X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/16a95d76ac51d07ca56ecf6761fc3a2155bf93a9..38d618baa9cb563ff86bda46fcabd992255afadd:/client/cmdhfmf.c?ds=inline

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index c16b9674..d306ac65 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -17,15 +17,14 @@ int CmdHF14AMifare(const char *Cmd)
 	uint32_t uid = 0;
 	uint32_t nt = 0, nr = 0;
 	uint64_t par_list = 0, ks_list = 0, r_key = 0;
-	uint8_t isOK = 0;
-	uint8_t keyBlock[8] = {0};
+	int16_t isOK = 0;
 
 	UsbCommand c = {CMD_READER_MIFARE, {true, 0, 0}};
 
 	// message
 	printf("-------------------------------------------------------------------------\n");
 	printf("Executing command. Expected execution time: 25sec on average  :-)\n");
-	printf("Press the key on the proxmark3 device to abort both proxmark3 and client.\n");
+	printf("Press button on the proxmark3 device to abort both proxmark3 and client.\n");
 	printf("-------------------------------------------------------------------------\n");
 
 	
@@ -47,15 +46,22 @@ start:
 		}
 		
 		UsbCommand resp;
-		if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
-			isOK  = resp.arg[0] & 0xff;
+		if (WaitForResponseTimeout(CMD_ACK, &resp, 1000)) {
+			isOK  = resp.arg[0];
 			uid = (uint32_t)bytes_to_num(resp.d.asBytes +  0, 4);
 			nt =  (uint32_t)bytes_to_num(resp.d.asBytes +  4, 4);
 			par_list = bytes_to_num(resp.d.asBytes +  8, 8);
 			ks_list = bytes_to_num(resp.d.asBytes +  16, 8);
 			nr = bytes_to_num(resp.d.asBytes + 24, 4);
 			printf("\n\n");
-			if (!isOK) PrintAndLog("Proxmark can't get statistic info. Execution aborted.\n");
+			switch (isOK) {
+				case -1 : PrintAndLog("Button pressed. Aborted.\n"); break;
+				case -2 : PrintAndLog("Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests).\n"); break;
+				case -3 : PrintAndLog("Card is not vulnerable to Darkside attack (its random number generator is not predictable).\n"); break;
+				case -4 : PrintAndLog("Card is not vulnerable to Darkside attack (its random number generator seems to be based on the wellknown");
+							PrintAndLog("generating polynomial with 16 effective bits only, but shows unexpected behaviour.\n"); break;
+				default: ;
+			}
 			break;
 		}
 	}	
@@ -69,22 +75,13 @@ start:
 	if (nonce2key(uid, nt, nr, par_list, ks_list, &r_key)) {
 		isOK = 2;
 		PrintAndLog("Key not found (lfsr_common_prefix list is null). Nt=%08x", nt);	
-	} else {
-		printf("------------------------------------------------------------------\n");
-		PrintAndLog("Key found:%012"llx" \n", r_key);
-
-		num_to_bytes(r_key, 6, keyBlock);
-		isOK = mfCheckKeys(0, 0, 1, keyBlock, &r_key);
-	}
-	
-	if (!isOK) 
-		PrintAndLog("Found valid key:%012"llx, r_key);
-	else
-	{
-		if (isOK != 2) PrintAndLog("Found invalid key. ");	
 		PrintAndLog("Failing is expected to happen in 25%% of all cases. Trying again with a different reader nonce...");
 		c.arg[0] = false;
 		goto start;
+	} else {
+		isOK = 0;
+		printf("------------------------------------------------------------------\n");
+		PrintAndLog("Found valid key:%012"llx" \n", r_key);
 	}
 	
 	PrintAndLog("");
@@ -124,10 +121,11 @@ int CmdHF14AMfWrBl(const char *Cmd)
 	PrintAndLog("--block no:%d, key type:%c, key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));
 	PrintAndLog("--data: %s", sprint_hex(bldata, 16));
 	
-  UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};
+	UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};
 	memcpy(c.d.asBytes, key, 6);
 	memcpy(c.d.asBytes + 10, bldata, 16);
-  SendCommand(&c);
+	clearCommandBuffer();
+	SendCommand(&c);
 
 	UsbCommand resp;
 	if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
@@ -145,7 +143,7 @@ int CmdHF14AMfRdBl(const char *Cmd)
 	uint8_t blockNo = 0;
 	uint8_t keyType = 0;
 	uint8_t key[6] = {0, 0, 0, 0, 0, 0};
-	
+
 	char cmdp	= 0x00;
 
