]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhfmf.c
38b7f988ac52a569957d1f60eaf3d94bd2d73672
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2011,2012 Merlok
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // High frequency MIFARE commands
9 //-----------------------------------------------------------------------------
20 #include "cmdhfmfhard.h"
23 #include "util_posix.h"
26 #include "mifare/mifarehost.h"
28 #include "mifare/mfkey.h"
29 #include "hardnested/hardnested_bf_core.h"
30 #include "cliparser/cliparser.h"
32 #include "mifare/mifaredefault.h"
33 #include "mifare/mifare4.h"
34 #include "mifare/mad.h"
35 #include "mifare/ndef.h"
38 #define NESTED_SECTOR_RETRY 10 // how often we try mfested() until we give up
40 static int CmdHelp ( const char * Cmd
);
42 int CmdHF14AMifare ( const char * Cmd
)
46 isOK
= mfDarkside (& key
);
48 case - 1 : PrintAndLog ( "Button pressed. Aborted." ); return 1 ;
49 case - 2 : PrintAndLog ( "Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests)." ); return 1 ;
50 case - 3 : PrintAndLog ( "Card is not vulnerable to Darkside attack (its random number generator is not predictable)." ); return 1 ;
51 case - 4 : PrintAndLog ( "Card is not vulnerable to Darkside attack (its random number generator seems to be based on the wellknown" );
52 PrintAndLog ( "generating polynomial with 16 effective bits only, but shows unexpected behaviour." ); return 1 ;
53 case - 5 : PrintAndLog ( "Aborted via keyboard." ); return 1 ;
54 default : PrintAndLog ( "Found valid key:%012" PRIx64
" \n " , key
);
62 int CmdHF14AMfWrBl ( const char * Cmd
)
66 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
67 uint8_t bldata
[ 16 ] = { 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 };
72 PrintAndLog ( "Usage: hf mf wrbl <block number> <key A/B> <key (12 hex symbols)> <block data (32 hex symbols)>" );
73 PrintAndLog ( " sample: hf mf wrbl 0 A FFFFFFFFFFFF 000102030405060708090A0B0C0D0E0F" );
77 blockNo
= param_get8 ( Cmd
, 0 );
78 cmdp
= param_getchar ( Cmd
, 1 );
80 PrintAndLog ( "Key type must be A or B" );
83 if ( cmdp
!= 'A' && cmdp
!= 'a' ) keyType
= 1 ;
84 if ( param_gethex ( Cmd
, 2 , key
, 12 )) {
85 PrintAndLog ( "Key must include 12 HEX symbols" );
88 if ( param_gethex ( Cmd
, 3 , bldata
, 32 )) {
89 PrintAndLog ( "Block data must include 32 HEX symbols" );
92 PrintAndLog ( "--block no:%d, key type:%c, key:%s" , blockNo
, keyType
? 'B' : 'A' , sprint_hex ( key
, 6 ));
93 PrintAndLog ( "--data: %s" , sprint_hex ( bldata
, 16 ));
95 UsbCommand c
= { CMD_MIFARE_WRITEBL
, { blockNo
, keyType
, 0 }};
96 memcpy ( c
. d
. asBytes
, key
, 6 );
97 memcpy ( c
. d
. asBytes
+ 10 , bldata
, 16 );
101 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
102 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
103 PrintAndLog ( "isOk:%02x" , isOK
);
105 PrintAndLog ( "Command execute timeout" );
111 int CmdHF14AMfRdBl ( const char * Cmd
)
115 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
121 PrintAndLog ( "Usage: hf mf rdbl <block number> <key A/B> <key (12 hex symbols)>" );
122 PrintAndLog ( " sample: hf mf rdbl 0 A FFFFFFFFFFFF " );
126 blockNo
= param_get8 ( Cmd
, 0 );
127 cmdp
= param_getchar ( Cmd
, 1 );
129 PrintAndLog ( "Key type must be A or B" );
132 if ( cmdp
!= 'A' && cmdp
!= 'a' ) keyType
= 1 ;
133 if ( param_gethex ( Cmd
, 2 , key
, 12 )) {
134 PrintAndLog ( "Key must include 12 HEX symbols" );
137 PrintAndLog ( "--block no:%d, key type:%c, key:%s " , blockNo
, keyType
? 'B' : 'A' , sprint_hex ( key
, 6 ));
139 UsbCommand c
= { CMD_MIFARE_READBL
, { blockNo
, keyType
, 0 }};
140 memcpy ( c
. d
. asBytes
, key
, 6 );
144 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
145 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
146 uint8_t * data
= resp
. d
. asBytes
;
149 PrintAndLog ( "isOk:%02x data:%s" , isOK
, sprint_hex ( data
, 16 ));
151 PrintAndLog ( "isOk:%02x" , isOK
);
155 if ( mfIsSectorTrailer ( blockNo
) && ( data
[ 6 ] || data
[ 7 ] || data
[ 8 ])) {
156 PrintAndLogEx ( NORMAL
, "Trailer decoded:" );
157 int bln
= mfFirstBlockOfSector ( mfSectorNum ( blockNo
));
158 int blinc
= ( mfNumBlocksPerSector ( mfSectorNum ( blockNo
)) > 4 ) ? 5 : 1 ;
159 for ( int i
= 0 ; i
< 4 ; i
++) {
160 PrintAndLogEx ( NORMAL
, "Access block %d%s: %s" , bln
, (( blinc
> 1 ) && ( i
< 3 ) ? "+" : "" ) , mfGetAccessConditionsDesc ( i
, & data
[ 6 ]));
163 PrintAndLogEx ( NORMAL
, "UserData: %s" , sprint_hex_inrow (& data
[ 9 ], 1 ));
166 PrintAndLog ( "Command execute timeout" );
173 int CmdHF14AMfRdSc ( const char * Cmd
)
176 uint8_t sectorNo
= 0 ;
178 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
180 uint8_t * data
= NULL
;
184 PrintAndLog ( "Usage: hf mf rdsc <sector number> <key A/B> <key (12 hex symbols)>" );
185 PrintAndLog ( " sample: hf mf rdsc 0 A FFFFFFFFFFFF " );
189 sectorNo
= param_get8 ( Cmd
, 0 );
191 PrintAndLog ( "Sector number must be less than 40" );
194 cmdp
= param_getchar ( Cmd
, 1 );
195 if ( cmdp
!= 'a' && cmdp
!= 'A' && cmdp
!= 'b' && cmdp
!= 'B' ) {
196 PrintAndLog ( "Key type must be A or B" );
199 if ( cmdp
!= 'A' && cmdp
!= 'a' ) keyType
= 1 ;
200 if ( param_gethex ( Cmd
, 2 , key
, 12 )) {
201 PrintAndLog ( "Key must include 12 HEX symbols" );
204 PrintAndLog ( "--sector no:%d key type:%c key:%s " , sectorNo
, keyType
? 'B' : 'A' , sprint_hex ( key
, 6 ));
206 UsbCommand c
= { CMD_MIFARE_READSC
, { sectorNo
, keyType
, 0 }};
207 memcpy ( c
. d
. asBytes
, key
, 6 );
212 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
213 isOK
= resp
. arg
[ 0 ] & 0xff ;
214 data
= resp
. d
. asBytes
;
216 PrintAndLog ( "isOk:%02x" , isOK
);
218 for ( i
= 0 ; i
< ( sectorNo
< 32 ? 3 : 15 ); i
++) {
219 PrintAndLog ( "data : %s" , sprint_hex ( data
+ i
* 16 , 16 ));
221 PrintAndLog ( "trailer: %s" , sprint_hex ( data
+ ( sectorNo
< 32 ? 3 : 15 ) * 16 , 16 ));
223 PrintAndLogEx ( NORMAL
, "Trailer decoded:" );
224 int bln
= mfFirstBlockOfSector ( sectorNo
);
225 int blinc
= ( mfNumBlocksPerSector ( sectorNo
) > 4 ) ? 5 : 1 ;
226 for ( i
= 0 ; i
< 4 ; i
++) {
227 PrintAndLogEx ( NORMAL
, "Access block %d%s: %s" , bln
, (( blinc
> 1 ) && ( i
< 3 ) ? "+" : "" ) , mfGetAccessConditionsDesc ( i
, &( data
+ ( sectorNo
< 32 ? 3 : 15 ) * 16 )[ 6 ]));
230 PrintAndLogEx ( NORMAL
, "UserData: %s" , sprint_hex_inrow (&( data
+ ( sectorNo
< 32 ? 3 : 15 ) * 16 )[ 9 ], 1 ));
233 PrintAndLog ( "Command execute timeout" );
239 uint8_t FirstBlockOfSector ( uint8_t sectorNo
)
244 return 32 * 4 + ( sectorNo
- 32 ) * 16 ;
248 uint8_t NumBlocksPerSector ( uint8_t sectorNo
)
257 static int ParamCardSizeSectors ( const char c
) {
260 case '0' : numSectors
= 5 ; break ;
261 case '2' : numSectors
= 32 ; break ;
262 case '4' : numSectors
= 40 ; break ;
263 default : numSectors
= 16 ;
268 static int ParamCardSizeBlocks ( const char c
) {
269 int numBlocks
= 16 * 4 ;
271 case '0' : numBlocks
= 5 * 4 ; break ;
272 case '2' : numBlocks
= 32 * 4 ; break ;
273 case '4' : numBlocks
= 32 * 4 + 8 * 16 ; break ;
274 default : numBlocks
= 16 * 4 ;
279 int CmdHF14AMfDump ( const char * Cmd
)
281 uint8_t sectorNo
, blockNo
;
283 uint8_t keys
[ 2 ][ 40 ][ 6 ];
284 uint8_t rights
[ 40 ][ 4 ];
285 uint8_t carddata
[ 256 ][ 16 ];
286 uint8_t numSectors
= 16 ;
293 char cmdp
= param_getchar ( Cmd
, 0 );
294 numSectors
= ParamCardSizeSectors ( cmdp
);
296 if ( strlen ( Cmd
) > 3 || cmdp
== 'h' || cmdp
== 'H' ) {
297 PrintAndLog ( "Usage: hf mf dump [card memory] [k|m]" );
298 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
299 PrintAndLog ( " k: Always try using both Key A and Key B for each sector, even if access bits would prohibit it" );
300 PrintAndLog ( " m: When missing access bits or keys, replace that block with NULL" );
302 PrintAndLog ( "Samples: hf mf dump" );
303 PrintAndLog ( " hf mf dump 4" );
304 PrintAndLog ( " hf mf dump 4 m" );
308 char opts
= param_getchar ( Cmd
, 1 );
309 bool useBothKeysAlways
= false ;
310 if ( opts
== 'k' || opts
== 'K' ) useBothKeysAlways
= true ;
311 bool nullMissingKeys
= false ;
312 if ( opts
== 'm' || opts
== 'M' ) nullMissingKeys
= true ;
314 if (( fin
= fopen ( "dumpkeys.bin" , "rb" )) == NULL
) {
315 PrintAndLog ( "Could not find file dumpkeys.bin" );
319 // Read keys from file
320 for ( int group
= 0 ; group
<= 1 ; group
++) {
321 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
322 size_t bytes_read
= fread ( keys
[ group
][ sectorNo
], 1 , 6 , fin
);
323 if ( bytes_read
!= 6 ) {
324 PrintAndLog ( "File reading error." );
333 PrintAndLog ( "|-----------------------------------------|" );
334 PrintAndLog ( "|------ Reading sector access bits...-----|" );
335 PrintAndLog ( "|-----------------------------------------|" );
337 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
338 for ( tries
= 0 ; tries
< 3 ; tries
++) {
339 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + NumBlocksPerSector ( sectorNo
) - 1 , 0 , 0 }};
340 // At least the Access Conditions can always be read with key A.
341 memcpy ( c
. d
. asBytes
, keys
[ 0 ][ sectorNo
], 6 );
344 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
345 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
346 uint8_t * data
= resp
. d
. asBytes
;
348 rights
[ sectorNo
][ 0 ] = (( data
[ 7 ] & 0x10 )>> 2 ) | (( data
[ 8 ] & 0x1 )<< 1 ) | (( data
[ 8 ] & 0x10 )>> 4 ); // C1C2C3 for data area 0
349 rights
[ sectorNo
][ 1 ] = (( data
[ 7 ] & 0x20 )>> 3 ) | (( data
[ 8 ] & 0x2 )<< 0 ) | (( data
[ 8 ] & 0x20 )>> 5 ); // C1C2C3 for data area 1
350 rights
[ sectorNo
][ 2 ] = (( data
[ 7 ] & 0x40 )>> 4 ) | (( data
[ 8 ] & 0x4 )>> 1 ) | (( data
[ 8 ] & 0x40 )>> 6 ); // C1C2C3 for data area 2
351 rights
[ sectorNo
][ 3 ] = (( data
[ 7 ] & 0x80 )>> 5 ) | (( data
[ 8 ] & 0x8 )>> 2 ) | (( data
[ 8 ] & 0x80 )>> 7 ); // C1C2C3 for sector trailer
353 } else if ( tries
== 2 ) { // on last try set defaults
354 PrintAndLog ( "Could not get access rights for sector %2d. Trying with defaults..." , sectorNo
);
355 rights
[ sectorNo
][ 0 ] = rights
[ sectorNo
][ 1 ] = rights
[ sectorNo
][ 2 ] = 0x00 ;
356 rights
[ sectorNo
][ 3 ] = 0x01 ;
359 PrintAndLog ( "Command execute timeout when trying to read access rights for sector %2d. Trying with defaults..." , sectorNo
);
360 rights
[ sectorNo
][ 0 ] = rights
[ sectorNo
][ 1 ] = rights
[ sectorNo
][ 2 ] = 0x00 ;
361 rights
[ sectorNo
][ 3 ] = 0x01 ;
366 PrintAndLog ( "|-----------------------------------------|" );
367 PrintAndLog ( "|----- Dumping all blocks to file... -----|" );
368 PrintAndLog ( "|-----------------------------------------|" );
371 for ( sectorNo
= 0 ; isOK
&& sectorNo
< numSectors
; sectorNo
++) {
372 for ( blockNo
= 0 ; isOK
&& blockNo
< NumBlocksPerSector ( sectorNo
); blockNo
++) {
373 bool received
= false ;
374 for ( tries
= 0 ; tries
< 3 ; tries
++) {
375 if ( blockNo
== NumBlocksPerSector ( sectorNo
) - 1 ) { // sector trailer. At least the Access Conditions can always be read with key A.
376 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, 0 , 0 }};
377 memcpy ( c
. d
. asBytes
, keys
[ 0 ][ sectorNo
], 6 );
379 received
= WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 );
380 } else if ( useBothKeysAlways
) {
381 // Always try both keys, even if access conditions wouldn't work.
