Merge pull request #49 from micolous/less-verbose-mfsim

hf {14a,mf} sim: Be less verbose by default, add option "m" to turn maths back on (Issue #45)

diff --git a/client/cmdhf14a.c b/client/cmdhf14a.c
index b404d4490f8769347a6cc022853bd4b2867ab246..c5585386e4a9f333d9f5df9b01a6224d6985cdd6 100644 (file)
--- a/client/cmdhf14a.c
+++ b/client/cmdhf14a.c
@@ -143,6 +143,7 @@ int usage_hf_14a_sim(void) {
 //     PrintAndLog("    u     : 4, 7 or 10 byte UID");
        PrintAndLog("    u     : 4, 7 byte UID");
        PrintAndLog("    x     : (Optional) performs the 'reader attack', nr/ar attack against a legitimate reader");
+       PrintAndLog("    v     : (Optional) show maths used for cracking reader. Useful for debugging.");
        PrintAndLog("\n   sample : hf 14a sim t 1 u 11223344 x");
        PrintAndLog("          : hf 14a sim t 1 u 11223344");
        PrintAndLog("          : hf 14a sim t 1 u 11223344556677");
@@ -447,6 +448,7 @@ int CmdHF14ASim(const char *Cmd) {
        uint8_t uid[10] = {0,0,0,0,0,0,0,0,0,0};
        int uidlen = 0;
        bool useUIDfromEML = TRUE;
+       bool showMaths = false;
 
        while(param_getchar(Cmd, cmdp) != 0x00) {
                switch(param_getchar(Cmd, cmdp)) {
@@ -477,6 +479,11 @@ int CmdHF14ASim(const char *Cmd) {
                                }
                                cmdp += 2;
                                break;
+                       case 'v':
+                       case 'V':
+                               showMaths = true;
+                               cmdp++;
+                               break;
                        case 'x':
                        case 'X':
                                flags |= FLAG_NR_AR_ATTACK;
@@ -513,7 +520,7 @@ int CmdHF14ASim(const char *Cmd) {
                if ( (resp.arg[0] & 0xffff) != CMD_SIMULATE_MIFARE_CARD ) break;
                        
                memcpy( data, resp.d.asBytes, sizeof(data) );
-               readerAttack(data, TRUE);
+               readerAttack(data, TRUE, showMaths);
        }
        return 0;
 }

