uint8_t isOK = 0;\r
uint8_t * data = NULL;\r
\r
- if (sectorNo > 15) {\r
- PrintAndLog("Sector number must be less than 16");\r
- return 1;\r
- }\r
PrintAndLog("Attempting to Read Ultralight... ");\r
\r
UsbCommand c = {CMD_MIFAREU_READCARD, {sectorNo}};\r
\r
PrintAndLog("isOk:%02x", isOK);\r
if (isOK) \r
- for (i = 0; i < 16; i++) {\r
- switch(i){\r
- case 2:\r
- //process lock bytes\r
- lockbytes_t=data+(i*4);\r
- lockbytes[0]=lockbytes_t[2];\r
- lockbytes[1]=lockbytes_t[3];\r
- for(int j=0; j<16; j++){\r
- bit[j]=lockbytes[j/8] & ( 1 <<(7-j%8));\r
- }\r
- //PrintAndLog("LB %02x %02x", lockbytes[0],lockbytes[1]);\r
- //PrintAndLog("LB2b %02x %02x %02x %02x %02x %02x %02x %02x",bit[8],bit[9],bit[10],bit[11],bit[12],bit[13],bit[14],bit[15]); \r
- PrintAndLog("Block %3d:%s ", i,sprint_hex(data + i * 4, 4));\r
- break;\r
- case 3: \r
- PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[4]);\r
- break;\r
- case 4:\r
- PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[3]);\r
- break;\r
- case 5:\r
- PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[2]);\r
- break;\r
- case 6:\r
- PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[1]);\r
- break;\r
- case 7:\r
- PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[0]);\r
- break;\r
- case 8:\r
- PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[15]);\r
- break;\r
- case 9:\r
- PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[14]);\r
- break;\r
- case 10:\r
- PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[13]);\r
- break;\r
- case 11:\r
- PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[12]);\r
- break;\r
- case 12:\r
- PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[11]);\r
- break;\r
- case 13:\r
- PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[10]);\r
- break;\r
- case 14:\r
- PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[9]);\r
- break;\r
- case 15:\r
- PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[8]);\r
- break;\r
- default:\r
- PrintAndLog("Block %3d:%s ", i,sprint_hex(data + i * 4, 4));\r
- break;\r
+ { // bit 0 and 1\r
+ PrintAndLog("Block %3d:%s ", 0,sprint_hex(data + 0 * 4, 4));\r
+ PrintAndLog("Block %3d:%s ", 1,sprint_hex(data + 1 * 4, 4));\r
+ // bit 2\r
+ //process lock bytes\r
+ lockbytes_t=data+(2*4);\r
+ lockbytes[0]=lockbytes_t[2];\r
+ lockbytes[1]=lockbytes_t[3];\r
+ for(int j=0; j<16; j++){\r
+ bit[j]=lockbytes[j/8] & ( 1 <<(7-j%8));\r
}\r
- }\r
+ //remaining\r
+ for (i = 3; i < 16; i++) {\r
+ int bitnum = (23-i) % 16;\r
+ PrintAndLog("Block %3d:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[bitnum]);\r
+ }\r
+\r
+ }\r
} else {\r
PrintAndLog("Command execute timeout");\r
}\r
uint8_t keyA[40][6];\r
uint8_t keyB[40][6];\r
uint8_t rights[40][4];\r
+ uint8_t carddata[256][16];\r
uint8_t numSectors = 16;\r
\r
FILE *fin;\r
return 1;\r
}\r
\r
- if ((fout = fopen("dumpdata.bin","wb")) == NULL) { \r
- PrintAndLog("Could not create file name dumpdata.bin");\r
- return 1;\r
- }\r
- \r
// Read key file\r
\r
for (sectorNo=0; sectorNo<numSectors; sectorNo++) {\r
if (fread( keyA[sectorNo], 1, 6, fin ) == 0) {\r
PrintAndLog("File reading error.");\r
+ fclose(fin);\r
return 2;\r
}\r
