PrintAndLog("options:");\r
PrintAndLog(" h this help");\r
PrintAndLog(" <block number> (Optional) target other key A than block 0.");\r
- PrintAndLog("sample:");\r
+ PrintAndLog("samples:");\r
PrintAndLog(" hf mf mifare");\r
PrintAndLog(" hf mf mifare 16");\r
return 0;\r
int usage_hf14_mf1ksim(void){\r
PrintAndLog("Usage: hf mf sim [h] u <uid (8,14,20 hex symbols)> n <numreads> i x");\r
PrintAndLog("options:");\r
- PrintAndLog(" h this help");\r
- PrintAndLog(" u (Optional) UID 4,7 or 10bytes. If not specified, the UID 4b from emulator memory will be used");\r
- PrintAndLog(" n (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");\r
- PrintAndLog(" i (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");\r
- PrintAndLog(" x (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r
+ PrintAndLog(" h this help");\r
+ PrintAndLog(" u (Optional) UID 4,7 or 10bytes. If not specified, the UID 4b from emulator memory will be used");\r
+ PrintAndLog(" n (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");\r
+ PrintAndLog(" i (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");\r
+ PrintAndLog(" x (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r
PrintAndLog("samples:");\r
PrintAndLog(" hf mf sim u 0a0a0a0a");\r
PrintAndLog(" hf mf sim u 11223344556677");\r
PrintAndLog("It continuously gets data from the field and saves it to: log, emulator, emulator file.");\r
PrintAndLog("Usage: hf mf sniff [h] [l] [d] [f]");\r
PrintAndLog("options:");\r
- PrintAndLog(" h this help");\r
- PrintAndLog(" l save encrypted sequence to logfile `uid.log`");\r
- PrintAndLog(" d decrypt sequence and put it to log file `uid.log`");\r
-// PrintAndLog(" n/a e decrypt sequence, collect read and write commands and save the result of the sequence to emulator memory");\r
- PrintAndLog(" f decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`");\r
+ PrintAndLog(" h this help");\r
+ PrintAndLog(" l save encrypted sequence to logfile `uid.log`");\r
+ PrintAndLog(" d decrypt sequence and put it to log file `uid.log`");\r
+// PrintAndLog(" n/a e decrypt sequence, collect read and write commands and save the result of the sequence to emulator memory");\r
+ PrintAndLog(" f decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`");\r
PrintAndLog("sample:");\r
PrintAndLog(" hf mf sniff l d f");\r
return 0;\r
}\r
+int usage_hf14_nested(void){\r
+ PrintAndLog("Usage:");\r
+ PrintAndLog(" all sectors: hf mf nested <card memory> <block number> <key A/B> <key (12 hex symbols)> [t,d]");\r
+ PrintAndLog(" one sector: hf mf nested o <block number> <key A/B> <key (12 hex symbols)>");\r
+ PrintAndLog(" <target block number> <target key A/B> [t]");\r
+ PrintAndLog("options:");\r
+ PrintAndLog(" h this help");\r
+ PrintAndLog(" card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");\r
+ PrintAndLog(" t transfer keys into emulator memory");\r
+ PrintAndLog(" d write keys to binary file");\r
+ PrintAndLog(" ");\r
+ PrintAndLog("samples:");\r
+ PrintAndLog(" hf mf nested 1 0 A FFFFFFFFFFFF ");\r
+ PrintAndLog(" hf mf nested 1 0 A FFFFFFFFFFFF t ");\r
+ PrintAndLog(" hf mf nested 1 0 A FFFFFFFFFFFF d ");\r
+ PrintAndLog(" hf mf nested o 0 A FFFFFFFFFFFF 4 A");\r
+ return 0;\r
+}\r
+int usage_hf14_hardnested(void){\r
