(no commit message)

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index d8bc8f1d043cd3e52a5ac33ef9db42c5cb0b792f..742b7b3b02dbe90f53963c1542b4114c77525e74 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -13,7 +13,6 @@
 \r
 static int CmdHelp(const char *Cmd);\r
 \r
 \r
 static int CmdHelp(const char *Cmd);\r
 \r

-\r

 int CmdHF14AMifare(const char *Cmd)\r
 {\r
        uint32_t uid = 0;\r
 int CmdHF14AMifare(const char *Cmd)\r
 {\r
        uint32_t uid = 0;\r


@@ -256,6 +255,206 @@ int CmdHF14AMfRdSc(const char *Cmd)
   return 0;\r
 }\r
 \r
   return 0;\r
 }\r
 \r

+int CmdHF14AMfDump1k(const char *Cmd)\r
+{\r
+       int i, j;\r
+       \r
+       uint8_t keyType = 0;\r
+       uint8_t c[3][4];\r
+       uint8_t keyA[16][6];\r
+       uint8_t keyB[16][6];\r
+       uint8_t rights[16][4];\r
+       \r
+       uint8_t isOK  = 0;\r
+       uint8_t *data  = NULL;\r
+\r
+       FILE *fin;\r
+       FILE *fout;\r
+       \r
+       UsbCommand *resp;\r
+       \r
+       if ((fin = fopen("dumpkeys.bin","rb")) == NULL) {\r
+               PrintAndLog("Could not find file keys.bin");\r
+               return 1;\r
+       }\r
+       \r
+       if ((fout = fopen("dumpdata.bin","wb")) == NULL) { \r
+               PrintAndLog("Could not create file name dump.bin");\r
+               return 1;\r
+       }\r
+       \r
+       // Read key file\r
+       \r
+       for (i=0 ; i<16 ; i++) {\r
+               fread ( keyA[i], 1, 6, fin );\r
+       }\r
+       for (i=0 ; i<16 ; i++) {\r
+               fread ( keyB[i], 1, 6, fin );\r
+       }\r
+       \r
+       // Read access rights to sectors\r
+       \r
+       PrintAndLog("|-----------------------------------------|");\r
+       PrintAndLog("|------ Reading sector access bits...-----|");\r
+       PrintAndLog("|-----------------------------------------|");\r
+       \r
+       for (i = 0 ; i < 16 ; i++) {\r
+               UsbCommand c = {CMD_MIFARE_READBL, {4*i + 3, 0, 0}};\r
+               memcpy(c.d.asBytes, keyA[i], 6);\r
+               SendCommand(&c);\r
+               resp = WaitForResponseTimeout(CMD_ACK, 1500);\r
+\r
+               if (resp != NULL) {\r
+                       uint8_t isOK  = resp->arg[0] & 0xff;\r
+                       uint8_t *data  = resp->d.asBytes;\r
+                       if (isOK){\r
+                               rights[i][0] = ((data[7] & 0x10)>>4) | ((data[8] & 0x1)<<1) | ((data[8] & 0x10)>>2);\r
+                               rights[i][1] = ((data[7] & 0x20)>>5) | ((data[8] & 0x2)<<0) | ((data[8] & 0x20)>>3);\r
+                               rights[i][2] = ((data[7] & 0x40)>>6) | ((data[8] & 0x4)>>1) | ((data[8] & 0x40)>>4);\r
+                               rights[i][3] = ((data[7] & 0x80)>>7) | ((data[8] & 0x8)>>2) | ((data[8] & 0x80)>>5);\r
+                               }\r
+                       else{\r
+                               PrintAndLog("Could not get access rights for block %d", i);\r
+                       }\r
+               }\r
+               else {\r
+                       PrintAndLog("Command execute timeout");\r
+               }\r
+       }\r
+       \r
+       // Read blocks and print to file\r
+       \r
+       PrintAndLog("|-----------------------------------------|");\r
+       PrintAndLog("|----- Dumping all blocks to file... -----|");\r
+       PrintAndLog("|-----------------------------------------|");\r
+       \r
+       for (i=0 ; i<16 ; i++) {\r
+               for (j=0 ; j<4 ; j++) {\r
+                       \r
+                       if (j == 3){\r
+                               UsbCommand c = {CMD_MIFARE_READBL, {i*4 + j, 0, 0}};\r
+                               memcpy(c.d.asBytes, keyA[i], 6);\r
+                               SendCommand(&c);\r
+                               resp = WaitForResponseTimeout(CMD_ACK, 1500);\r
+                       }\r
+                       else{\r
+                               if ((rights[i][j] == 6) | (rights[i][j] == 5)) {\r
+                                       UsbCommand c = {CMD_MIFARE_READBL, {i*4+j, 1, 0}};\r
+                                       memcpy(c.d.asBytes, keyB[i], 6);\r
+                                       SendCommand(&c);\r
+                                       resp = WaitForResponseTimeout(CMD_ACK, 1500);\r
+                               }\r
+                               else if (rights[i][j] == 7) {\r
+                                       PrintAndLog("Access rights do not allow reading of sector %d block %d",i,j);\r