}\r
for (sectorNo=0; sectorNo<numSectors; sectorNo++) {\r
if (fread( keyB[sectorNo], 1, 6, fin ) == 0) {\r
PrintAndLog("File reading error.");\r
+ fclose(fin);\r
return 2;\r
}\r
}\r
- \r
+ fclose(fin);\r
// Read access rights to sectors\r
\r
PrintAndLog("|-----------------------------------------|");\r
uint8_t isOK = resp.arg[0] & 0xff;\r
uint8_t *data = resp.d.asBytes;\r
if (isOK){\r
- rights[sectorNo][0] = ((data[7] & 0x10)>>4) | ((data[8] & 0x1)<<1) | ((data[8] & 0x10)>>2);\r
- rights[sectorNo][1] = ((data[7] & 0x20)>>5) | ((data[8] & 0x2)<<0) | ((data[8] & 0x20)>>3);\r
- rights[sectorNo][2] = ((data[7] & 0x40)>>6) | ((data[8] & 0x4)>>1) | ((data[8] & 0x40)>>4);\r
- rights[sectorNo][3] = ((data[7] & 0x80)>>7) | ((data[8] & 0x8)>>2) | ((data[8] & 0x80)>>5);\r
+ rights[sectorNo][0] = ((data[7] & 0x10)>>2) | ((data[8] & 0x1)<<1) | ((data[8] & 0x10)>>4); // C1C2C3 for data area 0\r
+ rights[sectorNo][1] = ((data[7] & 0x20)>>3) | ((data[8] & 0x2)<<0) | ((data[8] & 0x20)>>5); // C1C2C3 for data area 1\r
+ rights[sectorNo][2] = ((data[7] & 0x40)>>4) | ((data[8] & 0x4)>>1) | ((data[8] & 0x40)>>6); // C1C2C3 for data area 2\r
+ rights[sectorNo][3] = ((data[7] & 0x80)>>5) | ((data[8] & 0x8)>>2) | ((data[8] & 0x80)>>7); // C1C2C3 for sector trailer\r
} else {\r
- PrintAndLog("Could not get access rights for sector %2d.", sectorNo);\r
+ PrintAndLog("Could not get access rights for sector %2d. Trying with defaults...", sectorNo);\r
+ rights[sectorNo][0] = rights[sectorNo][1] = rights[sectorNo][2] = 0x00;\r
+ rights[sectorNo][3] = 0x01;\r
}\r
} else {\r
- PrintAndLog("Command execute timeout");\r
+ PrintAndLog("Command execute timeout when trying to read access rights for sector %2d. Trying with defaults...", sectorNo);\r
+ rights[sectorNo][0] = rights[sectorNo][1] = rights[sectorNo][2] = 0x00;\r
+ rights[sectorNo][3] = 0x01;\r
}\r
}\r
\r
PrintAndLog("|----- Dumping all blocks to file... -----|");\r
PrintAndLog("|-----------------------------------------|");\r
\r
- \r
- for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {\r
- for (blockNo = 0; blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
+ bool isOK = true;\r
+ for (sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {\r
+ for (blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
bool received = false;\r
if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. At least the Access Conditions can always be read with key A. \r
UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};\r
received = WaitForResponseTimeout(CMD_ACK,&resp,1500);\r
} else { // data block. Check if it can be read with key A or key B\r
uint8_t data_area = sectorNo<32?blockNo:blockNo/5;\r
- if ((rights[sectorNo][data_area] == 3) || (rights[sectorNo][data_area] == 5)) { // only key B would work\r
+ if ((rights[sectorNo][data_area] == 0x03) || (rights[sectorNo][data_area] == 0x05)) { // only key B would work\r
UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 1, 0}};\r
memcpy(c.d.asBytes, keyB[sectorNo], 6);\r
SendCommand(&c);\r
received = WaitForResponseTimeout(CMD_ACK,&resp,1500);\r
- } else if (rights[sectorNo][data_area] == 7) { // no key would work\r