+ PrintAndLog("Usage:");\r
+ PrintAndLog(" hf mf hardnested <block number> <key A|B> <key (12 hex symbols)>");\r
+ PrintAndLog(" <target block number> <target key A|B> [known target key (12 hex symbols)] [w] [s]");\r
+ PrintAndLog(" or hf mf hardnested r [known target key]");\r
+ PrintAndLog(" ");\r
+ PrintAndLog("options:");\r
+ PrintAndLog(" h this help"); \r
+ PrintAndLog(" w acquire nonces and write them to binary file nonces.bin");\r
+ PrintAndLog(" s slower acquisition (required by some non standard cards)");\r
+ PrintAndLog(" r read nonces.bin and start attack");\r
+ PrintAndLog(" ");\r
+ PrintAndLog("samples:");\r
+ PrintAndLog(" hf mf hardnested 0 A FFFFFFFFFFFF 4 A");\r
+ PrintAndLog(" hf mf hardnested 0 A FFFFFFFFFFFF 4 A w");\r
+ PrintAndLog(" hf mf hardnested 0 A FFFFFFFFFFFF 4 A w s");\r
+ PrintAndLog(" hf mf hardnested r");\r
+ PrintAndLog(" ");\r
+ PrintAndLog("Add the known target key to check if it is present in the remaining key space:");\r
+ PrintAndLog(" sample5: hf mf hardnested 0 A A0A1A2A3A4A5 4 A FFFFFFFFFFFF");\r
+ return 0;\r
+}\r
+int usage_hf14_chk(void){\r
+ PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d] [<key (12 hex symbols)>] [<dic (*.dic)>]");\r
+ PrintAndLog("options:");\r
+ PrintAndLog(" h this help"); \r
+ PrintAndLog(" * all sectors");\r
+ PrintAndLog(" card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");\r
+ PrintAndLog(" d write keys to binary file");\r
+ PrintAndLog(" t write keys to emulator memory\n");\r
+ PrintAndLog(" ");\r
+ PrintAndLog("samples:");\r
+ PrintAndLog(" hf mf chk 0 A 1234567890ab keys.dic");\r
+ PrintAndLog(" hf mf chk *1 ? t");\r
+ PrintAndLog(" hf mf chk *1 ? d");\r
+ return 0;\r
+}\r
\r
int CmdHF14AMifare(const char *Cmd) {\r
uint32_t uid = 0;\r
printf("Press button on the proxmark3 device to abort both proxmark3 and client.\n");\r
printf("-------------------------------------------------------------------------\n");\r
clock_t t1 = clock();\r
+ time_t start, end;\r
+ time(&start);\r
\r
start:\r
clearCommandBuffer();\r
\r
switch (isOK) {\r
case -1 : PrintAndLog("Button pressed. Aborted.\n"); break;\r
- case -2 : PrintAndLog("Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests).\n"); break;\r
- case -3 : PrintAndLog("Card is not vulnerable to Darkside attack (its random number generator is not predictable).\n"); break;\r
- case -4 : PrintAndLog("Card is not vulnerable to Darkside attack (its random number generator seems to be based on the wellknown");\r
+ case -2 : PrintAndLog("Card isn't vulnerable to Darkside attack (doesn't send NACK on authentication requests).\n"); break;\r
+ case -3 : PrintAndLog("Card isn't vulnerable to Darkside attack (its random number generator is not predictable).\n"); break;\r
+ case -4 : PrintAndLog("Card isn't vulnerable to Darkside attack (its random number generator seems to be based on the wellknown");\r
PrintAndLog("generating polynomial with 16 effective bits only, but shows unexpected behaviour.\n"); break;\r
default: ;\r
}\r
}\r
END:\r
t1 = clock() - t1;\r
+ time(&end);\r
+ unsigned long elapsed_time = difftime(end, start); \r
if ( t1 > 0 )\r
- PrintAndLog("Time in darkside: %.0f ticks\n", (float)t1);\r
+ PrintAndLog("Time in darkside: %.0f ticks %u seconds\n", (float)t1, elapsed_time);\r
