FIX: Added some more "clearCommandBuffer" calls before sending..
//-----------------------------------------------------------------------------
void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
{
-
//Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
// This can be used in a reader-only attack.
// (it can also be retrieved via 'hf 14a list', but hey...
uint8_t bitmask = 0;
uint8_t bits_to_shift = 0;
uint8_t bits_shifted = 0;
-
+
delay &= 0x07;
if (delay) {
for (uint16_t i = 0; i < delay; i++) {
PrintAndLog("--block no:%d, key type:%c, key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));\r
PrintAndLog("--data: %s", sprint_hex(bldata, 16));\r
\r
- UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};\r
+ UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};\r
memcpy(c.d.asBytes, key, 6);\r
memcpy(c.d.asBytes + 10, bldata, 16);\r
- SendCommand(&c);\r
+ clearCommandBuffer();\r
+ SendCommand(&c);\r
\r
UsbCommand resp;\r
if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
}\r
PrintAndLog("--block no:%d, key type:%c, key:%s ", blockNo, keyType?'B':'A', sprint_hex(key, 6));\r
\r
- UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};\r
+ UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};\r
memcpy(c.d.asBytes, key, 6);\r
- SendCommand(&c);\r
+ clearCommandBuffer();\r
+ SendCommand(&c);\r
\r
UsbCommand resp;\r
if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
\r
UsbCommand c = {CMD_MIFARE_READSC, {sectorNo, keyType, 0}};\r
memcpy(c.d.asBytes, key, 6);\r
+ clearCommandBuffer();\r
SendCommand(&c);\r
PrintAndLog(" ");\r
\r
for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {\r
UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 0, 0}};\r
memcpy(c.d.asBytes, keyA[sectorNo], 6);\r
+ clearCommandBuffer();\r
SendCommand(&c);\r
\r
if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. At least the Access Conditions can always be read with key A. \r
UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};\r
memcpy(c.d.asBytes, keyA[sectorNo], 6);\r
+ clearCommandBuffer();\r
SendCommand(&c);\r
received = WaitForResponseTimeout(CMD_ACK,&resp,1500);\r
} else { // data block. Check if it can be read with key A or key B\r
} else { // key A would work\r
UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};\r
memcpy(c.d.asBytes, keyA[sectorNo], 6);\r
+ clearCommandBuffer();\r
SendCommand(&c);\r
received = WaitForResponseTimeout(CMD_ACK,&resp,1500);\r
}\r
for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {\r
if (fread(keyA[sectorNo], 1, 6, fkeys) == 0) {\r
PrintAndLog("File reading error (dumpkeys.bin).");\r
-\r
fclose(fkeys);\r
return 2;\r
}\r
PrintAndLog("Writing to block %3d: %s", FirstBlockOfSector(sectorNo) + blockNo, sprint_hex(bldata, 16));\r
\r
memcpy(c.d.asBytes + 10, bldata, 16);\r
+ clearCommandBuffer();\r
SendCommand(&c);\r
\r
UsbCommand resp;\r
\r
uint8_t cmdp = param_getchar(Cmd, 0);\r
\r
- clearCommandBuffer();\r
- \r
if (cmdp == 'h' || cmdp == 'H') {\r
PrintAndLog("Usage: hf mf sim u <uid (8 hex symbols)> n <numreads> i x");\r
PrintAndLog(" h this help");\r
\r
UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};\r
memcpy(c.d.asBytes, uid, sizeof(uid));\r
+ clearCommandBuffer();\r
SendCommand(&c);\r
\r
if(flags & FLAG_INTERACTIVE)\r
return 0;\r
} \r
\r