+                               }\r
+                               else {\r
+                                       UsbCommand c = {CMD_MIFARE_READBL, {i*4+j, 0, 0}};\r
+                                       memcpy(c.d.asBytes, keyA[i], 6);\r
+                                       SendCommand(&c);\r
+                                       resp = WaitForResponseTimeout(CMD_ACK, 1500);\r
+                               }\r
+                       }\r
+\r
+                       if (resp != NULL) {\r
+                               uint8_t isOK  = resp->arg[0] & 0xff;\r
+                               uint8_t *data  = resp->d.asBytes;\r
+                               if (isOK) {\r
+                                       fwrite ( data, 1, 16, fout );\r
+                               }\r
+                               else {\r
+                                       PrintAndLog("Could not get access rights for block %d", i);\r
+                               }\r
+                       }\r
+                       else {\r
+                               PrintAndLog("Command execute timeout");\r
+                       }\r
+               }\r
+       }\r
+       \r
+       fclose(fin);\r
+       fclose(fout);\r
+       \r
+  return 0;\r
+}\r
+\r
+int CmdHF14AMfRestore1k(const char *Cmd)\r
+{\r
+\r
+       int i,j;\r
+       uint8_t blockNo = 0;\r
+       uint8_t keyType = 0;\r
+       uint8_t key[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};\r
+       uint8_t bldata[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};\r
+       uint8_t keyA[16][6];\r
+       uint8_t keyB[16][6];\r
+       \r
+       char cmdp = 0x00;\r
+       \r
+       FILE *fdump;\r
+       FILE *fkeys;\r
+       \r
+       FILE *fdebug = fopen("debug.bin","wb");\r
+       \r
+       if ((fdump = fopen("dumpdata.bin","rb")) == NULL) {\r
+               PrintAndLog("Could not find file dump.bin");\r
+               return 1;\r
+       }\r
+       if ((fkeys = fopen("dumpkeys.bin","rb")) == NULL) {\r
+               PrintAndLog("Could not find file keys.bin");\r
+               return 1;\r
+       }\r
+       \r
+       for (i=0 ; i<16 ; i++) {\r
+               fread(keyA[i], 1, 6, fkeys);\r
+       }\r
+       for (i=0 ; i<16 ; i++) {\r
+               fread(keyB[i], 1, 6, fkeys);\r
+       }\r
+       \r
+       PrintAndLog("going...");\r
+\r
+       for (i=0 ; i<16 ; i++) {\r
+               for( j=0 ; j<4 ; j++) {\r
+                       UsbCommand c = {CMD_MIFARE_WRITEBL, {i*4 + j, keyType, 0}};\r
+                       memcpy(c.d.asBytes, key, 6);\r
+                       \r
+                       fread(bldata, 1, 16, fdump);\r
+                                       \r
+                       if (j == 3) {\r
+                               bldata[0]  = (keyA[i][0]);\r
+                               bldata[1]  = (keyA[i][1]);\r
+                               bldata[2]  = (keyA[i][2]);\r
+                               bldata[3]  = (keyA[i][3]);\r
+                               bldata[4]  = (keyA[i][4]);\r
+                               bldata[5]  = (keyA[i][5]);\r
+                               bldata[10] = (keyB[i][0]);\r
+                               bldata[11] = (keyB[i][1]);\r
+                               bldata[12] = (keyB[i][2]);\r
+                               bldata[13] = (keyB[i][3]);\r
+                               bldata[14] = (keyB[i][4]);\r
+                               bldata[15] = (keyB[i][5]);\r
+                       }               \r
+                       \r
+                       PrintAndLog("writing to block %2d: %s confirm?", i*4+j, sprint_hex(bldata, 16));\r
+                       \r
+                       memcpy(c.d.asBytes + 10, bldata, 16);\r
+                       SendCommand(&c);\r
+                       UsbCommand *resp = WaitForResponseTimeout(CMD_ACK, 1500);\r
+\r
+                       if (resp != NULL) {\r
+                               uint8_t isOK  = resp->arg[0] & 0xff;\r
+                               PrintAndLog("isOk:%02x", isOK);\r
+                       } else {\r
+                               PrintAndLog("Command execute timeout");\r
+                       }\r
+               }\r
+       }\r
+       \r
+       fclose(fdump);\r
+       fclose(fkeys);\r
+       return 0;\r
+}\r
+\r

 int CmdHF14AMfNested(const char *Cmd)\r
 {\r
        int i, j, res, iterations;\r
 int CmdHF14AMfNested(const char *Cmd)\r
 {\r
        int i, j, res, iterations;\r


