From: Oleg Moiseenko <olegmsn@gmail.com>
Date: Thu, 5 Oct 2017 11:37:51 +0000 (+0300)
Subject: hf mf nested add some functionality (#403)
X-Git-Tag: v3.1.0~163
X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/commitdiff_plain/adf023ffe3f6d4490d534e48a66a6c6387a7c53e
hf mf nested add some functionality (#403)
* Added nested auto mode. it checks known keys and then launches nested
* Check if we allready have all keys after nested
---
diff --git a/CHANGELOG.md b/CHANGELOG.md
index da0e30ad..842c8bef 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,8 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
### Changed
- Improved backdoor detection missbehaving magic s50/1k tag (Fl0-0)
- Deleted wipe functionality from `hf mf csetuid` (Merlok)
+- Changed `hf mf nested` logic (Merlok)
+- Added `hf mf nested` mode: autosearch keys for attack (from well known keys) (Merlok)
### Fixed
@@ -19,6 +21,8 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
- Added data fsktonrz, a fsk cleaning/demodulating routine for weak fsk signal. Note: follow this up with a `data rawdemod nr` to finish demoding your signal. (marshmellow)
- Added lf em 410xbrute, LF EM410x reader bruteforce attack by simulating UIDs from a file (Fl0-0)
- Added `hf mf cwipe` command. It wipes "magic Chinese" card. For 1a generation it uses card's "wipe" command. For gen1a and gen1b it uses a write command. (Merlok)
+- Added to `hf mf nested` source key check before attack (Merlok)
+- Added to `hf mf nested` after attack it checks all found keys on non-open sectors (Merlok)
## [3.0.1][2017-06-08]
diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index aafbce2a..295f22b7 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -222,6 +222,28 @@ uint8_t NumBlocksPerSector(uint8_t sectorNo)
}
}
+static int ParamCardSizeSectors(const char c) {
+ int numBlocks = 16;
+ switch (c) {
+ case '0' : numBlocks = 5; break;
+ case '2' : numBlocks = 32; break;
+ case '4' : numBlocks = 40; break;
+ default: numBlocks = 16;
+ }
+ return numBlocks;
+}
+
+static int ParamCardSizeBlocks(const char c) {
+ int numBlocks = 16 * 4;
+ switch (c) {
+ case '0' : numBlocks = 5 * 4; break;
+ case '2' : numBlocks = 32 * 4; break;
+ case '4' : numBlocks = 32 * 4 + 8 * 16; break;
+ default: numBlocks = 16 * 4;
+ }
+ return numBlocks;
+}
+
int CmdHF14AMfDump(const char *Cmd)
{
uint8_t sectorNo, blockNo;
@@ -238,14 +260,7 @@ int CmdHF14AMfDump(const char *Cmd)
UsbCommand resp;
char cmdp = param_getchar(Cmd, 0);
- switch (cmdp) {
- case '0' : numSectors = 5; break;
- case '1' :
- case '\0': numSectors = 16; break;
- case '2' : numSectors = 32; break;
- case '4' : numSectors = 40; break;
- default: numSectors = 16;
- }
+ numSectors = ParamCardSizeSectors(cmdp);
if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
PrintAndLog("Usage: hf mf dump [card memory]");
@@ -516,6 +531,7 @@ typedef struct {
} sector_t;
+# define NESTED_KEY_COUNT 15
int CmdHF14AMfNested(const char *Cmd)
{
int i, j, res, iterations;
@@ -526,10 +542,12 @@ int CmdHF14AMfNested(const char *Cmd)
uint8_t trgKeyType = 0;
uint8_t SectorsCnt = 0;
uint8_t key[6] = {0, 0, 0, 0, 0, 0};
- uint8_t keyBlock[14*6];
+ uint8_t keyBlock[NESTED_KEY_COUNT * 6];
uint64_t key64 = 0;
- bool transferToEml = false;
+
+ bool autosearchKey = false;