return 0;\r
}\r
\r
-int CmdHF14AMfWrBl(const char *Cmd)\r
-{\r
+int CmdHF14AMfWrBl(const char *Cmd) {\r
uint8_t blockNo = 0;\r
uint8_t keyType = 0;\r
uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r
return 0;\r
}\r
\r
-int CmdHF14AMfRdBl(const char *Cmd)\r
-{\r
+int CmdHF14AMfRdBl(const char *Cmd) {\r
uint8_t blockNo = 0;\r
uint8_t keyType = 0;\r
uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r
return 0;\r
}\r
\r
-int CmdHF14AMfRdSc(const char *Cmd)\r
-{\r
+int CmdHF14AMfRdSc(const char *Cmd) {\r
int i;\r
uint8_t sectorNo = 0;\r
uint8_t keyType = 0;\r
return 0;\r
}\r
\r
-uint8_t FirstBlockOfSector(uint8_t sectorNo)\r
-{\r
+uint8_t FirstBlockOfSector(uint8_t sectorNo) {\r
if (sectorNo < 32) {\r
return sectorNo * 4;\r
} else {\r
}\r
}\r
\r
-uint8_t NumBlocksPerSector(uint8_t sectorNo)\r
-{\r
+uint8_t NumBlocksPerSector(uint8_t sectorNo) {\r
if (sectorNo < 32) {\r
return 4;\r
} else {\r
FILE *fkeys;\r
uint8_t standart[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};\r
uint8_t tempkey[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};\r
- \r
- char cmdp, ctmp;\r
\r
- if (strlen(Cmd)<3) {\r
- PrintAndLog("Usage:");\r
- PrintAndLog(" all sectors: hf mf nested <card memory> <block number> <key A/B> <key (12 hex symbols)> [t,d]");\r
- PrintAndLog(" one sector: hf mf nested o <block number> <key A/B> <key (12 hex symbols)>");\r
- PrintAndLog(" <target block number> <target key A/B> [t]");\r
- PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");\r
- PrintAndLog("t - transfer keys into emulator memory");\r
- PrintAndLog("d - write keys to binary file");\r
- PrintAndLog(" ");\r
- PrintAndLog(" samples:");\r
- PrintAndLog(" hf mf nested 1 0 A FFFFFFFFFFFF ");\r
- PrintAndLog(" hf mf nested 1 0 A FFFFFFFFFFFF t ");\r
- PrintAndLog(" hf mf nested 1 0 A FFFFFFFFFFFF d ");\r
- PrintAndLog(" hf mf nested o 0 A FFFFFFFFFFFF 4 A");\r
- return 0;\r
- } \r
+ if (strlen(Cmd)<3) return usage_hf14_nested();\r
\r
+ char cmdp, ctmp;\r
cmdp = param_getchar(Cmd, 0);\r
blockNo = param_get8(Cmd, 1);\r
ctmp = param_getchar(Cmd, 2);\r
- \r
+\r
if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {\r
PrintAndLog("Key type must be A or B");\r
return 1;\r
switch (isOK) {\r
case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;\r
case -2 : PrintAndLog("Button pressed. Aborted.\n"); break;\r
- case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (random numbers are not predictable).\n"); break;\r
+ case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (its random number generator is not predictable).\n"); break;\r
case -4 : PrintAndLog("No valid key found"); break;\r
case -5 : \r
key64 = bytes_to_num(keyBlock, 6);\r
}\r
else { // ------------------------------------ multiple sectors working\r
clock_t t1 = clock();\r
-\r
+ unsigned long elapsed_time;\r
+ time_t start, end;\r
+ time(&start);\r
+ \r
e_sector = calloc(SectorsCnt, sizeof(sector));\r
if (e_sector == NULL) return 1;\r
\r
}\r
}\r
clock_t t2 = clock() - t1;\r
+ time(&end);\r
+ elapsed_time = difftime(end, start); \r
if ( t2 > 0 )\r
- PrintAndLog("Time to check 6 known keys: %.0f ticks", (float)t2 );\r
-\r
+ PrintAndLog("Time to check 6 known keys: %.0f ticks %u seconds\n", (float)t2 , elapsed_time);\r
+ \r
