fix bug in moebius nonce collection - now finishes

[proxmark3-svn] / client / cmdhfmf.c

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index ed26c1bdf235e4ba5267122247d0e92e43f54997..c565a7cf222bac705e1cb21a1b4d7227b6eba719 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -9,6 +9,7 @@
 //-----------------------------------------------------------------------------\r
 \r
 #include "cmdhfmf.h"\r
 //-----------------------------------------------------------------------------\r
 \r
 #include "cmdhfmf.h"\r

+#include "./nonce2key/nonce2key.h"\r

 \r
 static int CmdHelp(const char *Cmd);\r
 \r
 \r
 static int CmdHelp(const char *Cmd);\r
 \r


@@ -28,7 +29,7 @@ int CmdHF14AMifare(const char *Cmd)
        printf("-------------------------------------------------------------------------\n");\r
 \r
        \r
        printf("-------------------------------------------------------------------------\n");\r
 \r
        \r

-start:\r
+ start:\r

     clearCommandBuffer();\r
     SendCommand(&c);\r
        \r
     clearCommandBuffer();\r
     SendCommand(&c);\r
        \r


@@ -1015,70 +1016,164 @@ int CmdHF14AMfChk(const char *Cmd)
        return 0;\r
 }\r
 \r
        return 0;\r
 }\r
 \r

+int usage_hf14_mf1ksim(void){\r
+       PrintAndLog("Usage:  hf mf sim  [h] u <uid (8,14 hex symbols)> n <numreads> i x");\r
+       PrintAndLog("options:");\r
+       PrintAndLog("      h    this help");\r
+       PrintAndLog("      u    (Optional) UID 4,7 bytes. If not specified, the UID 4b from emulator memory will be used");\r
+       PrintAndLog("      n    (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");\r
+       PrintAndLog("      i    (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");\r
+       PrintAndLog("      x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r
+       PrintAndLog("      e    (Optional) set keys found from 'reader attack' to emulator memory");\r
+       PrintAndLog("samples:");\r
+       PrintAndLog("           hf mf sim u 0a0a0a0a");\r
+       PrintAndLog("           hf mf sim u 11223344556677");\r
+       //PrintAndLog("           hf mf sim u 112233445566778899AA");   \r
+       return 0;\r
+}\r
+\r

 int CmdHF14AMf1kSim(const char *Cmd)\r
 {\r
 int CmdHF14AMf1kSim(const char *Cmd)\r
 {\r

-       uint8_t uid[7] = {0, 0, 0, 0, 0, 0, 0};\r
+       #define ATTACK_KEY_COUNT 8\r
+       uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};\r

        uint8_t exitAfterNReads = 0;\r
        uint8_t flags = 0;\r
        uint8_t exitAfterNReads = 0;\r
        uint8_t flags = 0;\r

+       int uidlen = 0;\r
+       uint8_t pnr = 0;\r
+       bool setEmulatorMem = false;\r

 \r
 \r

-       uint8_t cmdp = param_getchar(Cmd, 0);\r
+       char cmdp = param_getchar(Cmd, pnr);\r

