]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhfmf.c
eb3dc878f15adc79fcd3349d96ef00824b2e0916
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2011,2012 Merlok
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // High frequency MIFARE commands
9 //-----------------------------------------------------------------------------
14 #include "proxmark3.h"
18 #include "mifarehost.h"
20 #include "nonce2key/nonce2key.h"
22 #define NESTED_SECTOR_RETRY 10 // how often we try mfested() until we give up
25 static int CmdHelp ( const char * Cmd
);
27 int CmdHF14AMifare ( const char * Cmd
)
30 uint32_t nt
= 0 , nr
= 0 ;
31 uint64_t par_list
= 0 , ks_list
= 0 , r_key
= 0 ;
34 UsbCommand c
= { CMD_READER_MIFARE
, { true , 0 , 0 }};
37 printf ( "------------------------------------------------------------------------- \n " );
38 printf ( "Executing command. Expected execution time: 25sec on average :-) \n " );
39 printf ( "Press button on the proxmark3 device to abort both proxmark3 and client. \n " );
40 printf ( "------------------------------------------------------------------------- \n " );
49 int c
= getchar (); ( void ) c
;
58 printf ( " \n aborted via keyboard! \n " );
63 if ( WaitForResponseTimeout ( CMD_ACK
, & resp
, 1000 )) {
65 uid
= ( uint32_t ) bytes_to_num ( resp
. d
. asBytes
+ 0 , 4 );
66 nt
= ( uint32_t ) bytes_to_num ( resp
. d
. asBytes
+ 4 , 4 );
67 par_list
= bytes_to_num ( resp
. d
. asBytes
+ 8 , 8 );
68 ks_list
= bytes_to_num ( resp
. d
. asBytes
+ 16 , 8 );
69 nr
= bytes_to_num ( resp
. d
. asBytes
+ 24 , 4 );
72 case - 1 : PrintAndLog ( "Button pressed. Aborted. \n " ); break ;
73 case - 2 : PrintAndLog ( "Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests). \n " ); break ;
74 case - 3 : PrintAndLog ( "Card is not vulnerable to Darkside attack (its random number generator is not predictable). \n " ); break ;
75 case - 4 : PrintAndLog ( "Card is not vulnerable to Darkside attack (its random number generator seems to be based on the wellknown" );
76 PrintAndLog ( "generating polynomial with 16 effective bits only, but shows unexpected behaviour. \n " ); break ;
86 if ( isOK
!= 1 ) return 1 ;
88 // execute original function from util nonce2key
89 if ( nonce2key ( uid
, nt
, nr
, par_list
, ks_list
, & r_key
)) {
91 PrintAndLog ( "Key not found (lfsr_common_prefix list is null). Nt=%08x" , nt
);
92 PrintAndLog ( "Failing is expected to happen in 25%% of all cases. Trying again with a different reader nonce..." );
97 printf ( "------------------------------------------------------------------ \n " );
98 PrintAndLog ( "Found valid key:%012" PRIx64
" \n " , r_key
);
105 int CmdHF14AMfWrBl ( const char * Cmd
)
109 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
110 uint8_t bldata
[ 16 ] = { 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 };
115 PrintAndLog ( "Usage: hf mf wrbl <block number> <key A/B> <key (12 hex symbols)> <block data (32 hex symbols)>" );
116 PrintAndLog ( " sample: hf mf wrbl 0 A FFFFFFFFFFFF 000102030405060708090A0B0C0D0E0F" );
120 blockNo
= param_get8 ( Cmd
, 0 );
121 cmdp
= param_getchar ( Cmd
, 1 );
123 PrintAndLog ( "Key type must be A or B" );
126 if ( cmdp
!= 'A' && cmdp
!= 'a' ) keyType
= 1 ;
127 if ( param_gethex ( Cmd
, 2 , key
, 12 )) {
128 PrintAndLog ( "Key must include 12 HEX symbols" );
131 if ( param_gethex ( Cmd
, 3 , bldata
, 32 )) {
132 PrintAndLog ( "Block data must include 32 HEX symbols" );
135 PrintAndLog ( "--block no:%d, key type:%c, key:%s" , blockNo
, keyType
? 'B' : 'A' , sprint_hex ( key
, 6 ));
136 PrintAndLog ( "--data: %s" , sprint_hex ( bldata
, 16 ));
138 UsbCommand c
= { CMD_MIFARE_WRITEBL
, { blockNo
, keyType
, 0 }};
139 memcpy ( c
. d
. asBytes
, key
, 6 );
140 memcpy ( c
. d
. asBytes
+ 10 , bldata
, 16 );
144 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
145 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
146 PrintAndLog ( "isOk:%02x" , isOK
);
148 PrintAndLog ( "Command execute timeout" );
154 int CmdHF14AMfRdBl ( const char * Cmd
)
158 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
164 PrintAndLog ( "Usage: hf mf rdbl <block number> <key A/B> <key (12 hex symbols)>" );
165 PrintAndLog ( " sample: hf mf rdbl 0 A FFFFFFFFFFFF " );
169 blockNo
= param_get8 ( Cmd
, 0 );
170 cmdp
= param_getchar ( Cmd
, 1 );
172 PrintAndLog ( "Key type must be A or B" );
175 if ( cmdp
!= 'A' && cmdp
!= 'a' ) keyType
= 1 ;
176 if ( param_gethex ( Cmd
, 2 , key
, 12 )) {
177 PrintAndLog ( "Key must include 12 HEX symbols" );
180 PrintAndLog ( "--block no:%d, key type:%c, key:%s " , blockNo
, keyType
? 'B' : 'A' , sprint_hex ( key
, 6 ));
182 UsbCommand c
= { CMD_MIFARE_READBL
, { blockNo
, keyType
, 0 }};
183 memcpy ( c
. d
. asBytes
, key
, 6 );
187 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
188 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
189 uint8_t * data
= resp
. d
. asBytes
;
192 PrintAndLog ( "isOk:%02x data:%s" , isOK
, sprint_hex ( data
, 16 ));
194 PrintAndLog ( "isOk:%02x" , isOK
);
196 PrintAndLog ( "Command execute timeout" );
202 int CmdHF14AMfRdSc ( const char * Cmd
)
205 uint8_t sectorNo
= 0 ;
207 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
209 uint8_t * data
= NULL
;
213 PrintAndLog ( "Usage: hf mf rdsc <sector number> <key A/B> <key (12 hex symbols)>" );
214 PrintAndLog ( " sample: hf mf rdsc 0 A FFFFFFFFFFFF " );
218 sectorNo
= param_get8 ( Cmd
, 0 );
220 PrintAndLog ( "Sector number must be less than 40" );
223 cmdp
= param_getchar ( Cmd
, 1 );
224 if ( cmdp
!= 'a' && cmdp
!= 'A' && cmdp
!= 'b' && cmdp
!= 'B' ) {
225 PrintAndLog ( "Key type must be A or B" );
228 if ( cmdp
!= 'A' && cmdp
!= 'a' ) keyType
= 1 ;
229 if ( param_gethex ( Cmd
, 2 , key
, 12 )) {
230 PrintAndLog ( "Key must include 12 HEX symbols" );
233 PrintAndLog ( "--sector no:%d key type:%c key:%s " , sectorNo
, keyType
? 'B' : 'A' , sprint_hex ( key
, 6 ));
235 UsbCommand c
= { CMD_MIFARE_READSC
, { sectorNo
, keyType
, 0 }};
236 memcpy ( c
. d
. asBytes
, key
, 6 );
241 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
242 isOK
= resp
. arg
[ 0 ] & 0xff ;
243 data
= resp
. d
. asBytes
;
245 PrintAndLog ( "isOk:%02x" , isOK
);
247 for ( i
= 0 ; i
< ( sectorNo
< 32 ? 3 : 15 ); i
++) {
248 PrintAndLog ( "data : %s" , sprint_hex ( data
+ i
* 16 , 16 ));
250 PrintAndLog ( "trailer: %s" , sprint_hex ( data
+ ( sectorNo
< 32 ? 3 : 15 ) * 16 , 16 ));
253 PrintAndLog ( "Command execute timeout" );
259 uint8_t FirstBlockOfSector ( uint8_t sectorNo
)
264 return 32 * 4 + ( sectorNo
- 32 ) * 16 ;
268 uint8_t NumBlocksPerSector ( uint8_t sectorNo
)
277 int CmdHF14AMfDump ( const char * Cmd
)
279 uint8_t sectorNo
, blockNo
;
283 uint8_t rights
[ 40 ][ 4 ];
284 uint8_t carddata
[ 256 ][ 16 ];
285 uint8_t numSectors
= 16 ;
292 char cmdp
= param_getchar ( Cmd
, 0 );
294 case '0' : numSectors
= 5 ; break ;
296 case '\0' : numSectors
= 16 ; break ;
297 case '2' : numSectors
= 32 ; break ;
298 case '4' : numSectors
= 40 ; break ;
299 default : numSectors
= 16 ;
302 if ( strlen ( Cmd
) > 1 || cmdp
== 'h' || cmdp
== 'H' ) {
303 PrintAndLog ( "Usage: hf mf dump [card memory]" );
304 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
306 PrintAndLog ( "Samples: hf mf dump" );
307 PrintAndLog ( " hf mf dump 4" );
311 if (( fin
= fopen ( "dumpkeys.bin" , "rb" )) == NULL
) {
312 PrintAndLog ( "Could not find file dumpkeys.bin" );
316 // Read keys A from file
317 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
318 size_t bytes_read
= fread ( keyA
[ sectorNo
], 1 , 6 , fin
);
319 if ( bytes_read
!= 6 ) {
320 PrintAndLog ( "File reading error." );
326 // Read keys B from file
327 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
328 size_t bytes_read
= fread ( keyB
[ sectorNo
], 1 , 6 , fin
);
329 if ( bytes_read
!= 6 ) {
330 PrintAndLog ( "File reading error." );
338 PrintAndLog ( "|-----------------------------------------|" );
339 PrintAndLog ( "|------ Reading sector access bits...-----|" );
340 PrintAndLog ( "|-----------------------------------------|" );
342 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
343 for ( tries
= 0 ; tries
< 3 ; tries
++) {
344 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + NumBlocksPerSector ( sectorNo
) - 1 , 0 , 0 }};
345 memcpy ( c
. d
. asBytes
, keyA
[ sectorNo
], 6 );
348 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
349 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
350 uint8_t * data
= resp
. d
. asBytes
;
352 rights
[ sectorNo
][ 0 ] = (( data
[ 7 ] & 0x10 )>> 2 ) | (( data
[ 8 ] & 0x1 )<< 1 ) | (( data
[ 8 ] & 0x10 )>> 4 ); // C1C2C3 for data area 0
353 rights
[ sectorNo
][ 1 ] = (( data
[ 7 ] & 0x20 )>> 3 ) | (( data
[ 8 ] & 0x2 )<< 0 ) | (( data
[ 8 ] & 0x20 )>> 5 ); // C1C2C3 for data area 1
354 rights
[ sectorNo
][ 2 ] = (( data
[ 7 ] & 0x40 )>> 4 ) | (( data
[ 8 ] & 0x4 )>> 1 ) | (( data
[ 8 ] & 0x40 )>> 6 ); // C1C2C3 for data area 2
355 rights
[ sectorNo
][ 3 ] = (( data
[ 7 ] & 0x80 )>> 5 ) | (( data
[ 8 ] & 0x8 )>> 2 ) | (( data
[ 8 ] & 0x80 )>> 7 ); // C1C2C3 for sector trailer
357 } else if ( tries
== 2 ) { // on last try set defaults
358 PrintAndLog ( "Could not get access rights for sector %2d. Trying with defaults..." , sectorNo
);
359 rights
[ sectorNo
][ 0 ] = rights
[ sectorNo
][ 1 ] = rights
[ sectorNo
][ 2 ] = 0x00 ;
360 rights
[ sectorNo
][ 3 ] = 0x01 ;
363 PrintAndLog ( "Command execute timeout when trying to read access rights for sector %2d. Trying with defaults..." , sectorNo
);
364 rights
[ sectorNo
][ 0 ] = rights
[ sectorNo
][ 1 ] = rights
[ sectorNo
][ 2 ] = 0x00 ;
365 rights
[ sectorNo
][ 3 ] = 0x01 ;
370 PrintAndLog ( "|-----------------------------------------|" );
371 PrintAndLog ( "|----- Dumping all blocks to file... -----|" );
372 PrintAndLog ( "|-----------------------------------------|" );
375 for ( sectorNo
= 0 ; isOK
&& sectorNo
< numSectors
; sectorNo
++) {
376 for ( blockNo
= 0 ; isOK
&& blockNo
< NumBlocksPerSector ( sectorNo
); blockNo
++) {
377 bool received
= false ;
378 for ( tries
= 0 ; tries
< 3 ; tries
++) {
379 if ( blockNo
== NumBlocksPerSector ( sectorNo
) - 1 ) { // sector trailer. At least the Access Conditions can always be read with key A.
