X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/e869d598719e492ca4bda9d8d2a5f80b7ff9d919..e1778858ddc53a6a82e8ee24f02e6b673687f69a:/client/cmdhfmfu.c diff --git a/client/cmdhfmfu.c b/client/cmdhfmfu.c index 7aa16b89..428b0627 100644 --- a/client/cmdhfmfu.c +++ b/client/cmdhfmfu.c @@ -100,6 +100,38 @@ uint32_t ul_ev1_pwdgenB(uint8_t* uid) { return (uint32_t)bytes_to_num(pwd, 4); } +// Certain pwd generation algo nickname C. +uint32_t ul_ev1_pwdgenC(uint8_t* uid){ + uint32_t pwd = 0; + uint8_t base[] = { + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x28, + 0x63, 0x29, 0x20, 0x43, 0x6f, 0x70, 0x79, 0x72, + 0x69, 0x67, 0x68, 0x74, 0x20, 0x4c, 0x45, 0x47, + 0x4f, 0x20, 0x32, 0x30, 0x31, 0x34, 0xaa, 0xaa + }; + + memcpy(base, uid, 7); + + for (int i = 0; i < 32; i += 4) { + uint32_t b = *(uint32_t *)(base + i); + pwd = b + ROTR(pwd, 25) + ROTR(pwd, 10) - pwd; + } + return BSWAP_32(pwd); +} + +// pack generation for algo 1-3 +uint16_t ul_ev1_packgenA(uint8_t* uid){ + uint16_t pack = (uid[0] ^ uid[1] ^ uid[2]) << 8 | (uid[2] ^ 8); + return pack; +} +uint16_t ul_ev1_packgenB(uint8_t* uid){ + return 0x8080; +} +uint16_t ul_ev1_packgenC(uint8_t* uid){ + return 0xaa55; +} + + void ul_ev1_pwdgen_selftest(){ uint8_t uid1[] = {0x04,0x11,0x12,0x11,0x12,0x11,0x10}; @@ -109,6 +141,10 @@ void ul_ev1_pwdgen_selftest(){ uint8_t uid2[] = {0x04,0x1f,0x98,0xea,0x1e,0x3e,0x81}; uint32_t pwd2 = ul_ev1_pwdgenB(uid2); PrintAndLog("UID | %s | %08X | %s", sprint_hex(uid2,7), pwd2, (pwd2 == 0x5fd37eca)?"OK":"->5fd37eca<--"); + + uint8_t uid3[] = {0x04,0x62, 0xB6, 0x8A, 0xB4, 0x42, 0x80}; + uint32_t pwd3 = ul_ev1_pwdgenC(uid3); + PrintAndLog("UID | %s | %08X | %s", sprint_hex(uid3,7), pwd3, (pwd3 == 0x5a349515)?"OK":"->5a349515<--"); return; } @@ -449,10 +485,10 @@ int ul_print_type(uint32_t tagtype, uint8_t spaces){ } static int ulc_print_3deskey( uint8_t *data){ - PrintAndLog(" deskey1 [44/0x2C] : %s [%.4s]", sprint_hex(data ,4),data); - PrintAndLog(" deskey1 [45/0x2D] : %s [%.4s]", sprint_hex(data+4 ,4),data+4); - PrintAndLog(" deskey2 [46/0x2E] : %s [%.4s]", sprint_hex(data+8 ,4),data+8); - PrintAndLog(" deskey2 [47/0x2F] : %s [%.4s]", sprint_hex(data+12,4),data+12); + PrintAndLog(" deskey1 [44/0x2C] : %s [s]", sprint_hex(data ,4), sprint_ascii(data,4) ); + PrintAndLog(" deskey1 [45/0x2D] : %s [s]", sprint_hex(data+4 ,4), sprint_ascii(data+4,4)); + PrintAndLog(" deskey2 [46/0x2E] : %s [s]", sprint_hex(data+8 ,4), sprint_ascii(data+8,4)); + PrintAndLog(" deskey2 [47/0x2F] : %s [s]", sprint_hex(data+12,4), sprint_ascii(data+12,4)); PrintAndLog("\n 3des key : %s", sprint_hex(SwapEndian64(data, 16, 8), 16)); return 0; } @@ -610,7 +646,7 @@ uint32_t GetHF14AMfU_Type(void){ // Ultralight - ATQA / SAK if ( card.atqa[1] != 0x00 || card.atqa[0] != 0x44 || card.sak != 0x00 ) { - PrintAndLog("Tag is not Ultralight | NTAG | MY-D [ATQA: %02X %02X SAK: %02X]\n", card.atqa[1], card.atqa[0], card.sak); + //PrintAndLog("Tag is not Ultralight | NTAG | MY-D [ATQA: %02X %02X SAK: %02X]\n", card.atqa[1], card.atqa[0], card.sak); ul_switch_off_field(); return UL_ERROR; } @@ -915,6 +951,14 @@ int CmdHF14AMfUInfo(const char *Cmd){ PrintAndLog("Found a default password: %s || Pack: %02X %02X",sprint_hex(key, 4), pack[0], pack[1]); } if (!ul_auth_select( &card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack))) return -1; + + // test