]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhfmf.c
43eca8cb2cdd40ecad54f1d2faa88df9b2489f0f
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2011,2012 Merlok
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // High frequency MIFARE commands
9 //-----------------------------------------------------------------------------
12 #include "./nonce2key/nonce2key.h"
14 static int CmdHelp ( const char * Cmd
);
16 int CmdHF14AMifare ( const char * Cmd
)
19 uint32_t nt
= 0 , nr
= 0 ;
20 uint64_t par_list
= 0 , ks_list
= 0 , r_key
= 0 ;
23 UsbCommand c
= { CMD_READER_MIFARE
, { true , 0 , 0 }};
26 printf ( "------------------------------------------------------------------------- \n " );
27 printf ( "Executing command. Expected execution time: 25sec on average :-) \n " );
28 printf ( "Press button on the proxmark3 device to abort both proxmark3 and client. \n " );
29 printf ( "------------------------------------------------------------------------- \n " );
37 while ( ukbhit ()) getchar ();
45 printf ( " \n aborted via keyboard! \n " );
50 if ( WaitForResponseTimeout ( CMD_ACK
, & resp
, 1000 )) {
52 uid
= ( uint32_t ) bytes_to_num ( resp
. d
. asBytes
+ 0 , 4 );
53 nt
= ( uint32_t ) bytes_to_num ( resp
. d
. asBytes
+ 4 , 4 );
54 par_list
= bytes_to_num ( resp
. d
. asBytes
+ 8 , 8 );
55 ks_list
= bytes_to_num ( resp
. d
. asBytes
+ 16 , 8 );
56 nr
= bytes_to_num ( resp
. d
. asBytes
+ 24 , 4 );
59 case - 1 : PrintAndLog ( "Button pressed. Aborted. \n " ); break ;
60 case - 2 : PrintAndLog ( "Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests). \n " ); break ;
61 case - 3 : PrintAndLog ( "Card is not vulnerable to Darkside attack (its random number generator is not predictable). \n " ); break ;
62 case - 4 : PrintAndLog ( "Card is not vulnerable to Darkside attack (its random number generator seems to be based on the wellknown" );
63 PrintAndLog ( "generating polynomial with 16 effective bits only, but shows unexpected behaviour. \n " ); break ;
73 if ( isOK
!= 1 ) return 1 ;
75 // execute original function from util nonce2key
76 if ( nonce2key ( uid
, nt
, nr
, par_list
, ks_list
, & r_key
)) {
78 PrintAndLog ( "Key not found (lfsr_common_prefix list is null). Nt=%08x" , nt
);
79 PrintAndLog ( "Failing is expected to happen in 25%% of all cases. Trying again with a different reader nonce..." );
84 printf ( "------------------------------------------------------------------ \n " );
85 PrintAndLog ( "Found valid key:%012" llx
" \n " , r_key
);
92 int CmdHF14AMfWrBl ( const char * Cmd
)
96 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
97 uint8_t bldata
[ 16 ] = { 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 };
102 PrintAndLog ( "Usage: hf mf wrbl <block number> <key A/B> <key (12 hex symbols)> <block data (32 hex symbols)>" );
103 PrintAndLog ( " sample: hf mf wrbl 0 A FFFFFFFFFFFF 000102030405060708090A0B0C0D0E0F" );
107 blockNo
= param_get8 ( Cmd
, 0 );
108 cmdp
= param_getchar ( Cmd
, 1 );
110 PrintAndLog ( "Key type must be A or B" );
113 if ( cmdp
!= 'A' && cmdp
!= 'a' ) keyType
= 1 ;
114 if ( param_gethex ( Cmd
, 2 , key
, 12 )) {
115 PrintAndLog ( "Key must include 12 HEX symbols" );
118 if ( param_gethex ( Cmd
, 3 , bldata
, 32 )) {
119 PrintAndLog ( "Block data must include 32 HEX symbols" );
122 PrintAndLog ( "--block no:%d, key type:%c, key:%s" , blockNo
, keyType
? 'B' : 'A' , sprint_hex ( key
, 6 ));
123 PrintAndLog ( "--data: %s" , sprint_hex ( bldata
, 16 ));
125 UsbCommand c
= { CMD_MIFARE_WRITEBL
, { blockNo
, keyType
, 0 }};
126 memcpy ( c
. d
. asBytes
, key
, 6 );
127 memcpy ( c
. d
. asBytes
+ 10 , bldata
, 16 );
131 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
132 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
133 PrintAndLog ( "isOk:%02x" , isOK
);
135 PrintAndLog ( "Command execute timeout" );
141 int CmdHF14AMfRdBl ( const char * Cmd
)
145 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
151 PrintAndLog ( "Usage: hf mf rdbl <block number> <key A/B> <key (12 hex symbols)>" );
152 PrintAndLog ( " sample: hf mf rdbl 0 A FFFFFFFFFFFF " );
156 blockNo
= param_get8 ( Cmd
, 0 );
157 cmdp
= param_getchar ( Cmd
, 1 );
159 PrintAndLog ( "Key type must be A or B" );
162 if ( cmdp
!= 'A' && cmdp
!= 'a' ) keyType
= 1 ;
163 if ( param_gethex ( Cmd
, 2 , key
, 12 )) {
164 PrintAndLog ( "Key must include 12 HEX symbols" );
167 PrintAndLog ( "--block no:%d, key type:%c, key:%s " , blockNo
, keyType
? 'B' : 'A' , sprint_hex ( key
, 6 ));
169 UsbCommand c
= { CMD_MIFARE_READBL
, { blockNo
, keyType
, 0 }};
170 memcpy ( c
. d
. asBytes
, key
, 6 );
174 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
175 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
176 uint8_t * data
= resp
. d
. asBytes
;
179 PrintAndLog ( "isOk:%02x data:%s" , isOK
, sprint_hex ( data
, 16 ));
181 PrintAndLog ( "isOk:%02x" , isOK
);
183 PrintAndLog ( "Command execute timeout" );
189 int CmdHF14AMfRdSc ( const char * Cmd
)
192 uint8_t sectorNo
= 0 ;
194 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
196 uint8_t * data
= NULL
;
200 PrintAndLog ( "Usage: hf mf rdsc <sector number> <key A/B> <key (12 hex symbols)>" );
201 PrintAndLog ( " sample: hf mf rdsc 0 A FFFFFFFFFFFF " );
205 sectorNo
= param_get8 ( Cmd
, 0 );
207 PrintAndLog ( "Sector number must be less than 40" );
210 cmdp
= param_getchar ( Cmd
, 1 );
211 if ( cmdp
!= 'a' && cmdp
!= 'A' && cmdp
!= 'b' && cmdp
!= 'B' ) {
212 PrintAndLog ( "Key type must be A or B" );
215 if ( cmdp
!= 'A' && cmdp
!= 'a' ) keyType
= 1 ;
216 if ( param_gethex ( Cmd
, 2 , key
, 12 )) {
217 PrintAndLog ( "Key must include 12 HEX symbols" );
220 PrintAndLog ( "--sector no:%d key type:%c key:%s " , sectorNo
, keyType
? 'B' : 'A' , sprint_hex ( key
, 6 ));
222 UsbCommand c
= { CMD_MIFARE_READSC
, { sectorNo
, keyType
, 0 }};
223 memcpy ( c
. d
. asBytes
, key
, 6 );
228 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
229 isOK
= resp
. arg
[ 0 ] & 0xff ;
230 data
= resp
. d
. asBytes
;
232 PrintAndLog ( "isOk:%02x" , isOK
);
234 for ( i
= 0 ; i
< ( sectorNo
< 32 ? 3 : 15 ); i
++) {
235 PrintAndLog ( "data : %s" , sprint_hex ( data
+ i
* 16 , 16 ));
237 PrintAndLog ( "trailer: %s" , sprint_hex ( data
+ ( sectorNo
< 32 ? 3 : 15 ) * 16 , 16 ));
240 PrintAndLog ( "Command execute timeout" );
246 uint8_t FirstBlockOfSector ( uint8_t sectorNo
)
251 return 32 * 4 + ( sectorNo
- 32 ) * 16 ;
255 uint8_t NumBlocksPerSector ( uint8_t sectorNo
)
264 int CmdHF14AMfDump ( const char * Cmd
)
266 uint8_t sectorNo
, blockNo
;
270 uint8_t rights
[ 40 ][ 4 ];
271 uint8_t carddata
[ 256 ][ 16 ];
272 uint8_t numSectors
= 16 ;
279 char cmdp
= param_getchar ( Cmd
, 0 );
281 case '0' : numSectors
= 5 ; break ;
283 case '\0' : numSectors
= 16 ; break ;
284 case '2' : numSectors
= 32 ; break ;
285 case '4' : numSectors
= 40 ; break ;
286 default : numSectors
= 16 ;
289 if ( strlen ( Cmd
) > 1 || cmdp
== 'h' || cmdp
== 'H' ) {
290 PrintAndLog ( "Usage: hf mf dump [card memory]" );
291 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
293 PrintAndLog ( "Samples: hf mf dump" );
294 PrintAndLog ( " hf mf dump 4" );
298 if (( fin
= fopen ( "dumpkeys.bin" , "rb" )) == NULL
) {
299 PrintAndLog ( "Could not find file dumpkeys.bin" );
303 // Read keys A from file
304 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
305 if ( fread ( keyA
[ sectorNo
], 1 , 6 , fin
) == 0 ) {
306 PrintAndLog ( "File reading error." );
312 // Read keys B from file
313 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
314 if ( fread ( keyB
[ sectorNo
], 1 , 6 , fin
) == 0 ) {
315 PrintAndLog ( "File reading error." );
323 PrintAndLog ( "|-----------------------------------------|" );
324 PrintAndLog ( "|------ Reading sector access bits...-----|" );
325 PrintAndLog ( "|-----------------------------------------|" );
327 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
328 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + NumBlocksPerSector ( sectorNo
) - 1 , 0 , 0 }};
329 memcpy ( c
. d
. asBytes
, keyA
[ sectorNo
], 6 );
332 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
333 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
334 uint8_t * data
= resp
. d
. asBytes
;
336 rights
[ sectorNo
][ 0 ] = (( data
[ 7 ] & 0x10 )>> 2 ) | (( data
[ 8 ] & 0x1 )<< 1 ) | (( data
[ 8 ] & 0x10 )>> 4 ); // C1C2C3 for data area 0
337 rights
[ sectorNo
][ 1 ] = (( data
[ 7 ] & 0x20 )>> 3 ) | (( data
[ 8 ] & 0x2 )<< 0 ) | (( data
[ 8 ] & 0x20 )>> 5 ); // C1C2C3 for data area 1
338 rights
[ sectorNo
][ 2 ] = (( data
[ 7 ] & 0x40 )>> 4 ) | (( data
[ 8 ] & 0x4 )>> 1 ) | (( data
[ 8 ] & 0x40 )>> 6 ); // C1C2C3 for data area 2
339 rights
[ sectorNo
][ 3 ] = (( data
[ 7 ] & 0x80 )>> 5 ) | (( data
[ 8 ] & 0x8 )>> 2 ) | (( data
[ 8 ] & 0x80 )>> 7 ); // C1C2C3 for sector trailer
341 PrintAndLog ( "Could not get access rights for sector %2d. Trying with defaults..." , sectorNo
);
342 rights
[ sectorNo
][ 0 ] = rights
[ sectorNo
][ 1 ] = rights
[ sectorNo
][ 2 ] = 0x00 ;
343 rights
[ sectorNo
][ 3 ] = 0x01 ;
346 PrintAndLog ( "Command execute timeout when trying to read access rights for sector %2d. Trying with defaults..." , sectorNo
);
347 rights
[ sectorNo
][ 0 ] = rights
[ sectorNo
][ 1 ] = rights
[ sectorNo
][ 2 ] = 0x00 ;
348 rights
[ sectorNo
][ 3 ] = 0x01 ;
352 PrintAndLog ( "|-----------------------------------------|" );
353 PrintAndLog ( "|----- Dumping all blocks to file... -----|" );
354 PrintAndLog ( "|-----------------------------------------|" );
357 for ( sectorNo
= 0 ; isOK
&& sectorNo
< numSectors
; sectorNo
++) {
358 for ( blockNo
= 0 ; isOK
&& blockNo
< NumBlocksPerSector ( sectorNo
); blockNo
++) {
359 bool received
= false ;
361 if ( blockNo
== NumBlocksPerSector ( sectorNo
) - 1 ) { // sector trailer. At least the Access Conditions can always be read with key A.
