X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/be6e909c5bda0ae2d1ff2ea057127e099356c232..1c07ca92c3b9338697a0f2fc0e41790164815aeb:/client/cmdhfmf.c?ds=inline

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 0e3024a0..0ea171af 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -9,18 +9,18 @@
 //-----------------------------------------------------------------------------
 
 #include "cmdhfmf.h"
-#include "cmdhfmfhard.h"
-#include "nonce2key/nonce2key.h"
 
 static int CmdHelp(const char *Cmd);
 int usage_hf14_mifare(void){
-	PrintAndLog("Usage:  hf mf mifare [h] <block number>");
+	PrintAndLog("Usage:  hf mf mifare [h] <block number> <A|B>");
 	PrintAndLog("options:");
-	PrintAndLog("           h    this help");
-	PrintAndLog("           <block number>  (Optional) target other key A than block 0.");
+	PrintAndLog("      h               this help");
+	PrintAndLog("      <block number>  (Optional) target other block");
+	PrintAndLog("      <A|B>           (optional) target key type");
 	PrintAndLog("samples:");
 	PrintAndLog("           hf mf mifare");
 	PrintAndLog("           hf mf mifare 16");
+	PrintAndLog("           hf mf mifare 16 B");
 	return 0;
 }
 int usage_hf14_mf1ksim(void){
@@ -31,6 +31,8 @@ int usage_hf14_mf1ksim(void){
 	PrintAndLog("      n    (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");
 	PrintAndLog("      i    (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");
 	PrintAndLog("      x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");
+	PrintAndLog("      e    (Optional) Fill simulator keys from what we crack");
+	PrintAndLog("      v    (Optional) Show maths used for cracking reader. Useful for debugging.");
 	PrintAndLog("samples:");
 	PrintAndLog("           hf mf sim u 0a0a0a0a");
 	PrintAndLog("           hf mf sim u 11223344556677");
@@ -94,12 +96,14 @@ int usage_hf14_hardnested(void){
 	PrintAndLog("      w    acquire nonces and write them to binary file nonces.bin");
 	PrintAndLog("      s    slower acquisition (required by some non standard cards)");
 	PrintAndLog("      r    read nonces.bin and start attack");
+	PrintAndLog("      t    tests?");
 	PrintAndLog(" ");
 	PrintAndLog("samples:");
 	PrintAndLog("      hf mf hardnested 0 A FFFFFFFFFFFF 4 A");
 	PrintAndLog("      hf mf hardnested 0 A FFFFFFFFFFFF 4 A w");
 	PrintAndLog("      hf mf hardnested 0 A FFFFFFFFFFFF 4 A w s");
 	PrintAndLog("      hf mf hardnested r");
+	PrintAndLog("      hf mf hardnested r a0a1a2a3a4a5");
 	PrintAndLog(" ");
 	PrintAndLog("Add the known target key to check if it is present in the remaining key space:");
 	PrintAndLog("      sample5: hf mf hardnested 0 A A0A1A2A3A4A5 4 A FFFFFFFFFFFF");
@@ -109,15 +113,33 @@ int usage_hf14_chk(void){
 	PrintAndLog("Usage:  hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d] [<key (12 hex symbols)>] [<dic (*.dic)>]");
 	PrintAndLog("options:");
 	PrintAndLog("      h    this help");	
-	PrintAndLog("      *    all sectors");
-	PrintAndLog("      card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");
+	PrintAndLog("      *    all sectors based on card memory, other values then below defaults to 1k");
+	PrintAndLog("      			0 - MINI(320 bytes)");
+	PrintAndLog("      			1 - 1K");
+	PrintAndLog("      			2 - 2K");
+	PrintAndLog("      			4 - 4K");
 	PrintAndLog("      d    write keys to binary file");
 	PrintAndLog("      t    write keys to emulator memory\n");
 	PrintAndLog(" ");
 	PrintAndLog("samples:");
-	PrintAndLog("      hf mf chk 0 A 1234567890ab keys.dic");
-	PrintAndLog("      hf mf chk *1 ? t");
-	PrintAndLog("      hf mf chk *1 ? d");
+	PrintAndLog("      hf mf chk 0 A 1234567890ab keys.dic     -- target block 0, Key A");
+	PrintAndLog("      hf mf chk *1 ? t                        -- target all blocks, all keys, 1K, write to emul");
+	PrintAndLog("      hf mf chk *1 ? d                        -- target all blocks, all keys, 1K, write to file");
+	return 0;
+}
+int usage_hf14_keybrute(void){
+	PrintAndLog("J_Run's 2nd phase of multiple sector nested authentication key recovery");
+	PrintAndLog("You have a known 4 last bytes of a key recovered with mf_nonce_brute tool.");
+	PrintAndLog("First 2 bytes of key will be bruteforced");
+	PrintAndLog("");
+	PrintAndLog("Usage:  hf mf keybrute [h] <block number> <A|B> <key>");
+	PrintAndLog("options:");
+	PrintAndLog("      h               this help");
+	PrintAndLog("      <block number>  target block number");
+	PrintAndLog("      <A|B>           target key type");
+	PrintAndLog("      <key>           candidate key from mf_nonce_brute tool");
+	PrintAndLog("samples:");
+	PrintAndLog("           hf mf keybrute 1 A 000011223344");
 	return 0;
 }
 