PrintAndLog("enter nested..."); \r
\r
// nested sectors\r
switch (isOK) {\r
case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;\r
case -2 : PrintAndLog("Button pressed. Aborted.\n"); break;\r
- case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (random numbers are not predictable).\n"); break;\r
+ case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (its random number generator is not predictable).\n"); break;\r
case -4 : //key not found\r
calibrate = false;\r
iterations++;\r
}\r
\r
t1 = clock() - t1;\r
+ time(&end);\r
+ elapsed_time = difftime(end, start); \r
if ( t1 > 0 )\r
- PrintAndLog("Time in nested: %.0f ticks \n", (float)t1);\r
+ PrintAndLog("Time in nested: %.0f ticks %u seconds\n", (float)t1, elapsed_time);\r
+\r
\r
// 20160116 If Sector A is found, but not Sector B, try just reading it of the tag?\r
PrintAndLog("trying to read key B...");\r
\r
char ctmp;\r
ctmp = param_getchar(Cmd, 0);\r
-\r
- if (ctmp != 'R' && ctmp != 'r' && ctmp != 'T' && ctmp != 't' && strlen(Cmd) < 20) {\r
- PrintAndLog("Usage:");\r
- PrintAndLog(" hf mf hardnested <block number> <key A|B> <key (12 hex symbols)>");\r
- PrintAndLog(" <target block number> <target key A|B> [known target key (12 hex symbols)] [w] [s]");\r
- PrintAndLog(" or hf mf hardnested r [known target key]");\r
- PrintAndLog(" ");\r
- PrintAndLog("Options: ");\r
- PrintAndLog(" w: Acquire nonces and write them to binary file nonces.bin");\r
- PrintAndLog(" s: Slower acquisition (required by some non standard cards)");\r
- PrintAndLog(" r: Read nonces.bin and start attack");\r
- PrintAndLog(" ");\r
- PrintAndLog(" sample1: hf mf hardnested 0 A FFFFFFFFFFFF 4 A");\r
- PrintAndLog(" sample2: hf mf hardnested 0 A FFFFFFFFFFFF 4 A w");\r
- PrintAndLog(" sample3: hf mf hardnested 0 A FFFFFFFFFFFF 4 A w s");\r
- PrintAndLog(" sample4: hf mf hardnested r");\r
- PrintAndLog(" ");\r
- PrintAndLog("Add the known target key to check if it is present in the remaining key space:");\r
- PrintAndLog(" sample5: hf mf hardnested 0 A A0A1A2A3A4A5 4 A FFFFFFFFFFFF");\r
- return 0;\r
- } \r
+ if (ctmp != 'H' && ctmp != 'h' ) return usage_hf14_hardnested();\r
+ if (ctmp != 'R' && ctmp != 'r' && ctmp != 'T' && ctmp != 't' && strlen(Cmd) < 20) return usage_hf14_hardnested();\r
\r
bool know_target_key = false;\r
bool nonce_file_read = false;\r
bool slow = false;\r
int tests = 0;\r
\r
- \r
if (ctmp == 'R' || ctmp == 'r') {\r
nonce_file_read = true;\r
if (!param_gethex(Cmd, 1, trgkey, 12)) {\r
}\r
\r
int CmdHF14AMfChk(const char *Cmd) {\r
- if (strlen(Cmd)<3) {\r
- PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d] [<key (12 hex symbols)>] [<dic (*.dic)>]");\r
- PrintAndLog(" * - all sectors");\r
- PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");\r
- PrintAndLog("d - write keys to binary file");\r
- PrintAndLog("t - write keys to emulator memory\n");\r
- PrintAndLog(" sample: hf mf chk 0 A 1234567890ab keys.dic");\r
- PrintAndLog(" hf mf chk *1 ? t");\r
- PrintAndLog(" hf mf chk *1 ? d");\r
- return 0;\r
- } \r
+\r
+ if (strlen(Cmd)<3) return usage_hf14_chk();\r
\r
FILE * f;\r
char filename[FILE_PATH_SIZE]={0};\r
return 1;\r
}\r
\r
+ // empty e_sector\r
+ for(int i = 0; i < SectorsCnt; ++i){\r
+ e_sector[i].Key[0] = 0xffffffffffff;\r