@@ -271,18 +470,23 @@ int CmdHF14AMfNested(const char *Cmd)
        uint64_t key64 = 0;\r
        int transferToEml = 0;\r
        \r
        uint64_t key64 = 0;\r
        int transferToEml = 0;\r
        \r

+       int createDumpFile = 0;\r
+       FILE *fkeys;\r
+       \r

        char cmdp, ctmp;\r
 \r
        if (strlen(Cmd)<3) {\r
                PrintAndLog("Usage:");\r
        char cmdp, ctmp;\r
 \r
        if (strlen(Cmd)<3) {\r
                PrintAndLog("Usage:");\r

-               PrintAndLog(" all sectors:  hf mf nested  <card memory> <block number> <key A/B> <key (12 hex symbols)> [t]");\r
+               PrintAndLog(" all sectors:  hf mf nested  <card memory> <block number> <key A/B> <key (12 hex symbols)> [t,d]");\r

                PrintAndLog(" one sector:   hf mf nested  o <block number> <key A/B> <key (12 hex symbols)>");\r
                PrintAndLog("               <target block number> <target key A/B> [t]");\r
                PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");\r
                PrintAndLog("t - transfer keys into emulator memory");\r
                PrintAndLog(" one sector:   hf mf nested  o <block number> <key A/B> <key (12 hex symbols)>");\r
                PrintAndLog("               <target block number> <target key A/B> [t]");\r
                PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");\r
                PrintAndLog("t - transfer keys into emulator memory");\r

+               PrintAndLog("d - write keys to binary file");\r

                PrintAndLog(" ");\r
                PrintAndLog("      sample1: hf mf nested 1 0 A FFFFFFFFFFFF ");\r
                PrintAndLog("      sample1: hf mf nested 1 0 A FFFFFFFFFFFF t ");\r
                PrintAndLog(" ");\r
                PrintAndLog("      sample1: hf mf nested 1 0 A FFFFFFFFFFFF ");\r
                PrintAndLog("      sample1: hf mf nested 1 0 A FFFFFFFFFFFF t ");\r

+               PrintAndLog("      sample1: hf mf nested 1 0 A FFFFFFFFFFFF d ");\r

                PrintAndLog("      sample2: hf mf nested o 0 A FFFFFFFFFFFF 4 A");\r
                return 0;\r
        }       \r
                PrintAndLog("      sample2: hf mf nested o 0 A FFFFFFFFFFFF 4 A");\r
                return 0;\r
        }       \r


@@ -323,6 +527,7 @@ int CmdHF14AMfNested(const char *Cmd)
        if (ctmp == 't' || ctmp == 'T') transferToEml = 1;\r
        ctmp = param_getchar(Cmd, 6);\r
        transferToEml |= (ctmp == 't' || ctmp == 'T');\r
        if (ctmp == 't' || ctmp == 'T') transferToEml = 1;\r
        ctmp = param_getchar(Cmd, 6);\r
        transferToEml |= (ctmp == 't' || ctmp == 'T');\r

+       createDumpFile |= (ctmp == 'd' || ctmp == 'D');\r

        \r
        PrintAndLog("--block no:%02x key type:%02x key:%s etrans:%d", blockNo, keyType, sprint_hex(key, 6), transferToEml);\r
        if (cmdp == 'o')\r
        \r
        PrintAndLog("--block no:%02x key type:%02x key:%s etrans:%d", blockNo, keyType, sprint_hex(key, 6), transferToEml);\r
        if (cmdp == 'o')\r


@@ -434,6 +639,21 @@ int CmdHF14AMfNested(const char *Cmd)
                        }               \r
                }\r
                \r
                        }               \r
                }\r
                \r