382 for ( int k
= 0 ; k
<= 1 ; k
++) {
383 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, 1 , 0 }};
384 memcpy ( c
. d
. asBytes
, keys
[ k
][ sectorNo
], 6 );
386 received
= WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 );
388 // Don't try the other one on success.
389 if ( resp
. arg
[ 0 ] & 0xff ) break ;
391 } else { // data block. Check if it can be read with key A or key B
392 uint8_t data_area
= sectorNo
< 32 ? blockNo
: blockNo
/ 5 ;
393 if (( rights
[ sectorNo
][ data_area
] == 0x03 ) || ( rights
[ sectorNo
][ data_area
] == 0x05 )) { // only key B would work
394 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, 1 , 0 }};
395 memcpy ( c
. d
. asBytes
, keys
[ 1 ][ sectorNo
], 6 );
397 received
= WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 );
398 } else if ( rights
[ sectorNo
][ data_area
] == 0x07 ) { // no key would work
399 PrintAndLog ( "Access rights do not allow reading of sector %2d block %3d" , sectorNo
, blockNo
);
400 if ( nullMissingKeys
) {
401 memset ( resp
. d
. asBytes
, 0 , 16 );
403 PrintAndLog ( " ... filling the block with NULL" );
409 } else { // key A would work
410 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, 0 , 0 }};
411 memcpy ( c
. d
. asBytes
, keys
[ 0 ][ sectorNo
], 6 );
413 received
= WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 );
417 isOK
= resp
. arg
[ 0 ] & 0xff ;
423 isOK
= resp
. arg
[ 0 ] & 0xff ;
424 uint8_t * data
= resp
. d
. asBytes
;
425 if ( blockNo
== NumBlocksPerSector ( sectorNo
) - 1 ) { // sector trailer. Fill in the keys.
426 memcpy ( data
, keys
[ 0 ][ sectorNo
], 6 );
427 memcpy ( data
+ 10 , keys
[ 1 ][ sectorNo
], 6 );
430 memcpy ( carddata
[ FirstBlockOfSector ( sectorNo
) + blockNo
], data
, 16 );
431 PrintAndLog ( "Successfully read block %2d of sector %2d." , blockNo
, sectorNo
);
433 PrintAndLog ( "Could not read block %2d of sector %2d" , blockNo
, sectorNo
);
439 PrintAndLog ( "Command execute timeout when trying to read block %2d of sector %2d." , blockNo
, sectorNo
);
446 if (( fout
= fopen ( "dumpdata.bin" , "wb" )) == NULL
) {
447 PrintAndLog ( "Could not create file name dumpdata.bin" );
450 uint16_t numblocks
= FirstBlockOfSector ( numSectors
- 1 ) + NumBlocksPerSector ( numSectors
- 1 );
451 fwrite ( carddata
, 1 , 16 * numblocks
, fout
);
453 PrintAndLog ( "Dumped %d blocks (%d bytes) to file dumpdata.bin" , numblocks
, 16 * numblocks
);
459 int CmdHF14AMfRestore ( const char * Cmd
)
461 uint8_t sectorNo
, blockNo
;
463 uint8_t key
[ 6 ] = { 0xFF , 0xFF , 0xFF , 0xFF , 0xFF , 0xFF };
464 uint8_t bldata
[ 16 ] = { 0x00 };
472 char cmdp
= param_getchar ( Cmd
, 0 );
474 case '0' : numSectors
= 5 ; break ;
476 case '\0' : numSectors
= 16 ; break ;
477 case '2' : numSectors
= 32 ; break ;
478 case '4' : numSectors
= 40 ; break ;
479 default : numSectors
= 16 ;
482 if ( strlen ( Cmd
) > 1 || cmdp
== 'h' || cmdp
== 'H' ) {
483 PrintAndLog ( "Usage: hf mf restore [card memory]" );
484 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
486 PrintAndLog ( "Samples: hf mf restore" );
487 PrintAndLog ( " hf mf restore 4" );
491 if (( fkeys
= fopen ( "dumpkeys.bin" , "rb" )) == NULL
) {
492 PrintAndLog ( "Could not find file dumpkeys.bin" );
496 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
497 size_t bytes_read
= fread ( keyA
[ sectorNo
], 1 , 6 , fkeys
);
498 if ( bytes_read
!= 6 ) {
499 PrintAndLog ( "File reading error (dumpkeys.bin)." );
505 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
506 size_t bytes_read
= fread ( keyB
[ sectorNo
], 1 , 6 , fkeys
);
507 if ( bytes_read
!= 6 ) {
508 PrintAndLog ( "File reading error (dumpkeys.bin)." );
516 if (( fdump
= fopen ( "dumpdata.bin" , "rb" )) == NULL
) {
517 PrintAndLog ( "Could not find file dumpdata.bin" );
520 PrintAndLog ( "Restoring dumpdata.bin to card" );
522 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
523 for ( blockNo
= 0 ; blockNo
< NumBlocksPerSector ( sectorNo
); blockNo
++) {
524 UsbCommand c
= { CMD_MIFARE_WRITEBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, keyType
, 0 }};
525 memcpy ( c
. d
. asBytes
, key
, 6 );
527 size_t bytes_read
= fread ( bldata
, 1 , 16 , fdump
);
528 if ( bytes_read
!= 16 ) {
529 PrintAndLog ( "File reading error (dumpdata.bin)." );
534 if ( blockNo
== NumBlocksPerSector ( sectorNo
) - 1 ) { // sector trailer
535 bldata
[ 0 ] = ( keyA
[ sectorNo
][ 0 ]);
536 bldata
[ 1 ] = ( keyA
[ sectorNo
][ 1 ]);
537 bldata
[ 2 ] = ( keyA
[ sectorNo
][ 2 ]);
538 bldata
[ 3 ] = ( keyA
[ sectorNo
][ 3 ]);
539 bldata
[ 4 ] = ( keyA
[ sectorNo
][ 4 ]);
540 bldata
[ 5 ] = ( keyA
[ sectorNo
][ 5 ]);
541 bldata
[ 10 ] = ( keyB
[ sectorNo
][ 0 ]);
542 bldata
[ 11 ] = ( keyB
[ sectorNo
][ 1 ]);
543 bldata
[ 12 ] = ( keyB
[ sectorNo
][ 2 ]);
544 bldata
[ 13 ] = ( keyB
[ sectorNo
][ 3 ]);
545 bldata
[ 14 ] = ( keyB
[ sectorNo
][ 4 ]);
546 bldata
[ 15 ] = ( keyB
[ sectorNo
][ 5 ]);
549 PrintAndLog ( "Writing to block %3d: %s" , FirstBlockOfSector ( sectorNo
) + blockNo
, sprint_hex ( bldata
, 16 ));
551 memcpy ( c
. d
. asBytes
+ 10 , bldata
, 16 );
555 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
556 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
557 PrintAndLog ( "isOk:%02x" , isOK
);
559 PrintAndLog ( "Command execute timeout" );
568 //----------------------------------------------
570 //----------------------------------------------
572 static void parseParamTDS ( const char * Cmd
, const uint8_t indx
, bool * paramT
, bool * paramD
, uint8_t * timeout
) {
574 int len
= param_getlength ( Cmd
, indx
);
575 if ( len
> 0 && len
< 4 ){
576 param_getstr ( Cmd
, indx
, ctmp3
, sizeof ( ctmp3
));
578 * paramT
|= ( ctmp3
[ 0 ] == 't' || ctmp3
[ 0 ] == 'T' );
579 * paramD
|= ( ctmp3
[ 0 ] == 'd' || ctmp3
[ 0 ] == 'D' );
580 bool paramS1
= * paramT
|| * paramD
;
582 // slow and very slow
583 if ( ctmp3
[ 0 ] == 's' || ctmp3
[ 0 ] == 'S' || ctmp3
[ 1 ] == 's' || ctmp3
[ 1 ] == 'S' ) {
584 * timeout
= 11 ; // slow
586 if (! paramS1
&& ( ctmp3
[ 1 ] == 's' || ctmp3
[ 1 ] == 'S' )) {
587 * timeout
= 53 ; // very slow
589 if ( paramS1
&& ( ctmp3
[ 2 ] == 's' || ctmp3
[ 2 ] == 'S' )) {
590 * timeout
= 53 ; // very slow
596 int CmdHF14AMfNested ( const char * Cmd
)
598 int i
, j
, res
, iterations
;
599 sector_t
* e_sector
= NULL
;
602 uint8_t trgBlockNo
= 0 ;
603 uint8_t trgKeyType
= 0 ;
604 uint8_t SectorsCnt
= 0 ;
605 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
606 uint8_t keyBlock
[ MifareDefaultKeysSize
* 6 ];
608 // timeout in units. (ms * 106)/10 or us*0.0106
609 uint8_t btimeout14a
= MF_CHKKEYS_DEFTIMEOUT
; // fast by default
611 bool autosearchKey
= false ;
613 bool transferToEml
= false ;
614 bool createDumpFile
= false ;
616 uint8_t standart
[ 6 ] = { 0xFF , 0xFF , 0xFF , 0xFF , 0xFF , 0xFF };
617 uint8_t tempkey
[ 6 ] = { 0xFF , 0xFF , 0xFF , 0xFF , 0xFF , 0xFF };
622 PrintAndLog ( "Usage:" );
623 PrintAndLog ( " all sectors: hf mf nested <card memory> <block number> <key A/B> <key (12 hex symbols)> [t|d|s|ss]" );
624 PrintAndLog ( " all sectors autosearch key: hf mf nested <card memory> * [t|d|s|ss]" );
625 PrintAndLog ( " one sector: hf mf nested o <block number> <key A/B> <key (12 hex symbols)>" );
626 PrintAndLog ( " <target block number> <target key A/B> [t]" );
628 PrintAndLog ( "card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K" );
629 PrintAndLog ( "t - transfer keys to emulator memory" );
630 PrintAndLog ( "d - write keys to binary file dumpkeys.bin" );
631 PrintAndLog ( "s - Slow (1ms) check keys (required by some non standard cards)" );
632 PrintAndLog ( "ss - Very slow (5ms) check keys" );
634 PrintAndLog ( " sample1: hf mf nested 1 0 A FFFFFFFFFFFF " );
635 PrintAndLog ( " sample2: hf mf nested 1 0 A FFFFFFFFFFFF t " );
636 PrintAndLog ( " sample3: hf mf nested 1 0 A FFFFFFFFFFFF d " );
637 PrintAndLog ( " sample4: hf mf nested o 0 A FFFFFFFFFFFF 4 A" );
638 PrintAndLog ( " sample5: hf mf nested 1 * t" );
639 PrintAndLog ( " sample6: hf mf nested 1 * ss" );
644 cmdp
= param_getchar ( Cmd
, 0 );
645 if ( cmdp
== 'o' || cmdp
== 'O' ) {
649 SectorsCnt
= ParamCardSizeSectors ( cmdp
);
652 // <block number>. number or autosearch key (*)
653 if ( param_getchar ( Cmd
, 1 ) == '*' ) {
654 autosearchKey
= true ;
656 parseParamTDS ( Cmd
, 2 , & transferToEml
, & createDumpFile
, & btimeout14a
);
658 PrintAndLog ( "--nested. sectors:%2d, block no:*, eml:%c, dmp=%c checktimeout=%d us" ,
659 SectorsCnt
, transferToEml
? 'y' : 'n' , createDumpFile
? 'y' : 'n' , (( int ) btimeout14a
* 10000 ) / 106 );
661 blockNo
= param_get8 ( Cmd
, 1 );
663 ctmp
= param_getchar ( Cmd
, 2 );
664 if ( ctmp
!= 'a' && ctmp
!= 'A' && ctmp
!= 'b' && ctmp
!= 'B' ) {
665 PrintAndLog ( "Key type must be A or B" );
669 if ( ctmp
!= 'A' && ctmp
!= 'a' )
672 if ( param_gethex ( Cmd
, 3 , key
, 12 )) {
673 PrintAndLog ( "Key must include 12 HEX symbols" );
677 // check if we can authenticate to sector
678 res
= mfCheckKeys ( blockNo
, keyType
, true , 1 , key
, & key64
);
680 PrintAndLog ( "Can't authenticate to block:%3d key type:%c key:%s" , blockNo
, keyType
? 'B' : 'A' , sprint_hex ( key
, 6 ));
686 trgBlockNo
= param_get8 ( Cmd
, 4 );
688 ctmp
= param_getchar ( Cmd
, 5 );
689 if ( ctmp
!= 'a' && ctmp
!= 'A' && ctmp
!= 'b' && ctmp
!= 'B' ) {
690 PrintAndLog ( "Target key type must be A or B" );
693 if ( ctmp
!= 'A' && ctmp
!= 'a' )
696 parseParamTDS ( Cmd
, 6 , & transferToEml
, & createDumpFile
, & btimeout14a
);
698 parseParamTDS ( Cmd
, 4 , & transferToEml
, & createDumpFile
, & btimeout14a
);
701 PrintAndLog ( "--nested. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us" ,
702 SectorsCnt
, blockNo
, keyType
? 'B' : 'A' , transferToEml
? 'y' : 'n' , createDumpFile
? 'y' : 'n' , (( int ) btimeout14a
* 10000 ) / 106 );
706 if ( cmdp
== 'o' ) { // ------------------------------------ one sector working
707 PrintAndLog ( "--target block no:%3d, target key type:%c " , trgBlockNo
, trgKeyType
? 'B' : 'A' );
708 int16_t isOK
= mfnested ( blockNo
, keyType
, key
, trgBlockNo
, trgKeyType
, keyBlock
, true );
711 case - 1 : PrintAndLog ( "Error: No response from Proxmark. \n " ); break ;
712 case - 2 : PrintAndLog ( "Button pressed. Aborted. \n " ); break ;
713 case - 3 : PrintAndLog ( "Tag isn't vulnerable to Nested Attack (random numbers are not predictable). \n " ); break ;
714 default : PrintAndLog ( "Unknown Error. \n " );
718 key64
= bytes_to_num ( keyBlock
, 6 );
720 PrintAndLog ( "Found valid key:%012" PRIx64
, key64
);
722 // transfer key to the emulator
724 uint8_t sectortrailer
;
725 if ( trgBlockNo
< 32 * 4 ) { // 4 block sector
726 sectortrailer
= trgBlockNo
| 0x03 ;
727 } else { // 16 block sector
728 sectortrailer
= trgBlockNo
| 0x0f ;
730 mfEmlGetMem ( keyBlock
, sectortrailer
, 1 );
733 num_to_bytes ( key64
, 6 , keyBlock
);
735 num_to_bytes ( key64
, 6 , & keyBlock
[ 10 ]);
736 mfEmlSetMem ( keyBlock
, sectortrailer
, 1 );
737 PrintAndLog ( "Key transferred to emulator memory." );
740 PrintAndLog ( "No valid key found" );
743 else { // ------------------------------------ multiple sectors working
745 msclock1
= msclock ();
747 e_sector
= calloc ( SectorsCnt
, sizeof ( sector_t
));
748 if ( e_sector
== NULL
) return 1 ;
750 //test current key and additional standard keys first
751 for ( int defaultKeyCounter
= 0 ; defaultKeyCounter
< MifareDefaultKeysSize
; defaultKeyCounter
++){
752 num_to_bytes ( MifareDefaultKeys
[ defaultKeyCounter
], 6 , ( uint8_t *)( keyBlock
+ defaultKeyCounter
* 6 ));
755 PrintAndLog ( "Testing known keys. Sector count=%d" , SectorsCnt
);
756 mfCheckKeysSec ( SectorsCnt
, 2 , btimeout14a
, true , MifareDefaultKeysSize
, keyBlock
, e_sector
);
758 // get known key from array
759 bool keyFound
= false ;
761 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
762 for ( j
= 0 ; j
< 2 ; j
++) {
763 if ( e_sector
[ i
]. foundKey
[ j
]) {
767 num_to_bytes ( e_sector
[ i
]. Key
[ j
], 6 , key
);
775 // Can't found a key....