@@ -127,13 +149,18 @@ int CmdHF14AMifare(const char *Cmd) {
 	uint64_t par_list = 0, ks_list = 0, r_key = 0;
 	int16_t isOK = 0;
 	int tmpchar; 
-	uint8_t blockNo = 0;
+	uint8_t blockNo = 0, keytype = MIFARE_AUTH_KEYA;
 	
 	char cmdp = param_getchar(Cmd, 0);	
 	if ( cmdp == 'H' || cmdp == 'h') return usage_hf14_mifare();
 	
-	blockNo = param_get8(Cmd, 0);
-	UsbCommand c = {CMD_READER_MIFARE, {true, blockNo, 0}};
+	blockNo = param_get8(Cmd, 0);	 
+	
+	cmdp = param_getchar(Cmd, 1);
+	if (cmdp == 'B' || cmdp == 'b')
+		keytype = MIFARE_AUTH_KEYB;
+	
+	UsbCommand c = {CMD_READER_MIFARE, {true, blockNo, keytype}};
 
 	// message
 	printf("-------------------------------------------------------------------------\n");
@@ -187,18 +214,22 @@ start:
 		}
 	}	
 	printf("\n");
+	// error
+	if (isOK != 1) return 1;
 	
-	// par == 0
-	if (isOK == -1 && par_list == 0) {
-		if (!nonce2key_ex(uid, nt, nr, ks_list, &r_key) ){
+	if (par_list == 0 && ks_list != 0) {
+		// this special attack when parities is zero, uses checkkeys. Which now with block/keytype option also needs. 
+		// but it uses 0|1 instead of 0x60|0x61...
+		if (nonce2key_ex(blockNo, keytype - 0x60 , uid, nt, nr, ks_list, &r_key) ){
+			PrintAndLog("Trying again with a different reader nonce...");
+			c.arg[0] = false;
+			goto start;
+		} else {
 			PrintAndLog("Found valid key: %012"llx" \n", r_key);
 			goto END;
 		}
 	}
-	
-	// error
-	if (isOK != 1) return 1;
-	
+
 	// execute original function from util nonce2key
 	if (nonce2key(uid, nt, nr, par_list, ks_list, &r_key)) {
 		isOK = 2;
@@ -207,6 +238,16 @@ start:
 		c.arg[0] = false;
 		goto start;
 	} else {
+		
+		// nonce2key found a candidate key.  Lets verify it.
+		uint8_t keyblock[] = {0,0,0,0,0,0};
+		num_to_bytes(r_key, 6, keyblock);
+		uint64_t key64 = 0;
+		int res = mfCheckKeys(blockNo, keytype - 0x60 , false, 1, keyblock, &key64);
+		if ( res > 0 ) {
+			PrintAndLog("Candidate Key found (%012"llx") - Test authentication failed. [%d] Restarting darkside attack", r_key, res);	
+			goto start;
+		}
 		PrintAndLog("Found valid key: %012"llx" \n", r_key);
 	}
 END:
@@ -433,6 +474,7 @@ int CmdHF14AMfDump(const char *Cmd) {
 		if ( bytes_read == 0) {
 			PrintAndLog("File reading error.");
 			fclose(fin);
+			fin = NULL;
 			return 2;
 		}
 	}
@@ -443,12 +485,14 @@ int CmdHF14AMfDump(const char *Cmd) {
 		if ( bytes_read == 0) {
 			PrintAndLog("File reading error.");
 			fclose(fin);
+			fin = NULL;
 			return 2;
 		}
 	}
 	