+ bool transferToEml = false;
bool createDumpFile = false;
FILE *fkeys;
uint8_t standart[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
@@ -540,66 +558,90 @@ int CmdHF14AMfNested(const char *Cmd)
if (strlen(Cmd)<3) {
PrintAndLog("Usage:");
PrintAndLog(" all sectors: hf mf nested <card memory> <block number> <key A/B> <key (12 hex symbols)> [t,d]");
+ PrintAndLog(" all sectors autosearch key: hf mf nested <card memory> * [t,d]");
PrintAndLog(" one sector: hf mf nested o <block number> <key A/B> <key (12 hex symbols)>");
PrintAndLog(" <target block number> <target key A/B> [t]");
+ PrintAndLog(" ");
PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");
- PrintAndLog("t - transfer keys into emulator memory");
- PrintAndLog("d - write keys to binary file");
+ PrintAndLog("t - transfer keys to emulator memory");
+ PrintAndLog("d - write keys to binary file dumpkeys.bin");
PrintAndLog(" ");
PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF ");
PrintAndLog(" sample2: hf mf nested 1 0 A FFFFFFFFFFFF t ");
PrintAndLog(" sample3: hf mf nested 1 0 A FFFFFFFFFFFF d ");
PrintAndLog(" sample4: hf mf nested o 0 A FFFFFFFFFFFF 4 A");
+ PrintAndLog(" sample5: hf mf nested 1 * t");
return 0;
}
+ // <card memory>
cmdp = param_getchar(Cmd, 0);
- blockNo = param_get8(Cmd, 1);
- ctmp = param_getchar(Cmd, 2);
-
- if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {
- PrintAndLog("Key type must be A or B");
- return 1;
+ if (cmdp == 'o' || cmdp == 'O') {
+ cmdp = 'o';
+ SectorsCnt = 1;
+ } else {
+ SectorsCnt = ParamCardSizeSectors(cmdp);
}
+
+ // <block number>. number or autosearch key (*)
+ if (param_getchar(Cmd, 1) == '*') {
+ autosearchKey = true;
- if (ctmp != 'A' && ctmp != 'a')
- keyType = 1;
+ ctmp = param_getchar(Cmd, 2);
+ transferToEml |= (ctmp == 't' || ctmp == 'T');
+ createDumpFile |= (ctmp == 'd' || ctmp == 'D');
- if (param_gethex(Cmd, 3, key, 12)) {
- PrintAndLog("Key must include 12 HEX symbols");
- return 1;
- }
+ PrintAndLog("--nested. sectors:%2d, block no:*, eml:%c, dmp=%c ", SectorsCnt, transferToEml?'y':'n', createDumpFile?'y':'n');
+ } else {
+ blockNo = param_get8(Cmd, 1);
- if (cmdp == 'o' || cmdp == 'O') {
- cmdp = 'o';
- trgBlockNo = param_get8(Cmd, 4);
- ctmp = param_getchar(Cmd, 5);
+ ctmp = param_getchar(Cmd, 2);
if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {
- PrintAndLog("Target key type must be A or B");
+ PrintAndLog("Key type must be A or B");
return 1;
}
+
if (ctmp != 'A' && ctmp != 'a')
- trgKeyType = 1;
- } else {
+ keyType = 1;
- switch (cmdp) {
- case '0': SectorsCnt = 05; break;
- case '1': SectorsCnt = 16; break;
- case '2': SectorsCnt = 32; break;
- case '4': SectorsCnt = 40; break;
- default: SectorsCnt = 16;
+ if (param_gethex(Cmd, 3, key, 12)) {
+ PrintAndLog("Key must include 12 HEX symbols");
+ return 1;
}
- }
- ctmp = param_getchar(Cmd, 4);
- if (ctmp == 't' || ctmp == 'T') transferToEml = true;
- else if (ctmp == 'd' || ctmp == 'D') createDumpFile = true;
+ // check if we can authenticate to sector
+ res = mfCheckKeys(blockNo, keyType, true, 1, key, &key64);
+ if (res) {
+ PrintAndLog("Can't authenticate to block:%3d key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));
+ return 3;
+ }
- ctmp = param_getchar(Cmd, 6);
- transferToEml |= (ctmp == 't' || ctmp == 'T');