777 PrintAndLog ( "Can't found any of the known keys." );
781 PrintAndLog ( "--auto key. block no:%3d, key type:%c key:%s" , blockNo
, keyType
? 'B' : 'A' , sprint_hex ( key
, 6 ));
786 PrintAndLog ( "nested..." );
787 bool calibrate
= true ;
788 for ( i
= 0 ; i
< NESTED_SECTOR_RETRY
; i
++) {
789 for ( uint8_t sectorNo
= 0 ; sectorNo
< SectorsCnt
; sectorNo
++) {
790 for ( trgKeyType
= 0 ; trgKeyType
< 2 ; trgKeyType
++) {
791 if ( e_sector
[ sectorNo
]. foundKey
[ trgKeyType
]) continue ;
792 PrintAndLog ( "-----------------------------------------------" );
793 int16_t isOK
= mfnested ( blockNo
, keyType
, key
, FirstBlockOfSector ( sectorNo
), trgKeyType
, keyBlock
, calibrate
);
796 case - 1 : PrintAndLog ( "Error: No response from Proxmark. \n " ); break ;
797 case - 2 : PrintAndLog ( "Button pressed. Aborted. \n " ); break ;
798 case - 3 : PrintAndLog ( "Tag isn't vulnerable to Nested Attack (random numbers are not predictable). \n " ); break ;
799 default : PrintAndLog ( "Unknown Error. \n " );
809 key64
= bytes_to_num ( keyBlock
, 6 );
811 PrintAndLog ( "Found valid key:%012" PRIx64
, key64
);
812 e_sector
[ sectorNo
]. foundKey
[ trgKeyType
] = 1 ;
813 e_sector
[ sectorNo
]. Key
[ trgKeyType
] = key64
;
815 // try to check this key as a key to the other sectors
816 mfCheckKeysSec ( SectorsCnt
, 2 , btimeout14a
, true , 1 , keyBlock
, e_sector
);
822 // print nested statistic
823 PrintAndLog ( " \n\n ----------------------------------------------- \n Nested statistic: \n Iterations count: %d" , iterations
);
824 PrintAndLog ( "Time in nested: %1.3f (%1.3f sec per key)" , (( float )( msclock () - msclock1
))/ 1000.0 , (( float )( msclock () - msclock1
))/ iterations
/ 1000.0 );
827 PrintAndLog ( "|---|----------------|---|----------------|---|" );
828 PrintAndLog ( "|sec|key A |res|key B |res|" );
829 PrintAndLog ( "|---|----------------|---|----------------|---|" );
830 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
831 PrintAndLog ( "|%03d| %012" PRIx64
" | %d | %012" PRIx64
" | %d |" , i
,
832 e_sector
[ i
]. Key
[ 0 ], e_sector
[ i
]. foundKey
[ 0 ], e_sector
[ i
]. Key
[ 1 ], e_sector
[ i
]. foundKey
[ 1 ]);
834 PrintAndLog ( "|---|----------------|---|----------------|---|" );
836 // transfer keys to the emulator memory
838 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
839 mfEmlGetMem ( keyBlock
, FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 , 1 );
840 if ( e_sector
[ i
]. foundKey
[ 0 ])
841 num_to_bytes ( e_sector
[ i
]. Key
[ 0 ], 6 , keyBlock
);
842 if ( e_sector
[ i
]. foundKey
[ 1 ])
843 num_to_bytes ( e_sector
[ i
]. Key
[ 1 ], 6 , & keyBlock
[ 10 ]);
844 mfEmlSetMem ( keyBlock
, FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 , 1 );
846 PrintAndLog ( "Keys transferred to emulator memory." );
850 if ( createDumpFile
) {
851 if (( fkeys
= fopen ( "dumpkeys.bin" , "wb" )) == NULL
) {
852 PrintAndLog ( "Could not create file dumpkeys.bin" );
856 PrintAndLog ( "Printing keys to binary file dumpkeys.bin..." );
857 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
858 if ( e_sector
[ i
]. foundKey
[ 0 ]){
859 num_to_bytes ( e_sector
[ i
]. Key
[ 0 ], 6 , tempkey
);
860 fwrite ( tempkey
, 1 , 6 , fkeys
);
863 fwrite ( & standart
, 1 , 6 , fkeys
);
866 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
867 if ( e_sector
[ i
]. foundKey
[ 1 ]){
868 num_to_bytes ( e_sector
[ i
]. Key
[ 1 ], 6 , tempkey
);
869 fwrite ( tempkey
, 1 , 6 , fkeys
);
872 fwrite ( & standart
, 1 , 6 , fkeys
);
884 int CmdHF14AMfNestedHard ( const char * Cmd
)
888 uint8_t trgBlockNo
= 0 ;
889 uint8_t trgKeyType
= 0 ;
890 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
891 uint8_t trgkey
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
894 ctmp
= param_getchar ( Cmd
, 0 );
896 if ( ctmp
!= 'R' && ctmp
!= 'r' && ctmp
!= 'T' && ctmp
!= 't' && strlen ( Cmd
) < 20 ) {
897 PrintAndLog ( "Usage:" );
898 PrintAndLog ( " hf mf hardnested <block number> <key A|B> <key (12 hex symbols)>" );
899 PrintAndLog ( " <target block number> <target key A|B> [known target key (12 hex symbols)] [w] [s]" );
900 PrintAndLog ( " or hf mf hardnested r [known target key]" );
902 PrintAndLog ( "Options: " );
903 PrintAndLog ( " w: Acquire nonces and write them to binary file nonces.bin" );
904 PrintAndLog ( " s: Slower acquisition (required by some non standard cards)" );
905 PrintAndLog ( " r: Read nonces.bin and start attack" );
906 PrintAndLog ( " iX: set type of SIMD instructions. Without this flag programs autodetect it." );
907 PrintAndLog ( " i5: AVX512" );
908 PrintAndLog ( " i2: AVX2" );
909 PrintAndLog ( " ia: AVX" );
910 PrintAndLog ( " is: SSE2" );
911 PrintAndLog ( " im: MMX" );
912 PrintAndLog ( " in: none (use CPU regular instruction set)" );
914 PrintAndLog ( " sample1: hf mf hardnested 0 A FFFFFFFFFFFF 4 A" );
915 PrintAndLog ( " sample2: hf mf hardnested 0 A FFFFFFFFFFFF 4 A w" );
916 PrintAndLog ( " sample3: hf mf hardnested 0 A FFFFFFFFFFFF 4 A w s" );
917 PrintAndLog ( " sample4: hf mf hardnested r" );
919 PrintAndLog ( "Add the known target key to check if it is present in the remaining key space:" );
920 PrintAndLog ( " sample5: hf mf hardnested 0 A A0A1A2A3A4A5 4 A FFFFFFFFFFFF" );
924 bool know_target_key
= false ;
925 bool nonce_file_read
= false ;
926 bool nonce_file_write
= false ;
932 if ( ctmp
== 'R' || ctmp
== 'r' ) {
933 nonce_file_read
= true ;
935 if (! param_gethex ( Cmd
, 1 , trgkey
, 12 )) {
936 know_target_key
= true ;
939 } else if ( ctmp
== 'T' || ctmp
== 't' ) {
940 tests
= param_get32ex ( Cmd
, 1 , 100 , 10 );
942 if (! param_gethex ( Cmd
, 2 , trgkey
, 12 )) {
943 know_target_key
= true ;
947 blockNo
= param_get8 ( Cmd
, 0 );
948 ctmp
= param_getchar ( Cmd
, 1 );
949 if ( ctmp
!= 'a' && ctmp
!= 'A' && ctmp
!= 'b' && ctmp
!= 'B' ) {
950 PrintAndLog ( "Key type must be A or B" );
953 if ( ctmp
!= 'A' && ctmp
!= 'a' ) {
957 if ( param_gethex ( Cmd
, 2 , key
, 12 )) {
958 PrintAndLog ( "Key must include 12 HEX symbols" );
962 trgBlockNo
= param_get8 ( Cmd
, 3 );
963 ctmp
= param_getchar ( Cmd
, 4 );
964 if ( ctmp
!= 'a' && ctmp
!= 'A' && ctmp
!= 'b' && ctmp
!= 'B' ) {
965 PrintAndLog ( "Target key type must be A or B" );
968 if ( ctmp
!= 'A' && ctmp
!= 'a' ) {
974 if (! param_gethex ( Cmd
, 5 , trgkey
, 12 )) {
975 know_target_key
= true ;
980 while (( ctmp
= param_getchar ( Cmd
, i
))) {
981 if ( ctmp
== 's' || ctmp
== 'S' ) {
983 } else if ( ctmp
== 'w' || ctmp
== 'W' ) {
984 nonce_file_write
= true ;
985 } else if ( param_getlength ( Cmd
, i
) == 2 && ctmp
== 'i' ) {
988 PrintAndLog ( "Possible options are w , s and/or iX" );
995 SetSIMDInstr ( SIMD_AUTO
);
997 while (( ctmp
= param_getchar ( Cmd
, iindx
))) {
998 if ( param_getlength ( Cmd
, iindx
) == 2 && ctmp
== 'i' ) {
999 switch ( param_getchar_indx ( Cmd
, 1 , iindx
)) {
1001 SetSIMDInstr ( SIMD_AVX512
);
1004 SetSIMDInstr ( SIMD_AVX2
);
1007 SetSIMDInstr ( SIMD_AVX
);
1010 SetSIMDInstr ( SIMD_SSE2
);
1013 SetSIMDInstr ( SIMD_MMX
);
1016 SetSIMDInstr ( SIMD_NONE
);
1019 PrintAndLog ( "Unknown SIMD type. %c" , param_getchar_indx ( Cmd
, 1 , iindx
));
1027 PrintAndLog ( "--target block no:%3d, target key type:%c, known target key: 0x%02x%02x%02x%02x%02x%02x%s, file action: %s, Slow: %s, Tests: %d " ,
1030 trgkey
[ 0 ], trgkey
[ 1 ], trgkey
[ 2 ], trgkey
[ 3 ], trgkey
[ 4 ], trgkey
[ 5 ],
1031 know_target_key
? "" : " (not set)" ,
1032 nonce_file_write
? "write" : nonce_file_read
? "read" : "none" ,
1036 int16_t isOK
= mfnestedhard ( blockNo
, keyType
, key
, trgBlockNo
, trgKeyType
, know_target_key
? trgkey
: NULL
, nonce_file_read
, nonce_file_write
, slow
, tests
);
1040 case 1 : PrintAndLog ( "Error: No response from Proxmark. \n " ); break ;
1041 case 2 : PrintAndLog ( "Button pressed. Aborted. \n " ); break ;
1051 int CmdHF14AMfChk ( const char * Cmd
)
1053 if ( strlen ( Cmd
)< 3 ) {
1054 PrintAndLog ( "Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d|s|ss] [<key (12 hex symbols)>] [<dic (*.dic)>]" );
1055 PrintAndLog ( " * - all sectors" );
1056 PrintAndLog ( "card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K" );
1057 PrintAndLog ( "d - write keys to binary file \n " );
1058 PrintAndLog ( "t - write keys to emulator memory" );
1059 PrintAndLog ( "s - slow execute. timeout 1ms" );
1060 PrintAndLog ( "ss - very slow execute. timeout 5ms" );
1061 PrintAndLog ( " sample: hf mf chk 0 A 1234567890ab keys.dic" );
1062 PrintAndLog ( " hf mf chk *1 ? t" );
1063 PrintAndLog ( " hf mf chk *1 ? d" );
1064 PrintAndLog ( " hf mf chk *1 ? s" );
1065 PrintAndLog ( " hf mf chk *1 ? dss" );
1070 char filename
[ FILE_PATH_SIZE
]={ 0 };
1072 uint8_t * keyBlock
= NULL
, * p
;
1073 uint16_t stKeyBlock
= 20 ;
1079 uint8_t blockNo
= 0 ;
1080 uint8_t SectorsCnt
= 0 ;
1081 uint8_t keyType
= 0 ;
1083 // timeout in units. (ms * 106)/10 or us*0.0106
1084 uint8_t btimeout14a
= MF_CHKKEYS_DEFTIMEOUT
; // fast by default
1085 bool param3InUse
= false ;
1087 bool transferToEml
= 0 ;
1088 bool createDumpFile
= 0 ;
1090 sector_t
* e_sector
= NULL
;
1092 keyBlock
= calloc ( stKeyBlock
, 6 );
1093 if ( keyBlock
== NULL
) return 1 ;
1095 int defaultKeysSize
= MifareDefaultKeysSize
;
1096 for ( int defaultKeyCounter
= 0 ; defaultKeyCounter
< defaultKeysSize
; defaultKeyCounter
++){
1097 num_to_bytes ( MifareDefaultKeys
[ defaultKeyCounter
], 6 , ( uint8_t *)( keyBlock
+ defaultKeyCounter
* 6 ));
1100 if ( param_getchar ( Cmd
, 0 )== '*' ) {
1101 SectorsCnt
= ParamCardSizeSectors ( param_getchar ( Cmd
+ 1 , 0 ));
1104 blockNo
= param_get8 ( Cmd
, 0 );
1106 ctmp
= param_getchar ( Cmd
, 1 );
1107 clen
= param_getlength ( Cmd
, 1 );
1120 PrintAndLog ( "Key type must be A , B or ?" );
1126 parseParamTDS ( Cmd
, 2 , & transferToEml
, & createDumpFile
, & btimeout14a
);
1128 param3InUse
= transferToEml
| createDumpFile
| ( btimeout14a
!= MF_CHKKEYS_DEFTIMEOUT