        \r
        \r

-       if (cmdp == 'h' || cmdp == 'H') {\r
-               PrintAndLog("Usage:  hf mf sim  u <uid (8 hex symbols)> n <numreads> i x");\r
-               PrintAndLog("           h    this help");\r
-               PrintAndLog("           u    (Optional) UID. If not specified, the UID from emulator memory will be used");\r
-               PrintAndLog("           n    (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");\r
-               PrintAndLog("           i    (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");\r
-               PrintAndLog("           x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r
-               PrintAndLog("");\r
-               PrintAndLog("           sample: hf mf sim u 0a0a0a0a ");\r
-               return 0;\r
-       }\r
-       uint8_t pnr = 0;\r
-       if (param_getchar(Cmd, pnr) == 'u') {\r
-               if(param_gethex(Cmd, pnr+1, uid, 8) == 0)\r
-               {\r
-                       flags |= FLAG_4B_UID_IN_DATA; // UID from packet\r
-               } else if(param_gethex(Cmd,pnr+1,uid,14) == 0) {\r
-                       flags |= FLAG_7B_UID_IN_DATA;// UID from packet\r
-               } else {\r
-                       PrintAndLog("UID, if specified, must include 8 or 14 HEX symbols");\r
-                       return 1;\r
+       if (cmdp == 'h' || cmdp == 'H') return usage_hf14_mf1ksim();\r
+\r
+       if (cmdp == 'u' || cmdp == 'U') {\r
+               param_gethex_ex(Cmd, pnr+1, uid, &uidlen);\r
+               switch(uidlen){\r
+                       //case 20: flags = FLAG_10B_UID_IN_DATA;        break; //not complete\r
+                       case 14: flags = FLAG_7B_UID_IN_DATA; break;\r
+                       case  8: flags = FLAG_4B_UID_IN_DATA; break;\r
+                       default: return usage_hf14_mf1ksim();\r

                }\r
                pnr +=2;\r
        }\r
                }\r
                pnr +=2;\r
        }\r

-       if (param_getchar(Cmd, pnr) == 'n') {\r
-               exitAfterNReads = param_get8(Cmd,pnr+1);\r
+\r
+       cmdp = param_getchar(Cmd, pnr);\r
+       if (cmdp == 'n' || cmdp == 'N') {\r
+               exitAfterNReads = param_get8(Cmd, pnr+1);\r

                pnr += 2;\r
        }\r
                pnr += 2;\r
        }\r

-       if (param_getchar(Cmd, pnr) == 'i' ) {\r
-               //Using a flag to signal interactiveness, least significant bit\r
+\r
+       cmdp = param_getchar(Cmd, pnr);\r
+       if (cmdp == 'i' || cmdp == 'I' ) {\r

                flags |= FLAG_INTERACTIVE;\r
                pnr++;\r
        }\r
 \r
                flags |= FLAG_INTERACTIVE;\r
                pnr++;\r
        }\r
 \r

-       if (param_getchar(Cmd, pnr) == 'x' ) {\r
-               //Using a flag to signal interactiveness, least significant bit\r
+       cmdp = param_getchar(Cmd, pnr);\r
+       if (cmdp == 'x' || cmdp == 'X') {\r

                flags |= FLAG_NR_AR_ATTACK;\r
                flags |= FLAG_NR_AR_ATTACK;\r

+               pnr++;\r
+       }\r
+\r
+       cmdp = param_getchar(Cmd, pnr);\r
+       if (cmdp == 'e' || cmdp == 'E') {\r
+               setEmulatorMem = true;\r

        }\r
        }\r

+\r

        PrintAndLog(" uid:%s, numreads:%d, flags:%d (0x%02x) ",\r
                                flags & FLAG_4B_UID_IN_DATA ? sprint_hex(uid,4):\r
        PrintAndLog(" uid:%s, numreads:%d, flags:%d (0x%02x) ",\r
                                flags & FLAG_4B_UID_IN_DATA ? sprint_hex(uid,4):\r

-                                                                                         flags & FLAG_7B_UID_IN_DATA   ? sprint_hex(uid,7): "N/A"\r
+                                       flags & FLAG_7B_UID_IN_DATA     ? sprint_hex(uid,7): "N/A"\r

                                , exitAfterNReads, flags,flags);\r
 \r
 \r
        UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};\r
        memcpy(c.d.asBytes, uid, sizeof(uid));\r
                                , exitAfterNReads, flags,flags);\r
 \r
 \r
        UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};\r
        memcpy(c.d.asBytes, uid, sizeof(uid));\r

+       clearCommandBuffer();\r

        SendCommand(&c);\r
 \r
        SendCommand(&c);\r
 \r

-       if(flags & FLAG_INTERACTIVE)\r
-       {\r
+       if(flags & FLAG_INTERACTIVE) {\r