 
@@ -153,8 +151,8 @@ int CmdHF14AMfRdBl(const char *Cmd)
 		PrintAndLog("Usage:  hf mf rdbl    <block number> <key A/B> <key (12 hex symbols)>");
 		PrintAndLog("        sample: hf mf rdbl 0 A FFFFFFFFFFFF ");
 		return 0;
-	}	
-	
+	}
+
 	blockNo = param_get8(Cmd, 0);
 	cmdp = param_getchar(Cmd, 1);
 	if (cmdp == 0x00) {
@@ -167,10 +165,11 @@ int CmdHF14AMfRdBl(const char *Cmd)
 		return 1;
 	}
 	PrintAndLog("--block no:%d, key type:%c, key:%s ", blockNo, keyType?'B':'A', sprint_hex(key, 6));
-	
-  UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};
+
+	UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};
 	memcpy(c.d.asBytes, key, 6);
-  SendCommand(&c);
+	clearCommandBuffer();
+	SendCommand(&c);
 
 	UsbCommand resp;
 	if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
@@ -220,9 +219,10 @@ int CmdHF14AMfRdSc(const char *Cmd)
 		return 1;
 	}
 	PrintAndLog("--sector no:%d key type:%c key:%s ", sectorNo, keyType?'B':'A', sprint_hex(key, 6));
-	
+
 	UsbCommand c = {CMD_MIFARE_READSC, {sectorNo, keyType, 0}};
 	memcpy(c.d.asBytes, key, 6);
+	clearCommandBuffer();
 	SendCommand(&c);
 	PrintAndLog(" ");
 
@@ -242,7 +242,7 @@ int CmdHF14AMfRdSc(const char *Cmd)
 		PrintAndLog("Command execute timeout");
 	}
 
-  return 0;
+	return 0;
 }
 
 uint8_t FirstBlockOfSector(uint8_t sectorNo)
@@ -266,7 +266,7 @@ uint8_t NumBlocksPerSector(uint8_t sectorNo)
 int CmdHF14AMfDump(const char *Cmd)
 {
 	uint8_t sectorNo, blockNo;
-	
+
 	uint8_t keyA[40][6];
 	uint8_t keyB[40][6];
 	uint8_t rights[40][4];
@@ -319,16 +319,17 @@ int CmdHF14AMfDump(const char *Cmd)
 			return 2;
 		}
 	}
-	
+
 	fclose(fin);
 
 	PrintAndLog("|-----------------------------------------|");
 	PrintAndLog("|------ Reading sector access bits...-----|");
 	PrintAndLog("|-----------------------------------------|");
-	
+
 	for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {
 		UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 0, 0}};
 		memcpy(c.d.asBytes, keyA[sectorNo], 6);
+		clearCommandBuffer();
 		SendCommand(&c);
 
 		if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
@@ -350,11 +351,11 @@ int CmdHF14AMfDump(const char *Cmd)
 			rights[sectorNo][3] = 0x01;
 		}
 	}
-	
+
 	PrintAndLog("|-----------------------------------------|");
 	PrintAndLog("|----- Dumping all blocks to file... -----|");
 	PrintAndLog("|-----------------------------------------|");
-	
+
 	bool isOK = true;
 	for (sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
 		for (blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
@@ -363,6 +364,7 @@ int CmdHF14AMfDump(const char *Cmd)
 			if (blockNo == NumBlocksPerSector(sectorNo) - 1) {		// sector trailer. At least the Access Conditions can always be read with key A. 
 				UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};
 				memcpy(c.d.asBytes, keyA[sectorNo], 6);
+				clearCommandBuffer();
 				SendCommand(&c);
 				received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
 			} else {												// data block. Check if it can be read with key A or key B
@@ -370,6 +372,7 @@ int CmdHF14AMfDump(const char *Cmd)
 				if ((rights[sectorNo][data_area] == 0x03) || (rights[sectorNo][data_area] == 0x05)) {	// only key B would work
 					UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 1, 0}};
 					memcpy(c.d.asBytes, keyB[sectorNo], 6);
+					clearCommandBuffer();
 					SendCommand(&c);
 					received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
 				} else if (rights[sectorNo][data_area] == 0x07) {										// no key would work
@@ -378,6 +381,7 @@ int CmdHF14AMfDump(const char *Cmd)
 				} else {																				// key A would work
 					UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};
 					memcpy(c.d.asBytes, keyA[sectorNo], 6);
+					clearCommandBuffer();
 					SendCommand(&c);
 					received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
 				}
@@ -434,7 +438,7 @@ int CmdHF14AMfRestore(const char *Cmd)
 {
 	uint8_t sectorNo,blockNo;
 	uint8_t keyType = 0;
-	uint8_t key[6] = {0xFF};
+	uint8_t key[6] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
 	uint8_t bldata[16] = {0x00};
 	uint8_t keyA[40][6];
 	uint8_t keyB[40][6];
@@ -521,6 +525,7 @@ int CmdHF14AMfRestore(const char *Cmd)
 			PrintAndLog("Writing to block %3d: %s", FirstBlockOfSector(sectorNo) + blockNo, sprint_hex(bldata, 16));
 			