362 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, 0 , 0 }};
363 memcpy ( c
. d
. asBytes
, keyA
[ sectorNo
], 6 );
365 received
= WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 );
366 } else { // data block. Check if it can be read with key A or key B
367 uint8_t data_area
= sectorNo
< 32 ? blockNo
: blockNo
/ 5 ;
368 if (( rights
[ sectorNo
][ data_area
] == 0x03 ) || ( rights
[ sectorNo
][ data_area
] == 0x05 )) { // only key B would work
369 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, 1 , 0 }};
370 memcpy ( c
. d
. asBytes
, keyB
[ sectorNo
], 6 );
372 received
= WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 );
373 } else if ( rights
[ sectorNo
][ data_area
] == 0x07 ) { // no key would work
375 PrintAndLog ( "Access rights do not allow reading of sector %2d block %3d" , sectorNo
, blockNo
);
376 } else { // key A would work
377 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, 0 , 0 }};
378 memcpy ( c
. d
. asBytes
, keyA
[ sectorNo
], 6 );
380 received
= WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 );
385 isOK
= resp
. arg
[ 0 ] & 0xff ;
386 uint8_t * data
= resp
. d
. asBytes
;
387 if ( blockNo
== NumBlocksPerSector ( sectorNo
) - 1 ) { // sector trailer. Fill in the keys.
388 data
[ 0 ] = ( keyA
[ sectorNo
][ 0 ]);
389 data
[ 1 ] = ( keyA
[ sectorNo
][ 1 ]);
390 data
[ 2 ] = ( keyA
[ sectorNo
][ 2 ]);
391 data
[ 3 ] = ( keyA
[ sectorNo
][ 3 ]);
392 data
[ 4 ] = ( keyA
[ sectorNo
][ 4 ]);
393 data
[ 5 ] = ( keyA
[ sectorNo
][ 5 ]);
394 data
[ 10 ] = ( keyB
[ sectorNo
][ 0 ]);
395 data
[ 11 ] = ( keyB
[ sectorNo
][ 1 ]);
396 data
[ 12 ] = ( keyB
[ sectorNo
][ 2 ]);
397 data
[ 13 ] = ( keyB
[ sectorNo
][ 3 ]);
398 data
[ 14 ] = ( keyB
[ sectorNo
][ 4 ]);
399 data
[ 15 ] = ( keyB
[ sectorNo
][ 5 ]);
402 memcpy ( carddata
[ FirstBlockOfSector ( sectorNo
) + blockNo
], data
, 16 );
403 PrintAndLog ( "Successfully read block %2d of sector %2d." , blockNo
, sectorNo
);
405 PrintAndLog ( "Could not read block %2d of sector %2d" , blockNo
, sectorNo
);
411 PrintAndLog ( "Command execute timeout when trying to read block %2d of sector %2d." , blockNo
, sectorNo
);
418 if (( fout
= fopen ( "dumpdata.bin" , "wb" )) == NULL
) {
419 PrintAndLog ( "Could not create file name dumpdata.bin" );
422 uint16_t numblocks
= FirstBlockOfSector ( numSectors
- 1 ) + NumBlocksPerSector ( numSectors
- 1 );
423 fwrite ( carddata
, 1 , 16 * numblocks
, fout
);
425 PrintAndLog ( "Dumped %d blocks (%d bytes) to file dumpdata.bin" , numblocks
, 16 * numblocks
);
431 int CmdHF14AMfRestore ( const char * Cmd
)
433 uint8_t sectorNo
, blockNo
;
435 uint8_t key
[ 6 ] = { 0xFF , 0xFF , 0xFF , 0xFF , 0xFF , 0xFF };
436 uint8_t bldata
[ 16 ] = { 0x00 };
444 char cmdp
= param_getchar ( Cmd
, 0 );
446 case '0' : numSectors
= 5 ; break ;
448 case '\0' : numSectors
= 16 ; break ;
449 case '2' : numSectors
= 32 ; break ;
450 case '4' : numSectors
= 40 ; break ;
451 default : numSectors
= 16 ;
454 if ( strlen ( Cmd
) > 1 || cmdp
== 'h' || cmdp
== 'H' ) {
455 PrintAndLog ( "Usage: hf mf restore [card memory]" );
456 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
458 PrintAndLog ( "Samples: hf mf restore" );
459 PrintAndLog ( " hf mf restore 4" );
463 if (( fkeys
= fopen ( "dumpkeys.bin" , "rb" )) == NULL
) {
464 PrintAndLog ( "Could not find file dumpkeys.bin" );
468 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
469 if ( fread ( keyA
[ sectorNo
], 1 , 6 , fkeys
) == 0 ) {
470 PrintAndLog ( "File reading error (dumpkeys.bin)." );
477 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
478 if ( fread ( keyB
[ sectorNo
], 1 , 6 , fkeys
) == 0 ) {
479 PrintAndLog ( "File reading error (dumpkeys.bin)." );
487 if (( fdump
= fopen ( "dumpdata.bin" , "rb" )) == NULL
) {
488 PrintAndLog ( "Could not find file dumpdata.bin" );
491 PrintAndLog ( "Restoring dumpdata.bin to card" );
493 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
494 for ( blockNo
= 0 ; blockNo
< NumBlocksPerSector ( sectorNo
); blockNo
++) {
495 UsbCommand c
= { CMD_MIFARE_WRITEBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, keyType
, 0 }};
496 memcpy ( c
. d
. asBytes
, key
, 6 );
498 if ( fread ( bldata
, 1 , 16 , fdump
) == 0 ) {
499 PrintAndLog ( "File reading error (dumpdata.bin)." );
504 if ( blockNo
== NumBlocksPerSector ( sectorNo
) - 1 ) { // sector trailer
505 bldata
[ 0 ] = ( keyA
[ sectorNo
][ 0 ]);
506 bldata
[ 1 ] = ( keyA
[ sectorNo
][ 1 ]);
507 bldata
[ 2 ] = ( keyA
[ sectorNo
][ 2 ]);
508 bldata
[ 3 ] = ( keyA
[ sectorNo
][ 3 ]);
509 bldata
[ 4 ] = ( keyA
[ sectorNo
][ 4 ]);
510 bldata
[ 5 ] = ( keyA
[ sectorNo
][ 5 ]);
511 bldata
[ 10 ] = ( keyB
[ sectorNo
][ 0 ]);
512 bldata
[ 11 ] = ( keyB
[ sectorNo
][ 1 ]);
513 bldata
[ 12 ] = ( keyB
[ sectorNo
][ 2 ]);
514 bldata
[ 13 ] = ( keyB
[ sectorNo
][ 3 ]);
515 bldata
[ 14 ] = ( keyB
[ sectorNo
][ 4 ]);
516 bldata
[ 15 ] = ( keyB
[ sectorNo
][ 5 ]);
519 PrintAndLog ( "Writing to block %3d: %s" , FirstBlockOfSector ( sectorNo
) + blockNo
, sprint_hex ( bldata
, 16 ));
521 memcpy ( c
. d
. asBytes
+ 10 , bldata
, 16 );
525 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
526 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
527 PrintAndLog ( "isOk:%02x" , isOK
);
529 PrintAndLog ( "Command execute timeout" );
538 int CmdHF14AMfNested ( const char * Cmd
)
540 int i
, j
, res
, iterations
;
541 sector
* e_sector
= NULL
;
544 uint8_t trgBlockNo
= 0 ;
545 uint8_t trgKeyType
= 0 ;
546 uint8_t SectorsCnt
= 0 ;
547 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
548 uint8_t keyBlock
[ 14 * 6 ];
550 bool transferToEml
= false ;
552 bool createDumpFile
= false ;
554 uint8_t standart
[ 6 ] = { 0xFF , 0xFF , 0xFF , 0xFF , 0xFF , 0xFF };
555 uint8_t tempkey
[ 6 ] = { 0xFF , 0xFF , 0xFF , 0xFF , 0xFF , 0xFF };
560 PrintAndLog ( "Usage:" );
561 PrintAndLog ( " all sectors: hf mf nested <card memory> <block number> <key A/B> <key (12 hex symbols)> [t,d]" );
562 PrintAndLog ( " one sector: hf mf nested o <block number> <key A/B> <key (12 hex symbols)>" );
563 PrintAndLog ( " <target block number> <target key A/B> [t]" );
564 PrintAndLog ( "card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K" );
565 PrintAndLog ( "t - transfer keys into emulator memory" );
566 PrintAndLog ( "d - write keys to binary file" );
568 PrintAndLog ( " sample1: hf mf nested 1 0 A FFFFFFFFFFFF " );
569 PrintAndLog ( " sample2: hf mf nested 1 0 A FFFFFFFFFFFF t " );
570 PrintAndLog ( " sample3: hf mf nested 1 0 A FFFFFFFFFFFF d " );
571 PrintAndLog ( " sample4: hf mf nested o 0 A FFFFFFFFFFFF 4 A" );
575 cmdp
= param_getchar ( Cmd
, 0 );
576 blockNo
= param_get8 ( Cmd
, 1 );
577 ctmp
= param_getchar ( Cmd
, 2 );
579 if ( ctmp
!= 'a' && ctmp
!= 'A' && ctmp
!= 'b' && ctmp
!= 'B' ) {
580 PrintAndLog ( "Key type must be A or B" );
584 if ( ctmp
!= 'A' && ctmp
!= 'a' )
587 if ( param_gethex ( Cmd
, 3 , key
, 12 )) {
588 PrintAndLog ( "Key must include 12 HEX symbols" );
592 if ( cmdp
== 'o' || cmdp
== 'O' ) {
594 trgBlockNo
= param_get8 ( Cmd
, 4 );
595 ctmp
= param_getchar ( Cmd
, 5 );
596 if ( ctmp
!= 'a' && ctmp
!= 'A' && ctmp
!= 'b' && ctmp
!= 'B' ) {
597 PrintAndLog ( "Target key type must be A or B" );
600 if ( ctmp
!= 'A' && ctmp
!= 'a' )
605 case '0' : SectorsCnt
= 05 ; break ;
606 case '1' : SectorsCnt
= 16 ; break ;
607 case '2' : SectorsCnt