);
1130 PrintAndLog ( "--chk keys. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us" ,
1131 SectorsCnt
, blockNo
, keyType
? 'B' : 'A' , transferToEml
? 'y' : 'n' , createDumpFile
? 'y' : 'n' , (( int ) btimeout14a
* 10000 ) / 106 );
1133 for ( i
= param3InUse
; param_getchar ( Cmd
, 2 + i
); i
++) {
1134 if (! param_gethex ( Cmd
, 2 + i
, keyBlock
+ 6 * keycnt
, 12 )) {
1135 if ( stKeyBlock
- keycnt
< 2 ) {
1136 p
= realloc ( keyBlock
, 6 *( stKeyBlock
+= 10 ));
1138 PrintAndLog ( "Cannot allocate memory for Keys" );
1144 PrintAndLog ( "chk key[%2d] %02x%02x%02x%02x%02x%02x" , keycnt
,
1145 ( keyBlock
+ 6 * keycnt
)[ 0 ],( keyBlock
+ 6 * keycnt
)[ 1 ], ( keyBlock
+ 6 * keycnt
)[ 2 ],
1146 ( keyBlock
+ 6 * keycnt
)[ 3 ], ( keyBlock
+ 6 * keycnt
)[ 4 ], ( keyBlock
+ 6 * keycnt
)[ 5 ], 6 );
1149 // May be a dic file
1150 if ( param_getstr ( Cmd
, 2 + i
, filename
, sizeof ( filename
)) >= FILE_PATH_SIZE
) {
1151 PrintAndLog ( "File name too long" );
1156 if ( ( f
= fopen ( filename
, "r" )) ) {
1157 while ( fgets ( buf
, sizeof ( buf
), f
) ){
1158 if ( strlen ( buf
) < 12 || buf
[ 11 ] == ' \n ' )
1161 while ( fgetc ( f
) != ' \n ' && ! feof ( f
)) ; //goto next line
1163 if ( buf
[ 0 ]== '#' ) continue ; //The line start with # is comment, skip
1165 if (! isxdigit (( unsigned char ) buf
[ 0 ])){
1166 PrintAndLog ( "File content error. '%s' must include 12 HEX symbols" , buf
);
1172 if ( stKeyBlock
- keycnt
< 2 ) {
1173 p
= realloc ( keyBlock
, 6 *( stKeyBlock
+= 10 ));
1175 PrintAndLog ( "Cannot allocate memory for defKeys" );
1182 memset ( keyBlock
+ 6 * keycnt
, 0 , 6 );
1183 num_to_bytes ( strtoll ( buf
, NULL
, 16 ), 6 , keyBlock
+ 6 * keycnt
);
1184 PrintAndLog ( "chk custom key[%2d] %012" PRIx64
, keycnt
, bytes_to_num ( keyBlock
+ 6 * keycnt
, 6 ));
1186 memset ( buf
, 0 , sizeof ( buf
));
1190 PrintAndLog ( "File: %s: not found or locked." , filename
);
1198 // fill with default keys
1200 PrintAndLog ( "No key specified, trying default keys" );
1201 for (; keycnt
< defaultKeysSize
; keycnt
++)
1202 PrintAndLog ( "chk default key[%2d] %02x%02x%02x%02x%02x%02x" , keycnt
,
1203 ( keyBlock
+ 6 * keycnt
)[ 0 ],( keyBlock
+ 6 * keycnt
)[ 1 ], ( keyBlock
+ 6 * keycnt
)[ 2 ],
1204 ( keyBlock
+ 6 * keycnt
)[ 3 ], ( keyBlock
+ 6 * keycnt
)[ 4 ], ( keyBlock
+ 6 * keycnt
)[ 5 ], 6 );
1207 // initialize storage for found keys
1208 e_sector
= calloc ( SectorsCnt
, sizeof ( sector_t
));
1209 if ( e_sector
== NULL
) {
1213 for ( uint8_t keyAB
= 0 ; keyAB
< 2 ; keyAB
++) {
1214 for ( uint16_t sectorNo
= 0 ; sectorNo
< SectorsCnt
; sectorNo
++) {
1215 e_sector
[ sectorNo
]. Key
[ keyAB
] = 0xffffffffffff ;
1216 e_sector
[ sectorNo
]. foundKey
[ keyAB
] = 0 ;
1221 bool foundAKey
= false ;
1222 uint32_t max_keys
= keycnt
> USB_CMD_DATA_SIZE
/ 6 ? USB_CMD_DATA_SIZE
/ 6 : keycnt
;
1224 PrintAndLog ( "To cancel this operation press the button on the proxmark..." );
1226 for ( uint32_t c
= 0 ; c
< keycnt
; c
+= max_keys
) {
1228 uint32_t size
= keycnt
- c
> max_keys
? max_keys
: keycnt
- c
;
1229 res
= mfCheckKeysSec ( SectorsCnt
, keyType
, btimeout14a
, true , size
, & keyBlock
[ 6 * c
], e_sector
); // timeout is (ms * 106)/10 or us*0.0106
1240 PrintAndLog ( "Command execute timeout" );
1244 int keyAB
= keyType
;
1246 for ( uint32_t c
= 0 ; c
< keycnt
; c
+= max_keys
) {
1248 uint32_t size
= keycnt
- c
> max_keys
? max_keys
: keycnt
- c
;
1249 res
= mfCheckKeys ( blockNo
, keyAB
& 0x01 , true , size
, & keyBlock
[ 6 * c
], & key64
);
1253 PrintAndLog ( "Found valid key:[%d:%c]%012" PRIx64
, blockNo
, ( keyAB
& 0x01 )? 'B' : 'A' , key64
);
1257 PrintAndLog ( "Command execute timeout" );
1260 } while (-- keyAB
> 0 );
1267 PrintAndLog ( "|---|----------------|---|----------------|---|" );
1268 PrintAndLog ( "|sec|key A |res|key B |res|" );
1269 PrintAndLog ( "|---|----------------|---|----------------|---|" );
1270 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
1271 PrintAndLog ( "|%03d| %012" PRIx64
" | %d | %012" PRIx64
" | %d |" , i
,
1272 e_sector
[ i
]. Key
[ 0 ], e_sector
[ i
]. foundKey
[ 0 ], e_sector
[ i
]. Key
[ 1 ], e_sector
[ i
]. foundKey
[ 1 ]);
1274 PrintAndLog ( "|---|----------------|---|----------------|---|" );
1278 PrintAndLog ( "No valid keys found." );
1281 if ( transferToEml
) {
1283 for ( uint16_t sectorNo
= 0 ; sectorNo
< SectorsCnt
; sectorNo
++) {
1284 if ( e_sector
[ sectorNo
]. foundKey
[ 0 ] || e_sector
[ sectorNo
]. foundKey
[ 1 ]) {
1285 mfEmlGetMem ( block
, FirstBlockOfSector ( sectorNo
) + NumBlocksPerSector ( sectorNo
) - 1 , 1 );
1286 for ( uint16_t t
= 0 ; t
< 2 ; t
++) {
1287 if ( e_sector
[ sectorNo
]. foundKey
[ t
]) {
1288 num_to_bytes ( e_sector
[ sectorNo
]. Key
[ t
], 6 , block
+ t
* 10 );
1291 mfEmlSetMem ( block
, FirstBlockOfSector ( sectorNo
) + NumBlocksPerSector ( sectorNo
) - 1 , 1 );
1294 PrintAndLog ( "Found keys have been transferred to the emulator memory" );
1297 if ( createDumpFile
) {
1298 FILE * fkeys
= fopen ( "dumpkeys.bin" , "wb" );
1299 if ( fkeys
== NULL
) {
1300 PrintAndLog ( "Could not create file dumpkeys.bin" );
1306 for ( uint8_t t
= 0 ; t
< 2 ; t
++) {
1307 for ( uint8_t sectorNo
= 0 ; sectorNo
< SectorsCnt
; sectorNo
++) {
1308 num_to_bytes ( e_sector
[ sectorNo
]. Key
[ t
], 6 , mkey
);
1309 fwrite ( mkey
, 1 , 6 , fkeys
);
1313 PrintAndLog ( "Found keys have been dumped to file dumpkeys.bin. 0xffffffffffff has been inserted for unknown keys." );
1322 void readerAttack ( nonces_t ar_resp
[], bool setEmulatorMem
, bool doStandardAttack
) {
1323 #define ATTACK_KEY_COUNT 7 // keep same as define in iso14443a.c -> Mifare1ksim()
1324 // cannot be more than 7 or it will overrun c.d.asBytes(512)
1330 st_t sector_trailer
[ ATTACK_KEY_COUNT
];
1331 memset ( sector_trailer
, 0x00 , sizeof ( sector_trailer
));
1333 uint8_t stSector
[ ATTACK_KEY_COUNT
];
1334 memset ( stSector
, 0x00 , sizeof ( stSector
));
1335 uint8_t key_cnt
[ ATTACK_KEY_COUNT
];
1336 memset ( key_cnt
, 0x00 , sizeof ( key_cnt
));
1338 for ( uint8_t i
= 0 ; i
< ATTACK_KEY_COUNT
; i
++) {
1339 if ( ar_resp
[ i
]. ar2
> 0 ) {
1340 //PrintAndLog("DEBUG: Trying sector %d, cuid %08x, nt %08x, ar %08x, nr %08x, ar2 %08x, nr2 %08x",ar_resp[i].sector, ar_resp[i].cuid,ar_resp[i].nonce,ar_resp[i].ar,ar_resp[i].nr,ar_resp[i].ar2,ar_resp[i].nr2);
1341 if ( doStandardAttack
&& mfkey32 ( ar_resp
[ i
], & key
)) {
1342 PrintAndLog ( " Found Key%s for sector %02d: [%04x%08x]" , ( ar_resp
[ i
]. keytype
) ? "B" : "A" , ar_resp
[ i
]. sector
, ( uint32_t ) ( key
>> 32 ), ( uint32_t ) ( key
& 0xFFFFFFFF ));
1344 for ( uint8_t ii
= 0 ; ii
< ATTACK_KEY_COUNT
; ii
++) {
1345 if ( key_cnt
[ ii
]== 0 || stSector
[ ii
]== ar_resp
[ i
]. sector
) {
1346 if ( ar_resp
[ i
]. keytype
== 0 ) {
1348 sector_trailer
[ ii
]. keyA
= key
;
1349 stSector
[ ii
] = ar_resp
[ i
]. sector
;
1354 sector_trailer
[ ii
]. keyB
= key
;
1355 stSector
[ ii
] = ar_resp
[ i
]. sector
;
1361 } else if ( mfkey32_moebius ( ar_resp
[ i
+ ATTACK_KEY_COUNT
], & key
)) {
1362 uint8_t sectorNum
= ar_resp
[ i
+ ATTACK_KEY_COUNT
]. sector
;
1363 uint8_t keyType
= ar_resp
[ i
+ ATTACK_KEY_COUNT
]. keytype
;
1365 PrintAndLog ( "M-Found Key%s for sector %02d: [%012" PRIx64
"]"
1366 , keyType
? "B" : "A"
1371 for ( uint8_t ii
= 0 ; ii
< ATTACK_KEY_COUNT
; ii
++) {
1372 if ( key_cnt
[ ii
]== 0 || stSector
[ ii
]== sectorNum
) {
1375 sector_trailer
[ ii
]. keyA
= key
;
1376 stSector
[ ii
] = sectorNum
;
1381 sector_trailer
[ ii
]. keyB
= key
;
1382 stSector
[ ii
] = sectorNum
;
1392 //set emulator memory for keys
1393 if ( setEmulatorMem
) {
1394 for ( uint8_t i
= 0 ; i
< ATTACK_KEY_COUNT
; i
++) {
1396 uint8_t memBlock
[ 16 ];
1397 memset ( memBlock
, 0x00 , sizeof ( memBlock
));
1399 memset ( cmd1
, 0x00 , sizeof ( cmd1
));
1400 snprintf ( cmd1
, sizeof ( cmd1
), "%04x%08xFF078069%04x%08x" ,( uint32_t ) ( sector_trailer
[ i
]. keyA
>> 32 ), ( uint32_t ) ( sector_trailer
[ i
]. keyA
& 0xFFFFFFFF ),( uint32_t ) ( sector_trailer
[ i
]. keyB
>> 32 ), ( uint32_t ) ( sector_trailer
[ i
]. keyB
& 0xFFFFFFFF ));
1401 PrintAndLog ( "Setting Emulator Memory Block %02d: [%s]" , stSector
[ i
]* 4 + 3 , cmd1
);
1402 if ( param_gethex ( cmd1
, 0 , memBlock
, 32 )) {
1403 PrintAndLog ( "block data must include 32 HEX symbols" );
1407 UsbCommand c
= { CMD_MIFARE_EML_MEMSET
, {( stSector
[ i
]* 4 + 3 ), 1 , 0 }};
1408 memcpy ( c
. d
. asBytes
, memBlock
, 16 );
1409 clearCommandBuffer ();
1415 //un-comment to use as well moebius attack
1416 for (uint8_t i = ATTACK_KEY_COUNT; i<ATTACK_KEY_COUNT*2; i++) {
1417 if (ar_resp[i].ar2 > 0) {
1418 if (tryMfk32_moebius(ar_resp[i], &key)) {
1419 PrintAndLog("M-Found Key%s for sector %02d: [%04x%08x]", (ar_resp[i].keytype) ? "B" : "A", ar_resp[i].sector, (uint32_t) (key>>32), (uint32_t) (key &0xFFFFFFFF));
1425 int usage_hf14_mfsim ( void ) {
1426 PrintAndLog ( "Usage: hf mf sim [h] [*<card memory>] [u <uid (8, 14, or 20 hex symbols)>] [n <numreads>] [i] [x]" );
1427 PrintAndLog ( "options:" );
1428 PrintAndLog ( " h (Optional) this help" );
1429 PrintAndLog ( " card memory: 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other, default> - 1K" );
1430 PrintAndLog ( " u (Optional) UID 4 or 7 bytes. If not specified, the UID 4B from emulator memory will be used" );
1431 PrintAndLog ( " n (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite" );
1432 PrintAndLog ( " i (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted" );
1433 PrintAndLog ( " x (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)" );
1434 PrintAndLog ( " e (Optional) set keys found from 'reader attack' to emulator memory (implies x and i)" );
1435 PrintAndLog ( " f (Optional) get UIDs to use for 'reader attack' from file 'f <filename.txt>' (implies x and i)" );
1436 PrintAndLog ( " r (Optional) Generate random nonces instead of sequential nonces. Standard reader attack won't work with this option, only moebius attack works." );