 			memcpy(c.d.asBytes + 10, bldata, 16);
+			clearCommandBuffer();
 			SendCommand(&c);
 
 			UsbCommand resp;
@@ -547,7 +552,7 @@ int CmdHF14AMfNested(const char *Cmd)
 	uint8_t trgKeyType = 0;
 	uint8_t SectorsCnt = 0;
 	uint8_t key[6] = {0, 0, 0, 0, 0, 0};
-	uint8_t keyBlock[13*6];
+	uint8_t keyBlock[14*6];
 	uint64_t key64 = 0;
 	bool transferToEml = false;
 	
@@ -622,8 +627,14 @@ int CmdHF14AMfNested(const char *Cmd)
 	
 	if (cmdp == 'o') {
 		PrintAndLog("--target block no:%3d, target key type:%c ", trgBlockNo, trgKeyType?'B':'A');
-		if (mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true)) {
-			PrintAndLog("Nested error.");
+		int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true);
+		if (isOK) {
+			switch (isOK) {
+				case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;
+				case -2 : PrintAndLog("Button pressed. Aborted.\n"); break;
+				case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (random numbers are not predictable).\n"); break;
+				default : PrintAndLog("Unknown Error.\n");
+			}
 			return 2;
 		}
 		key64 = bytes_to_num(keyBlock, 6);
@@ -678,7 +689,7 @@ int CmdHF14AMfNested(const char *Cmd)
 			for (j = 0; j < 2; j++) {
 				if (e_sector[i].foundKey[j]) continue;
 				
-				res = mfCheckKeys(FirstBlockOfSector(i), j, 6, keyBlock, &key64);
+				res = mfCheckKeys(FirstBlockOfSector(i), j, true, 6, keyBlock, &key64);
 				
 				if (!res) {
 					e_sector[i].Key[j] = key64;
@@ -696,11 +707,17 @@ int CmdHF14AMfNested(const char *Cmd)
 				for (trgKeyType = 0; trgKeyType < 2; trgKeyType++) { 
 					if (e_sector[sectorNo].foundKey[trgKeyType]) continue;
 					PrintAndLog("-----------------------------------------------");
-					if(mfnested(blockNo, keyType, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate)) {
-						PrintAndLog("Nested error.\n");
+					int16_t isOK = mfnested(blockNo, keyType, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate);
+					if(isOK) {
+						switch (isOK) {
+							case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;
+							case -2 : PrintAndLog("Button pressed. Aborted.\n"); break;
+							case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (random numbers are not predictable).\n"); break;
+							default : PrintAndLog("Unknown Error.\n");
+						}
 						free(e_sector);
-						return 2;					}
-					else {
+						return 2;
+					} else {
 						calibrate = false;
 					}
 					
@@ -858,6 +875,7 @@ int CmdHF14AMfChk(const char *Cmd)
 		break;
 	default:
 		PrintAndLog("Key type must be A , B or ?");
+		free(keyBlock);
 		return 1;
 	};
 	
@@ -909,6 +927,7 @@ int CmdHF14AMfChk(const char *Cmd)
 						if (!p) {
 							PrintAndLog("Cannot allocate memory for defKeys");
 							free(keyBlock);
+							fclose(f);
 							return 2;
 						}
 						keyBlock = p;
@@ -956,7 +975,7 @@ int CmdHF14AMfChk(const char *Cmd)
 			uint32_t max_keys = keycnt>USB_CMD_DATA_SIZE/6?USB_CMD_DATA_SIZE/6:keycnt;
 			for (uint32_t c = 0; c < keycnt; c+=max_keys) {
 				uint32_t size = keycnt-c>max_keys?max_keys:keycnt-c;
-				res = mfCheckKeys(b, t, size, &keyBlock[6*c], &key64);
+				res = mfCheckKeys(b, t, true, size, &keyBlock[6*c], &key64);
 				if (res != 1) {
 					if (!res) {
 						PrintAndLog("Found valid key:[%012"llx"]",key64);
@@ -1060,6 +1079,7 @@ int CmdHF14AMf1kSim(const char *Cmd)
 
