X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/4a79e52c0b9530242d728d182ede1bfdb9625cdc..35147d51e3961db75a852368fffa31006da90199:/client/cmdhfmf.c?ds=sidebyside diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index eb3b4bf1..e892b377 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -7,7 +7,7 @@ //----------------------------------------------------------------------------- // High frequency MIFARE commands //----------------------------------------------------------------------------- - +#include "../include/mifare.h" #include "cmdhfmf.h" static int CmdHelp(const char *Cmd); @@ -140,6 +140,7 @@ int CmdHF14AMfWrBl(const char *Cmd) return 0; } +/* dublett finns i CMDHFMFU.C int CmdHF14AMfUWrBl(const char *Cmd) { uint8_t blockNo = 0; @@ -249,8 +250,7 @@ int CmdHF14AMfUWrBl(const char *Cmd) } return 0; } - - +*/ int CmdHF14AMfRdBl(const char *Cmd) { uint8_t blockNo = 0; @@ -299,6 +299,7 @@ int CmdHF14AMfRdBl(const char *Cmd) return 0; } +/* dublett finns i CMDHFMFU.C int CmdHF14AMfURdBl(const char *Cmd) { uint8_t blockNo = 0; @@ -330,8 +331,9 @@ int CmdHF14AMfURdBl(const char *Cmd) return 0; } +*/ - +/* dublett finns i CMDHFMFU.C int CmdHF14AMfURdCard(const char *Cmd) { int i; @@ -422,7 +424,7 @@ int CmdHF14AMfURdCard(const char *Cmd) } return 0; } - +*/ int CmdHF14AMfRdSc(const char *Cmd) { @@ -509,6 +511,7 @@ int CmdHF14AMfDump(const char *Cmd) uint8_t keyA[40][6]; uint8_t keyB[40][6]; uint8_t rights[40][4]; + uint8_t carddata[256][16]; uint8_t numSectors = 16; FILE *fin; @@ -516,7 +519,16 @@ int CmdHF14AMfDump(const char *Cmd) UsbCommand resp; + int size = GetCardSize(); char cmdp = param_getchar(Cmd, 0); + + PrintAndLog("Got %d",size); + + return; + + if ( size > -1) + cmdp = (char)48+size; + switch (cmdp) { case '0' : numSectors = 5; break; case '1' : @@ -540,13 +552,7 @@ int CmdHF14AMfDump(const char *Cmd) return 1; } - if ((fout = fopen("dumpdata.bin","wb")) == NULL) { - PrintAndLog("Could not create file name dumpdata.bin"); - return 1; - } - - // Read key file - + // Read keys A from file for (sectorNo=0; sectorNo>4) | ((data[8] & 0x1)<<1) | ((data[8] & 0x10)>>2); - rights[sectorNo][1] = ((data[7] & 0x20)>>5) | ((data[8] & 0x2)<<0) | ((data[8] & 0x20)>>3); - rights[sectorNo][2] = ((data[7] & 0x40)>>6) | ((data[8] & 0x4)>>1) | ((data[8] & 0x40)>>4); - rights[sectorNo][3] = ((data[7] & 0x80)>>7) | ((data[8] & 0x8)>>2) | ((data[8] & 0x80)>>5); + rights[sectorNo][0] = ((data[7] & 0x10)>>2) | ((data[8] & 0x1)<<1) | ((data[8] & 0x10)>>4); // C1C2C3 for data area 0 + rights[sectorNo][1] = ((data[7] & 0x20)>>3) | ((data[8] & 0x2)<<0) | ((data[8] & 0x20)>>5); // C1C2C3 for data area 1 + rights[sectorNo][2] = ((data[7] & 0x40)>>4) | ((data[8] & 0x4)>>1) | ((data[8] & 0x40)>>6); // C1C2C3 for data area 2 + rights[sectorNo][3] = ((data[7] & 0x80)>>5) | ((data[8] & 0x8)>>2) | ((data[8] & 0x80)>>7); // C1C2C3 for sector trailer } else { - PrintAndLog("Could not get access rights for sector %2d.", sectorNo); + PrintAndLog("Could not get access rights for sector %2d. Trying with defaults...", sectorNo); + rights[sectorNo][0] = rights[sectorNo][1] = rights[sectorNo][2] = 