- PrintAndLog("Access rights do not allow reading of sector %2d block %3d", sectorNo, blockNo);\r
+ } else if (rights[sectorNo][data_area] == 0x07) { // no key would work\r
+ isOK = false;\r
+ PrintAndLog("Access rights do not allow reading of sector %2d block %3d", sectorNo, blockNo);\r
} else { // key A would work\r
- UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};\r
- memcpy(c.d.asBytes, keyA[sectorNo], 6);\r
- SendCommand(&c);\r
- received = WaitForResponseTimeout(CMD_ACK,&resp,1500);\r
+ UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};\r
+ memcpy(c.d.asBytes, keyA[sectorNo], 6);\r
+ SendCommand(&c);\r
+ received = WaitForResponseTimeout(CMD_ACK,&resp,1500);\r
}\r
}\r
\r
if (received) {\r
- uint8_t isOK = resp.arg[0] & 0xff;\r
+ isOK = resp.arg[0] & 0xff;\r
uint8_t *data = resp.d.asBytes;\r
if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. Fill in the keys.\r
data[0] = (keyA[sectorNo][0]);\r
data[15] = (keyB[sectorNo][5]);\r
}\r
if (isOK) {\r
- fwrite ( data, 1, 16, fout );\r
- PrintAndLog("Dumped block %2d of sector %2d into 'dumpdata.bin'");\r
+ memcpy(carddata[FirstBlockOfSector(sectorNo) + blockNo], data, 16);\r
+ PrintAndLog("Successfully read block %2d of sector %2d.", blockNo, sectorNo);\r
} else {\r
PrintAndLog("Could not read block %2d of sector %2d", blockNo, sectorNo);\r
+ break;\r
}\r
}\r
else {\r
- PrintAndLog("Command execute timeout");\r
+ isOK = false;\r
+ PrintAndLog("Command execute timeout when trying to read block %2d of sector %2d.", blockNo, sectorNo);\r
+ break;\r
}\r
}\r
\r
}\r
- \r
- fclose(fin);\r
- fclose(fout);\r
+\r
+ if (isOK) {\r
+ if ((fout = fopen("dumpdata.bin","wb")) == NULL) { \r
+ PrintAndLog("Could not create file name dumpdata.bin");\r
+ return 1;\r
+ }\r
+ uint16_t numblocks = FirstBlockOfSector(numSectors - 1) + NumBlocksPerSector(numSectors - 1);\r
+ fwrite(carddata, 1, 16*numblocks, fout);\r
+ fclose(fout);\r
+ PrintAndLog("Dumped %d blocks (%d bytes) to file dumpdata.bin", numblocks, 16*numblocks);\r
+ }\r
+ \r
return 0;\r
}\r
\r
}\r
if ((fkeys = fopen("dumpkeys.bin","rb")) == NULL) {\r
PrintAndLog("Could not find file dumpkeys.bin");\r
+ fclose(fdump);\r
return 1;\r
}\r
\r
for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {\r
if (fread(keyA[sectorNo], 1, 6, fkeys) == 0) {\r
PrintAndLog("File reading error (dumpkeys.bin).");\r
+ fclose(fdump);\r
+ fclose(fkeys);\r
return 2;\r
}\r
}\r
for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {\r
if (fread(keyB[sectorNo], 1, 6, fkeys) == 0) {\r
PrintAndLog("File reading error (dumpkeys.bin).");\r
+ fclose(fdump);\r
+ fclose(fkeys);\r
return 2;\r
}\r
}\r
- \r
+ fclose(fkeys);\r
+\r
PrintAndLog("Restoring dumpdata.bin to card");\r
\r
for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {\r
\r
if (fread(bldata, 1, 16, fdump) == 0) {\r
PrintAndLog("File reading error (dumpdata.bin).");\r
+ fclose(fdump);\r
return 2;\r
}\r
\r
}\r
\r
fclose(fdump);\r
- fclose(fkeys);\r
return 0;\r
}\r
\r
PrintAndLog("d - write keys to binary file");\r
PrintAndLog(" ");\r
PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF ");\r
- PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF t ");\r
- PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF d ");\r
