]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/mifarehost.c
fb6a4bdbed7172ee4959c801c57427bb3f9ba18c
2 // people from mifare@nethemba.com, 2010
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // High frequency ISO14443A commands
9 //-----------------------------------------------------------------------------
14 #include "mifarehost.h"
17 int compar_int(const void * a
, const void * b
) {
18 return (*(uint64_t*)b
- *(uint64_t*)a
);
21 // Compare countKeys structure
22 int compar_special_int(const void * a
, const void * b
) {
23 return (((countKeys
*)b
)->count
- ((countKeys
*)a
)->count
);
26 countKeys
* uniqsort(uint64_t * possibleKeys
, uint32_t size
) {
29 countKeys
*our_counts
;
31 qsort(possibleKeys
, size
, sizeof (uint64_t), compar_int
);
33 our_counts
= calloc(size
, sizeof(countKeys
));
34 if (our_counts
== NULL
) {
35 PrintAndLog("Memory allocation error for our_counts");
39 for (i
= 0; i
< size
; i
++) {
40 if (possibleKeys
[i
+1] == possibleKeys
[i
]) {
43 our_counts
[j
].key
= possibleKeys
[i
];
44 our_counts
[j
].count
= count
;
49 qsort(our_counts
, j
, sizeof(countKeys
), compar_special_int
);
53 int mfnested(uint8_t blockNo
, uint8_t keyType
, uint8_t * key
, uint8_t trgBlockNo
, uint8_t trgKeyType
, uint8_t * resultKeys
)
58 fnVector
* vector
= NULL
;
61 UsbCommand
* resp
= NULL
;
63 memset(resultKeys
, 0x00, 16 * 6);
66 while (WaitForResponseTimeout(CMD_ACK
, 500) != NULL
) ;
68 UsbCommand c
= {CMD_MIFARE_NESTED
, {blockNo
, keyType
, trgBlockNo
+ trgKeyType
* 0x100}};
69 memcpy(c
.d
.asBytes
, key
, 6);
79 printf("\naborted via keyboard!\n");
83 resp
= WaitForResponseTimeout(CMD_ACK
, 1500);
86 isEOF
= resp
->arg
[0] & 0xff;
90 len
= resp
->arg
[1] & 0xff;
91 if (len
== 0) continue;
93 memcpy(&uid
, resp
->d
.asBytes
, 4);
94 PrintAndLog("uid:%08x len=%d trgbl=%d trgkey=%x", uid
, len
, resp
->arg
[2] & 0xff, (resp
->arg
[2] >> 8) & 0xff);
95 vector
= (fnVector
*) realloc((void *)vector
, (lenVector
+ len
) * sizeof(fnVector
) + 200);
97 PrintAndLog("Memory allocation error for fnVector. len: %d bytes: %d", lenVector
+ len
, (lenVector
+ len
) * sizeof(fnVector
));
101 for (i
= 0; i
< len
; i
++) {
102 vector
[lenVector
+ i
].blockNo
= resp
->arg
[2] & 0xff;
103 vector
[lenVector
+ i
].keyType
= (resp
->arg
[2] >> 8) & 0xff;
104 vector
[lenVector
+ i
].uid
= uid
;
106 memcpy(&vector
[lenVector
+ i
].nt
, (void *)(resp
->d
.asBytes
+ 8 + i
* 8 + 0), 4);
107 memcpy(&vector
[lenVector
+ i
].ks1
, (void *)(resp
->d
.asBytes
+ 8 + i
* 8 + 4), 4);
115 PrintAndLog("Got 0 keys from proxmark.");
118 printf("------------------------------------------------------------------\n");
121 struct Crypto1State
* revstate
= NULL
;
122 struct Crypto1State
* revstate_start
= NULL
;
127 if ((pk
= (void *) malloc(sizeof(pKeys
))) == NULL
) return 1;
128 memset(pk
, 0x00, sizeof(pKeys
));
130 for (m
= 0; m
< lenVector
; m
++) {
131 // And finally recover the first 32 bits of the key
132 revstate
= lfsr_recovery32(vector
[m
].ks1
, vector
[m
].nt
^ vector
[m
].uid
);
133 if (revstate_start
== NULL
) revstate_start
= revstate
;
135 while ((revstate
->odd
!= 0x0) || (revstate