380 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, 0 , 0 }};
381 memcpy ( c
. d
. asBytes
, keyA
[ sectorNo
], 6 );
383 received
= WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 );
384 } else { // data block. Check if it can be read with key A or key B
385 uint8_t data_area
= sectorNo
< 32 ? blockNo
: blockNo
/ 5 ;
386 if (( rights
[ sectorNo
][ data_area
] == 0x03 ) || ( rights
[ sectorNo
][ data_area
] == 0x05 )) { // only key B would work
387 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, 1 , 0 }};
388 memcpy ( c
. d
. asBytes
, keyB
[ sectorNo
], 6 );
390 received
= WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 );
391 } else if ( rights
[ sectorNo
][ data_area
] == 0x07 ) { // no key would work
393 PrintAndLog ( "Access rights do not allow reading of sector %2d block %3d" , sectorNo
, blockNo
);
395 } else { // key A would work
396 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, 0 , 0 }};
397 memcpy ( c
. d
. asBytes
, keyA
[ sectorNo
], 6 );
399 received
= WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 );
403 isOK
= resp
. arg
[ 0 ] & 0xff ;
409 isOK
= resp
. arg
[ 0 ] & 0xff ;
410 uint8_t * data
= resp
. d
. asBytes
;
411 if ( blockNo
== NumBlocksPerSector ( sectorNo
) - 1 ) { // sector trailer. Fill in the keys.
412 data
[ 0 ] = ( keyA
[ sectorNo
][ 0 ]);
413 data
[ 1 ] = ( keyA
[ sectorNo
][ 1 ]);
414 data
[ 2 ] = ( keyA
[ sectorNo
][ 2 ]);
415 data
[ 3 ] = ( keyA
[ sectorNo
][ 3 ]);
416 data
[ 4 ] = ( keyA
[ sectorNo
][ 4 ]);
417 data
[ 5 ] = ( keyA
[ sectorNo
][ 5 ]);
418 data
[ 10 ] = ( keyB
[ sectorNo
][ 0 ]);
419 data
[ 11 ] = ( keyB
[ sectorNo
][ 1 ]);
420 data
[ 12 ] = ( keyB
[ sectorNo
][ 2 ]);
421 data
[ 13 ] = ( keyB
[ sectorNo
][ 3 ]);
422 data
[ 14 ] = ( keyB
[ sectorNo
][ 4 ]);
423 data
[ 15 ] = ( keyB
[ sectorNo
][ 5 ]);
426 memcpy ( carddata
[ FirstBlockOfSector ( sectorNo
) + blockNo
], data
, 16 );
427 PrintAndLog ( "Successfully read block %2d of sector %2d." , blockNo
, sectorNo
);
429 PrintAndLog ( "Could not read block %2d of sector %2d" , blockNo
, sectorNo
);
435 PrintAndLog ( "Command execute timeout when trying to read block %2d of sector %2d." , blockNo
, sectorNo
);
442 if (( fout
= fopen ( "dumpdata.bin" , "wb" )) == NULL
) {
443 PrintAndLog ( "Could not create file name dumpdata.bin" );
446 uint16_t numblocks
= FirstBlockOfSector ( numSectors
- 1 ) + NumBlocksPerSector ( numSectors
- 1 );
447 fwrite ( carddata
, 1 , 16 * numblocks
, fout
);
449 PrintAndLog ( "Dumped %d blocks (%d bytes) to file dumpdata.bin" , numblocks
, 16 * numblocks
);
455 int CmdHF14AMfRestore ( const char * Cmd
)
457 uint8_t sectorNo
, blockNo
;
459 uint8_t key
[ 6 ] = { 0xFF , 0xFF , 0xFF , 0xFF , 0xFF , 0xFF };
460 uint8_t bldata
[ 16 ] = { 0x00 };
468 char cmdp
= param_getchar ( Cmd
, 0 );
470 case '0' : numSectors
= 5 ; break ;
472 case '\0' : numSectors
= 16 ; break ;
473 case '2' : numSectors
= 32 ; break ;
474 case '4' : numSectors
= 40 ; break ;
475 default : numSectors
= 16 ;
478 if ( strlen ( Cmd
) > 1 || cmdp
== 'h' || cmdp
== 'H' ) {
479 PrintAndLog ( "Usage: hf mf restore [card memory]" );
480 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
482 PrintAndLog ( "Samples: hf mf restore" );
483 PrintAndLog ( " hf mf restore 4" );
487 if (( fkeys
= fopen ( "dumpkeys.bin" , "rb" )) == NULL
) {
488 PrintAndLog ( "Could not find file dumpkeys.bin" );
492 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
493 size_t bytes_read
= fread ( keyA
[ sectorNo
], 1 , 6 , fkeys
);
494 if ( bytes_read
!= 6 ) {
495 PrintAndLog ( "File reading error (dumpkeys.bin)." );
501 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
502 size_t bytes_read
= fread ( keyB
[ sectorNo
], 1 , 6 , fkeys
);
503 if ( bytes_read
!= 6 ) {
504 PrintAndLog ( "File reading error (dumpkeys.bin)." );
512 if (( fdump
= fopen ( "dumpdata.bin" , "rb" )) == NULL
) {
513 PrintAndLog ( "Could not find file dumpdata.bin" );
516 PrintAndLog ( "Restoring dumpdata.bin to card" );
518 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
519 for ( blockNo
= 0 ; blockNo
< NumBlocksPerSector ( sectorNo
); blockNo
++) {
520 UsbCommand c
= { CMD_MIFARE_WRITEBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, keyType
, 0 }};
521 memcpy ( c
. d
. asBytes
, key
, 6 );
523 size_t bytes_read
= fread ( bldata
, 1 , 16 , fdump
);
524 if ( bytes_read
!= 16 ) {
525 PrintAndLog ( "File reading error (dumpdata.bin)." );
530 if ( blockNo
== NumBlocksPerSector ( sectorNo
) - 1 ) { // sector trailer
531 bldata
[ 0 ] = ( keyA
[ sectorNo
][ 0 ]);
532 bldata
[ 1 ] = ( keyA
[ sectorNo
][ 1 ]);
533 bldata
[ 2 ] = ( keyA
[ sectorNo
][ 2 ]);
534 bldata
[ 3 ] = ( keyA
[ sectorNo
][ 3 ]);
535 bldata
[ 4 ] = ( keyA
[ sectorNo
][ 4 ]);
536 bldata
[ 5 ] = ( keyA
[ sectorNo
][ 5 ]);
537 bldata
[ 10 ] = ( keyB
[ sectorNo
][ 0 ]);
538 bldata
[ 11 ] = ( keyB
[ sectorNo
][ 1 ]);
539 bldata
[ 12 ] = ( keyB
[ sectorNo
][ 2 ]);
540 bldata
[ 13 ] = ( keyB
[ sectorNo
][ 3 ]);
541 bldata
[ 14 ] = ( keyB
[ sectorNo
][ 4 ]);
542 bldata
[ 15 ] = ( keyB
[ sectorNo
][ 5 ]);
545 PrintAndLog ( "Writing to block %3d: %s" , FirstBlockOfSector ( sectorNo
) + blockNo
, sprint_hex ( bldata
, 16 ));
547 memcpy ( c
. d
. asBytes
+ 10 , bldata
, 16 );
551 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
552 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
553 PrintAndLog ( "isOk:%02x" , isOK
);
555 PrintAndLog ( "Command execute timeout" );
571 int CmdHF14AMfNested ( const char * Cmd
)
573 int i
, j
, res
, iterations
;
574 sector_t
* e_sector
= NULL
;
577 uint8_t trgBlockNo
= 0 ;
578 uint8_t trgKeyType
= 0 ;
579 uint8_t SectorsCnt
= 0 ;
580 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
581 uint8_t keyBlock
[ 14 * 6 ];
583 bool transferToEml
= false ;
585 bool createDumpFile
= false ;
587 uint8_t standart
[ 6 ] = { 0xFF , 0xFF , 0xFF , 0xFF , 0xFF , 0xFF };
588 uint8_t tempkey
[ 6 ] = { 0xFF , 0xFF , 0xFF , 0xFF , 0xFF , 0xFF };
593 PrintAndLog ( "Usage:" );
594 PrintAndLog ( " all sectors: hf mf nested <card memory> <block number> <key A/B> <key (12 hex symbols)> [t,d]" );
595 PrintAndLog ( " one sector: hf mf nested o <block number> <key A/B> <key (12 hex symbols)>" );
596 PrintAndLog ( " <target block number> <target key A/B> [t]" );
597 PrintAndLog ( "card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K" );
598 PrintAndLog ( "t - transfer keys into emulator memory" );
599 PrintAndLog ( "d - write keys to binary file" );
601 PrintAndLog ( " sample1: hf mf nested 1 0 A FFFFFFFFFFFF " );
602 PrintAndLog ( " sample2: hf mf nested 1 0 A FFFFFFFFFFFF t " );
603 PrintAndLog ( " sample3: hf mf nested 1 0 A FFFFFFFFFFFF d " );
604 PrintAndLog ( " sample4: hf mf nested o 0 A FFFFFFFFFFFF 4 A" );
608 cmdp
= param_getchar ( Cmd
, 0 );
609 blockNo
= param_get8 ( Cmd
, 1 );
610 ctmp
= param_getchar ( Cmd
, 2 );
612 if ( ctmp
!= 'a' && ctmp
!= 'A' && ctmp
!= 'b' && ctmp
!= 'B' ) {
613 PrintAndLog ( "Key type must be A or B" );
617 if ( ctmp
!= 'A' && ctmp
!= 'a' )
620 if ( param_gethex ( Cmd
, 3 , key
, 12 )) {
621 PrintAndLog ( "Key must include 12 HEX symbols" );
625 if ( cmdp
== 'o' || cmdp
== 'O' ) {
627 trgBlockNo