- PrintAndLog(" sample2: hf mf nested o 0 A FFFFFFFFFFFF 4 A");\r
+ PrintAndLog(" sample2: hf mf nested 1 0 A FFFFFFFFFFFF t ");\r
+ PrintAndLog(" sample3: hf mf nested 1 0 A FFFFFFFFFFFF d ");\r
+ PrintAndLog(" sample4: hf mf nested o 0 A FFFFFFFFFFFF 4 A");\r
return 0;\r
} \r
\r
}\r
\r
\r
-static uint32_t get_trailer_block (uint32_t uiBlock)\r
-{\r
- // Test if we are in the small or big sectors\r
- uint32_t trailer_block = 0;\r
- if (uiBlock < 128) {\r
- trailer_block = uiBlock + (3 - (uiBlock % 4));\r
- } else {\r
- trailer_block = uiBlock + (15 - (uiBlock % 16));\r
- }\r
- return trailer_block;\r
-}\r
-\r
-\r
int CmdHF14AMfChk(const char *Cmd)\r
{\r
+ if (strlen(Cmd)<3) {\r
+ PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t] [<key (12 hex symbols)>] [<dic (*.dic)>]");\r
+ PrintAndLog(" * - all sectors");\r
+ PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");\r
+ PrintAndLog("d - write keys to binary file\n");\r
+ PrintAndLog(" sample: hf mf chk 0 A 1234567890ab keys.dic");\r
+ PrintAndLog(" hf mf chk *1 ? t");\r
+ return 0;\r
+ } \r
+\r
FILE * f;\r
char filename[256]={0};\r
char buf[13];\r
int transferToEml = 0;\r
int createDumpFile = 0;\r
\r
+\r
keyBlock = calloc(stKeyBlock, 6);\r
if (keyBlock == NULL) return 1;\r
\r
num_to_bytes(defaultKeys[defaultKeyCounter], 6, (uint8_t*)(keyBlock + defaultKeyCounter * 6));\r
}\r
\r
- if (strlen(Cmd)<3) {\r
- PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t] [<key (12 hex symbols)>] [<dic (*.dic)>]");\r
- PrintAndLog(" * - all sectors");\r
- PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");\r
-// PrintAndLog("d - write keys to binary file\n");\r
- \r
- PrintAndLog(" sample: hf mf chk 0 A 1234567890ab keys.dic");\r
- PrintAndLog(" hf mf chk *1 ? t");\r
- return 0;\r
- } \r
\r
if (param_getchar(Cmd, 0)=='*') {\r
blockNo = 3;\r
keycnt++;\r
memset(buf, 0, sizeof(buf));\r
}\r
+ fclose(f);\r
} else {\r
PrintAndLog("File: %s: not found or locked.", filename);\r
free(keyBlock);\r
return 1;\r
- fclose(f);\r
}\r
}\r
}\r
PrintAndLog("No key specified, trying default keys");\r
for (;keycnt < defaultKeysSize; keycnt++)\r
PrintAndLog("chk default key[%2d] %02x%02x%02x%02x%02x%02x", keycnt,\r
- (keyBlock + 6*keycnt)[0],(keyBlock + 6*keycnt)[1], (keyBlock + 6*keycnt)[2],\r
- (keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4], (keyBlock + 6*keycnt)[5], 6);\r
+ (keyBlock + 6*keycnt)[0],(keyBlock + 6*keycnt)[1], (keyBlock + 6*keycnt)[2],\r
+ (keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4], (keyBlock + 6*keycnt)[5], 6);\r
+ }\r
+ \r
+ // initialize storage for found keys\r
+ bool validKey[2][40];\r
+ uint8_t foundKey[2][40][6];\r
+ for (uint16_t t = 0; t < 2; t++) {\r
+ for (uint16_t sectorNo = 0; sectorNo < SectorsCnt; sectorNo++) {\r
+ validKey[t][sectorNo] = false;\r
+ for (uint16_t i = 0; i < 6; i++) {\r
+ foundKey[t][sectorNo][i] = 0xff;\r
+ }\r
+ }\r
}\r
\r
for ( int t = !keyType; t < 2; keyType==2?(t++):(t=2) ) {\r
int b=blockNo;\r
for (int i = 0; i < SectorsCnt; ++i) {\r
- PrintAndLog("--SectorsCnt:%2d, block no:%3d, key type:%C, key count:%2d ", i, b, t?'B':'A', keycnt);\r
