`hf mf sniff` - working with emulator files

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 6abfdda23496ce976b3de0ee2aa5693b8859e7a3..c27ba56cbf184b05deaea598adc77c229c703744 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -1543,8 +1543,8 @@ int CmdHF14AMfCSave(const char *Cmd) {
 \r
 int CmdHF14AMfSniff(const char *Cmd){\r
        // params\r
-       bool wantLogToFile = 0;\r
-       bool wantDecrypt = 0;\r
+       bool wantLogToFile = 1;\r
+       bool wantDecrypt = 1;\r
        bool wantSaveToEml = 0;\r
        bool wantSaveToEmlFile = 0;\r
 \r
@@ -1568,7 +1568,7 @@ int CmdHF14AMfSniff(const char *Cmd){
                PrintAndLog("    l - save encrypted sequence to logfile `uid.log`");\r
                PrintAndLog("    d - decrypt sequence and put it to log file `uid.log`");\r
                PrintAndLog(" n/a   e - decrypt sequence, collect read and write commands and save the result of the sequence to emulator memory");\r
-               PrintAndLog(" n/a   r - decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`");\r
+               PrintAndLog("    r - decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`");\r
                PrintAndLog("Usage:  hf mf sniff [l][d][e][r]");\r
                PrintAndLog("  sample: hf mf sniff l d e");\r
                return 0;\r
@@ -1635,14 +1635,14 @@ int CmdHF14AMfSniff(const char *Cmd){
                                                \r
                                                PrintAndLog("tag select uid:%s atqa:%02x %02x sak:0x%02x", sprint_hex(uid, 7), atqa[0], atqa[1], sak);\r
                                                if (wantLogToFile) {\r
-                                                       FillFileNameByUID(logHexFileName, uid, ".log");\r
+                                                       FillFileNameByUID(logHexFileName, uid, ".log", 7);\r
                                                        AddLogCurrentDT(logHexFileName);\r
                                                }                                               \r
-                                               if (wantDecrypt) mfTraceInit(uid, atqa, sak);\r
+                                               if (wantDecrypt) mfTraceInit(uid, atqa, sak, wantSaveToEmlFile);\r
                                        } else {\r
                                                PrintAndLog("%s(%d):%s", isTag ? "TAG":"RDR", num, sprint_hex(bufPtr, len));\r
                                                if (wantLogToFile) AddLogHex(logHexFileName, isTag ? "TAG: ":"RDR: ", bufPtr, len);\r
-                                               if (wantDecrypt) mfTraceDecode(bufPtr, len);\r
+                                               if (wantDecrypt) mfTraceDecode(bufPtr, len, wantSaveToEmlFile);\r
                                        }\r
                                        bufPtr += len;\r
                                        num++;\r