0x00; + rights[sectorNo][3] = 0x01; } } else { - PrintAndLog("Command execute timeout"); + PrintAndLog("Command execute timeout when trying to read access rights for sector %2d. Trying with defaults...", sectorNo); + rights[sectorNo][0] = rights[sectorNo][1] = rights[sectorNo][2] = 0x00; + rights[sectorNo][3] = 0x01; } } - // Read blocks and print to file - PrintAndLog("|-----------------------------------------|"); PrintAndLog("|----- Dumping all blocks to file... -----|"); PrintAndLog("|-----------------------------------------|"); - - for (sectorNo = 0; sectorNo < numSectors; sectorNo++) { - for (blockNo = 0; blockNo < NumBlocksPerSector(sectorNo); blockNo++) { + bool isOK = true; + for (sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) { + for (blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) { bool received = false; + if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. At least the Access Conditions can always be read with key A. UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}}; memcpy(c.d.asBytes, keyA[sectorNo], 6); @@ -605,12 +613,13 @@ int CmdHF14AMfDump(const char *Cmd) received = WaitForResponseTimeout(CMD_ACK,&resp,1500); } else { // data block. Check if it can be read with key A or key B uint8_t data_area = sectorNo<32?blockNo:blockNo/5; - if ((rights[sectorNo][data_area] == 3) || (rights[sectorNo][data_area] == 5)) { // only key B would work + if ((rights[sectorNo][data_area] == 0x03) || (rights[sectorNo][data_area] == 0x05)) { // only key B would work UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 1, 0}}; memcpy(c.d.asBytes, keyB[sectorNo], 6); SendCommand(&c); received = WaitForResponseTimeout(CMD_ACK,&resp,1500); - } else if (rights[sectorNo][data_area] == 7) { // no key would work + } else if (rights[sectorNo][data_area] == 0x07) { // no key would work + isOK = false; PrintAndLog("Access rights do not allow reading of sector %2d block %3d", sectorNo, blockNo); } else { // key A would work UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}}; @@ -621,7 +630,7 @@ int CmdHF14AMfDump(const char *Cmd) } if (received) { - uint8_t isOK = resp.arg[0] & 0xff; + isOK = resp.arg[0] & 0xff; uint8_t *data = resp.d.asBytes; if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. Fill in the keys. data[0] = (keyA[sectorNo][0]); @@ -638,21 +647,33 @@ int CmdHF14AMfDump(const char *Cmd) data[15] = (keyB[sectorNo][5]); } if (isOK) { - fwrite ( data, 1, 16, fout ); - PrintAndLog("Dumped block %2d of sector %2d into 'dumpdata.bin'"); + memcpy(carddata[FirstBlockOfSector(sectorNo) + blockNo], data, 16); + PrintAndLog("Successfully read block %2d of sector %2d.", blockNo, sectorNo); } else { PrintAndLog("Could not read block %2d of sector %2d", blockNo, sectorNo); + break; } } else { - PrintAndLog("Command execute timeout"); + isOK = false; + PrintAndLog("Command execute timeout when trying to read block %2d of sector %2d.", blockNo, sectorNo); + break; } } + } + if (isOK) { + if ((fout = fopen("dumpdata.bin","wb")) == NULL) { + PrintAndLog("Could not create file name