]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhfmf.c
051f414b6653877e428b1926500c5ea050834e46
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2011 Merlok
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // High frequency MIFARE commands
9 //-----------------------------------------------------------------------------
12 #include "proxmark3.h"
14 static int CmdHelp(const char *Cmd
);
16 int CmdHF14AMifare(const char *Cmd
)
20 uint64_t par_list
= 0, ks_list
= 0, r_key
= 0;
22 uint8_t keyBlock
[6] = {0,0,0,0,0,0};
24 if (param_getchar(Cmd
, 0) && param_gethex(Cmd
, 0, keyBlock
, 8)) {
25 PrintAndLog("Nt must include 8 HEX symbols");
29 UsbCommand c
= {CMD_READER_MIFARE
, {(uint32_t)bytes_to_num(keyBlock
, 4), 0, 0}};
33 while (ukbhit()) getchar();
36 printf("-------------------------------------------------------------------------\n");
37 printf("Executing command. It may take up to 30 min.\n");
38 printf("Press the key on proxmark3 device to abort proxmark3.\n");
39 printf("Press the key on the proxmark3 device to abort both proxmark3 and client.\n");
40 printf("-------------------------------------------------------------------------\n");
47 printf("\naborted via keyboard!\n");
51 UsbCommand
* resp
= WaitForResponseTimeout(CMD_ACK
, 2000);
53 isOK
= resp
->arg
[0] & 0xff;
55 uid
= (uint32_t)bytes_to_num(resp
->d
.asBytes
+ 0, 4);
56 nt
= (uint32_t)bytes_to_num(resp
->d
.asBytes
+ 4, 4);
57 par_list
= bytes_to_num(resp
->d
.asBytes
+ 8, 8);
58 ks_list
= bytes_to_num(resp
->d
.asBytes
+ 16, 8);
61 PrintAndLog("isOk:%02x", isOK
);
62 if (!isOK
) PrintAndLog("Proxmark can't get statistic info. Execution aborted.\n");
69 if (isOK
!= 1) return 1;
71 // execute original function from util nonce2key
72 if (nonce2key(uid
, nt
, par_list
, ks_list
, &r_key
)) return 2;
73 printf("------------------------------------------------------------------\n");
74 PrintAndLog("Key found:%012llx \n", r_key
);
76 num_to_bytes(r_key
, 6, keyBlock
);
77 isOK
= mfCheckKeys(0, 0, 1, keyBlock
, &r_key
);
79 PrintAndLog("Found valid key:%012llx", r_key
);
81 PrintAndLog("Found invalid key. ( Nt=%08x", nt
);
87 int CmdHF14AMfWrBl(const char *Cmd
)
91 uint8_t key
[6] = {0, 0, 0, 0, 0, 0};
92 uint8_t bldata
[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
97 PrintAndLog("Usage: hf mf wrbl <block number> <key A/B> <key (12 hex symbols)> <block data (32 hex symbols)>");
98 PrintAndLog(" sample: hf mf wrbl 0 A FFFFFFFFFFFF 000102030405060708090A0B0C0D0E0F");
102 blockNo
= param_get8(Cmd
, 0);
103 cmdp
= param_getchar(Cmd
, 1);
105 PrintAndLog("Key type must be A or B");
108 if (cmdp
!= 'A' && cmdp
!= 'a') keyType
= 1;
109 if (param_gethex(Cmd
, 2, key
, 12)) {
110 PrintAndLog("Key must include 12 HEX symbols");
113 if (param_gethex(Cmd
, 3, bldata
, 32)) {
114 PrintAndLog("Block data must include 32 HEX symbols");
117 PrintAndLog("--block no:%02x key type:%02x key:%s", blockNo
, keyType
, sprint_hex(key
, 6));
118 PrintAndLog("--data: %s", sprint_hex(bldata
, 16));
120 UsbCommand c
= {CMD_MIFARE_WRITEBL
, {blockNo
, keyType
, 0}};
121 memcpy(c
.d
