]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhfmf.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2011,2012 Merlok
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // High frequency MIFARE commands
9 //-----------------------------------------------------------------------------
16 #include "proxmark3.h"
20 #include "mifarehost.h"
24 #define NESTED_SECTOR_RETRY 10 // how often we try mfested() until we give up
27 static int CmdHelp ( const char * Cmd
);
30 int CmdHF14AMifare ( const char * Cmd
)
35 isOK
= mfDarkside (& key
);
37 case - 1 : PrintAndLog ( "Button pressed. Aborted." ); return 1 ;
38 case - 2 : PrintAndLog ( "Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests)." ); return 1 ;
39 case - 3 : PrintAndLog ( "Card is not vulnerable to Darkside attack (its random number generator is not predictable)." ); return 1 ;
40 case - 4 : PrintAndLog ( "Card is not vulnerable to Darkside attack (its random number generator seems to be based on the wellknown" );
41 PrintAndLog ( "generating polynomial with 16 effective bits only, but shows unexpected behaviour." ); return 1 ;
42 case - 5 : PrintAndLog ( "Aborted via keyboard." ); return 1 ;
43 default : PrintAndLog ( "Found valid key:%012" PRIx64
" \n " , key
);
51 int CmdHF14AMfWrBl ( const char * Cmd
)
55 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
56 uint8_t bldata
[ 16 ] = { 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 };
61 PrintAndLog ( "Usage: hf mf wrbl <block number> <key A/B> <key (12 hex symbols)> <block data (32 hex symbols)>" );
62 PrintAndLog ( " sample: hf mf wrbl 0 A FFFFFFFFFFFF 000102030405060708090A0B0C0D0E0F" );
66 blockNo
= param_get8 ( Cmd
, 0 );
67 cmdp
= param_getchar ( Cmd
, 1 );
69 PrintAndLog ( "Key type must be A or B" );
72 if ( cmdp
!= 'A' && cmdp
!= 'a' ) keyType
= 1 ;
73 if ( param_gethex ( Cmd
, 2 , key
, 12 )) {
74 PrintAndLog ( "Key must include 12 HEX symbols" );
77 if ( param_gethex ( Cmd
, 3 , bldata
, 32 )) {
78 PrintAndLog ( "Block data must include 32 HEX symbols" );
81 PrintAndLog ( "--block no:%d, key type:%c, key:%s" , blockNo
, keyType
? 'B' : 'A' , sprint_hex ( key
, 6 ));
82 PrintAndLog ( "--data: %s" , sprint_hex ( bldata
, 16 ));
84 UsbCommand c
= { CMD_MIFARE_WRITEBL
, { blockNo
, keyType
, 0 }};
85 memcpy ( c
. d
. asBytes
, key
, 6 );
86 memcpy ( c
. d
. asBytes
+ 10 , bldata
, 16 );
90 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
91 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
92 PrintAndLog ( "isOk:%02x" , isOK
);
94 PrintAndLog ( "Command execute timeout" );
100 int CmdHF14AMfRdBl ( const char * Cmd
)
104 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
110 PrintAndLog ( "Usage: hf mf rdbl <block number> <key A/B> <key (12 hex symbols)>" );
111 PrintAndLog ( " sample: hf mf rdbl 0 A FFFFFFFFFFFF " );
115 blockNo
= param_get8 ( Cmd
, 0 );
116 cmdp
= param_getchar ( Cmd
, 1 );
118 PrintAndLog ( "Key type must be A or B" );
121 if ( cmdp
!= 'A' && cmdp
!= 'a' ) keyType
= 1 ;
122 if ( param_gethex ( Cmd
, 2 , key
, 12 )) {
123 PrintAndLog ( "Key must include 12 HEX symbols" );
126 PrintAndLog ( "--block no:%d, key type:%c, key:%s " , blockNo
, keyType
? 'B' : 'A' , sprint_hex ( key
, 6 ));
128 UsbCommand c
= { CMD_MIFARE_READBL
, { blockNo
, keyType
, 0 }};
129 memcpy ( c
. d
. asBytes
, key
, 6 );
133 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
134 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
135 uint8_t * data
= resp
. d
. asBytes
;
138 PrintAndLog ( "isOk:%02x data:%s" , isOK
, sprint_hex ( data
, 16 ));
140 PrintAndLog ( "isOk:%02x" , isOK
);
142 PrintAndLog ( "Command execute timeout" );
148 int CmdHF14AMfRdSc ( const char * Cmd
)
151 uint8_t sectorNo
= 0 ;
153 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
155 uint8_t * data
= NULL
;
159 PrintAndLog ( "Usage: hf mf rdsc <sector number> <key A/B> <key (12 hex symbols)>" );
160 PrintAndLog ( " sample: hf mf rdsc 0 A FFFFFFFFFFFF " );
164 sectorNo
= param_get8 ( Cmd
, 0 );
166 PrintAndLog ( "Sector number must be less than 40" );
169 cmdp
= param_getchar ( Cmd
, 1 );
170 if ( cmdp
!= 'a' && cmdp
!= 'A' && cmdp
!= 'b' && cmdp
!= 'B' ) {
171 PrintAndLog ( "Key type must be A or B" );
174 if ( cmdp
!= 'A' && cmdp
!= 'a' ) keyType
= 1 ;
175 if ( param_gethex ( Cmd
, 2 , key
, 12 )) {
176 PrintAndLog ( "Key must include 12 HEX symbols" );
179 PrintAndLog ( "--sector no:%d key type:%c key:%s " , sectorNo
, keyType
? 'B' : 'A' , sprint_hex ( key
, 6 ));
181 UsbCommand c
= { CMD_MIFARE_READSC
, { sectorNo
, keyType
, 0 }};
182 memcpy ( c
. d
. asBytes
, key
, 6 );
187 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
188 isOK
= resp
. arg
[ 0 ] & 0xff ;
189 data
= resp
. d
. asBytes
;
191 PrintAndLog ( "isOk:%02x" , isOK
);
193 for ( i
= 0 ; i
< ( sectorNo
< 32 ? 3 : 15 ); i
++) {
194 PrintAndLog ( "data : %s" , sprint_hex ( data
+ i
* 16 , 16 ));
196 PrintAndLog ( "trailer: %s" , sprint_hex ( data
+ ( sectorNo
< 32 ? 3 : 15 ) * 16 , 16 ));
199 PrintAndLog ( "Command execute timeout" );
205 uint8_t FirstBlockOfSector ( uint8_t sectorNo
)
210 return 32 * 4 + ( sectorNo
- 32 ) * 16 ;
214 uint8_t NumBlocksPerSector ( uint8_t sectorNo
)
223 int CmdHF14AMfDump ( const char * Cmd
)
225 uint8_t sectorNo
, blockNo
;
229 uint8_t rights
[ 40 ][ 4 ];
230 uint8_t carddata
[ 256 ][ 16 ];
231 uint8_t numSectors
= 16 ;
238 char cmdp
= param_getchar ( Cmd
, 0 );
240 case '0' : numSectors
= 5 ; break ;
242 case '\0' : numSectors
= 16 ; break ;
243 case '2' : numSectors
= 32 ; break ;
244 case '4' : numSectors
= 40 ; break ;
245 default : numSectors
= 16 ;
248 if ( strlen ( Cmd
) > 1 || cmdp
== 'h' || cmdp
== 'H' ) {
249 PrintAndLog ( "Usage: hf mf dump [card memory]" );
250 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
252 PrintAndLog ( "Samples: hf mf dump" );
253 PrintAndLog ( " hf mf dump 4" );
257 if (( fin
= fopen ( "dumpkeys.bin" , "rb" )) == NULL
) {
258 PrintAndLog ( "Could not find file dumpkeys.bin" );
262 // Read keys A from file
263 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
264 size_t bytes_read
= fread ( keyA
[ sectorNo
], 1 , 6 , fin
);
265 if ( bytes_read
!= 6 ) {
266 PrintAndLog ( "File reading error." );
272 // Read keys B from file
273 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
274 size_t bytes_read
= fread ( keyB
[ sectorNo
], 1 , 6 , fin
);
275 if ( bytes_read
!= 6 ) {
276 PrintAndLog ( "File reading error." );
284 PrintAndLog ( "|-----------------------------------------|" );
285 PrintAndLog ( "|------ Reading sector access bits...-----|" );
286 PrintAndLog ( "|-----------------------------------------|" );
288 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
289 for ( tries
= 0 ; tries
< 3 ; tries
++) {
290 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + NumBlocksPerSector ( sectorNo
) - 1 , 0 , 0 }};
291 memcpy ( c
. d
. asBytes
, keyA
[ sectorNo
], 6 );
294 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
295 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
296 uint8_t * data
= resp
. d
. asBytes
;
298 rights
[ sectorNo
][ 0 ] = (( data
[ 7 ] & 0x10 )>> 2 ) | (( data
[ 8 ] & 0x1 )<< 1 ) | (( data
[ 8 ] & 0x10 )>> 4 ); // C1C2C3 for data area 0
299 rights
[ sectorNo
][ 1 ] = (( data
[ 7 ] & 0x20 )>> 3 ) | (( data
[ 8 ] & 0x2 )<< 0 ) | (( data
[ 8 ] & 0x20 )>> 5 ); // C1C2C3 for data area 1
300 rights
[ sectorNo
][ 2 ] = (( data
[ 7 ] & 0x40 )>> 4 ) | (( data
[ 8 ] & 0x4 )>> 1 ) | (( data
[ 8 ] & 0x40 )>> 6 ); // C1C2C3 for data area 2
301 rights
[ sectorNo
][ 3 ] = (( data
[ 7 ] & 0x80 )>> 5 ) | (( data
[ 8 ] & 0x8 )>> 2 ) | (( data
[ 8 ] & 0x80 )>> 7 ); // C1C2C3 for sector trailer
303 } else if ( tries
== 2 ) { // on last try set defaults
304 PrintAndLog ( "Could not get access rights for sector %2d. Trying with defaults..." , sectorNo
);
305 rights
[ sectorNo
][ 0 ] = rights
[ sectorNo
][ 1 ] = rights
[ sectorNo
][ 2 ] = 0x00 ;
306 rights
[ sectorNo
][ 3 ] = 0x01 ;
309 PrintAndLog ( "Command execute timeout when trying to read access rights for sector %2d. Trying with defaults..." , sectorNo
);
310 rights
[ sectorNo
][ 0 ] = rights
[ sectorNo
][ 1 ] = rights
[ sectorNo
][ 2 ] = 0x00 ;
311 rights
[ sectorNo
][ 3 ] = 0x01 ;
316 PrintAndLog ( "|-----------------------------------------|" );
317 PrintAndLog ( "|----- Dumping all blocks to file... -----|" );
318 PrintAndLog ( "|-----------------------------------------|" );
321 for ( sectorNo
= 0 ; isOK
&& sectorNo
< numSectors
; sectorNo
++) {
322 for ( blockNo
= 0 ; isOK
&& blockNo
< NumBlocksPerSector ( sectorNo
); blockNo
++) {
323 bool received
= false ;
324 for ( tries
= 0 ; tries
< 3 ; tries
++) {
325 if ( blockNo
== NumBlocksPerSector ( sectorNo
) - 1 ) { // sector trailer. At least the Access Conditions can always be read with key A.