 	fclose(fin);
-
+	fin = NULL;
+			
 	PrintAndLog("|-----------------------------------------|");
 	PrintAndLog("|------ Reading sector access bits...-----|");
 	PrintAndLog("|-----------------------------------------|");
@@ -554,6 +598,7 @@ int CmdHF14AMfDump(const char *Cmd) {
 		uint16_t numblocks = FirstBlockOfSector(numSectors - 1) + NumBlocksPerSector(numSectors - 1);
 		fwrite(carddata, 1, 16*numblocks, fout);
 		fclose(fout);
+		fout = NULL;		
 		PrintAndLog("Dumped %d blocks (%d bytes) to file dumpdata.bin", numblocks, 16*numblocks);
 	}
 		
@@ -602,6 +647,7 @@ int CmdHF14AMfRestore(const char *Cmd) {
 		if ( bytes_read == 0) {
 			PrintAndLog("File reading error (dumpkeys.bin).");
 			fclose(fkeys);
+			fkeys = NULL;
 			return 2;
 		}
 	}
@@ -611,6 +657,7 @@ int CmdHF14AMfRestore(const char *Cmd) {
 		if ( bytes_read == 0) {
 			PrintAndLog("File reading error (dumpkeys.bin).");
 			fclose(fkeys);
+			fkeys = NULL;
 			return 2;
 		}
 	}
@@ -631,6 +678,7 @@ int CmdHF14AMfRestore(const char *Cmd) {
 			if ( bytes_read == 0) {
 				PrintAndLog("File reading error (dumpdata.bin).");
 				fclose(fdump);
+				fdump = NULL;				
 				return 2;
 			}
 					
@@ -666,6 +714,7 @@ int CmdHF14AMfRestore(const char *Cmd) {
 	}
 	
 	fclose(fdump);
+	fdump = NULL;	
 	return 0;
 }
 
@@ -937,7 +986,7 @@ int CmdHF14AMfNestedHard(const char *Cmd) {
 	
 	char ctmp;
 	ctmp = param_getchar(Cmd, 0);
-	if (ctmp != 'H' && ctmp != 'h' ) return usage_hf14_hardnested();
+	if (ctmp == 'H' || ctmp == 'h' ) return usage_hf14_hardnested();
 	if (ctmp != 'R' && ctmp != 'r' && ctmp != 'T' && ctmp != 't' && strlen(Cmd) < 20) return usage_hf14_hardnested();
 	
 	bool know_target_key = false;
@@ -1003,12 +1052,13 @@ int CmdHF14AMfNestedHard(const char *Cmd) {
 			trgBlockNo, 
 			trgKeyType?'B':'A', 
 			trgkey[0], trgkey[1], trgkey[2], trgkey[3], trgkey[4], trgkey[5],
-			know_target_key?"":" (not set)",
-			nonce_file_write?"write":nonce_file_read?"read":"none",
-			slow?"Yes":"No",
+			know_target_key ? "" : " (not set)",
+			nonce_file_write ? "write": nonce_file_read ? "read" : "none",
+			slow ? "Yes" : "No",
 			tests);
 
-	int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key?trgkey:NULL, nonce_file_read, nonce_file_write, slow, tests);
+	uint64_t foundkey = 0;
+	int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key ? trgkey : NULL, nonce_file_read, nonce_file_write, slow, tests, &foundkey);
 
 	if (isOK) {
 		switch (isOK) {
@@ -1212,7 +1262,8 @@ int CmdHF14AMfChk(const char *Cmd) {
 			if (e_sector[i].foundKey[trgKeyType]) continue;
 						
 			for (uint32_t c = 0; c < keycnt; c += max_keys) {
-				
+				printf(".");
+				fflush(stdout);			
 				uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c;
 				