.asBytes
, key
, 6);
122 memcpy(c
.d
.asBytes
+ 10, bldata
, 16);
124 UsbCommand
* resp
= WaitForResponseTimeout(CMD_ACK
, 1500);
127 uint8_t isOK
= resp
->arg
[0] & 0xff;
129 PrintAndLog("isOk:%02x", isOK
);
131 PrintAndLog("Command execute timeout");
137 int CmdHF14AMfRdBl(const char *Cmd
)
141 uint8_t key
[6] = {0, 0, 0, 0, 0, 0};
147 PrintAndLog("Usage: hf mf rdbl <block number> <key A/B> <key (12 hex symbols)>");
148 PrintAndLog(" sample: hf mf rdbl 0 A FFFFFFFFFFFF ");
152 blockNo
= param_get8(Cmd
, 0);
153 cmdp
= param_getchar(Cmd
, 1);
155 PrintAndLog("Key type must be A or B");
158 if (cmdp
!= 'A' && cmdp
!= 'a') keyType
= 1;
159 if (param_gethex(Cmd
, 2, key
, 12)) {
160 PrintAndLog("Key must include 12 HEX symbols");
163 PrintAndLog("--block no:%02x key type:%02x key:%s ", blockNo
, keyType
, sprint_hex(key
, 6));
165 UsbCommand c
= {CMD_MIFARE_READBL
, {blockNo
, keyType
, 0}};
166 memcpy(c
.d
.asBytes
, key
, 6);
168 UsbCommand
* resp
= WaitForResponseTimeout(CMD_ACK
, 1500);
171 uint8_t isOK
= resp
->arg
[0] & 0xff;
172 uint8_t * data
= resp
->d
.asBytes
;
175 PrintAndLog("isOk:%02x data:%s", isOK
, sprint_hex(data
, 16));
177 PrintAndLog("isOk:%02x", isOK
);
179 PrintAndLog("Command execute timeout");
185 int CmdHF14AMfRdSc(const char *Cmd
)
188 uint8_t sectorNo
= 0;
190 uint8_t key
[6] = {0, 0, 0, 0, 0, 0};
193 uint8_t * data
= NULL
;
198 PrintAndLog("Usage: hf mf rdsc <sector number> <key A/B> <key (12 hex symbols)>");
199 PrintAndLog(" sample: hf mf rdsc 0 A FFFFFFFFFFFF ");
203 sectorNo
= param_get8(Cmd
, 0);
205 PrintAndLog("Sector number must be less than 64");
208 cmdp
= param_getchar(Cmd
, 1);
210 PrintAndLog("Key type must be A or B");
213 if (cmdp
!= 'A' && cmdp
!= 'a') keyType
= 1;
214 if (param_gethex(Cmd
, 2, key
, 12)) {
215 PrintAndLog("Key must include 12 HEX symbols");
218 PrintAndLog("--sector no:%02x key type:%02x key:%s ", sectorNo
, keyType
, sprint_hex(key
, 6));
220 UsbCommand c
= {CMD_MIFARE_READSC
, {sectorNo
, keyType
, 0}};
221 memcpy(c
.d
.asBytes
, key
, 6);
223 UsbCommand
* resp
= WaitForResponseTimeout(CMD_ACK
, 1500);
227 isOK
= resp
->arg
[0] & 0xff;
228 data
= resp
->d
.asBytes
;
230 PrintAndLog("isOk:%02x", isOK
);
232 for (i
= 0; i
< 2; i
++) {
233 PrintAndLog("data:%s", sprint_hex(data
+ i
* 16, 16));
236 PrintAndLog("Command1 execute timeout");
240 resp
= WaitForResponseTimeout(CMD_ACK
, 500);
244 isOK
= resp
->arg
[0] & 0xff;
245 data
= resp
->d
.asBytes
;
248 for (i
= 0; i
< 2; i
++) {
249 PrintAndLog("data:%s", sprint_hex(data
+ i
* 16, 16));
252 PrintAndLog("Command2 execute timeout");
258 int CmdHF14AMfDump1k(const char *Cmd
)
266 uint8_t rights
[16][4];
269 uint8_t *data
= NULL
;
276 if ((fin
= fopen("dumpkeys.bin","rb")) == NULL
) {
277 PrintAndLog("Could not find file keys.bin");
281 if ((fout
= fopen("dumpdata.bin","wb")) == NULL
) {
282 PrintAndLog("Could not create file name dump.bin");
288 for (i
=0 ; i
<16 ; i
++) {
289 fread ( keyA
[i
], 1, 6, fin
);
291 for (i
=0 ; i
<16 ; i
++) {
292 fread ( keyB
[i
], 1, 6, fin
);
295 // Read access rights to sectors