326 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, 0 , 0 }};
327 memcpy ( c
. d
. asBytes
, keyA
[ sectorNo
], 6 );
329 received
= WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 );
330 } else { // data block. Check if it can be read with key A or key B
331 uint8_t data_area
= sectorNo
< 32 ? blockNo
: blockNo
/ 5 ;
332 if (( rights
[ sectorNo
][ data_area
] == 0x03 ) || ( rights
[ sectorNo
][ data_area
] == 0x05 )) { // only key B would work
333 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, 1 , 0 }};
334 memcpy ( c
. d
. asBytes
, keyB
[ sectorNo
], 6 );
336 received
= WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 );
337 } else if ( rights
[ sectorNo
][ data_area
] == 0x07 ) { // no key would work
339 PrintAndLog ( "Access rights do not allow reading of sector %2d block %3d" , sectorNo
, blockNo
);
341 } else { // key A would work
342 UsbCommand c
= { CMD_MIFARE_READBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, 0 , 0 }};
343 memcpy ( c
. d
. asBytes
, keyA
[ sectorNo
], 6 );
345 received
= WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 );
349 isOK
= resp
. arg
[ 0 ] & 0xff ;
355 isOK
= resp
. arg
[ 0 ] & 0xff ;
356 uint8_t * data
= resp
. d
. asBytes
;
357 if ( blockNo
== NumBlocksPerSector ( sectorNo
) - 1 ) { // sector trailer. Fill in the keys.
358 data
[ 0 ] = ( keyA
[ sectorNo
][ 0 ]);
359 data
[ 1 ] = ( keyA
[ sectorNo
][ 1 ]);
360 data
[ 2 ] = ( keyA
[ sectorNo
][ 2 ]);
361 data
[ 3 ] = ( keyA
[ sectorNo
][ 3 ]);
362 data
[ 4 ] = ( keyA
[ sectorNo
][ 4 ]);
363 data
[ 5 ] = ( keyA
[ sectorNo
][ 5 ]);
364 data
[ 10 ] = ( keyB
[ sectorNo
][ 0 ]);
365 data
[ 11 ] = ( keyB
[ sectorNo
][ 1 ]);
366 data
[ 12 ] = ( keyB
[ sectorNo
][ 2 ]);
367 data
[ 13 ] = ( keyB
[ sectorNo
][ 3 ]);
368 data
[ 14 ] = ( keyB
[ sectorNo
][ 4 ]);
369 data
[ 15 ] = ( keyB
[ sectorNo
][ 5 ]);
372 memcpy ( carddata
[ FirstBlockOfSector ( sectorNo
) + blockNo
], data
, 16 );
373 PrintAndLog ( "Successfully read block %2d of sector %2d." , blockNo
, sectorNo
);
375 PrintAndLog ( "Could not read block %2d of sector %2d" , blockNo
, sectorNo
);
381 PrintAndLog ( "Command execute timeout when trying to read block %2d of sector %2d." , blockNo
, sectorNo
);
388 if (( fout
= fopen ( "dumpdata.bin" , "wb" )) == NULL
) {
389 PrintAndLog ( "Could not create file name dumpdata.bin" );
392 uint16_t numblocks
= FirstBlockOfSector ( numSectors
- 1 ) + NumBlocksPerSector ( numSectors
- 1 );
393 fwrite ( carddata
, 1 , 16 * numblocks
, fout
);
395 PrintAndLog ( "Dumped %d blocks (%d bytes) to file dumpdata.bin" , numblocks
, 16 * numblocks
);
401 int CmdHF14AMfRestore ( const char * Cmd
)
403 uint8_t sectorNo
, blockNo
;
405 uint8_t key
[ 6 ] = { 0xFF , 0xFF , 0xFF , 0xFF , 0xFF , 0xFF };
406 uint8_t bldata
[ 16 ] = { 0x00 };
414 char cmdp
= param_getchar ( Cmd
, 0 );
416 case '0' : numSectors
= 5 ; break ;
418 case '\0' : numSectors
= 16 ; break ;
419 case '2' : numSectors
= 32 ; break ;
420 case '4' : numSectors
= 40 ; break ;
421 default : numSectors
= 16 ;
424 if ( strlen ( Cmd
) > 1 || cmdp
== 'h' || cmdp
== 'H' ) {
425 PrintAndLog ( "Usage: hf mf restore [card memory]" );
426 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
428 PrintAndLog ( "Samples: hf mf restore" );
429 PrintAndLog ( " hf mf restore 4" );
433 if (( fkeys
= fopen ( "dumpkeys.bin" , "rb" )) == NULL
) {
434 PrintAndLog ( "Could not find file dumpkeys.bin" );
438 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
439 size_t bytes_read
= fread ( keyA
[ sectorNo
], 1 , 6 , fkeys
);
440 if ( bytes_read
!= 6 ) {
441 PrintAndLog ( "File reading error (dumpkeys.bin)." );
447 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
448 size_t bytes_read
= fread ( keyB
[ sectorNo
], 1 , 6 , fkeys
);
449 if ( bytes_read
!= 6 ) {
450 PrintAndLog ( "File reading error (dumpkeys.bin)." );
458 if (( fdump
= fopen ( "dumpdata.bin" , "rb" )) == NULL
) {
459 PrintAndLog ( "Could not find file dumpdata.bin" );
462 PrintAndLog ( "Restoring dumpdata.bin to card" );
464 for ( sectorNo
= 0 ; sectorNo
< numSectors
; sectorNo
++) {
465 for ( blockNo
= 0 ; blockNo
< NumBlocksPerSector ( sectorNo
); blockNo
++) {
466 UsbCommand c
= { CMD_MIFARE_WRITEBL
, { FirstBlockOfSector ( sectorNo
) + blockNo
, keyType
, 0 }};
467 memcpy ( c
. d
. asBytes
, key
, 6 );
469 size_t bytes_read
= fread ( bldata
, 1 , 16 , fdump
);
470 if ( bytes_read
!= 16 ) {
471 PrintAndLog ( "File reading error (dumpdata.bin)." );
476 if ( blockNo
== NumBlocksPerSector ( sectorNo
) - 1 ) { // sector trailer
477 bldata
[ 0 ] = ( keyA
[ sectorNo
][ 0 ]);
478 bldata
[ 1 ] = ( keyA
[ sectorNo
][ 1 ]);
479 bldata
[ 2 ] = ( keyA
[ sectorNo
][ 2 ]);
480 bldata
[ 3 ] = ( keyA
[ sectorNo
][ 3 ]);
481 bldata
[ 4 ] = ( keyA
[ sectorNo
][ 4 ]);
482 bldata
[ 5 ] = ( keyA
[ sectorNo
][ 5 ]);
483 bldata
[ 10 ] = ( keyB
[ sectorNo
][ 0 ]);
484 bldata
[ 11 ] = ( keyB
[ sectorNo
][ 1 ]);
485 bldata
[ 12 ] = ( keyB
[ sectorNo
][ 2 ]);
486 bldata
[ 13 ] = ( keyB
[ sectorNo
][ 3 ]);
487 bldata
[ 14 ] = ( keyB
[ sectorNo
][ 4 ]);
488 bldata
[ 15 ] = ( keyB
[ sectorNo
][ 5 ]);
491 PrintAndLog ( "Writing to block %3d: %s" , FirstBlockOfSector ( sectorNo
) + blockNo
, sprint_hex ( bldata
, 16 ));
493 memcpy ( c
. d
. asBytes
+ 10 , bldata
, 16 );
497 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
498 uint8_t isOK
= resp
. arg
[ 0 ] & 0xff ;
499 PrintAndLog ( "isOk:%02x" , isOK
);
501 PrintAndLog ( "Command execute timeout" );
517 int CmdHF14AMfNested ( const char * Cmd
)
519 int i
, j
, res
, iterations
;
520 sector_t
* e_sector
= NULL
;
523 uint8_t trgBlockNo
= 0 ;
524 uint8_t trgKeyType
= 0 ;
525 uint8_t SectorsCnt
= 0 ;
526 uint8_t key
[ 6 ] = { 0 , 0 , 0 , 0 , 0 , 0 };
527 uint8_t keyBlock
[ 14 * 6 ];
529 bool transferToEml
= false ;
531 bool createDumpFile
= false ;
533 uint8_t standart
[ 6 ] = { 0xFF , 0xFF , 0xFF , 0xFF , 0xFF , 0xFF };
534 uint8_t tempkey
[ 6 ] = { 0xFF , 0xFF , 0xFF , 0xFF , 0xFF , 0xFF };
539 PrintAndLog ( "Usage:" );
540 PrintAndLog ( " all sectors: hf mf nested <card memory> <block number> <key A/B> <key (12 hex symbols)> [t,d]" );
541 PrintAndLog ( " one sector: hf mf nested o <block number> <key A/B> <key (12 hex symbols)>" );
542 PrintAndLog ( " <target block number> <target key A/B> [t]" );
543 PrintAndLog ( "card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K" );
544 PrintAndLog ( "t - transfer keys into emulator memory" );
545 PrintAndLog ( "d - write keys to binary file" );
547 PrintAndLog ( " sample1: hf mf nested 1 0 A FFFFFFFFFFFF " );
548 PrintAndLog ( " sample2: hf mf nested 1 0 A FFFFFFFFFFFF t " );
549 PrintAndLog ( " sample3: hf mf nested 1 0 A FFFFFFFFFFFF d " );
550 PrintAndLog ( " sample4: hf mf nested o 0 A FFFFFFFFFFFF 4 A" );
554 cmdp
= param_getchar ( Cmd
, 0 );
555 blockNo
= param_get8 ( Cmd
, 1 );
556 ctmp
= param_getchar ( Cmd
, 2 );
558 if ( ctmp
!= 'a' && ctmp
!= 'A' && ctmp
!= 'b' && ctmp
!= 'B' ) {
559 PrintAndLog ( "Key type must be A or B" );
563 if ( ctmp
!= 'A' && ctmp
!= 'a' )
566 if ( param_gethex ( Cmd
, 3 , key
, 12 )) {
567 PrintAndLog ( "Key must include 12 HEX symbols" );
571 if ( cmdp