 				res = mfCheckKeys(b, trgKeyType, true, size, &keyBlock[6*c], &key64);
@@ -1221,8 +1272,6 @@ int CmdHF14AMfChk(const char *Cmd) {
 					e_sector[i].foundKey[trgKeyType] = TRUE;
 					break;
 				}
-				printf(".");
-				fflush(stdout);
 			}
 			b < 127 ? ( b +=4 ) : ( b += 16 );	
 		}
@@ -1311,45 +1360,152 @@ int CmdHF14AMfChk(const char *Cmd) {
 	PrintAndLog("");
 	return 0;
 }
+#define ATTACK_KEY_COUNT 8
+sector *k_sector = NULL;
+uint8_t k_sectorsCount = 16;
+void readerAttack(nonces_t data[], bool setEmulatorMem, bool verbose) {
+
+	// initialize storage for found keys
+	if (k_sector == NULL)
+		k_sector = calloc(k_sectorsCount, sizeof(sector));
+	if (k_sector == NULL) 
+		return;
+
+	uint64_t key = 0;
+		
+	// empty e_sector
+	for(int i = 0; i < k_sectorsCount; ++i){
+		k_sector[i].Key[0] = 0xffffffffffff;
+		k_sector[i].Key[1] = 0xffffffffffff;
+		k_sector[i].foundKey[0] = FALSE;
+		k_sector[i].foundKey[1] = FALSE;
+	}
+
+	printf("enter reader attack\n");
+	for (uint8_t i = 0; i < ATTACK_KEY_COUNT; ++i) {
+		if (data[i].ar2 > 0) {
+
+			// We can probably skip this, mfkey32v2 is more reliable.
+#ifdef HFMF_TRYMFK32
+			if (tryMfk32(data[i], &key, verbose)) {
+				PrintAndLog("Found Key%s for sector %02d: [%012"llx"]"
+					, (data[i].keytype) ? "B" : "A"
+					, data[i].sector
+					, key
+				);
+
+				k_sector[i].Key[data[i].keytype] = key;
+				k_sector[i].foundKey[data[i].keytype] = TRUE;
+				
+				//set emulator memory for keys
+				if (setEmulatorMem) {
+					uint8_t	memBlock[16] = {0,0,0,0,0,0, 0xff, 0x0F, 0x80, 0x69, 0,0,0,0,0,0};
+					num_to_bytes( k_sector[i].Key[0], 6, memBlock);
+					num_to_bytes( k_sector[i].Key[1], 6, memBlock+10);
+					PrintAndLog("Setting Emulator Memory Block %02d: [%s]"
+						, ((data[i].sector)*4) + 3
+						, sprint_hex( memBlock, sizeof(memBlock))
+						);
+					mfEmlSetMem( memBlock, ((data[i].sector)*4) + 3, 1);
+				}
+				continue;
+			}
+#endif
+			//moebius attack			
+			if (tryMfk32_moebius(data[i+ATTACK_KEY_COUNT], &key, verbose)) {
+				uint8_t sectorNum = data[i+ATTACK_KEY_COUNT].sector;
+				uint8_t keyType = data[i+ATTACK_KEY_COUNT].keytype;
+
+				PrintAndLog("M-Found Key%s for sector %02d: [%012"llx"]"
+					, keyType ? "B" : "A"
+					, sectorNum
+					, key
+				);
+
+				k_sector[sectorNum].Key[keyType] = key;
+				k_sector[sectorNum].foundKey[keyType] = TRUE;
+
+				//set emulator memory for keys
+				if (setEmulatorMem) {
+					uint8_t	memBlock[16] = {0,0,0,0,0,0, 0xff, 0x0F, 0x80, 0x69, 0,0,0,0,0,0};
+					num_to_bytes( k_sector[sectorNum].Key[0], 6, memBlock);
+					num_to_bytes( k_sector[sectorNum].Key[1], 6, memBlock+10);
+					PrintAndLog("Setting Emulator Memory Block %02d: [%s]"
+						, (sectorNum*4) + 3
+						, sprint_hex( memBlock, sizeof(memBlock))
+						);
+					mfEmlSetMem( memBlock, (sectorNum*4) + 3, 1);
+				}
+				continue;
+			}
+
+		}
+	}
+}
 