= param_get8 ( Cmd
, 4 );
628 ctmp
= param_getchar ( Cmd
, 5 );
629 if ( ctmp
!= 'a' && ctmp
!= 'A' && ctmp
!= 'b' && ctmp
!= 'B' ) {
630 PrintAndLog ( "Target key type must be A or B" );
633 if ( ctmp
!= 'A' && ctmp
!= 'a' )
638 case '0' : SectorsCnt
= 05 ; break ;
639 case '1' : SectorsCnt
= 16 ; break ;
640 case '2' : SectorsCnt
= 32 ; break ;
641 case '4' : SectorsCnt
= 40 ; break ;
642 default : SectorsCnt
= 16 ;
646 ctmp
= param_getchar ( Cmd
, 4 );
647 if ( ctmp
== 't' || ctmp
== 'T' ) transferToEml
= true ;
648 else if ( ctmp
== 'd' || ctmp
== 'D' ) createDumpFile
= true ;
650 ctmp
= param_getchar ( Cmd
, 6 );
651 transferToEml
|= ( ctmp
== 't' || ctmp
== 'T' );
652 transferToEml
|= ( ctmp
== 'd' || ctmp
== 'D' );
655 PrintAndLog ( "--target block no:%3d, target key type:%c " , trgBlockNo
, trgKeyType
? 'B' : 'A' );
656 int16_t isOK
= mfnested ( blockNo
, keyType
, key
, trgBlockNo
, trgKeyType
, keyBlock
, true );
659 case - 1 : PrintAndLog ( "Error: No response from Proxmark. \n " ); break ;
660 case - 2 : PrintAndLog ( "Button pressed. Aborted. \n " ); break ;
661 case - 3 : PrintAndLog ( "Tag isn't vulnerable to Nested Attack (random numbers are not predictable). \n " ); break ;
662 default : PrintAndLog ( "Unknown Error. \n " );
666 key64
= bytes_to_num ( keyBlock
, 6 );
668 PrintAndLog ( "Found valid key:%012" PRIx64
, key64
);
670 // transfer key to the emulator
672 uint8_t sectortrailer
;
673 if ( trgBlockNo
< 32 * 4 ) { // 4 block sector
674 sectortrailer
= ( trgBlockNo
& 0x03 ) + 3 ;
675 } else { // 16 block sector
676 sectortrailer
= ( trgBlockNo
& 0x0f ) + 15 ;
678 mfEmlGetMem ( keyBlock
, sectortrailer
, 1 );
681 num_to_bytes ( key64
, 6 , keyBlock
);
683 num_to_bytes ( key64
, 6 , & keyBlock
[ 10 ]);
684 mfEmlSetMem ( keyBlock
, sectortrailer
, 1 );
687 PrintAndLog ( "No valid key found" );
690 else { // ------------------------------------ multiple sectors working
694 e_sector
= calloc ( SectorsCnt
, sizeof ( sector_t
));
695 if ( e_sector
== NULL
) return 1 ;
697 //test current key and additional standard keys first
698 memcpy ( keyBlock
, key
, 6 );
699 num_to_bytes ( 0xffffffffffff , 6 , ( uint8_t *)( keyBlock
+ 1 * 6 ));
700 num_to_bytes ( 0x000000000000 , 6 , ( uint8_t *)( keyBlock
+ 2 * 6 ));
701 num_to_bytes ( 0xa0a1a2a3a4a5 , 6 , ( uint8_t *)( keyBlock
+ 3 * 6 ));
702 num_to_bytes ( 0xb0b1b2b3b4b5 , 6 , ( uint8_t *)( keyBlock
+ 4 * 6 ));
703 num_to_bytes ( 0xaabbccddeeff , 6 , ( uint8_t *)( keyBlock
+ 5 * 6 ));
704 num_to_bytes ( 0x4d3a99c351dd , 6 , ( uint8_t *)( keyBlock
+ 6 * 6 ));
705 num_to_bytes ( 0x1a982c7e459a , 6 , ( uint8_t *)( keyBlock
+ 7 * 6 ));
706 num_to_bytes ( 0xd3f7d3f7d3f7 , 6 , ( uint8_t *)( keyBlock
+ 8 * 6 ));
707 num_to_bytes ( 0x714c5c886e97 , 6 , ( uint8_t *)( keyBlock
+ 9 * 6 ));
708 num_to_bytes ( 0x587ee5f9350f , 6 , ( uint8_t *)( keyBlock
+ 10 * 6 ));
709 num_to_bytes ( 0xa0478cc39091 , 6 , ( uint8_t *)( keyBlock
+ 11 * 6 ));
710 num_to_bytes ( 0x533cb6c723f6 , 6 , ( uint8_t *)( keyBlock
+ 12 * 6 ));
711 num_to_bytes ( 0x8fd0a4f256e9 , 6 , ( uint8_t *)( keyBlock
+ 13 * 6 ));
713 PrintAndLog ( "Testing known keys. Sector count=%d" , SectorsCnt
);
714 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
715 for ( j
= 0 ; j
< 2 ; j
++) {
716 if ( e_sector
[ i
]. foundKey
[ j
]) continue ;
718 res
= mfCheckKeys ( FirstBlockOfSector ( i
), j
, true , 6 , keyBlock
, & key64
);
721 e_sector
[ i
]. Key
[ j
] = key64
;
722 e_sector
[ i
]. foundKey
[ j
] = 1 ;
729 PrintAndLog ( "nested..." );
730 bool calibrate
= true ;
731 for ( i
= 0 ; i
< NESTED_SECTOR_RETRY
; i
++) {
732 for ( uint8_t sectorNo
= 0 ; sectorNo
< SectorsCnt
; sectorNo
++) {
733 for ( trgKeyType
= 0 ; trgKeyType
< 2 ; trgKeyType
++) {
734 if ( e_sector
[ sectorNo
]. foundKey
[ trgKeyType
]) continue ;
735 PrintAndLog ( "-----------------------------------------------" );
736 int16_t isOK
= mfnested ( blockNo
, keyType
, key
, FirstBlockOfSector ( sectorNo
), trgKeyType
, keyBlock
, calibrate
);
739 case - 1 : PrintAndLog ( "Error: No response from Proxmark. \n " ); break ;
740 case - 2 : PrintAndLog ( "Button pressed. Aborted. \n " ); break ;
741 case - 3 : PrintAndLog ( "Tag isn't vulnerable to Nested Attack (random numbers are not predictable). \n " ); break ;
742 default : PrintAndLog ( "Unknown Error. \n " );
752 key64
= bytes_to_num ( keyBlock
, 6 );
754 PrintAndLog ( "Found valid key:%012" PRIx64
, key64
);
755 e_sector
[ sectorNo
]. foundKey
[ trgKeyType
] = 1 ;
756 e_sector
[ sectorNo
]. Key
[ trgKeyType
] = key64
;
762 printf ( "Time in nested: %1.3f (%1.3f sec per key) \n\n " , (( float ) clock () - time1
)/ CLOCKS_PER_SEC
, (( float ) clock () - time1
)/ iterations
/ CLOCKS_PER_SEC
);
764 PrintAndLog ( "----------------------------------------------- \n Iterations count: %d \n\n " , iterations
);
766 PrintAndLog ( "|---|----------------|---|----------------|---|" );
767 PrintAndLog ( "|sec|key A |res|key B |res|" );
768 PrintAndLog ( "|---|----------------|---|----------------|---|" );
769 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
770 PrintAndLog ( "|%03d| %012" PRIx64
" | %d | %012" PRIx64
" | %d |" , i
,
771 e_sector
[ i
]. Key
[ 0 ], e_sector
[ i
]. foundKey
[ 0 ], e_sector
[ i
]. Key
[ 1 ], e_sector
[ i
]. foundKey
[ 1 ]);
773 PrintAndLog ( "|---|----------------|---|----------------|---|" );
775 // transfer them to the emulator
777 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
778 mfEmlGetMem ( keyBlock
, FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 , 1 );
779 if ( e_sector
[ i
]. foundKey
[ 0 ])
780 num_to_bytes ( e_sector
[ i
]. Key
[ 0 ], 6 , keyBlock
);
781 if ( e_sector
[ i
]. foundKey
[ 1 ])
782 num_to_bytes ( e_sector
[ i
]. Key
[ 1 ], 6 , & keyBlock
[ 10 ]);
783 mfEmlSetMem ( keyBlock
, FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 , 1 );
788 if ( createDumpFile
) {
789 if (( fkeys
= fopen ( "dumpkeys.bin" , "wb" )) == NULL
) {
790 PrintAndLog ( "Could not create file dumpkeys.bin" );
794 PrintAndLog ( "Printing keys to binary file dumpkeys.bin..." );
795 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
796 if ( e_sector
[ i
]. foundKey
[ 0 ]){
797 num_to_bytes ( e_sector
[ i
]. Key
[ 0 ], 6 , tempkey
);
798 fwrite ( tempkey
, 1 , 6 , fkeys
);
801 fwrite ( & standart
, 1 , 6 , fkeys
);
804 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
805 if ( e_sector
[ i
]. foundKey
[ 1 ]){
806 num_to_bytes ( e_sector
[ i
]. Key
[ 1 ], 6 , tempkey
);
807 fwrite ( tempkey
, 1 , 6 , fkeys
);
810 fwrite ( & standart
, 1 , 6 , fkeys
);
821 int CmdHF14AMfChk ( const char * Cmd
)
824 PrintAndLog ( "Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d] [<key (12 hex symbols)>] [<dic (*.dic)>]" );
825 PrintAndLog ( " * - all sectors" );
826 PrintAndLog ( "card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K" );
827 PrintAndLog ( "d - write keys to binary file \n " );
828 PrintAndLog ( "t - write keys to emulator memory" );
829 PrintAndLog ( " sample: hf mf chk 0 A 1234567890ab keys.dic" );
830 PrintAndLog ( " hf mf chk *1 ? t" );
831 PrintAndLog ( " hf mf chk *1 ? d" );
836 char filename
[ FILE_PATH_SIZE
]={ 0 };