diff --git a/client/mifarehost.c b/client/mifarehost.c
index cfcc17ba17872036c1477b581f3e39de51b96ec0..fc29e10e9f1e3d3f5db3e0886a83187070190354 100644 (file)
--- a/client/mifarehost.c
+++ b/client/mifarehost.c
@@ -275,9 +275,13 @@ int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params) {
 \r
 // SNIFFER\r
 \r
+// constants\r
+static uint8_t trailerAccessBytes[4] = {0x08, 0x77, 0x8F, 0x00};\r
+\r
 // variables\r
 char logHexFileName[200] = {0x00};\r
-static uint8_t traceCard[4096];\r
+static uint8_t traceCard[4096] = {0x00};\r
+static char traceFileName[20];\r
 static int traceState = TRACE_IDLE;\r
 static uint8_t traceCurBlock = 0;\r
 static uint8_t traceCurKey = 0;\r
@@ -295,13 +299,79 @@ uint32_t nr_enc;  // encrypted reader challenge
 uint32_t ar_enc;  // encrypted reader response\r
 uint32_t at_enc;  // encrypted tag response\r
 \r
-int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak) {\r
+int isTraceCardEmpty(void) {\r
+       return ((traceCard[0] == 0) && (traceCard[1] == 0) && (traceCard[2] == 0) && (traceCard[3] == 0));\r
+}\r
 \r
-       if (traceCrypto1) crypto1_destroy(traceCrypto1);\r
-       traceCrypto1 = NULL;\r
+int isBlockEmpty(int blockN) {\r
+       for (int i = 0; i < 16; i++) \r
+               if (traceCard[blockN * 16 + i] != 0) return 0;\r
 \r
+       return 1;\r
+}\r
+\r
+int isBlockTrailer(int blockN) {\r
+ return ((blockN & 0x03) == 0x03);\r
+}\r
+\r
+int loadTraceCard(uint8_t *tuid) {\r
+       FILE * f;\r
+       char buf[64];\r
+       uint8_t buf8[64];\r
+       int i, blockNum;\r
+       \r
+       if (!isTraceCardEmpty()) saveTraceCard();\r
        memset(traceCard, 0x00, 4096);\r
        memcpy(traceCard, tuid + 3, 4);\r
+       FillFileNameByUID(traceFileName, tuid, ".eml", 7);\r
+\r
+       f = fopen(traceFileName, "r");\r
+       if (!f) return 1;\r
+       \r
+       blockNum = 0;\r
+       while(!feof(f)){\r
+               memset(buf, 0, sizeof(buf));\r
+               fgets(buf, sizeof(buf), f);\r
+\r
+               if (strlen(buf) < 32){\r
+                       if (feof(f)) break;\r
+                       PrintAndLog("File content error. Block data must include 32 HEX symbols");\r
+                       return 2;\r
+               }\r
+               for (i = 0; i < 32; i += 2)\r
+                       sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]);\r
+\r
+               memcpy(traceCard + blockNum * 16, buf8, 16);\r
+\r
+               blockNum++;\r
+       }\r
+       fclose(f);\r
+\r
+       return 0;\r
+}\r
+\r
+int saveTraceCard(void) {\r
+       FILE * f;\r
+       \r
+       if ((!strlen(traceFileName)) || (isTraceCardEmpty())) return 0;\r
+       \r
+       f = fopen(traceFileName, "w+");\r
+       for (int i = 0; i < 64; i++) {  // blocks\r
+               for (int j = 0; j < 16; j++)  // bytes\r
+                       fprintf(f, "%02x", *(traceCard + i * 16 + j)); \r
+               fprintf(f,"\n");\r
+       }\r
+       fclose(f);\r
+\r
+       return 0;\r
+}\r
+\r
+int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile) {\r
+\r
+       if (traceCrypto1) crypto1_destroy(traceCrypto1);\r
+       traceCrypto1 = NULL;\r
+\r
+       if (wantSaveToEmlFile) loadTraceCard(tuid);\r
        traceCard[4] = traceCard[0] ^ traceCard[1] ^ traceCard[2] ^ traceCard[3];\r
        traceCard[5] = sak;\r
        memcpy(&traceCard[6], atqa, 2);\r
@@ -331,7 +401,7 @@ void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len, bool i
 }\r
 \r
 \r
-int mfTraceDecode(uint8_t *data_src, int len) {\r
+int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {\r
        uint8_t data[64];\r
 \r
        if (traceState == TRACE_ERROR) return 1;\r
@@ -386,7 +456,12 @@ int mfTraceDecode(uint8_t *data_src, int len) {
                if (len == 18) {\r
                        traceState = TRACE_IDLE;\r
 \r
-                       memcpy(traceCard + traceCurBlock * 16, data, 16);\r
+                       if (isBlockTrailer(traceCurBlock)) {\r
+                               memcpy(traceCard + traceCurBlock * 16 + 6, data + 6, 4);\r
+                       } else {\r
+                               memcpy(traceCard + traceCurBlock * 16, data, 16);\r
+                       }\r
+                       if (wantSaveToEmlFile) saveTraceCard();\r
                        return 0;\r
                } else {\r
                        traceState = TRACE_ERROR;\r
@@ -410,6 +485,7 @@ int mfTraceDecode(uint8_t *data_src, int len) {
                        traceState = TRACE_IDLE;\r
 \r
                        memcpy(traceCard + traceCurBlock * 16, data, 16);\r
+                       if (wantSaveToEmlFile) saveTraceCard();\r
                        return 0;\r
                } else {\r
                        traceState = TRACE_ERROR;\r
@@ -470,11 +546,15 @@ int mfTraceDecode(uint8_t *data_src, int len) {
                        printf("key> %x%x\n", (unsigned int)((lfsr & 0xFFFFFFFF00000000) >> 32), (unsigned int)(lfsr & 0xFFFFFFFF));\r
                        AddLogUint64(logHexFileName, "key> ", lfsr); \r
                        \r
+                       int blockShift = ((traceCurBlock & 0xFC) + 3) * 16;\r
+                       if (isBlockEmpty((traceCurBlock & 0xFC) + 3)) memcpy(traceCard + blockShift + 6, trailerAccessBytes, 4);\r
+                       \r
                        if (traceCurKey) {\r
-                               num_to_bytes(lfsr, 6, traceCard + traceCurBlock * 16 + 10);\r
+                               num_to_bytes(lfsr, 6, traceCard + blockShift + 10);\r
                        } else {\r
-                               num_to_bytes(lfsr, 6, traceCard + traceCurBlock * 16);\r
+                               num_to_bytes(lfsr, 6, traceCard + blockShift);\r
                        }\r
+                       if (wantSaveToEmlFile) saveTraceCard();\r
 \r
                        if (traceCrypto1) {\r
                                crypto1_destroy(traceCrypto1);\r