297 PrintAndLog("|-----------------------------------------|");
298 PrintAndLog("|------ Reading sector access bits...-----|");
299 PrintAndLog("|-----------------------------------------|");
301 for (i
= 0 ; i
< 16 ; i
++) {
302 UsbCommand c
= {CMD_MIFARE_READBL
, {4*i
+ 3, 0, 0}};
303 memcpy(c
.d
.asBytes
, keyA
[i
], 6);
305 resp
= WaitForResponseTimeout(CMD_ACK
, 1500);
308 uint8_t isOK
= resp
->arg
[0] & 0xff;
309 uint8_t *data
= resp
->d
.asBytes
;
311 rights
[i
][0] = ((data
[7] & 0x10)>>4) | ((data
[8] & 0x1)<<1) | ((data
[8] & 0x10)>>2);
312 rights
[i
][1] = ((data
[7] & 0x20)>>5) | ((data
[8] & 0x2)<<0) | ((data
[8] & 0x20)>>3);
313 rights
[i
][2] = ((data
[7] & 0x40)>>6) | ((data
[8] & 0x4)>>1) | ((data
[8] & 0x40)>>4);
314 rights
[i
][3] = ((data
[7] & 0x80)>>7) | ((data
[8] & 0x8)>>2) | ((data
[8] & 0x80)>>5);
317 PrintAndLog("Could not get access rights for block %d", i
);
321 PrintAndLog("Command execute timeout");
325 // Read blocks and print to file
327 PrintAndLog("|-----------------------------------------|");
328 PrintAndLog("|----- Dumping all blocks to file... -----|");
329 PrintAndLog("|-----------------------------------------|");
331 for (i
=0 ; i
<16 ; i
++) {
332 for (j
=0 ; j
<4 ; j
++) {
334 UsbCommand c
= {CMD_MIFARE_READBL
, {i
*4 + j
, 0, 0}};
335 memcpy(c
.d
.asBytes
, keyA
[i
], 6);
337 resp
= WaitForResponseTimeout(CMD_ACK
, 1500);
340 if ((rights
[i
][j
] == 6) | (rights
[i
][j
] == 5)) {
341 UsbCommand c
= {CMD_MIFARE_READBL
, {i
*4+j
, 1, 0}};
342 memcpy(c
.d
.asBytes
, keyB
[i
], 6);
344 resp
= WaitForResponseTimeout(CMD_ACK
, 1500);
346 else if (rights
[i
][j
] == 7) {
347 PrintAndLog("Access rights do not allow reading of sector %d block %d",i
,j
);
350 UsbCommand c
= {CMD_MIFARE_READBL
, {i
*4+j
, 0, 0}};
351 memcpy(c
.d
.asBytes
, keyA
[i
], 6);
353 resp
= WaitForResponseTimeout(CMD_ACK
, 1500);
358 uint8_t isOK
= resp
->arg
[0] & 0xff;
359 uint8_t *data
= resp
->d
.asBytes
;
361 data
[0] = (keyA
[i
][0]);
362 data
[1] = (keyA
[i
][1]);
363 data
[2] = (keyA
[i
][2]);
364 data
[3] = (keyA
[i
][3]);
365 data
[4] = (keyA
[i
][4]);
366 data
[5] = (keyA
[i
][5]);
367 data
[10] = (keyB
[i
][0]);
368 data
[11] = (keyB
[i
][1]);
369 data
[12] = (keyB
[i
][2]);
370 data
[13] = (keyB
[i
][3]);
371 data
[14] = (keyB
[i
][4]);
372 data
[15] = (keyB
[i
][5]);
375 fwrite ( data
, 1, 16, fout
);
378 PrintAndLog("Could not get access rights for block %d", i
);
382 PrintAndLog("Command execute timeout");
393 int CmdHF14AMfRestore1k(const char *Cmd
)
398 uint8_t key
[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
399 uint8_t bldata
[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
408 if ((fdump
= fopen("dumpdata.bin","rb")) == NULL
) {
409 PrintAndLog("Could not find file dump.bin");
412 if ((fkeys
= fopen("dumpkeys.bin","rb")) == NULL
) {
413 PrintAndLog("Could not find file keys.bin");
417 for (i
=0 ; i
<16 ; i
++) {
418 fread(keyA
[i
], 1, 6, fkeys
);
420 for (i
=0 ; i
<16 ; i
++) {
421 fread(keyB
[i
], 1, 6, fkeys
);
424 PrintAndLog("Restoring dumpdata.bin to card");
426 for (i
=0 ; i
<16 ; i
++) {
427 for( j
=0 ; j