1437 PrintAndLog ( "samples:" );
1438 PrintAndLog ( " hf mf sim u 0a0a0a0a" );
1439 PrintAndLog ( " hf mf sim *4" );
1440 PrintAndLog ( " hf mf sim u 11223344556677" );
1441 PrintAndLog ( " hf mf sim f uids.txt" );
1442 PrintAndLog ( " hf mf sim u 0a0a0a0a e" );
1447 int CmdHF14AMfSim ( const char * Cmd
) {
1449 uint8_t uid
[ 7 ] = { 0 };
1450 uint8_t exitAfterNReads
= 0 ;
1453 bool setEmulatorMem
= false ;
1454 bool attackFromFile
= false ;
1456 char filename
[ FILE_PATH_SIZE
];
1457 memset ( filename
, 0x00 , sizeof ( filename
));
1462 bool errors
= false ;
1463 uint8_t cardsize
= '1' ;
1465 while ( param_getchar ( Cmd
, cmdp
) != 0x00 ) {
1466 switch ( param_getchar ( Cmd
, cmdp
)) {
1468 cardsize
= param_getchar ( Cmd
+ 1 , cmdp
);
1474 default : cardsize
= '1' ;
1480 setEmulatorMem
= true ;
1482 flags
|= FLAG_INTERACTIVE
;
1483 flags
|= FLAG_NR_AR_ATTACK
;
1488 len
= param_getstr ( Cmd
, cmdp
+ 1 , filename
, sizeof ( filename
));
1490 PrintAndLog ( "error no filename found" );
1493 attackFromFile
= true ;
1495 flags
|= FLAG_INTERACTIVE
;
1496 flags
|= FLAG_NR_AR_ATTACK
;
1501 return usage_hf14_mfsim ();
1504 flags
|= FLAG_INTERACTIVE
;
1509 exitAfterNReads
= param_get8 ( Cmd
, cmdp
+ 1 );
1514 flags
|= FLAG_RANDOM_NONCE
;
1519 param_gethex_ex ( Cmd
, cmdp
+ 1 , uid
, & uidlen
);
1521 case 14 : flags
= FLAG_7B_UID_IN_DATA
; break ;
1522 case 8 : flags
= FLAG_4B_UID_IN_DATA
; break ;
1523 default : return usage_hf14_mfsim ();
1529 flags
|= FLAG_NR_AR_ATTACK
;
1533 PrintAndLog ( "Unknown parameter '%c'" , param_getchar ( Cmd
, cmdp
));
1540 if ( errors
) return usage_hf14_mfsim ();
1543 if ( attackFromFile
) {
1546 f
= fopen ( filename
, "r" );
1548 PrintAndLog ( "File %s not found or locked" , filename
);
1551 PrintAndLog ( "Loading file and simulating. Press keyboard to abort" );
1552 while (! feof ( f
) && ! ukbhit ()){
1553 memset ( buf
, 0 , sizeof ( buf
));
1554 memset ( uid
, 0 , sizeof ( uid
));
1556 if ( fgets ( buf
, sizeof ( buf
), f
) == NULL
) {
1557 if ( count
> 0 ) break ;
1559 PrintAndLog ( "File reading error." );
1563 if (! strlen ( buf
) && feof ( f
)) break ;
1565 uidlen
= strlen ( buf
)- 1 ;
1567 case 14 : flags
|= FLAG_7B_UID_IN_DATA
; break ;
1568 case 8 : flags
|= FLAG_4B_UID_IN_DATA
; break ;
1570 PrintAndLog ( "uid in file wrong length at %d (length: %d) [%s]" , count
, uidlen
, buf
);
1575 for ( uint8_t i
= 0 ; i
< uidlen
; i
+= 2 ) {
1576 sscanf (& buf
[ i
], "%02x" , ( unsigned int *)& uid
[ i
/ 2 ]);
1579 PrintAndLog ( "mf sim cardsize: %s, uid: %s, numreads:%d, flags:%d (0x%02x) - press button to abort" ,
1580 cardsize
== '0' ? "Mini" :
1581 cardsize
== '2' ? "2K" :
1582 cardsize
== '4' ? "4K" : "1K" ,
1583 flags
& FLAG_4B_UID_IN_DATA
? sprint_hex ( uid
, 4 ):
1584 flags
& FLAG_7B_UID_IN_DATA
? sprint_hex ( uid
, 7 ): "N/A" ,
1589 UsbCommand c
= { CMD_SIMULATE_MIFARE_CARD
, { flags
, exitAfterNReads
, cardsize
}};
1590 memcpy ( c
. d
. asBytes
, uid
, sizeof ( uid
));
1591 clearCommandBuffer ();
1594 while (! WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
1595 //We're waiting only 1.5 s at a time, otherwise we get the
1596 // annoying message about "Waiting for a response... "
1599 nonces_t ar_resp
[ ATTACK_KEY_COUNT
* 2 ];
1600 memcpy ( ar_resp
, resp
. d
. asBytes
, sizeof ( ar_resp
));
1601 // We can skip the standard attack if we have RANDOM_NONCE set.
1602 readerAttack ( ar_resp
, setEmulatorMem
, !( flags
& FLAG_RANDOM_NONCE
));
1603 if (( bool ) resp
. arg
[ 1 ]) {
1604 PrintAndLog ( "Device button pressed - quitting" );
1612 } else { //not from file
1614 PrintAndLog ( "mf sim cardsize: %s, uid: %s, numreads:%d, flags:%d (0x%02x) " ,
1615 cardsize
== '0' ? "Mini" :
1616 cardsize
== '2' ? "2K" :
1617 cardsize
== '4' ? "4K" : "1K" ,
1618 flags
& FLAG_4B_UID_IN_DATA
? sprint_hex ( uid
, 4 ):
1619 flags
& FLAG_7B_UID_IN_DATA
? sprint_hex ( uid
, 7 ): "N/A" ,
1624 UsbCommand c
= { CMD_SIMULATE_MIFARE_CARD
, { flags
, exitAfterNReads
, cardsize
}};
1625 memcpy ( c
. d
. asBytes
, uid
, sizeof ( uid
));
1626 clearCommandBuffer ();
1629 if ( flags
& FLAG_INTERACTIVE
) {
1630 PrintAndLog ( "Press pm3-button to abort simulation" );
1631 while (! WaitForResponseTimeout ( CMD_ACK
, & resp
, 1500 )) {
1632 //We're waiting only 1.5 s at a time, otherwise we get the
1633 // annoying message about "Waiting for a response... "
1636 if ( flags
& FLAG_NR_AR_ATTACK
) {
1637 nonces_t ar_resp
[ ATTACK_KEY_COUNT
* 2 ];
1638 memcpy ( ar_resp
, resp
. d
. asBytes
, sizeof ( ar_resp
));
1639 // We can skip the standard attack if we have RANDOM_NONCE set.
1640 readerAttack ( ar_resp
, setEmulatorMem
, !( flags
& FLAG_RANDOM_NONCE
));
1648 int CmdHF14AMfDbg ( const char * Cmd
)
1650 int dbgMode
= param_get32ex ( Cmd
, 0 , 0 , 10 );
1652 PrintAndLog ( "Max debug mode parameter is 4 \n " );
1655 if ( strlen ( Cmd
) < 1 || ! param_getchar ( Cmd
, 0 ) || dbgMode
> 4 ) {
1656 PrintAndLog ( "Usage: hf mf dbg <debug level>" );
1657 PrintAndLog ( " 0 - no debug messages" );
1658 PrintAndLog ( " 1 - error messages" );
1659 PrintAndLog ( " 2 - plus information messages" );
1660 PrintAndLog ( " 3 - plus debug messages" );
1661 PrintAndLog ( " 4 - print even debug messages in timing critical functions" );
1662 PrintAndLog ( " Note: this option therefore may cause malfunction itself" );
1666 UsbCommand c
= { CMD_MIFARE_SET_DBGMODE
, { dbgMode
, 0 , 0 }};
1672 int CmdHF14AMfEGet ( const char * Cmd
)
1674 uint8_t blockNo
= 0 ;
1675 uint8_t data
[ 16 ] = { 0x00 };
1677 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1678 PrintAndLog ( "Usage: hf mf eget <block number>" );
1679 PrintAndLog ( " sample: hf mf eget 0 " );
1683 blockNo
= param_get8 ( Cmd
, 0 );
1686 if (! mfEmlGetMem ( data
, blockNo
, 1 )) {
1687 PrintAndLog ( "data[%3d]:%s" , blockNo
, sprint_hex ( data
, 16 ));
1689 PrintAndLog ( "Command execute timeout" );
1695 int CmdHF14AMfEClear ( const char * Cmd
)
1697 if ( param_getchar ( Cmd
, 0 ) == 'h' ) {
1698 PrintAndLog ( "Usage: hf mf eclr" );
1699 PrintAndLog ( "It set card emulator memory to empty data blocks and key A/B FFFFFFFFFFFF \n " );
1703 UsbCommand c
= { CMD_MIFARE_EML_MEMCLR
, { 0 , 0 , 0 }};
1709 int CmdHF14AMfESet ( const char * Cmd
)
1711 uint8_t memBlock
[ 16 ];
1712 uint8_t blockNo
= 0 ;
1714 memset ( memBlock
, 0x00 , sizeof ( memBlock
));
1716 if ( strlen ( Cmd
) < 3 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1717 PrintAndLog ( "Usage: hf mf eset <block number> <block data (32 hex symbols)>" );
1718 PrintAndLog ( " sample: hf mf eset 1 000102030405060708090a0b0c0d0e0f " );
1722 blockNo
= param_get8 ( Cmd
, 0 );
1724 if ( param_gethex ( Cmd
, 1 , memBlock
, 32 )) {
1725 PrintAndLog ( "block data must include 32 HEX symbols" );
1730 return mfEmlSetMem ( memBlock
, blockNo
, 1 );
1734 int CmdHF14AMfELoad ( const char * Cmd
)
1737 char filename
[ FILE_PATH_SIZE
];
1738 char * fnameptr
= filename
;
1739 char buf
[ 64 ] = { 0x00 };
1740 uint8_t buf8
[ 64 ] = { 0x00 };
1741 int i
, len
, blockNum
, numBlocks
;
1742 int nameParamNo
= 1 ;
1744 char ctmp
= param_getchar ( Cmd
, 0 );
1746 if ( ctmp
== 'h' || ctmp
== 0x00 ) {
1747 PrintAndLog ( "It loads emul dump from the file `filename.eml`" );
1748 PrintAndLog ( "Usage: hf mf eload [card memory] <file name w/o `.eml`>" );
1749 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1751 PrintAndLog ( " sample: hf mf eload filename" );
1752 PrintAndLog ( " hf mf eload 4 filename" );
1757 case '0' : numBlocks
= 5 * 4 ; break ;
1759 case '\0' : numBlocks
= 16 * 4 ; break ;
1760 case '2' : numBlocks
= 32 * 4 ; break ;
1761 case '4' : numBlocks
= 256 ; break ;
1768 len
= param_getstr ( Cmd
, nameParamNo
, filename
, sizeof ( filename
));
1770 if ( len
> FILE_PATH_SIZE
- 5 ) len
= FILE_PATH_SIZE
- 5 ;
1774 sprintf ( fnameptr
, ".eml" );
1777 f
= fopen ( filename
, "r" );
1779 PrintAndLog ( "File %s not found or locked" , filename
);
1785 memset ( buf
, 0 , sizeof ( buf
));
1787 if ( fgets ( buf
, sizeof ( buf
), f
) == NULL
) {
1789 if ( blockNum
>= numBlocks
) break ;
1791 PrintAndLog ( "File reading error." );
1796 if ( strlen ( buf
) < 32 ){
1797 if ( strlen ( buf
) && feof ( f
))
1799 PrintAndLog ( "File content error. Block data must include 32 HEX symbols" );
1804 for ( i
= 0 ; i
< 32 ; i
+= 2 ) {
1805 sscanf (& buf
[ i
], "%02x" , ( unsigned int *)& buf8
[ i
/ 2 ]);
1808 if ( mfEmlSetMem ( buf8
, blockNum
, 1 )) {
1809 PrintAndLog ( "Cant set emul block: %3d" , blockNum
);
1816 if ( blockNum
>= numBlocks
) break ;
1821 if (( blockNum
!= numBlocks
)) {
1822 PrintAndLog ( "File content error. Got %d must be %d blocks." , blockNum
, numBlocks
);
1825 PrintAndLog ( "Loaded %d blocks from file: %s" , blockNum
, filename
);
1830 int CmdHF14AMfESave ( const char * Cmd
)
1833 char filename
[ FILE_PATH_SIZE
];
1834 char * fnameptr
= filename
;
1836 int i
, j
, len
, numBlocks
;
1837 int nameParamNo
= 1 ;
1839 memset ( filename
, 0 , sizeof ( filename
));
1840 memset ( buf
, 0 , sizeof ( buf
));
1842 char ctmp
= param_getchar ( Cmd
, 0 );
1844 if ( ctmp
== 'h' || ctmp
== 'H' ) {
1845 PrintAndLog ( "It saves emul dump into the file `filename.eml` or `cardID.eml`" );
1846 PrintAndLog ( " Usage: hf mf esave [card memory] [file name w/o `.eml`]" );
1847 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1849 PrintAndLog ( " sample: hf mf esave " );
1850 PrintAndLog ( " hf mf esave 4" );
1851 PrintAndLog ( " hf mf esave 4 filename" );
1856 case '0' : numBlocks
= 5 * 4 ; break ;
1858 case '\0' : numBlocks
= 16 * 4 ; break ;
1859 case '2' : numBlocks
= 32 * 4 ; break ;
1860 case '4' : numBlocks
= 256 ; break ;
1867 len
= param_getstr ( Cmd
, nameParamNo
, filename
, sizeof ( filename
));
1869 if ( len
> FILE_PATH_SIZE
- 5 ) len
= FILE_PATH_SIZE
- 5 ;
1871 // user supplied filename?
