From: Oleg Moiseenko <olegmsn@gmail.com>
Date: Thu, 5 Oct 2017 11:37:51 +0000 (+0300)
Subject: hf mf nested add some functionality (#403)
X-Git-Tag: v3.1.0~163
X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/commitdiff_plain/adf023ffe3f6d4490d534e48a66a6c6387a7c53e?ds=sidebyside

hf mf nested add some functionality (#403)

* Added nested auto mode. it checks known keys and then launches nested
* Check if we allready have all keys after nested
---

diff --git a/CHANGELOG.md b/CHANGELOG.md
index da0e30ad..842c8bef 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,8 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 ### Changed
 - Improved backdoor detection missbehaving magic s50/1k tag (Fl0-0)
 - Deleted wipe functionality from `hf mf csetuid` (Merlok)
+- Changed `hf mf nested` logic (Merlok)
+- Added `hf mf nested` mode: autosearch keys for attack (from well known keys) (Merlok)
 
 ### Fixed
 
@@ -19,6 +21,8 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 - Added data fsktonrz, a fsk cleaning/demodulating routine for weak fsk signal. Note: follow this up with a `data rawdemod nr` to finish demoding your signal. (marshmellow)
 - Added lf em 410xbrute, LF EM410x reader bruteforce attack by simulating UIDs from a file (Fl0-0)
 - Added `hf mf cwipe` command. It wipes "magic Chinese" card. For 1a generation it uses card's "wipe" command. For gen1a and gen1b it uses a write command. (Merlok)
+- Added to `hf mf nested` source key check before attack (Merlok)
+- Added to `hf mf nested` after attack it checks all found keys on non-open sectors (Merlok)
 
 ## [3.0.1][2017-06-08]
 
diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index aafbce2a..295f22b7 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -222,6 +222,28 @@ uint8_t NumBlocksPerSector(uint8_t sectorNo)
 	}
 }
 
+static int ParamCardSizeSectors(const char c) {
+	int numBlocks = 16;
+	switch (c) {
+		case '0' : numBlocks = 5; break;
+		case '2' : numBlocks = 32; break;
+		case '4' : numBlocks = 40; break;
+		default:   numBlocks = 16;
+	}
+	return numBlocks;
+}
+
+static int ParamCardSizeBlocks(const char c) {
+	int numBlocks = 16 * 4;
+	switch (c) {
+		case '0' : numBlocks = 5 * 4; break;
+		case '2' : numBlocks = 32 * 4; break;
+		case '4' : numBlocks = 32 * 4 + 8 * 16; break;
+		default:   numBlocks = 16 * 4;
+	}
+	return numBlocks;
+}
+
 int CmdHF14AMfDump(const char *Cmd)
 {
 	uint8_t sectorNo, blockNo;
@@ -238,14 +260,7 @@ int CmdHF14AMfDump(const char *Cmd)
 	UsbCommand resp;
 
 	char cmdp = param_getchar(Cmd, 0);
-	switch (cmdp) {
-		case '0' : numSectors = 5; break;
-		case '1' :
-		case '\0': numSectors = 16; break;
-		case '2' : numSectors = 32; break;
-		case '4' : numSectors = 40; break;
-		default:   numSectors = 16;
-	}
+	numSectors = ParamCardSizeSectors(cmdp);
 
 	if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
 		PrintAndLog("Usage:   hf mf dump [card memory]");
@@ -516,6 +531,7 @@ typedef struct {
 } sector_t;
 
 
+# define NESTED_KEY_COUNT 15
 int CmdHF14AMfNested(const char *Cmd)
 {
 	int i, j, res, iterations;
@@ -526,10 +542,12 @@ int CmdHF14AMfNested(const char *Cmd)
 	uint8_t trgKeyType = 0;
 	uint8_t SectorsCnt = 0;
 	uint8_t key[6] = {0, 0, 0, 0, 0, 0};
-	uint8_t keyBlock[14*6];
+	uint8_t keyBlock[NESTED_KEY_COUNT * 6];
 	uint64_t key64 = 0;
-	bool transferToEml = false;
+	
+	bool autosearchKey = false;
 