dumpdata.bin"); + return 1; + } + uint16_t numblocks = FirstBlockOfSector(numSectors - 1) + NumBlocksPerSector(numSectors - 1); + fwrite(carddata, 1, 16*numblocks, fout); + fclose(fout); + PrintAndLog("Dumped %d blocks (%d bytes) to file dumpdata.bin", numblocks, 16*numblocks); } fclose(fin); - fclose(fout); return 0; } @@ -712,7 +733,7 @@ int CmdHF14AMfRestore(const char *Cmd) return 2; } } - + PrintAndLog("Restoring dumpdata.bin to card"); for (sectorNo = 0; sectorNo < numSectors; sectorNo++) { @@ -792,20 +813,24 @@ int CmdHF14AMfNested(const char *Cmd) PrintAndLog("d - write keys to binary file"); PrintAndLog(" "); PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF "); - PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF t "); - PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF d "); - PrintAndLog(" sample2: hf mf nested o 0 A FFFFFFFFFFFF 4 A"); + PrintAndLog(" sample2: hf mf nested 1 0 A FFFFFFFFFFFF t "); + PrintAndLog(" sample3: hf mf nested 1 0 A FFFFFFFFFFFF d "); + PrintAndLog(" sample4: hf mf nested o 0 A FFFFFFFFFFFF 4 A"); return 0; } cmdp = param_getchar(Cmd, 0); blockNo = param_get8(Cmd, 1); ctmp = param_getchar(Cmd, 2); + if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') { PrintAndLog("Key type must be A or B"); return 1; } - if (ctmp != 'A' && ctmp != 'a') keyType = 1; + + if (ctmp != 'A' && ctmp != 'a') + keyType = 1; + if (param_gethex(Cmd, 3, key, 12)) { PrintAndLog("Key must include 12 HEX symbols"); return 1; @@ -819,8 +844,12 @@ int CmdHF14AMfNested(const char *Cmd) PrintAndLog("Target key type must be A or B"); return 1; } - if (ctmp != 'A' && ctmp != 'a') trgKeyType = 1; + if (ctmp != 'A' && ctmp != 'a') + trgKeyType = 1; } else { + + + switch (cmdp) { case '0': SectorsCnt = 05; break; case '1': SectorsCnt = 16; break; @@ -996,19 +1025,6 @@ int CmdHF14AMfNested(const char *Cmd) } -static uint32_t get_trailer_block (uint32_t uiBlock) -{ - // Test if we are in the small or big sectors - uint32_t trailer_block = 0; - if (uiBlock < 128) { - trailer_block = uiBlock + (3 - (uiBlock % 4)); - } else { - trailer_block = uiBlock + (15 - (uiBlock % 16)); - } - return trailer_block; -} - - int CmdHF14AMfChk(const char *Cmd) { FILE * f; @@ -1058,8 +1074,7 @@ int CmdHF14AMfChk(const char *Cmd) PrintAndLog("Usage: hf mf chk |<*card memory> [t] [] []"); PrintAndLog(" * - all sectors"); PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, - 1K"); -// PrintAndLog("d - write keys to binary file\n"); - + PrintAndLog("d - write keys to binary file\n"); PrintAndLog(" sample: hf mf chk 0 A 1234567890ab keys.dic"); PrintAndLog(" hf mf chk *1 ? t"); return 0; @@ -1169,10 +1184,22 @@ int CmdHF14AMfChk(const char *Cmd) (keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4], (keyBlock + 6*keycnt)[5], 6); } + // initialize storage for found keys + bool validKey[2][40]; + uint8_t foundKey[2][40][6]; + for (uint16_t t = 0; t < 2; t++) { + for (uint16_t sectorNo = 0; sectorNo < SectorsCnt; sectorNo++) { + validKey[t][sectorNo] = false; + for (uint16_t i = 0; i < 6; i++) { + foundKey[t][sectorNo][i] = 0xff; + } + } + } + for ( int t = !keyType; t < 2; keyType==2?