1873 // get filename (UID from memory)
1874 if ( mfEmlGetMem ( buf
, 0 , 1 )) {
1875 PrintAndLog ( "Can \' t get UID from block: %d" , 0 );
1876 len
= sprintf ( fnameptr
, "dump" );
1880 for ( j
= 0 ; j
< 7 ; j
++, fnameptr
+= 2 )
1881 sprintf ( fnameptr
, "%02X" , buf
[ j
]);
1887 // add file extension
1888 sprintf ( fnameptr
, ".eml" );
1891 f
= fopen ( filename
, "w+" );
1894 PrintAndLog ( "Can't open file %s " , filename
);
1899 for ( i
= 0 ; i
< numBlocks
; i
++) {
1900 if ( mfEmlGetMem ( buf
, i
, 1 )) {
1901 PrintAndLog ( "Cant get block: %d" , i
);
1904 for ( j
= 0 ; j
< 16 ; j
++)
1905 fprintf ( f
, "%02X" , buf
[ j
]);
1910 PrintAndLog ( "Saved %d blocks to file: %s" , numBlocks
, filename
);
1916 int CmdHF14AMfECFill ( const char * Cmd
)
1918 uint8_t keyType
= 0 ;
1919 uint8_t numSectors
= 16 ;
1921 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1922 PrintAndLog ( "Usage: hf mf ecfill <key A/B> [card memory]" );
1923 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1925 PrintAndLog ( "samples: hf mf ecfill A" );
1926 PrintAndLog ( " hf mf ecfill A 4" );
1927 PrintAndLog ( "Read card and transfer its data to emulator memory." );
1928 PrintAndLog ( "Keys must be laid in the emulator memory. \n " );
1932 char ctmp
= param_getchar ( Cmd
, 0 );
1933 if ( ctmp
!= 'a' && ctmp
!= 'A' && ctmp
!= 'b' && ctmp
!= 'B' ) {
1934 PrintAndLog ( "Key type must be A or B" );
1937 if ( ctmp
!= 'A' && ctmp
!= 'a' ) keyType
= 1 ;
1939 ctmp
= param_getchar ( Cmd
, 1 );
1941 case '0' : numSectors
= 5 ; break ;
1943 case '\0' : numSectors
= 16 ; break ;
1944 case '2' : numSectors
= 32 ; break ;
1945 case '4' : numSectors
= 40 ; break ;
1946 default : numSectors
= 16 ;
1949 printf ( "--params: numSectors: %d, keyType:%d \n " , numSectors
, keyType
);
1950 UsbCommand c
= { CMD_MIFARE_EML_CARDLOAD
, { numSectors
, keyType
, 0 }};
1956 int CmdHF14AMfEKeyPrn ( const char * Cmd
)
1959 uint8_t numSectors
= 16 ;
1961 uint64_t keyA
, keyB
;
1962 bool createDumpFile
= false ;
1964 if ( param_getchar ( Cmd
, 0 ) == 'h' ) {
1965 PrintAndLog ( "It prints the keys loaded in the emulator memory" );
1966 PrintAndLog ( "Usage: hf mf ekeyprn [card memory] [d]" );
1967 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1968 PrintAndLog ( " [d] : write keys to binary file dumpkeys.bin" );
1970 PrintAndLog ( " sample: hf mf ekeyprn 1" );
1975 while ( param_getchar ( Cmd
, cmdp
) != 0x00 ) {
1976 switch ( param_getchar ( Cmd
, cmdp
)) {
1977 case '0' : numSectors
= 5 ; break ;
1979 case '\0' : numSectors
= 16 ; break ;
1980 case '2' : numSectors
= 32 ; break ;
1981 case '4' : numSectors
= 40 ; break ;
1983 case 'D' : createDumpFile
= true ; break ;
1988 PrintAndLog ( "|---|----------------|----------------|" );
1989 PrintAndLog ( "|sec|key A |key B |" );
1990 PrintAndLog ( "|---|----------------|----------------|" );
1991 for ( i
= 0 ; i
< numSectors
; i
++) {
1992 if ( mfEmlGetMem ( data
, FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 , 1 )) {
1993 PrintAndLog ( "error get block %d" , FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 );
1996 keyA
= bytes_to_num ( data
, 6 );
1997 keyB
= bytes_to_num ( data
+ 10 , 6 );
1998 PrintAndLog ( "|%03d| %012" PRIx64
" | %012" PRIx64
" |" , i
, keyA
, keyB
);
2000 PrintAndLog ( "|---|----------------|----------------|" );
2003 if ( createDumpFile
) {
2005 if (( fkeys
= fopen ( "dumpkeys.bin" , "wb" )) == NULL
) {
2006 PrintAndLog ( "Could not create file dumpkeys.bin" );
2009 PrintAndLog ( "Printing keys to binary file dumpkeys.bin..." );
2010 for ( i
= 0 ; i
< numSectors
; i
++) {
2011 if ( mfEmlGetMem ( data
, FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 , 1 )) {
2012 PrintAndLog ( "error get block %d" , FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 );
2015 fwrite ( data
+ 6 , 1 , 6 , fkeys
);
2017 for ( i
= 0 ; i
< numSectors
; i
++) {
2018 if ( mfEmlGetMem ( data
, FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 , 1 )) {
2019 PrintAndLog ( "error get block %d" , FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 );
2022 fwrite ( data
+ 10 , 1 , 6 , fkeys
);
2031 int CmdHF14AMfCSetUID ( const char * Cmd
)
2033 uint8_t uid
[ 8 ] = { 0x00 };
2034 uint8_t oldUid
[ 8 ] = { 0x00 };
2035 uint8_t atqa
[ 2 ] = { 0x00 };
2036 uint8_t sak
[ 1 ] = { 0x00 };
2037 uint8_t atqaPresent
= 0 ;
2040 uint8_t needHelp
= 0 ;
2043 if ( param_getchar ( Cmd
, 0 ) && param_gethex ( Cmd
, 0 , uid
, 8 )) {
2044 PrintAndLog ( "UID must include 8 HEX symbols" );
2048 if ( param_getlength ( Cmd
, 1 ) > 1 && param_getlength ( Cmd
, 2 ) > 1 ) {
2052 if ( param_gethex ( Cmd
, 1 , atqa
, 4 )) {
2053 PrintAndLog ( "ATQA must include 4 HEX symbols" );
2057 if ( param_gethex ( Cmd
, 2 , sak
, 2 )) {
2058 PrintAndLog ( "SAK must include 2 HEX symbols" );
2063 while ( param_getchar ( Cmd
, cmdp
) != 0x00 )
2065 switch ( param_getchar ( Cmd
, cmdp
))
2072 PrintAndLog ( "ERROR: Unknown parameter '%c'" , param_getchar ( Cmd
, cmdp
));
2079 if ( strlen ( Cmd
) < 1 || needHelp
) {
2081 PrintAndLog ( "Usage: hf mf csetuid <UID 8 hex symbols> [ATQA 4 hex symbols SAK 2 hex symbols]" );
2082 PrintAndLog ( "sample: hf mf csetuid 01020304" );
2083 PrintAndLog ( "sample: hf mf csetuid 01020304 0004 08" );
2084 PrintAndLog ( "Set UID, ATQA, and SAK for magic Chinese card (only works with such cards)" );
2088 PrintAndLog ( "uid:%s" , sprint_hex ( uid
, 4 ));
2090 PrintAndLog ( "--atqa:%s sak:%02x" , sprint_hex ( atqa
, 2 ), sak
[ 0 ]);
2093 res
= mfCSetUID ( uid
, ( atqaPresent
)? atqa
: NULL
, ( atqaPresent
)? sak
: NULL
, oldUid
);
2095 PrintAndLog ( "Can't set UID. Error=%d" , res
);
2099 PrintAndLog ( "old UID:%s" , sprint_hex ( oldUid
, 4 ));
2100 PrintAndLog ( "new UID:%s" , sprint_hex ( uid
, 4 ));
2104 int CmdHF14AMfCWipe ( const char * Cmd
)
2107 int numBlocks
= 16 * 4 ;
2108 bool wipeCard
= false ;
2109 bool fillCard
= false ;
2111 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
2112 PrintAndLog ( "Usage: hf mf cwipe [card size] [w] [f]" );
2113 PrintAndLog ( "sample: hf mf cwipe 1 w f" );
2114 PrintAndLog ( "[card size]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
2115 PrintAndLog ( "w - Wipe magic Chinese card (only works with gen:1a cards)" );
2116 PrintAndLog ( "f - Fill the card with default data and keys (works with gen:1a and gen:1b cards only)" );
2120 gen
= mfCIdentify ();
2121 if (( gen
!= 1 ) && ( gen
!= 2 ))
2124 numBlocks
= ParamCardSizeBlocks ( param_getchar ( Cmd
, 0 ));
2127 while ( param_getchar ( Cmd
, cmdp
) != 0x00 ){
2128 switch ( param_getchar ( Cmd
, cmdp
)) {
2143 if (! wipeCard
&& ! fillCard
)
2146 PrintAndLog ( "--blocks count:%2d wipe:%c fill:%c" , numBlocks
, ( wipeCard
)? 'y' : 'n' , ( fillCard
)? 'y' : 'n' );
2149 /* generation 1b magic card */
2151 PrintAndLog ( "WARNING: can't wipe magic card 1b generation" );
2153 res
= mfCWipe ( numBlocks
, true , false , fillCard
);
2155 /* generation 1a magic card by default */
2156 res
= mfCWipe ( numBlocks
, false , wipeCard
, fillCard
);
2160 PrintAndLog ( "Can't wipe. error=%d" , res
);
2167 int CmdHF14AMfCSetBlk ( const char * Cmd
)
2169 uint8_t memBlock
[ 16 ] = { 0x00 };
2170 uint8_t blockNo
= 0 ;
2171 bool wipeCard
= false ;
2174 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
2175 PrintAndLog ( "Usage: hf mf csetblk <block number> <block data (32 hex symbols)> [w]" );
2176 PrintAndLog ( "sample: hf mf csetblk 1 01020304050607080910111213141516" );
2177 PrintAndLog ( "Set block data for magic Chinese card (only works with such cards)" );
2178 PrintAndLog ( "If you also want wipe the card then add 'w' at the end of the command line" );
2182 gen
= mfCIdentify ();
2183 if (( gen
!= 1 ) && ( gen
!= 2 ))
2186 blockNo
= param_get8 ( Cmd
, 0 );
2188 if ( param_gethex ( Cmd
, 1 , memBlock
, 32 )) {
2189 PrintAndLog ( "block data must include 32 HEX symbols" );
2193 char ctmp
= param_getchar ( Cmd
, 2 );
2194 wipeCard
= ( ctmp
== 'w' || ctmp
== 'W' );
2195 PrintAndLog ( "--block number:%2d data:%s" , blockNo
, sprint_hex ( memBlock
, 16 ));
2198 /* generation 1b magic card */
2199 res
= mfCSetBlock ( blockNo
, memBlock
, NULL
, wipeCard
, CSETBLOCK_SINGLE_OPER
| CSETBLOCK_MAGIC_1B
);
2201 /* generation 1a magic card by default */
2202 res
= mfCSetBlock ( blockNo
, memBlock
, NULL
, wipeCard
, CSETBLOCK_SINGLE_OPER
);
2206 PrintAndLog ( "Can't write block. error=%d" , res
);
2213 int CmdHF14AMfCLoad ( const char * Cmd
)
2216 char filename
[ FILE_PATH_SIZE
] = { 0x00 };
2217 char * fnameptr
= filename
;
2218 char buf
[ 256 ] = { 0x00 };
2219 uint8_t buf8
[ 256 ] = { 0x00 };
2220 uint8_t fillFromEmulator
= 0 ;
2221 int i
, len
, blockNum
, flags
= 0 , gen
= 0 , numblock
= 64 ;
2223 if ( param_getchar ( Cmd
, 0 ) == 'h' || param_getchar ( Cmd
, 0 )== 0x00 ) {
2224 PrintAndLog ( "It loads magic Chinese card from the file `filename.eml`" );
2225 PrintAndLog ( "or from emulator memory (option `e`). 4K card: (option `4`)" );
2226 PrintAndLog ( "Usage: hf mf cload [file name w/o `.eml`][e][4]" );
2227 PrintAndLog ( " or: hf mf cload e [4]" );
2228 PrintAndLog ( "Sample: hf mf cload filename" );
2229 PrintAndLog ( " hf mf cload filname 4" );
2230 PrintAndLog ( " hf mf cload e" );
2231 PrintAndLog ( " hf mf cload e 4" );
2235 char ctmp
= param_getchar ( Cmd
, 0 );
2236 if ( ctmp
== 'e' || ctmp
== 'E' ) fillFromEmulator
= 1 ;
2237 ctmp
= param_getchar ( Cmd
, 1 );
2238 if ( ctmp
== '4' ) numblock
= 256 ;
2240 gen
= mfCIdentify ();
2241 PrintAndLog ( "Loading magic mifare %dK" , numblock
== 256 ? 4 : 1 );
2243 if ( fillFromEmulator
) {
2244 for ( blockNum
= 0 ; blockNum
< numblock
; blockNum
+= 1 ) {
2245 if ( mfEmlGetMem ( buf8
, blockNum
, 1 )) {
2246 PrintAndLog ( "Cant get block: %d" , blockNum
);
2249 if ( blockNum
== 0 ) flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
; // switch on field and send magic sequence
2250 if ( blockNum
== 1 ) flags
= 0 ; // just write
2251 if ( blockNum
== numblock
- 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
; // Done. Magic Halt and switch off field.
2254 /* generation 1b magic card */
2255 flags
|= CSETBLOCK_MAGIC_1B
;
2256 if ( mfCSetBlock ( blockNum
, buf8
, NULL
, 0 , flags
)) {
2257 PrintAndLog ( "Cant set magic card block: %d" , blockNum
);
2263 param_getstr ( Cmd
, 0 , filename
, sizeof ( filename
));
2265 len
= strlen ( filename
);
2266 if ( len
> FILE_PATH_SIZE
- 5 ) len
= FILE_PATH_SIZE
- 5 ;
2268 //memcpy(filename, Cmd, len);
2271 sprintf ( fnameptr
, ".eml" );
2274 f
= fopen ( filename
, "r" );
2276 PrintAndLog ( "File not found or locked." );
2283 memset ( buf
, 0 , sizeof ( buf
));
2285 if ( fgets ( buf
, sizeof ( buf
), f
) == NULL
) {
2287 PrintAndLog ( "File reading error." );
2291 if ( strlen ( buf
) < 32 ) {
2292 if ( strlen ( buf
) && feof ( f
))
2294 PrintAndLog ( "File content error. Block data must include 32 HEX symbols" );
2298 for ( i
= 0 ; i
< 32 ; i
+= 2 )
2299 sscanf (& buf
[ i
], "%02x" , ( unsigned int *)& buf8
[ i
/ 2 ]);
2301 if ( blockNum
== 0 ) flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
; // switch on field and send magic sequence
2302 if ( blockNum
== 1 ) flags
= 0 ; // just write
2303 if ( blockNum
== numblock
- 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
; // Done. Switch off field.