 int CmdHF14AMf1kSim(const char *Cmd) {
+
 	uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
 	uint8_t exitAfterNReads = 0;
 	uint8_t flags = (FLAG_UID_IN_EMUL | FLAG_4B_UID_IN_DATA);
 	int uidlen = 0;
-	uint8_t pnr = 0;
-	uint8_t cmdp = param_getchar(Cmd, 0);
-
-	if (cmdp == 'h' || cmdp == 'H') return usage_hf14_mf1ksim();
-
-	cmdp = param_getchar(Cmd, pnr);
-	if (cmdp == 'u' || cmdp == 'U') {
-		param_gethex_ex(Cmd, pnr+1, uid, &uidlen);
-		switch(uidlen){
-			case 20: flags = FLAG_10B_UID_IN_DATA;	break;
-			case 14: flags = FLAG_7B_UID_IN_DATA; break;
-			case  8: flags = FLAG_4B_UID_IN_DATA; break;
-			default: return usage_hf14_mf1ksim();
+	bool setEmulatorMem = false;
+	uint8_t cmdp = 0;
+	bool errors = false;
+
+	// If set to true, we should show our workings when doing NR_AR_ATTACK.
+	bool verbose = false;
+
+	while(param_getchar(Cmd, cmdp) != 0x00) {
+		switch(param_getchar(Cmd, cmdp)) {
+		case 'e':
+		case 'E':
+			setEmulatorMem = true;
+			cmdp++;
+			break;
+		case 'h':
+		case 'H':
+			return usage_hf14_mf1ksim();
+		case 'i':
+		case 'I':
+			flags |= FLAG_INTERACTIVE;
+			cmdp++;
+			break;
+		case 'n':
+		case 'N':
+			exitAfterNReads = param_get8(Cmd, cmdp+1);
+			cmdp += 2;
+			break;
+		case 'u':
+		case 'U':
+			param_gethex_ex(Cmd, cmdp+1, uid, &uidlen);
+			switch(uidlen) {
+				case 20: flags = FLAG_10B_UID_IN_DATA; break;
+				case 14: flags = FLAG_7B_UID_IN_DATA; break;
+				case  8: flags = FLAG_4B_UID_IN_DATA; break;
+				default: return usage_hf14_mf1ksim();
+			}
+			cmdp +=2;
+			break;
+		case 'v':
+		case 'V':
+			verbose = true;
+			cmdp++;
+			break;
+		case 'x':
+		case 'X':
+			flags |= FLAG_NR_AR_ATTACK;
+			cmdp++;
+			break;
+		default:
+			PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
+			errors = true;
+			break;
 		}
-		pnr +=2;
-	}
-
-	cmdp = param_getchar(Cmd, pnr);	
-	if (cmdp == 'n' || cmdp == 'N') {
-		exitAfterNReads = param_get8(Cmd, pnr+1);
-		pnr += 2;
-	}
-
-	cmdp = param_getchar(Cmd, pnr);		
-	if (cmdp == 'i' || cmdp == 'I' ) {
-		flags |= FLAG_INTERACTIVE;
-		pnr++;
-	}
-
-	cmdp = param_getchar(Cmd, pnr);	
-	if (cmdp == 'x' || cmdp == 'X') {
-		flags |= FLAG_NR_AR_ATTACK;
+		if(errors) break;
 	}
+	//Validations
+	if(errors) return usage_hf14_mf1ksim();
 	
 	PrintAndLog(" uid:%s, numreads:%d, flags:%d (0x%02x) "
 				, (uidlen == 0 ) ? "N/A" : sprint_hex(uid, uidlen>>1)
@@ -1363,24 +1519,25 @@ int CmdHF14AMf1kSim(const char *Cmd) {
 	SendCommand(&c);
 
 	if(flags & FLAG_INTERACTIVE) {		
-		uint8_t data[32];
-		uint64_t key;
-		UsbCommand resp;		
 		PrintAndLog("Press pm3-button or send another cmd to abort simulation");
+
+		nonces_t data[ATTACK_KEY_COUNT*2];
+		UsbCommand resp;		
+
 		while( !ukbhit() ){
 			if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500) ) continue;
 
 			if ( !(flags & FLAG_NR_AR_ATTACK) ) break;
 			if ( (resp.arg[0] & 0xffff) != CMD_SIMULATE_MIFARE_CARD ) break;
 
-			memset(data, 0x00, sizeof(data));	
-			int len = (resp.arg[1] > sizeof(data)) ? sizeof(data) : resp.arg[1];
-
-			memcpy(data, resp.d.asBytes, len);			
-			key = 0;
-			bool found = tryMfk32(data, &key);
-			found ^= tryMfk32_moebius(data, &key);
-			if ( found ) break;
+			memcpy( data, resp.d.asBytes, sizeof(data) );			
+			readerAttack(data, setEmulatorMem, verbose);
+		}
+		
+		if (k_sector != NULL) {
+			printKeyTable(k_sectorsCount, k_sector );
+			free(k_sector);
+			k_sector = NULL;
 		}
 	}
 	return 0;
@@ -1544,7 +1701,7 @@ int CmdHF14AMfSniff(const char *Cmd){
 int CmdHF14AMfDbg(const char *Cmd) {
 
 	char ctmp = param_getchar(Cmd, 0);
-	if (strlen(Cmd) < 1  || ctmp == 'h'|| ctmp == 'H') return usage_hf14_dbg();
+	if (strlen(Cmd) < 1 || ctmp == 'h' || ctmp == 'H') return usage_hf14_dbg();
 	
 	uint8_t dbgMode = param_get8ex(Cmd, 0, 0, 10);
 	if (dbgMode > 4) return usage_hf14_dbg();
@@ -1554,6 +1711,43 @@ int CmdHF14AMfDbg(const char *Cmd) {
 	return 0;
 }
 