== 'o' || cmdp
== 'O' ) {
573 trgBlockNo
= param_get8 ( Cmd
, 4 );
574 ctmp
= param_getchar ( Cmd
, 5 );
575 if ( ctmp
!= 'a' && ctmp
!= 'A' && ctmp
!= 'b' && ctmp
!= 'B' ) {
576 PrintAndLog ( "Target key type must be A or B" );
579 if ( ctmp
!= 'A' && ctmp
!= 'a' )
584 case '0' : SectorsCnt
= 05 ; break ;
585 case '1' : SectorsCnt
= 16 ; break ;
586 case '2' : SectorsCnt
= 32 ; break ;
587 case '4' : SectorsCnt
= 40 ; break ;
588 default : SectorsCnt
= 16 ;
592 ctmp
= param_getchar ( Cmd
, 4 );
593 if ( ctmp
== 't' || ctmp
== 'T' ) transferToEml
= true ;
594 else if ( ctmp
== 'd' || ctmp
== 'D' ) createDumpFile
= true ;
596 ctmp
= param_getchar ( Cmd
, 6 );
597 transferToEml
|= ( ctmp
== 't' || ctmp
== 'T' );
598 transferToEml
|= ( ctmp
== 'd' || ctmp
== 'D' );
601 PrintAndLog ( "--target block no:%3d, target key type:%c " , trgBlockNo
, trgKeyType
? 'B' : 'A' );
602 int16_t isOK
= mfnested ( blockNo
, keyType
, key
, trgBlockNo
, trgKeyType
, keyBlock
, true );
605 case - 1 : PrintAndLog ( "Error: No response from Proxmark. \n " ); break ;
606 case - 2 : PrintAndLog ( "Button pressed. Aborted. \n " ); break ;
607 case - 3 : PrintAndLog ( "Tag isn't vulnerable to Nested Attack (random numbers are not predictable). \n " ); break ;
608 default : PrintAndLog ( "Unknown Error. \n " );
612 key64
= bytes_to_num ( keyBlock
, 6 );
614 PrintAndLog ( "Found valid key:%012" PRIx64
, key64
);
616 // transfer key to the emulator
618 uint8_t sectortrailer
;
619 if ( trgBlockNo
< 32 * 4 ) { // 4 block sector
620 sectortrailer
= ( trgBlockNo
& 0x03 ) + 3 ;
621 } else { // 16 block sector
622 sectortrailer
= ( trgBlockNo
& 0x0f ) + 15 ;
624 mfEmlGetMem ( keyBlock
, sectortrailer
, 1 );
627 num_to_bytes ( key64
, 6 , keyBlock
);
629 num_to_bytes ( key64
, 6 , & keyBlock
[ 10 ]);
630 mfEmlSetMem ( keyBlock
, sectortrailer
, 1 );
633 PrintAndLog ( "No valid key found" );
636 else { // ------------------------------------ multiple sectors working
638 msclock1
= msclock ();
640 e_sector
= calloc ( SectorsCnt
, sizeof ( sector_t
));
641 if ( e_sector
== NULL
) return 1 ;
643 //test current key and additional standard keys first
644 memcpy ( keyBlock
, key
, 6 );
645 num_to_bytes ( 0xffffffffffff , 6 , ( uint8_t *)( keyBlock
+ 1 * 6 ));
646 num_to_bytes ( 0x000000000000 , 6 , ( uint8_t *)( keyBlock
+ 2 * 6 ));
647 num_to_bytes ( 0xa0a1a2a3a4a5 , 6 , ( uint8_t *)( keyBlock
+ 3 * 6 ));
648 num_to_bytes ( 0xb0b1b2b3b4b5 , 6 , ( uint8_t *)( keyBlock
+ 4 * 6 ));
649 num_to_bytes ( 0xaabbccddeeff , 6 , ( uint8_t *)( keyBlock
+ 5 * 6 ));
650 num_to_bytes ( 0x4d3a99c351dd , 6 , ( uint8_t *)( keyBlock
+ 6 * 6 ));
651 num_to_bytes ( 0x1a982c7e459a , 6 , ( uint8_t *)( keyBlock
+ 7 * 6 ));
652 num_to_bytes ( 0xd3f7d3f7d3f7 , 6 , ( uint8_t *)( keyBlock
+ 8 * 6 ));
653 num_to_bytes ( 0x714c5c886e97 , 6 , ( uint8_t *)( keyBlock
+ 9 * 6 ));
654 num_to_bytes ( 0x587ee5f9350f , 6 , ( uint8_t *)( keyBlock
+ 10 * 6 ));
655 num_to_bytes ( 0xa0478cc39091 , 6 , ( uint8_t *)( keyBlock
+ 11 * 6 ));
656 num_to_bytes ( 0x533cb6c723f6 , 6 , ( uint8_t *)( keyBlock
+ 12 * 6 ));
657 num_to_bytes ( 0x8fd0a4f256e9 , 6 , ( uint8_t *)( keyBlock
+ 13 * 6 ));
659 PrintAndLog ( "Testing known keys. Sector count=%d" , SectorsCnt
);
660 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
661 for ( j
= 0 ; j
< 2 ; j
++) {
662 if ( e_sector
[ i
]. foundKey
[ j
]) continue ;
664 res
= mfCheckKeys ( FirstBlockOfSector ( i
), j
, true , 6 , keyBlock
, & key64
);
667 e_sector
[ i
]. Key
[ j
] = key64
;
668 e_sector
[ i
]. foundKey
[ j
] = 1 ;
675 PrintAndLog ( "nested..." );
676 bool calibrate
= true ;
677 for ( i
= 0 ; i
< NESTED_SECTOR_RETRY
; i
++) {
678 for ( uint8_t sectorNo
= 0 ; sectorNo
< SectorsCnt
; sectorNo
++) {
679 for ( trgKeyType
= 0 ; trgKeyType
< 2 ; trgKeyType
++) {
680 if ( e_sector
[ sectorNo
]. foundKey
[ trgKeyType
]) continue ;
681 PrintAndLog ( "-----------------------------------------------" );
682 int16_t isOK
= mfnested ( blockNo
, keyType
, key
, FirstBlockOfSector ( sectorNo
), trgKeyType
, keyBlock
, calibrate
);
685 case - 1 : PrintAndLog ( "Error: No response from Proxmark. \n " ); break ;
686 case - 2 : PrintAndLog ( "Button pressed. Aborted. \n " ); break ;
687 case - 3 : PrintAndLog ( "Tag isn't vulnerable to Nested Attack (random numbers are not predictable). \n " ); break ;
688 default : PrintAndLog ( "Unknown Error. \n " );
698 key64
= bytes_to_num ( keyBlock
, 6 );
700 PrintAndLog ( "Found valid key:%012" PRIx64
, key64
);
701 e_sector
[ sectorNo
]. foundKey
[ trgKeyType
] = 1 ;
702 e_sector
[ sectorNo
]. Key
[ trgKeyType
] = key64
;
708 printf ( "Time in nested: %1.3f (%1.3f sec per key) \n\n " , (( float )( msclock () - msclock1
))/ 1000.0 , (( float )( msclock () - msclock1
))/ iterations
/ 1000.0 );
710 PrintAndLog ( "----------------------------------------------- \n Iterations count: %d \n\n " , iterations
);
712 PrintAndLog ( "|---|----------------|---|----------------|---|" );
713 PrintAndLog ( "|sec|key A |res|key B |res|" );
714 PrintAndLog ( "|---|----------------|---|----------------|---|" );
715 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
716 PrintAndLog ( "|%03d| %012" PRIx64
" | %d | %012" PRIx64
" | %d |" , i
,
717 e_sector
[ i
]. Key
[ 0 ], e_sector
[ i
]. foundKey
[ 0 ], e_sector
[ i
]. Key
[ 1 ], e_sector
[ i
]. foundKey
[ 1 ]);
719 PrintAndLog ( "|---|----------------|---|----------------|---|" );
721 // transfer them to the emulator
723 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
724 mfEmlGetMem ( keyBlock
, FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 , 1 );
725 if ( e_sector
[ i
]. foundKey
[ 0 ])
726 num_to_bytes ( e_sector
[ i
]. Key
[ 0 ], 6 , keyBlock
);
727 if ( e_sector
[ i
]. foundKey
[ 1 ])
728 num_to_bytes ( e_sector
[ i
]. Key
[ 1 ], 6 , & keyBlock
[ 10 ]);
729 mfEmlSetMem ( keyBlock
, FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 , 1 );
734 if ( createDumpFile
) {
735 if (( fkeys
= fopen ( "dumpkeys.bin" , "wb" )) == NULL
) {
736 PrintAndLog ( "Could not create file dumpkeys.bin" );
740 PrintAndLog ( "Printing keys to binary file dumpkeys.bin..." );
741 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
742 if ( e_sector
[ i
]. foundKey
[ 0 ]){
743 num_to_bytes ( e_sector
[ i
]. Key
[ 0 ], 6 , tempkey
);
744 fwrite ( tempkey
, 1 , 6 , fkeys
);
747 fwrite ( & standart
, 1 , 6 , fkeys
);
750 for ( i
= 0 ; i
< SectorsCnt
; i
++) {
751 if ( e_sector
[ i
]. foundKey
[ 1 ]){
752 num_to_bytes ( e_sector
[ i
]. Key
[ 1 ], 6 , tempkey
);
753 fwrite ( tempkey
, 1 , 6 , fkeys
);
756 fwrite ( & standart
, 1 , 6 , fkeys
);
767 int CmdHF14AMfChk ( const char * Cmd
)
770 PrintAndLog ( "Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d] [<key (12 hex symbols)>] [<dic (*.dic)>]" );
771 PrintAndLog ( " * - all sectors" );
772 PrintAndLog ( "card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K" );
773 PrintAndLog ( "d - write keys to binary file \n " );
774 PrintAndLog ( "t - write keys to emulator memory" );
775 PrintAndLog ( " sample: hf mf chk 0 A 1234567890ab keys.dic" );
776 PrintAndLog ( " hf mf chk *1 ? t" );
777 PrintAndLog ( " hf mf chk *1 ? d" );