= 32 ; break ;
608 case '4' : SectorsCnt
= 40 ; break ;
609 default : SectorsCnt
= 16 ;
613 ctmp
= param_getchar ( Cmd
, 4 );
614 if ( ctmp
== 't' || ctmp
== 'T' ) transferToEml
= true ;
615 else if ( ctmp
== 'd' || ctmp
== 'D' ) createDumpFile
= true ;
617 ctmp
= param_getchar ( Cmd
, 6 );
618 transferToEml
|= ( ctmp
== 't' || ctmp
== 'T' );
619 transferToEml
|= ( ctmp
== 'd' || ctmp
== 'D' );
622 PrintAndLog ( "--target block no:%3d, target key type:%c " , trgBlockNo
, trgKeyType
? 'B' : 'A' );
623 int16_t isOK
= mfnested ( blockNo
, keyType
, key
, trgBlockNo
, trgKeyType
, keyBlock
, true );
626 case - 1 : PrintAndLog ( "Error: No response from Proxmark. \n " ); break ;
627 case - 2 : PrintAndLog ( "Button pressed. Aborted. \n " ); break ;
628 case - 3 : PrintAndLog ( "Tag isn't vulnerable to Nested Attack (random numbers are not predictable). \n " ); break ;
629 default : PrintAndLog ( "Unknown Error. \n " );
633 key64
= bytes_to_num ( keyBlock
, 6 );
635 PrintAndLog ( "Found valid key:%012" llx
, key64
);
637 // transfer key to the emulator
639 uint8_t sectortrailer
;
640 if ( trgBlockNo
< 32 * 4 ) { // 4 block sector
641 sectortrailer
= ( trgBlockNo
& 0x03 ) + 3 ;
642 } else { // 16 block sector
643 sectortrailer
= ( trgBlockNo
& 0x0f ) + 15 ;
645 mfEmlGetMem ( keyBlock
, sectortrailer
, 1 );
648 num_to_bytes ( key64
, 6 , keyBlock
);
650 num_to_bytes ( key64
, 6 , & keyBlock
[ 10 ]);
651 mfEmlSetMem ( keyBlock
, sectortrailer
, 1 );
654 PrintAndLog ( "No valid key found" );
657 else { // ------------------------------------ multiple sectors working
661 e_sector
= calloc ( SectorsCnt
, sizeof ( sector
));
662 if ( e_sector
== NULL
) return 1 ;
664 //test current key and additional standard keys first
665 memcpy ( keyBlock
, key
, 6 );
666 num_to_bytes ( 0xffffffffffff , 6 , ( uint8_t *)( keyBlock
+ 1 * 6 ));
667 num_to_bytes ( 0x000000000000 , 6 , ( uint8_t *)( keyBlock
+ 2 * 6 ));
668 num_to_bytes ( 0xa0a1a2a3a4a5 , 6 , ( uint8_t *)( keyBlock
+ 3 * 6 ));
669 num_to_bytes ( 0xb0b1b2b3b4b5 , 6 , ( uint8_t *)( keyBlock
+ 4 * 6 ));
670 num_to_bytes ( 0xaabbccddeeff , 6 , ( uint8_t *)( keyBlock
+ 5 * 6 ));
671 num_to_bytes ( 0x4d3a99c351dd , 6 , ( uint8_t *)( keyBlock
+ 6 * 6 ));
672 num_to_bytes ( 0x1a982c7e459a , 6 , ( uint8_t *)( keyBlock
+ 7 * 6 ));
673 num_to_bytes ( 0xd3f7d3f7d3f7 , 6 , ( uint8_t *)( keyBlock
+ 8 * 6 ));
674 num_to_bytes ( 0x714c5c886e97 , 6 , ( uint8_t *)( keyBlock
+ 9 * 6 ));
675 num_to_bytes ( 0x587ee5f9350f , 6 , ( uint8_t *)( keyBlock
+ 10 * 6 ));
676 num_to_bytes ( 0xa0478cc39091 , 6 , ( uint8_t *)( keyBlock
+ 11 * 6 ));
677 num_to_bytes ( 0x533cb6c723f6 , 6 , ( uint8_t *)( keyBlock
+ 12 * 6 ));
678 num_to_bytes ( 0x8fd0a4f256e9 , 6 , ( uint8_t *)( keyBlock
+ 13 * 6 ));
680 PrintAndLog ( "Testing known keys. Sector count=%d" , SectorsCnt
);
681 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
682 for ( j
= 0 ; j
< 2 ; j
++) {
683 if ( e_sector
[ i
]. foundKey
[ j
]) continue ;
685 res
= mfCheckKeys ( FirstBlockOfSector ( i
), j
, true , 6 , keyBlock
, & key64
);
688 e_sector
[ i
]. Key
[ j
] = key64
;
689 e_sector
[ i
]. foundKey
[ j
] = 1 ;
696 PrintAndLog ( "nested..." );
697 bool calibrate
= true ;
698 for ( i
= 0 ; i
< NESTED_SECTOR_RETRY
; i
++) {
699 for ( uint8_t sectorNo
= 0 ; sectorNo
< SectorsCnt
; sectorNo
++) {
700 for ( trgKeyType
= 0 ; trgKeyType
< 2 ; trgKeyType
++) {
701 if ( e_sector
[ sectorNo
]. foundKey
[ trgKeyType
]) continue ;
702 PrintAndLog ( "-----------------------------------------------" );
703 int16_t isOK
= mfnested ( blockNo
, keyType
, key
, FirstBlockOfSector ( sectorNo
), trgKeyType
, keyBlock
, calibrate
);
706 case - 1 : PrintAndLog ( "Error: No response from Proxmark. \n " ); break ;
707 case - 2 : PrintAndLog ( "Button pressed. Aborted. \n " ); break ;
708 case - 3 : PrintAndLog ( "Tag isn't vulnerable to Nested Attack (random numbers are not predictable). \n " ); break ;
709 default : PrintAndLog ( "Unknown Error. \n " );
719 key64
= bytes_to_num ( keyBlock
, 6 );
721 PrintAndLog ( "Found valid key:%012" llx
, key64
);
722 e_sector
[ sectorNo
]. foundKey
[ trgKeyType
] = 1 ;
723 e_sector
[ sectorNo
]. Key
[ trgKeyType
] = key64
;
729 printf ( "Time in nested: %1.3f (%1.3f sec per key) \n\n " , (( float ) clock () - time1
)/ CLOCKS_PER_SEC
, (( float ) clock () - time1
)/ iterations
/ CLOCKS_PER_SEC
);
731 PrintAndLog ( "----------------------------------------------- \n Iterations count: %d \n\n " , iterations
);
733 PrintAndLog ( "|---|----------------|---|----------------|---|" );
734 PrintAndLog ( "|sec|key A |res|key B |res|" );
735 PrintAndLog ( "|---|----------------|---|----------------|---|" );
736 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
737 PrintAndLog ( "|%03d| %012" llx
" | %d | %012" llx
" | %d |" , i
,
738 e_sector
[ i
]. Key
[ 0 ], e_sector
[ i
]. foundKey
[ 0 ], e_sector
[ i
]. Key
[ 1 ], e_sector
[ i
]. foundKey
[ 1 ]);
740 PrintAndLog ( "|---|----------------|---|----------------|---|" );
742 // transfer them to the emulator
744 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
745 mfEmlGetMem ( keyBlock
, FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 , 1 );
746 if ( e_sector
[ i
]. foundKey
[ 0 ])
747 num_to_bytes ( e_sector
[ i
]. Key
[ 0 ], 6 , keyBlock
);
748 if ( e_sector
[ i
]. foundKey
[ 1 ])
749 num_to_bytes ( e_sector
[ i
]. Key
[ 1 ], 6 , & keyBlock
[ 10 ]);
750 mfEmlSetMem ( keyBlock
, FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 , 1 );
755 if ( createDumpFile
) {
756 if (( fkeys
= fopen ( "dumpkeys.bin" , "wb" )) == NULL
) {
757 PrintAndLog ( "Could not create file dumpkeys.bin" );
761 PrintAndLog ( "Printing keys to binary file dumpkeys.bin..." );
762 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
763 if ( e_sector
[ i
]. foundKey
[ 0 ]){
764 num_to_bytes ( e_sector
[ i
]. Key
[ 0 ], 6 , tempkey
);
765 fwrite ( tempkey
, 1 , 6 , fkeys
);
768 fwrite ( & standart
, 1 , 6 , fkeys
);
771 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
772 if ( e_sector
[ i
]. foundKey
[ 1 ]){
773 num_to_bytes ( e_sector
[ i
]. Key
[ 1 ], 6 , tempkey
);
774 fwrite ( tempkey
, 1 , 6 , fkeys
);
777 fwrite ( & standart
, 1 , 6 , fkeys
);
788 int CmdHF14AMfChk ( const char * Cmd
)
791 PrintAndLog ( "Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d] [<key (12 hex symbols)>] [<dic (*.dic)>]" );
792 PrintAndLog ( " * - all sectors" );
793 PrintAndLog ( "card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K" );
794 PrintAndLog ( "d - write keys to binary file \n " );
795 PrintAndLog ( "t - write keys to emulator memory" );
796 PrintAndLog ( " sample: hf mf chk 0 A 1234567890ab keys.dic" );
797 PrintAndLog ( " hf mf chk *1 ? t" );
798 PrintAndLog ( " hf mf chk *1 ? d" );
803 char filename
[ FILE_PATH_SIZE
]={ 0 };
805 uint8_t * keyBlock
= NULL
, * p
;
806 uint8_t stKeyBlock
= 20 ;
812 uint8_t SectorsCnt
= 1 ;
816 int transferToEml
= 0 ;
817 int createDumpFile
= 0 ;
819 keyBlock
= calloc ( stKeyBlock
, 6 );
820 if ( keyBlock
== NULL
) return 1 ;
822 uint64_t defaultKeys
[] =
824 0xffffffffffff , // Default key (first key used by program if no user defined key)
825 0x000000000000 , // Blank key
826 0xa0a1a2a3a4a5 , // NFCForum MAD key
838 int defaultKeysSize
= sizeof ( defaultKeys
) / sizeof ( uint64_t );
840 for ( int defaultKeyCounter
= 0 ; defaultKeyCounter