<4 ; j
++) {
428 UsbCommand c
= {CMD_MIFARE_WRITEBL
, {i
*4 + j
, keyType
, 0}};
429 memcpy(c
.d
.asBytes
, key
, 6);
431 fread(bldata
, 1, 16, fdump
);
434 bldata
[0] = (keyA
[i
][0]);
435 bldata
[1] = (keyA
[i
][1]);
436 bldata
[2] = (keyA
[i
][2]);
437 bldata
[3] = (keyA
[i
][3]);
438 bldata
[4] = (keyA
[i
][4]);
439 bldata
[5] = (keyA
[i
][5]);
440 bldata
[10] = (keyB
[i
][0]);
441 bldata
[11] = (keyB
[i
][1]);
442 bldata
[12] = (keyB
[i
][2]);
443 bldata
[13] = (keyB
[i
][3]);
444 bldata
[14] = (keyB
[i
][4]);
445 bldata
[15] = (keyB
[i
][5]);
448 PrintAndLog("Writing to block %2d: %s Confirm? [Y,N]", i
*4+j
, sprint_hex(bldata
, 16));
451 if ((c
!= 'y') || (c
!= 'Y')){
452 PrintAndLog("Aborting !");
456 memcpy(c
.d
.asBytes
+ 10, bldata
, 16);
458 UsbCommand
*resp
= WaitForResponseTimeout(CMD_ACK
, 1500);
461 uint8_t isOK
= resp
->arg
[0] & 0xff;
462 PrintAndLog("isOk:%02x", isOK
);
464 PrintAndLog("Command execute timeout");
474 int CmdHF14AMfNested(const char *Cmd
)
476 int i
, j
, res
, iterations
;
477 sector
* e_sector
= NULL
;
480 uint8_t trgBlockNo
= 0;
481 uint8_t trgKeyType
= 0;
484 uint8_t key
[6] = {0, 0, 0, 0, 0, 0};
485 uint8_t keyBlock
[16 * 6];
487 int transferToEml
= 0;
489 int createDumpFile
= 0;
491 uint8_t standart
[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
492 uint8_t tempkey
[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
497 PrintAndLog("Usage:");
498 PrintAndLog(" all sectors: hf mf nested <card memory> <block number> <key A/B> <key (12 hex symbols)> [t,d]");
499 PrintAndLog(" one sector: hf mf nested o <block number> <key A/B> <key (12 hex symbols)>");
500 PrintAndLog(" <target block number> <target key A/B> [t]");
501 PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");
502 PrintAndLog("t - transfer keys into emulator memory");
503 PrintAndLog("d - write keys to binary file");
505 PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF ");
506 PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF t ");
507 PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF d ");
508 PrintAndLog(" sample2: hf mf nested o 0 A FFFFFFFFFFFF 4 A");
512 cmdp
= param_getchar(Cmd
, 0);
513 blockNo
= param_get8(Cmd
, 1);
514 ctmp
= param_getchar(Cmd
, 2);
516 PrintAndLog("Key type must be A or B");
519 if (ctmp
!= 'A' && ctmp
!= 'a') keyType
= 1;
520 if (param_gethex(Cmd
, 3, key
, 12)) {
521 PrintAndLog("Key must include 12 HEX symbols");
525 if (cmdp
== 'o' || cmdp
== 'O') {
527 trgBlockNo
= param_get8(Cmd
, 4);
528 ctmp
= param_getchar(Cmd
, 5);
530 PrintAndLog("Target key type must be A or B");
533 if (ctmp
!= 'A' && ctmp
!= 'a') trgKeyType
= 1;
536 case '0': SectorsCnt
= 05; break;
537 case '1': SectorsCnt
= 16; break;
538 case '2': SectorsCnt
= 32; break;
539 case '4': SectorsCnt
= 64; break;
540 default: SectorsCnt
= 16;
544 ctmp
= param_getchar(Cmd
, 4);
545 if (ctmp
== 't' || ctmp
== 'T') transferToEml
= 1;
546 else if (ctmp
== 'd' || ctmp
== 'D') createDumpFile
= 1;
548 ctmp
= param_getchar(Cmd
, 6);
549 transferToEml
|= (ctmp
== 't' || ctmp
== 'T');
550 transferToEml
|= (ctmp
== 'd' || ctmp