- UsbCommand c = {CMD_MIFARE_SET_DBGMODE, {dbgMode, 0, 0}};\r
- SendCommand(&c);\r
+ UsbCommand c = {CMD_MIFARE_SET_DBGMODE, {dbgMode, 0, 0}};\r
+ SendCommand(&c);\r
\r
- return 0;\r
+ return 0;\r
}\r
\r
int CmdHF14AMfEGet(const char *Cmd)\r
return 0;\r
} \r
\r
- UsbCommand c = {CMD_MIFARE_EML_MEMCLR, {0, 0, 0}};\r
- SendCommand(&c);\r
- return 0;\r
+ UsbCommand c = {CMD_MIFARE_EML_MEMCLR, {0, 0, 0}};\r
+ SendCommand(&c);\r
+ return 0;\r
}\r
\r
-\r
int CmdHF14AMfESet(const char *Cmd)\r
{\r
uint8_t memBlock[16];\r
return 0;\r
}\r
\r
-\r
int CmdHF14AMfELoad(const char *Cmd)\r
{\r
FILE * f;\r
uint8_t blockWidth = 32;\r
char ctmp = param_getchar(Cmd, 0);\r
\r
- if ( ctmp == 'h' || ctmp == 0x00) {\r
+ if ( ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) {\r
PrintAndLog("It loads emul dump from the file `filename.eml`");\r
PrintAndLog("Usage: hf mf eload [card memory] <file name w/o `.eml`>");\r
PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K, u = UL");\r
return 0;\r
}\r
\r
-\r
int CmdHF14AMfESave(const char *Cmd)\r
{\r
FILE * f;\r
return 0;\r
}\r
\r
-\r
int CmdHF14AMfECFill(const char *Cmd)\r
{\r
uint8_t keyType = 0;\r
return 0;\r
}\r
\r
-\r
int CmdHF14AMfEKeyPrn(const char *Cmd)\r
{\r
int i;\r
uint8_t numSectors;\r
uint8_t data[16];\r
uint64_t keyA, keyB;\r
+\r
+ char cmdp = param_getchar(Cmd, 0);\r
\r
- if (param_getchar(Cmd, 0) == 'h') {\r
+ if ( cmdp == 'h' || cmdp == 'H' ) {\r
PrintAndLog("It prints the keys loaded in the emulator memory");\r
PrintAndLog("Usage: hf mf ekeyprn [card memory]");\r
PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");\r
return 0;\r
} \r
\r
- char cmdp = param_getchar(Cmd, 0);\r
- \r
switch (cmdp) {\r
case '0' : numSectors = 5; break;\r
case '1' : \r
return 0;\r
}\r
\r
-\r
int CmdHF14AMfCSetUID(const char *Cmd)\r
{\r
uint8_t wipeCard = 0;\r
return 0;\r
}\r
\r
-\r
int CmdHF14AMfCLoad(const char *Cmd)\r
{\r
FILE * f;\r
uint8_t buf8[64] = {0x00};\r
uint8_t fillFromEmulator = 0;\r
int i, len, blockNum, flags=0;\r
+\r
+ char ctmp = param_getchar(Cmd, 0);\r
\r
- if (param_getchar(Cmd, 0) == 'h' || param_getchar(Cmd, 0)== 0x00) {\r
+ if (ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) {\r
PrintAndLog("It loads magic Chinese card from the file `filename.eml`");\r
PrintAndLog("or from emulator memory (option `e`)");\r
PrintAndLog("Usage: hf mf cload <file name w/o `.eml`>");\r
return 0;\r
} \r
\r
- char ctmp = param_getchar(Cmd, 0);\r
if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;\r
\r
if (fillFromEmulator) {\r
return 0;\r
}\r
\r
-\r
int CmdHF14AMfCGetSc(const char *Cmd) {\r
uint8_t memBlock[16] = {0x00};\r
uint8_t sectorNo = 0;\r
return 0;\r
}\r
\r
-\r
int CmdHF14AMfCSave(const char *Cmd) {\r
\r
FILE * f;\r
\r
// memset(filename, 0, sizeof(filename));\r
// memset(buf, 0, sizeof(buf));\r
-\r
- if (param_getchar(Cmd, 0) == 'h') {\r
+ char ctmp = param_getchar(Cmd, 0);\r
+ \r
+ if ( ctmp == 'h' || ctmp == 'H' ) {\r
PrintAndLog("It saves `magic Chinese` card dump into the file `filename.eml` or `cardID.eml`");\r
PrintAndLog("or into emulator memory (option `e`)");\r
PrintAndLog("Usage: hf mf esave [file name w/o `.eml`][e]");\r
PrintAndLog(" hf mf esave e \n");\r
return 0;\r
} \r
-\r
- char ctmp = param_getchar(Cmd, 0);\r
if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;\r
