+ free(statelists[0].head.slhead);\r
+ free(statelists[1].head.slhead);\r
+ \r
+ return 0;\r
+}\r
+\r
+int mfCheckKeys (uint8_t blockNo, uint8_t keyType, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key){\r
+\r
+ *key = 0;\r
+\r
+ UsbCommand c = {CMD_MIFARE_CHKKEYS, {blockNo, keyType, keycnt}};\r
+ memcpy(c.d.asBytes, keyBlock, 6 * keycnt);\r
+ SendCommand(&c);\r
+\r
+ UsbCommand resp;\r
+ if (!WaitForResponseTimeout(CMD_ACK,&resp,3000)) return 1;\r
+ if ((resp.arg[0] & 0xff) != 0x01) return 2;\r
+ *key = bytes_to_num(resp.d.asBytes, 6);\r
+ return 0;\r
+}\r
+\r
+// EMULATOR\r
+\r
+int mfEmlGetMem(uint8_t *data, int blockNum, int blocksCount) {\r
+ UsbCommand c = {CMD_MIFARE_EML_MEMGET, {blockNum, blocksCount, 0}};\r
+ SendCommand(&c);\r
+\r
+ UsbCommand resp;\r
+ if (!WaitForResponseTimeout(CMD_ACK,&resp,1500)) return 1;\r
+ memcpy(data, resp.d.asBytes, blocksCount * 16);\r
+ return 0;\r
+}\r
+\r
+int mfEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {\r
+ UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};\r
+ memcpy(c.d.asBytes, data, blocksCount * 16); \r
+ SendCommand(&c);\r
+ return 0;\r
+}\r
+\r
+// "MAGIC" CARD\r
+\r
+int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool wantWipe) {\r
+ uint8_t oldblock0[16] = {0x00};\r
+ uint8_t block0[16] = {0x00};\r
+\r
+ int old = mfCGetBlock(0, oldblock0, CSETBLOCK_SINGLE_OPER);\r
+ if (old == 0) {\r
+ memcpy(block0, oldblock0, 16);\r
+ PrintAndLog("old block 0: %s", sprint_hex(block0,16));\r
+ } else {\r
+ PrintAndLog("Couldn't get old data. Will write over the last bytes of Block 0.");\r
+ }\r
+\r
+ // fill in the new values\r
+ // UID\r
+ memcpy(block0, uid, 4); \r
+ // Mifare UID BCC\r
+ block0[4] = block0[0]^block0[1]^block0[2]^block0[3];\r
+ // mifare classic SAK(byte 5) and ATQA(byte 6 and 7, reversed)\r
+ if (sak!=NULL)\r
+ block0[5]=sak[0];\r
+ if (atqa!=NULL) {\r
+ block0[6]=atqa[1];\r
+ block0[7]=atqa[0];\r
+ }\r
+ PrintAndLog("new block 0: %s", sprint_hex(block0,16));\r
+ return mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER);\r
+}\r
+\r
+int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, bool wantWipe, uint8_t params) {\r
+\r
+ uint8_t isOK = 0;\r
+ UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};\r
+ memcpy(c.d.asBytes, data, 16); \r
+ SendCommand(&c);\r
+\r
+ UsbCommand resp;\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ isOK = resp.arg[0] & 0xff;\r
+ if (uid != NULL) \r
+ memcpy(uid, resp.d.asBytes, 4);\r
+ if (!isOK) \r
+ return 2;\r
+ } else {\r
+ PrintAndLog("Command execute timeout");\r
+ return 1;\r
+ }\r
+ return 0;\r
+}\r
+\r
+int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params) {\r
+ uint8_t isOK = 0;\r
+\r
+ UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};\r
+ SendCommand(&c);\r
+\r
+ UsbCommand resp;\r
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
+ isOK = resp.arg[0] & 0xff;\r
+ memcpy(data, resp.d.asBytes, 16);\r
+ if (!isOK) return 2;\r
+ } else {\r
+ PrintAndLog("Command execute timeout");\r
+ return 1;\r
+ }\r
+ return 0;\r
+}\r
+\r
+// SNIFFER\r
+\r
+// constants\r
+static uint8_t trailerAccessBytes[4] = {0x08, 0x77, 0x8F, 0x00};\r
+\r
+// variables\r
+char logHexFileName[FILE_PATH_SIZE] = {0x00};\r
+static uint8_t traceCard[4096] = {0x00};\r
+static char traceFileName[FILE_PATH_SIZE] = {0x00};\r
+static int traceState = TRACE_IDLE;\r
+static uint8_t traceCurBlock = 0;\r
+static uint8_t traceCurKey = 0;\r
+\r
+struct Crypto1State *traceCrypto1 = NULL;\r
+\r
+struct Crypto1State *revstate;\r
+uint64_t lfsr;\r
+uint32_t ks2;\r
+uint32_t ks3;\r
+\r
+uint32_t uid; // serial number\r
+uint32_t nt; // tag challenge\r
+uint32_t nr_enc; // encrypted reader challenge\r
+uint32_t ar_enc; // encrypted reader response\r
+uint32_t at_enc; // encrypted tag response\r
+\r
+int isTraceCardEmpty(void) {\r
+ return ((traceCard[0] == 0) && (traceCard[1] == 0) && (traceCard[2] == 0) && (traceCard[3] == 0));\r
+}\r
+\r
+int isBlockEmpty(int blockN) {\r
+ for (int i = 0; i < 16; i++) \r
+ if (traceCard[blockN * 16 + i] != 0) return 0;\r
+\r
+ return 1;\r
+}\r
+\r
+int isBlockTrailer(int blockN) {\r
+ return ((blockN & 0x03) == 0x03);\r
+}\r
+\r
+int loadTraceCard(uint8_t *tuid) {\r
+ FILE * f;\r
+ char buf[64] = {0x00};\r
+ uint8_t buf8[64] = {0x00};\r
+ int i, blockNum;\r
+ \r
+ if (!isTraceCardEmpty()) \r
+ saveTraceCard();\r
+ \r
+ memset(traceCard, 0x00, 4096);\r
+ memcpy(traceCard, tuid + 3, 4);\r
+\r
+ FillFileNameByUID(traceFileName, tuid, ".eml", 7);\r
+\r
+ f = fopen(traceFileName, "r");\r
+ if (!f) {\r
+ fclose(f);\r
projects / proxmark3-svn / blobdiff