+	bool transferToEml = false;
 	bool createDumpFile = false;
 	FILE *fkeys;
 	uint8_t standart[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
@@ -540,66 +558,90 @@ int CmdHF14AMfNested(const char *Cmd)
 	if (strlen(Cmd)<3) {
 		PrintAndLog("Usage:");
 		PrintAndLog(" all sectors:  hf mf nested  <card memory> <block number> <key A/B> <key (12 hex symbols)> [t,d]");
+		PrintAndLog(" all sectors autosearch key:  hf mf nested  <card memory> * [t,d]");
 		PrintAndLog(" one sector:   hf mf nested  o <block number> <key A/B> <key (12 hex symbols)>");
 		PrintAndLog("               <target block number> <target key A/B> [t]");
+		PrintAndLog(" ");
 		PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");
-		PrintAndLog("t - transfer keys into emulator memory");
-		PrintAndLog("d - write keys to binary file");
+		PrintAndLog("t - transfer keys to emulator memory");
+		PrintAndLog("d - write keys to binary file dumpkeys.bin");
 		PrintAndLog(" ");
 		PrintAndLog("      sample1: hf mf nested 1 0 A FFFFFFFFFFFF ");
 		PrintAndLog("      sample2: hf mf nested 1 0 A FFFFFFFFFFFF t ");
 		PrintAndLog("      sample3: hf mf nested 1 0 A FFFFFFFFFFFF d ");
 		PrintAndLog("      sample4: hf mf nested o 0 A FFFFFFFFFFFF 4 A");
+		PrintAndLog("      sample5: hf mf nested 1 * t");
 		return 0;
 	}
 
+	// <card memory>
 	cmdp = param_getchar(Cmd, 0);
-	blockNo = param_get8(Cmd, 1);
-	ctmp = param_getchar(Cmd, 2);
-
-	if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {
-		PrintAndLog("Key type must be A or B");
-		return 1;
+	if (cmdp == 'o' || cmdp == 'O') {
+		cmdp = 'o';
+		SectorsCnt = 1;
+	} else {
+		SectorsCnt = ParamCardSizeSectors(cmdp);
 	}
+		
+	// <block number>. number or autosearch key (*)
+	if (param_getchar(Cmd, 1) == '*') {
+		autosearchKey = true;
 
-	if (ctmp != 'A' && ctmp != 'a')
-		keyType = 1;
+		ctmp = param_getchar(Cmd, 2);
+		transferToEml |= (ctmp == 't' || ctmp == 'T');
+		createDumpFile |= (ctmp == 'd' || ctmp == 'D');
 
-	if (param_gethex(Cmd, 3, key, 12)) {
-		PrintAndLog("Key must include 12 HEX symbols");
-		return 1;
-	}
+		PrintAndLog("--nested. sectors:%2d, block no:*, eml:%c, dmp=%c ", SectorsCnt, transferToEml?'y':'n', createDumpFile?'y':'n');
+	} else {
+		blockNo = param_get8(Cmd, 1);
 
-	if (cmdp == 'o' || cmdp == 'O') {
-		cmdp = 'o';
-		trgBlockNo = param_get8(Cmd, 4);
-		ctmp = param_getchar(Cmd, 5);
+		ctmp = param_getchar(Cmd, 2);
 		if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {
-			PrintAndLog("Target key type must be A or B");
+			PrintAndLog("Key type must be A or B");
 			return 1;
 		}
+
 		if (ctmp != 'A' && ctmp != 'a')
-			trgKeyType = 1;
-	} else {
+			keyType = 1;
 
-		switch (cmdp) {
-			case '0': SectorsCnt = 05; break;
-			case '1': SectorsCnt = 16; break;
-			case '2': SectorsCnt = 32; break;
-			case '4': SectorsCnt = 40; break;
-			default:  SectorsCnt = 16;
+		if (param_gethex(Cmd, 3, key, 12)) {
+			PrintAndLog("Key must include 12 HEX symbols");
+			return 1;
 		}
-	}
 
-	ctmp = param_getchar(Cmd, 4);
-	if		(ctmp == 't' || ctmp == 'T') transferToEml = true;
-	else if (ctmp == 'd' || ctmp == 'D') createDumpFile = true;
+		// check if we can authenticate to sector
+		res = mfCheckKeys(blockNo, keyType, true, 1, key, &key64);
+		if (res) {
+			PrintAndLog("Can't authenticate to block:%3d key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));
+			return 3;
+		}
 
-	ctmp = param_getchar(Cmd, 6);
-	transferToEml |= (ctmp == 't' || ctmp == 'T');
-	transferToEml |= (ctmp == 'd' || ctmp == 'D');
+		// one sector nested
+		if (cmdp == 'o') { 
+			trgBlockNo = param_get8(Cmd, 4);
 