\r
if (fillFromEmulator) {\r
}\r
}\r
\r
-\r
int CmdHF14AMfSniff(const char *Cmd){\r
\r
bool wantLogToFile = 0;\r
}\r
\r
//needs nt, ar, at, Data to decrypt\r
-int CmdDecryptTraceCmds(const char *Cmd){\r
+int CmdHf14MfDecryptBytes(const char *Cmd){\r
uint8_t data[50];\r
\r
uint32_t nt = param_get32ex(Cmd,0,0,16);\r
{"cgetsc", CmdHF14AMfCGetSc, 0, "Read sector - Magic Chinese card"},\r
{"cload", CmdHF14AMfCLoad, 0, "Load dump into magic Chinese card"},\r
{"csave", CmdHF14AMfCSave, 0, "Save dump from magic Chinese card into file or emulator"},\r
- {"decrypt", CmdDecryptTraceCmds, 1, "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace"},\r
+ {"decrypt", CmdHf14MfDecryptBytes, 1, "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace"},\r
{NULL, NULL, 0, NULL}\r
};\r
\r
static int CmdHelp(const char *Cmd);
-struct pcf7931_config configPcf = {{0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF},17500,{0,0}};
+#define PCF7931_DEFAULT_INITDELAY 17500
+#define PCF7931_DEFAULT_OFFSET_WIDTH 0
+#define PCF7931_DEFAULT_OFFSET_POSITION 0
+
+// Default values - Configuration
+struct pcf7931_config configPcf = {
+ {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF},
+ PCF7931_DEFAULT_INITDELAY,
+ {
+ PCF7931_DEFAULT_OFFSET_WIDTH,
+ PCF7931_DEFAULT_OFFSET_POSITION
+ }
+ };
+
+// Resets the configuration settings to default values.
+int pcf7931_resetConfig(){
+ memset(configPcf.Pwd, 0xFF, sizeof(configPcf.Pwd) );
+ configPcf.InitDelay = PCF7931_DEFAULT_INITDELAY;
+ configPcf.Offset[0] = PCF7931_DEFAULT_OFFSET_WIDTH;
+ configPcf.Offset[1] = PCF7931_DEFAULT_OFFSET_POSITION;
+ return 0;
+}
-int usage_pcf7931_read()
-{
+int pcf7931_printConfig(){
+ PrintAndLog("Password (LSB first on bytes) : %s", sprint_hex( configPcf.Pwd, sizeof(configPcf.Pwd)));
+ PrintAndLog("Tag initialization delay : %d us", configPcf.InitDelay);
+ PrintAndLog("Offset low pulses width : %d us", configPcf.Offset[0]);
+ PrintAndLog("Offset low pulses position : %d us", configPcf.Offset[1]);
+ return 0;
+}
+
+int usage_pcf7931_read(){
PrintAndLog("Usage: lf pcf7931 read [h] ");
PrintAndLog("This command tries to read a PCF7931 tag.");
- PrintAndLog("Options: ");
- PrintAndLog(" h This help");
+ PrintAndLog("Options:");
+ PrintAndLog(" h This help");
PrintAndLog("Examples:");
PrintAndLog(" lf pcf7931 read");
return 0;
}
-int CmdLFPCF7931Read(const char *Cmd)
-{
- uint8_t cmdp = 0;
-
- if (param_getchar(Cmd, cmdp) == 'H' || param_getchar(Cmd, cmdp) == 'h')
- return usage_pcf7931_read();
-
- UsbCommand c = {CMD_PCF7931_READ};
+int usage_pcf7931_write(){
+ PrintAndLog("Usage: lf pcf7931 write [h] <block address> <byte address> <data>");
+ PrintAndLog("This command tries to write a PCF7931 tag.");
+ PrintAndLog("Options:");
+ PrintAndLog(" h This help");
+ PrintAndLog(" blockaddress Block to save");
+ PrintAndLog(" byteaddress Index of byte inside block to overwrite");
+ PrintAndLog(" data one byte of data");
+ PrintAndLog("Examples:");
+ PrintAndLog(" lf pcf7931 write 10 1 FF");
+ return 0;
+}
+
+int usage_pcf7931_config(){
+ PrintAndLog("Usage: lf pcf7931 config [h] [r] <pwd> <delay> <offset width> <offset position>");
+ PrintAndLog("This command tries to set the configuration used with PCF7931 commands");
