>] [<dic (*.dic)>]");
 		PrintAndLog("          * - all sectors");
 		PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");
-		PrintAndLog("d - write keys to binary file\n");
-		PrintAndLog("t - write keys to emulator memory");
-		PrintAndLog("s - slow execute. timeout 1ms");
-		PrintAndLog("ss- very slow execute. timeout 5ms");
+		PrintAndLog("d  - write keys to binary file\n");
+		PrintAndLog("t  - write keys to emulator memory");
+		PrintAndLog("s  - slow execute. timeout 1ms");
+		PrintAndLog("ss - very slow execute. timeout 5ms");
 		PrintAndLog("      sample: hf mf chk 0 A 1234567890ab keys.dic");
 		PrintAndLog("              hf mf chk *1 ? t");
 		PrintAndLog("              hf mf chk *1 ? d");
@@ -1040,16 +1072,16 @@ int CmdHF14AMfChk(const char *Cmd)
 	int	keycnt = 0;
 	char ctmp	= 0x00;
 	int clen = 0;
-	char ctmp3[3]	= {0x00};
 	uint8_t blockNo = 0;
 	uint8_t SectorsCnt = 0;
 	uint8_t keyType = 0;
 	uint64_t key64 = 0;
-	uint32_t timeout14a = 0; // timeout in us
+	// timeout in units. (ms * 106)/10 or us*0.0106
+	uint8_t btimeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default
 	bool param3InUse = false;
 
-	int transferToEml = 0;
-	int createDumpFile = 0;
+	bool transferToEml = 0;
+	bool createDumpFile = 0;
 	
 	sector_t *e_sector = NULL;
 
@@ -1087,33 +1119,13 @@ int CmdHF14AMfChk(const char *Cmd)
 		};
 	}
 
-	// transfer to emulator & create dump file
-	ctmp = param_getchar(Cmd, 2);
-	clen = param_getlength(Cmd, 2);
-	if (clen == 1 && (ctmp == 't' || ctmp == 'T')) transferToEml = 1;
-	if (clen == 1 && (ctmp == 'd' || ctmp == 'D')) createDumpFile = 1;
+	parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &btimeout14a);
 	
-	param3InUse = transferToEml | createDumpFile;
-	
-	timeout14a = 500; // fast by default
-	// double parameters - ts, ds
-	clen = param_getlength(Cmd, 2);
-	if (clen == 2 || clen == 3){
-		param_getstr(Cmd, 2, ctmp3, sizeof(ctmp3));
-		ctmp = ctmp3[1];
-	}
-	//parse
-	if (ctmp == 's' || ctmp == 'S') {
-		timeout14a = 1000; // slow
-		if (!param3InUse && clen == 2 && (ctmp3[1] == 's' || ctmp3[1] == 'S')) {
-			timeout14a = 5000; // very slow
-		}
-		if (param3InUse && clen == 3 && (ctmp3[2] == 's' || ctmp3[2] == 'S')) {
-			timeout14a = 5000; // very slow
-		}
-		param3InUse = true;
-	}
+	param3InUse = transferToEml | createDumpFile | (btimeout14a != MF_CHKKEYS_DEFTIMEOUT);
 
+	PrintAndLog("--chk keys. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us", 
+			SectorsCnt, blockNo, keyType?'B':'A', transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106);
+	
 	for (i = param3InUse; param_getchar(Cmd, 2 + i); i++) {
 		if (!param_gethex(Cmd, 2 + i, keyBlock + 6 * keycnt, 12)) {
 			if ( stKeyBlock - keycnt < 2) {
@@ -1210,7 +1222,7 @@ int CmdHF14AMfChk(const char *Cmd)
 		for (uint32_t c = 0; c < keycnt; c += max_keys) {
 
 			uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c;
-			res = mfCheckKeysSec(SectorsCnt, keyType, timeout14a * 1.06 / 100, true, size, &keyBlock[6 * c], e_sector); // timeout is (ms * 106)/10 or us*0.0106
+			res = mfCheckKeysSec(SectorsCnt, keyType, btimeout14a, true, size, &keyBlock[6 * c], e_sector); // timeout is (ms * 106)/10 or us*0.0106
 
 			if (res != 1) {
 				if (!res) {
@@ -2292,6 +2304,20 @@ int CmdHF14AMfCGetBlk(const char *Cmd) {
 		}
 