== 'D');
552 PrintAndLog("--block no:%02x key type:%02x key:%s etrans:%d", blockNo
, keyType
, sprint_hex(key
, 6), transferToEml
);
554 PrintAndLog("--target block no:%02x target key type:%02x ", trgBlockNo
, trgKeyType
);
557 if (mfnested(blockNo
, keyType
, key
, trgBlockNo
, trgKeyType
, keyBlock
)) {
558 PrintAndLog("Nested error.");
562 for (i
= 0; i
< 16; i
++) {
563 PrintAndLog("cnt=%d key= %s", i
, sprint_hex(keyBlock
+ i
* 6, 6));
567 res
= mfCheckKeys(trgBlockNo
, trgKeyType
, 8, keyBlock
, &key64
);
569 res
= mfCheckKeys(trgBlockNo
, trgKeyType
, 8, &keyBlock
[6 * 8], &key64
);
571 PrintAndLog("Found valid key:%012llx", key64
);
573 // transfer key to the emulator
575 mfEmlGetMem(keyBlock
, (trgBlockNo
/ 4) * 4 + 3, 1);
578 num_to_bytes(key64
, 6, keyBlock
);
580 num_to_bytes(key64
, 6, &keyBlock
[10]);
581 mfEmlSetMem(keyBlock
, (trgBlockNo
/ 4) * 4 + 3, 1);
584 PrintAndLog("No valid key found");
587 else { // ------------------------------------ multiple sectors working
588 blDiff
= blockNo
% 4;
589 PrintAndLog("Block shift=%d", blDiff
);
590 e_sector
= calloc(SectorsCnt
, sizeof(sector
));
591 if (e_sector
== NULL
) return 1;
593 //test current key 4 sectors
594 memcpy(keyBlock
, key
, 6);
595 num_to_bytes(0xa0a1a2a3a4a5, 6, (uint8_t*)(keyBlock
+ 1 * 6));
596 num_to_bytes(0xb0b1b2b3b4b5, 6, (uint8_t*)(keyBlock
+ 2 * 6));
597 num_to_bytes(0xffffffffffff, 6, (uint8_t*)(keyBlock
+ 3 * 6));
598 num_to_bytes(0x000000000000, 6, (uint8_t*)(keyBlock
+ 4 * 6));
599 num_to_bytes(0xaabbccddeeff, 6, (uint8_t*)(keyBlock
+ 5 * 6));
601 PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt
);
602 for (i
= 0; i
< SectorsCnt
; i
++) {
603 for (j
= 0; j
< 2; j
++) {
604 if (e_sector
[i
].foundKey
[j
]) continue;
606 res
= mfCheckKeys(i
* 4 + blDiff
, j
, 6, keyBlock
, &key64
);
609 e_sector
[i
].Key
[j
] = key64
;
610 e_sector
[i
].foundKey
[j
] = 1;
617 PrintAndLog("nested...");
618 for (i
= 0; i
< NESTED_SECTOR_RETRY
; i
++) {
619 for (trgBlockNo
= blDiff
; trgBlockNo
< SectorsCnt
* 4; trgBlockNo
= trgBlockNo
+ 4)
620 for (trgKeyType
= 0; trgKeyType
< 2; trgKeyType
++) {
621 if (e_sector
[trgBlockNo
/ 4].foundKey
[trgKeyType
]) continue;
622 if (mfnested(blockNo
, keyType
, key
, trgBlockNo
, trgKeyType
, keyBlock
)) continue;
626 //try keys from nested
627 res
= mfCheckKeys(trgBlockNo
, trgKeyType
, 8, keyBlock
, &key64
);
629 res
= mfCheckKeys(trgBlockNo
, trgKeyType
, 8, &keyBlock
[6 * 8], &key64
);
631 PrintAndLog("Found valid key:%012llx", key64
);
632 e_sector
[trgBlockNo
/ 4].foundKey
[trgKeyType
] = 1;
633 e_sector
[trgBlockNo
/ 4].Key
[trgKeyType
] = key64
;
638 PrintAndLog("Iterations count: %d", iterations
);
640 PrintAndLog("|---|----------------|---|----------------|---|");
641 PrintAndLog("|sec|key A |res|key B |res|");
642 PrintAndLog("|---|----------------|---|----------------|---|");
643 for (i
= 0; i
< SectorsCnt
; i
++) {
644 PrintAndLog("|%03d| %012llx | %d | %012llx | %d |", i
,
645 e_sector
[i
].Key
[0], e_sector
[i
].foundKey
[0], e_sector
[i
].Key
[1], e_sector
[i
].foundKey
[1]);