+ PrintAndLog("The time offsets could be useful to correct slew rate generated by the antenna");
+ PrintAndLog("Caling without some parameter will print the current configuration.");
+ PrintAndLog("Options:");
+ PrintAndLog(" h This help");
+ PrintAndLog(" r Reset configuration to default values");
+ PrintAndLog(" pwd Password, hex, 7bytes, LSB-order");
+ PrintAndLog(" delay Tag initialization delay (in us) decimal");
+ PrintAndLog(" offset Low pulses width (in us) decimal");
+ PrintAndLog(" offset Low pulses position (in us) decimal");
+ PrintAndLog("Examples:");
+ PrintAndLog(" lf pcf7931 config");
+ PrintAndLog(" lf pcf7931 config r");
+ PrintAndLog(" lf pcf7931 config 11223344556677 20000");
+ PrintAndLog(" lf pcf7931 config 11223344556677 17500 -10 30");
+ return 0;
+}
+
+int CmdLFPCF7931Read(const char *Cmd){
+
+ uint8_t ctmp = param_getchar(Cmd, 0);
+ if ( ctmp == 'H' || ctmp == 'h' ) return usage_pcf7931_read();
+
+ UsbCommand resp;
+ UsbCommand c = {CMD_PCF7931_READ, {0, 0, 0}};
clearCommandBuffer();
SendCommand(&c);
- UsbCommand resp;
- WaitForResponse(CMD_ACK,&resp);
+ if ( !WaitForResponseTimeout(CMD_ACK, &resp, 2500) ) {
+ PrintAndLog("command execution time out");
+ return 1;
+ }
return 0;
}
-int CmdLFPCF7931Config(const char *Cmd)
-{
- int res = 0;
- // res = sscanf(Cmd,
- // "%02x %02x %hu %hu %hu %hu %hu %hhu %hd %hd",
- // &configPcf.password[0],
- // &configPcf.password[1],
- // &configPcf.password[2],
- // &configPcf.password[3],
- // &configPcf.password[4],
- // &configPcf.password[5],
- // &configPcf.password[6],
- // &configPcf.init_delay,
- // &configPcf.offset[0],
- // &configPcf.offset[1]);
-
- if (res >= 7 || res < 1){
- if(res == 7) configPcf.init_delay = 17500; //default value
-
- if(res<=8){
- configPcf.offset[0] = 0; //default value
- configPcf.offset[1] = 0; //default value
- }
-
- if(res < 1){
- PrintAndLog("Usage: <password byte 1 (in hex, lsb first)> <password byte 2 (in hex, lsb first)> [...] <password byte 7 (in hex, lsb first)> <tag initialization delay (in us)> <optional : offset on the low pulses width (in us)> <optional : offset on the low pulses position (in us)>");
- PrintAndLog("The time offsets could be usefull to correct slew rate generated by the antenna.");
- }
-
- PrintAndLog("Current configuration :");
- PrintAndLog("Password (LSB first on each byte) : %02x %02x %02x %02x %02x %02x %02x", configPcf.password[0], configPcf.password[1], configPcf.password[2], configPcf.password[3], configPcf.password[4], configPcf.password[5], configPcf.password[6]);
- PrintAndLog("Tag initialization delay : %d us", configPcf.init_delay);
- PrintAndLog("Offsets : %d us on the low pulses width, %d us on the low pulses positions", configPcf.offset[0], configPcf.offset[1]);
-
- return 0;
- }
-
- //default values
- configPcf.password[0] = 0xFF;
- configPcf.password[1] = 0xFF;
- configPcf.password[2] = 0xFF;
- configPcf.password[3] = 0xFF;
- configPcf.password[4] = 0xFF;
- configPcf.password[5] = 0xFF;
- configPcf.password[6] = 0xFF;
-
- configPcf.init_delay = 17500;
- configPcf.offset[0] = 0;
- configPcf.offset[1] = 0;
-
- PrintAndLog("Incorrect format");
- PrintAndLog("Examples of right usage : lf pcf7931 config 11 22 33 44 55 66 77 20000");
- PrintAndLog(" lf pcf7931 config FF FF FF FF FF FF FF 17500 -10 30");