782 char filename
[ FILE_PATH_SIZE
]={ 0 };
784 uint8_t * keyBlock
= NULL
, * p
;
785 uint8_t stKeyBlock
= 20 ;
791 uint8_t SectorsCnt
= 1 ;
795 int transferToEml
= 0 ;
796 int createDumpFile
= 0 ;
798 keyBlock
= calloc ( stKeyBlock
, 6 );
799 if ( keyBlock
== NULL
) return 1 ;
801 uint64_t defaultKeys
[] =
803 0xffffffffffff , // Default key (first key used by program if no user defined key)
804 0x000000000000 , // Blank key
805 0xa0a1a2a3a4a5 , // NFCForum MAD key
817 int defaultKeysSize
= sizeof ( defaultKeys
) / sizeof ( uint64_t );
819 for ( int defaultKeyCounter
= 0 ; defaultKeyCounter
< defaultKeysSize
; defaultKeyCounter
++)
821 num_to_bytes ( defaultKeys
[ defaultKeyCounter
], 6 , ( uint8_t *)( keyBlock
+ defaultKeyCounter
* 6 ));
824 if ( param_getchar ( Cmd
, 0 )== '*' ) {
826 switch ( param_getchar ( Cmd
+ 1 , 0 )) {
827 case '0' : SectorsCnt
= 5 ; break ;
828 case '1' : SectorsCnt
= 16 ; break ;
829 case '2' : SectorsCnt
= 32 ; break ;
830 case '4' : SectorsCnt
= 40 ; break ;
831 default : SectorsCnt
= 16 ;
835 blockNo
= param_get8 ( Cmd
, 0 );
837 ctmp
= param_getchar ( Cmd
, 1 );
849 PrintAndLog ( "Key type must be A , B or ?" );
853 ctmp
= param_getchar ( Cmd
, 2 );
854 if ( ctmp
== 't' || ctmp
== 'T' ) transferToEml
= 1 ;
855 else if ( ctmp
== 'd' || ctmp
== 'D' ) createDumpFile
= 1 ;
857 for ( i
= transferToEml
|| createDumpFile
; param_getchar ( Cmd
, 2 + i
); i
++) {
858 if (! param_gethex ( Cmd
, 2 + i
, keyBlock
+ 6 * keycnt
, 12 )) {
859 if ( stKeyBlock
- keycnt
< 2 ) {
860 p
= realloc ( keyBlock
, 6 *( stKeyBlock
+= 10 ));
862 PrintAndLog ( "Cannot allocate memory for Keys" );
868 PrintAndLog ( "chk key[%2d] %02x%02x%02x%02x%02x%02x" , keycnt
,
869 ( keyBlock
+ 6 * keycnt
)[ 0 ],( keyBlock
+ 6 * keycnt
)[ 1 ], ( keyBlock
+ 6 * keycnt
)[ 2 ],
870 ( keyBlock
+ 6 * keycnt
)[ 3 ], ( keyBlock
+ 6 * keycnt
)[ 4 ], ( keyBlock
+ 6 * keycnt
)[ 5 ], 6 );
874 if ( param_getstr ( Cmd
, 2 + i
, filename
) >= FILE_PATH_SIZE
) {
875 PrintAndLog ( "File name too long" );
880 if ( ( f
= fopen ( filename
, "r" )) ) {
881 while ( fgets ( buf
, sizeof ( buf
), f
) ){
882 if ( strlen ( buf
) < 12 || buf
[ 11 ] == ' \n ' )
885 while ( fgetc ( f
) != ' \n ' && ! feof ( f
)) ; //goto next line
887 if ( buf
[ 0 ]== '#' ) continue ; //The line start with # is comment, skip
889 if (! isxdigit ( buf
[ 0 ])){
890 PrintAndLog ( "File content error. '%s' must include 12 HEX symbols" , buf
);
896 if ( stKeyBlock
- keycnt
< 2 ) {
897 p
= realloc ( keyBlock
, 6 *( stKeyBlock
+= 10 ));
899 PrintAndLog ( "Cannot allocate memory for defKeys" );
906 memset ( keyBlock
+ 6 * keycnt
, 0 , 6 );
907 num_to_bytes ( strtoll ( buf
, NULL
, 16 ), 6 , keyBlock
+ 6 * keycnt
);
908 PrintAndLog ( "chk custom key[%2d] %012" PRIx64
, keycnt
, bytes_to_num ( keyBlock
+ 6 * keycnt
, 6 ));
910 memset ( buf
, 0 , sizeof ( buf
));
914 PrintAndLog ( "File: %s: not found or locked." , filename
);
923 PrintAndLog ( "No key specified, trying default keys" );
924 for (; keycnt
< defaultKeysSize
; keycnt
++)
925 PrintAndLog ( "chk default key[%2d] %02x%02x%02x%02x%02x%02x" , keycnt
,
926 ( keyBlock
+ 6 * keycnt
)[ 0 ],( keyBlock
+ 6 * keycnt
)[ 1 ], ( keyBlock
+ 6 * keycnt
)[ 2 ],
927 ( keyBlock
+ 6 * keycnt
)[ 3 ], ( keyBlock
+ 6 * keycnt
)[ 4 ], ( keyBlock
+ 6 * keycnt
)[ 5 ], 6 );
930 // initialize storage for found keys
931 bool validKey
[ 2 ][ 40 ];
932 uint8_t foundKey
[ 2 ][ 40 ][ 6 ];
933 for ( uint16_t t
= 0 ; t
< 2 ; t
++) {
934 for ( uint16_t sectorNo
= 0 ; sectorNo
< SectorsCnt
; sectorNo
++) {
935 validKey
[ t
][ sectorNo
] = false ;
936 for ( uint16_t i
= 0 ; i
< 6 ; i
++) {
937 foundKey
[ t
][ sectorNo
][ i
] = 0xff ;
942 for ( int t
= ! keyType
; t
< 2 ; keyType
== 2 ?( t
++):( t
= 2 ) ) {
944 for ( int i
= 0 ; i
< SectorsCnt
; ++ i
) {
945 PrintAndLog ( "--sector:%2d, block:%3d, key type:%C, key count:%2d " , i
, b
, t
? 'B' : 'A' , keycnt
);
946 uint32_t max_keys
= keycnt
> USB_CMD_DATA_SIZE
/ 6 ? USB_CMD_DATA_SIZE
/ 6 : keycnt
;
947 for ( uint32_t c
= 0 ; c
< keycnt
; c
+= max_keys
) {
948 uint32_t size
= keycnt
- c
> max_keys
? max_keys
: keycnt
- c
;
949 res
= mfCheckKeys ( b
, t
, true , size
, & keyBlock
[ 6 * c
], & key64
);
952 PrintAndLog ( "Found valid key:[%012" PRIx64
"]" , key64
);
953 num_to_bytes ( key64
, 6 , foundKey
[ t
][ i
]);
954 validKey
[ t
][ i
] = true ;
957 PrintAndLog ( "Command execute timeout" );
960 b
< 127 ?( b
+= 4 ):( b
+= 16 );
966 for ( uint16_t sectorNo
= 0 ; sectorNo
< SectorsCnt
; sectorNo
++) {
967 if ( validKey
[ 0 ][ sectorNo
] || validKey
[ 1 ][ sectorNo
]) {
968 mfEmlGetMem ( block
, FirstBlockOfSector ( sectorNo
) + NumBlocksPerSector ( sectorNo
) - 1 , 1 );
969 for ( uint16_t t
= 0 ; t
< 2 ; t
++) {
970 if ( validKey
[ t
][ sectorNo
]) {
971 memcpy ( block
+ t
* 10 , foundKey
[ t
][ sectorNo
], 6 );
974 mfEmlSetMem ( block
, FirstBlockOfSector ( sectorNo
) + NumBlocksPerSector ( sectorNo
) - 1 , 1 );
977 PrintAndLog ( "Found keys have been transferred to the emulator memory" );
980 if ( createDumpFile
) {
981 FILE * fkeys
= fopen ( "dumpkeys.bin" , "wb" );
983 PrintAndLog ( "Could not create file dumpkeys.bin" );
987 for ( uint16_t t
= 0 ; t
< 2 ; t
++) {
988 fwrite ( foundKey
[ t
], 1 , 6 * SectorsCnt
, fkeys
);
991 PrintAndLog ( "Found keys have been dumped to file dumpkeys.bin. 0xffffffffffff has been inserted for unknown keys." );
999 void readerAttack ( nonces_t ar_resp
[], bool setEmulatorMem
, bool doStandardAttack
) {
1000 #define ATTACK_KEY_COUNT 8 // keep same as define in iso14443a.c -> Mifare1ksim()
1006 st_t sector_trailer
[ ATTACK_KEY_COUNT
];
1007 memset ( sector_trailer
, 0x00 , sizeof ( sector_trailer
));
1009 uint8_t stSector
[ ATTACK_KEY_COUNT
];
1010 memset ( stSector
, 0x00 , sizeof ( stSector
));
1011 uint8_t key_cnt
[ ATTACK_KEY_COUNT
];
1012 memset ( key_cnt
, 0x00 , sizeof ( key_cnt
));
1014 for ( uint8_t i
= 0 ; i
< ATTACK_KEY_COUNT
; i
++) {
1015 if ( ar_resp
[ i
]. ar2
> 0 ) {
1016 //PrintAndLog("DEBUG: Trying sector %d, cuid %08x, nt %08x, ar %08x, nr %08x, ar2 %08x, nr2 %08x",ar_resp[i].sector, ar_resp[i].cuid,ar_resp[i].nonce,ar_resp[i].ar,ar_resp[i].nr,ar_resp[i].ar2,ar_resp[i].nr2);
1017 if ( doStandardAttack
&& mfkey32 ( ar_resp
[ i
], & key
)) {
1018 PrintAndLog ( " Found Key%s for sector %02d: [%04x%08x]" , ( ar_resp
[ i
]. keytype
) ? "B" : "A" , ar_resp
[ i
]. sector
, ( uint32_t ) ( key
>> 32 ), ( uint32_t ) ( key
& 0xFFFFFFFF ));
1020 for ( uint8_t ii
= 0 ; ii
< ATTACK_KEY_COUNT
; ii
++) {
1021 if ( key_cnt
[ ii
]== 0 || stSector
[ ii
]== ar_resp
[ i
]. sector
) {
1022 if ( ar_resp
[ i
]. keytype
== 0 ) {
1024 sector_trailer
[ ii
]. keyA
= key
;
1025 stSector
[ ii
] = ar_resp
[ i
]. sector
;
1030 sector_trailer
[ ii
]. keyB
= key
;
1031 stSector
[ ii
] = ar_resp
[ i
]. sector
;
1037 } else if ( mfkey32_moebius ( ar_resp
[ i
+ ATTACK_KEY_COUNT
], & key
)) {
1038 uint8_t sectorNum
= ar_resp
[ i
+ ATTACK_KEY_COUNT
]. sector
;
1039 uint8_t keyType
= ar_resp
[ i
+ ATTACK_KEY_COUNT
]. keytype
;
1041 PrintAndLog ( "M-Found Key%s for sector %02d: [%012" PRIx64
"]"
1042 , keyType
? "B" : "A"
1047 for ( uint8_t ii
= 0 ; ii