 	UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};
 	memcpy(c.d.asBytes, uid, sizeof(uid));
+	clearCommandBuffer();
 	SendCommand(&c);
 
 	if(flags & FLAG_INTERACTIVE)
@@ -1068,7 +1088,7 @@ int CmdHF14AMf1kSim(const char *Cmd)
 		PrintAndLog("Press pm3-button to abort simulation");
 		while(! WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 			//We're waiting only 1.5 s at a time, otherwise we get the
-			// annoying message about "Waiting for a response... "
+			//annoying message about "Waiting for a response... "
 		}
 	}
 	
@@ -1135,7 +1155,6 @@ int CmdHF14AMfEClear(const char *Cmd)
   return 0;
 }
 
-
 int CmdHF14AMfESet(const char *Cmd)
 {
 	uint8_t memBlock[16];
@@ -1163,7 +1182,6 @@ int CmdHF14AMfESet(const char *Cmd)
 	return 0;
 }
 
-
 int CmdHF14AMfELoad(const char *Cmd)
 {
 	FILE * f;
@@ -1173,13 +1191,13 @@ int CmdHF14AMfELoad(const char *Cmd)
 	uint8_t buf8[64] = {0x00};
 	int i, len, blockNum, numBlocks;
 	int nameParamNo = 1;
-	
+	uint8_t blockWidth = 32;	
 	char ctmp = param_getchar(Cmd, 0);
 		
 	if ( ctmp == 'h' || ctmp == 0x00) {
 		PrintAndLog("It loads emul dump from the file `filename.eml`");
-		PrintAndLog("Usage:  hf mf eload [card memory] <file name w/o `.eml`>");
-		PrintAndLog("  [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");
+		PrintAndLog("Usage:  hf mf eload [card memory] <file name w/o `.eml`> [numblocks]");
+		PrintAndLog("  [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K, u = UL");
 		PrintAndLog("");
 		PrintAndLog(" sample: hf mf eload filename");
 		PrintAndLog("         hf mf eload 4 filename");
@@ -1192,15 +1210,18 @@ int CmdHF14AMfELoad(const char *Cmd)
 		case '\0': numBlocks = 16*4; break;
 		case '2' : numBlocks = 32*4; break;
 		case '4' : numBlocks = 256; break;
+		case 'U' : // fall through
+		case 'u' : numBlocks = 255; blockWidth = 8; break;
 		default:  {
 			numBlocks = 16*4;
 			nameParamNo = 0;
 		}
 	}
+	uint32_t numblk2 = param_get32ex(Cmd,2,0,10);
+	if (numblk2 > 0) numBlocks = numblk2;	
 
 	len = param_getstr(Cmd,nameParamNo,filename);
-	
-	if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;
+	if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;
 
 	fnameptr += len;
 
@@ -1226,19 +1247,18 @@ int CmdHF14AMfELoad(const char *Cmd)
 			return 2;
 		}
 		
-		if (strlen(buf) < 32){
+		if (strlen(buf) < blockWidth){
 			if(strlen(buf) && feof(f))
 				break;
-			PrintAndLog("File content error. Block data must include 32 HEX symbols");
+			PrintAndLog("File content error. Block data must include %d HEX symbols", blockWidth);
 			fclose(f);
 			return 2;
 		}
 		
-		for (i = 0; i < 32; i += 2) {
+		for (i = 0; i < blockWidth; i += 2) {
 			sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]);
-		}
-		
-		if (mfEmlSetMem(buf8, blockNum, 1)) {
+		}		
+		if (mfEmlSetMem_xt(buf8, blockNum, 1, blockWidth/2)) {
 			PrintAndLog("Cant set emul block: %3d", blockNum);
 			fclose(f);
 			return 3;
@@ -1259,7 +1279,6 @@ int CmdHF14AMfELoad(const char *Cmd)
 	return 0;
 }
 
-
 int CmdHF14AMfESave(const char *Cmd)
 {
 	FILE * f;
@@ -1299,17 +1318,20 @@ int CmdHF14AMfESave(const char *Cmd)
 
 	len = param_getstr(Cmd,nameParamNo,filename);
 	