(t++):(t=2) ) { int b=blockNo; for (int i = 0; i < SectorsCnt; ++i) { - PrintAndLog("--SectorsCnt:%2d, block no:%3d, key type:%C, key count:%2d ", i, b, t?'B':'A', keycnt); + PrintAndLog("--sector:%2d, block:%3d, key type:%C, key count:%2d ", i, b, t?'B':'A', keycnt); uint32_t max_keys = keycnt>USB_CMD_DATA_SIZE/6?USB_CMD_DATA_SIZE/6:keycnt; for (uint32_t c = 0; c < keycnt; c+=max_keys) { uint32_t size = keycnt-c>max_keys?max_keys:keycnt-c; @@ -1180,13 +1207,9 @@ int CmdHF14AMfChk(const char *Cmd) if (res != 1) { if (!res) { PrintAndLog("Found valid key:[%012"llx"]",key64); - if (transferToEml) { - uint8_t block[16]; - mfEmlGetMem(block, get_trailer_block(b), 1); - num_to_bytes(key64, 6, block + t*10); - mfEmlSetMem(block, get_trailer_block(b), 1); - } - } + num_to_bytes(key64, 6, foundKey[t][i]); + validKey[t][i] = true; + } } else { PrintAndLog("Command execute timeout"); } @@ -1194,42 +1217,43 @@ int CmdHF14AMfChk(const char *Cmd) b<127?(b+=4):(b+=16); } } - - free(keyBlock); -/* - // Create dump file - if (createDumpFile) { - if ((fkeys = fopen("dumpkeys.bin","wb")) == NULL) { - PrintAndLog("Could not create file dumpkeys.bin"); - free(e_sector); - return 1; + if (transferToEml) { + uint8_t block[16]; + for (uint16_t sectorNo = 0; sectorNo < SectorsCnt; sectorNo++) { + if (validKey[0][sectorNo] || validKey[1][sectorNo]) { + mfEmlGetMem(block, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1); + for (uint16_t t = 0; t < 2; t++) { + if (validKey[t][sectorNo]) { + memcpy(block + t*10, foundKey[t][sectorNo], 6); } - PrintAndLog("Printing keys to binary file dumpkeys.bin..."); - for(i=0; i<16; i++) { - if (e_sector[i].foundKey[0]){ - num_to_bytes(e_sector[i].Key[0], 6, tempkey); - fwrite ( tempkey, 1, 6, fkeys ); } - else{ - fwrite ( &standart, 1, 6, fkeys ); + mfEmlSetMem(block, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1); } } - for(i=0; i<16; i++) { - if (e_sector[i].foundKey[1]){ - num_to_bytes(e_sector[i].Key[1], 6, tempkey); - fwrite ( tempkey, 1, 6, fkeys ); + PrintAndLog("Found keys have been transferred to the emulator memory"); } - else{ - fwrite ( &standart, 1, 6, fkeys ); + + if (createDumpFile) { + FILE *fkeys = fopen("dumpkeys.bin","wb"); + if (fkeys == NULL) { + PrintAndLog("Could not create file dumpkeys.bin"); + free(keyBlock); + return 1; } + for (uint16_t t = 0; t < 2; t++) { + fwrite(foundKey[t], 1, 6*SectorsCnt, fkeys); } fclose(fkeys); + PrintAndLog("Found keys have been dumped to file dumpkeys.bin. 0xffffffffffff has been inserted for unknown keys."); } -*/ + + free(keyBlock); + return 0; } + int CmdHF14AMf1kSim(const char *Cmd) { uint8_t uid[7] = {0, 0, 0, 0, 0, 0, 0}; @@ -2011,30 +2035,121 @@ int CmdHF14AMfSniff(const char *Cmd){ FillFileNameByUID(logHexFileName, uid + (7 - uid_len), ".log", uid_len); AddLogCurrentDT(logHexFileName); } - if (wantDecrypt) mfTraceInit(uid, atqa, sak, wantSaveToEmlFile); + if (wantDecrypt) + mfTraceInit(uid, atqa, sak, wantSaveToEmlFile); } else { PrintAndLog("%s(%d):%s", isTag ? "TAG":"RDR", num, sprint_hex(bufPtr, len)); - if (wantLogToFile) AddLogHex(logHexFileName, isTag ? "TAG: ":"RDR: ", bufPtr, len); - if (wantDecrypt) mfTraceDecode(bufPtr, len, parity, wantSaveToEmlFile); + if (wantLogToFile) + AddLogHex(logHexFileName, isTag ? "TAG: ":"RDR: ", bufPtr, len); + if (wantDecrypt) + mfTraceDecode(bufPtr, len, parity, wantSaveToEmlFile); } bufPtr += len; num++; } } - } // resp not NILL + } // resp not NULL } // while (true) return 0; } +// Tries to identify cardsize. +// Returns where num is: +// -1 unidentified +// 0 - MINI (320bytes) +// 1 - 1K +// 2 - 2K +// 4 - 4K +int GetCardSize() +{ + UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT, 0, 0}}; + SendCommand(&c); + + UsbCommand resp; + WaitForResponse(CMD_ACK,&resp); + + if(resp.arg[0] == 0) { + PrintAndLog("iso14443a card select failed"); + return -1; + } + + iso14a_card_select_t *card = (iso14a_card_select_t *)resp.d.asBytes; + + PrintAndLog("Trying to detect card size."); + + uint16_t atqa = 0; + uint8_t sak = 0; + atqa = (card->atqa[1] & 0xff) << 8; + atqa += card->atqa[0] & 0xff; + sak = card->sak; + + // https://code.google.com/p/libnfc/source/browse/libnfc/target-subr.c + + PrintAndLog("found ATAQ: %04X SAK: %02X", atqa, sak); + + + // NXP MIFARE Mini 0.3k + if ( (atqa && 0xff0f == 0x0004) && (sak == 0x09) ) return 0; + + // MIFARE Classic 1K + if ( (atqa && 0xff0f == 0x0004) && (sak == 0x08) ) return 1; + + // MIFARE Classik 4K + if ( (atqa && 0xff0f == 0x0002) && (sak == 0x18) ) return 4; + + // SmartMX with MIFARE 1K emulation + if ( (atqa && 0xf0ff == 0x0004) ) return 1; + + // SmartMX with MIFARE 4K emulation + if ( (atqa && 0xf0ff == 0x0002) ) return 4; + + // Infineon MIFARE CLASSIC 1K + if ( (atqa && 0xffff == 0x0004) && (sak == 0x88) ) return 1; + + // MFC 4K emulated by Nokia 6212 Classic + if ( (atqa && 0xffff == 0x0002) && (sak == 0x38) ) return 4; + + // MFC 4K emulated by Nokia 6131 NFC + if ( (atqa && 0xffff == 0x0008) && (sak == 0x38) ) return 4; + + // MIFARE Plus (4 Byte UID or 4 Byte RID) + // MIFARE Plus (7 Byte UID) + if ( + (atqa && 0xffff == 0x0002) || + (atqa && 0xffff == 0x0004) || + (atqa && 0xffff == 0x0042) || + (atqa && 0xffff == 0x0044) + ) + { + switch(sak){ + case 0x08: + case 0x10: + //case 0x20: + return 2; + break; + case 0x11: + case 0x18: + //case 0x20: + return 4; + break; + } + } + + return -1; +} + + + + static command_t CommandTable[] = { {"help", CmdHelp, 1, "This help"}, {"dbg", CmdHF14AMfDbg, 0, "Set default debug mode"}, {"rdbl", CmdHF14AMfRdBl, 0, "Read MIFARE classic block"}, - {"urdbl", CmdHF14AMfURdBl, 0, "Read MIFARE Ultralight block"}, - {"urdcard", CmdHF14AMfURdCard, 0,"Read MIFARE Ultralight Card"}, - {"uwrbl", CmdHF14AMfUWrBl, 0,"Write MIFARE Ultralight block"}, + //{"urdbl", CmdHF14AMfURdBl, 0, "Read MIFARE Ultralight block"}, + //{"urdcard", CmdHF14AMfURdCard, 0,"Read MIFARE Ultralight Card"}, + //{"uwrbl", CmdHF14AMfUWrBl, 0,"Write MIFARE Ultralight block"}, {"rdsc", CmdHF14AMfRdSc, 0, "Read MIFARE classic sector"}, {"dump", CmdHF14AMfDump, 0, "Dump MIFARE classic tag to binary file"}, {"restore", CmdHF14AMfRestore, 0, "Restore MIFARE classic binary file to BLANK tag"},