->even
!= 0x0)) {
136 lfsr_rollback_word(revstate
, vector
[m
].nt
^ vector
[m
].uid
, 0);
137 crypto1_get_lfsr(revstate
, &lfsr
);
139 // Allocate a new space for keys
140 if (((kcount
% MEM_CHUNK
) == 0) || (kcount
>= pk
->size
)) {
141 pk
->size
+= MEM_CHUNK
;
142 //fprintf(stdout, "New chunk by %d, sizeof %d\n", kcount, pk->size * sizeof(uint64_t));
143 pk
->possibleKeys
= (uint64_t *) realloc((void *)pk
->possibleKeys
, pk
->size
* sizeof(uint64_t));
144 if (pk
->possibleKeys
== NULL
) {
145 PrintAndLog("Memory allocation error for pk->possibleKeys");
149 pk
->possibleKeys
[kcount
] = lfsr
;
153 free(revstate_start
);
154 revstate_start
= NULL
;
161 if ((pk
->possibleKeys
= (uint64_t *) realloc((void *)pk
->possibleKeys
, pk
->size
* sizeof(uint64_t))) == NULL
) {
162 PrintAndLog("Memory allocation error for pk->possibleKeys");
167 PrintAndLog("Total keys count:%d", kcount
);
168 ck
= uniqsort(pk
->possibleKeys
, pk
->size
);
171 for (i
= 0; i
< 16 ; i
++) {
172 num_to_bytes(ck
[i
].key
, 6, (uint8_t*)(resultKeys
+ i
* 6));
176 free(pk
->possibleKeys
);
184 int mfCheckKeys (uint8_t blockNo
, uint8_t keyType
, uint8_t keycnt
, uint8_t * keyBlock
, uint64_t * key
){
187 UsbCommand c
= {CMD_MIFARE_CHKKEYS
, {blockNo
, keyType
, keycnt
}};
188 memcpy(c
.d
.asBytes
, keyBlock
, 6 * keycnt
);
192 UsbCommand
* resp
= WaitForResponseTimeout(CMD_ACK
, 3000);
194 if (resp
== NULL
) return 1;
195 if ((resp
->arg
[0] & 0xff) != 0x01) return 2;
196 *key
= bytes_to_num(resp
->d
.asBytes
, 6);
200 int mfEmlGetMem(uint8_t *data
, int blockNum
, int blocksCount
) {
201 UsbCommand c
= {CMD_MIFARE_EML_MEMGET
, {blockNum
, blocksCount
, 0}};
205 UsbCommand
* resp
= WaitForResponseTimeout(CMD_ACK
, 1500);
207 if (resp
== NULL
) return 1;
208 memcpy(data
, resp
->d
.asBytes
, blocksCount
* 16);
212 int mfEmlSetMem(uint8_t *data
, int blockNum
, int blocksCount
) {
213 UsbCommand c
= {CMD_MIFARE_EML_MEMSET
, {blockNum
, blocksCount
, 0}};
214 memcpy(c
.d
.asBytes
, data
, blocksCount
* 16);
219 int mfCSetUID(uint8_t *uid
, uint8_t *oldUID
, int wantWipe
) {
221 memset(block0
, 0, 16);
222 memcpy(block0
, uid
, 4);
223 block0
[4] = block0
[0]^block0
[1]^block0
[2]^block0
[3]; // Mifare UID BCC
224 // mifare classic SAK(byte 5) and ATQA(byte 6 and 7)
229 return mfCSetBlock(0, block0
, oldUID
, wantWipe
, CSETBLOCK_SINGLE_OPER
);
232 int mfCSetBlock(uint8_t blockNo
, uint8_t *data
, uint8_t *uid
, int wantWipe
, uint8_t params
) {
235 UsbCommand c
= {CMD_MIFARE_EML_CSETBLOCK
, {wantWipe
, params
& (0xFE | (uid
== NULL
? 0:1)), blockNo
}};
236 memcpy(c
.d
.asBytes
, data
, 16);
239 UsbCommand
* resp
= WaitForResponseTimeout(CMD_ACK
, 1500);
242 isOK
= resp
->arg
[0] & 0xff;
243 if (uid
!= NULL
) memcpy(uid
, resp
->d
.asBytes
, 4);
246 PrintAndLog("Command execute timeout");
252 int mfCGetBlock(uint8_t blockNo
, uint8_t *data
, uint8_t params
) {
255 UsbCommand c
= {CMD_MIFARE_EML_CGETBLOCK
, {params
, 0, blockNo
}};
258 UsbCommand
* resp
= WaitForResponseTimeout(CMD_ACK
, 1500);
261 isOK
= resp
->arg
[0] & 0xff;
262 memcpy(data
, resp
->d
.asBytes
, 16);
265 PrintAndLog("Command execute timeout");