 	PrintAndLog("block data:%s", sprint_hex(memBlock, 16));
+	
+	if (mfIsSectorTrailer(blockNo)) {
+		PrintAndLogEx(NORMAL, "Trailer decoded:");
+		PrintAndLogEx(NORMAL, "Key A: %s", sprint_hex_inrow(memBlock, 6));
+		PrintAndLogEx(NORMAL, "Key B: %s", sprint_hex_inrow(&memBlock[10], 6));
+		int bln = mfFirstBlockOfSector(mfSectorNum(blockNo));
+		int blinc = (mfNumBlocksPerSector(mfSectorNum(blockNo)) > 4) ? 5 : 1;
+		for (int i = 0; i < 4; i++) {
+			PrintAndLogEx(NORMAL, "Access block %d%s: %s", bln, ((blinc > 1) && (i < 3) ? "+" : "") , mfGetAccessConditionsDesc(i, &memBlock[6]));
+			bln += blinc;
+		}
+		PrintAndLogEx(NORMAL, "UserData: %s", sprint_hex_inrow(&memBlock[9], 1));
+	}
+	
 	return 0;
 }
 
@@ -2342,6 +2368,19 @@ int CmdHF14AMfCGetSc(const char *Cmd) {
 		}
 
 		PrintAndLog("block %3d data:%s", baseblock + i, sprint_hex(memBlock, 16));
+		
+		if (mfIsSectorTrailer(baseblock + i)) {
+                PrintAndLogEx(NORMAL, "Trailer decoded:");
+                PrintAndLogEx(NORMAL, "Key A: %s", sprint_hex_inrow(memBlock, 6));
+                PrintAndLogEx(NORMAL, "Key B: %s", sprint_hex_inrow(&memBlock[10], 6));
+                int bln = baseblock;
+                int blinc = (mfNumBlocksPerSector(sectorNo) > 4) ? 5 : 1;
+                for (int i = 0; i < 4; i++) {
+                        PrintAndLogEx(NORMAL, "Access block %d%s: %s", bln, ((blinc > 1) && (i < 3) ? "+" : "") , mfGetAccessConditionsDesc(i, &memBlock[6]));
+                        bln += blinc;
+                }
+                PrintAndLogEx(NORMAL, "UserData: %s", sprint_hex_inrow(&memBlock[9], 1));
+        }
 	}
 	return 0;
 }
@@ -2637,50 +2676,12 @@ int CmdDecryptTraceCmds(const char *Cmd){
 	return tryDecryptWord(param_get32ex(Cmd,0,0,16),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16),data,len/2);
 }
 
-int aes_encode(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *output, int length){
-	uint8_t iiv[16] = {0};
-	if (iv)
-		memcpy(iiv, iv, 16);
-	
-	aes_context aes;
-	aes_init(&aes);
-	if (aes_setkey_enc(&aes, key, 128))
-		return 1;
-	if (aes_crypt_cbc(&aes, AES_ENCRYPT, length, iiv, input, output))
-		return 2;
-	aes_free(&aes);
-
-	return 0;
-}
-
-int aes_decode(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *output, int length){
-	uint8_t iiv[16] = {0};
-	if (iv)
-		memcpy(iiv, iv, 16);
-	
-	aes_context aes;
-	aes_init(&aes);
-	if (aes_setkey_dec(&aes, key, 128))
-		return 1;
-	if (aes_crypt_cbc(&aes, AES_DECRYPT, length, iiv, input, output))
-		return 2;
-	aes_free(&aes);
-
-	return 0;
-}
-
 int CmdHF14AMfAuth4(const char *cmd) {
 	uint8_t keyn[20] = {0};
 	int keynlen = 0;
 	uint8_t key[16] = {0};
 	int keylen = 0;
-	uint8_t data[257] = {0};
-	int datalen = 0;
-	
-	uint8_t Rnd1[17] = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x00};
-	uint8_t Rnd2[17] = {0};
-	
-	
+
 	CLIParserInit("hf mf auth4", 
 		"Executes AES authentication command in ISO14443-4", 
 		"Usage:\n\thf mf auth4 4000 000102030405060708090a0b0c0d0e0f -> executes authentication\n"
@@ -2694,8 +2695,8 @@ int CmdHF14AMfAuth4(const char *cmd) {
 	};
 	CLIExecWithReturn(cmd, argtable, true);
 	