- transferToEml |= (ctmp == 'd' || ctmp == 'D');
+ // one sector nested
+ if (cmdp == 'o') {
+ trgBlockNo = param_get8(Cmd, 4);
- if (cmdp == 'o') {
+ ctmp = param_getchar(Cmd, 5);
+ if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {
+ PrintAndLog("Target key type must be A or B");
+ return 1;
+ }
+ if (ctmp != 'A' && ctmp != 'a')
+ trgKeyType = 1;
+
+ ctmp = param_getchar(Cmd, 6);
+ transferToEml |= (ctmp == 't' || ctmp == 'T');
+ createDumpFile |= (ctmp == 'd' || ctmp == 'D');
+ } else {
+ ctmp = param_getchar(Cmd, 4);
+ transferToEml |= (ctmp == 't' || ctmp == 'T');
+ createDumpFile |= (ctmp == 'd' || ctmp == 'D');
+ }
+
+ PrintAndLog("--nested. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c ", SectorsCnt, blockNo, keyType?'B':'A', transferToEml?'y':'n', createDumpFile?'y':'n');
+ }
+
+ // one-sector nested
+ if (cmdp == 'o') { // ------------------------------------ one sector working
PrintAndLog("--target block no:%3d, target key type:%c ", trgBlockNo, trgKeyType?'B':'A');
int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true);
if (isOK) {
@@ -630,6 +672,7 @@ int CmdHF14AMfNested(const char *Cmd)
else
num_to_bytes(key64, 6, &keyBlock[10]);
mfEmlSetMem(keyBlock, sectortrailer, 1);
+ PrintAndLog("Key transferred to emulator memory.");
}
} else {
PrintAndLog("No valid key found");
@@ -657,13 +700,14 @@ int CmdHF14AMfNested(const char *Cmd)
num_to_bytes(0xa0478cc39091, 6, (uint8_t*)(keyBlock + 11 * 6));
num_to_bytes(0x533cb6c723f6, 6, (uint8_t*)(keyBlock + 12 * 6));
num_to_bytes(0x8fd0a4f256e9, 6, (uint8_t*)(keyBlock + 13 * 6));
+ num_to_bytes(0x1a2b3c4d5e6f, 6, (uint8_t*)(keyBlock + 14 * 6));
PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt);
for (i = 0; i < SectorsCnt; i++) {
for (j = 0; j < 2; j++) {
if (e_sector[i].foundKey[j]) continue;
- res = mfCheckKeys(FirstBlockOfSector(i), j, true, 6, keyBlock, &key64);
+ res = mfCheckKeys(FirstBlockOfSector(i), j, true, NESTED_KEY_COUNT, keyBlock, &key64);
if (!res) {
e_sector[i].Key[j] = key64;
@@ -671,6 +715,32 @@ int CmdHF14AMfNested(const char *Cmd)
}
}
}
+
+ // get known key from array
+ bool keyFound = false;
+ if (autosearchKey) {
+ for (i = 0; i < SectorsCnt; i++) {
+ for (j = 0; j < 2; j++) {
+ if (e_sector[i].foundKey[j]) {
+ // get known key
+ blockNo = i * 4;
+ keyType = j;
+ num_to_bytes(e_sector[i].Key[j], 6, key);
+
+ keyFound = true;
+ break;
+ }
+ }
+ if (keyFound) break;
+ }
+
+ // Can't found a key....
+ if (!keyFound) {
+ PrintAndLog("Can't found any of the known keys.");
+ return 4;
+ }
+ PrintAndLog("--auto key. block no:%3d, key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));
+ }
// nested sectors
iterations = 0;
@@ -707,10 +777,71 @@ int CmdHF14AMfNested(const char *Cmd)
}
}
- printf("Time in nested: %1.3f (%1.3f sec per key)\n\n", ((float)(msclock() - msclock1))/1000.0, ((float)(msclock() - msclock1))/iterations/1000.0);
+ // print nested statistic
+ PrintAndLog("\n\n-----------------------------------------------\nNested statistic:\nIterations count: %d", iterations);
+ PrintAndLog("Time in nested: %1.3f (%1.3f sec per key)", ((float)(msclock() - msclock1))/1000.0, ((float)(msclock() - msclock1))/iterations/1000.0);
+
+ // check if we have unrecognized keys
+ bool notFoundKeys = false;
+ for (i = 0; i < SectorsCnt; i++) {
+ for (j = 0; j < 2; j++) {