838 uint8_t * keyBlock
= NULL
, * p
;
839 uint8_t stKeyBlock
= 20 ;
845 uint8_t SectorsCnt
= 1 ;
849 int transferToEml
= 0 ;
850 int createDumpFile
= 0 ;
852 keyBlock
= calloc ( stKeyBlock
, 6 );
853 if ( keyBlock
== NULL
) return 1 ;
855 uint64_t defaultKeys
[] =
857 0xffffffffffff , // Default key (first key used by program if no user defined key)
858 0x000000000000 , // Blank key
859 0xa0a1a2a3a4a5 , // NFCForum MAD key
871 int defaultKeysSize
= sizeof ( defaultKeys
) / sizeof ( uint64_t );
873 for ( int defaultKeyCounter
= 0 ; defaultKeyCounter
< defaultKeysSize
; defaultKeyCounter
++)
875 num_to_bytes ( defaultKeys
[ defaultKeyCounter
], 6 , ( uint8_t *)( keyBlock
+ defaultKeyCounter
* 6 ));
878 if ( param_getchar ( Cmd
, 0 )== '*' ) {
880 switch ( param_getchar ( Cmd
+ 1 , 0 )) {
881 case '0' : SectorsCnt
= 5 ; break ;
882 case '1' : SectorsCnt
= 16 ; break ;
883 case '2' : SectorsCnt
= 32 ; break ;
884 case '4' : SectorsCnt
= 40 ; break ;
885 default : SectorsCnt
= 16 ;
889 blockNo
= param_get8 ( Cmd
, 0 );
891 ctmp
= param_getchar ( Cmd
, 1 );
903 PrintAndLog ( "Key type must be A , B or ?" );
907 ctmp
= param_getchar ( Cmd
, 2 );
908 if ( ctmp
== 't' || ctmp
== 'T' ) transferToEml
= 1 ;
909 else if ( ctmp
== 'd' || ctmp
== 'D' ) createDumpFile
= 1 ;
911 for ( i
= transferToEml
|| createDumpFile
; param_getchar ( Cmd
, 2 + i
); i
++) {
912 if (! param_gethex ( Cmd
, 2 + i
, keyBlock
+ 6 * keycnt
, 12 )) {
913 if ( stKeyBlock
- keycnt
< 2 ) {
914 p
= realloc ( keyBlock
, 6 *( stKeyBlock
+= 10 ));
916 PrintAndLog ( "Cannot allocate memory for Keys" );
922 PrintAndLog ( "chk key[%2d] %02x%02x%02x%02x%02x%02x" , keycnt
,
923 ( keyBlock
+ 6 * keycnt
)[ 0 ],( keyBlock
+ 6 * keycnt
)[ 1 ], ( keyBlock
+ 6 * keycnt
)[ 2 ],
924 ( keyBlock
+ 6 * keycnt
)[ 3 ], ( keyBlock
+ 6 * keycnt
)[ 4 ], ( keyBlock
+ 6 * keycnt
)[ 5 ], 6 );
928 if ( param_getstr ( Cmd
, 2 + i
, filename
) >= FILE_PATH_SIZE
) {
929 PrintAndLog ( "File name too long" );
934 if ( ( f
= fopen ( filename
, "r" )) ) {
935 while ( fgets ( buf
, sizeof ( buf
), f
) ){
936 if ( strlen ( buf
) < 12 || buf
[ 11 ] == ' \n ' )
939 while ( fgetc ( f
) != ' \n ' && ! feof ( f
)) ; //goto next line
941 if ( buf
[ 0 ]== '#' ) continue ; //The line start with # is comment, skip
943 if (! isxdigit ( buf
[ 0 ])){
944 PrintAndLog ( "File content error. '%s' must include 12 HEX symbols" , buf
);
950 if ( stKeyBlock
- keycnt
< 2 ) {
951 p
= realloc ( keyBlock
, 6 *( stKeyBlock
+= 10 ));
953 PrintAndLog ( "Cannot allocate memory for defKeys" );
960 memset ( keyBlock
+ 6 * keycnt
, 0 , 6 );
961 num_to_bytes ( strtoll ( buf
, NULL
, 16 ), 6 , keyBlock
+ 6 * keycnt
);
962 PrintAndLog ( "chk custom key[%2d] %012" PRIx64
, keycnt
, bytes_to_num ( keyBlock
+ 6 * keycnt
, 6 ));
964 memset ( buf
, 0 , sizeof ( buf
));
968 PrintAndLog ( "File: %s: not found or locked." , filename
);
977 PrintAndLog ( "No key specified, trying default keys" );
978 for (; keycnt
< defaultKeysSize
; keycnt
++)
979 PrintAndLog ( "chk default key[%2d] %02x%02x%02x%02x%02x%02x" , keycnt
,
980 ( keyBlock
+ 6 * keycnt
)[ 0 ],( keyBlock
+ 6 * keycnt
)[ 1 ], ( keyBlock
+ 6 * keycnt
)[ 2 ],
981 ( keyBlock
+ 6 * keycnt
)[ 3 ], ( keyBlock
+ 6 * keycnt
)[ 4 ], ( keyBlock
+ 6 * keycnt
)[ 5 ], 6 );
984 // initialize storage for found keys
985 bool validKey
[ 2 ][ 40 ];
986 uint8_t foundKey
[ 2 ][ 40 ][ 6 ];
987 for ( uint16_t t
= 0 ; t
< 2 ; t
++) {
988 for ( uint16_t sectorNo
= 0 ; sectorNo
< SectorsCnt
; sectorNo
++) {
989 validKey
[ t
][ sectorNo
] = false ;
990 for ( uint16_t i
= 0 ; i
< 6 ; i
++) {
991 foundKey
[ t
][ sectorNo
][ i
] = 0xff ;
996 for ( int t
= ! keyType
; t
< 2 ; keyType
== 2 ?( t
++):( t
= 2 ) ) {
998 for ( int i
= 0 ; i
< SectorsCnt
; ++ i
) {
999 PrintAndLog ( "--sector:%2d, block:%3d, key type:%C, key count:%2d " , i
, b
, t
? 'B' : 'A' , keycnt
);
1000 uint32_t max_keys
= keycnt
> USB_CMD_DATA_SIZE
/ 6 ? USB_CMD_DATA_SIZE
/ 6 : keycnt
;
1001 for ( uint32_t c
= 0 ; c
< keycnt
; c
+= max_keys
) {
1002 uint32_t size
= keycnt
- c
> max_keys
? max_keys
: keycnt
- c
;
1003 res
= mfCheckKeys ( b
, t
, true , size
, & keyBlock
[ 6 * c
], & key64
);
1006 PrintAndLog ( "Found valid key:[%012" PRIx64
"]" , key64
);
1007 num_to_bytes ( key64
, 6 , foundKey
[ t
][ i
]);
1008 validKey
[ t
][ i
] = true ;
1011 PrintAndLog ( "Command execute timeout" );
1014 b
< 127 ?( b
+= 4 ):( b
+= 16 );
1018 if ( transferToEml
) {
1020 for ( uint16_t sectorNo
= 0 ; sectorNo
< SectorsCnt
; sectorNo
++) {
1021 if ( validKey
[ 0 ][ sectorNo
] || validKey
[ 1 ][ sectorNo
]) {
1022 mfEmlGetMem ( block
, FirstBlockOfSector ( sectorNo
) + NumBlocksPerSector ( sectorNo
) - 1 , 1 );
1023 for ( uint16_t t
= 0 ; t
< 2 ; t
++) {
1024 if ( validKey
[ t
][ sectorNo
]) {
1025 memcpy ( block
+ t
* 10 , foundKey
[ t
][ sectorNo
], 6 );
1028 mfEmlSetMem ( block
, FirstBlockOfSector ( sectorNo
) + NumBlocksPerSector ( sectorNo
) - 1 , 1 );
1031 PrintAndLog ( "Found keys have been transferred to the emulator memory" );
1034 if ( createDumpFile
) {
1035 FILE * fkeys
= fopen ( "dumpkeys.bin" , "wb" );
1036 if ( fkeys
== NULL
) {
1037 PrintAndLog ( "Could not create file dumpkeys.bin" );
1041 for ( uint16_t t
= 0 ; t
< 2 ; t
++) {
1042 fwrite ( foundKey
[ t
], 1 , 6 * SectorsCnt
, fkeys
);
1045 PrintAndLog ( "Found keys have been dumped to file dumpkeys.bin. 0xffffffffffff has been inserted for unknown keys." );
1053 void readerAttack ( nonces_t ar_resp
[], bool setEmulatorMem
, bool doStandardAttack
) {
1054 #define ATTACK_KEY_COUNT 8 // keep same as define in iso14443a.c -> Mifare1ksim()
1060 st_t sector_trailer
[ ATTACK_KEY_COUNT
];
1061 memset ( sector_trailer
, 0x00 , sizeof ( sector_trailer
));
1063 uint8_t stSector
[ ATTACK_KEY_COUNT
];
1064 memset ( stSector
, 0x00 , sizeof ( stSector
));
1065 uint8_t key_cnt
[ ATTACK_KEY_COUNT
];
1066 memset ( key_cnt
, 0x00 , sizeof ( key_cnt
));
1068 for ( uint8_t i
= 0 ; i
< ATTACK_KEY_COUNT
; i
++) {
1069 if ( ar_resp
[ i
]. ar2
> 0 ) {
1070 //PrintAndLog("DEBUG: Trying sector %d, cuid %08x, nt %08x, ar %08x, nr %08x, ar2 %08x, nr2 %08x",ar_resp[i].sector, ar_resp[i].cuid,ar_resp[i].nonce,ar_resp[i].ar,ar_resp[i].nr,ar_resp[i].ar2,ar_resp[i].nr2);
1071 if ( doStandardAttack
&& mfkey32 ( ar_resp
[ i
], & key
)) {
1072 PrintAndLog ( " Found Key%s for sector %02d: [%04x%08x]" , ( ar_resp
[ i
]. keytype
) ? "B" : "A" , ar_resp
[ i
]. sector
, ( uint32_t ) ( key
>> 32 ), ( uint32_t ) ( key
& 0xFFFFFFFF ));
1074 for ( uint8_t ii
= 0 ; ii
< ATTACK_KEY_COUNT
; ii
++) {
1075 if ( key_cnt
[ ii
]== 0 || stSector
[ ii
]== ar_resp
[ i
]. sector
) {
1076 if ( ar_resp
[ i
]. keytype
== 0 ) {
1078 sector_trailer
[ ii
]. keyA
= key
;
1079 stSector
[ ii
] = ar_resp
[ i
]. sector
;
1084 sector_trailer
[ ii
]. keyB
= key
;
1085 stSector
[ ii
] = ar_resp
[ i
]. sector
;
1091 } else if ( tryMfk32_moebius ( ar_resp
[ i
+ ATTACK_KEY_COUNT
], & key
)) {
1092 uint8_t sectorNum
= ar_resp
[ i
+ ATTACK_KEY_COUNT
]. sector
;
1093 uint8_t keyType
= ar_resp
[ i
+ ATTACK_KEY_COUNT
]. keytype
;
1095 PrintAndLog ( "M-Found Key%s for sector %02d: [%012" PRIx64
"]"
1096 , keyType
? "B" : "A"
1101 for ( uint8_t ii