                UsbCommand resp;\r
                PrintAndLog("Press pm3-button to abort simulation");\r
                while(! WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
                        //We're waiting only 1.5 s at a time, otherwise we get the\r
                        // annoying message about "Waiting for a response... "\r
                }\r
                UsbCommand resp;\r
                PrintAndLog("Press pm3-button to abort simulation");\r
                while(! WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
                        //We're waiting only 1.5 s at a time, otherwise we get the\r
                        // annoying message about "Waiting for a response... "\r
                }\r

+               //got a response\r
+               if (flags & FLAG_NR_AR_ATTACK) {\r
+                       nonces_t ar_resp[ATTACK_KEY_COUNT*2];\r
+                       uint64_t key = 0;\r
+                       memcpy (ar_resp, resp.d.asBytes, sizeof(ar_resp));\r
+                       typedef struct {\r
+                                       uint64_t keyA;\r
+                                       uint32_t security;\r
+                                       uint64_t keyB;\r
+                       } st_t;\r
+                       st_t sector_trailer[ATTACK_KEY_COUNT];\r
+                       memset(sector_trailer, 0x00, sizeof(sector_trailer));\r
+\r
+                       uint8_t stSector[ATTACK_KEY_COUNT];\r
+                       memset(stSector, 0x00, sizeof(stSector));\r
+                       uint8_t key_cnt[ATTACK_KEY_COUNT];\r
+                       memset(key_cnt, 0x00, sizeof(key_cnt));\r
+\r
+                       for (uint8_t i = 0; i<ATTACK_KEY_COUNT; i++) {\r
+                               if (ar_resp[i].ar2 > 0) {\r
+                                       //PrintAndLog("Trying sector %d, cuid %08x, nt %08x, ar %08x, nr %08x, ar2 %08x, nr2 %08x",ar_resp[i].sector, ar_resp[i].cuid,ar_resp[i].nonce,ar_resp[i].ar,ar_resp[i].nr,ar_resp[i].ar2,ar_resp[i].nr2);\r
+                                       if (mfkey32(ar_resp[i], &key)) {\r
+                                               PrintAndLog("Found Key%s for sector %02d: [%04x%08x]", (ar_resp[i].keytype) ? "B" : "A", ar_resp[i].sector, (uint32_t) (key>>32), (uint32_t) (key &0xFFFFFFFF));\r
+\r
+                                               for (uint8_t ii = 0; ii<ATTACK_KEY_COUNT; ii++) {\r
+                                                       if (key_cnt[ii]==0 || stSector[ii]==ar_resp[i].sector) {\r
+                                                               if (ar_resp[i].keytype==0) {\r
+                                                                       //keyA\r
+                                                                       sector_trailer[ii].keyA = key;\r
+                                                                       stSector[ii] = ar_resp[i].sector;\r
+                                                                       key_cnt[ii]++;\r
+                                                                       break;\r
+                                                               } else {\r
+                                                                       //keyB\r
+                                                                       sector_trailer[ii].keyB = key;\r
+                                                                       stSector[ii] = ar_resp[i].sector;\r
+                                                                       key_cnt[ii]++;\r
+                                                                       break;\r
+                                                               }\r
+                                                       }\r
+                                               }\r
+                                       }\r
+                               }\r
+                       }\r
+                       //set emulator memory for keys\r
+                       if (setEmulatorMem) {\r
+                               for (uint8_t i = 0; i<ATTACK_KEY_COUNT; i++) {\r
+                                       if (key_cnt[i]>0) {\r
+                                               //PrintAndLog   ("block %d, keyA:%04x%08x, keyb:%04x%08x",stSector[i]*4+3, (uint32_t) (sector_trailer[i].keyA>>32), (uint32_t) (sector_trailer[i].keyA &0xFFFFFFFF),(uint32_t) (sector_trailer[i].keyB>>32), (uint32_t) (sector_trailer[i].keyB &0xFFFFFFFF));\r
+                                               uint8_t memBlock[16];\r
+                                               memset(memBlock, 0x00, sizeof(memBlock));\r
+                                               char cmd1[36];\r
+                                               memset(cmd1,0x00,sizeof(cmd1));\r
+                                               snprintf(cmd1,sizeof(cmd1),"%04x%08xFF078069%04x%08x",(uint32_t) (sector_trailer[i].keyA>>32), (uint32_t) (sector_trailer[i].keyA &0xFFFFFFFF),(uint32_t) (sector_trailer[i].keyB>>32), (uint32_t) (sector_trailer[i].keyB &0xFFFFFFFF));\r
+                                               PrintAndLog("Setting Emulator Memory Block %02d: [%s]",stSector[i]*4+3, cmd1);\r
+                                               if (param_gethex(cmd1, 0, memBlock, 32)) {\r
+                                                       PrintAndLog("block data must include 32 HEX symbols");\r
+                                                       return 1;\r
+                                               }\r
+                                               \r
+                                               UsbCommand c = {CMD_MIFARE_EML_MEMSET, {(stSector[i]*4+3), 1, 0}};\r
+                                               memcpy(c.d.asBytes, memBlock, 16);\r
+                                               clearCommandBuffer();\r
+                                               SendCommand(&c);                        \r
+                                       }\r
+                               }\r
+                       }\r
+                       //moebius attack\r
+                       for (uint8_t i = ATTACK_KEY_COUNT; i<ATTACK_KEY_COUNT*2; i++) {\r
+                               if (ar_resp[i].ar2 > 0) {\r
+                                       if (tryMfk32_moebius(ar_resp[i], &key)) {\r
+                                               PrintAndLog("M-Found Key%s for sector %02d: [%04x%08x]", (ar_resp[i].keytype) ? "B" : "A", ar_resp[i].sector, (uint32_t) (key>>32), (uint32_t) (key &0xFFFFFFFF));\r
+                                       }\r
+                               }\r
+                       }\r
+               }\r