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 99a91ced7a8418e95665ffdc6eae7dc218cffae7..ea73bf959f4b926957a09d772cd5815da326c80b 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -32,6 +32,7 @@ int usage_hf14_mf1ksim(void){
        PrintAndLog("      i    (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");\r
        PrintAndLog("      x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");\r
        PrintAndLog("      e    (Optional) Fill simulator keys from what we crack");\r
+       PrintAndLog("      v    (Optional) Show maths used for cracking reader. Useful for debugging.");\r
        PrintAndLog("samples:");\r
        PrintAndLog("           hf mf sim u 0a0a0a0a");\r
        PrintAndLog("           hf mf sim u 11223344556677");\r
@@ -1364,7 +1365,7 @@ int CmdHF14AMfChk(const char *Cmd) {
 #define ATTACK_KEY_COUNT 8\r
 sector *k_sector = NULL;\r
 uint8_t k_sectorsCount = 16;\r
-void readerAttack(nonces_t data[], bool setEmulatorMem) {\r
+void readerAttack(nonces_t data[], bool setEmulatorMem, bool showMaths) {\r
 \r
        // initialize storage for found keys\r
        if (k_sector == NULL)\r
@@ -1413,7 +1414,7 @@ void readerAttack(nonces_t data[], bool setEmulatorMem) {
                        }\r
 #endif\r
                        //moebius attack                        \r
-                       if (tryMfk32_moebius(data[i+ATTACK_KEY_COUNT], &key)) {\r
+                       if (tryMfk32_moebius(data[i+ATTACK_KEY_COUNT], &key, showMaths)) {\r
                                uint8_t sectorNum = data[i+ATTACK_KEY_COUNT].sector;\r
                                uint8_t keyType = data[i+ATTACK_KEY_COUNT].keytype;\r
 \r
@@ -1449,11 +1450,14 @@ int CmdHF14AMf1kSim(const char *Cmd) {
        uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};\r
        uint8_t exitAfterNReads = 0;\r
        uint8_t flags = (FLAG_UID_IN_EMUL | FLAG_4B_UID_IN_DATA);\r
-       int uidlen = 0; \r
+       int uidlen = 0;\r
        bool setEmulatorMem = false;\r
        uint8_t cmdp = 0;\r
        bool errors = false;\r
 \r
+       // If set to true, we should show our workings when doing NR_AR_ATTACK.\r
+       bool showMaths = false;\r
+\r
        while(param_getchar(Cmd, cmdp) != 0x00) {\r
                switch(param_getchar(Cmd, cmdp)) {\r
                case 'e':\r
@@ -1485,6 +1489,11 @@ int CmdHF14AMf1kSim(const char *Cmd) {
                        }\r
                        cmdp +=2;\r
                        break;\r
+               case 'v':\r
+               case 'V':\r
+                       showMaths = true;\r
+                       cmdp++;\r
+                       break;\r
                case 'x':\r
                case 'X':\r
                        flags |= FLAG_NR_AR_ATTACK;\r
@@ -1524,7 +1533,7 @@ int CmdHF14AMf1kSim(const char *Cmd) {
                        if ( (resp.arg[0] & 0xffff) != CMD_SIMULATE_MIFARE_CARD ) break;\r
 \r
                        memcpy( data, resp.d.asBytes, sizeof(data) );                   \r
-                       readerAttack(data, setEmulatorMem);\r
+                       readerAttack(data, setEmulatorMem, showMaths);\r
                }\r
                \r
                if (k_sector != NULL) {\r

diff --git a/client/cmdhfmf.h b/client/cmdhfmf.h
index 738b343251e390e9e5d408dff2a3703a9b288fd5..d381a852b864d4651cbf4b38cefd2b747467f9c9 100644 (file)
--- a/client/cmdhfmf.h
+++ b/client/cmdhfmf.h
@@ -28,19 +28,19 @@
 #include "nonce2key/nonce2key.h"\r
 \r
 int CmdHFMF(const char *Cmd);\r
-
-int CmdHF14AMfDbg(const char* cmd);
-int CmdHF14AMfRdBl(const char* cmd);
-int CmdHF14AMfURdBl(const char* cmd);
-int CmdHF14AMfRdSc(const char* cmd);
-int CmdHF14SMfURdCard(const char* cmd);
-int CmdHF14AMfDump(const char* cmd);
-int CmdHF14AMfRestore(const char* cmd);
-int CmdHF14AMfWrBl(const char* cmd);
-int CmdHF14AMfUWrBl(const char* cmd);
-int CmdHF14AMfChk(const char* cmd);
-int CmdHF14AMifare(const char* cmd);
-int CmdHF14AMfNested(const char* cmd);
+\r
+int CmdHF14AMfDbg(const char* cmd);\r
+int CmdHF14AMfRdBl(const char* cmd);\r
+int CmdHF14AMfURdBl(const char* cmd);\r
+int CmdHF14AMfRdSc(const char* cmd);\r
+int CmdHF14SMfURdCard(const char* cmd);\r
+int CmdHF14AMfDump(const char* cmd);\r
+int CmdHF14AMfRestore(const char* cmd);\r
+int CmdHF14AMfWrBl(const char* cmd);\r
+int CmdHF14AMfUWrBl(const char* cmd);\r
+int CmdHF14AMfChk(const char* cmd);\r
+int CmdHF14AMifare(const char* cmd);\r
+int CmdHF14AMfNested(const char* cmd);\r
 int CmdHF14AMfNestedHard(const char *Cmd);\r
 int CmdHF14AMfSniff(const char* cmd);\r
 int CmdHF14AMf1kSim(const char* cmd);\r
@@ -60,6 +60,6 @@ int CmdHF14AMfCLoad(const char* cmd);
 int CmdHF14AMfCSave(const char* cmd);\r
 int CmdHf14MfDecryptBytes(const char *Cmd);\r
 \r
-void readerAttack(nonces_t data[], bool setEmulatorMem);\r
+void readerAttack(nonces_t data[], bool setEmulatorMem, bool showMaths);\r
 void printKeyTable( uint8_t sectorscnt, sector *e_sector );\r
 #endif\r