= 0 ; ii
< ATTACK_KEY_COUNT
; ii
++) {
1102 if ( key_cnt
[ ii
]== 0 || stSector
[ ii
]== sectorNum
) {
1105 sector_trailer
[ ii
]. keyA
= key
;
1106 stSector
[ ii
] = sectorNum
;
1111 sector_trailer
[ ii
]. keyB
= key
;
1112 stSector
[ ii
] = sectorNum
;
1122 //set emulator memory for keys
1123 if ( setEmulatorMem
) {
1124 for ( uint8_t i
= 0 ; i
< ATTACK_KEY_COUNT
; i
++) {
1126 uint8_t memBlock
[ 16 ];
1127 memset ( memBlock
, 0x00 , sizeof ( memBlock
));
1129 memset ( cmd1
, 0x00 , sizeof ( cmd1
));
1130 snprintf ( cmd1
, sizeof ( cmd1
), "%04x%08xFF078069%04x%08x" ,( uint32_t ) ( sector_trailer
[ i
]. keyA
>> 32 ), ( uint32_t ) ( sector_trailer
[ i
]. keyA
& 0xFFFFFFFF ),( uint32_t ) ( sector_trailer
[ i
]. keyB
>> 32 ), ( uint32_t ) ( sector_trailer
[ i
]. keyB
& 0xFFFFFFFF ));
1131 PrintAndLog ( "Setting Emulator Memory Block %02d: [%s]" , stSector
[ i
]* 4 + 3 , cmd1
);
1132 if ( param_gethex ( cmd1
, 0 , memBlock
, 32 )) {
1133 PrintAndLog ( "block data must include 32 HEX symbols" );
1137 UsbCommand c
= { CMD_MIFARE_EML_MEMSET
, {( stSector
[ i
]* 4 + 3 ), 1 , 0 }};
1138 memcpy ( c
. d
. asBytes
, memBlock
, 16 );
1139 clearCommandBuffer ();
1145 //un-comment to use as well moebius attack
1146 for (uint8_t i = ATTACK_KEY_COUNT; i<ATTACK_KEY_COUNT*2; i++) {
1147 if (ar_resp[i].ar2 > 0) {
1148 if (tryMfk32_moebius(ar_resp[i], &key)) {
1149 PrintAndLog("M-Found Key%s for sector %02d: [%04x%08x]", (ar_resp[i].keytype) ? "B" : "A", ar_resp[i].sector, (uint32_t) (key>>32), (uint32_t) (key &0xFFFFFFFF));
1155 int usage_hf14_mf1ksim ( void ) {
1156 PrintAndLog ( "Usage: hf mf sim h u <uid (8, 14, or 20 hex symbols)> n <numreads> i x" );
1157 PrintAndLog ( "options:" );
1158 PrintAndLog ( " h this help" );
1159 PrintAndLog ( " u (Optional) UID 4,7 or 10 bytes. If not specified, the UID 4B from emulator memory will be used" );
1160 PrintAndLog ( " n (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite" );
1161 PrintAndLog ( " i (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted" );
1162 PrintAndLog ( " x (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)" );
1163 PrintAndLog ( " e (Optional) set keys found from 'reader attack' to emulator memory (implies x and i)" );
1164 PrintAndLog ( " f (Optional) get UIDs to use for 'reader attack' from file 'f <filename.txt>' (implies x and i)" );
1165 PrintAndLog ( " r (Optional) Generate random nonces instead of sequential nonces. Standard reader attack won't work with this option, only moebius attack works." );
1166 PrintAndLog ( "samples:" );
1167 PrintAndLog ( " hf mf sim u 0a0a0a0a" );
1168 PrintAndLog ( " hf mf sim u 11223344556677" );
1169 PrintAndLog ( " hf mf sim u 112233445566778899AA" );
1170 PrintAndLog ( " hf mf sim f uids.txt" );
1171 PrintAndLog ( " hf mf sim u 0a0a0a0a e" );
1176 int CmdHF14AMf1kSim ( const char * Cmd
) {
1178 uint8_t uid
[ 10 ] = { 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 };
1179 uint8_t exitAfterNReads
= 0 ;
1183 bool setEmulatorMem
= false ;
1184 bool attackFromFile
= false ;
1186 char filename
[ FILE_PATH_SIZE
];
1187 memset ( filename
, 0x00 , sizeof ( filename
));
1192 bool errors
= false ;
1194 while ( param_getchar ( Cmd
, cmdp
) != 0x00 ) {
1195 switch ( param_getchar ( Cmd
, cmdp
)) {
1198 setEmulatorMem
= true ;
1200 flags
|= FLAG_INTERACTIVE
;
1201 flags
|= FLAG_NR_AR_ATTACK
;
1206 len
= param_getstr ( Cmd
, cmdp
+ 1 , filename
);
1208 PrintAndLog ( "error no filename found" );
1211 attackFromFile
= true ;
1213 flags
|= FLAG_INTERACTIVE
;
1214 flags
|= FLAG_NR_AR_ATTACK
;
1219 return usage_hf14_mf1ksim ();
1222 flags
|= FLAG_INTERACTIVE
;
1227 exitAfterNReads
= param_get8 ( Cmd
, pnr
+ 1 );
1232 flags
|= FLAG_RANDOM_NONCE
;
1237 param_gethex_ex ( Cmd
, cmdp
+ 1 , uid
, & uidlen
);
1239 case 20 : flags
= FLAG_10B_UID_IN_DATA
; break ; //not complete
1240 case 14 : flags
= FLAG_7B_UID_IN_DATA
; break ;
1241 case 8 : flags
= FLAG_4B_UID_IN_DATA
; break ;
1242 default : return usage_hf14_mf1ksim ();
1248 flags
|= FLAG_NR_AR_ATTACK
;
1252 PrintAndLog ( "Unknown parameter '%c'" , param_getchar ( Cmd
, cmdp
));
1259 if ( errors
) return usage_hf14_mf1ksim ();
1262 if ( attackFromFile
) {
1265 f
= fopen ( filename
, "r" );
1267 PrintAndLog ( "File %s not found or locked" , filename
);
1270 PrintAndLog ( "Loading file and simulating. Press keyboard to abort" );
1271 while (! feof ( f
) && ! ukbhit ()){
1272 memset ( buf
, 0 , sizeof ( buf
));
1273 memset ( uid
, 0 , sizeof ( uid
));
1275 if ( fgets ( buf
, sizeof ( buf
), f
) == NULL
) {
1276 if ( count
> 0 ) break ;
1278 PrintAndLog ( "File reading error." );
1282 if (! strlen ( buf
) && feof ( f
)) break ;
1284 uidlen
= strlen ( buf
)- 1 ;
1286 case 20 : flags
|= FLAG_10B_UID_IN_DATA
; break ; //not complete
1287 case 14 : flags
|= FLAG_7B_UID_IN_DATA
; break ;
1288 case 8 : flags
|= FLAG_4B_UID_IN_DATA
; break ;
1290 PrintAndLog ( "uid in file wrong length at %d (length: %d) [%s]" , count
, uidlen
, buf
);
1295 for ( uint8_t i
= 0 ; i
< uidlen
; i
+= 2 ) {
1296 sscanf (& buf
[ i
], "%02x" , ( unsigned int *)& uid
[ i
/ 2 ]);
1299 PrintAndLog ( "mf 1k sim uid: %s, numreads:%d, flags:%d (0x%02x) - press button to abort" ,
1300 flags
& FLAG_4B_UID_IN_DATA
? sprint_hex ( uid
, 4 ):
1301 flags
& FLAG_7B_UID_IN_DATA
? sprint_hex ( uid
, 7 ):
1302 flags
& FLAG_10B_UID_IN_DATA
? sprint_hex ( uid
, 10 ): "N/A"
1303 , exitAfterNReads
, flags
, flags
);
1305 UsbCommand c
= { CMD_SIMULATE_MIFARE_CARD
, { flags
, exitAfterNReads
, 0 }};
1306 memcpy ( c
. d
. asBytes
, uid
, sizeof ( uid
));
1307 clearCommandBuffer ();
1310 while (! WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
1311 //We're waiting only 1.5 s at a time, otherwise we get the
1312 // annoying message about "Waiting for a response... "
1315 nonces_t ar_resp
[ ATTACK_KEY_COUNT
* 2 ];
1316 memcpy ( ar_resp
, resp
. d
. asBytes
, sizeof ( ar_resp
));
1317 // We can skip the standard attack if we have RANDOM_NONCE set.
1318 readerAttack ( ar_resp
, setEmulatorMem
, !( flags
& FLAG_RANDOM_NONCE
));
1319 if (( bool ) resp
. arg
[ 1 ]) {
1320 PrintAndLog ( "Device button pressed - quitting" );
1327 } else { //not from file
1329 PrintAndLog ( "mf 1k sim uid: %s, numreads:%d, flags:%d (0x%02x) " ,
1330 flags
& FLAG_4B_UID_IN_DATA
? sprint_hex ( uid
, 4 ):
1331 flags
& FLAG_7B_UID_IN_DATA
? sprint_hex ( uid
, 7 ):
1332 flags
& FLAG_10B_UID_IN_DATA
? sprint_hex ( uid
, 10 ): "N/A"
1333 , exitAfterNReads
, flags
, flags
);
1335 UsbCommand c
= { CMD_SIMULATE_MIFARE_CARD
, { flags
, exitAfterNReads
, 0 }};
1336 memcpy ( c
. d
. asBytes
, uid
, sizeof ( uid
));
1337 clearCommandBuffer ();
1340 if ( flags
& FLAG_INTERACTIVE
) {
1341 PrintAndLog ( "Press pm3-button to abort simulation" );
1342 while (! WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
1343 //We're waiting only 1.5 s at a time, otherwise we get the
1344 // annoying message about "Waiting for a response... "
1347 if ( flags
& FLAG_NR_AR_ATTACK
) {
1348 nonces_t ar_resp
[ ATTACK_KEY_COUNT
* 2 ];
1349 memcpy ( ar_resp
, resp
. d
. asBytes
, sizeof ( ar_resp
));
1350 // We can skip the standard attack if we have RANDOM_NONCE set.
