uint32_t next_fivehundred = 500;
uint32_t total_added_nonces = 0;
uint32_t idx = 1;
+ uint32_t timeout = 0;
FILE *fnonces = NULL;
field_off = false;
UsbCommand resp;
if (field_off) break;
- if (!WaitForResponseTimeout(CMD_ACK, &resp, 6000)) {
- if (fnonces) fclose(fnonces);
- return 1;
- }
+ while(!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
+ timeout++;
+ printf(".");
+ if (timeout > 7) {
+ PrintAndLog("\nNo response from Proxmark. Aborting...");
+ if (fnonces) fclose(fnonces);
+ return 1;
+ }
+ }
if (resp.arg[0]) {
if (fnonces) fclose(fnonces);
return ret;
}
-int mfnestedhard(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *trgkey, bool nonce_file_read, bool nonce_file_write, bool slow, int tests)
+int mfnestedhard(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *trgkey, bool nonce_file_read, bool nonce_file_write, bool slow, int tests, uint64_t *found_key)
{
// initialize Random number generator
time_t t;
srand((unsigned) time(&t));
+ *found_key = 0;
+
if (trgkey != NULL) {
known_target_key = bytes_to_num(trgkey, 6);
} else {
free_candidates_memory(candidates);
candidates = NULL;
}
+ *found_key = foundkey;
return 0;
-}
+}
\ No newline at end of file
return 1;
}
+static int l_hardnested(lua_State *L){
+
+ bool haveTarget = TRUE;
+ size_t size;
+ const char *p_blockno = luaL_checklstring(L, 1, &size);
+ if(size != 2) return returnToLuaWithError(L,"Wrong size of blockNo, got %d bytes, expected 2", (int) size);
+
+ const char *p_keytype = luaL_checklstring(L, 2, &size);
+ if(size != 1) return returnToLuaWithError(L,"Wrong size of keyType, got %d bytes, expected 1", (int) size);
+
+ const char *p_key = luaL_checklstring(L, 3, &size);
+ if(size != 12) return returnToLuaWithError(L,"Wrong size of key, got %d bytes, expected 12", (int) size);
+
+ const char *p_trg_blockno = luaL_checklstring(L, 4, &size);
+ if(size != 2) return returnToLuaWithError(L,"Wrong size of trgBlockNo, got %d bytes, expected 2", (int) size);
+
+ const char *p_trg_keytype = luaL_checklstring(L, 5, &size);
+ if(size != 1) return returnToLuaWithError(L,"Wrong size of trgKeyType, got %d bytes, expected 1", (int) size);
+
+ const char *p_trgkey = luaL_checklstring(L, 6, &size);
+ if(size != 12)
+ haveTarget = FALSE;
+
+ const char *p_nonce_file_read = luaL_checklstring(L, 7, &size);
+ if(size != 1) return returnToLuaWithError(L,"Wrong size of nonce_file_read, got %d bytes, expected 1", (int) size);
+
+ const char *p_nonce_file_write = luaL_checklstring(L, 8, &size);
+ if(size != 1) return returnToLuaWithError(L,"Wrong size of nonce_file_write, got %d bytes, expected 1", (int) size);
+
+ const char *p_slow = luaL_checklstring(L, 9, &size);
+ if(size != 1) return returnToLuaWithError(L,"Wrong size of slow, got %d bytes, expected 1", (int) size);
+
+ const char *p_tests = luaL_checklstring(L, 10, &size);
+ if(size != 1) return returnToLuaWithError(L,"Wrong size of tests, got %d bytes, expected 1", (int) size);
+
+ uint32_t blockNo = 0, keyType = 0;
+ uint32_t trgBlockNo = 0, trgKeyType = 0;
+ uint32_t slow = 0, tests = 0;
+ uint32_t nonce_file_read = 0, nonce_file_write = 0;
+
+ sscanf(p_blockno, "%02x", &blockNo);
+ sscanf(p_keytype, "%x", &keyType);
+ sscanf(p_trg_blockno, "%02x", &trgBlockNo);
+ sscanf(p_trg_keytype, "%x", &trgKeyType);
+ sscanf(p_nonce_file_read, "%x", &nonce_file_read);
+ sscanf(p_nonce_file_write, "%x", &nonce_file_write);
+
+ sscanf(p_slow, "%x", &slow);
+ sscanf(p_tests, "%x", &tests);
+
+ uint8_t key[6] = {0,0,0,0,0,0};
+ uint8_t trgkey[6] = {0,0,0,0,0,0};
+ for (int i = 0; i < 32; i += 2) {
+ sscanf(&p_key[i], "%02x", (unsigned int *)&key[i / 2]);
+ if (haveTarget)
+ sscanf(&p_trgkey[i], "%02x", (unsigned int *)&trgkey[i / 2]);
+ }
+
+ uint64_t foundkey = 0;
+ int retval = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, haveTarget ? trgkey : NULL, nonce_file_read, nonce_file_write, slow, tests, &foundkey);
+
+ //Push the retval on the stack
+ lua_pushinteger(L,retval);
+
+ //Push the key onto the stack
+ uint8_t dest_key[6];
+ num_to_bytes(foundkey, sizeof(dest_key), dest_key);
+
+ //printf("Pushing to lua stack: %012"llx"\n",key);
+ lua_pushlstring(L, (const char *) dest_key, sizeof(dest_key));
+ return 2; //Two return values
+}
+
/**
* @brief Sets the lua path to include "./lualibs/?.lua", in order for a script to be
* able to do "require('foobar')" if foobar.lua is within lualibs folder.