+               if (createDumpFile) {\r
+                       if ((fkeys = fopen("dumpkeys.bin","wb")) == NULL) { \r
+                               rintAndLog("Could not create file keys.bin");\r
+                               free(e_sector);\r
+                               return 1;\r
+                       }\r
+                       for(i=0; i<16; i++) {\r
+                               fwrite ( e_sector[i].Key[0], sizeof(e_sector[i].Key[0]), 1, fkeys );\r
+                       }\r
+                       for(i=0; i<16; i++) {\r
+                               fwrite ( e_sector[i].Key[1], sizeof(e_sector[i].Key[1]), 1, fkeys );\r
+                       }\r
+                       fclose(fkeys);\r
+               }\r
+               \r

                free(e_sector);\r
        }\r
 \r
                free(e_sector);\r
        }\r
 \r


@@ -739,7 +959,8 @@ int CmdHF14AMfESave(const char *Cmd)
   return 0;\r
 }\r
 \r
   return 0;\r
 }\r
 \r

-int CmdHF14AMfECFill(const char *Cmd) {\r
+int CmdHF14AMfECFill(const char *Cmd)\r
+{\r

        uint8_t keyType = 0;\r
 \r
        if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {\r
        uint8_t keyType = 0;\r
 \r
        if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {\r


@@ -762,7 +983,8 @@ int CmdHF14AMfECFill(const char *Cmd) {
   return 0;\r
 }\r
 \r
   return 0;\r
 }\r
 \r

-int CmdHF14AMfEKeyPrn(const char *Cmd) {\r
+int CmdHF14AMfEKeyPrn(const char *Cmd)\r
+{\r

        int i;\r
        uint8_t data[16];\r
        uint64_t keyA, keyB;\r
        int i;\r
        uint8_t data[16];\r
        uint64_t keyA, keyB;\r


@@ -784,17 +1006,19 @@ int CmdHF14AMfEKeyPrn(const char *Cmd) {
        return 0;\r
 }\r
 \r
        return 0;\r
 }\r
 \r

-static command_t CommandTable[] = \r
+static command_t CommandTable[] =\r

 {\r
 {\r

-  {"help",             CmdHelp,                                                1, "This help"},\r
-  {"dbg",                      CmdHF14AMfDbg,                  0, "Set default debug mode"},\r
+  {"help",             CmdHelp,                                1, "This help"},\r
+  {"dbg",              CmdHF14AMfDbg,                  0, "Set default debug mode"},\r

   {"rdbl",             CmdHF14AMfRdBl,                 0, "Read MIFARE classic block"},\r
   {"rdsc",             CmdHF14AMfRdSc,                 0, "Read MIFARE classic sector"},\r
   {"rdbl",             CmdHF14AMfRdBl,                 0, "Read MIFARE classic block"},\r
   {"rdsc",             CmdHF14AMfRdSc,                 0, "Read MIFARE classic sector"},\r

+  {"dump1k",   CmdHF14AMfDump1k,               0, "Dump MIFARE classic tag to binary file"},\r
+  {"restore1k",        CmdHF14AMfRestore1k,    0, "Restore MIFARE classic binary file to BLANK tag"},\r

   {"wrbl",             CmdHF14AMfWrBl,                 0, "Write MIFARE classic block"},\r
   {"wrbl",             CmdHF14AMfWrBl,                 0, "Write MIFARE classic block"},\r

-  {"chk",                      CmdHF14AMfChk,                  0, "Test block up to 8 keys"},\r
+  {"chk",              CmdHF14AMfChk,                  0, "Test block up to 8 keys"},\r

   {"mifare",   CmdHF14AMifare,                 0, "Read parity error messages. param - <used card nonce>"},\r
   {"nested",   CmdHF14AMfNested,               0, "Test nested authentication"},\r
   {"mifare",   CmdHF14AMifare,                 0, "Read parity error messages. param - <used card nonce>"},\r
   {"nested",   CmdHF14AMfNested,               0, "Test nested authentication"},\r

-  {"sim",                      CmdHF14AMf1kSim,                0, "Simulate MIFARE 1k card"},\r
+  {"sim",              CmdHF14AMf1kSim,                0, "Simulate MIFARE 1k card"},\r

   {"eclr",     CmdHF14AMfEClear,               0, "Clear simulator memory block"},\r
   {"eget",             CmdHF14AMfEGet,                 0, "Get simulator memory block"},\r
   {"eset",             CmdHF14AMfESet,                 0, "Set simulator memory block"},\r
   {"eclr",     CmdHF14AMfEClear,               0, "Clear simulator memory block"},\r
   {"eget",             CmdHF14AMfEGet,                 0, "Get simulator memory block"},\r
   {"eset",             CmdHF14AMfESet,                 0, "Set simulator memory block"},\r