diff --git a/client/mifarehost.h b/client/mifarehost.h
index 4d3824091aa73df682aa38fae8724f4e8dfddd5f..64fc9339d94164733e7055884d03ba4023b7a76b 100644 (file)
--- a/client/mifarehost.h
+++ b/client/mifarehost.h
@@ -63,10 +63,19 @@ extern char logHexFileName[200];
 \r
 int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t * ResultKeys);\r
 int mfCheckKeys (uint8_t blockNo, uint8_t keyType, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key);\r
+\r
 int mfEmlGetMem(uint8_t *data, int blockNum, int blocksCount);\r
 int mfEmlSetMem(uint8_t *data, int blockNum, int blocksCount);\r
+\r
 int mfCSetUID(uint8_t *uid, uint8_t *oldUID, int wantWipe);\r
 int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, int wantWipe, uint8_t params);\r
 int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params);\r
-int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak);\r
-int mfTraceDecode(uint8_t *data_src, int len);\r
+\r
+int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile);\r
+int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile);\r
+\r
+int isTraceCardEmpty(void);\r
+int isBlockEmpty(int blockN);\r
+int isBlockTrailer(int blockN);\r
+int loadTraceCard(uint8_t *tuid);\r
+int saveTraceCard(void);\r

diff --git a/client/util.c b/client/util.c
index 8a62e361aec8f9ba8452c12887627d13eabe70b5..0673f181e0d9044bb22635d2a6378976197c8424 100644 (file)
--- a/client/util.c
+++ b/client/util.c
@@ -80,15 +80,13 @@ void AddLogCurrentDT(char *fileName) {
        AddLogLine(fileName, "\nanticollision: ", buff);
 }
 
-void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext) {
+void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext, int byteCount) {
        char * fnameptr = fileName;
        memset(fileName, 0x00, 200);
        
-       for (int j = 0; j < 7; j++, fnameptr += 2)
+       for (int j = 0; j < byteCount; j++, fnameptr += 2)
                sprintf(fnameptr, "%02x", uid[j]); 
        sprintf(fnameptr, "%s", ext); 
-       
-       printf("fname:%s", fileName);
 }
 
 // printing and converting functions

diff --git a/client/util.h b/client/util.h
index cec187cf23db1bebe911cede313da860aa137192..22e834719b94174883fef4336360cd0864eae49c 100644 (file)
--- a/client/util.h
+++ b/client/util.h
@@ -22,7 +22,7 @@ void AddLogLine(char *fileName, char *extData, char *c);
 void AddLogHex(char *fileName, char *extData, const uint8_t * data, const size_t len);
 void AddLogUint64(char *fileName, char *extData, const uint64_t data);
 void AddLogCurrentDT(char *fileName);
-void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext);
+void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext, int byteCount);
 
 void print_hex(const uint8_t * data, const size_t len);
 char * sprint_hex(const uint8_t * data, const size_t len);