647 PrintAndLog("|---|----------------|---|----------------|---|");
649 // transfer them to the emulator
651 for (i
= 0; i
< SectorsCnt
; i
++) {
652 mfEmlGetMem(keyBlock
, i
* 4 + 3, 1);
653 if (e_sector
[i
].foundKey
[0])
654 num_to_bytes(e_sector
[i
].Key
[0], 6, keyBlock
);
655 if (e_sector
[i
].foundKey
[1])
656 num_to_bytes(e_sector
[i
].Key
[1], 6, &keyBlock
[10]);
657 mfEmlSetMem(keyBlock
, i
* 4 + 3, 1);
662 if (createDumpFile
) {
663 if ((fkeys
= fopen("dumpkeys.bin","wb")) == NULL
) {
664 PrintAndLog("Could not create file keys.bin");
668 PrintAndLog("Printing keys to bynary file dumpkeys.bin...");
669 for(i
=0; i
<16; i
++) {
670 if (e_sector
[i
].foundKey
[0]){
671 num_to_bytes(e_sector
[i
].Key
[0], 6, tempkey
);
672 fwrite ( tempkey
, 1, 6, fkeys
);
675 fwrite ( &standart
, 1, 6, fkeys
);
678 for(i
=0; i
<16; i
++) {
679 if (e_sector
[i
].foundKey
[1]){
680 num_to_bytes(e_sector
[i
].Key
[1], 6, tempkey
);
681 fwrite ( tempkey
, 1, 6, fkeys
);
684 fwrite ( &standart
, 1, 6, fkeys
);
696 int CmdHF14AMfChk(const char *Cmd
)
703 uint8_t keyBlock
[8 * 6];
706 memset(keyBlock
, 0x00, sizeof(keyBlock
));
709 PrintAndLog("Usage: hf mf chk <block number> <key A/B> [<key (12 hex symbols)>]");
710 PrintAndLog(" sample: hf mf chk 0 A FFFFFFFFFFFF a0a1a2a3a4a5 b0b1b2b3b4b5 ");
714 blockNo
= param_get8(Cmd
, 0);
715 ctmp
= param_getchar(Cmd
, 1);
717 PrintAndLog("Key type must be A or B");
720 if (ctmp
!= 'A' && ctmp
!= 'a') keyType
= 1;
722 for (i
= 0; i
< 6; i
++) {
723 if (!isxdigit(param_getchar(Cmd
, 2 + i
))) break;
725 if (param_gethex(Cmd
, 2 + i
, keyBlock
+ 6 * i
, 12)) {
726 PrintAndLog("Key[%d] must include 12 HEX symbols", i
);
733 PrintAndLog("There is must be at least one key");
737 PrintAndLog("--block no:%02x key type:%02x key count:%d ", blockNo
, keyType
, keycnt
);
739 res
= mfCheckKeys(blockNo
, keyType
, keycnt
, keyBlock
, &key64
);
742 PrintAndLog("isOk:%02x valid key:%012llx", 1, key64
);
744 PrintAndLog("isOk:%02x", 0);
746 PrintAndLog("Command execute timeout");
752 int CmdHF14AMf1kSim(const char *Cmd
)
754 uint8_t uid
[4] = {0, 0, 0, 0};
756 if (param_getchar(Cmd
, 0) == 'h') {
757 PrintAndLog("Usage: hf mf sim <uid (8 hex symbols)>");
758 PrintAndLog(" sample: hf mf sim 0a0a0a0a ");
762 if (param_getchar(Cmd
, 0) && param_gethex(Cmd
, 0, uid
, 8)) {
763 PrintAndLog("UID must include 8 HEX symbols");
766 PrintAndLog(" uid:%s ", sprint_hex(uid
, 4));
768 UsbCommand c
= {CMD_SIMULATE_MIFARE_CARD
, {0, 0, 0}};
769 memcpy(c
.d
.asBytes
, uid
, 4);
775 int CmdHF14AMfDbg(const char *Cmd
)
777 int dbgMode
= param_get32ex(Cmd
, 0, 0, 10);
779 PrintAndLog("Max debud mode parameter is 4 \n");
782 if (strlen(Cmd
) < 1 || !param_getchar(Cmd
, 0) || dbgMode
> 4) {
783 PrintAndLog("Usage: hf mf dbg <debug level>");
784 PrintAndLog(" 0 - no debug messages");
785 PrintAndLog(" 1 - error messages");
786 PrintAndLog(" 2 - all messages");
787 PrintAndLog(" 4 - extended debug mode");
791 UsbCommand c
= {CMD_MIFARE_SET_DBGMODE
, {dbgMode
, 0, 0}};
797 int CmdHF14AMfEGet(const char *Cmd
)
800 uint8_t data
[3 * 16];
803 if (strlen(Cmd
) < 1 || param_getchar(Cmd