+ if (!e_sector[i].foundKey[j]) {
+ notFoundKeys = true;
+ break;
+ }
+ }
+ if (notFoundKeys) break;
+ }
+
+ if (notFoundKeys) {
+ PrintAndLog("-----------------------------------------------\n");
+ PrintAndLog("We have unrecognized keys. Trying to check if we have this keys on key buffer...");
+
+ // fill keyBlock with known keys
+ int cnt = 0;
+ for (i = 0; i < SectorsCnt; i++) {
+ for (j = 0; j < 2; j++) {
+ if (e_sector[i].foundKey[j]) {
+ // try to insert key to keyBlock
+ if (cnt < NESTED_KEY_COUNT) {
+
+ // search for dublicates
+ bool dubl = false;
+ for (int v = 0; v < NESTED_KEY_COUNT; v++) {
+ if (e_sector[i].Key[j] == bytes_to_num((uint8_t*)(keyBlock + v * 6), 6)) {
+ dubl = true;
+ break;
+ }
+ }
+
+ // insert
+ if (!dubl) {
+ num_to_bytes(e_sector[i].Key[j], 6, (uint8_t*)(keyBlock + cnt * 6));
+ cnt++;
+ }
+ }
+ }
+ }
+ }
- PrintAndLog("-----------------------------------------------\nIterations count: %d\n\n", iterations);
- //print them
+ // try to auth with known keys to not recognized sectors keys
+ PrintAndLog("Testing keys. Sector count=%d known keys count:%d", SectorsCnt, cnt);
+ for (i = 0; i < SectorsCnt; i++) {
+ for (j = 0; j < 2; j++) {
+ if (e_sector[i].foundKey[j]) continue;
+
+ res = mfCheckKeys(FirstBlockOfSector(i), j, true, cnt, keyBlock, &key64);
+
+ if (!res) {
+ e_sector[i].Key[j] = key64;
+ e_sector[i].foundKey[j] = 1;
+ }
+ }
+ }
+
+ } // if (notFoundKeys)
+
+ // print result
PrintAndLog("|---|----------------|---|----------------|---|");
PrintAndLog("|sec|key A |res|key B |res|");
PrintAndLog("|---|----------------|---|----------------|---|");
@@ -720,7 +851,7 @@ int CmdHF14AMfNested(const char *Cmd)
}
PrintAndLog("|---|----------------|---|----------------|---|");
- // transfer them to the emulator
+ // transfer keys to the emulator memory
if (transferToEml) {
for (i = 0; i < SectorsCnt; i++) {
mfEmlGetMem(keyBlock, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1);
@@ -730,6 +861,7 @@ int CmdHF14AMfNested(const char *Cmd)
num_to_bytes(e_sector[i].Key[1], 6, &keyBlock[10]);
mfEmlSetMem(keyBlock, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1);
}
+ PrintAndLog("Keys transferred to emulator memory.");
}
// Create dump file
@@ -946,13 +1078,7 @@ int CmdHF14AMfChk(const char *Cmd)
if (param_getchar(Cmd, 0)=='*') {
blockNo = 3;
- switch(param_getchar(Cmd+1, 0)) {
- case '0': SectorsCnt = 5; break;
- case '1': SectorsCnt = 16; break;
- case '2': SectorsCnt = 32; break;
- case '4': SectorsCnt = 40; break;
- default: SectorsCnt = 16;
- }
+ SectorsCnt = ParamCardSizeSectors(param_getchar(Cmd + 1, 0));
}
else
blockNo = param_get8(Cmd, 0);
@@ -1854,17 +1980,6 @@ int CmdHF14AMfCSetUID(const char *Cmd)
return 0;
}
-static int ParamGetCardSize(const char c) {
- int numBlocks = 16 * 4;
- switch (c) {
- case '0' : numBlocks = 5 * 4; break;
- case '2' : numBlocks = 32 * 4; break;
- case '4' : numBlocks = 32 * 4 + 8 * 16; break;
- default: numBlocks = 16 * 4;
- }
- return numBlocks;
-}
-
int CmdHF14AMfCWipe(const char *Cmd)
{
int res, gen = 0;
@@ -1885,7 +2000,7 @@ int CmdHF14AMfCWipe(const char *Cmd)
if ((gen != 1) && (gen != 2))
return 1;
- numBlocks = ParamGetCardSize(param_getchar(Cmd, 0));
+ numBlocks = ParamCardSizeBlocks(param_getchar(Cmd, 0));
char cmdp = 0;
while(param_getchar(Cmd, cmdp) != 0x00){