-	CLIGetStrWithReturn(1, keyn, &keynlen);
-	CLIGetStrWithReturn(2, key, &keylen);
+	CLIGetHexWithReturn(1, keyn, &keynlen);
+	CLIGetHexWithReturn(2, key, &keylen);
 	CLIParserFree();
 	
 	if (keynlen != 2) {
@@ -2708,81 +2709,7 @@ int CmdHF14AMfAuth4(const char *cmd) {
 		return 1;
 	}
 
-	uint8_t cmd1[] = {0x0a, 0x00, 0x70, keyn[1], keyn[0], 0x00};
-	int res = ExchangeRAW14a(cmd1, sizeof(cmd1), true, true, data, sizeof(data), &datalen);
-	if (res) {
-		PrintAndLog("ERROR exchande raw error: %d", res);
-		DropField();
-		return 2;
-	}
-	
-	PrintAndLog("<phase1: %s", sprint_hex(data, datalen));
-		
-	if (datalen < 3) {
-		PrintAndLog("ERROR: card response length: %d", datalen);
-		DropField();
-		return 3;
-	}
-	
-	if (data[0] != 0x0a || data[1] != 0x00) {
-		PrintAndLog("ERROR: card response. Framing error. :%s", sprint_hex(data, 2));
-		DropField();
-		return 3;
-	}
-
-	if (data[2] != 0x90) {
-		PrintAndLog("ERROR: card response error: %02x", data[2]);
-		DropField();
-		return 3;
-	}
-
-	if (datalen != 19) {
-		PrintAndLog("ERROR: card response must be 16 bytes long instead of: %d", datalen);
-		DropField();
-		return 3;
-	}
-	
-    aes_decode(NULL, key, &data[3], Rnd2, 16);
-	Rnd2[16] = Rnd2[0];
-	PrintAndLog("Rnd2: %s", sprint_hex(Rnd2, 16));
-
-	uint8_t cmd2[35] = {0};
-	cmd2[0] = 0x0b;
-	cmd2[1] = 0x00;
-	cmd2[2] = 0x72;
-
-	uint8_t raw[32] = {0};
-	memmove(raw, Rnd1, 16);
-	memmove(&raw[16], &Rnd2[1], 16);
-
-    aes_encode(NULL, key, raw, &cmd2[3], 32);
-	PrintAndLog(">phase2: %s", sprint_hex(cmd2, 35));
-	
-	res = ExchangeRAW14a(cmd2, sizeof(cmd2), false, false, data, sizeof(data), &datalen);
-	if (res) {
-		PrintAndLog("ERROR exchande raw error: %d", res);
-		DropField();
-		return 4;
-	}
-	
-	PrintAndLog("<phase2: %s", sprint_hex(data, datalen));
-
-    aes_decode(NULL, key, &data[3], raw, 32);
-	PrintAndLog("res: %s", sprint_hex(raw, 32));
-	
-	PrintAndLog("Rnd1`: %s", sprint_hex(&raw[4], 16));
-	if (memcmp(&raw[4], &Rnd1[1], 16)) {
-		PrintAndLog("\nERROR: Authentication FAILED. rnd not equal");
-		PrintAndLog("rnd1 reader: %s", sprint_hex(&Rnd1[1], 16));
-		PrintAndLog("rnd1   card: %s", sprint_hex(&raw[4], 16));
-		DropField();
-		return 5;
-	}
-
-	DropField();
-	PrintAndLog("\nAuthentication OK");
-	
-	return 0;
+	return MifareAuth4(NULL, keyn, key, true, false, true);
 }
 
 static command_t CommandTable[] =