+ PrintAndLog("--sector:%2d, block:%3d, key type:%C, key count:%2d ", i, b, t?'B':'A', keycnt);\r
uint32_t max_keys = keycnt>USB_CMD_DATA_SIZE/6?USB_CMD_DATA_SIZE/6:keycnt;\r
for (uint32_t c = 0; c < keycnt; c+=max_keys) {\r
uint32_t size = keycnt-c>max_keys?max_keys:keycnt-c;\r
if (res != 1) {\r
if (!res) {\r
PrintAndLog("Found valid key:[%012"llx"]",key64);\r
- if (transferToEml) {\r
- uint8_t block[16];\r
- mfEmlGetMem(block, get_trailer_block(b), 1);\r
- num_to_bytes(key64, 6, block + t*10);\r
- mfEmlSetMem(block, get_trailer_block(b), 1);\r
- }\r
- }\r
+ num_to_bytes(key64, 6, foundKey[t][i]);\r
+ validKey[t][i] = true;\r
+ } \r
} else {\r
PrintAndLog("Command execute timeout");\r
}\r
b<127?(b+=4):(b+=16); \r
}\r
}\r
- \r
- free(keyBlock);\r
\r
-/*\r
- // Create dump file\r
+ if (transferToEml) {\r
+ uint8_t block[16];\r
+ for (uint16_t sectorNo = 0; sectorNo < SectorsCnt; sectorNo++) {\r
+ if (validKey[0][sectorNo] || validKey[1][sectorNo]) {\r
+ mfEmlGetMem(block, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1);\r
+ for (uint16_t t = 0; t < 2; t++) {\r
+ if (validKey[t][sectorNo]) {\r
+ memcpy(block + t*10, foundKey[t][sectorNo], 6);\r
+ }\r
+ }\r
+ mfEmlSetMem(block, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1);\r
+ }\r
+ }\r
+ PrintAndLog("Found keys have been transferred to the emulator memory");\r
+ }\r
+\r
if (createDumpFile) {\r
- if ((fkeys = fopen("dumpkeys.bin","wb")) == NULL) { \r
+ FILE *fkeys = fopen("dumpkeys.bin","wb");\r
+ if (fkeys == NULL) { \r
PrintAndLog("Could not create file dumpkeys.bin");\r
- free(e_sector);\r
+ free(keyBlock);\r
return 1;\r
}\r
- PrintAndLog("Printing keys to binary file dumpkeys.bin...");\r
- for(i=0; i<16; i++) {\r
- if (e_sector[i].foundKey[0]){\r
- num_to_bytes(e_sector[i].Key[0], 6, tempkey);\r
- fwrite ( tempkey, 1, 6, fkeys );\r
- }\r
- else{\r
- fwrite ( &standart, 1, 6, fkeys );\r
- }\r
- }\r
- for(i=0; i<16; i++) {\r
- if (e_sector[i].foundKey[1]){\r
- num_to_bytes(e_sector[i].Key[1], 6, tempkey);\r
- fwrite ( tempkey, 1, 6, fkeys );\r
- }\r
- else{\r
- fwrite ( &standart, 1, 6, fkeys );\r
- }\r
+ for (uint16_t t = 0; t < 2; t++) {\r
+ fwrite(foundKey[t], 1, 6*SectorsCnt, fkeys);\r
}\r
fclose(fkeys);\r
+ PrintAndLog("Found keys have been dumped to file dumpkeys.bin. 0xffffffffffff has been inserted for unknown keys.");\r
}\r
-*/\r
- return 0;\r
+\r
+ free(keyBlock);\r
+\r
+ return 0;\r
}\r
\r
+\r
int CmdHF14AMf1kSim(const char *Cmd)\r
{\r
uint8_t uid[7] = {0, 0, 0, 0, 0, 0, 0};\r
break;\r
}\r
PrintAndLog("File reading error.");\r
+ fclose(f);\r
return 2;\r
}\r
if (strlen(buf) < 32){\r
if(strlen(buf) && feof(f))\r
break;\r
PrintAndLog("File content error. Block data must include 32 HEX symbols");\r
+ fclose(f);\r
return 2;\r
}\r
for (i = 0; i < 32; i += 2) {\r
}\r
if (mfEmlSetMem(buf8, blockNum, 1)) {\r
PrintAndLog("Cant set emul block: %3d", blockNum);\r
+ fclose(f);\r
return 3;\r
}\r
blockNum++;\r
int CmdHF14AMfCSetUID(const char *Cmd)\r
{\r
uint8_t wipeCard = 0;\r
- uint8_t uid[8];\r
- uint8_t oldUid[8];\r
+ uint8_t uid[8] = {0};\r
+ uint8_t oldUid[8]= {0};\r
int res;\r
\r
if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {\r
projects / proxmark3-svn / blobdiff