pwd gen C + num_to_bytes( ul_ev1_pwdgenC(card.uid), 4, key); + len = ulev1_requestAuthentication(key, pack, sizeof(pack)); + if (len >= 1) { + PrintAndLog("Found a default password: %s || Pack: %02X %02X",sprint_hex(key, 4), pack[0], pack[1]); + } + if (!ul_auth_select( &card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack))) return -1; for (uint8_t i = 0; i < KEYS_PWD_COUNT; ++i ) { key = default_pwd_pack[i]; @@ -1169,7 +1213,7 @@ int CmdHF14AMfURdBl(const char *Cmd){ uint8_t *data = resp.d.asBytes; PrintAndLog("\nBlock# | Data | Ascii"); PrintAndLog("-----------------------------"); - PrintAndLog("%02d/0x%02X | %s| %.4s\n", blockNo, blockNo, sprint_hex(data, 4), data); + PrintAndLog("%02d/0x%02X | %s| %s\n", blockNo, blockNo, sprint_hex(data, 4), sprint_ascii(data,4)); } else { PrintAndLog("Failed reading block: (%02x)", isOK); @@ -1316,6 +1360,14 @@ int usage_hf_mfu_gendiverse(void){ return 0; } +int usage_hf_mfu_pwdgen(void){ + PrintAndLog("Usage: hf mfu pwdgen "); + PrintAndLog(""); + PrintAndLog("sample: hf mfu pwdgen 11223344556677"); + PrintAndLog(""); + return 0; +} + #define DUMP_PREFIX_LENGTH 48 // // Mifare Ultralight / Ultralight-C / Ultralight-EV1 @@ -1544,25 +1596,25 @@ int CmdHF14AMfUDump(const char *Cmd){ PrintAndLog("\n*Special* block data:"); PrintAndLog("\nDataType| Data | | Ascii"); PrintAndLog("---------------------------------"); - PrintAndLog("GetVer-1| %s| | %.4s", sprint_hex(dump_file_data, 4), dump_file_data); - PrintAndLog("GetVer-2| %s| | %.4s", sprint_hex(dump_file_data+4, 4), dump_file_data+4); + PrintAndLog("GetVer-1| %s| | %s", sprint_hex(dump_file_data, 4), sprint_ascii(dump_file_data, 4)); + PrintAndLog("GetVer-2| %s| | %s", sprint_hex(dump_file_data+4, 4), sprint_ascii(dump_file_data+4,4)); PrintAndLog("TBD | 00 00 | | "); - PrintAndLog("Tearing | %s| | %.3s", sprint_hex(dump_file_data+10, 3), dump_file_data+10); - PrintAndLog("Pack | %s | | %.2s", sprint_hex(dump_file_data+13, 2), dump_file_data+13); + PrintAndLog("Tearing | %s| | %s", sprint_hex(dump_file_data+10, 3), sprint_ascii(dump_file_data+10,3) ); + PrintAndLog("Pack | %s | | %s", sprint_hex(dump_file_data+13, 2), sprint_ascii(dump_file_data+13,2) ); PrintAndLog("TBD | 00 | | "); - PrintAndLog("Sig-1 | %s| | %.4s", sprint_hex(dump_file_data+16, 4), dump_file_data+16); - PrintAndLog("Sig-2 | %s| | %.4s", sprint_hex(dump_file_data+20, 4), dump_file_data+20); - PrintAndLog("Sig-3 | %s| | %.4s", sprint_hex(dump_file_data+24, 4), dump_file_data+24); - PrintAndLog("Sig-4 | %s| | %.4s", sprint_hex(dump_file_data+28, 4), dump_file_data+28); - PrintAndLog("Sig-5 | %s| | %.4s", sprint_hex(dump_file_data+32, 4), dump_file_data+32); - PrintAndLog("Sig-6 | %s| | %.4s", sprint_hex(dump_file_data+36, 4), dump_file_data+36); - PrintAndLog("Sig-7 | %s| | %.4s", sprint_hex(dump_file_data+40, 4), dump_file_data+40); - PrintAndLog("Sig-8 | %s| | %.4s", sprint_hex(dump_file_data+44, 4), dump_file_data+44); + PrintAndLog("Sig-1 | %s| | %s", sprint_hex(dump_file_data+16, 4), sprint_ascii(dump_file_data+16,4)); + PrintAndLog("Sig-2 | %s| | %s", sprint_hex(dump_file_data+20, 4), sprint_ascii(dump_file_data+20,4)); + PrintAndLog("Sig-3 | %s| | %s", sprint_hex(dump_file_data+24, 4), sprint_ascii(dump_file_data+24,4)); + PrintAndLog("Sig-4 | %s| | %s", sprint_hex(dump_file_data+28, 4), sprint_ascii(dump_file_data+28,4)); + PrintAndLog("Sig-5 | %s| | %s", sprint_hex(dump_file_data+32, 4), sprint_ascii(dump_file_data+32,4)); + PrintAndLog("Sig-6 | %s| | %s", sprint_hex(dump_file_data+36, 4), sprint_ascii(dump_file_data+36,4)); + PrintAndLog("Sig-7 | %s| | %s", sprint_hex(dump_file_data+40, 4), sprint_ascii(dump_file_data+40,4)); + PrintAndLog("Sig-8 | %s| | %s", sprint_hex(dump_file_data+44, 4), sprint_ascii(dump_file_data+44,4)); PrintAndLog("\nBlock# | Data |lck| Ascii"); PrintAndLog("---------------------------------"); for (i = 0; i < Pages; ++i) { if ( i < 3 ) { - PrintAndLog("%02d/0x%02X | %s| | ", i+startPage, i+startPage, sprint_hex(data + i * 4, 4)); + PrintAndLog("%02d/0x%02X | %s| | %s", i+startPage, i+startPage, sprint_hex(data + i * 4, 4), sprint_ascii(data + i * 4,4) ); continue; } switch(i){ @@ -1609,7 +1661,7 @@ int CmdHF14AMfUDump(const char *Cmd){ case 43: tmplockbit = bit2[9]; break; //auth1 default: break; } - PrintAndLog("%02d/0x%02X | %s| %d | %.4s", i+startPage, i+startPage, sprint_hex(data + i * 4, 4), tmplockbit, data+i*4); + PrintAndLog("%02d/0x%02X | %s| %d | %s", i+startPage, i+startPage, sprint_hex(data + i * 4, 4), tmplockbit, sprint_ascii(data + i * 4,4)); } PrintAndLog("---------------------------------"); @@ -1627,8 +1679,10 @@ int CmdHF14AMfUDump(const char *Cmd){ return 1; } fwrite( dump_file_data, 1, Pages*4 + DUMP_PREFIX_LENGTH, fout ); - fclose(fout); - + if (fout) { + fclose(fout); + fout = NULL; + } PrintAndLog("Dumped %d pages, wrote %d bytes to %s", Pages+(DUMP_PREFIX_LENGTH/4), Pages*4 + DUMP_PREFIX_LENGTH, filename); return 0; } @@ -1650,7 +1704,7 @@ int CmdHF14AMfucAuth(const char *Cmd){ //Change key to user defined one if (cmdp == 'k' || cmdp == 'K'){ keyNo = param_get8(Cmd, 1); - if(keyNo > KEYS_3DES_COUNT) + if(keyNo >= KEYS_3DES_COUNT) errors = true; } @@ -1876,7 +1930,6 @@ int CmdHF14AMfucSetUid(const char *Cmd){ int CmdHF14AMfuGenDiverseKeys(const char *Cmd){ uint8_t uid[4]; - char cmdp = param_getchar(Cmd, 0); if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_hf_mfu_gendiverse(); @@ -1974,6 +2027,20 @@ int CmdHF14AMfUSim(const char *Cmd) { return CmdHF14ASim(Cmd); } +int CmdHF14AMfuPwdGen(const char *Cmd){ + uint8_t uid[7] = {0x00}; + char cmdp = param_getchar(Cmd, 0); + if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_hf_mfu_pwdgen(); + + if (param_gethex(Cmd, 0, uid, 14)) return usage_hf_mfu_pwdgen(); + + PrintAndLog(" algo | pwd | pack"); + PrintAndLog("------+----------+-----"); + PrintAndLog(" EV1 | %08X | %04X", ul_ev1_pwdgenA(uid), ul_ev1_packgenA(uid)); + PrintAndLog(" Ami | %08X | %04X", ul_ev1_pwdgenB(uid), ul_ev1_packgenB(uid)); + PrintAndLog(" LD | %08X | %04X", ul_ev1_pwdgenC(uid), ul_ev1_packgenC(uid)); + return 0; +} //------------------------------------ // Menu Stuff //------------------------------------ @@ -1991,11 +2058,13 @@ static command_t CommandTable[] = {"setuid", CmdHF14AMfucSetUid, 0, "Set UID - MAGIC tags only"}, {"sim", CmdHF14AMfUSim, 0, "Simulate Ultralight from emulator memory"}, {"gen", CmdHF14AMfuGenDiverseKeys , 1, "Generate 3des mifare diversified keys"}, + {"pwdgen", CmdHF14AMfuPwdGen, 1, "Generate pwd from known algos"}, {NULL, NULL, 0, NULL} }; int CmdHFMFUltra(const char *Cmd){ - WaitForResponseTimeout(CMD_ACK,NULL,100); + clearCommandBuffer(); + //WaitForResponseTimeout(CMD_ACK,NULL,100); CmdsParse(CommandTable, Cmd); return 0; }