-	if (cmdp == 'o') {
+			ctmp = param_getchar(Cmd, 5);
+			if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {
+				PrintAndLog("Target key type must be A or B");
+				return 1;
+			}
+			if (ctmp != 'A' && ctmp != 'a')
+				trgKeyType = 1;
+
+			ctmp = param_getchar(Cmd, 6);
+			transferToEml |= (ctmp == 't' || ctmp == 'T');
+			createDumpFile |= (ctmp == 'd' || ctmp == 'D');
+		} else {
+			ctmp = param_getchar(Cmd, 4);
+			transferToEml |= (ctmp == 't' || ctmp == 'T');
+			createDumpFile |= (ctmp == 'd' || ctmp == 'D');
+		}
+
+		PrintAndLog("--nested. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c ", SectorsCnt, blockNo, keyType?'B':'A', transferToEml?'y':'n', createDumpFile?'y':'n');
+	}
+
+	// one-sector nested
+	if (cmdp == 'o') { // ------------------------------------  one sector working
 		PrintAndLog("--target block no:%3d, target key type:%c ", trgBlockNo, trgKeyType?'B':'A');
 		int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true);
 		if (isOK) {
@@ -630,6 +672,7 @@ int CmdHF14AMfNested(const char *Cmd)
 				else
 					num_to_bytes(key64, 6, &keyBlock[10]);
 				mfEmlSetMem(keyBlock, sectortrailer, 1);
+				PrintAndLog("Key transferred to emulator memory.");
 			}
 		} else {
 			PrintAndLog("No valid key found");
@@ -657,13 +700,14 @@ int CmdHF14AMfNested(const char *Cmd)
 		num_to_bytes(0xa0478cc39091, 6, (uint8_t*)(keyBlock + 11 * 6));
 		num_to_bytes(0x533cb6c723f6, 6, (uint8_t*)(keyBlock + 12 * 6));
 		num_to_bytes(0x8fd0a4f256e9, 6, (uint8_t*)(keyBlock + 13 * 6));
+		num_to_bytes(0x1a2b3c4d5e6f, 6, (uint8_t*)(keyBlock + 14 * 6));
 
 		PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt);
 		for (i = 0; i < SectorsCnt; i++) {
 			for (j = 0; j < 2; j++) {
 				if (e_sector[i].foundKey[j]) continue;
 
-				res = mfCheckKeys(FirstBlockOfSector(i), j, true, 6, keyBlock, &key64);
+				res = mfCheckKeys(FirstBlockOfSector(i), j, true, NESTED_KEY_COUNT, keyBlock, &key64); 
 
 				if (!res) {
 					e_sector[i].Key[j] = key64;
@@ -671,6 +715,32 @@ int CmdHF14AMfNested(const char *Cmd)
 				}
 			}
 		}
+		
+		// get known key from array
+		bool keyFound = false;
+		if (autosearchKey) {
+			for (i = 0; i < SectorsCnt; i++) {
+				for (j = 0; j < 2; j++) {
+					if (e_sector[i].foundKey[j]) {
+						// get known key
+						blockNo = i * 4;
+						keyType = j;
+						num_to_bytes(e_sector[i].Key[j], 6, key);
+						
+						keyFound = true;
+						break;
+					}
+				}
+				if (keyFound) break;
+			}		
+
+			// Can't found a key....
+			if (!keyFound) {
+				PrintAndLog("Can't found any of the known keys.");
+				return 4;
+			}
+			PrintAndLog("--auto key. block no:%3d, key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));
+		}
 
 		// nested sectors
 		iterations = 0;
@@ -707,10 +777,71 @@ int CmdHF14AMfNested(const char *Cmd)
 			}
 		}
 
-		printf("Time in nested: %1.3f (%1.3f sec per key)\n\n", ((float)(msclock() - msclock1))/1000.0, ((float)(msclock() - msclock1))/iterations/1000.0);
+		// print nested statistic
+		PrintAndLog("\n\n-----------------------------------------------\nNested statistic:\nIterations count: %d", iterations);
+		PrintAndLog("Time in nested: %1.3f (%1.3f sec per key)", ((float)(msclock() - msclock1))/1000.0, ((float)(msclock() - msclock1))/iterations/1000.0);
+		
+		// check if we have unrecognized keys
+		bool notFoundKeys = false;
+		for (i = 0; i < SectorsCnt; i++) {
+			for (j = 0; j < 2; j++) {
+				if (!e_sector[i].foundKey[j]) {
+					notFoundKeys = true;
+					break;
+				}
+			}
+			if (notFoundKeys) break;
+		}		
+		
+		if (notFoundKeys) {
+			PrintAndLog("-----------------------------------------------\n");
+			PrintAndLog("We have unrecognized keys. Trying to check if we have this keys on key buffer...");
+
+			// fill keyBlock with known keys
+			int cnt = 0;
+			for (i = 0; i < SectorsCnt; i++) {
+				for (j = 0; j < 2; j++) {
+					if (e_sector[i].foundKey[j]) {
+						// try to insert key to keyBlock						
+						if (cnt < NESTED_KEY_COUNT) {
+
+							// search for dublicates
+							bool dubl = false;
+							for (int v = 0; v < NESTED_KEY_COUNT; v++) {
+								if (e_sector[i].Key[j] == bytes_to_num((uint8_t*)(keyBlock + v * 6), 6)) {
+									dubl = true;
+									break;
+								}
+							}
+							
+							// insert
+							if (!dubl) {
+								num_to_bytes(e_sector[i].Key[j], 6, (uint8_t*)(keyBlock + cnt * 6));
+								cnt++;
+							}
+						}
+					}
+				}
+			}
 