-	if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;
+	if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;
 	
 	// user supplied filename?
 	if (len < 1) {
 		// get filename (UID from memory)
 		if (mfEmlGetMem(buf, 0, 1)) {
 			PrintAndLog("Can\'t get UID from block: %d", 0);
-			sprintf(filename, "dump.eml"); 
+			len = sprintf(fnameptr, "dump");
+			fnameptr += len;
+		}
+		else {
+			for (j = 0; j < 7; j++, fnameptr += 2)
+				sprintf(fnameptr, "%02X", buf[j]);
 		}
-		for (j = 0; j < 7; j++, fnameptr += 2)
-			sprintf(fnameptr, "%02X", buf[j]); 
 	} else {
 		fnameptr += len;
 	}
@@ -1342,7 +1364,6 @@ int CmdHF14AMfESave(const char *Cmd)
   return 0;
 }
 
-
 int CmdHF14AMfECFill(const char *Cmd)
 {
 	uint8_t keyType = 0;
@@ -1382,7 +1403,6 @@ int CmdHF14AMfECFill(const char *Cmd)
 	return 0;
 }
 
-
 int CmdHF14AMfEKeyPrn(const char *Cmd)
 {
 	int i;
@@ -1390,7 +1410,9 @@ int CmdHF14AMfEKeyPrn(const char *Cmd)
 	uint8_t data[16];
 	uint64_t keyA, keyB;
 	
-	if (param_getchar(Cmd, 0) == 'h') {
+	char cmdp = param_getchar(Cmd, 0);
+
+	if ( cmdp == 'h' || cmdp == 'H') {
 		PrintAndLog("It prints the keys loaded in the emulator memory");
 		PrintAndLog("Usage:  hf mf ekeyprn [card memory]");
 		PrintAndLog("  [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");
@@ -1399,8 +1421,6 @@ int CmdHF14AMfEKeyPrn(const char *Cmd)
 		return 0;
 	}	
 
-	char cmdp = param_getchar(Cmd, 0);
-	
 	switch (cmdp) {
 		case '0' : numSectors = 5; break;
 		case '1' : 
@@ -1427,7 +1447,6 @@ int CmdHF14AMfEKeyPrn(const char *Cmd)
 	return 0;
 }
 
-
 int CmdHF14AMfCSetUID(const char *Cmd)
 {
 	uint8_t wipeCard = 0;
@@ -1499,16 +1518,16 @@ int CmdHF14AMfCSetUID(const char *Cmd)
 
 int CmdHF14AMfCSetBlk(const char *Cmd)
 {
-	uint8_t uid[8] = {0x00};
 	uint8_t memBlock[16] = {0x00};
 	uint8_t blockNo = 0;
+	uint8_t params = MAGIC_SINGLE;
 	int res;
 
 	if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {
-		PrintAndLog("Usage:  hf mf csetblk <block number> <block data (32 hex symbols)>");
+		PrintAndLog("Usage:  hf mf csetblk <block number> <block data (32 hex symbols)> [w]");
 		PrintAndLog("sample:  hf mf csetblk 1 01020304050607080910111213141516");
-		PrintAndLog("Set block data for magic Chinese card (only works with!!!)");
-		PrintAndLog("If you want wipe card then add 'w' into command line. \n");
+		PrintAndLog("Set block data for magic Chinese card (only works with such cards)");
+		PrintAndLog("If you also want wipe the card then add 'w' at the end of the command line");
 		return 0;
 	}	
 
@@ -1519,29 +1538,35 @@ int CmdHF14AMfCSetBlk(const char *Cmd)
 		return 1;
 	}
 
+	char ctmp = param_getchar(Cmd, 2);
+	if (ctmp == 'w' || ctmp == 'W')
+		params |= MAGIC_WIPE;
+
 	PrintAndLog("--block number:%2d data:%s", blockNo, sprint_hex(memBlock, 16));
 
-	res = mfCSetBlock(blockNo, memBlock, uid, 0, CSETBLOCK_SINGLE_OPER);
+	res = mfCSetBlock(blockNo, memBlock, NULL, params);
 	if (res) {
-			PrintAndLog("Can't write block. error=%d", res);
-			return 1;
-		}
-	
+		PrintAndLog("Can't write block. error=%d", res);
+		return 1;
+	}
 	return 0;
 }
 