1351 readerAttack ( ar_resp
, setEmulatorMem
, !( flags
& FLAG_RANDOM_NONCE
));
1359 int CmdHF14AMfDbg ( const char * Cmd
)
1361 int dbgMode
= param_get32ex ( Cmd
, 0 , 0 , 10 );
1363 PrintAndLog ( "Max debug mode parameter is 4 \n " );
1366 if ( strlen ( Cmd
) < 1 || ! param_getchar ( Cmd
, 0 ) || dbgMode
> 4 ) {
1367 PrintAndLog ( "Usage: hf mf dbg <debug level>" );
1368 PrintAndLog ( " 0 - no debug messages" );
1369 PrintAndLog ( " 1 - error messages" );
1370 PrintAndLog ( " 2 - plus information messages" );
1371 PrintAndLog ( " 3 - plus debug messages" );
1372 PrintAndLog ( " 4 - print even debug messages in timing critical functions" );
1373 PrintAndLog ( " Note: this option therefore may cause malfunction itself" );
1377 UsbCommand c
= { CMD_MIFARE_SET_DBGMODE
, { dbgMode
, 0 , 0 }};
1383 int CmdHF14AMfEGet ( const char * Cmd
)
1385 uint8_t blockNo
= 0 ;
1386 uint8_t data
[ 16 ] = { 0x00 };
1388 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1389 PrintAndLog ( "Usage: hf mf eget <block number>" );
1390 PrintAndLog ( " sample: hf mf eget 0 " );
1394 blockNo
= param_get8 ( Cmd
, 0 );
1397 if (! mfEmlGetMem ( data
, blockNo
, 1 )) {
1398 PrintAndLog ( "data[%3d]:%s" , blockNo
, sprint_hex ( data
, 16 ));
1400 PrintAndLog ( "Command execute timeout" );
1406 int CmdHF14AMfEClear ( const char * Cmd
)
1408 if ( param_getchar ( Cmd
, 0 ) == 'h' ) {
1409 PrintAndLog ( "Usage: hf mf eclr" );
1410 PrintAndLog ( "It set card emulator memory to empty data blocks and key A/B FFFFFFFFFFFF \n " );
1414 UsbCommand c
= { CMD_MIFARE_EML_MEMCLR
, { 0 , 0 , 0 }};
1420 int CmdHF14AMfESet ( const char * Cmd
)
1422 uint8_t memBlock
[ 16 ];
1423 uint8_t blockNo
= 0 ;
1425 memset ( memBlock
, 0x00 , sizeof ( memBlock
));
1427 if ( strlen ( Cmd
) < 3 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1428 PrintAndLog ( "Usage: hf mf eset <block number> <block data (32 hex symbols)>" );
1429 PrintAndLog ( " sample: hf mf eset 1 000102030405060708090a0b0c0d0e0f " );
1433 blockNo
= param_get8 ( Cmd
, 0 );
1435 if ( param_gethex ( Cmd
, 1 , memBlock
, 32 )) {
1436 PrintAndLog ( "block data must include 32 HEX symbols" );
1441 UsbCommand c
= { CMD_MIFARE_EML_MEMSET
, { blockNo
, 1 , 0 }};
1442 memcpy ( c
. d
. asBytes
, memBlock
, 16 );
1448 int CmdHF14AMfELoad ( const char * Cmd
)
1451 char filename
[ FILE_PATH_SIZE
];
1452 char * fnameptr
= filename
;
1453 char buf
[ 64 ] = { 0x00 };
1454 uint8_t buf8
[ 64 ] = { 0x00 };
1455 int i
, len
, blockNum
, numBlocks
;
1456 int nameParamNo
= 1 ;
1458 char ctmp
= param_getchar ( Cmd
, 0 );
1460 if ( ctmp
== 'h' || ctmp
== 0x00 ) {
1461 PrintAndLog ( "It loads emul dump from the file `filename.eml`" );
1462 PrintAndLog ( "Usage: hf mf eload [card memory] <file name w/o `.eml`>" );
1463 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1465 PrintAndLog ( " sample: hf mf eload filename" );
1466 PrintAndLog ( " hf mf eload 4 filename" );
1471 case '0' : numBlocks
= 5 * 4 ; break ;
1473 case '\0' : numBlocks
= 16 * 4 ; break ;
1474 case '2' : numBlocks
= 32 * 4 ; break ;
1475 case '4' : numBlocks
= 256 ; break ;
1482 len
= param_getstr ( Cmd
, nameParamNo
, filename
);
1484 if ( len
> FILE_PATH_SIZE
- 5 ) len
= FILE_PATH_SIZE
- 5 ;
1488 sprintf ( fnameptr
, ".eml" );
1491 f
= fopen ( filename
, "r" );
1493 PrintAndLog ( "File %s not found or locked" , filename
);
1499 memset ( buf
, 0 , sizeof ( buf
));
1501 if ( fgets ( buf
, sizeof ( buf
), f
) == NULL
) {
1503 if ( blockNum
>= numBlocks
) break ;
1505 PrintAndLog ( "File reading error." );
1510 if ( strlen ( buf
) < 32 ){
1511 if ( strlen ( buf
) && feof ( f
))
1513 PrintAndLog ( "File content error. Block data must include 32 HEX symbols" );
1518 for ( i
= 0 ; i
< 32 ; i
+= 2 ) {
1519 sscanf (& buf
[ i
], "%02x" , ( unsigned int *)& buf8
[ i
/ 2 ]);
1522 if ( mfEmlSetMem ( buf8
, blockNum
, 1 )) {
1523 PrintAndLog ( "Cant set emul block: %3d" , blockNum
);
1530 if ( blockNum
>= numBlocks
) break ;
1535 if (( blockNum
!= numBlocks
)) {
1536 PrintAndLog ( "File content error. Got %d must be %d blocks." , blockNum
, numBlocks
);
1539 PrintAndLog ( "Loaded %d blocks from file: %s" , blockNum
, filename
);
1544 int CmdHF14AMfESave ( const char * Cmd
)
1547 char filename
[ FILE_PATH_SIZE
];
1548 char * fnameptr
= filename
;
1550 int i
, j
, len
, numBlocks
;
1551 int nameParamNo
= 1 ;
1553 memset ( filename
, 0 , sizeof ( filename
));
1554 memset ( buf
, 0 , sizeof ( buf
));
1556 char ctmp
= param_getchar ( Cmd
, 0 );
1558 if ( ctmp
== 'h' || ctmp
== 'H' ) {
1559 PrintAndLog ( "It saves emul dump into the file `filename.eml` or `cardID.eml`" );
1560 PrintAndLog ( " Usage: hf mf esave [card memory] [file name w/o `.eml`]" );
1561 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1563 PrintAndLog ( " sample: hf mf esave " );
1564 PrintAndLog ( " hf mf esave 4" );
1565 PrintAndLog ( " hf mf esave 4 filename" );
1570 case '0' : numBlocks
= 5 * 4 ; break ;
1572 case '\0' : numBlocks
= 16 * 4 ; break ;
1573 case '2' : numBlocks
= 32 * 4 ; break ;
1574 case '4' : numBlocks
= 256 ; break ;
1581 len
= param_getstr ( Cmd
, nameParamNo
, filename
);
1583 if ( len
> FILE_PATH_SIZE
- 5 ) len
= FILE_PATH_SIZE
- 5 ;
1585 // user supplied filename?
1587 // get filename (UID from memory)
1588 if ( mfEmlGetMem ( buf
, 0 , 1 )) {
1589 PrintAndLog ( "Can \' t get UID from block: %d" , 0 );
1590 len
= sprintf ( fnameptr
, "dump" );
1594 for ( j
= 0 ; j
< 7 ; j
++, fnameptr
+= 2 )
1595 sprintf ( fnameptr
, "%02X" , buf
[ j
]);
1601 // add file extension
1602 sprintf ( fnameptr
, ".eml" );
1605 f
= fopen ( filename
, "w+" );
1608 PrintAndLog ( "Can't open file %s " , filename
);
1613 for ( i
= 0 ; i
< numBlocks
; i
++) {
1614 if ( mfEmlGetMem ( buf
, i
, 1 )) {
1615 PrintAndLog ( "Cant get block: %d" , i
);
1618 for ( j
= 0 ; j
< 16 ; j
++)
1619 fprintf ( f
, "%02X" , buf
[ j
]);
1624 PrintAndLog ( "Saved %d blocks to file: %s" , numBlocks
, filename
);
1630 int CmdHF14AMfECFill ( const char * Cmd
)
1632 uint8_t keyType
= 0 ;
1633 uint8_t numSectors
= 16 ;
1635 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1636 PrintAndLog ( "Usage: hf mf ecfill <key A/B> [card memory]" );
1637 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1639 PrintAndLog ( "samples: hf mf ecfill A" );
1640 PrintAndLog ( " hf mf ecfill A 4" );
1641 PrintAndLog ( "Read card and transfer its data to emulator memory." );
1642 PrintAndLog ( "Keys must be laid in the emulator memory. \n " );
1646 char ctmp
= param_getchar ( Cmd
, 0 );
1647 if ( ctmp
!= 'a' && ctmp
!= 'A' && ctmp
!= 'b' && ctmp
!= 'B' ) {
1648 PrintAndLog ( "Key type must be A or B" );
1651 if ( ctmp
!= 'A' && ctmp
!= 'a' ) keyType
= 1 ;
1653 ctmp
= param_getchar ( Cmd
, 1 );
1655 case '0' : numSectors
= 5 ; break ;
1657 case '\0' : numSectors
= 16 ; break ;
1658 case '2' : numSectors
= 32 ; break ;
1659 case '4' : numSectors
= 40 ; break ;
1660 default : numSectors
= 16 ;
1663 printf ( "--params: numSectors: %d, keyType:%d" , numSectors
, keyType
);
1664 UsbCommand c
= { CMD_MIFARE_EML_CARDLOAD
, { numSectors
, keyType
, 0 }};
1670 int CmdHF14AMfEKeyPrn ( const char * Cmd
)
1675 uint64_t keyA
, keyB
;
1677 if ( param_getchar ( Cmd
, 0 ) == 'h' ) {
1678 PrintAndLog ( "It prints the keys loaded in the emulator memory" );
1679 PrintAndLog ( "Usage: hf mf ekeyprn [card memory]" );
1680 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1682 PrintAndLog ( " sample: hf mf ekeyprn 1" );
1686 char cmdp
= param_getchar ( Cmd
, 0 );
1689 case '0' : numSectors
= 5 ; break ;
1691 case '\0' : numSectors
= 16 ; break ;
1692 case '2' : numSectors
= 32 ; break ;
1693 case '4' : numSectors
= 40 ; break ;
1694 default : numSectors
= 16 ;
1697 PrintAndLog ( "|---|----------------|----------------|" );
1698 PrintAndLog ( "|sec|key A |key B |" );
1699 PrintAndLog ( "|---|----------------|----------------|" );
1700 for ( i
= 0 ; i
< numSectors
; i
++) {
1701 if ( mfEmlGetMem ( data
, FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 , 1 )) {