+ e_sector[i].Key[1] = 0xffffffffffff;\r
+ e_sector[i].foundKey[0] = FALSE;\r
+ e_sector[i].foundKey[1] = FALSE;\r
+ }\r
+ \r
+ \r
uint8_t trgKeyType = 0;\r
uint32_t max_keys = keycnt > (USB_CMD_DATA_SIZE/6) ? (USB_CMD_DATA_SIZE/6) : keycnt;\r
\r
// time\r
clock_t t1 = clock();\r
+ time_t start, end;\r
+ time(&start);\r
\r
// check keys.\r
for (trgKeyType = !keyType; trgKeyType < 2; (keyType==2) ? (++trgKeyType) : (trgKeyType=2) ) {\r
\r
// skip already found keys.\r
if (e_sector[i].foundKey[trgKeyType]) continue;\r
- \r
- \r
+ \r
for (uint32_t c = 0; c < keycnt; c += max_keys) {\r
\r
uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c;\r
\r
res = mfCheckKeys(b, trgKeyType, true, size, &keyBlock[6*c], &key64);\r
if (!res) {\r
- //PrintAndLog("Sector:%3d Block:%3d, key type: %C -- Found key [%012"llx"]", i, b, trgKeyType ? 'B':'A', key64);\r
- \r
e_sector[i].Key[trgKeyType] = key64;\r
e_sector[i].foundKey[trgKeyType] = TRUE;\r
break;\r
- } else { \r
- e_sector[i].Key[trgKeyType] = 0xffffffffffff;\r
- e_sector[i].foundKey[trgKeyType] = FALSE;\r
}\r
printf(".");\r
fflush(stdout);\r
}\r
}\r
t1 = clock() - t1;\r
+ time(&end);\r
+ unsigned long elapsed_time = difftime(end, start); \r
if ( t1 > 0 )\r
- printf("\nTime in checkkeys: %.0f ticks\n", (float)t1);\r
+ PrintAndLog("\nTime in checkkeys: %.0f ticks %u seconds\n", (float)t1, elapsed_time);\r
\r
+ \r
// 20160116 If Sector A is found, but not Sector B, try just reading it of the tag?\r
- PrintAndLog("testing to read B...");\r
- for (i = 0; i < SectorsCnt; i++) {\r
- // KEY A but not KEY B\r
- if ( e_sector[i].foundKey[0] && !e_sector[i].foundKey[1] ) {\r
- \r
- uint8_t sectrail = (FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1);\r
- \r
- PrintAndLog("Reading block %d", sectrail);\r
- \r
- UsbCommand c = {CMD_MIFARE_READBL, {sectrail, 0, 0}};\r
- num_to_bytes(e_sector[i].Key[0], 6, c.d.asBytes); // KEY A\r
- clearCommandBuffer();\r
- SendCommand(&c);\r
-\r
- UsbCommand resp;\r
- if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500)) continue;\r
+ if ( keyType != 1 ) {\r
+ PrintAndLog("testing to read key B...");\r
+ for (i = 0; i < SectorsCnt; i++) {\r
+ // KEY A but not KEY B\r
+ if ( e_sector[i].foundKey[0] && !e_sector[i].foundKey[1] ) {\r
+ \r
+ uint8_t sectrail = (FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1);\r
\r
- uint8_t isOK = resp.arg[0] & 0xff;\r
- if (!isOK) continue;\r
-\r
- uint8_t *data = resp.d.asBytes;\r
- key64 = bytes_to_num(data+10, 6);\r
- if (key64) {\r
- PrintAndLog("Data:%s", sprint_hex(data+10, 6));\r
- e_sector[i].foundKey[1] = 1;\r
- e_sector[i].Key[1] = key64;\r
+ PrintAndLog("Reading block %d", sectrail);\r
+ \r
+ UsbCommand c = {CMD_MIFARE_READBL, {sectrail, 0, 0}};\r
+ num_to_bytes(e_sector[i].Key[0], 6, c.d.asBytes); // KEY A\r
+ clearCommandBuffer();\r
+ SendCommand(&c);\r
+\r
+ UsbCommand resp;\r
+ if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500)) continue;\r
+ \r
+ uint8_t isOK = resp.arg[0] & 0xff;\r
+ if (!isOK) continue;\r
+\r
+ uint8_t *data = resp.d.asBytes;\r
+ key64 = bytes_to_num(data+10, 6);\r
+ if (key64) {\r
+ PrintAndLog("Data:%s", sprint_hex(data+10, 6));\r
+ e_sector[i].foundKey[1] = 1;\r
+ e_sector[i].Key[1] = key64;\r
+ }\r
}\r
}\r
}\r
projects / proxmark3-svn / blobdiff