        }\r
        \r
        return 0;\r
        }\r
        \r
        return 0;\r


@@ -1951,6 +2046,13 @@ int CmdHF14AMfSniff(const char *Cmd){
        return 0;\r
 }\r
 \r
        return 0;\r
 }\r
 \r

+//needs nt, ar, at, Data to decrypt\r
+int CmdDecryptTraceCmds(const char *Cmd){\r
+       uint8_t data[50];\r
+       int len = 0;\r
+       param_gethex_ex(Cmd,3,data,&len);\r
+       return tryDecryptWord(param_get32ex(Cmd,0,0,16),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16),data,len/2);\r
+}\r

 \r
 static command_t CommandTable[] =\r
 {\r
 \r
 static command_t CommandTable[] =\r
 {\r


@@ -1979,6 +2081,7 @@ static command_t CommandTable[] =
   {"cgetsc",   CmdHF14AMfCGetSc,               0, "Read sector - Magic Chinese card"},\r
   {"cload",            CmdHF14AMfCLoad,                0, "Load dump into magic Chinese card"},\r
   {"csave",            CmdHF14AMfCSave,                0, "Save dump from magic Chinese card into file or emulator"},\r
   {"cgetsc",   CmdHF14AMfCGetSc,               0, "Read sector - Magic Chinese card"},\r
   {"cload",            CmdHF14AMfCLoad,                0, "Load dump into magic Chinese card"},\r
   {"csave",            CmdHF14AMfCSave,                0, "Save dump from magic Chinese card into file or emulator"},\r

+  {"decrypt", CmdDecryptTraceCmds,1, "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace"},\r

   {NULL, NULL, 0, NULL}\r
 };\r
 \r
   {NULL, NULL, 0, NULL}\r
 };\r
 \r