int set_pm3_libraries(lua_State *L)
{
-
static const luaL_Reg libs[] = {
{"SendCommand", l_SendCommand},
{"WaitForResponseTimeout", l_WaitForResponseTimeout},
{"sha1", l_sha1},
{"reveng_models", l_reveng_models},
{"reveng_runmodel", l_reveng_RunModel},
+ {"hardnested", l_hardnested},
{NULL, NULL}
};
--- /dev/null
+local cmds = require('commands')
+local getopt = require('getopt')
+local utils = require('utils')
+local lib14a = require('read14a')
+
+example = "script iterates over all possible sectors for a tag and runs hardnested attack against them to collect the keys."
+author = "Iceman"
+desc =
+[[
+This script iterates over all possible sectors for a tag and runs hardnested attack against them to collect the keys.
+
+Arguments:
+ -k Known key, 6 bytes (12 hex digits)
+Examples :
+ script hard -b 112233445566
+]]
+
+local numBlocks = 64
+local numSectors = 16
+local DEBUG = TRUE
+---
+-- A debug printout-function
+function dbg(args)
+ if not DEBUG then return end
+
+ if type(args) == "table" then
+ local i = 1
+ while result[i] do
+ dbg(result[i])
+ i = i+1
+ end
+ else
+ print("###", args)
+ end
+end
+---
+-- This is only meant to be used when errors occur
+function oops(err)
+ print("ERROR: ",err)
+ return nil,err
+end
+---
+-- Usage help
+function help()
+ print(desc)
+ print("Example usage")
+ print(example)
+end
+--
+-- Exit message
+function ExitMsg(msg)
+ print( string.rep('--',20) )
+ print( string.rep('--',20) )
+ print(msg)
+ print()
+end
+---
+-- a simple selftest function,
+local function selftest()
+ return nil
+end
+
+---
+-- The main entry point
+function main(args)
+
+ local blockno = '00'
+ local keytype = 0 --A 01==B
+ local key = 'fc00018778f7'
+ local trgkey = ''
+
+ local data
+ -- Read the parameters
+ for o, a in getopt.getopt(args, 'hk:t') do
+ if o == "h" then return help() end
+ if o == "k" then key = a end
+ if o == "t" then return selftest() end
+ end
+
+ -- Turn off Debug
+ local cmdSetDbgOff = "hf mf dbg 0"
+ core.console( cmdSetDbgOff)
+ -- identify tag
+ result, err = lib14a.read1443a(false)
+ if not result then
+ return oops(err)
+ end
+ core.clearCommandBuffer()
+
+ -- Show tag info
+ print((' Found tag %s'):format(result.name))
+
+ local keys = {}
+ -- loop
+ for i=4, 12 , 4 do
+ for trgkeytype=0,1 do
+ local trgblockno = ("%02d"):format(i)
+ local err, found_key = core.hardnested(blockno, keytype, key, trgblockno, trgkeytype, trgkey, 0,0,0,0)
+
+ table.insert( keys , { ["success"] = err, ["sector"] = i, ["type"] = trgkeytype, ["key"] = utils.ConvertAsciiToHex(found_key) } )
+ end
+ end
+ --print
+ for k,v in pairs(keys) do
+ for a,b in pairs(v) do print(a,b) end
+ end
+end
+
+main(args)
\ No newline at end of file
projects / proxmark3-svn / commitdiff