X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/d08faa4e026f0eb4a9ecaf8bdda2091b4ab99565..9332b857ffeee343334064d3ca53048f59c55e50:/client/cmdhfmf.c

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 0a24f6da..b2d5494f 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -799,14 +799,16 @@ int CmdHF14AMfNestedHard(const char *Cmd)
 	uint8_t trgBlockNo = 0;
 	uint8_t trgKeyType = 0;
 	uint8_t key[6] = {0, 0, 0, 0, 0, 0};
+	uint8_t trgkey[6] = {0, 0, 0, 0, 0, 0};
 	
 	char ctmp;
 	ctmp = param_getchar(Cmd, 0);
+
 	if (ctmp != 'R' && ctmp != 'r' && strlen(Cmd) < 20) {
 		PrintAndLog("Usage:");
 		PrintAndLog("      hf mf hardnested <block number> <key A|B> <key (12 hex symbols)>");
-		PrintAndLog("                       <target block number> <target key A|B> [w] [s]");
-		PrintAndLog("  or  hf mf hardnested r");
+		PrintAndLog("                       <target block number> <target key A|B> [known target key (12 hex symbols)] [w] [s]");
+		PrintAndLog("  or  hf mf hardnested r [known target key]");
 		PrintAndLog(" ");
 		PrintAndLog("Options: ");
 		PrintAndLog("      w: Acquire nonces and write them to binary file nonces.bin");
@@ -817,17 +819,22 @@ int CmdHF14AMfNestedHard(const char *Cmd)
 		PrintAndLog("      sample2: hf mf hardnested 0 A FFFFFFFFFFFF 4 A w");
 		PrintAndLog("      sample3: hf mf hardnested 0 A FFFFFFFFFFFF 4 A w s");
 		PrintAndLog("      sample4: hf mf hardnested r");
-
+		PrintAndLog(" ");
+		PrintAndLog("Add the known target key to check if it is present in the remaining key space:");
+		PrintAndLog("      sample5: hf mf hardnested 0 A A0A1A2A3A4A5 4 A FFFFFFFFFFFF");
 		return 0;
 	}	
 	
+	bool know_target_key = false;
 	bool nonce_file_read = false;
 	bool nonce_file_write = false;
 	bool slow = false;
 	
 	if (ctmp == 'R' || ctmp == 'r') {
-
 		nonce_file_read = true;
+		if (!param_gethex(Cmd, 1, trgkey, 12)) {
+			know_target_key = true;
+		}
 
 	} else {
 
@@ -857,6 +864,12 @@ int CmdHF14AMfNestedHard(const char *Cmd)
 		}
 
 		uint16_t i = 5;
+
+		if (!param_gethex(Cmd, 5, trgkey, 12)) {
+			know_target_key = true;
+			i++;
+		}
+
 		while ((ctmp = param_getchar(Cmd, i))) {
 			if (ctmp == 's' || ctmp == 'S') {
 				slow = true;
@@ -870,12 +883,16 @@ int CmdHF14AMfNestedHard(const char *Cmd)
 		}
 	}
 
-	PrintAndLog("--target block no:%3d, target key type:%c, file action: %s, Slow: %s ", 
+	PrintAndLog("--target block no:%3d, target key type:%c, known target key: 0x%02x%02x%02x%02x%02x%02x%s, file action: %s, Slow: %s ", 
 			trgBlockNo, 
 			trgKeyType?'B':'A', 
+			trgkey[0], trgkey[1], trgkey[2], trgkey[3], trgkey[4], trgkey[5],
+			know_target_key?"":" (not set)",
 			nonce_file_write?"write":nonce_file_read?"read":"none",
 			slow?"Yes":"No");
-	int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, nonce_file_read, nonce_file_write, slow);
+
+	int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key?trgkey:NULL, nonce_file_read, nonce_file_write, slow);
+
 	if (isOK) {
 		switch (isOK) {
 			case 1 : PrintAndLog("Error: No response from Proxmark.\n"); break;
@@ -1178,15 +1195,21 @@ int CmdHF14AMf1kSim(const char *Cmd)
 
 	if(flags & FLAG_INTERACTIVE)
 	{		
-		PrintAndLog("Press pm3-button to abort simulation");
-		
 		uint8_t data[40];
 		uint8_t key[6];
 