2306 /* generation 1b magic card */
2307 flags
|= CSETBLOCK_MAGIC_1B
;
2308 if ( mfCSetBlock ( blockNum
, buf8
, NULL
, 0 , flags
)) {
2309 PrintAndLog ( "Can't set magic card block: %d" , blockNum
);
2315 if ( blockNum
>= numblock
) break ; // magic card type - mifare 1K 64 blocks, mifare 4k 256 blocks
2319 //if (blockNum != 16 * 4 && blockNum != 32 * 4 + 8 * 16){
2320 if ( blockNum
!= numblock
){
2321 PrintAndLog ( "File content error. There must be %d blocks" , numblock
);
2324 PrintAndLog ( "Loaded from file: %s" , filename
);
2330 int CmdHF14AMfCGetBlk ( const char * Cmd
) {
2331 uint8_t memBlock
[ 16 ];
2332 uint8_t blockNo
= 0 ;
2334 memset ( memBlock
, 0x00 , sizeof ( memBlock
));
2336 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
2337 PrintAndLog ( "Usage: hf mf cgetblk <block number>" );
2338 PrintAndLog ( "sample: hf mf cgetblk 1" );
2339 PrintAndLog ( "Get block data from magic Chinese card (only works with such cards) \n " );
2343 gen
= mfCIdentify ();
2345 blockNo
= param_get8 ( Cmd
, 0 );
2347 PrintAndLog ( "--block number:%2d " , blockNo
);
2350 /* generation 1b magic card */
2351 res
= mfCGetBlock ( blockNo
, memBlock
, CSETBLOCK_SINGLE_OPER
| CSETBLOCK_MAGIC_1B
);
2353 /* generation 1a magic card by default */
2354 res
= mfCGetBlock ( blockNo
, memBlock
, CSETBLOCK_SINGLE_OPER
);
2357 PrintAndLog ( "Can't read block. error=%d" , res
);
2361 PrintAndLog ( "block data:%s" , sprint_hex ( memBlock
, 16 ));
2363 if ( mfIsSectorTrailer ( blockNo
)) {
2364 PrintAndLogEx ( NORMAL
, "Trailer decoded:" );
2365 PrintAndLogEx ( NORMAL
, "Key A: %s" , sprint_hex_inrow ( memBlock
, 6 ));
2366 PrintAndLogEx ( NORMAL
, "Key B: %s" , sprint_hex_inrow (& memBlock
[ 10 ], 6 ));
2367 int bln
= mfFirstBlockOfSector ( mfSectorNum ( blockNo
));
2368 int blinc
= ( mfNumBlocksPerSector ( mfSectorNum ( blockNo
)) > 4 ) ? 5 : 1 ;
2369 for ( int i
= 0 ; i
< 4 ; i
++) {
2370 PrintAndLogEx ( NORMAL
, "Access block %d%s: %s" , bln
, (( blinc
> 1 ) && ( i
< 3 ) ? "+" : "" ) , mfGetAccessConditionsDesc ( i
, & memBlock
[ 6 ]));
2373 PrintAndLogEx ( NORMAL
, "UserData: %s" , sprint_hex_inrow (& memBlock
[ 9 ], 1 ));
2379 int CmdHF14AMfCGetSc ( const char * Cmd
) {
2380 uint8_t memBlock
[ 16 ] = { 0x00 };
2381 uint8_t sectorNo
= 0 ;
2382 int i
, res
, flags
, gen
= 0 , baseblock
= 0 , sect_size
= 4 ;
2384 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
2385 PrintAndLog ( "Usage: hf mf cgetsc <sector number>" );
2386 PrintAndLog ( "sample: hf mf cgetsc 0" );
2387 PrintAndLog ( "Get sector data from magic Chinese card (only works with such cards) \n " );
2391 sectorNo
= param_get8 ( Cmd
, 0 );
2393 if ( sectorNo
> 39 ) {
2394 PrintAndLog ( "Sector number must be in [0..15] in MIFARE classic 1k and [0..39] in MIFARE classic 4k." );
2398 PrintAndLog ( "--sector number:%d " , sectorNo
);
2400 gen
= mfCIdentify ();
2402 flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
;
2403 if ( sectorNo
< 32 ) {
2404 baseblock
= sectorNo
* 4 ;
2406 baseblock
= 128 + 16 * ( sectorNo
- 32 );
2409 if ( sectorNo
> 31 ) sect_size
= 16 ;
2411 for ( i
= 0 ; i
< sect_size
; i
++) {
2412 if ( i
== 1 ) flags
= 0 ;
2413 if ( i
== sect_size
- 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
;
2416 /* generation 1b magic card */
2417 flags
|= CSETBLOCK_MAGIC_1B
;
2419 res
= mfCGetBlock ( baseblock
+ i
, memBlock
, flags
);
2421 PrintAndLog ( "Can't read block. %d error=%d" , baseblock
+ i
, res
);
2425 PrintAndLog ( "block %3d data:%s" , baseblock
+ i
, sprint_hex ( memBlock
, 16 ));
2427 if ( mfIsSectorTrailer ( baseblock
+ i
)) {
2428 PrintAndLogEx ( NORMAL
, "Trailer decoded:" );
2429 PrintAndLogEx ( NORMAL
, "Key A: %s" , sprint_hex_inrow ( memBlock
, 6 ));
2430 PrintAndLogEx ( NORMAL
, "Key B: %s" , sprint_hex_inrow (& memBlock
[ 10 ], 6 ));
2431 int bln
= baseblock
;
2432 int blinc
= ( mfNumBlocksPerSector ( sectorNo
) > 4 ) ? 5 : 1 ;
2433 for ( int i
= 0 ; i
< 4 ; i
++) {
2434 PrintAndLogEx ( NORMAL
, "Access block %d%s: %s" , bln
, (( blinc
> 1 ) && ( i
< 3 ) ? "+" : "" ) , mfGetAccessConditionsDesc ( i
, & memBlock
[ 6 ]));
2437 PrintAndLogEx ( NORMAL
, "UserData: %s" , sprint_hex_inrow (& memBlock
[ 9 ], 1 ));
2444 int CmdHF14AMfCSave ( const char * Cmd
) {
2447 char filename
[ FILE_PATH_SIZE
] = { 0x00 };
2448 char * fnameptr
= filename
;
2449 uint8_t fillFromEmulator
= 0 ;
2450 uint8_t buf
[ 256 ] = { 0x00 };
2451 int i
, j
, len
, flags
, gen
= 0 , numblock
= 64 ;
2453 // memset(filename, 0, sizeof(filename));
2454 // memset(buf, 0, sizeof(buf));
2456 if ( param_getchar ( Cmd
, 0 ) == 'h' ) {
2457 PrintAndLog ( "It saves `magic Chinese` card dump into the file `filename.eml` or `cardID.eml`" );
2458 PrintAndLog ( "or into emulator memory (option `e`). 4K card: (option `4`)" );
2459 PrintAndLog ( "Usage: hf mf csave [file name w/o `.eml`][e][4]" );
2460 PrintAndLog ( "Sample: hf mf csave " );
2461 PrintAndLog ( " hf mf csave filename" );
2462 PrintAndLog ( " hf mf csave e" );
2463 PrintAndLog ( " hf mf csave 4" );
2464 PrintAndLog ( " hf mf csave filename 4" );
2465 PrintAndLog ( " hf mf csave e 4" );
2469 char ctmp
= param_getchar ( Cmd
, 0 );
2470 if ( ctmp
== 'e' || ctmp
== 'E' ) fillFromEmulator
= 1 ;
2471 if ( ctmp
== '4' ) numblock
= 256 ;
2472 ctmp
= param_getchar ( Cmd
, 1 );
2473 if ( ctmp
== '4' ) numblock
= 256 ;
2475 gen
= mfCIdentify ();
2476 PrintAndLog ( "Saving magic mifare %dK" , numblock
== 256 ? 4 : 1 );
2478 if ( fillFromEmulator
) {
2479 // put into emulator
2480 flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
;
2481 for ( i
= 0 ; i
< numblock
; i
++) {
2482 if ( i
== 1 ) flags
= 0 ;
2483 if ( i
== numblock
- 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
;
2486 /* generation 1b magic card */
2487 flags
|= CSETBLOCK_MAGIC_1B
;
2489 if ( mfCGetBlock ( i
, buf
, flags
)) {
2490 PrintAndLog ( "Cant get block: %d" , i
);
2494 if ( mfEmlSetMem ( buf
, i
, 1 )) {
2495 PrintAndLog ( "Cant set emul block: %d" , i
);
2501 param_getstr ( Cmd
, 0 , filename
, sizeof ( filename
));
2503 len
= strlen ( filename
);
2504 if ( len
> FILE_PATH_SIZE
- 5 ) len
= FILE_PATH_SIZE
- 5 ;
2506 ctmp
= param_getchar ( Cmd
, 0 );
2507 if ( len
< 1 || ( ctmp
== '4' )) {
2510 flags
= CSETBLOCK_SINGLE_OPER
;
2512 /* generation 1b magic card */
2513 flags
|= CSETBLOCK_MAGIC_1B
;
2514 if ( mfCGetBlock ( 0 , buf
, flags
)) {
2515 PrintAndLog ( "Cant get block: %d" , 0 );
2516 len
= sprintf ( fnameptr
, "dump" );
2520 for ( j
= 0 ; j
< 7 ; j
++, fnameptr
+= 2 )
2521 sprintf ( fnameptr
, "%02x" , buf
[ j
]);
2524 //memcpy(filename, Cmd, len);
2528 sprintf ( fnameptr
, ".eml" );
2531 f
= fopen ( filename
, "w+" );
2534 PrintAndLog ( "File not found or locked." );
2539 flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
;
2540 for ( i
= 0 ; i
< numblock
; i
++) {
2541 if ( i
== 1 ) flags
= 0 ;
2542 if ( i
== numblock
- 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
;
2545 /* generation 1b magic card */
2546 flags
|= CSETBLOCK_MAGIC_1B
;
2547 if ( mfCGetBlock ( i
, buf
, flags
)) {
2548 PrintAndLog ( "Cant get block: %d" , i
);
2551 for ( j
= 0 ; j
< 16 ; j
++)
2552 fprintf ( f
, "%02x" , buf
[ j
]);
2557 PrintAndLog ( "Saved to file: %s" , filename
);
2564 int CmdHF14AMfSniff ( const char * Cmd
){
2566 bool wantLogToFile
= 0 ;
2567 bool wantDecrypt
= 0 ;
2568 //bool wantSaveToEml = 0; TODO
2569 bool wantSaveToEmlFile
= 0 ;
2580 uint8_t atqa
[ 2 ] = { 0x00 };
2583 uint8_t * buf
= NULL
;
2584 uint16_t bufsize
= 0 ;
2585 uint8_t * bufPtr
= NULL
;
2588 char ctmp
= param_getchar ( Cmd
, 0 );
2589 if ( ctmp
== 'h' || ctmp
== 'H' ) {
2590 PrintAndLog ( "It continuously gets data from the field and saves it to: log, emulator, emulator file." );
2591 PrintAndLog ( "You can specify:" );
2592 PrintAndLog ( " l - save encrypted sequence to logfile `uid.log`" );
2593 PrintAndLog ( " d - decrypt sequence and put it to log file `uid.log`" );
2594 PrintAndLog ( " n/a e - decrypt sequence, collect read and write commands and save the result of the sequence to emulator memory" );
2595 PrintAndLog ( " f - decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`" );
2596 PrintAndLog ( "Usage: hf mf sniff [l][d][e][f]" );
2597 PrintAndLog ( " sample: hf mf sniff l d e" );
2601 for ( int i
= 0 ; i
< 4 ; i
++) {
2602 ctmp
= param_getchar ( Cmd
, i
);
2603 if ( ctmp
== 'l' || ctmp
== 'L' ) wantLogToFile
= true ;
2604 if ( ctmp
== 'd' || ctmp
== 'D' ) wantDecrypt
= true ;
2605 //if (ctmp == 'e' || ctmp == 'E') wantSaveToEml = true; TODO
2606 if ( ctmp
== 'f' || ctmp
== 'F' ) wantSaveToEmlFile
= true ;
2609 printf ( "------------------------------------------------------------------------- \n " );
2610 printf ( "Executing command. \n " );
2611 printf ( "Press the key on the proxmark3 device to abort both proxmark3 and client. \n " );
2612 printf ( "Press the key on pc keyboard to abort the client. \n " );
2613 printf ( "------------------------------------------------------------------------- \n " );
2615 UsbCommand c
= { CMD_MIFARE_SNIFFER
, { 0 , 0 , 0 }};
2616 clearCommandBuffer ();
2625 printf ( " \n aborted via keyboard! \n " );
2630 if ( WaitForResponseTimeoutW ( CMD_ACK
, & resp
, 2000 , false )) {
2631 res
= resp
. arg
[ 0 ] & 0xff ;
2632 uint16_t traceLen
= resp
. arg
[ 1 ];
2635 if ( res
== 0 ) { // we are done
2639 if ( res
== 1 ) { // there is (more) data to be transferred
2640 if ( pckNum
== 0 ) { // first packet, (re)allocate necessary buffer
2641 if ( traceLen
> bufsize
|| buf
== NULL
) {
2643 if ( buf
== NULL
) { // not yet allocated
2644 p
= malloc ( traceLen
);
2645 } else { // need more memory
2646 p
= realloc ( buf
, traceLen
);
2649 PrintAndLog ( "Cannot allocate memory for trace" );
2657 memset ( buf
, 0x00 , traceLen
);
2659 memcpy ( bufPtr
, resp
. d
. asBytes
, len
);
2664 if ( res
== 2 ) { // received all data, start displaying
2665 blockLen
= bufPtr
- buf
;
2668 PrintAndLog ( "received trace len: %d packages: %d" , blockLen
, pckNum
);
2669 while ( bufPtr
- buf
< blockLen
) {
2670 bufPtr
+= 6 ; // skip (void) timing information
2671 len
= *(( uint16_t *) bufPtr
);
2678 parlen
= ( len
- 1 ) / 8 + 1 ;
2680 if (( len
== 14 ) && ( bufPtr
[ 0 ] == 0xff ) && ( bufPtr
[ 1 ] == 0xff ) && ( bufPtr
[ 12 ] == 0xff ) && ( bufPtr
[ 13 ] == 0xff )) {
2681 memcpy ( uid
, bufPtr
+ 2 , 7 );
2682 memcpy ( atqa
, bufPtr
+ 2 + 7 , 2 );
2683 uid_len
= ( atqa
[ 0 ] & 0xC0 ) == 0x40 ? 7 : 4 ;
2685 PrintAndLog ( "tag select uid:%s atqa:0x%02x%02x sak:0x%02x" ,
2686 sprint_hex ( uid
+ ( 7 - uid_len
), uid_len
),
2690 if ( wantLogToFile
|| wantDecrypt
) {
2691 FillFileNameByUID ( logHexFileName
, uid
+ ( 7 - uid_len
), ".log" , uid_len
);
2692 AddLogCurrentDT ( logHexFileName
);
2695 mfTraceInit ( uid
, atqa
, sak
, wantSaveToEmlFile
);
2697 oddparitybuf ( bufPtr
, len
, parity
);
2698 PrintAndLog ( "%s(%d):%s [%s] c[%s]%c" ,
2699 isTag
? "TAG" : "RDR" ,
2701 sprint_hex ( bufPtr
, len
),
2702 printBitsPar ( bufPtr
+ len
, len
),
2703 printBitsPar ( parity
, len
),
2704 memcmp ( bufPtr
+ len
, parity
, len
/ 8 + 1 ) ? '!' : ' ' );
2706 AddLogHex ( logHexFileName
, isTag
? "TAG: " : "RDR: " , bufPtr
, len
);
2708 mfTraceDecode ( bufPtr
, len
, bufPtr
[ len
], wantSaveToEmlFile
);
2712 bufPtr
+= parlen
; // ignore parity
2721 msleep ( 300 ); // wait for exiting arm side.