diff --git a/client/nonce2key/nonce2key.c b/client/nonce2key/nonce2key.c
index 14b03bcbb67510232b5bbd6c928b153ae9c98b26..aeaecbe6759902fc97d8bdfa0185014784ae8d6c 100644 (file)
--- a/client/nonce2key/nonce2key.c
+++ b/client/nonce2key/nonce2key.c
@@ -208,7 +208,7 @@ bool tryMfk32(nonces_t data, uint64_t *outputkey) {
        return isSuccess;
 }
 
-bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey) {
+bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool showMaths) {
        struct Crypto1State *s, *t;
        uint64_t outkey  = 0;
        uint64_t key     = 0;                        // recovered key
@@ -223,24 +223,28 @@ bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey) {
        bool isSuccess = FALSE;
        int counter = 0;
        
-       printf("Recovering key for:\n");
-       printf("    uid: %08x\n",uid);
-       printf("   nt_0: %08x\n",nt0);
-       printf(" {nr_0}: %08x\n",nr0_enc);
-       printf(" {ar_0}: %08x\n",ar0_enc);
-       printf("   nt_1: %08x\n",nt1);
-       printf(" {nr_1}: %08x\n",nr1_enc);
-       printf(" {ar_1}: %08x\n",ar1_enc);
+       if (showMaths) {
+               printf("Recovering key for:\n");
+               printf("    uid: %08x\n", uid);
+               printf("   nt_0: %08x\n", nt0);
+               printf(" {nr_0}: %08x\n", nr0_enc);
+               printf(" {ar_0}: %08x\n", ar0_enc);
+               printf("   nt_1: %08x\n", nt1);
+               printf(" {nr_1}: %08x\n", nr1_enc);
+               printf(" {ar_1}: %08x\n", ar1_enc);
+       }
 
        //PrintAndLog("Enter mfkey32_moebius");
        clock_t t1 = clock();
 
-       printf("\nLFSR succesors of the tag challenge:\n");
        uint32_t p640 = prng_successor(nt0, 64);
        uint32_t p641 = prng_successor(nt1, 64);
        
-       printf("  nt': %08x\n", p640);
-       printf(" nt'': %08x\n", prng_successor(p640, 32));
+       if (showMaths) {
+               printf("\nLFSR succesors of the tag challenge:\n");
+               printf("  nt': %08x\n", p640);
+               printf(" nt'': %08x\n", prng_successor(p640, 32));
+       }
        
        s = lfsr_recovery32(ar0_enc ^ p640, 0);
   

diff --git a/client/nonce2key/nonce2key.h b/client/nonce2key/nonce2key.h
index e8e2a01b88d9bd1d6ab2311c8163772365b7263b..b274feca59ea5affb48bf8f7012fe2da2f9212b3 100644 (file)
--- a/client/nonce2key/nonce2key.h
+++ b/client/nonce2key/nonce2key.h
@@ -28,7 +28,7 @@ extern int nonce2key_ex(uint8_t blockno, uint8_t keytype, uint32_t uid, uint32_t
 
 //iceman, added these to be able to crack key direct from "hf 14 sim" && "hf mf sim"
 bool tryMfk32(nonces_t data, uint64_t *outputkey );
-bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey );  // <<-- this one has best success
+bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool showMaths );  // <<-- this one has best success
 int tryMfk64_ex(uint8_t *data, uint64_t *outputkey );
 int tryMfk64(uint32_t uid, uint32_t nt, uint32_t nr_enc, uint32_t ar_enc, uint32_t at_enc, uint64_t *outputkey);
 #endif