< defaultKeysSize
; defaultKeyCounter
++)
842 num_to_bytes ( defaultKeys
[ defaultKeyCounter
], 6 , ( uint8_t *)( keyBlock
+ defaultKeyCounter
* 6 ));
845 if ( param_getchar ( Cmd
, 0 )== '*' ) {
847 switch ( param_getchar ( Cmd
+ 1 , 0 )) {
848 case '0' : SectorsCnt
= 5 ; break ;
849 case '1' : SectorsCnt
= 16 ; break ;
850 case '2' : SectorsCnt
= 32 ; break ;
851 case '4' : SectorsCnt
= 40 ; break ;
852 default : SectorsCnt
= 16 ;
856 blockNo
= param_get8 ( Cmd
, 0 );
858 ctmp
= param_getchar ( Cmd
, 1 );
870 PrintAndLog ( "Key type must be A , B or ?" );
874 ctmp
= param_getchar ( Cmd
, 2 );
875 if ( ctmp
== 't' || ctmp
== 'T' ) transferToEml
= 1 ;
876 else if ( ctmp
== 'd' || ctmp
== 'D' ) createDumpFile
= 1 ;
878 for ( i
= transferToEml
|| createDumpFile
; param_getchar ( Cmd
, 2 + i
); i
++) {
879 if (! param_gethex ( Cmd
, 2 + i
, keyBlock
+ 6 * keycnt
, 12 )) {
880 if ( stKeyBlock
- keycnt
< 2 ) {
881 p
= realloc ( keyBlock
, 6 *( stKeyBlock
+= 10 ));
883 PrintAndLog ( "Cannot allocate memory for Keys" );
889 PrintAndLog ( "chk key[%2d] %02x%02x%02x%02x%02x%02x" , keycnt
,
890 ( keyBlock
+ 6 * keycnt
)[ 0 ],( keyBlock
+ 6 * keycnt
)[ 1 ], ( keyBlock
+ 6 * keycnt
)[ 2 ],
891 ( keyBlock
+ 6 * keycnt
)[ 3 ], ( keyBlock
+ 6 * keycnt
)[ 4 ], ( keyBlock
+ 6 * keycnt
)[ 5 ], 6 );
895 if ( param_getstr ( Cmd
, 2 + i
, filename
) >= FILE_PATH_SIZE
) {
896 PrintAndLog ( "File name too long" );
901 if ( ( f
= fopen ( filename
, "r" )) ) {
902 while ( fgets ( buf
, sizeof ( buf
), f
) ){
903 if ( strlen ( buf
) < 12 || buf
[ 11 ] == ' \n ' )
906 while ( fgetc ( f
) != ' \n ' && ! feof ( f
)) ; //goto next line
908 if ( buf
[ 0 ]== '#' ) continue ; //The line start with # is comment, skip
910 if (! isxdigit ( buf
[ 0 ])){
911 PrintAndLog ( "File content error. '%s' must include 12 HEX symbols" , buf
);
917 if ( stKeyBlock
- keycnt
< 2 ) {
918 p
= realloc ( keyBlock
, 6 *( stKeyBlock
+= 10 ));
920 PrintAndLog ( "Cannot allocate memory for defKeys" );
926 memset ( keyBlock
+ 6 * keycnt
, 0 , 6 );
927 num_to_bytes ( strtoll ( buf
, NULL
, 16 ), 6 , keyBlock
+ 6 * keycnt
);
928 PrintAndLog ( "chk custom key[%2d] %012" llx
, keycnt
, bytes_to_num ( keyBlock
+ 6 * keycnt
, 6 ));
930 memset ( buf
, 0 , sizeof ( buf
));
934 PrintAndLog ( "File: %s: not found or locked." , filename
);
943 PrintAndLog ( "No key specified, trying default keys" );
944 for (; keycnt
< defaultKeysSize
; keycnt
++)
945 PrintAndLog ( "chk default key[%2d] %02x%02x%02x%02x%02x%02x" , keycnt
,
946 ( keyBlock
+ 6 * keycnt
)[ 0 ],( keyBlock
+ 6 * keycnt
)[ 1 ], ( keyBlock
+ 6 * keycnt
)[ 2 ],
947 ( keyBlock
+ 6 * keycnt
)[ 3 ], ( keyBlock
+ 6 * keycnt
)[ 4 ], ( keyBlock
+ 6 * keycnt
)[ 5 ], 6 );
950 // initialize storage for found keys
951 bool validKey
[ 2 ][ 40 ];
952 uint8_t foundKey
[ 2 ][ 40 ][ 6 ];
953 for ( uint16_t t
= 0 ; t
< 2 ; t
++) {
954 for ( uint16_t sectorNo
= 0 ; sectorNo
< SectorsCnt
; sectorNo
++) {
955 validKey
[ t
][ sectorNo
] = false ;
956 for ( uint16_t i
= 0 ; i
< 6 ; i
++) {
957 foundKey
[ t
][ sectorNo
][ i
] = 0xff ;
962 for ( int t
= ! keyType
; t
< 2 ; keyType
== 2 ?( t
++):( t
= 2 ) ) {
964 for ( int i
= 0 ; i
< SectorsCnt
; ++ i
) {
965 PrintAndLog ( "--sector:%2d, block:%3d, key type:%C, key count:%2d " , i
, b
, t
? 'B' : 'A' , keycnt
);
966 uint32_t max_keys
= keycnt
> USB_CMD_DATA_SIZE
/ 6 ? USB_CMD_DATA_SIZE
/ 6 : keycnt
;
967 for ( uint32_t c
= 0 ; c
< keycnt
; c
+= max_keys
) {
968 uint32_t size
= keycnt
- c
> max_keys
? max_keys
: keycnt
- c
;
969 res
= mfCheckKeys ( b
, t
, true , size
, & keyBlock
[ 6 * c
], & key64
);
972 PrintAndLog ( "Found valid key:[%012" llx
"]" , key64
);
973 num_to_bytes ( key64
, 6 , foundKey
[ t
][ i
]);
974 validKey
[ t
][ i
] = true ;
977 PrintAndLog ( "Command execute timeout" );
980 b
< 127 ?( b
+= 4 ):( b
+= 16 );
986 for ( uint16_t sectorNo
= 0 ; sectorNo
< SectorsCnt
; sectorNo
++) {
987 if ( validKey
[ 0 ][ sectorNo
] || validKey
[ 1 ][ sectorNo
]) {
988 mfEmlGetMem ( block
, FirstBlockOfSector ( sectorNo
) + NumBlocksPerSector ( sectorNo
) - 1 , 1 );
989 for ( uint16_t t
= 0 ; t
< 2 ; t
++) {
990 if ( validKey
[ t
][ sectorNo
]) {
991 memcpy ( block
+ t
* 10 , foundKey
[ t
][ sectorNo
], 6 );
994 mfEmlSetMem ( block
, FirstBlockOfSector ( sectorNo
) + NumBlocksPerSector ( sectorNo
) - 1 , 1 );
997 PrintAndLog ( "Found keys have been transferred to the emulator memory" );
1000 if ( createDumpFile
) {
1001 FILE * fkeys
= fopen ( "dumpkeys.bin" , "wb" );
1002 if ( fkeys
== NULL
) {
1003 PrintAndLog ( "Could not create file dumpkeys.bin" );
1007 for ( uint16_t t
= 0 ; t
< 2 ; t
++) {
1008 fwrite ( foundKey
[ t
], 1 , 6 * SectorsCnt
, fkeys
);
1011 PrintAndLog ( "Found keys have been dumped to file dumpkeys.bin. 0xffffffffffff has been inserted for unknown keys." );
1019 void readerAttack ( nonces_t ar_resp
[], bool setEmulatorMem
) {
1020 #define ATTACK_KEY_COUNT 8 // keep same as define in iso14443a.c -> Mifare1ksim()
1026 st_t sector_trailer
[ ATTACK_KEY_COUNT
];
1027 memset ( sector_trailer
, 0x00 , sizeof ( sector_trailer
));
1029 uint8_t stSector
[ ATTACK_KEY_COUNT
];
1030 memset ( stSector
, 0x00 , sizeof ( stSector
));
1031 uint8_t key_cnt
[ ATTACK_KEY_COUNT
];
1032 memset ( key_cnt
, 0x00 , sizeof ( key_cnt
));
1034 for ( uint8_t i
= 0 ; i
< ATTACK_KEY_COUNT
; i
++) {
1035 if ( ar_resp
[ i
]. ar2
> 0 ) {
1036 //PrintAndLog("DEBUG: Trying sector %d, cuid %08x, nt %08x, ar %08x, nr %08x, ar2 %08x, nr2 %08x",ar_resp[i].sector, ar_resp[i].cuid,ar_resp[i].nonce,ar_resp[i].ar,ar_resp[i].nr,ar_resp[i].ar2,ar_resp[i].nr2);
1037 if ( mfkey32 ( ar_resp
[ i
], & key
)) {
1038 PrintAndLog ( " Found Key%s for sector %02d: [%04x%08x]" , ( ar_resp
[ i
]. keytype
) ? "B" : "A" , ar_resp
[ i
]. sector
, ( uint32_t ) ( key
>> 32 ), ( uint32_t ) ( key
& 0xFFFFFFFF ));
1040 for ( uint8_t ii
= 0 ; ii
< ATTACK_KEY_COUNT
; ii
++) {
1041 if ( key_cnt
[ ii
]== 0 || stSector
[ ii
]== ar_resp
[ i
]. sector
) {
1042 if ( ar_resp
[ i
]. keytype
== 0 ) {
1044 sector_trailer
[ ii
]. keyA
= key
;
1045 stSector
[ ii
] = ar_resp
[ i
]. sector
;
1050 sector_trailer
[ ii
]. keyB
= key
;
1051 stSector
[ ii
] = ar_resp
[ i
]. sector
;
1060 //set emulator memory for keys
1061 if ( setEmulatorMem
) {
1062 for ( uint8_t i
= 0 ; i
< ATTACK_KEY_COUNT
; i
++) {
1064 uint8_t memBlock
[ 16 ];
1065 memset ( memBlock
, 0x00 , sizeof ( memBlock
));
1067 memset ( cmd1
, 0x00 , sizeof ( cmd1
));
1068 snprintf ( cmd1
, sizeof ( cmd1
), "%04x%08xFF078069%04x%08x" ,( uint32_t ) ( sector_trailer
[ i
]. keyA
>> 32 ), ( uint32_t ) ( sector_trailer
[ i
]. keyA
& 0xFFFFFFFF ),( uint32_t ) ( sector_trailer
[ i
]. keyB
>> 32 ), ( uint32_t ) ( sector_trailer
[ i
]. keyB
& 0xFFFFFFFF ));
1069 PrintAndLog ( "Setting Emulator Memory Block %02d: [%s]" , stSector
[ i
]* 4 + 3 , cmd1
);
1070 if ( param_gethex ( cmd1
, 0 , memBlock
, 32 )) {
1071 PrintAndLog ( "block data must include 32 HEX symbols" );
1075 UsbCommand c
= { CMD_MIFARE_EML_MEMSET
, {( stSector
[ i
]* 4 + 3 ), 1 , 0 }};
1076 memcpy ( c
. d
. asBytes
, memBlock
, 16 );
1077 clearCommandBuffer ();
1083 for ( uint8_t i
= ATTACK_KEY_COUNT
; i
< ATTACK_KEY_COUNT
* 2 ; i
++) {
1084 if ( ar_resp
[ i
]. ar2
> 0 ) {
1085 if ( tryMfk32_moebius ( ar_resp
[ i
], & key
)) {
1086 PrintAndLog ( "M-Found Key%s for sector %02d: [%04x%08x]" , ( ar_resp
[ i
]. keytype