, 0) == 'h') {
804 PrintAndLog("Usage: hf mf eget <block number>");
805 PrintAndLog(" sample: hf mf eget 0 ");
809 blockNo
= param_get8(Cmd
, 0);
810 if (blockNo
>= 16 * 4) {
811 PrintAndLog("Block number must be in [0..63] as in MIFARE classic.");
816 if (!mfEmlGetMem(data
, blockNo
, 3)) {
817 for (i
= 0; i
< 3; i
++) {
818 PrintAndLog("data[%d]:%s", blockNo
+ i
, sprint_hex(data
+ i
* 16, 16));
821 PrintAndLog("Command execute timeout");
827 int CmdHF14AMfEClear(const char *Cmd
)
829 if (param_getchar(Cmd
, 0) == 'h') {
830 PrintAndLog("Usage: hf mf eclr");
831 PrintAndLog("It set card emulator memory to empty data blocks and key A/B FFFFFFFFFFFF \n");
835 UsbCommand c
= {CMD_MIFARE_EML_MEMCLR
, {0, 0, 0}};
840 int CmdHF14AMfESet(const char *Cmd
)
842 uint8_t memBlock
[16];
845 memset(memBlock
, 0x00, sizeof(memBlock
));
847 if (strlen(Cmd
) < 3 || param_getchar(Cmd
, 0) == 'h') {
848 PrintAndLog("Usage: hf mf eset <block number> <block data (32 hex symbols)>");
849 PrintAndLog(" sample: hf mf eset 1 000102030405060708090a0b0c0d0e0f ");
853 blockNo
= param_get8(Cmd
, 0);
854 if (blockNo
>= 16 * 4) {
855 PrintAndLog("Block number must be in [0..63] as in MIFARE classic.");
859 if (param_gethex(Cmd
, 1, memBlock
, 32)) {
860 PrintAndLog("block data must include 32 HEX symbols");
865 UsbCommand c
= {CMD_MIFARE_EML_MEMSET
, {blockNo
, 1, 0}};
866 memcpy(c
.d
.asBytes
, memBlock
, 16);
871 int CmdHF14AMfELoad(const char *Cmd
)
875 char * fnameptr
= filename
;
878 int i
, len
, blockNum
;
880 memset(filename
, 0, sizeof(filename
));
881 memset(buf
, 0, sizeof(buf
));
883 if (param_getchar(Cmd
, 0) == 'h') {
884 PrintAndLog("It loads emul dump from the file `filename.eml`");
885 PrintAndLog("Usage: hf mf eload <file name w/o `.eml`>");
886 PrintAndLog(" sample: hf mf eload filename");
891 if (len
> 14) len
= 14;
896 memcpy(filename
, Cmd
, len
);
899 sprintf(fnameptr
, ".eml");
902 f
= fopen(filename
, "r");
904 PrintAndLog("File not found or locked.");
910 memset(buf
, 0, sizeof(buf
));
911 fgets(buf
, sizeof(buf
), f
);
912 if (strlen(buf
) < 32){
913 PrintAndLog("File content error. Block data must include 32 HEX symbols");
916 for (i
= 0; i
< 32; i
+= 2)
917 sscanf(&buf
[i
], "%02x", (unsigned int *)&buf8
[i
/ 2]);
918 // PrintAndLog("data[%02d]:%s", blockNum, sprint_hex(buf8, 16));
920 if (mfEmlSetMem(buf8
, blockNum
, 1)) {
921 PrintAndLog("Cant set emul block: %d", blockNum
);
926 if (blockNum
>= 16 * 4) break;
930 if (blockNum
!= 16 * 4){
931 PrintAndLog("File content error. There must be 64 blocks");
934 PrintAndLog("Loaded from file: %s", filename
);
938 int CmdHF14AMfESave(const char *Cmd
)
942 char * fnameptr
= filename
;
946 memset(filename
, 0, sizeof(filename
));
947 memset(buf
, 0, sizeof(buf
));
949 if (param_getchar(Cmd
, 0) == 'h') {
950 PrintAndLog("It saves emul dump into the file `filename.eml` or `cardID.eml`");
951 PrintAndLog("Usage: hf mf esave [file name w/o `.eml`]");
952 PrintAndLog(" sample: hf mf esave ");
953 PrintAndLog(" hf mf esave filename");
958 if (len
> 14) len
= 14;
962 if (mfEmlGetMem(buf
, 0, 1)) {