1702 PrintAndLog ( "error get block %d" , FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 );
1705 keyA
= bytes_to_num ( data
, 6 );
1706 keyB
= bytes_to_num ( data
+ 10 , 6 );
1707 PrintAndLog ( "|%03d| %012" PRIx64
" | %012" PRIx64
" |" , i
, keyA
, keyB
);
1709 PrintAndLog ( "|---|----------------|----------------|" );
1715 int CmdHF14AMfCSetUID ( const char * Cmd
)
1717 uint8_t wipeCard
= 0 ;
1718 uint8_t uid
[ 8 ] = { 0x00 };
1719 uint8_t oldUid
[ 8 ] = { 0x00 };
1720 uint8_t atqa
[ 2 ] = { 0x00 };
1721 uint8_t sak
[ 1 ] = { 0x00 };
1722 uint8_t atqaPresent
= 1 ;
1727 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, argi
) == 'h' ) {
1728 PrintAndLog ( "Usage: hf mf csetuid <UID 8 hex symbols> [ATQA 4 hex symbols SAK 2 hex symbols] [w]" );
1729 PrintAndLog ( "sample: hf mf csetuid 01020304" );
1730 PrintAndLog ( "sample: hf mf csetuid 01020304 0004 08 w" );
1731 PrintAndLog ( "Set UID, ATQA, and SAK for magic Chinese card (only works with such cards)" );
1732 PrintAndLog ( "If you also want to wipe the card then add 'w' at the end of the command line." );
1736 if ( param_getchar ( Cmd
, argi
) && param_gethex ( Cmd
, argi
, uid
, 8 )) {
1737 PrintAndLog ( "UID must include 8 HEX symbols" );
1742 ctmp
= param_getchar ( Cmd
, argi
);
1743 if ( ctmp
== 'w' || ctmp
== 'W' ) {
1749 if ( param_getchar ( Cmd
, argi
)) {
1750 if ( param_gethex ( Cmd
, argi
, atqa
, 4 )) {
1751 PrintAndLog ( "ATQA must include 4 HEX symbols" );
1755 if (! param_getchar ( Cmd
, argi
) || param_gethex ( Cmd
, argi
, sak
, 2 )) {
1756 PrintAndLog ( "SAK must include 2 HEX symbols" );
1765 ctmp
= param_getchar ( Cmd
, argi
);
1766 if ( ctmp
== 'w' || ctmp
== 'W' ) {
1771 PrintAndLog ( "--wipe card:%s uid:%s" , ( wipeCard
)? "YES" : "NO" , sprint_hex ( uid
, 4 ));
1773 res
= mfCSetUID ( uid
, ( atqaPresent
)? atqa
: NULL
, ( atqaPresent
)? sak
: NULL
, oldUid
, wipeCard
);
1775 PrintAndLog ( "Can't set UID. error=%d" , res
);
1779 PrintAndLog ( "old UID:%s" , sprint_hex ( oldUid
, 4 ));
1780 PrintAndLog ( "new UID:%s" , sprint_hex ( uid
, 4 ));
1784 int CmdHF14AMfCSetBlk ( const char * Cmd
)
1786 uint8_t memBlock
[ 16 ] = { 0x00 };
1787 uint8_t blockNo
= 0 ;
1788 bool wipeCard
= false ;
1791 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1792 PrintAndLog ( "Usage: hf mf csetblk <block number> <block data (32 hex symbols)> [w]" );
1793 PrintAndLog ( "sample: hf mf csetblk 1 01020304050607080910111213141516" );
1794 PrintAndLog ( "Set block data for magic Chinese card (only works with such cards)" );
1795 PrintAndLog ( "If you also want wipe the card then add 'w' at the end of the command line" );
1799 blockNo
= param_get8 ( Cmd
, 0 );
1801 if ( param_gethex ( Cmd
, 1 , memBlock
, 32 )) {
1802 PrintAndLog ( "block data must include 32 HEX symbols" );
1806 char ctmp
= param_getchar ( Cmd
, 2 );
1807 wipeCard
= ( ctmp
== 'w' || ctmp
== 'W' );
1808 PrintAndLog ( "--block number:%2d data:%s" , blockNo
, sprint_hex ( memBlock
, 16 ));
1810 res
= mfCSetBlock ( blockNo
, memBlock
, NULL
, wipeCard
, CSETBLOCK_SINGLE_OPER
);
1812 PrintAndLog ( "Can't write block. error=%d" , res
);
1819 int CmdHF14AMfCLoad ( const char * Cmd
)
1822 char filename
[ FILE_PATH_SIZE
] = { 0x00 };
1823 char * fnameptr
= filename
;
1824 char buf
[ 64 ] = { 0x00 };
1825 uint8_t buf8
[ 64 ] = { 0x00 };
1826 uint8_t fillFromEmulator
= 0 ;
1827 int i
, len
, blockNum
, flags
= 0 ;
1829 if ( param_getchar ( Cmd
, 0 ) == 'h' || param_getchar ( Cmd
, 0 )== 0x00 ) {
1830 PrintAndLog ( "It loads magic Chinese card from the file `filename.eml`" );
1831 PrintAndLog ( "or from emulator memory (option `e`)" );
1832 PrintAndLog ( "Usage: hf mf cload <file name w/o `.eml`>" );
1833 PrintAndLog ( " or: hf mf cload e " );
1834 PrintAndLog ( " sample: hf mf cload filename" );
1838 char ctmp
= param_getchar ( Cmd
, 0 );
1839 if ( ctmp
== 'e' || ctmp
== 'E' ) fillFromEmulator
= 1 ;
1841 if ( fillFromEmulator
) {
1842 for ( blockNum
= 0 ; blockNum
< 16 * 4 ; blockNum
+= 1 ) {
1843 if ( mfEmlGetMem ( buf8
, blockNum
, 1 )) {
1844 PrintAndLog ( "Cant get block: %d" , blockNum
);
1847 if ( blockNum
== 0 ) flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
; // switch on field and send magic sequence
1848 if ( blockNum
== 1 ) flags
= 0 ; // just write
1849 if ( blockNum
== 16 * 4 - 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
; // Done. Magic Halt and switch off field.
1851 if ( mfCSetBlock ( blockNum
, buf8
, NULL
, 0 , flags
)) {
1852 PrintAndLog ( "Cant set magic card block: %d" , blockNum
);
1859 if ( len
> FILE_PATH_SIZE
- 5 ) len
= FILE_PATH_SIZE
- 5 ;
1861 memcpy ( filename
, Cmd
, len
);
1864 sprintf ( fnameptr
, ".eml" );
1867 f
= fopen ( filename
, "r" );
1869 PrintAndLog ( "File not found or locked." );
1876 memset ( buf
, 0 , sizeof ( buf
));
1878 if ( fgets ( buf
, sizeof ( buf
), f
) == NULL
) {
1880 PrintAndLog ( "File reading error." );
1884 if ( strlen ( buf
) < 32 ) {
1885 if ( strlen ( buf
) && feof ( f
))
1887 PrintAndLog ( "File content error. Block data must include 32 HEX symbols" );
1891 for ( i
= 0 ; i
< 32 ; i
+= 2 )
1892 sscanf (& buf
[ i
], "%02x" , ( unsigned int *)& buf8
[ i
/ 2 ]);
1894 if ( blockNum
== 0 ) flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
; // switch on field and send magic sequence
1895 if ( blockNum
== 1 ) flags
= 0 ; // just write
1896 if ( blockNum
== 16 * 4 - 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
; // Done. Switch off field.
1898 if ( mfCSetBlock ( blockNum
, buf8
, NULL
, 0 , flags
)) {
1899 PrintAndLog ( "Can't set magic card block: %d" , blockNum
);
1905 if ( blockNum
>= 16 * 4 ) break ; // magic card type - mifare 1K
1909 if ( blockNum
!= 16 * 4 && blockNum
!= 32 * 4 + 8 * 16 ){
1910 PrintAndLog ( "File content error. There must be 64 blocks" );
1913 PrintAndLog ( "Loaded from file: %s" , filename
);
1919 int CmdHF14AMfCGetBlk ( const char * Cmd
) {
1920 uint8_t memBlock
[ 16 ];
1921 uint8_t blockNo
= 0 ;
1923 memset ( memBlock
, 0x00 , sizeof ( memBlock
));
1925 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1926 PrintAndLog ( "Usage: hf mf cgetblk <block number>" );
1927 PrintAndLog ( "sample: hf mf cgetblk 1" );
1928 PrintAndLog ( "Get block data from magic Chinese card (only works with such cards) \n " );
1932 blockNo
= param_get8 ( Cmd
, 0 );
1934 PrintAndLog ( "--block number:%2d " , blockNo
);
1936 res
= mfCGetBlock ( blockNo
, memBlock
, CSETBLOCK_SINGLE_OPER
);
1938 PrintAndLog ( "Can't read block. error=%d" , res
);
1942 PrintAndLog ( "block data:%s" , sprint_hex ( memBlock
, 16 ));
1947 int CmdHF14AMfCGetSc ( const char * Cmd
) {
1948 uint8_t memBlock
[ 16 ] = { 0x00 };
1949 uint8_t sectorNo
= 0 ;
1952 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1953 PrintAndLog ( "Usage: hf mf cgetsc <sector number>" );
1954 PrintAndLog ( "sample: hf mf cgetsc 0" );
1955 PrintAndLog ( "Get sector data from magic Chinese card (only works with such cards) \n " );
1959 sectorNo
= param_get8 ( Cmd
, 0 );
1960 if ( sectorNo
> 15 ) {
1961 PrintAndLog ( "Sector number must be in [0..15] as in MIFARE classic." );
1965 PrintAndLog ( "--sector number:%d " , sectorNo
);
1967 flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
;
1968 for ( i
= 0 ; i
< 4 ; i
++) {
1969 if ( i
== 1 ) flags
= 0 ;
1970 if ( i
== 3 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
;
1972 res
= mfCGetBlock ( sectorNo
* 4 + i
, memBlock
, flags
);
1974 PrintAndLog ( "Can't read block. %d error=%d" , sectorNo
* 4 + i
, res
);
1978 PrintAndLog ( "block %3d data:%s" , sectorNo
* 4 + i
, sprint_hex ( memBlock
, 16 ));
1984 int CmdHF14AMfCSave ( const char * Cmd
) {
1987 char filename
[ FILE_PATH_SIZE
] = { 0x00 };
1988 char * fnameptr
= filename
;
1989 uint8_t fillFromEmulator
= 0 ;
1990 uint8_t buf
[ 64 ] = { 0x00 };
1991 int i
, j
, len
, flags
;
1993 // memset(filename, 0, sizeof(filename));
1994 // memset(buf, 0, sizeof(buf));
1996 if ( param_getchar ( Cmd
, 0 ) == 'h' ) {
1997 PrintAndLog ( "It saves `magic Chinese` card dump into the file `filename.eml` or `cardID.eml`" );
