Merge remote-tracking branch 'upstream/master'

[proxmark3-svn] / client / cmdhfmf.c

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 43eca8cb2cdd40ecad54f1d2faa88df9b2489f0f..cdac64764dd33dd554c6dbd1a7c785f7038db7ef 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -1016,7 +1016,7 @@ int CmdHF14AMfChk(const char *Cmd)
        return 0;\r
 }\r
 \r
        return 0;\r
 }\r
 \r

-void readerAttack(nonces_t ar_resp[], bool setEmulatorMem) {\r
+void readerAttack(nonces_t ar_resp[], bool setEmulatorMem, bool doStandardAttack) {\r

        #define ATTACK_KEY_COUNT 8 // keep same as define in iso14443a.c -> Mifare1ksim()\r
        uint64_t key = 0;\r
        typedef struct {\r
        #define ATTACK_KEY_COUNT 8 // keep same as define in iso14443a.c -> Mifare1ksim()\r
        uint64_t key = 0;\r
        typedef struct {\r


@@ -1034,7 +1034,7 @@ void readerAttack(nonces_t ar_resp[], bool setEmulatorMem) {
        for (uint8_t i = 0; i<ATTACK_KEY_COUNT; i++) {\r
                if (ar_resp[i].ar2 > 0) {\r
                        //PrintAndLog("DEBUG: Trying sector %d, cuid %08x, nt %08x, ar %08x, nr %08x, ar2 %08x, nr2 %08x",ar_resp[i].sector, ar_resp[i].cuid,ar_resp[i].nonce,ar_resp[i].ar,ar_resp[i].nr,ar_resp[i].ar2,ar_resp[i].nr2);\r
        for (uint8_t i = 0; i<ATTACK_KEY_COUNT; i++) {\r
                if (ar_resp[i].ar2 > 0) {\r
                        //PrintAndLog("DEBUG: Trying sector %d, cuid %08x, nt %08x, ar %08x, nr %08x, ar2 %08x, nr2 %08x",ar_resp[i].sector, ar_resp[i].cuid,ar_resp[i].nonce,ar_resp[i].ar,ar_resp[i].nr,ar_resp[i].ar2,ar_resp[i].nr2);\r

-                       if (mfkey32(ar_resp[i], &key)) {\r
+                       if (doStandardAttack && mfkey32(ar_resp[i], &key)) {\r

                                PrintAndLog("  Found Key%s for sector %02d: [%04x%08x]", (ar_resp[i].keytype) ? "B" : "A", ar_resp[i].sector, (uint32_t) (key>>32), (uint32_t) (key &0xFFFFFFFF));\r
 \r
                                for (uint8_t ii = 0; ii<ATTACK_KEY_COUNT; ii++) {\r
                                PrintAndLog("  Found Key%s for sector %02d: [%04x%08x]", (ar_resp[i].keytype) ? "B" : "A", ar_resp[i].sector, (uint32_t) (key>>32), (uint32_t) (key &0xFFFFFFFF));\r
 \r
                                for (uint8_t ii = 0; ii<ATTACK_KEY_COUNT; ii++) {\r


@@ -1054,6 +1054,34 @@ void readerAttack(nonces_t ar_resp[], bool setEmulatorMem) {
                                                }\r
                                        }\r
                                }\r
                                                }\r
                                        }\r
                                }\r

+                       } else if (tryMfk32_moebius(ar_resp[i+ATTACK_KEY_COUNT], &key)) {\r
+                               uint8_t sectorNum = ar_resp[i+ATTACK_KEY_COUNT].sector;\r
+                               uint8_t keyType = ar_resp[i+ATTACK_KEY_COUNT].keytype;\r
+\r
+                               PrintAndLog("M-Found Key%s for sector %02d: [%012"llx"]"\r
+                                       , keyType ? "B" : "A"\r
+                                       , sectorNum\r
+                                       , key\r
+                               );\r
+\r
+                               for (uint8_t ii = 0; ii<ATTACK_KEY_COUNT; ii++) {\r
+                                       if (key_cnt[ii]==0 || stSector[ii]==sectorNum) {\r
+                                               if (keyType==0) {\r
+                                                       //keyA\r
+                                                       sector_trailer[ii].keyA = key;\r
+                                                       stSector[ii] = sectorNum;\r
+                                                       key_cnt[ii]++;\r
+                                                       break;\r
+                                               } else {\r
+                                                       //keyB\r
+                                                       sector_trailer[ii].keyB = key;\r
+                                                       stSector[ii] = sectorNum;\r
+                                                       key_cnt[ii]++;\r
+                                                       break;\r
+                                               }\r
+                                       }\r
+                               }\r
+                               continue;\r

                        }\r
                }\r
        }\r
                        }\r
                }\r
        }\r


@@ -1079,14 +1107,15 @@ void readerAttack(nonces_t ar_resp[], bool setEmulatorMem) {
                        }\r
                }\r
        }\r
                        }\r
                }\r
        }\r