-		PrintAndLog("-----------------------------------------------\nIterations count: %d\n\n", iterations);
-		//print them
+			// try to auth with known keys to not recognized sectors keys
+			PrintAndLog("Testing keys. Sector count=%d known keys count:%d", SectorsCnt, cnt);
+			for (i = 0; i < SectorsCnt; i++) {
+				for (j = 0; j < 2; j++) {
+					if (e_sector[i].foundKey[j]) continue;
+
+					res = mfCheckKeys(FirstBlockOfSector(i), j, true, cnt, keyBlock, &key64); 
+
+					if (!res) {
+						e_sector[i].Key[j] = key64;
+						e_sector[i].foundKey[j] = 1;
+					}
+				}
+			}			
+			
+		} // if (notFoundKeys)
+		
+		// print result
 		PrintAndLog("|---|----------------|---|----------------|---|");
 		PrintAndLog("|sec|key A           |res|key B           |res|");
 		PrintAndLog("|---|----------------|---|----------------|---|");
@@ -720,7 +851,7 @@ int CmdHF14AMfNested(const char *Cmd)
 		}
 		PrintAndLog("|---|----------------|---|----------------|---|");
 
-		// transfer them to the emulator
+		// transfer keys to the emulator memory
 		if (transferToEml) {
 			for (i = 0; i < SectorsCnt; i++) {
 				mfEmlGetMem(keyBlock, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1);
@@ -730,6 +861,7 @@ int CmdHF14AMfNested(const char *Cmd)
 					num_to_bytes(e_sector[i].Key[1], 6, &keyBlock[10]);
 				mfEmlSetMem(keyBlock, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1);
 			}
+			PrintAndLog("Keys transferred to emulator memory.");
 		}
 
 		// Create dump file
@@ -946,13 +1078,7 @@ int CmdHF14AMfChk(const char *Cmd)
 
 	if (param_getchar(Cmd, 0)=='*') {
 		blockNo = 3;
-		switch(param_getchar(Cmd+1, 0)) {
-			case '0': SectorsCnt =  5; break;
-			case '1': SectorsCnt = 16; break;
-			case '2': SectorsCnt = 32; break;
-			case '4': SectorsCnt = 40; break;
-			default:  SectorsCnt = 16;
-		}
+		SectorsCnt = ParamCardSizeSectors(param_getchar(Cmd + 1, 0));
 	}
 	else
 		blockNo = param_get8(Cmd, 0);
@@ -1854,17 +1980,6 @@ int CmdHF14AMfCSetUID(const char *Cmd)
 	return 0;
 }
 
-static int ParamGetCardSize(const char c) {
-	int numBlocks = 16 * 4;
-	switch (c) {
-		case '0' : numBlocks = 5 * 4; break;
-		case '2' : numBlocks = 32 * 4; break;
-		case '4' : numBlocks = 32 * 4 + 8 * 16; break;
-		default:   numBlocks = 16 * 4;
-	}
-	return numBlocks;
-}
-
 int CmdHF14AMfCWipe(const char *Cmd)
 {
 	int res, gen = 0;
@@ -1885,7 +2000,7 @@ int CmdHF14AMfCWipe(const char *Cmd)
 	if ((gen != 1) && (gen != 2)) 
 		return 1;
 	
-	numBlocks = ParamGetCardSize(param_getchar(Cmd, 0));
+	numBlocks = ParamCardSizeBlocks(param_getchar(Cmd, 0));
 
 	char cmdp = 0;
 	while(param_getchar(Cmd, cmdp) != 0x00){