-
 int CmdHF14AMfCLoad(const char *Cmd)
 {
 	FILE * f;
-	char filename[FILE_PATH_SIZE] = {0x00};
+	char filename[FILE_PATH_SIZE];
 	char * fnameptr = filename;
 	char buf[64] = {0x00};
 	uint8_t buf8[64] = {0x00};
 	uint8_t fillFromEmulator = 0;
-	int i, len, blockNum, flags;
+	int i, len, blockNum, flags=0;
 	
-	if (param_getchar(Cmd, 0) == 'h' || param_getchar(Cmd, 0)== 0x00) {
+	memset(filename, 0, sizeof(filename));
+
+	char ctmp = param_getchar(Cmd, 0);
+
+	if (ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) {
 		PrintAndLog("It loads magic Chinese card from the file `filename.eml`");
 		PrintAndLog("or from emulator memory (option `e`)");
 		PrintAndLog("Usage:  hf mf cload <file name w/o `.eml`>");
@@ -1550,7 +1575,6 @@ int CmdHF14AMfCLoad(const char *Cmd)
 		return 0;
 	}	
 
-	char ctmp = param_getchar(Cmd, 0);
 	if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;
 	
 	if (fillFromEmulator) {
@@ -1559,11 +1583,11 @@ int CmdHF14AMfCLoad(const char *Cmd)
 				PrintAndLog("Cant get block: %d", blockNum);
 				return 2;
 			}
-			if (blockNum == 0) flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC;				// switch on field and send magic sequence
+			if (blockNum == 0) flags = MAGIC_INIT + MAGIC_WUPC;				// switch on field and send magic sequence
 			if (blockNum == 1) flags = 0;													// just write
-			if (blockNum == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD;		// Done. Magic Halt and switch off field.
+			if (blockNum == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF;		// Done. Magic Halt and switch off field.
 
-			if (mfCSetBlock(blockNum, buf8, NULL, 0, flags)) {
+			if (mfCSetBlock(blockNum, buf8, NULL, flags)) {
 				PrintAndLog("Cant set magic card block: %d", blockNum);
 				return 3;
 			}
@@ -1571,7 +1595,7 @@ int CmdHF14AMfCLoad(const char *Cmd)
 		return 0;
 	} else {
 		len = strlen(Cmd);
-		if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;
+		if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;
 
 		memcpy(filename, Cmd, len);
 		fnameptr += len;
@@ -1591,6 +1615,7 @@ int CmdHF14AMfCLoad(const char *Cmd)
 			memset(buf, 0, sizeof(buf));
 			
 			if (fgets(buf, sizeof(buf), f) == NULL) {
+				fclose(f);
 				PrintAndLog("File reading error.");
 				return 2;
 			}
@@ -1599,16 +1624,17 @@ int CmdHF14AMfCLoad(const char *Cmd)
 				if(strlen(buf) && feof(f))
 					break;
 				PrintAndLog("File content error. Block data must include 32 HEX symbols");
+				fclose(f);
 				return 2;
 			}
 			for (i = 0; i < 32; i += 2)
 				sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]);
 
-			if (blockNum == 0) flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC;				// switch on field and send magic sequence
+			if (blockNum == 0) flags = MAGIC_INIT + MAGIC_WUPC;				// switch on field and send magic sequence
 			if (blockNum == 1) flags = 0;													// just write
-			if (blockNum == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD;		// Done. Switch off field.
+			if (blockNum == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF;		// Done. Switch off field.
 
-			if (mfCSetBlock(blockNum, buf8, NULL, 0, flags)) {
+			if (mfCSetBlock(blockNum, buf8, NULL, flags)) {
 				PrintAndLog("Can't set magic card block: %d", blockNum);
 				return 3;
 			}
@@ -1629,15 +1655,16 @@ int CmdHF14AMfCLoad(const char *Cmd)
 }
 
 int CmdHF14AMfCGetBlk(const char *Cmd) {
-	uint8_t memBlock[16];
+	uint8_t data[16];
 	uint8_t blockNo = 0;
 	int res;
-	memset(memBlock, 0x00, sizeof(memBlock));
+	memset(data, 0x00, sizeof(data));
+	char ctmp = param_getchar(Cmd, 0);
 
-	if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {
+	if (strlen(Cmd) < 1 || ctmp == 'h' || ctmp == 'H') {
 		PrintAndLog("Usage:  hf mf cgetblk <block number>");
 		PrintAndLog("sample:  hf mf cgetblk 1");
-		PrintAndLog("Get block data from magic Chinese card (only works with!!!)\n");
+		PrintAndLog("Get block data from magic Chinese card (only works with such cards)\n");
 		return 0;
 	}	
 