< ATTACK_KEY_COUNT
; ii
++) {
1048 if ( key_cnt
[ ii
]== 0 || stSector
[ ii
]== sectorNum
) {
1051 sector_trailer
[ ii
]. keyA
= key
;
1052 stSector
[ ii
] = sectorNum
;
1057 sector_trailer
[ ii
]. keyB
= key
;
1058 stSector
[ ii
] = sectorNum
;
1068 //set emulator memory for keys
1069 if ( setEmulatorMem
) {
1070 for ( uint8_t i
= 0 ; i
< ATTACK_KEY_COUNT
; i
++) {
1072 uint8_t memBlock
[ 16 ];
1073 memset ( memBlock
, 0x00 , sizeof ( memBlock
));
1075 memset ( cmd1
, 0x00 , sizeof ( cmd1
));
1076 snprintf ( cmd1
, sizeof ( cmd1
), "%04x%08xFF078069%04x%08x" ,( uint32_t ) ( sector_trailer
[ i
]. keyA
>> 32 ), ( uint32_t ) ( sector_trailer
[ i
]. keyA
& 0xFFFFFFFF ),( uint32_t ) ( sector_trailer
[ i
]. keyB
>> 32 ), ( uint32_t ) ( sector_trailer
[ i
]. keyB
& 0xFFFFFFFF ));
1077 PrintAndLog ( "Setting Emulator Memory Block %02d: [%s]" , stSector
[ i
]* 4 + 3 , cmd1
);
1078 if ( param_gethex ( cmd1
, 0 , memBlock
, 32 )) {
1079 PrintAndLog ( "block data must include 32 HEX symbols" );
1083 UsbCommand c
= { CMD_MIFARE_EML_MEMSET
, {( stSector
[ i
]* 4 + 3 ), 1 , 0 }};
1084 memcpy ( c
. d
. asBytes
, memBlock
, 16 );
1085 clearCommandBuffer ();
1091 //un-comment to use as well moebius attack
1092 for (uint8_t i = ATTACK_KEY_COUNT; i<ATTACK_KEY_COUNT*2; i++) {
1093 if (ar_resp[i].ar2 > 0) {
1094 if (tryMfk32_moebius(ar_resp[i], &key)) {
1095 PrintAndLog("M-Found Key%s for sector %02d: [%04x%08x]", (ar_resp[i].keytype) ? "B" : "A", ar_resp[i].sector, (uint32_t) (key>>32), (uint32_t) (key &0xFFFFFFFF));
1101 int usage_hf14_mf1ksim ( void ) {
1102 PrintAndLog ( "Usage: hf mf sim h u <uid (8, 14, or 20 hex symbols)> n <numreads> i x" );
1103 PrintAndLog ( "options:" );
1104 PrintAndLog ( " h this help" );
1105 PrintAndLog ( " u (Optional) UID 4,7 or 10 bytes. If not specified, the UID 4B from emulator memory will be used" );
1106 PrintAndLog ( " n (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite" );
1107 PrintAndLog ( " i (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted" );
1108 PrintAndLog ( " x (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)" );
1109 PrintAndLog ( " e (Optional) set keys found from 'reader attack' to emulator memory (implies x and i)" );
1110 PrintAndLog ( " f (Optional) get UIDs to use for 'reader attack' from file 'f <filename.txt>' (implies x and i)" );
1111 PrintAndLog ( " r (Optional) Generate random nonces instead of sequential nonces. Standard reader attack won't work with this option, only moebius attack works." );
1112 PrintAndLog ( "samples:" );
1113 PrintAndLog ( " hf mf sim u 0a0a0a0a" );
1114 PrintAndLog ( " hf mf sim u 11223344556677" );
1115 PrintAndLog ( " hf mf sim u 112233445566778899AA" );
1116 PrintAndLog ( " hf mf sim f uids.txt" );
1117 PrintAndLog ( " hf mf sim u 0a0a0a0a e" );
1122 int CmdHF14AMf1kSim ( const char * Cmd
) {
1124 uint8_t uid
[ 10 ] = { 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 };
1125 uint8_t exitAfterNReads
= 0 ;
1129 bool setEmulatorMem
= false ;
1130 bool attackFromFile
= false ;
1132 char filename
[ FILE_PATH_SIZE
];
1133 memset ( filename
, 0x00 , sizeof ( filename
));
1138 bool errors
= false ;
1140 while ( param_getchar ( Cmd
, cmdp
) != 0x00 ) {
1141 switch ( param_getchar ( Cmd
, cmdp
)) {
1144 setEmulatorMem
= true ;
1146 flags
|= FLAG_INTERACTIVE
;
1147 flags
|= FLAG_NR_AR_ATTACK
;
1152 len
= param_getstr ( Cmd
, cmdp
+ 1 , filename
);
1154 PrintAndLog ( "error no filename found" );
1157 attackFromFile
= true ;
1159 flags
|= FLAG_INTERACTIVE
;
1160 flags
|= FLAG_NR_AR_ATTACK
;
1165 return usage_hf14_mf1ksim ();
1168 flags
|= FLAG_INTERACTIVE
;
1173 exitAfterNReads
= param_get8 ( Cmd
, pnr
+ 1 );
1178 flags
|= FLAG_RANDOM_NONCE
;
1183 param_gethex_ex ( Cmd
, cmdp
+ 1 , uid
, & uidlen
);
1185 case 20 : flags
= FLAG_10B_UID_IN_DATA
; break ; //not complete
1186 case 14 : flags
= FLAG_7B_UID_IN_DATA
; break ;
1187 case 8 : flags
= FLAG_4B_UID_IN_DATA
; break ;
1188 default : return usage_hf14_mf1ksim ();
1194 flags
|= FLAG_NR_AR_ATTACK
;
1198 PrintAndLog ( "Unknown parameter '%c'" , param_getchar ( Cmd
, cmdp
));
1205 if ( errors
) return usage_hf14_mf1ksim ();
1208 if ( attackFromFile
) {
1211 f
= fopen ( filename
, "r" );
1213 PrintAndLog ( "File %s not found or locked" , filename
);
1216 PrintAndLog ( "Loading file and simulating. Press keyboard to abort" );
1217 while (! feof ( f
) && ! ukbhit ()){
1218 memset ( buf
, 0 , sizeof ( buf
));
1219 memset ( uid
, 0 , sizeof ( uid
));
1221 if ( fgets ( buf
, sizeof ( buf
), f
) == NULL
) {
1222 if ( count
> 0 ) break ;
1224 PrintAndLog ( "File reading error." );
1228 if (! strlen ( buf
) && feof ( f
)) break ;
1230 uidlen
= strlen ( buf
)- 1 ;
1232 case 20 : flags
|= FLAG_10B_UID_IN_DATA
; break ; //not complete
1233 case 14 : flags
|= FLAG_7B_UID_IN_DATA
; break ;
1234 case 8 : flags
|= FLAG_4B_UID_IN_DATA
; break ;
1236 PrintAndLog ( "uid in file wrong length at %d (length: %d) [%s]" , count
, uidlen
, buf
);
1241 for ( uint8_t i
= 0 ; i
< uidlen
; i
+= 2 ) {
1242 sscanf (& buf
[ i
], "%02x" , ( unsigned int *)& uid
[ i
/ 2 ]);
1245 PrintAndLog ( "mf 1k sim uid: %s, numreads:%d, flags:%d (0x%02x) - press button to abort" ,
1246 flags
& FLAG_4B_UID_IN_DATA
? sprint_hex ( uid
, 4 ):
1247 flags
& FLAG_7B_UID_IN_DATA
? sprint_hex ( uid
, 7 ):
1248 flags
& FLAG_10B_UID_IN_DATA
? sprint_hex ( uid
, 10 ): "N/A"
1249 , exitAfterNReads
, flags
, flags
);
1251 UsbCommand c
= { CMD_SIMULATE_MIFARE_CARD
, { flags
, exitAfterNReads
, 0 }};
1252 memcpy ( c
. d
. asBytes
, uid
, sizeof ( uid
));
1253 clearCommandBuffer ();
1256 while (! WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
1257 //We're waiting only 1.5 s at a time, otherwise we get the
1258 // annoying message about "Waiting for a response... "
1261 nonces_t ar_resp
[ ATTACK_KEY_COUNT
* 2 ];
1262 memcpy ( ar_resp
, resp
. d
. asBytes
, sizeof ( ar_resp
));
1263 // We can skip the standard attack if we have RANDOM_NONCE set.
1264 readerAttack ( ar_resp
, setEmulatorMem
, !( flags
& FLAG_RANDOM_NONCE
));
1265 if (( bool ) resp
. arg
[ 1 ]) {
1266 PrintAndLog ( "Device button pressed - quitting" );
1273 } else { //not from file
1275 PrintAndLog ( "mf 1k sim uid: %s, numreads:%d, flags:%d (0x%02x) " ,
1276 flags
& FLAG_4B_UID_IN_DATA
? sprint_hex ( uid
, 4 ):
1277 flags
& FLAG_7B_UID_IN_DATA
? sprint_hex ( uid
, 7 ):
1278 flags
& FLAG_10B_UID_IN_DATA
? sprint_hex ( uid
, 10 ): "N/A"
1279 , exitAfterNReads
, flags
, flags
);
1281 UsbCommand c
= { CMD_SIMULATE_MIFARE_CARD
, { flags
, exitAfterNReads
, 0 }};
1282 memcpy ( c
. d
. asBytes
, uid
, sizeof ( uid
));
1283 clearCommandBuffer ();
1286 if ( flags
& FLAG_INTERACTIVE
) {
1287 PrintAndLog ( "Press pm3-button to abort simulation" );
1288 while (! WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
1289 //We're waiting only 1.5 s at a time, otherwise we get the
1290 // annoying message about "Waiting for a response... "
1293 if ( flags
& FLAG_NR_AR_ATTACK
) {
1294 nonces_t ar_resp
[ ATTACK_KEY_COUNT
* 2 ];
1295 memcpy ( ar_resp
, resp
. d
. asBytes
, sizeof ( ar_resp
));
1296 // We can skip the standard attack if we have RANDOM_NONCE set.
