support parity attack for any block

diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index 475b1c1b8e7e2a3e593d9dde365e70b5229a50a5..4807bc1bc807d4035c8b4b9d92e55dcc6d9c9581 100644 (file)
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -1110,7 +1110,7 @@ void UsbPacketReceived(uint8_t *packet, int len)
                        break;
                        
                case CMD_READER_MIFARE:
-                       ReaderMifare(c->arg[0]);
+                       ReaderMifare(c->arg[0], c->arg[1], c->arg[2]);
                        break;
                case CMD_MIFARE_READBL:
                        MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

diff --git a/armsrc/apps.h b/armsrc/apps.h
index 4d4c80837ef72747387e699a98536fa4d3d7abaf..bef48d3e884193d722f1d8c053ac2055c56a3d87 100644 (file)
--- a/armsrc/apps.h
+++ b/armsrc/apps.h
@@ -113,7 +113,7 @@ void EPA_PACE_Collect_Nonce(UsbCommand * c);
 void EPA_PACE_Replay(UsbCommand *c);
 
 // mifarecmd.h
-void ReaderMifare(bool first_try);
+void ReaderMifare(bool first_try, uint8_t blockNo, uint8_t keyType);
 int32_t dist_nt(uint32_t nt1, uint32_t nt2);
 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *data);
 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain);

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 27574dad2601cceda2f59b785445a1915a958892..5a602c79b00ef6f57ffea88d53666d72ca2a415b 100644 (file)
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -2022,16 +2022,18 @@ int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
 // Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
 // (article by Nicolas T. Courtois, 2009)
 //-----------------------------------------------------------------------------
-void ReaderMifare(bool first_try)
+void ReaderMifare(bool first_try, uint8_t blockNo, uint8_t keyType)
 {
        // Mifare AUTH
-       uint8_t mf_auth[]    = { 0x60,0x00,0xf5,0x7b };
+       uint8_t mf_auth[]    = { 0x60 + (keyType & 0x01), blockNo ,0x00,0x00 };
        uint8_t mf_nr_ar[]   = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
        static uint8_t mf_nr_ar3;
 
        uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
        uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
 
+       AppendCrc14443a(mf_auth, 2);
+
        if (first_try) { 
                iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
        }

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 48e78b1c2fcad2a74a90de187356d346ed54492c..181c93160d4c07133c8cc65d24c67d204ba79618 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -19,7 +19,24 @@ int CmdHF14AMifare(const char *Cmd)
        uint64_t par_list = 0, ks_list = 0, r_key = 0;\r
        int16_t isOK = 0;\r
 \r
-       UsbCommand c = {CMD_READER_MIFARE, {true, 0, 0}};\r
+       uint8_t blockNo = 0, keyType = 0;\r
+       char cmdp       = 0x00;\r
+\r
+       if (strlen(Cmd)<3) {\r
+               PrintAndLog("Usage:  hf mf mifare <block number> <key A/B>");\r
+               PrintAndLog("        sample: hf mf mi 0 A");\r
+               return 0;\r
+       }       \r
+\r
+       blockNo = param_get8(Cmd, 0);\r
+       cmdp = param_getchar(Cmd, 1);\r
+       if (cmdp == 0x00) {\r
+               PrintAndLog("Key type must be A or B");\r
+               return 1;\r
+       }\r
+       if (cmdp != 'A' && cmdp != 'a') keyType = 1;\r
+\r
+       UsbCommand c = {CMD_READER_MIFARE, {true, blockNo, keyType}};\r
 \r
        // message\r
        printf("-------------------------------------------------------------------------\n");\r