-       //moebius attack\r
+       /*\r
+       //un-comment to use as well moebius attack\r

        for (uint8_t i = ATTACK_KEY_COUNT; i<ATTACK_KEY_COUNT*2; i++) {\r
                if (ar_resp[i].ar2 > 0) {\r
                        if (tryMfk32_moebius(ar_resp[i], &key)) {\r
                                PrintAndLog("M-Found Key%s for sector %02d: [%04x%08x]", (ar_resp[i].keytype) ? "B" : "A", ar_resp[i].sector, (uint32_t) (key>>32), (uint32_t) (key &0xFFFFFFFF));\r
                        }\r
                }\r
        for (uint8_t i = ATTACK_KEY_COUNT; i<ATTACK_KEY_COUNT*2; i++) {\r
                if (ar_resp[i].ar2 > 0) {\r
                        if (tryMfk32_moebius(ar_resp[i], &key)) {\r
                                PrintAndLog("M-Found Key%s for sector %02d: [%04x%08x]", (ar_resp[i].keytype) ? "B" : "A", ar_resp[i].sector, (uint32_t) (key>>32), (uint32_t) (key &0xFFFFFFFF));\r
                        }\r
                }\r

-       }\r
+       }*/\r

 }\r
 \r
 int usage_hf14_mf1ksim(void) {\r
 }\r
 \r
 int usage_hf14_mf1ksim(void) {\r


@@ -1099,6 +1128,7 @@ int usage_hf14_mf1ksim(void) {
        PrintAndLog("      x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r
        PrintAndLog("      e    (Optional) set keys found from 'reader attack' to emulator memory (implies x and i)");\r
        PrintAndLog("      f    (Optional) get UIDs to use for 'reader attack' from file 'f <filename.txt>' (implies x and i)");\r
        PrintAndLog("      x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r
        PrintAndLog("      e    (Optional) set keys found from 'reader attack' to emulator memory (implies x and i)");\r
        PrintAndLog("      f    (Optional) get UIDs to use for 'reader attack' from file 'f <filename.txt>' (implies x and i)");\r

+       PrintAndLog("      r    (Optional) Generate random nonces instead of sequential nonces. Standard reader attack won't work with this option, only moebius attack works.");\r

        PrintAndLog("samples:");\r
        PrintAndLog("           hf mf sim u 0a0a0a0a");\r
        PrintAndLog("           hf mf sim u 11223344556677");\r
        PrintAndLog("samples:");\r
        PrintAndLog("           hf mf sim u 0a0a0a0a");\r
        PrintAndLog("           hf mf sim u 11223344556677");\r


@@ -1163,6 +1193,11 @@ int CmdHF14AMf1kSim(const char *Cmd) {
                        exitAfterNReads = param_get8(Cmd, pnr+1);\r
                        cmdp += 2;\r
                        break;\r
                        exitAfterNReads = param_get8(Cmd, pnr+1);\r
                        cmdp += 2;\r
                        break;\r

+               case 'r':\r
+               case 'R':\r
+                       flags |= FLAG_RANDOM_NONCE;\r
+                       cmdp++;\r
+                       break;\r

                case 'u':\r
                case 'U':\r
                        param_gethex_ex(Cmd, cmdp+1, uid, &uidlen);\r
                case 'u':\r
                case 'U':\r
                        param_gethex_ex(Cmd, cmdp+1, uid, &uidlen);\r


@@ -1245,7 +1280,8 @@ int CmdHF14AMf1kSim(const char *Cmd) {
                        //got a response\r
                        nonces_t ar_resp[ATTACK_KEY_COUNT*2];\r
                        memcpy(ar_resp, resp.d.asBytes, sizeof(ar_resp));\r
                        //got a response\r
                        nonces_t ar_resp[ATTACK_KEY_COUNT*2];\r
                        memcpy(ar_resp, resp.d.asBytes, sizeof(ar_resp));\r

-                       readerAttack(ar_resp, setEmulatorMem);\r
+                       // We can skip the standard attack if we have RANDOM_NONCE set.\r
+                       readerAttack(ar_resp, setEmulatorMem, !(flags & FLAG_RANDOM_NONCE));\r

                        if ((bool)resp.arg[1]) {\r
                                PrintAndLog("Device button pressed - quitting");\r
                                fclose(f);\r
                        if ((bool)resp.arg[1]) {\r
                                PrintAndLog("Device button pressed - quitting");\r
                                fclose(f);\r


@@ -1277,7 +1313,8 @@ int CmdHF14AMf1kSim(const char *Cmd) {
                        if (flags & FLAG_NR_AR_ATTACK) {\r
                                nonces_t ar_resp[ATTACK_KEY_COUNT*2];\r
                                memcpy(ar_resp, resp.d.asBytes, sizeof(ar_resp));\r
                        if (flags & FLAG_NR_AR_ATTACK) {\r
                                nonces_t ar_resp[ATTACK_KEY_COUNT*2];\r
                                memcpy(ar_resp, resp.d.asBytes, sizeof(ar_resp));\r

-                               readerAttack(ar_resp, setEmulatorMem);\r
+                               // We can skip the standard attack if we have RANDOM_NONCE set.\r
+                               readerAttack(ar_resp, setEmulatorMem, !(flags & FLAG_RANDOM_NONCE));\r

                        }\r
                }\r
        }\r
                        }\r
                }\r
        }\r