1297 readerAttack ( ar_resp
, setEmulatorMem
, !( flags
& FLAG_RANDOM_NONCE
));
1305 int CmdHF14AMfDbg ( const char * Cmd
)
1307 int dbgMode
= param_get32ex ( Cmd
, 0 , 0 , 10 );
1309 PrintAndLog ( "Max debug mode parameter is 4 \n " );
1312 if ( strlen ( Cmd
) < 1 || ! param_getchar ( Cmd
, 0 ) || dbgMode
> 4 ) {
1313 PrintAndLog ( "Usage: hf mf dbg <debug level>" );
1314 PrintAndLog ( " 0 - no debug messages" );
1315 PrintAndLog ( " 1 - error messages" );
1316 PrintAndLog ( " 2 - plus information messages" );
1317 PrintAndLog ( " 3 - plus debug messages" );
1318 PrintAndLog ( " 4 - print even debug messages in timing critical functions" );
1319 PrintAndLog ( " Note: this option therefore may cause malfunction itself" );
1323 UsbCommand c
= { CMD_MIFARE_SET_DBGMODE
, { dbgMode
, 0 , 0 }};
1329 int CmdHF14AMfEGet ( const char * Cmd
)
1331 uint8_t blockNo
= 0 ;
1332 uint8_t data
[ 16 ] = { 0x00 };
1334 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1335 PrintAndLog ( "Usage: hf mf eget <block number>" );
1336 PrintAndLog ( " sample: hf mf eget 0 " );
1340 blockNo
= param_get8 ( Cmd
, 0 );
1343 if (! mfEmlGetMem ( data
, blockNo
, 1 )) {
1344 PrintAndLog ( "data[%3d]:%s" , blockNo
, sprint_hex ( data
, 16 ));
1346 PrintAndLog ( "Command execute timeout" );
1352 int CmdHF14AMfEClear ( const char * Cmd
)
1354 if ( param_getchar ( Cmd
, 0 ) == 'h' ) {
1355 PrintAndLog ( "Usage: hf mf eclr" );
1356 PrintAndLog ( "It set card emulator memory to empty data blocks and key A/B FFFFFFFFFFFF \n " );
1360 UsbCommand c
= { CMD_MIFARE_EML_MEMCLR
, { 0 , 0 , 0 }};
1366 int CmdHF14AMfESet ( const char * Cmd
)
1368 uint8_t memBlock
[ 16 ];
1369 uint8_t blockNo
= 0 ;
1371 memset ( memBlock
, 0x00 , sizeof ( memBlock
));
1373 if ( strlen ( Cmd
) < 3 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1374 PrintAndLog ( "Usage: hf mf eset <block number> <block data (32 hex symbols)>" );
1375 PrintAndLog ( " sample: hf mf eset 1 000102030405060708090a0b0c0d0e0f " );
1379 blockNo
= param_get8 ( Cmd
, 0 );
1381 if ( param_gethex ( Cmd
, 1 , memBlock
, 32 )) {
1382 PrintAndLog ( "block data must include 32 HEX symbols" );
1387 UsbCommand c
= { CMD_MIFARE_EML_MEMSET
, { blockNo
, 1 , 0 }};
1388 memcpy ( c
. d
. asBytes
, memBlock
, 16 );
1394 int CmdHF14AMfELoad ( const char * Cmd
)
1397 char filename
[ FILE_PATH_SIZE
];
1398 char * fnameptr
= filename
;
1399 char buf
[ 64 ] = { 0x00 };
1400 uint8_t buf8
[ 64 ] = { 0x00 };
1401 int i
, len
, blockNum
, numBlocks
;
1402 int nameParamNo
= 1 ;
1404 char ctmp
= param_getchar ( Cmd
, 0 );
1406 if ( ctmp
== 'h' || ctmp
== 0x00 ) {
1407 PrintAndLog ( "It loads emul dump from the file `filename.eml`" );
1408 PrintAndLog ( "Usage: hf mf eload [card memory] <file name w/o `.eml`>" );
1409 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1411 PrintAndLog ( " sample: hf mf eload filename" );
1412 PrintAndLog ( " hf mf eload 4 filename" );
1417 case '0' : numBlocks
= 5 * 4 ; break ;
1419 case '\0' : numBlocks
= 16 * 4 ; break ;
1420 case '2' : numBlocks
= 32 * 4 ; break ;
1421 case '4' : numBlocks
= 256 ; break ;
1428 len
= param_getstr ( Cmd
, nameParamNo
, filename
);
1430 if ( len
> FILE_PATH_SIZE
- 5 ) len
= FILE_PATH_SIZE
- 5 ;
1434 sprintf ( fnameptr
, ".eml" );
1437 f
= fopen ( filename
, "r" );
1439 PrintAndLog ( "File %s not found or locked" , filename
);
1445 memset ( buf
, 0 , sizeof ( buf
));
1447 if ( fgets ( buf
, sizeof ( buf
), f
) == NULL
) {
1449 if ( blockNum
>= numBlocks
) break ;
1451 PrintAndLog ( "File reading error." );
1456 if ( strlen ( buf
) < 32 ){
1457 if ( strlen ( buf
) && feof ( f
))
1459 PrintAndLog ( "File content error. Block data must include 32 HEX symbols" );
1464 for ( i
= 0 ; i
< 32 ; i
+= 2 ) {
1465 sscanf (& buf
[ i
], "%02x" , ( unsigned int *)& buf8
[ i
/ 2 ]);
1468 if ( mfEmlSetMem ( buf8
, blockNum
, 1 )) {
1469 PrintAndLog ( "Cant set emul block: %3d" , blockNum
);
1476 if ( blockNum
>= numBlocks
) break ;
1481 if (( blockNum
!= numBlocks
)) {
1482 PrintAndLog ( "File content error. Got %d must be %d blocks." , blockNum
, numBlocks
);
1485 PrintAndLog ( "Loaded %d blocks from file: %s" , blockNum
, filename
);
1490 int CmdHF14AMfESave ( const char * Cmd
)
1493 char filename
[ FILE_PATH_SIZE
];
1494 char * fnameptr
= filename
;
1496 int i
, j
, len
, numBlocks
;
1497 int nameParamNo
= 1 ;
1499 memset ( filename
, 0 , sizeof ( filename
));
1500 memset ( buf
, 0 , sizeof ( buf
));
1502 char ctmp
= param_getchar ( Cmd
, 0 );
1504 if ( ctmp
== 'h' || ctmp
== 'H' ) {
1505 PrintAndLog ( "It saves emul dump into the file `filename.eml` or `cardID.eml`" );
1506 PrintAndLog ( " Usage: hf mf esave [card memory] [file name w/o `.eml`]" );
1507 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1509 PrintAndLog ( " sample: hf mf esave " );
1510 PrintAndLog ( " hf mf esave 4" );
1511 PrintAndLog ( " hf mf esave 4 filename" );
1516 case '0' : numBlocks
= 5 * 4 ; break ;
1518 case '\0' : numBlocks
= 16 * 4 ; break ;
1519 case '2' : numBlocks
= 32 * 4 ; break ;
1520 case '4' : numBlocks
= 256 ; break ;
1527 len
= param_getstr ( Cmd
, nameParamNo
, filename
);
1529 if ( len
> FILE_PATH_SIZE
- 5 ) len
= FILE_PATH_SIZE
- 5 ;
1531 // user supplied filename?
1533 // get filename (UID from memory)
1534 if ( mfEmlGetMem ( buf
, 0 , 1 )) {
1535 PrintAndLog ( "Can \' t get UID from block: %d" , 0 );
1536 len
= sprintf ( fnameptr
, "dump" );
1540 for ( j
= 0 ; j
< 7 ; j
++, fnameptr
+= 2 )
1541 sprintf ( fnameptr
, "%02X" , buf
[ j
]);
1547 // add file extension
1548 sprintf ( fnameptr
, ".eml" );
1551 f
= fopen ( filename
, "w+" );
1554 PrintAndLog ( "Can't open file %s " , filename
);
1559 for ( i
= 0 ; i
< numBlocks
; i
++) {
1560 if ( mfEmlGetMem ( buf
, i
, 1 )) {
1561 PrintAndLog ( "Cant get block: %d" , i
);
1564 for ( j
= 0 ; j
< 16 ; j
++)
1565 fprintf ( f
, "%02X" , buf
[ j
]);
1570 PrintAndLog ( "Saved %d blocks to file: %s" , numBlocks
, filename
);
1576 int CmdHF14AMfECFill ( const char * Cmd
)
1578 uint8_t keyType
= 0 ;
1579 uint8_t numSectors
= 16 ;
1581 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1582 PrintAndLog ( "Usage: hf mf ecfill <key A/B> [card memory]" );
1583 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1585 PrintAndLog ( "samples: hf mf ecfill A" );
1586 PrintAndLog ( " hf mf ecfill A 4" );
1587 PrintAndLog ( "Read card and transfer its data to emulator memory." );
1588 PrintAndLog ( "Keys must be laid in the emulator memory. \n " );
1592 char ctmp
= param_getchar ( Cmd
, 0 );
1593 if ( ctmp
!= 'a' && ctmp
!= 'A' && ctmp
!= 'b' && ctmp
!= 'B' ) {
1594 PrintAndLog ( "Key type must be A or B" );
1597 if ( ctmp
!= 'A' && ctmp
!= 'a' ) keyType
= 1 ;
1599 ctmp
= param_getchar ( Cmd
, 1 );
1601 case '0' : numSectors
= 5 ; break ;
1603 case '\0' : numSectors
= 16 ; break ;
1604 case '2' : numSectors
= 32 ; break ;
1605 case '4' : numSectors
= 40 ; break ;
1606 default : numSectors
= 16 ;
1609 printf ( "--params: numSectors: %d, keyType:%d" , numSectors
, keyType
);
1610 UsbCommand c
= { CMD_MIFARE_EML_CARDLOAD
, { numSectors
, keyType
, 0 }};
1616 int CmdHF14AMfEKeyPrn ( const char * Cmd
)
1621 uint64_t keyA
, keyB
;
1623 if ( param_getchar ( Cmd
, 0 ) == 'h' ) {
1624 PrintAndLog ( "It prints the keys loaded in the emulator memory" );
1625 PrintAndLog ( "Usage: hf mf ekeyprn [card memory]" );
1626 PrintAndLog ( " [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K" );
1628 PrintAndLog ( " sample: hf mf ekeyprn 1" );
1632 char cmdp
= param_getchar ( Cmd
, 0 );
1635 case '0' : numSectors
= 5 ; break ;
1637 case '\0' : numSectors
= 16 ; break ;
1638 case '2' : numSectors
= 32 ; break ;
1639 case '4' : numSectors
= 40 ; break ;
1640 default : numSectors
= 16 ;
1643 PrintAndLog ( "|---|----------------|----------------|" );
1644 PrintAndLog ( "|sec|key A |key B |" );
1645 PrintAndLog ( "|---|----------------|----------------|" );
1646 for ( i
= 0 ; i
< numSectors
; i
++) {
1647 if ( mfEmlGetMem ( data
, FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 , 1 )) {