) ? "B" : "A" , ar_resp
[ i
]. sector
, ( uint32_t ) ( key
>> 32 ), ( uint32_t ) ( key
& 0xFFFFFFFF ));
1092 int usage_hf14_mf1ksim ( void ) {
1093 PrintAndLog ( "Usage: hf mf sim h u <uid (8, 14, or 20 hex symbols)> n <numreads> i x" );
1094 PrintAndLog ( "options:" );
1095 PrintAndLog ( " h this help" );
1096 PrintAndLog ( " u (Optional) UID 4,7 or 10 bytes. If not specified, the UID 4B from emulator memory will be used" );
1097 PrintAndLog ( " n (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite" );
1098 PrintAndLog ( " i (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted" );
1099 PrintAndLog ( " x (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)" );
1100 PrintAndLog ( " e (Optional) set keys found from 'reader attack' to emulator memory (implies x and i)" );
1101 PrintAndLog ( " f (Optional) get UIDs to use for 'reader attack' from file 'f <filename.txt>' (implies x and i)" );
1102 PrintAndLog ( "samples:" );
1103 PrintAndLog ( " hf mf sim u 0a0a0a0a" );
1104 PrintAndLog ( " hf mf sim u 11223344556677" );
1105 PrintAndLog ( " hf mf sim u 112233445566778899AA" );
1106 PrintAndLog ( " hf mf sim f uids.txt" );
1107 PrintAndLog ( " hf mf sim u 0a0a0a0a e" );
1112 int CmdHF14AMf1kSim ( const char * Cmd
) {
1114 uint8_t uid
[ 10 ] = { 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 };
1115 uint8_t exitAfterNReads
= 0 ;
1119 bool setEmulatorMem
= false ;
1120 bool attackFromFile
= false ;
1122 char filename
[ FILE_PATH_SIZE
];
1123 memset ( filename
, 0x00 , sizeof ( filename
));
1128 bool errors
= false ;
1130 while ( param_getchar ( Cmd
, cmdp
) != 0x00 ) {
1131 switch ( param_getchar ( Cmd
, cmdp
)) {
1134 setEmulatorMem
= true ;
1136 flags
|= FLAG_INTERACTIVE
;
1137 flags
|= FLAG_NR_AR_ATTACK
;
1142 len
= param_getstr ( Cmd
, cmdp
+ 1 , filename
);
1144 PrintAndLog ( "error no filename found" );
1147 attackFromFile
= true ;
1149 flags
|= FLAG_INTERACTIVE
;
1150 flags
|= FLAG_NR_AR_ATTACK
;
1155 return usage_hf14_mf1ksim ();
1158 flags
|= FLAG_INTERACTIVE
;
1163 exitAfterNReads
= param_get8 ( Cmd
, pnr
+ 1 );
1168 param_gethex_ex ( Cmd
, cmdp
+ 1 , uid
, & uidlen
);
1170 case 20 : flags
= FLAG_10B_UID_IN_DATA
; break ; //not complete
1171 case 14 : flags
= FLAG_7B_UID_IN_DATA
; break ;
1172 case 8 : flags
= FLAG_4B_UID_IN_DATA
; break ;
1173 default : return usage_hf14_mf1ksim ();
1179 flags
|= FLAG_NR_AR_ATTACK
;
1183 PrintAndLog ( "Unknown parameter '%c'" , param_getchar ( Cmd
, cmdp
));
1190 if ( errors
) return usage_hf14_mf1ksim ();
1193 if ( attackFromFile
) {
1196 f
= fopen ( filename
, "r" );
1198 PrintAndLog ( "File %s not found or locked" , filename
);
1201 PrintAndLog ( "Loading file and simulating. Press keyboard to abort" );
1202 while (! feof ( f
) && ! ukbhit ()){
1203 memset ( buf
, 0 , sizeof ( buf
));
1204 memset ( uid
, 0 , sizeof ( uid
));
1206 if ( fgets ( buf
, sizeof ( buf
), f
) == NULL
) {
1207 if ( count
> 0 ) break ;
1209 PrintAndLog ( "File reading error." );
1213 if (! strlen ( buf
) && feof ( f
)) break ;
1215 uidlen
= strlen ( buf
)- 1 ;
1217 case 20 : flags
|= FLAG_10B_UID_IN_DATA
; break ; //not complete
1218 case 14 : flags
|= FLAG_7B_UID_IN_DATA
; break ;
1219 case 8 : flags
|= FLAG_4B_UID_IN_DATA
; break ;
1221 PrintAndLog ( "uid in file wrong length at %d (length: %d) [%s]" , count
, uidlen
, buf
);
1226 for ( uint8_t i
= 0 ; i
< uidlen
; i
+= 2 ) {
1227 sscanf (& buf
[ i
], "%02x" , ( unsigned int *)& uid
[ i
/ 2 ]);
1230 PrintAndLog ( "mf 1k sim uid: %s, numreads:%d, flags:%d (0x%02x) - press button to abort" ,
1231 flags
& FLAG_4B_UID_IN_DATA
? sprint_hex ( uid
, 4 ):
1232 flags
& FLAG_7B_UID_IN_DATA
? sprint_hex ( uid
, 7 ):
1233 flags
& FLAG_10B_UID_IN_DATA
? sprint_hex ( uid
, 10 ): "N/A"
1234 , exitAfterNReads
, flags
, flags
);
1236 UsbCommand c
= { CMD_SIMULATE_MIFARE_CARD
, { flags
, exitAfterNReads
, 0 }};
1237 memcpy ( c
. d
. asBytes
, uid
, sizeof ( uid
));
1238 clearCommandBuffer ();
1241 while (! WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
1242 //We're waiting only 1.5 s at a time, otherwise we get the
1243 // annoying message about "Waiting for a response... "
1246 nonces_t ar_resp
[ ATTACK_KEY_COUNT
* 2 ];
1247 memcpy ( ar_resp
, resp
. d
. asBytes
, sizeof ( ar_resp
));
1248 readerAttack ( ar_resp
, setEmulatorMem
);
1249 if (( bool ) resp
. arg
[ 1 ]) {
1250 PrintAndLog ( "Device button pressed - quitting" );
1257 } else { //not from file
1259 PrintAndLog ( "mf 1k sim uid: %s, numreads:%d, flags:%d (0x%02x) " ,
1260 flags
& FLAG_4B_UID_IN_DATA
? sprint_hex ( uid
, 4 ):
1261 flags
& FLAG_7B_UID_IN_DATA
? sprint_hex ( uid
, 7 ):
1262 flags
& FLAG_10B_UID_IN_DATA
? sprint_hex ( uid
, 10 ): "N/A"
1263 , exitAfterNReads
, flags
, flags
);
1265 UsbCommand c
= { CMD_SIMULATE_MIFARE_CARD
, { flags
, exitAfterNReads
, 0 }};
1266 memcpy ( c
. d
. asBytes
, uid
, sizeof ( uid
));
1267 clearCommandBuffer ();
1270 if ( flags
& FLAG_INTERACTIVE
) {
1271 PrintAndLog ( "Press pm3-button to abort simulation" );
1272 while (! WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
1273 //We're waiting only 1.5 s at a time, otherwise we get the
1274 // annoying message about "Waiting for a response... "
1277 if ( flags
& FLAG_NR_AR_ATTACK
) {
1278 nonces_t ar_resp
[ ATTACK_KEY_COUNT
* 2 ];
1279 memcpy ( ar_resp
, resp
. d
. asBytes
, sizeof ( ar_resp
));
1280 readerAttack ( ar_resp
, setEmulatorMem
);
1288 int CmdHF14AMfDbg ( const char * Cmd
)
1290 int dbgMode
= param_get32ex ( Cmd
, 0 , 0 , 10 );
1292 PrintAndLog ( "Max debug mode parameter is 4 \n " );
1295 if ( strlen ( Cmd
) < 1 || ! param_getchar ( Cmd
, 0 ) || dbgMode
> 4 ) {
1296 PrintAndLog ( "Usage: hf mf dbg <debug level>" );
1297 PrintAndLog ( " 0 - no debug messages" );
1298 PrintAndLog ( " 1 - error messages" );
1299 PrintAndLog ( " 2 - plus information messages" );
1300 PrintAndLog ( " 3 - plus debug messages" );
1301 PrintAndLog ( " 4 - print even debug messages in timing critical functions" );
1302 PrintAndLog ( " Note: this option therefore may cause malfunction itself" );
1306 UsbCommand c
= { CMD_MIFARE_SET_DBGMODE
, { dbgMode
, 0 , 0 }};
1312 int CmdHF14AMfEGet ( const char * Cmd
)
1314 uint8_t blockNo
= 0 ;
1315 uint8_t data
[ 16 ] = { 0x00 };
1317 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1318 PrintAndLog ( "Usage: hf mf eget <block number>" );
1319 PrintAndLog ( " sample: hf mf eget 0 " );
1323 blockNo
= param_get8 ( Cmd
, 0 );
1326 if (! mfEmlGetMem ( data
, blockNo
, 1 )) {
1327 PrintAndLog ( "data[%3d]:%s" , blockNo
, sprint_hex ( data
, 16 ));
1329 PrintAndLog ( "Command execute timeout" );
1335 int CmdHF14AMfEClear ( const char * Cmd
)
1337 if ( param_getchar ( Cmd
, 0 ) == 'h' ) {
1338 PrintAndLog ( "Usage: hf mf eclr" );
1339 PrintAndLog ( "It set card emulator memory to empty data blocks and key A/B FFFFFFFFFFFF \n " );
1343 UsbCommand c
= { CMD_MIFARE_EML_MEMCLR
, { 0 , 0 , 0 }};
1349 int CmdHF14AMfESet ( const char * Cmd
)
1351 uint8_t memBlock
[ 16 ];
1352 uint8_t blockNo
= 0 ;
1354 memset ( memBlock
, 0x00 , sizeof ( memBlock
));
1356 if ( strlen ( Cmd
) < 3 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1357 PrintAndLog ( "Usage: hf mf eset <block number> <block data (32 hex symbols)>" );
1358 PrintAndLog ( " sample: hf mf eset 1 000102030405060708090a0b0c0d0e0f " );
1362 blockNo
= param_get8 ( Cmd
, 0 );
1364 if ( param_gethex ( Cmd