@@ -1645,28 +1672,29 @@ int CmdHF14AMfCGetBlk(const char *Cmd) {
 
 	PrintAndLog("--block number:%2d ", blockNo);
 
-	res = mfCGetBlock(blockNo, memBlock, CSETBLOCK_SINGLE_OPER);
+	res = mfCGetBlock(blockNo, data, MAGIC_SINGLE);
 	if (res) {
 			PrintAndLog("Can't read block. error=%d", res);
 			return 1;
 		}
 	
-	PrintAndLog("block data:%s", sprint_hex(memBlock, 16));
+	PrintAndLog("block data:%s", sprint_hex(data, sizeof(data)));
 	return 0;
 }
 
-
 int CmdHF14AMfCGetSc(const char *Cmd) {
-	uint8_t memBlock[16] = {0x00};
+	uint8_t data[16];
 	uint8_t sectorNo = 0;
 	int i, res, flags;
+	memset(data, 0x00, sizeof(data));
+	char ctmp = param_getchar(Cmd, 0);
 
-	if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {
+	if (strlen(Cmd) < 1 || ctmp == 'h' || ctmp == 'H') {
 		PrintAndLog("Usage:  hf mf cgetsc <sector number>");
 		PrintAndLog("sample:  hf mf cgetsc 0");
-		PrintAndLog("Get sector data from magic Chinese card (only works with!!!)\n");
+		PrintAndLog("Get sector data from magic Chinese card (only works with such cards)\n");
 		return 0;
-	}	
+	}
 
 	sectorNo = param_get8(Cmd, 0);
 	if (sectorNo > 15) {
@@ -1675,37 +1703,37 @@ int CmdHF14AMfCGetSc(const char *Cmd) {
 	}
 
 	PrintAndLog("--sector number:%d ", sectorNo);
+	PrintAndLog("block | data");
 
-	flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC;
+	flags = MAGIC_INIT + MAGIC_WUPC;
 	for (i = 0; i < 4; i++) {
 		if (i == 1) flags = 0;
-		if (i == 3) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD;
+		if (i == 3) flags = MAGIC_HALT + MAGIC_OFF;
 
-		res = mfCGetBlock(sectorNo * 4 + i, memBlock, flags);
+		res = mfCGetBlock(sectorNo * 4 + i, data, flags);
 		if (res) {
 			PrintAndLog("Can't read block. %d error=%d", sectorNo * 4 + i, res);
 			return 1;
 		}
-	
-		PrintAndLog("block %3d data:%s", sectorNo * 4 + i, sprint_hex(memBlock, 16));
+		PrintAndLog(" %3d | %s", sectorNo * 4 + i, sprint_hex(data, sizeof(data)));
 	}
 	return 0;
 }
 
-
 int CmdHF14AMfCSave(const char *Cmd) {
 
 	FILE * f;
-	char filename[FILE_PATH_SIZE] = {0x00};
+	char filename[FILE_PATH_SIZE];
 	char * fnameptr = filename;
 	uint8_t fillFromEmulator = 0;
-	uint8_t buf[64] = {0x00};
+	uint8_t buf[64];
 	int i, j, len, flags;
-	
-	// memset(filename, 0, sizeof(filename));
-	// memset(buf, 0, sizeof(buf));
 
-	if (param_getchar(Cmd, 0) == 'h') {
+	memset(filename, 0, sizeof(filename));
+	memset(buf, 0, sizeof(buf));
+	char ctmp = param_getchar(Cmd, 0);
+
+	if ( ctmp == 'h' || ctmp == 'H' ) {
 		PrintAndLog("It saves `magic Chinese` card dump into the file `filename.eml` or `cardID.eml`");
 		PrintAndLog("or into emulator memory (option `e`)");
 		PrintAndLog("Usage:  hf mf esave [file name w/o `.eml`][e]");
@@ -1713,23 +1741,21 @@ int CmdHF14AMfCSave(const char *Cmd) {
 		PrintAndLog("         hf mf esave filename");
 		PrintAndLog("         hf mf esave e \n");
 		return 0;
-	}	
-
-	char ctmp = param_getchar(Cmd, 0);
+	}
 	if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;
 