1648 PrintAndLog ( "error get block %d" , FirstBlockOfSector ( i
) + NumBlocksPerSector ( i
) - 1 );
1651 keyA
= bytes_to_num ( data
, 6 );
1652 keyB
= bytes_to_num ( data
+ 10 , 6 );
1653 PrintAndLog ( "|%03d| %012" PRIx64
" | %012" PRIx64
" |" , i
, keyA
, keyB
);
1655 PrintAndLog ( "|---|----------------|----------------|" );
1661 int CmdHF14AMfCSetUID ( const char * Cmd
)
1663 uint8_t wipeCard
= 0 ;
1664 uint8_t uid
[ 8 ] = { 0x00 };
1665 uint8_t oldUid
[ 8 ] = { 0x00 };
1666 uint8_t atqa
[ 2 ] = { 0x00 };
1667 uint8_t sak
[ 1 ] = { 0x00 };
1668 uint8_t atqaPresent
= 1 ;
1673 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, argi
) == 'h' ) {
1674 PrintAndLog ( "Usage: hf mf csetuid <UID 8 hex symbols> [ATQA 4 hex symbols SAK 2 hex symbols] [w]" );
1675 PrintAndLog ( "sample: hf mf csetuid 01020304" );
1676 PrintAndLog ( "sample: hf mf csetuid 01020304 0004 08 w" );
1677 PrintAndLog ( "Set UID, ATQA, and SAK for magic Chinese card (only works with such cards)" );
1678 PrintAndLog ( "If you also want to wipe the card then add 'w' at the end of the command line." );
1682 if ( param_getchar ( Cmd
, argi
) && param_gethex ( Cmd
, argi
, uid
, 8 )) {
1683 PrintAndLog ( "UID must include 8 HEX symbols" );
1688 ctmp
= param_getchar ( Cmd
, argi
);
1689 if ( ctmp
== 'w' || ctmp
== 'W' ) {
1695 if ( param_getchar ( Cmd
, argi
)) {
1696 if ( param_gethex ( Cmd
, argi
, atqa
, 4 )) {
1697 PrintAndLog ( "ATQA must include 4 HEX symbols" );
1701 if (! param_getchar ( Cmd
, argi
) || param_gethex ( Cmd
, argi
, sak
, 2 )) {
1702 PrintAndLog ( "SAK must include 2 HEX symbols" );
1711 ctmp
= param_getchar ( Cmd
, argi
);
1712 if ( ctmp
== 'w' || ctmp
== 'W' ) {
1717 PrintAndLog ( "--wipe card:%s uid:%s" , ( wipeCard
)? "YES" : "NO" , sprint_hex ( uid
, 4 ));
1719 res
= mfCSetUID ( uid
, ( atqaPresent
)? atqa
: NULL
, ( atqaPresent
)? sak
: NULL
, oldUid
, wipeCard
);
1721 PrintAndLog ( "Can't set UID. error=%d" , res
);
1725 PrintAndLog ( "old UID:%s" , sprint_hex ( oldUid
, 4 ));
1726 PrintAndLog ( "new UID:%s" , sprint_hex ( uid
, 4 ));
1730 int CmdHF14AMfCSetBlk ( const char * Cmd
)
1732 uint8_t memBlock
[ 16 ] = { 0x00 };
1733 uint8_t blockNo
= 0 ;
1734 bool wipeCard
= false ;
1737 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1738 PrintAndLog ( "Usage: hf mf csetblk <block number> <block data (32 hex symbols)> [w]" );
1739 PrintAndLog ( "sample: hf mf csetblk 1 01020304050607080910111213141516" );
1740 PrintAndLog ( "Set block data for magic Chinese card (only works with such cards)" );
1741 PrintAndLog ( "If you also want wipe the card then add 'w' at the end of the command line" );
1745 blockNo
= param_get8 ( Cmd
, 0 );
1747 if ( param_gethex ( Cmd
, 1 , memBlock
, 32 )) {
1748 PrintAndLog ( "block data must include 32 HEX symbols" );
1752 char ctmp
= param_getchar ( Cmd
, 2 );
1753 wipeCard
= ( ctmp
== 'w' || ctmp
== 'W' );
1754 PrintAndLog ( "--block number:%2d data:%s" , blockNo
, sprint_hex ( memBlock
, 16 ));
1756 res
= mfCSetBlock ( blockNo
, memBlock
, NULL
, wipeCard
, CSETBLOCK_SINGLE_OPER
);
1758 PrintAndLog ( "Can't write block. error=%d" , res
);
1765 int CmdHF14AMfCLoad ( const char * Cmd
)
1768 char filename
[ FILE_PATH_SIZE
] = { 0x00 };
1769 char * fnameptr
= filename
;
1770 char buf
[ 64 ] = { 0x00 };
1771 uint8_t buf8
[ 64 ] = { 0x00 };
1772 uint8_t fillFromEmulator
= 0 ;
1773 int i
, len
, blockNum
, flags
= 0 ;
1775 if ( param_getchar ( Cmd
, 0 ) == 'h' || param_getchar ( Cmd
, 0 )== 0x00 ) {
1776 PrintAndLog ( "It loads magic Chinese card from the file `filename.eml`" );
1777 PrintAndLog ( "or from emulator memory (option `e`)" );
1778 PrintAndLog ( "Usage: hf mf cload <file name w/o `.eml`>" );
1779 PrintAndLog ( " or: hf mf cload e " );
1780 PrintAndLog ( " sample: hf mf cload filename" );
1784 char ctmp
= param_getchar ( Cmd
, 0 );
1785 if ( ctmp
== 'e' || ctmp
== 'E' ) fillFromEmulator
= 1 ;
1787 if ( fillFromEmulator
) {
1788 for ( blockNum
= 0 ; blockNum
< 16 * 4 ; blockNum
+= 1 ) {
1789 if ( mfEmlGetMem ( buf8
, blockNum
, 1 )) {
1790 PrintAndLog ( "Cant get block: %d" , blockNum
);
1793 if ( blockNum
== 0 ) flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
; // switch on field and send magic sequence
1794 if ( blockNum
== 1 ) flags
= 0 ; // just write
1795 if ( blockNum
== 16 * 4 - 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
; // Done. Magic Halt and switch off field.
1797 if ( mfCSetBlock ( blockNum
, buf8
, NULL
, 0 , flags
)) {
1798 PrintAndLog ( "Cant set magic card block: %d" , blockNum
);
1805 if ( len
> FILE_PATH_SIZE
- 5 ) len
= FILE_PATH_SIZE
- 5 ;
1807 memcpy ( filename
, Cmd
, len
);
1810 sprintf ( fnameptr
, ".eml" );
1813 f
= fopen ( filename
, "r" );
1815 PrintAndLog ( "File not found or locked." );
1822 memset ( buf
, 0 , sizeof ( buf
));
1824 if ( fgets ( buf
, sizeof ( buf
), f
) == NULL
) {
1826 PrintAndLog ( "File reading error." );
1830 if ( strlen ( buf
) < 32 ) {
1831 if ( strlen ( buf
) && feof ( f
))
1833 PrintAndLog ( "File content error. Block data must include 32 HEX symbols" );
1837 for ( i
= 0 ; i
< 32 ; i
+= 2 )
1838 sscanf (& buf
[ i
], "%02x" , ( unsigned int *)& buf8
[ i
/ 2 ]);
1840 if ( blockNum
== 0 ) flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
; // switch on field and send magic sequence
1841 if ( blockNum
== 1 ) flags
= 0 ; // just write
1842 if ( blockNum
== 16 * 4 - 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
; // Done. Switch off field.
1844 if ( mfCSetBlock ( blockNum
, buf8
, NULL
, 0 , flags
)) {
1845 PrintAndLog ( "Can't set magic card block: %d" , blockNum
);
1851 if ( blockNum
>= 16 * 4 ) break ; // magic card type - mifare 1K
1855 if ( blockNum
!= 16 * 4 && blockNum
!= 32 * 4 + 8 * 16 ){
1856 PrintAndLog ( "File content error. There must be 64 blocks" );
1859 PrintAndLog ( "Loaded from file: %s" , filename
);
1865 int CmdHF14AMfCGetBlk ( const char * Cmd
) {
1866 uint8_t memBlock
[ 16 ];
1867 uint8_t blockNo
= 0 ;
1869 memset ( memBlock
, 0x00 , sizeof ( memBlock
));
1871 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1872 PrintAndLog ( "Usage: hf mf cgetblk <block number>" );
1873 PrintAndLog ( "sample: hf mf cgetblk 1" );
1874 PrintAndLog ( "Get block data from magic Chinese card (only works with such cards) \n " );
1878 blockNo
= param_get8 ( Cmd
, 0 );
1880 PrintAndLog ( "--block number:%2d " , blockNo
);
1882 res
= mfCGetBlock ( blockNo
, memBlock
, CSETBLOCK_SINGLE_OPER
);
1884 PrintAndLog ( "Can't read block. error=%d" , res
);
1888 PrintAndLog ( "block data:%s" , sprint_hex ( memBlock
, 16 ));
1893 int CmdHF14AMfCGetSc ( const char * Cmd
) {
1894 uint8_t memBlock
[ 16 ] = { 0x00 };
1895 uint8_t sectorNo
= 0 ;
1898 if ( strlen ( Cmd
) < 1 || param_getchar ( Cmd
, 0 ) == 'h' ) {
1899 PrintAndLog ( "Usage: hf mf cgetsc <sector number>" );
1900 PrintAndLog ( "sample: hf mf cgetsc 0" );
1901 PrintAndLog ( "Get sector data from magic Chinese card (only works with such cards) \n " );
1905 sectorNo
= param_get8 ( Cmd
, 0 );
1906 if ( sectorNo
> 15 ) {
1907 PrintAndLog ( "Sector number must be in [0..15] as in MIFARE classic." );
1911 PrintAndLog ( "--sector number:%d " , sectorNo
);
1913 flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
;
1914 for ( i
= 0 ; i
< 4 ; i
++) {
1915 if ( i
== 1 ) flags
= 0 ;
1916 if ( i
== 3 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
;
1918 res
= mfCGetBlock ( sectorNo
* 4 + i
, memBlock
, flags
);
1920 PrintAndLog ( "Can't read block. %d error=%d" , sectorNo
* 4 + i
, res
);
1924 PrintAndLog ( "block %3d data:%s" , sectorNo
* 4 + i
, sprint_hex ( memBlock
, 16 ));
1930 int CmdHF14AMfCSave ( const char * Cmd
) {
1933 char filename
[ FILE_PATH_SIZE
] = { 0x00 };
1934 char * fnameptr
= filename
;
1935 uint8_t fillFromEmulator
= 0 ;
1936 uint8_t buf
[ 64 ] = { 0x00 };
1937 int i
, j
, len
, flags
;
1939 // memset(filename, 0, sizeof(filename));
1940 // memset(buf, 0, sizeof(buf));
1942 if ( param_getchar ( Cmd
, 0 ) == 'h' ) {
1943 PrintAndLog ( "It saves `magic Chinese` card dump into the file `filename.eml` or `cardID.eml`" );