, 1 , memBlock
, 32 )) {
1365 PrintAndLog ( "block data must include 32 HEX symbols" );
1370 UsbCommand c
= { CMD_MIFARE_EML_MEMSET
, { blockNo
, 1 , 0 }};
1371 memcpy ( c
. d
. asBytes
, memBlock
, 16 );
1377 int CmdHF14AMfELoad ( const char * Cmd
)
1380 char filename
[ FILE_PATH_SIZE
];
1381 char * fnameptr
= filename
;
1382 char buf
[ 64 ] = { 0x00 };
1383 uint8_t buf8
[ 64 ] = { 0x00 };
1384 int i
, len
, blockNum
, numBlocks
;
1385 int nameParamNo
= 1 ;
1387 char ctmp
= param_getchar ( Cmd
, 0 );
1389 if ( ctmp
== 'h' || ctmp
== 0x00 ) {
1390 PrintAndLog ( "It loads emul dump from the file `filename.eml`" );
1391 PrintAndLog ( "Usage: hf mf eload [card memory] <file name w/o `.eml`>" );
1392 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1394 PrintAndLog ( " sample: hf mf eload filename" );
1395 PrintAndLog ( " hf mf eload 4 filename" );
1400 case '0' : numBlocks
= 5 * 4 ; break ;
1402 case '\0' : numBlocks
= 16 * 4 ; break ;
1403 case '2' : numBlocks
= 32 * 4 ; break ;
1404 case '4' : numBlocks
= 256 ; break ;
1411 len
= param_getstr ( Cmd
, nameParamNo
, filename
);
1413 if ( len
> FILE_PATH_SIZE
- 4 ) len
= FILE_PATH_SIZE
- 4 ;
1417 sprintf ( fnameptr
, ".eml" );
1420 f
= fopen ( filename
, "r" );
1422 PrintAndLog ( "File %s not found or locked" , filename
);
1428 memset ( buf
, 0 , sizeof ( buf
));
1430 if ( fgets ( buf
, sizeof ( buf
), f
) == NULL
) {
1432 if ( blockNum
>= numBlocks
) break ;
1434 PrintAndLog ( "File reading error." );
1439 if ( strlen ( buf
) < 32 ){
1440 if ( strlen ( buf
) && feof ( f
))
1442 PrintAndLog ( "File content error. Block data must include 32 HEX symbols" );
1447 for ( i
= 0 ; i
< 32 ; i
+= 2 ) {
1448 sscanf (& buf
[ i
], "%02x" , ( unsigned int *)& buf8
[ i
/ 2 ]);
1451 if ( mfEmlSetMem ( buf8
, blockNum
, 1 )) {
1452 PrintAndLog ( "Cant set emul block: %3d" , blockNum
);
1459 if ( blockNum
>= numBlocks
) break ;
1464 if (( blockNum
!= numBlocks
)) {
1465 PrintAndLog ( "File content error. Got %d must be %d blocks." , blockNum
, numBlocks
);
1468 PrintAndLog ( "Loaded %d blocks from file: %s" , blockNum
, filename
);
1473 int CmdHF14AMfESave ( const char * Cmd
)
1476 char filename
[ FILE_PATH_SIZE
];
1477 char * fnameptr
= filename
;
1479 int i
, j
, len
, numBlocks
;
1480 int nameParamNo
= 1 ;
1482 memset ( filename
, 0 , sizeof ( filename
));
1483 memset ( buf
, 0 , sizeof ( buf
));
1485 char ctmp
= param_getchar ( Cmd
, 0 );
1487 if ( ctmp
== 'h' || ctmp
== 'H' ) {
1488 PrintAndLog ( "It saves emul dump into the file `filename.eml` or `cardID.eml`" );
1489 PrintAndLog ( " Usage: hf mf esave [card memory] [file name w/o `.eml`]" );
1490 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1492 PrintAndLog ( " sample: hf mf esave " );
1493 PrintAndLog ( " hf mf esave 4" );
1494 PrintAndLog ( " hf mf esave 4 filename" );
1499 case '0' : numBlocks
= 5 * 4 ; break ;
1501 case '\0' : numBlocks
= 16 * 4 ; break ;
1502 case '2' : numBlocks
= 32 * 4 ; break ;
1503 case '4' : numBlocks
= 256 ; break ;
1510 len
= param_getstr ( Cmd
, nameParamNo
, filename
);
1512 if ( len
> FILE_PATH_SIZE
- 4 ) len
= FILE_PATH_SIZE
- 4 ;
1514 // user supplied filename?
1516 // get filename (UID from memory)
1517 if ( mfEmlGetMem ( buf
, 0 , 1 )) {
1518 PrintAndLog ( "Can \' t get UID from block: %d" , 0 );
1519 len
= sprintf ( fnameptr
, "dump" );
1523 for ( j
= 0 ; j
< 7 ; j
++, fnameptr
+= 2 )
1524 sprintf ( fnameptr
, "%02X" , buf
[ j
]);
1530 // add file extension
1531 sprintf ( fnameptr
, ".eml" );
1534 f
= fopen ( filename
, "w+" );
1537 PrintAndLog ( "Can't open file %s " , filename
);
1542 for ( i
= 0 ; i
< numBlocks
; i
++) {
1543 if ( mfEmlGetMem ( buf
, i
, 1 )) {
1544 PrintAndLog ( "Cant get block: %d" , i
);
1547 for ( j
= 0 ; j
< 16 ; j
++)
1548 fprintf ( f
, "%02X" , buf
[ j
]);
1553 PrintAndLog ( "Saved %d blocks to file: %s" , numBlocks
, filename
);
1559 int CmdHF14AMfECFill ( const char * Cmd
)
1561 uint8_t keyType
= 0 ;
1562 uint8_t numSectors
= 16 ;
1564 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1565 PrintAndLog ( "Usage: hf mf ecfill <key A/B> [card memory]" );
1566 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1568 PrintAndLog ( "samples: hf mf ecfill A" );
1569 PrintAndLog ( " hf mf ecfill A 4" );
1570 PrintAndLog ( "Read card and transfer its data to emulator memory." );
1571 PrintAndLog ( "Keys must be laid in the emulator memory. \n " );
1575 char ctmp
= param_getchar ( Cmd
, 0 );
1576 if ( ctmp
!= 'a' && ctmp
!= 'A' && ctmp
!= 'b' && ctmp
!= 'B' ) {
1577 PrintAndLog ( "Key type must be A or B" );
1580 if ( ctmp
!= 'A' && ctmp
!= 'a' ) keyType
= 1 ;
1582 ctmp
= param_getchar ( Cmd
, 1 );
1584 case '0' : numSectors
= 5 ; break ;
1586 case '\0' : numSectors
= 16 ; break ;
1587 case '2' : numSectors
= 32 ; break ;
1588 case '4' : numSectors
= 40 ; break ;
1589 default : numSectors
= 16 ;
1592 printf ( "--params: numSectors: %d, keyType:%d" , numSectors
, keyType
);
1593 UsbCommand c
= { CMD_MIFARE_EML_CARDLOAD
, { numSectors
, keyType
, 0 }};
1599 int CmdHF14AMfEKeyPrn ( const char * Cmd
)
1604 uint64_t keyA
, keyB
;
1606 if ( param_getchar ( Cmd
, 0 ) == 'h' ) {
1607 PrintAndLog ( "It prints the keys loaded in the emulator memory" );
1608 PrintAndLog ( "Usage: hf mf ekeyprn [card memory]" );
1609 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1611 PrintAndLog ( " sample: hf mf ekeyprn 1" );
1615 char cmdp
= param_getchar ( Cmd
, 0 );
1618 case '0' : numSectors
= 5 ; break ;
1620 case '\0' : numSectors
= 16 ; break ;
1621 case '2' : numSectors
= 32 ; break ;
1622 case '4' : numSectors
= 40 ; break ;
1623 default : numSectors
= 16 ;
1626 PrintAndLog ( "|---|----------------|----------------|" );
1627 PrintAndLog ( "|sec|key A |key B |" );
1628 PrintAndLog ( "|---|----------------|----------------|" );
1629 for ( i
= 0 ; i
< numSectors
; i
++) {
1630 if ( mfEmlGetMem ( data
, FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 , 1 )) {
1631 PrintAndLog ( "error get block %d" , FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 );
1634 keyA
= bytes_to_num ( data
, 6 );
1635 keyB
= bytes_to_num ( data
+ 10 , 6 );
1636 PrintAndLog ( "|%03d| %012" llx
" | %012" llx
" |" , i
, keyA
, keyB
);
1638 PrintAndLog ( "|---|----------------|----------------|" );
1644 int CmdHF14AMfCSetUID ( const char * Cmd
)
1646 uint8_t wipeCard
= 0 ;
1647 uint8_t uid
[ 8 ] = { 0x00 };
1648 uint8_t oldUid
[ 8 ] = { 0x00 };
1649 uint8_t atqa
[ 2 ] = { 0x00 };
1650 uint8_t sak
[ 1 ] = { 0x00 };
1651 uint8_t atqaPresent
= 1 ;
1656 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, argi
) == 'h' ) {
1657 PrintAndLog ( "Usage: hf mf csetuid <UID 8 hex symbols> [ATQA 4 hex symbols SAK 2 hex symbols] [w]" );
1658 PrintAndLog ( "sample: hf mf csetuid 01020304" );
1659 PrintAndLog ( "sample: hf mf csetuid 01020304 0004 08 w" );
1660 PrintAndLog ( "Set UID, ATQA, and SAK for magic Chinese card (only works with such cards)" );
1661 PrintAndLog ( "If you also want to wipe the card then add 'w' at the end of the command line." );
1665 if ( param_getchar ( Cmd
, argi
) && param_gethex ( Cmd
, argi
, uid
, 8 )) {
1666 PrintAndLog ( "UID must include 8 HEX symbols" );
1671 ctmp
= param_getchar ( Cmd
, argi
);
1672 if ( ctmp
== 'w' || ctmp
== 'W' ) {
1678 if ( param_getchar ( Cmd
, argi
)) {
1679 if ( param_gethex ( Cmd
, argi
, atqa
, 4 )) {