+int CmdHF14AMfKeyBrute(const char *Cmd) {
+
+	uint8_t blockNo = 0, keytype = 0;
+	uint8_t key[6] = {0, 0, 0, 0, 0, 0};
+	uint64_t foundkey = 0;
+	
+	char cmdp = param_getchar(Cmd, 0);	
+	if ( cmdp == 'H' || cmdp == 'h') return usage_hf14_keybrute();
+	
+	// block number
+	blockNo = param_get8(Cmd, 0);	 
+	
+	// keytype
+	cmdp = param_getchar(Cmd, 1);
+	if (cmdp == 'B' || cmdp == 'b') keytype = 1;
+	
+	// key
+	if (param_gethex(Cmd, 2, key, 12)) return usage_hf14_keybrute();
+	
+	clock_t t1 = clock();
+	time_t start, end;
+	time(&start);
+	
+	if (mfKeyBrute( blockNo, keytype, key, &foundkey))
+		PrintAndLog("Found valid key: %012"llx" \n", foundkey);
+	else
+		PrintAndLog("Key not found");
+	
+	t1 = clock() - t1;
+	time(&end);
+	unsigned long elapsed_time = difftime(end, start);	
+	if ( t1 > 0 )
+		PrintAndLog("\nTime in keybrute: %.0f ticks %u seconds\n", (float)t1, elapsed_time);
+	
+	return 0;	
+}
+
 void printKeyTable( uint8_t sectorscnt, sector *e_sector ){
 	PrintAndLog("|---|----------------|---|----------------|---|");
 	PrintAndLog("|sec|key A           |res|key B           |res|");
@@ -1568,7 +1762,6 @@ void printKeyTable( uint8_t sectorscnt, sector *e_sector ){
 }
 
 // EMULATOR COMMANDS
-
 int CmdHF14AMfEGet(const char *Cmd)
 {
 	uint8_t blockNo = 0;
@@ -1582,7 +1775,7 @@ int CmdHF14AMfEGet(const char *Cmd)
 	
 	blockNo = param_get8(Cmd, 0);
 
-	PrintAndLog(" ");
+	PrintAndLog("");
 	if (!mfEmlGetMem(data, blockNo, 1)) {
 		PrintAndLog("data[%3d]:%s", blockNo, sprint_hex(data, 16));
 	} else {
@@ -2295,10 +2488,11 @@ static command_t CommandTable[] = {
 	{"dump",		CmdHF14AMfDump,			0, "Dump MIFARE classic tag to binary file"},
 	{"restore",		CmdHF14AMfRestore,		0, "Restore MIFARE classic binary file to BLANK tag"},
 	{"wrbl",		CmdHF14AMfWrBl,			0, "Write MIFARE classic block"},
-	{"chk",			CmdHF14AMfChk,			0, "Test block keys"},
-	{"mifare",		CmdHF14AMifare,			0, "Read parity error messages."},
-	{"nested",		CmdHF14AMfNested,		0, "Test nested authentication"},
+	{"chk",			CmdHF14AMfChk,			0, "Check keys"},
+	{"mifare",		CmdHF14AMifare,			0, "Darkside attack. read parity error messages."},
+	{"nested",		CmdHF14AMfNested,		0, "Nested attack. Test nested authentication"},
 	{"hardnested", 	CmdHF14AMfNestedHard, 	0, "Nested attack for hardened Mifare cards"},
+	{"keybrute",	CmdHF14AMfKeyBrute,		0, "J_Run's 2nd phase of multiple sector nested authentication key recovery"},
 	{"sniff",		CmdHF14AMfSniff,		0, "Sniff card-reader communication"},
 	{"sim",			CmdHF14AMf1kSim,		0, "Simulate MIFARE card"},
 	{"eclr",		CmdHF14AMfEClear,		0, "Clear simulator memory block"},