- return 0;
+int CmdLFPCF7931Config(const char *Cmd){
+
+ uint8_t ctmp = param_getchar(Cmd, 0);
+ if ( ctmp == 0) return pcf7931_printConfig();
+ if ( ctmp == 'H' || ctmp == 'h' ) return usage_pcf7931_config();
+ if ( ctmp == 'R' || ctmp == 'r' ) return pcf7931_resetConfig();
+
+ if ( param_gethex(Cmd, 0, configPcf.Pwd, 14) ) return usage_pcf7931_config();
+
+ configPcf.InitDelay = (param_get32ex(Cmd,1,0,10) & 0xFFFF);
+ configPcf.Offset[0] = (int)(param_get32ex(Cmd,2,0,10) & 0xFFFF);
+ configPcf.Offset[1] = (int)(param_get32ex(Cmd,3,0,10) & 0xFFFF);
+
+ pcf7931_printConfig();
+ return 0;
}
-int CmdLFPCF7931Write(const char *Cmd)
-{
- UsbCommand c = {CMD_PCF7931_WRITE};
+int CmdLFPCF7931Write(const char *Cmd){
+
+ uint8_t ctmp = param_getchar(Cmd, 0);
+ if (strlen(Cmd) < 1 || ctmp == 'h' || ctmp == 'H') return usage_pcf7931_write();
- int res = 0;
- res = sscanf(Cmd, "%" SCNu64 " %" SCNu64 " %" SCNu64 , &c.arg[0], &c.arg[1], &c.arg[2]);
+ uint64_t blockaddress = param_get64ex(Cmd, 0, 0, 16);
+ uint64_t byteaddress = param_get64ex(Cmd, 1, 0, 16);
+ uint8_t data = param_get8ex(Cmd,2,0,16);
- if(res < 1) {
PrintAndLog("Please specify the block address in hex");
- return 1;
- }
- if (res == 1){
PrintAndLog("Please specify the byte address in hex");
- return 2;
- }
- if(res == 2) {
PrintAndLog("Please specify the data in hex (1 byte)");
+
+ PrintAndLog("", blockaddress, byteaddress, data);
return 3;
- }
- if(res == 3) {
- memcpy(c.d.asDwords, configPcf.password, 7);
-
- c.d.asDwords[7] = (configPcf.offset[0]+128);
- c.d.asDwords[8] = (configPcf.offset[1]+128);
- c.d.asDwords[9] = configPcf.init_delay;
+ UsbCommand c = {CMD_PCF7931_WRITE, { blockaddress, byteaddress, data} };
+ memcpy(c.d.asDwords, configPcf.Pwd, 7);
+ c.d.asDwords[7] = (configPcf.Offset[0]+128);
+ c.d.asDwords[8] = (configPcf.Offset[1]+128);
+ c.d.asDwords[9] = configPcf.InitDelay;
clearCommandBuffer();
- SendCommand(&c);
- return 0;
- }
-
- PrintAndLog("INCORRECT FORMAT");
- return 0;
+ SendCommand(&c);
+ //no ack?
+ return 0;
}
-
static command_t CommandTable[] =
{
{"help", CmdHelp, 1, "This help"},
{"read", CmdLFPCF7931Read, 1, "Read content of a PCF7931 transponder"},
- {"write", CmdLFPCF7931Write, 1, "Write data on a PCF7931 transponder. Usage : lf pcf7931 write <bloc address> <byte address> <data>"},
+ {"write", CmdLFPCF7931Write, 1, "Write data on a PCF7931 transponder."},
{"config", CmdLFPCF7931Config, 1, "Configure the password, the tags initialization delay and time offsets (optional)"},
{NULL, NULL, 0, NULL}
};
#define CMDLFPCF7931_H__
struct pcf7931_config{
- uint8_t password[7];
- uint16_t init_delay;
- int16_t offset[2];
+ uint8_t Pwd[7];
+ uint16_t InitDelay;
+ int16_t Offset[2];
};
int CmdLFPCF7931(const char *Cmd);
int password = 0xFFFFFFFF; //default to blank Block 7\r
\r
char cmdp = param_getchar(Cmd, 0);\r
- if (cmdp == 'h' || cmdp == 'H')\r
- return usage_t55xx_read();\r
+ if (cmdp == 'h' || cmdp == 'H') return usage_t55xx_read();\r
\r
int res = sscanf(Cmd, "%d %x", &block, &password);\r
\r
- if ( res < 1 || res > 2 )\r
- return usage_t55xx_read();\r
-\r
+ if ( res < 1 || res > 2 ) return usage_t55xx_read();\r
\r
if ((block < 0) | (block > 7)) {\r
PrintAndLog("Block must be between 0 and 7");\r
projects / proxmark3-svn / commitdiff