1998 PrintAndLog ( "or into emulator memory (option `e`)" );
1999 PrintAndLog ( "Usage: hf mf esave [file name w/o `.eml`][e]" );
2000 PrintAndLog ( " sample: hf mf esave " );
2001 PrintAndLog ( " hf mf esave filename" );
2002 PrintAndLog ( " hf mf esave e \n " );
2006 char ctmp
= param_getchar ( Cmd
, 0 );
2007 if ( ctmp
== 'e' || ctmp
== 'E' ) fillFromEmulator
= 1 ;
2009 if ( fillFromEmulator
) {
2010 // put into emulator
2011 flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
;
2012 for ( i
= 0 ; i
< 16 * 4 ; i
++) {
2013 if ( i
== 1 ) flags
= 0 ;
2014 if ( i
== 16 * 4 - 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
;
2016 if ( mfCGetBlock ( i
, buf
, flags
)) {
2017 PrintAndLog ( "Cant get block: %d" , i
);
2021 if ( mfEmlSetMem ( buf
, i
, 1 )) {
2022 PrintAndLog ( "Cant set emul block: %d" , i
);
2029 if ( len
> FILE_PATH_SIZE
- 5 ) len
= FILE_PATH_SIZE
- 5 ;
2033 if ( mfCGetBlock ( 0 , buf
, CSETBLOCK_SINGLE_OPER
)) {
2034 PrintAndLog ( "Cant get block: %d" , 0 );
2035 len
= sprintf ( fnameptr
, "dump" );
2039 for ( j
= 0 ; j
< 7 ; j
++, fnameptr
+= 2 )
2040 sprintf ( fnameptr
, "%02x" , buf
[ j
]);
2043 memcpy ( filename
, Cmd
, len
);
2047 sprintf ( fnameptr
, ".eml" );
2050 f
= fopen ( filename
, "w+" );
2053 PrintAndLog ( "File not found or locked." );
2058 flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
;
2059 for ( i
= 0 ; i
< 16 * 4 ; i
++) {
2060 if ( i
== 1 ) flags
= 0 ;
2061 if ( i
== 16 * 4 - 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
;
2063 if ( mfCGetBlock ( i
, buf
, flags
)) {
2064 PrintAndLog ( "Cant get block: %d" , i
);
2067 for ( j
= 0 ; j
< 16 ; j
++)
2068 fprintf ( f
, "%02x" , buf
[ j
]);
2073 PrintAndLog ( "Saved to file: %s" , filename
);
2080 int CmdHF14AMfSniff ( const char * Cmd
){
2082 bool wantLogToFile
= 0 ;
2083 bool wantDecrypt
= 0 ;
2084 //bool wantSaveToEml = 0; TODO
2085 bool wantSaveToEmlFile
= 0 ;
2095 uint8_t atqa
[ 2 ] = { 0x00 };
2098 uint8_t * buf
= NULL
;
2099 uint16_t bufsize
= 0 ;
2100 uint8_t * bufPtr
= NULL
;
2102 char ctmp
= param_getchar ( Cmd
, 0 );
2103 if ( ctmp
== 'h' || ctmp
== 'H' ) {
2104 PrintAndLog ( "It continuously gets data from the field and saves it to: log, emulator, emulator file." );
2105 PrintAndLog ( "You can specify:" );
2106 PrintAndLog ( " l - save encrypted sequence to logfile `uid.log`" );
2107 PrintAndLog ( " d - decrypt sequence and put it to log file `uid.log`" );
2108 PrintAndLog ( " n/a e - decrypt sequence, collect read and write commands and save the result of the sequence to emulator memory" );
2109 PrintAndLog ( " f - decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`" );
2110 PrintAndLog ( "Usage: hf mf sniff [l][d][e][f]" );
2111 PrintAndLog ( " sample: hf mf sniff l d e" );
2115 for ( int i
= 0 ; i
< 4 ; i
++) {
2116 ctmp
= param_getchar ( Cmd
, i
);
2117 if ( ctmp
== 'l' || ctmp
== 'L' ) wantLogToFile
= true ;
2118 if ( ctmp
== 'd' || ctmp
== 'D' ) wantDecrypt
= true ;
2119 //if (ctmp == 'e' || ctmp == 'E') wantSaveToEml = true; TODO
2120 if ( ctmp
== 'f' || ctmp
== 'F' ) wantSaveToEmlFile
= true ;
2123 printf ( "------------------------------------------------------------------------- \n " );
2124 printf ( "Executing command. \n " );
2125 printf ( "Press the key on the proxmark3 device to abort both proxmark3 and client. \n " );
2126 printf ( "Press the key on pc keyboard to abort the client. \n " );
2127 printf ( "------------------------------------------------------------------------- \n " );
2129 UsbCommand c
= { CMD_MIFARE_SNIFFER
, { 0 , 0 , 0 }};
2130 clearCommandBuffer ();
2139 printf ( " \n aborted via keyboard! \n " );
2144 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 2000 )) {
2145 res
= resp
. arg
[ 0 ] & 0xff ;
2146 uint16_t traceLen
= resp
. arg
[ 1 ];
2149 if ( res
== 0 ) { // we are done
2154 if ( res
== 1 ) { // there is (more) data to be transferred
2155 if ( pckNum
== 0 ) { // first packet, (re)allocate necessary buffer
2156 if ( traceLen
> bufsize
|| buf
== NULL
) {
2158 if ( buf
== NULL
) { // not yet allocated
2159 p
= malloc ( traceLen
);
2160 } else { // need more memory
2161 p
= realloc ( buf
, traceLen
);
2164 PrintAndLog ( "Cannot allocate memory for trace" );
2172 memset ( buf
, 0x00 , traceLen
);
2174 memcpy ( bufPtr
, resp
. d
. asBytes
, len
);
2179 if ( res
== 2 ) { // received all data, start displaying
2180 blockLen
= bufPtr
- buf
;
2183 PrintAndLog ( "received trace len: %d packages: %d" , blockLen
, pckNum
);
2184 while ( bufPtr
- buf
< blockLen
) {
2185 bufPtr
+= 6 ; // skip (void) timing information
2186 len
= *(( uint16_t *) bufPtr
);
2194 if (( len
== 14 ) && ( bufPtr
[ 0 ] == 0xff ) && ( bufPtr
[ 1 ] == 0xff ) && ( bufPtr
[ 12 ] == 0xff ) && ( bufPtr
[ 13 ] == 0xff )) {
2195 memcpy ( uid
, bufPtr
+ 2 , 7 );
2196 memcpy ( atqa
, bufPtr
+ 2 + 7 , 2 );
2197 uid_len
= ( atqa
[ 0 ] & 0xC0 ) == 0x40 ? 7 : 4 ;
2199 PrintAndLog ( "tag select uid:%s atqa:0x%02x%02x sak:0x%02x" ,
2200 sprint_hex ( uid
+ ( 7 - uid_len
), uid_len
),
2204 if ( wantLogToFile
|| wantDecrypt
) {
2205 FillFileNameByUID ( logHexFileName
, uid
+ ( 7 - uid_len
), ".log" , uid_len
);
2206 AddLogCurrentDT ( logHexFileName
);
2209 mfTraceInit ( uid
, atqa
, sak
, wantSaveToEmlFile
);
2211 PrintAndLog ( "%s(%d):%s" , isTag
? "TAG" : "RDR" , num
, sprint_hex ( bufPtr
, len
));
2213 AddLogHex ( logHexFileName
, isTag
? "TAG: " : "RDR: " , bufPtr
, len
);
2215 mfTraceDecode ( bufPtr
, len
, wantSaveToEmlFile
);
2219 bufPtr
+= (( len
- 1 )/ 8 + 1 ); // ignore parity
2230 //needs nt, ar, at, Data to decrypt
2231 int CmdDecryptTraceCmds ( const char * Cmd
){
2234 param_gethex_ex ( Cmd
, 3 , data
,& len
);
2235 return tryDecryptWord ( param_get32ex ( Cmd
, 0 , 0 , 16 ), param_get32ex ( Cmd
, 1 , 0 , 16 ), param_get32ex ( Cmd
, 2 , 0 , 16 ), data
, len
/ 2 );
2238 static command_t CommandTable
[] =
2240 { "help" , CmdHelp
, 1 , "This help" },
2241 { "dbg" , CmdHF14AMfDbg
, 0 , "Set default debug mode" },
2242 { "rdbl" , CmdHF14AMfRdBl
, 0 , "Read MIFARE classic block" },
2243 { "rdsc" , CmdHF14AMfRdSc
, 0 , "Read MIFARE classic sector" },
2244 { "dump" , CmdHF14AMfDump
, 0 , "Dump MIFARE classic tag to binary file" },
2245 { "restore" , CmdHF14AMfRestore
, 0 , "Restore MIFARE classic binary file to BLANK tag" },
2246 { "wrbl" , CmdHF14AMfWrBl
, 0 , "Write MIFARE classic block" },
2247 { "chk" , CmdHF14AMfChk
, 0 , "Test block keys" },
2248 { "mifare" , CmdHF14AMifare
, 0 , "Read parity error messages." },
2249 { "nested" , CmdHF14AMfNested
, 0 , "Test nested authentication" },
2250 { "sniff" , CmdHF14AMfSniff
, 0 , "Sniff card-reader communication" },
2251 { "sim" , CmdHF14AMf1kSim
, 0 , "Simulate MIFARE card" },
2252 { "eclr" , CmdHF14AMfEClear
, 0 , "Clear simulator memory block" },
2253 { "eget" , CmdHF14AMfEGet
, 0 , "Get simulator memory block" },
2254 { "eset" , CmdHF14AMfESet
, 0 , "Set simulator memory block" },
2255 { "eload" , CmdHF14AMfELoad
, 0 , "Load from file emul dump" },
2256 { "esave" , CmdHF14AMfESave
, 0 , "Save to file emul dump" },
2257 { "ecfill" , CmdHF14AMfECFill
, 0 , "Fill simulator memory with help of keys from simulator" },
2258 { "ekeyprn" , CmdHF14AMfEKeyPrn
, 0 , "Print keys from simulator memory" },
2259 { "csetuid" , CmdHF14AMfCSetUID
, 0 , "Set UID for magic Chinese card" },
2260 { "csetblk" , CmdHF14AMfCSetBlk
, 0 , "Write block - Magic Chinese card" },
2261 { "cgetblk" , CmdHF14AMfCGetBlk
, 0 , "Read block - Magic Chinese card" },
2262 { "cgetsc" , CmdHF14AMfCGetSc
, 0 , "Read sector - Magic Chinese card" },
2263 { "cload" , CmdHF14AMfCLoad
, 0 , "Load dump into magic Chinese card" },
2264 { "csave" , CmdHF14AMfCSave
, 0 , "Save dump from magic Chinese card into file or emulator" },
2265 { "decrypt" , CmdDecryptTraceCmds
, 1 , "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace" },
2266 { NULL
, NULL
, 0 , NULL
}
2269 int CmdHFMF ( const char * Cmd
)
2272 WaitForResponseTimeout ( CMD_ACK
, NULL
, 100 );
2274 CmdsParse ( CommandTable
, Cmd
);
2278 int CmdHelp ( const char * Cmd
)
2280 CmdsHelp ( CommandTable
);