963 PrintAndLog("Cant get block: %d", 0);
966 for (j
= 0; j
< 7; j
++, fnameptr
+= 2)
967 sprintf(fnameptr
, "%02x", buf
[j
]);
969 memcpy(filename
, Cmd
, len
);
973 sprintf(fnameptr
, ".eml");
976 f
= fopen(filename
, "w+");
979 for (i
= 0; i
< 16 * 4; i
++) {
980 if (mfEmlGetMem(buf
, i
, 1)) {
981 PrintAndLog("Cant get block: %d", i
);
984 for (j
= 0; j
< 16; j
++)
985 fprintf(f
, "%02x", buf
[j
]);
990 PrintAndLog("Saved to file: %s", filename
);
995 int CmdHF14AMfECFill(const char *Cmd
)
999 if (strlen(Cmd
) < 1 || param_getchar(Cmd
, 0) == 'h') {
1000 PrintAndLog("Usage: hf mf efill <key A/B>");
1001 PrintAndLog("sample: hf mf efill A");
1002 PrintAndLog("Card data blocks transfers to card emulator memory.");
1003 PrintAndLog("Keys must be laid in the simulator memory. \n");
1007 char ctmp
= param_getchar(Cmd
, 0);
1009 PrintAndLog("Key type must be A or B");
1012 if (ctmp
!= 'A' && ctmp
!= 'a') keyType
= 1;
1014 UsbCommand c
= {CMD_MIFARE_EML_CARDLOAD
, {0, keyType
, 0}};
1019 int CmdHF14AMfEKeyPrn(const char *Cmd
)
1023 uint64_t keyA
, keyB
;
1025 PrintAndLog("|---|----------------|----------------|");
1026 PrintAndLog("|sec|key A |key B |");
1027 PrintAndLog("|---|----------------|----------------|");
1028 for (i
= 0; i
< 16; i
++) {
1029 if (mfEmlGetMem(data
, i
* 4 + 3, 1)) {
1030 PrintAndLog("error get block %d", i
* 4 + 3);
1033 keyA
= bytes_to_num(data
, 6);
1034 keyB
= bytes_to_num(data
+ 10, 6);
1035 PrintAndLog("|%03d| %012llx | %012llx |", i
, keyA
, keyB
);
1037 PrintAndLog("|---|----------------|----------------|");
1042 static command_t CommandTable
[] =
1044 {"help", CmdHelp
, 1, "This help"},
1045 {"dbg", CmdHF14AMfDbg
, 0, "Set default debug mode"},
1046 {"rdbl", CmdHF14AMfRdBl
, 0, "Read MIFARE classic block"},
1047 {"rdsc", CmdHF14AMfRdSc
, 0, "Read MIFARE classic sector"},
1048 {"dump1k", CmdHF14AMfDump1k
, 0, "Dump MIFARE classic tag to binary file"},
1049 {"restore1k", CmdHF14AMfRestore1k
, 0, "Restore MIFARE classic binary file to BLANK tag"},
1050 {"wrbl", CmdHF14AMfWrBl
, 0, "Write MIFARE classic block"},
1051 {"chk", CmdHF14AMfChk
, 0, "Test block up to 8 keys"},
1052 {"mifare", CmdHF14AMifare
, 0, "Read parity error messages. param - <used card nonce>"},
1053 {"nested", CmdHF14AMfNested
, 0, "Test nested authentication"},
1054 {"sim", CmdHF14AMf1kSim
, 0, "Simulate MIFARE 1k card"},
1055 {"eclr", CmdHF14AMfEClear
, 0, "Clear simulator memory block"},
1056 {"eget", CmdHF14AMfEGet
, 0, "Get simulator memory block"},
1057 {"eset", CmdHF14AMfESet
, 0, "Set simulator memory block"},
1058 {"eload", CmdHF14AMfELoad
, 0, "Load from file emul dump"},
1059 {"esave", CmdHF14AMfESave
, 0, "Save to file emul dump"},
1060 {"ecfill", CmdHF14AMfECFill
, 0, "Fill simulator memory with help of keys from simulator"},
1061 {"ekeyprn", CmdHF14AMfEKeyPrn
, 0, "Print keys from simulator memory"},
1062 {NULL
, NULL
, 0, NULL
}
1065 int CmdHFMF(const char *Cmd
)
1068 while (WaitForResponseTimeout(CMD_ACK
, 500) != NULL
) ;
1070 CmdsParse(CommandTable
, Cmd
);
1074 int CmdHelp(const char *Cmd
)
1076 CmdsHelp(CommandTable
);