 	if (fillFromEmulator) {
 		// put into emulator
-		flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC;
+		flags = MAGIC_INIT + MAGIC_WUPC;
 		for (i = 0; i < 16 * 4; i++) {
 			if (i == 1) flags = 0;
-			if (i == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD;
-		
+			if (i == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF;
+
 			if (mfCGetBlock(i, buf, flags)) {
 				PrintAndLog("Cant get block: %d", i);
 				break;
 			}
-			
+
 			if (mfEmlSetMem(buf, i, 1)) {
 				PrintAndLog("Cant set emul block: %d", i);
 				return 3;
@@ -1738,23 +1764,27 @@ int CmdHF14AMfCSave(const char *Cmd) {
 		return 0;
 	} else {
 		len = strlen(Cmd);
-		if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;
-	
+		if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;
+
+		// get filename based on UID
 		if (len < 1) {
-			// get filename
-			if (mfCGetBlock(0, buf, CSETBLOCK_SINGLE_OPER)) {
+
+			if (mfCGetBlock(0, buf, MAGIC_SINGLE)) {
 				PrintAndLog("Cant get block: %d", 0);
-				return 1;
+				len = sprintf(fnameptr, "dump");
+				fnameptr += len;
+			} else {
+				for (j = 0; j < 7; j++, fnameptr += 2)
+					sprintf(fnameptr, "%02x", buf[j]); 
 			}
-			for (j = 0; j < 7; j++, fnameptr += 2)
-				sprintf(fnameptr, "%02x", buf[j]); 
 		} else {
 			memcpy(filename, Cmd, len);
 			fnameptr += len;
 		}
 
+		// add .eml extension
 		sprintf(fnameptr, ".eml"); 
-	
+
 		// open file
 		f = fopen(filename, "w+");
 
@@ -1764,10 +1794,10 @@ int CmdHF14AMfCSave(const char *Cmd) {
 		}
 
 		// put hex
-		flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC;
+		flags = MAGIC_INIT + MAGIC_WUPC;
 		for (i = 0; i < 16 * 4; i++) {
 			if (i == 1) flags = 0;
-			if (i == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD;
+			if (i == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF;
 		
 			if (mfCGetBlock(i, buf, flags)) {
 				PrintAndLog("Cant get block: %d", i);
@@ -1777,15 +1807,13 @@ int CmdHF14AMfCSave(const char *Cmd) {
 				fprintf(f, "%02x", buf[j]); 
 			fprintf(f,"\n");
 		}
+		fflush(f);
 		fclose(f);
-	
 		PrintAndLog("Saved to file: %s", filename);
-	
 		return 0;
 	}
 }
 
-
 int CmdHF14AMfSniff(const char *Cmd){
 
 	bool wantLogToFile = 0;
@@ -1855,7 +1883,10 @@ int CmdHF14AMfSniff(const char *Cmd){
 			uint16_t traceLen = resp.arg[1];
 			len = resp.arg[2];
 
-			if (res == 0) return 0;						// we are done
+			if (res == 0) {
+				free(buf);
+				return 0;						// we are done
+			}
 
 			if (res == 1) {								// there is (more) data to be transferred
 				if (pckNum == 0) {						// first packet, (re)allocate necessary buffer
@@ -1877,6 +1908,11 @@ int CmdHF14AMfSniff(const char *Cmd){
 					bufsize = traceLen;
 					memset(buf, 0x00, traceLen);
 				}
+				if (bufPtr == NULL) {
+					PrintAndLog("Cannot allocate memory for trace");
+					free(buf);
+					return 2;
+				}
 				memcpy(bufPtr, resp.d.asBytes, len);
 				bufPtr += len;
 				pckNum++;
@@ -1933,6 +1969,13 @@ int CmdHF14AMfSniff(const char *Cmd){
 	return 0;
 }
 
+//needs nt, ar, at, Data to decrypt
+int CmdHf14MfDecryptBytes(const char *Cmd){
+	uint8_t data[50];
+	int len = 0;
+	param_gethex_ex(Cmd,3,data,&len);
+	return tryDecryptWord(param_get32ex(Cmd,0,0,16),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16),data,len/2);
+}
 
 static command_t CommandTable[] =
 {
@@ -1961,6 +2004,7 @@ static command_t CommandTable[] =
   {"cgetsc",	CmdHF14AMfCGetSc,		0, "Read sector - Magic Chinese card"},
   {"cload",		CmdHF14AMfCLoad,		0, "Load dump into magic Chinese card"},
   {"csave",		CmdHF14AMfCSave,		0, "Save dump from magic Chinese card into file or emulator"},
+  {"decrypt", CmdHf14MfDecryptBytes,1, "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace"},
   {NULL, NULL, 0, NULL}
 };