1680 PrintAndLog ( "ATQA must include 4 HEX symbols" );
1684 if (! param_getchar ( Cmd
, argi
) || param_gethex ( Cmd
, argi
, sak
, 2 )) {
1685 PrintAndLog ( "SAK must include 2 HEX symbols" );
1694 ctmp
= param_getchar ( Cmd
, argi
);
1695 if ( ctmp
== 'w' || ctmp
== 'W' ) {
1700 PrintAndLog ( "--wipe card:%s uid:%s" , ( wipeCard
)? "YES" : "NO" , sprint_hex ( uid
, 4 ));
1702 res
= mfCSetUID ( uid
, ( atqaPresent
)? atqa
: NULL
, ( atqaPresent
)? sak
: NULL
, oldUid
, wipeCard
);
1704 PrintAndLog ( "Can't set UID. error=%d" , res
);
1708 PrintAndLog ( "old UID:%s" , sprint_hex ( oldUid
, 4 ));
1709 PrintAndLog ( "new UID:%s" , sprint_hex ( uid
, 4 ));
1713 int CmdHF14AMfCSetBlk ( const char * Cmd
)
1715 uint8_t memBlock
[ 16 ] = { 0x00 };
1716 uint8_t blockNo
= 0 ;
1717 bool wipeCard
= FALSE
;
1720 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1721 PrintAndLog ( "Usage: hf mf csetblk <block number> <block data (32 hex symbols)> [w]" );
1722 PrintAndLog ( "sample: hf mf csetblk 1 01020304050607080910111213141516" );
1723 PrintAndLog ( "Set block data for magic Chinese card (only works with such cards)" );
1724 PrintAndLog ( "If you also want wipe the card then add 'w' at the end of the command line" );
1728 blockNo
= param_get8 ( Cmd
, 0 );
1730 if ( param_gethex ( Cmd
, 1 , memBlock
, 32 )) {
1731 PrintAndLog ( "block data must include 32 HEX symbols" );
1735 char ctmp
= param_getchar ( Cmd
, 2 );
1736 wipeCard
= ( ctmp
== 'w' || ctmp
== 'W' );
1737 PrintAndLog ( "--block number:%2d data:%s" , blockNo
, sprint_hex ( memBlock
, 16 ));
1739 res
= mfCSetBlock ( blockNo
, memBlock
, NULL
, wipeCard
, CSETBLOCK_SINGLE_OPER
);
1741 PrintAndLog ( "Can't write block. error=%d" , res
);
1748 int CmdHF14AMfCLoad ( const char * Cmd
)
1751 char filename
[ FILE_PATH_SIZE
] = { 0x00 };
1752 char * fnameptr
= filename
;
1753 char buf
[ 64 ] = { 0x00 };
1754 uint8_t buf8
[ 64 ] = { 0x00 };
1755 uint8_t fillFromEmulator
= 0 ;
1756 int i
, len
, blockNum
, flags
= 0 ;
1758 if ( param_getchar ( Cmd
, 0 ) == 'h' || param_getchar ( Cmd
, 0 )== 0x00 ) {
1759 PrintAndLog ( "It loads magic Chinese card from the file `filename.eml`" );
1760 PrintAndLog ( "or from emulator memory (option `e`)" );
1761 PrintAndLog ( "Usage: hf mf cload <file name w/o `.eml`>" );
1762 PrintAndLog ( " or: hf mf cload e " );
1763 PrintAndLog ( " sample: hf mf cload filename" );
1767 char ctmp
= param_getchar ( Cmd
, 0 );
1768 if ( ctmp
== 'e' || ctmp
== 'E' ) fillFromEmulator
= 1 ;
1770 if ( fillFromEmulator
) {
1771 for ( blockNum
= 0 ; blockNum
< 16 * 4 ; blockNum
+= 1 ) {
1772 if ( mfEmlGetMem ( buf8
, blockNum
, 1 )) {
1773 PrintAndLog ( "Cant get block: %d" , blockNum
);
1776 if ( blockNum
== 0 ) flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
; // switch on field and send magic sequence
1777 if ( blockNum
== 1 ) flags
= 0 ; // just write
1778 if ( blockNum
== 16 * 4 - 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
; // Done. Magic Halt and switch off field.
1780 if ( mfCSetBlock ( blockNum
, buf8
, NULL
, 0 , flags
)) {
1781 PrintAndLog ( "Cant set magic card block: %d" , blockNum
);
1788 if ( len
> FILE_PATH_SIZE
- 4 ) len
= FILE_PATH_SIZE
- 4 ;
1790 memcpy ( filename
, Cmd
, len
);
1793 sprintf ( fnameptr
, ".eml" );
1796 f
= fopen ( filename
, "r" );
1798 PrintAndLog ( "File not found or locked." );
1805 memset ( buf
, 0 , sizeof ( buf
));
1807 if ( fgets ( buf
, sizeof ( buf
), f
) == NULL
) {
1809 PrintAndLog ( "File reading error." );
1813 if ( strlen ( buf
) < 32 ) {
1814 if ( strlen ( buf
) && feof ( f
))
1816 PrintAndLog ( "File content error. Block data must include 32 HEX symbols" );
1820 for ( i
= 0 ; i
< 32 ; i
+= 2 )
1821 sscanf (& buf
[ i
], "%02x" , ( unsigned int *)& buf8
[ i
/ 2 ]);
1823 if ( blockNum
== 0 ) flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
; // switch on field and send magic sequence
1824 if ( blockNum
== 1 ) flags
= 0 ; // just write
1825 if ( blockNum
== 16 * 4 - 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
; // Done. Switch off field.
1827 if ( mfCSetBlock ( blockNum
, buf8
, NULL
, 0 , flags
)) {
1828 PrintAndLog ( "Can't set magic card block: %d" , blockNum
);
1833 if ( blockNum
>= 16 * 4 ) break ; // magic card type - mifare 1K
1837 if ( blockNum
!= 16 * 4 && blockNum
!= 32 * 4 + 8 * 16 ){
1838 PrintAndLog ( "File content error. There must be 64 blocks" );
1841 PrintAndLog ( "Loaded from file: %s" , filename
);
1847 int CmdHF14AMfCGetBlk ( const char * Cmd
) {
1848 uint8_t memBlock
[ 16 ];
1849 uint8_t blockNo
= 0 ;
1851 memset ( memBlock
, 0x00 , sizeof ( memBlock
));
1853 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1854 PrintAndLog ( "Usage: hf mf cgetblk <block number>" );
1855 PrintAndLog ( "sample: hf mf cgetblk 1" );
1856 PrintAndLog ( "Get block data from magic Chinese card (only works with such cards) \n " );
1860 blockNo
= param_get8 ( Cmd
, 0 );
1862 PrintAndLog ( "--block number:%2d " , blockNo
);
1864 res
= mfCGetBlock ( blockNo
, memBlock
, CSETBLOCK_SINGLE_OPER
);
1866 PrintAndLog ( "Can't read block. error=%d" , res
);
1870 PrintAndLog ( "block data:%s" , sprint_hex ( memBlock
, 16 ));
1875 int CmdHF14AMfCGetSc ( const char * Cmd
) {
1876 uint8_t memBlock
[ 16 ] = { 0x00 };
1877 uint8_t sectorNo
= 0 ;
1880 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1881 PrintAndLog ( "Usage: hf mf cgetsc <sector number>" );
1882 PrintAndLog ( "sample: hf mf cgetsc 0" );
1883 PrintAndLog ( "Get sector data from magic Chinese card (only works with such cards) \n " );
1887 sectorNo
= param_get8 ( Cmd
, 0 );
1888 if ( sectorNo
> 15 ) {
1889 PrintAndLog ( "Sector number must be in [0..15] as in MIFARE classic." );
1893 PrintAndLog ( "--sector number:%d " , sectorNo
);
1895 flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
;
1896 for ( i
= 0 ; i
< 4 ; i
++) {
1897 if ( i
== 1 ) flags
= 0 ;
1898 if ( i
== 3 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
;
1900 res
= mfCGetBlock ( sectorNo
* 4 + i
, memBlock
, flags
);
1902 PrintAndLog ( "Can't read block. %d error=%d" , sectorNo
* 4 + i
, res
);
1906 PrintAndLog ( "block %3d data:%s" , sectorNo
* 4 + i
, sprint_hex ( memBlock
, 16 ));
1912 int CmdHF14AMfCSave ( const char * Cmd
) {
1915 char filename
[ FILE_PATH_SIZE
] = { 0x00 };
1916 char * fnameptr
= filename
;
1917 uint8_t fillFromEmulator
= 0 ;
1918 uint8_t buf
[ 64 ] = { 0x00 };
1919 int i
, j
, len
, flags
;
1921 // memset(filename, 0, sizeof(filename));
1922 // memset(buf, 0, sizeof(buf));
1924 if ( param_getchar ( Cmd
, 0 ) == 'h' ) {
1925 PrintAndLog ( "It saves `magic Chinese` card dump into the file `filename.eml` or `cardID.eml`" );
1926 PrintAndLog ( "or into emulator memory (option `e`)" );
1927 PrintAndLog ( "Usage: hf mf esave [file name w/o `.eml`][e]" );
1928 PrintAndLog ( " sample: hf mf esave " );
1929 PrintAndLog ( " hf mf esave filename" );
1930 PrintAndLog ( " hf mf esave e \n " );
1934 char ctmp
= param_getchar ( Cmd
, 0 );
1935 if ( ctmp
== 'e' || ctmp
== 'E' ) fillFromEmulator
= 1 ;
1937 if ( fillFromEmulator
) {
1938 // put into emulator
1939 flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
;
1940 for ( i
= 0 ; i
< 16 * 4 ; i
++) {
1941 if ( i
== 1 ) flags
= 0 ;
1942 if ( i
== 16 * 4 - 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
;
1944 if ( mfCGetBlock ( i
, buf
, flags
)) {