2722 PrintAndLog ( "Done." );
2726 //needs nt, ar, at, Data to decrypt
2727 int CmdDecryptTraceCmds ( const char * Cmd
){
2730 param_gethex_ex ( Cmd
, 3 , data
,& len
);
2731 return tryDecryptWord ( param_get32ex ( Cmd
, 0 , 0 , 16 ), param_get32ex ( Cmd
, 1 , 0 , 16 ), param_get32ex ( Cmd
, 2 , 0 , 16 ), data
, len
/ 2 );
2734 int CmdHF14AMfAuth4 ( const char * cmd
) {
2735 uint8_t keyn
[ 20 ] = { 0 };
2737 uint8_t key
[ 16 ] = { 0 };
2740 CLIParserInit ( "hf mf auth4" ,
2741 "Executes AES authentication command in ISO14443-4" ,
2742 "Usage: \n\t hf mf auth4 4000 000102030405060708090a0b0c0d0e0f -> executes authentication \n "
2743 " \t hf mf auth4 9003 FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF -> executes authentication \n " );
2745 void * argtable
[] = {
2747 arg_str1 ( NULL
, NULL
, "<Key Num (HEX 2 bytes)>" , NULL
),
2748 arg_str1 ( NULL
, NULL
, "<Key Value (HEX 16 bytes)>" , NULL
),
2751 CLIExecWithReturn ( cmd
, argtable
, true );
2753 CLIGetHexWithReturn ( 1 , keyn
, & keynlen
);
2754 CLIGetHexWithReturn ( 2 , key
, & keylen
);
2758 PrintAndLog ( "ERROR: <Key Num> must be 2 bytes long instead of: %d" , keynlen
);
2763 PrintAndLog ( "ERROR: <Key Value> must be 16 bytes long instead of: %d" , keylen
);
2767 return MifareAuth4 ( NULL
, keyn
, key
, true , false , true );
2770 // https://www.nxp.com/docs/en/application-note/AN10787.pdf
2771 int CmdHF14AMfMAD ( const char * cmd
) {
2773 CLIParserInit ( "hf mf mad" ,
2774 "Checks and prints Mifare Application Directory (MAD)" ,
2775 "Usage: \n\t hf mf mad -> shows MAD if exists \n "
2776 " \t hf mf mad -a 03e1 -k ffffffffffff -b -> shows NDEF data if exists. read card with custom key and key B \n " );
2778 void * argtable
[] = {
2780 arg_lit0 ( "vV" , "verbose" , "show technical data" ),
2781 arg_str0 ( "aA" , "aid" , "print all sectors with aid" , NULL
),
2782 arg_str0 ( "kK" , "key" , "key for printing sectors" , NULL
),
2783 arg_lit0 ( "bB" , "keyb" , "use key B for access printing sectors (by default: key A)" ),
2786 CLIExecWithReturn ( cmd
, argtable
, true );
2787 bool verbose
= arg_get_lit ( 1 );
2788 uint8_t aid
[ 2 ] = { 0 };
2790 CLIGetHexWithReturn ( 2 , aid
, & aidlen
);
2791 uint8_t key
[ 6 ] = { 0 };
2793 CLIGetHexWithReturn ( 3 , key
, & keylen
);
2794 bool keyB
= arg_get_lit ( 4 );
2798 if ( aidlen
!= 2 && keylen
> 0 ) {
2799 PrintAndLogEx ( WARNING
, "do not need a key without aid." );
2802 uint8_t sector0
[ 16 * 4 ] = { 0 };
2803 uint8_t sector10
[ 16 * 4 ] = { 0 };
2804 if ( mfReadSector ( MF_MAD1_SECTOR
, MF_KEY_A
, ( uint8_t *) g_mifare_mad_key
, sector0
)) {
2805 PrintAndLogEx ( ERR
, "read sector 0 error. card don't have MAD or don't have MAD on default keys." );
2810 for ( int i
= 0 ; i
< 4 ; i
++)
2811 PrintAndLogEx ( NORMAL
, "[%d] %s" , i
, sprint_hex (& sector0
[ i
* 16 ], 16 ));
2814 bool haveMAD2
= false ;
2815 MAD1DecodeAndPrint ( sector0
, verbose
, & haveMAD2
);
2818 if ( mfReadSector ( MF_MAD2_SECTOR
, MF_KEY_A
, ( uint8_t *) g_mifare_mad_key
, sector10
)) {
2819 PrintAndLogEx ( ERR
, "read sector 0x10 error. card don't have MAD or don't have MAD on default keys." );
2823 MAD2DecodeAndPrint ( sector10
, verbose
);
2827 uint16_t aaid
= ( aid
[ 0 ] << 8 ) + aid
[ 1 ];
2828 PrintAndLogEx ( NORMAL
, " \n -------------- AID 0x%04x ---------------" , aaid
);
2830 uint16_t mad
[ 7 + 8 + 8 + 8 + 8 ] = { 0 };
2832 if ( MADDecode ( sector0
, sector10
, mad
, & madlen
)) {
2833 PrintAndLogEx ( ERR
, "can't decode mad." );
2837 uint8_t akey
[ 6 ] = { 0 };
2838 memcpy ( akey
, g_mifare_ndef_key
, 6 );
2840 memcpy ( akey
, key
, 6 );
2843 for ( int i
= 0 ; i
< madlen
; i
++) {
2844 if ( aaid
== mad
[ i
]) {
2845 uint8_t vsector
[ 16 * 4 ] = { 0 };
2846 if ( mfReadSector ( i
+ 1 , keyB
? MF_KEY_B
: MF_KEY_A
, akey
, vsector
)) {
2847 PrintAndLogEx ( NORMAL
, "" );
2848 PrintAndLogEx ( ERR
, "read sector %d error." , i
+ 1 );
2852 for ( int j
= 0 ; j
< ( verbose
? 4 : 3 ); j
++)
2853 PrintAndLogEx ( NORMAL
, " [%03d] %s" , ( i
+ 1 ) * 4 + j
, sprint_hex (& vsector
[ j
* 16 ], 16 ));
2861 int CmdHFMFNDEF ( const char * cmd
) {
2863 CLIParserInit ( "hf mf ndef" ,
2864 "Prints NFC Data Exchange Format (NDEF)" ,
2865 "Usage: \n\t hf mf ndef -> shows NDEF data \n "
2866 " \t hf mf ndef -a 03e1 -k ffffffffffff -b -> shows NDEF data with custom AID, key and with key B \n " );
2868 void * argtable
[] = {
2870 arg_litn ( "vV" , "verbose" , 0 , 2 , "show technical data" ),
2871 arg_str0 ( "aA" , "aid" , "replace default aid for NDEF" , NULL
),
2872 arg_str0 ( "kK" , "key" , "replace default key for NDEF" , NULL
),
2873 arg_lit0 ( "bB" , "keyb" , "use key B for access sectors (by default: key A)" ),
2876 CLIExecWithReturn ( cmd
, argtable
, true );
2878 bool verbose
= arg_get_lit ( 1 );
2879 bool verbose2
= arg_get_lit ( 1 ) > 1 ;
2880 uint8_t aid
[ 2 ] = { 0 };
2882 CLIGetHexWithReturn ( 2 , aid
, & aidlen
);
2883 uint8_t key
[ 6 ] = { 0 };
2885 CLIGetHexWithReturn ( 3 , key
, & keylen
);
2886 bool keyB
= arg_get_lit ( 4 );
2890 uint16_t ndefAID
= 0x03e1 ;
2892 ndefAID
= ( aid
[ 0 ] << 8 ) + aid
[ 1 ];
2894 uint8_t ndefkey
[ 6 ] = { 0 };
2895 memcpy ( ndefkey
, g_mifare_ndef_key
, 6 );
2897 memcpy ( ndefkey
, key
, 6 );
2900 uint8_t sector0
[ 16 * 4 ] = { 0 };
2901 uint8_t sector10
[ 16 * 4 ] = { 0 };
2902 uint8_t data
[ 4096 ] = { 0 };
2905 PrintAndLogEx ( NORMAL
, "" );
2907 if ( mfReadSector ( MF_MAD1_SECTOR
, MF_KEY_A
, ( uint8_t *) g_mifare_mad_key
, sector0
)) {
2908 PrintAndLogEx ( ERR
, "read sector 0 error. card don't have MAD or don't have MAD on default keys." );
2912 bool haveMAD2
= false ;
2913 int res
= MADCheck ( sector0
, NULL
, verbose
, & haveMAD2
);
2915 PrintAndLogEx ( ERR
, "MAD error %d." , res
);
2920 if ( mfReadSector ( MF_MAD2_SECTOR
, MF_KEY_A
, ( uint8_t *) g_mifare_mad_key
, sector10
)) {
2921 PrintAndLogEx ( ERR
, "read sector 0x10 error. card don't have MAD or don't have MAD on default keys." );
2926 uint16_t mad
[ 7 + 8 + 8 + 8 + 8 ] = { 0 };
2928 if ( MADDecode ( sector0
, ( haveMAD2
? sector10
: NULL
), mad
, & madlen
)) {
2929 PrintAndLogEx ( ERR
, "can't decode mad." );
2933 printf ( "data reading:" );
2934 for ( int i
= 0 ; i
< madlen
; i
++) {
2935 if ( ndefAID
== mad
[ i
]) {
2936 uint8_t vsector
[ 16 * 4 ] = { 0 };
2937 if ( mfReadSector ( i
+ 1 , keyB
? MF_KEY_B
: MF_KEY_A
, ndefkey
, vsector
)) {
2938 PrintAndLogEx ( ERR
, "read sector %d error." , i
+ 1 );
2942 memcpy (& data
[ datalen
], vsector
, 16 * 3 );
2951 PrintAndLogEx ( ERR
, "no NDEF data." );
2956 PrintAndLogEx ( NORMAL
, "NDEF data:" );
2957 dump_buffer ( data
, datalen
, stdout
, 1 );
2960 NDEFDecodeAndPrint ( data
, datalen
, verbose
);
2965 static command_t CommandTable
[] =
2967 { "help" , CmdHelp
, 1 , "This help" },
2968 { "dbg" , CmdHF14AMfDbg
, 0 , "Set default debug mode" },
2969 { "rdbl" , CmdHF14AMfRdBl
, 0 , "Read MIFARE classic block" },
2970 { "rdsc" , CmdHF14AMfRdSc
, 0 , "Read MIFARE classic sector" },
2971 { "dump" , CmdHF14AMfDump
, 0 , "Dump MIFARE classic tag to binary file" },
2972 { "restore" , CmdHF14AMfRestore
, 0 , "Restore MIFARE classic binary file to BLANK tag" },
2973 { "wrbl" , CmdHF14AMfWrBl
, 0 , "Write MIFARE classic block" },
2974 { "auth4" , CmdHF14AMfAuth4
, 0 , "ISO14443-4 AES authentication" },
2975 { "chk" , CmdHF14AMfChk
, 0 , "Test block keys" },
2976 { "mifare" , CmdHF14AMifare
, 0 , "Read parity error messages." },
2977 { "hardnested" , CmdHF14AMfNestedHard
, 0 , "Nested attack for hardened Mifare cards" },
2978 { "nested" , CmdHF14AMfNested
, 0 , "Test nested authentication" },
2979 { "sniff" , CmdHF14AMfSniff
, 0 , "Sniff card-reader communication" },
2980 { "sim" , CmdHF14AMfSim
, 0 , "Simulate MIFARE card" },
2981 { "eclr" , CmdHF14AMfEClear
, 0 , "Clear simulator memory" },
2982 { "eget" , CmdHF14AMfEGet
, 0 , "Get simulator memory block" },
2983 { "eset" , CmdHF14AMfESet
, 0 , "Set simulator memory block" },
2984 { "eload" , CmdHF14AMfELoad
, 0 , "Load from file emul dump" },
2985 { "esave" , CmdHF14AMfESave
, 0 , "Save to file emul dump" },
2986 { "ecfill" , CmdHF14AMfECFill
, 0 , "Fill simulator memory with help of keys from simulator" },
2987 { "ekeyprn" , CmdHF14AMfEKeyPrn
, 0 , "Print keys from simulator memory" },
2988 { "cwipe" , CmdHF14AMfCWipe
, 0 , "Wipe magic Chinese card" },
2989 { "csetuid" , CmdHF14AMfCSetUID
, 0 , "Set UID for magic Chinese card" },
2990 { "csetblk" , CmdHF14AMfCSetBlk
, 0 , "Write block - Magic Chinese card" },
2991 { "cgetblk" , CmdHF14AMfCGetBlk
, 0 , "Read block - Magic Chinese card" },
2992 { "cgetsc" , CmdHF14AMfCGetSc
, 0 , "Read sector - Magic Chinese card" },
2993 { "cload" , CmdHF14AMfCLoad
, 0 , "Load dump into magic Chinese card" },
2994 { "csave" , CmdHF14AMfCSave
, 0 , "Save dump from magic Chinese card into file or emulator" },
2995 { "decrypt" , CmdDecryptTraceCmds
, 1 , "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace" },
2996 { "mad" , CmdHF14AMfMAD
, 0 , "Checks and prints MAD" },
2997 { "ndef" , CmdHFMFNDEF
, 0 , "Prints NDEF records from card" },
2998 { NULL
, NULL
, 0 , NULL
}
3001 int CmdHFMF ( const char * Cmd
)
3003 ( void ) WaitForResponseTimeout ( CMD_ACK
, NULL
, 100 );
3004 CmdsParse ( CommandTable
, Cmd
);
3008 int CmdHelp ( const char * Cmd
)
3010 CmdsHelp ( CommandTable
);