 		UsbCommand resp;		
+		PrintAndLog("Press pm3-button or send another cmd to abort simulation");
+		//while(! WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
+			//We're waiting only 1.5 s at a time, otherwise we get the
+			// annoying message about "Waiting for a response... "
+		//}
 		while(!ukbhit() ){
-			if ( WaitForResponseTimeout(CMD_ACK,&resp,1500) ) {
-				if ( (resp.arg[0] & 0xffff) == CMD_SIMULATE_MIFARE_CARD ){
+			if (!WaitForResponseTimeout(CMD_ACK,&resp,1500) ) continue;
+
+			if ( !(flags & FLAG_NR_AR_ATTACK) ) break;
+			if ( (resp.arg[0] & 0xffff) != CMD_SIMULATE_MIFARE_CARD ) break;
+
 					memset(data, 0x00, sizeof(data));
 					memset(key, 0x00, sizeof(key));
 					int len = (resp.arg[1] > sizeof(data)) ? sizeof(data) : resp.arg[1];
@@ -1196,8 +1219,8 @@ int CmdHF14AMf1kSim(const char *Cmd)
 					uint64_t corr_uid = 0;
 					if ( memcmp(data, "\x00\x00\x00\x00", 4) == 0 ) {
 						corr_uid = (data[3] << 24) | (data[2] << 16) | (data[1] << 8) | data[0];
-					}
-					else {
+				tryMfk32(corr_uid, data, key);
+			} else {
 						corr_uid |= (uint64_t)data[2] << 48; 
 						corr_uid |= (uint64_t)data[1] << 40; 
 						corr_uid |= (uint64_t)data[0] << 32;
@@ -1205,14 +1228,12 @@ int CmdHF14AMf1kSim(const char *Cmd)
 						corr_uid |= data[6] << 16;
 						corr_uid |= data[5] << 8;
 						corr_uid |= data[4];
+				tryMfk64(corr_uid, data, key);
 					}
-					tryMfk32(corr_uid, data, key);
-					//tryMfk64(corr_uid, data, key);
 					PrintAndLog("--");
 				}
 			}
-		}
-	}
+	
 	return 0;
 }
 
@@ -1317,7 +1338,7 @@ int CmdHF14AMfELoad(const char *Cmd)
 		
 	if ( ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) {
 		PrintAndLog("It loads emul dump from the file `filename.eml`");
-		PrintAndLog("Usage:  hf mf eload [card memory] <file name w/o `.eml`>");
+		PrintAndLog("Usage:  hf mf eload [card memory] <file name w/o `.eml`> [numblocks]");
 		PrintAndLog("  [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K, u = UL");
 		PrintAndLog("");
 		PrintAndLog(" sample: hf mf eload filename");
@@ -1331,13 +1352,15 @@ int CmdHF14AMfELoad(const char *Cmd)
 		case '\0': numBlocks = 16*4; break;
 		case '2' : numBlocks = 32*4; break;
 		case '4' : numBlocks = 256; break;
-		case 'U' : // fall through  ,  NTAG 215 has 135blocks a 540 bytes.
-		case 'u' : numBlocks = 135; blockWidth = 8; break;
+		case 'U' : // fall through
+		case 'u' : numBlocks = 255; blockWidth = 8; break;
 		default:  {
 			numBlocks = 16*4;
 			nameParamNo = 0;
 		}
 	}
+	uint32_t numblk2 = param_get32ex(Cmd,2,0,10);
+	if (numblk2 > 0) numBlocks = numblk2;	
 
 	len = param_getstr(Cmd,nameParamNo,filename);
 	
@@ -1799,7 +1822,7 @@ int CmdHF14AMfCGetBlk(const char *Cmd) {
 		return 1;
 	}
 	
-	PrintAndLog("data:%s", sprint_hex(data, sizeof(data)));
+	PrintAndLog("data: %s", sprint_hex(data, sizeof(data)));
 	return 0;
 }