1944 PrintAndLog ( "or into emulator memory (option `e`)" );
1945 PrintAndLog ( "Usage: hf mf esave [file name w/o `.eml`][e]" );
1946 PrintAndLog ( " sample: hf mf esave " );
1947 PrintAndLog ( " hf mf esave filename" );
1948 PrintAndLog ( " hf mf esave e \n " );
1952 char ctmp
= param_getchar ( Cmd
, 0 );
1953 if ( ctmp
== 'e' || ctmp
== 'E' ) fillFromEmulator
= 1 ;
1955 if ( fillFromEmulator
) {
1956 // put into emulator
1957 flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
;
1958 for ( i
= 0 ; i
< 16 * 4 ; i
++) {
1959 if ( i
== 1 ) flags
= 0 ;
1960 if ( i
== 16 * 4 - 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
;
1962 if ( mfCGetBlock ( i
, buf
, flags
)) {
1963 PrintAndLog ( "Cant get block: %d" , i
);
1967 if ( mfEmlSetMem ( buf
, i
, 1 )) {
1968 PrintAndLog ( "Cant set emul block: %d" , i
);
1975 if ( len
> FILE_PATH_SIZE
- 5 ) len
= FILE_PATH_SIZE
- 5 ;
1979 if ( mfCGetBlock ( 0 , buf
, CSETBLOCK_SINGLE_OPER
)) {
1980 PrintAndLog ( "Cant get block: %d" , 0 );
1981 len
= sprintf ( fnameptr
, "dump" );
1985 for ( j
= 0 ; j
< 7 ; j
++, fnameptr
+= 2 )
1986 sprintf ( fnameptr
, "%02x" , buf
[ j
]);
1989 memcpy ( filename
, Cmd
, len
);
1993 sprintf ( fnameptr
, ".eml" );
1996 f
= fopen ( filename
, "w+" );
1999 PrintAndLog ( "File not found or locked." );
2004 flags
= CSETBLOCK_INIT_FIELD
+ CSETBLOCK_WUPC
;
2005 for ( i
= 0 ; i
< 16 * 4 ; i
++) {
2006 if ( i
== 1 ) flags
= 0 ;
2007 if ( i
== 16 * 4 - 1 ) flags
= CSETBLOCK_HALT
+ CSETBLOCK_RESET_FIELD
;
2009 if ( mfCGetBlock ( i
, buf
, flags
)) {
2010 PrintAndLog ( "Cant get block: %d" , i
);
2013 for ( j
= 0 ; j
< 16 ; j
++)
2014 fprintf ( f
, "%02x" , buf
[ j
]);
2019 PrintAndLog ( "Saved to file: %s" , filename
);
2026 int CmdHF14AMfSniff ( const char * Cmd
){
2028 bool wantLogToFile
= 0 ;
2029 bool wantDecrypt
= 0 ;
2030 //bool wantSaveToEml = 0; TODO
2031 bool wantSaveToEmlFile
= 0 ;
2041 uint8_t atqa
[ 2 ] = { 0x00 };
2044 uint8_t * buf
= NULL
;
2045 uint16_t bufsize
= 0 ;
2046 uint8_t * bufPtr
= NULL
;
2048 char ctmp
= param_getchar ( Cmd
, 0 );
2049 if ( ctmp
== 'h' || ctmp
== 'H' ) {
2050 PrintAndLog ( "It continuously gets data from the field and saves it to: log, emulator, emulator file." );
2051 PrintAndLog ( "You can specify:" );
2052 PrintAndLog ( " l - save encrypted sequence to logfile `uid.log`" );
2053 PrintAndLog ( " d - decrypt sequence and put it to log file `uid.log`" );
2054 PrintAndLog ( " n/a e - decrypt sequence, collect read and write commands and save the result of the sequence to emulator memory" );
2055 PrintAndLog ( " f - decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`" );
2056 PrintAndLog ( "Usage: hf mf sniff [l][d][e][f]" );
2057 PrintAndLog ( " sample: hf mf sniff l d e" );
2061 for ( int i
= 0 ; i
< 4 ; i
++) {
2062 ctmp
= param_getchar ( Cmd
, i
);
2063 if ( ctmp
== 'l' || ctmp
== 'L' ) wantLogToFile
= true ;
2064 if ( ctmp
== 'd' || ctmp
== 'D' ) wantDecrypt
= true ;
2065 //if (ctmp == 'e' || ctmp == 'E') wantSaveToEml = true; TODO
2066 if ( ctmp
== 'f' || ctmp
== 'F' ) wantSaveToEmlFile
= true ;
2069 printf ( "------------------------------------------------------------------------- \n " );
2070 printf ( "Executing command. \n " );
2071 printf ( "Press the key on the proxmark3 device to abort both proxmark3 and client. \n " );
2072 printf ( "Press the key on pc keyboard to abort the client. \n " );
2073 printf ( "------------------------------------------------------------------------- \n " );
2075 UsbCommand c
= { CMD_MIFARE_SNIFFER
, { 0 , 0 , 0 }};
2076 clearCommandBuffer ();
2085 printf ( " \n aborted via keyboard! \n " );
2090 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 2000 )) {
2091 res
= resp
. arg
[ 0 ] & 0xff ;
2092 uint16_t traceLen
= resp
. arg
[ 1 ];
2095 if ( res
== 0 ) { // we are done
2100 if ( res
== 1 ) { // there is (more) data to be transferred
2101 if ( pckNum
== 0 ) { // first packet, (re)allocate necessary buffer
2102 if ( traceLen
> bufsize
|| buf
== NULL
) {
2104 if ( buf
== NULL
) { // not yet allocated
2105 p
= malloc ( traceLen
);
2106 } else { // need more memory
2107 p
= realloc ( buf
, traceLen
);
2110 PrintAndLog ( "Cannot allocate memory for trace" );
2118 memset ( buf
, 0x00 , traceLen
);
2120 memcpy ( bufPtr
, resp
. d
. asBytes
, len
);
2125 if ( res
== 2 ) { // received all data, start displaying
2126 blockLen
= bufPtr
- buf
;
2129 PrintAndLog ( "received trace len: %d packages: %d" , blockLen
, pckNum
);
2130 while ( bufPtr
- buf
< blockLen
) {
2131 bufPtr
+= 6 ; // skip (void) timing information
2132 len
= *(( uint16_t *) bufPtr
);
2140 if (( len
== 14 ) && ( bufPtr
[ 0 ] == 0xff ) && ( bufPtr
[ 1 ] == 0xff ) && ( bufPtr
[ 12 ] == 0xff ) && ( bufPtr
[ 13 ] == 0xff )) {
2141 memcpy ( uid
, bufPtr
+ 2 , 7 );
2142 memcpy ( atqa
, bufPtr
+ 2 + 7 , 2 );
2143 uid_len
= ( atqa
[ 0 ] & 0xC0 ) == 0x40 ? 7 : 4 ;
2145 PrintAndLog ( "tag select uid:%s atqa:0x%02x%02x sak:0x%02x" ,
2146 sprint_hex ( uid
+ ( 7 - uid_len
), uid_len
),
2150 if ( wantLogToFile
|| wantDecrypt
) {
2151 FillFileNameByUID ( logHexFileName
, uid
+ ( 7 - uid_len
), ".log" , uid_len
);
2152 AddLogCurrentDT ( logHexFileName
);
2155 mfTraceInit ( uid
, atqa
, sak
, wantSaveToEmlFile
);
2157 PrintAndLog ( "%s(%d):%s" , isTag
? "TAG" : "RDR" , num
, sprint_hex ( bufPtr
, len
));
2159 AddLogHex ( logHexFileName
, isTag
? "TAG: " : "RDR: " , bufPtr
, len
);
2161 mfTraceDecode ( bufPtr
, len
, wantSaveToEmlFile
);
2165 bufPtr
+= (( len
- 1 )/ 8 + 1 ); // ignore parity
2176 //needs nt, ar, at, Data to decrypt
2177 int CmdDecryptTraceCmds ( const char * Cmd
){
2180 param_gethex_ex ( Cmd
, 3 , data
,& len
);
2181 return tryDecryptWord ( param_get32ex ( Cmd
, 0 , 0 , 16 ), param_get32ex ( Cmd
, 1 , 0 , 16 ), param_get32ex ( Cmd
, 2 , 0 , 16 ), data
, len
/ 2 );
2184 static command_t CommandTable
[] =
2186 { "help" , CmdHelp
, 1 , "This help" },
2187 { "dbg" , CmdHF14AMfDbg
, 0 , "Set default debug mode" },
2188 { "rdbl" , CmdHF14AMfRdBl
, 0 , "Read MIFARE classic block" },
2189 { "rdsc" , CmdHF14AMfRdSc
, 0 , "Read MIFARE classic sector" },
2190 { "dump" , CmdHF14AMfDump
, 0 , "Dump MIFARE classic tag to binary file" },
2191 { "restore" , CmdHF14AMfRestore
, 0 , "Restore MIFARE classic binary file to BLANK tag" },
2192 { "wrbl" , CmdHF14AMfWrBl
, 0 , "Write MIFARE classic block" },
2193 { "chk" , CmdHF14AMfChk
, 0 , "Test block keys" },
2194 { "mifare" , CmdHF14AMifare
, 0 , "Read parity error messages." },
2195 { "nested" , CmdHF14AMfNested
, 0 , "Test nested authentication" },
2196 { "sniff" , CmdHF14AMfSniff
, 0 , "Sniff card-reader communication" },
2197 { "sim" , CmdHF14AMf1kSim
, 0 , "Simulate MIFARE card" },
2198 { "eclr" , CmdHF14AMfEClear
, 0 , "Clear simulator memory block" },
2199 { "eget" , CmdHF14AMfEGet
, 0 , "Get simulator memory block" },
2200 { "eset" , CmdHF14AMfESet
, 0 , "Set simulator memory block" },
2201 { "eload" , CmdHF14AMfELoad
, 0 , "Load from file emul dump" },
2202 { "esave" , CmdHF14AMfESave
, 0 , "Save to file emul dump" },
2203 { "ecfill" , CmdHF14AMfECFill
, 0 , "Fill simulator memory with help of keys from simulator" },
2204 { "ekeyprn" , CmdHF14AMfEKeyPrn
, 0 , "Print keys from simulator memory" },
2205 { "csetuid" , CmdHF14AMfCSetUID
, 0 , "Set UID for magic Chinese card" },
2206 { "csetblk" , CmdHF14AMfCSetBlk
, 0 , "Write block - Magic Chinese card" },
2207 { "cgetblk" , CmdHF14AMfCGetBlk
, 0 , "Read block - Magic Chinese card" },
2208 { "cgetsc" , CmdHF14AMfCGetSc
, 0 , "Read sector - Magic Chinese card" },
2209 { "cload" , CmdHF14AMfCLoad
, 0 , "Load dump into magic Chinese card" },
2210 { "csave" , CmdHF14AMfCSave
, 0 , "Save dump from magic Chinese card into file or emulator" },
2211 { "decrypt" , CmdDecryptTraceCmds
, 1 , "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace" },
2212 { NULL
, NULL
, 0 , NULL
}
2215 int CmdHFMF ( const char * Cmd
)
2218 WaitForResponseTimeout ( CMD_ACK
, NULL
, 100 );
2220 CmdsParse ( CommandTable
, Cmd
);
2224 int CmdHelp ( const char * Cmd
)
2226 CmdsHelp ( CommandTable
);