1945 PrintAndLog ( "Cant get block: %d" , i
);
1949 if ( mfEmlSetMem ( buf
, i
, 1 )) {
1950 PrintAndLog ( "Cant set emul block: %d" , i
);
1957 if ( len
> FILE_PATH_SIZE
- 4 ) len
= FILE_PATH_SIZE
- 4 ;
1961 if ( mfCGetBlock ( 0 , buf
, CSETBLOCK_SINGLE_OPER
)) {
1962 PrintAndLog ( "Cant get block: %d" , 0 );
1963 len
= sprintf ( fnameptr
, "dump" );
1967 for ( j
= 0 ; j
< 7 ; j
++, fnameptr
+= 2 )
1968 sprintf ( fnameptr
, "%02x" , buf
[ j
]);
1971 memcpy ( filename
, Cmd
, len
);
1975 sprintf ( fnameptr
, ".eml" );
1978 f
= fopen ( filename
, "w+" );
1981 PrintAndLog ( "File not found or locked." );
1986 flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
;
1987 for ( i
= 0 ; i
< 16 * 4 ; i
++) {
1988 if ( i
== 1 ) flags
= 0 ;
1989 if ( i
== 16 * 4 - 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
;
1991 if ( mfCGetBlock ( i
, buf
, flags
)) {
1992 PrintAndLog ( "Cant get block: %d" , i
);
1995 for ( j
= 0 ; j
< 16 ; j
++)
1996 fprintf ( f
, "%02x" , buf
[ j
]);
2001 PrintAndLog ( "Saved to file: %s" , filename
);
2008 int CmdHF14AMfSniff ( const char * Cmd
){
2010 bool wantLogToFile
= 0 ;
2011 bool wantDecrypt
= 0 ;
2012 //bool wantSaveToEml = 0; TODO
2013 bool wantSaveToEmlFile
= 0 ;
2023 uint8_t atqa
[ 2 ] = { 0x00 };
2026 uint8_t * buf
= NULL
;
2027 uint16_t bufsize
= 0 ;
2028 uint8_t * bufPtr
= NULL
;
2030 char ctmp
= param_getchar ( Cmd
, 0 );
2031 if ( ctmp
== 'h' || ctmp
== 'H' ) {
2032 PrintAndLog ( "It continuously gets data from the field and saves it to: log, emulator, emulator file." );
2033 PrintAndLog ( "You can specify:" );
2034 PrintAndLog ( " l - save encrypted sequence to logfile `uid.log`" );
2035 PrintAndLog ( " d - decrypt sequence and put it to log file `uid.log`" );
2036 PrintAndLog ( " n/a e - decrypt sequence, collect read and write commands and save the result of the sequence to emulator memory" );
2037 PrintAndLog ( " f - decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`" );
2038 PrintAndLog ( "Usage: hf mf sniff [l][d][e][f]" );
2039 PrintAndLog ( " sample: hf mf sniff l d e" );
2043 for ( int i
= 0 ; i
< 4 ; i
++) {
2044 ctmp
= param_getchar ( Cmd
, i
);
2045 if ( ctmp
== 'l' || ctmp
== 'L' ) wantLogToFile
= true ;
2046 if ( ctmp
== 'd' || ctmp
== 'D' ) wantDecrypt
= true ;
2047 //if (ctmp == 'e' || ctmp == 'E') wantSaveToEml = true; TODO
2048 if ( ctmp
== 'f' || ctmp
== 'F' ) wantSaveToEmlFile
= true ;
2051 printf ( "------------------------------------------------------------------------- \n " );
2052 printf ( "Executing command. \n " );
2053 printf ( "Press the key on the proxmark3 device to abort both proxmark3 and client. \n " );
2054 printf ( "Press the key on pc keyboard to abort the client. \n " );
2055 printf ( "------------------------------------------------------------------------- \n " );
2057 UsbCommand c
= { CMD_MIFARE_SNIFFER
, { 0 , 0 , 0 }};
2058 clearCommandBuffer ();
2067 printf ( " \n aborted via keyboard! \n " );
2072 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 2000 )) {
2073 res
= resp
. arg
[ 0 ] & 0xff ;
2074 uint16_t traceLen
= resp
. arg
[ 1 ];
2077 if ( res
== 0 ) return 0 ; // we are done
2079 if ( res
== 1 ) { // there is (more) data to be transferred
2080 if ( pckNum
== 0 ) { // first packet, (re)allocate necessary buffer
2081 if ( traceLen
> bufsize
) {
2083 if ( buf
== NULL
) { // not yet allocated
2084 p
= malloc ( traceLen
);
2085 } else { // need more memory
2086 p
= realloc ( buf
, traceLen
);
2089 PrintAndLog ( "Cannot allocate memory for trace" );
2097 memset ( buf
, 0x00 , traceLen
);
2099 memcpy ( bufPtr
, resp
. d
. asBytes
, len
);
2104 if ( res
== 2 ) { // received all data, start displaying
2105 blockLen
= bufPtr
- buf
;
2108 PrintAndLog ( "received trace len: %d packages: %d" , blockLen
, pckNum
);
2109 while ( bufPtr
- buf
< blockLen
) {
2110 bufPtr
+= 6 ; // skip (void) timing information
2111 len
= *(( uint16_t *) bufPtr
);
2119 if (( len
== 14 ) && ( bufPtr
[ 0 ] == 0xff ) && ( bufPtr
[ 1 ] == 0xff ) && ( bufPtr
[ 12 ] == 0xff ) && ( bufPtr
[ 13 ] == 0xff )) {
2120 memcpy ( uid
, bufPtr
+ 2 , 7 );
2121 memcpy ( atqa
, bufPtr
+ 2 + 7 , 2 );
2122 uid_len
= ( atqa
[ 0 ] & 0xC0 ) == 0x40 ? 7 : 4 ;
2124 PrintAndLog ( "tag select uid:%s atqa:0x%02x%02x sak:0x%02x" ,
2125 sprint_hex ( uid
+ ( 7 - uid_len
), uid_len
),
2129 if ( wantLogToFile
|| wantDecrypt
) {
2130 FillFileNameByUID ( logHexFileName
, uid
+ ( 7 - uid_len
), ".log" , uid_len
);
2131 AddLogCurrentDT ( logHexFileName
);
2134 mfTraceInit ( uid
, atqa
, sak
, wantSaveToEmlFile
);
2136 PrintAndLog ( "%s(%d):%s" , isTag
? "TAG" : "RDR" , num
, sprint_hex ( bufPtr
, len
));
2138 AddLogHex ( logHexFileName
, isTag
? "TAG: " : "RDR: " , bufPtr
, len
);
2140 mfTraceDecode ( bufPtr
, len
, wantSaveToEmlFile
);
2144 bufPtr
+= (( len
- 1 )/ 8 + 1 ); // ignore parity
2155 //needs nt, ar, at, Data to decrypt
2156 int CmdDecryptTraceCmds ( const char * Cmd
){
2159 param_gethex_ex ( Cmd
, 3 , data
,& len
);
2160 return tryDecryptWord ( param_get32ex ( Cmd
, 0 , 0 , 16 ), param_get32ex ( Cmd
, 1 , 0 , 16 ), param_get32ex ( Cmd
, 2 , 0 , 16 ), data
, len
/ 2 );
2163 static command_t CommandTable
[] =
2165 { "help" , CmdHelp
, 1 , "This help" },
2166 { "dbg" , CmdHF14AMfDbg
, 0 , "Set default debug mode" },
2167 { "rdbl" , CmdHF14AMfRdBl
, 0 , "Read MIFARE classic block" },
2168 { "rdsc" , CmdHF14AMfRdSc
, 0 , "Read MIFARE classic sector" },
2169 { "dump" , CmdHF14AMfDump
, 0 , "Dump MIFARE classic tag to binary file" },
2170 { "restore" , CmdHF14AMfRestore
, 0 , "Restore MIFARE classic binary file to BLANK tag" },
2171 { "wrbl" , CmdHF14AMfWrBl
, 0 , "Write MIFARE classic block" },
2172 { "chk" , CmdHF14AMfChk
, 0 , "Test block keys" },
2173 { "mifare" , CmdHF14AMifare
, 0 , "Read parity error messages." },
2174 { "nested" , CmdHF14AMfNested
, 0 , "Test nested authentication" },
2175 { "sniff" , CmdHF14AMfSniff
, 0 , "Sniff card-reader communication" },
2176 { "sim" , CmdHF14AMf1kSim
, 0 , "Simulate MIFARE card" },
2177 { "eclr" , CmdHF14AMfEClear
, 0 , "Clear simulator memory block" },
2178 { "eget" , CmdHF14AMfEGet
, 0 , "Get simulator memory block" },
2179 { "eset" , CmdHF14AMfESet
, 0 , "Set simulator memory block" },
2180 { "eload" , CmdHF14AMfELoad
, 0 , "Load from file emul dump" },
2181 { "esave" , CmdHF14AMfESave
, 0 , "Save to file emul dump" },
2182 { "ecfill" , CmdHF14AMfECFill
, 0 , "Fill simulator memory with help of keys from simulator" },
2183 { "ekeyprn" , CmdHF14AMfEKeyPrn
, 0 , "Print keys from simulator memory" },
2184 { "csetuid" , CmdHF14AMfCSetUID
, 0 , "Set UID for magic Chinese card" },
2185 { "csetblk" , CmdHF14AMfCSetBlk
, 0 , "Write block - Magic Chinese card" },
2186 { "cgetblk" , CmdHF14AMfCGetBlk
, 0 , "Read block - Magic Chinese card" },
2187 { "cgetsc" , CmdHF14AMfCGetSc
, 0 , "Read sector - Magic Chinese card" },
2188 { "cload" , CmdHF14AMfCLoad
, 0 , "Load dump into magic Chinese card" },
2189 { "csave" , CmdHF14AMfCSave
, 0 , "Save dump from magic Chinese card into file or emulator" },
2190 { "decrypt" , CmdDecryptTraceCmds
, 1 , "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace" },
2191 { NULL
, NULL
, 0 , NULL
}
2194 int CmdHFMF ( const char * Cmd
)
2197 WaitForResponseTimeout ( CMD_ACK
, NULL
, 100 );
2199 CmdsParse ( CommandTable
, Cmd
);
2203 int CmdHelp ( const char * Cmd
)
2205 CmdsHelp ( CommandTable
);