From: iceman Date: Tue, 12 Jan 2016 18:26:56 +0000 (+0100) Subject: Merge branch 'master' of https://github.com/iceman1001/proxmark3 X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/commitdiff_plain/b725f2ca21d11709b5e61595bd88ae260fee4c7f?hp=2c29cba82ac4bdb2b16ec4d16c7fc293cd1850dd Merge branch 'master' of https://github.com/iceman1001/proxmark3 --- diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c index bfd7069b..8a925475 100644 --- a/armsrc/iso14443a.c +++ b/armsrc/iso14443a.c @@ -1464,7 +1464,6 @@ void PrepareDelayedTransfer(uint16_t delay) //------------------------------------------------------------------------------------- static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing) { - FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); uint32_t ThisTransferTime = 0; @@ -1492,9 +1491,8 @@ static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { AT91C_BASE_SSC->SSC_THR = cmd[c]; c++; - if(c >= len) { + if(c >= len) break; - } } } @@ -1508,7 +1506,7 @@ static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8_t *parity) { int i, j; - int last; + int last = 0; uint8_t b; ToSendReset(); @@ -1516,7 +1514,6 @@ void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8 // Start of Communication (Seq. Z) ToSend[++ToSendMax] = SEC_Z; LastProxToAirDuration = 8 * (ToSendMax+1) - 6; - last = 0; size_t bytecount = nbytes(bits); // Generate send structure for the data bits @@ -1729,7 +1726,7 @@ int EmSend4bitEx(uint8_t resp, bool correctionNeeded){ Code4bitAnswerAsTag(resp); int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded); // do the tracing for the previous reader request and this tag answer: - uint8_t par[1]; + uint8_t par[1] = {0x00}; GetParity(&resp, 1, par); EmLogTrace(Uart.output, Uart.len, @@ -1766,13 +1763,13 @@ int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8 } int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded){ - uint8_t par[MAX_PARITY_SIZE]; + uint8_t par[MAX_PARITY_SIZE] = {0x00}; GetParity(resp, respLen, par); return EmSendCmdExPar(resp, respLen, correctionNeeded, par); } int EmSendCmd(uint8_t *resp, uint16_t respLen){ - uint8_t par[MAX_PARITY_SIZE]; + uint8_t par[MAX_PARITY_SIZE] = {0x00}; GetParity(resp, respLen, par); return EmSendCmdExPar(resp, respLen, false, par); } @@ -1793,9 +1790,12 @@ bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_Start uint16_t exact_fdt = (approx_fdt - 20 + 32)/64 * 64 + 20; reader_EndTime = tag_StartTime - exact_fdt; reader_StartTime = reader_EndTime - reader_modlen; - if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_EndTime, reader_Parity, TRUE)) { + + if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_EndTime, reader_Parity, TRUE)) return FALSE; - } else return(!LogTrace(tag_data, tag_len, tag_StartTime, tag_EndTime, tag_Parity, FALSE)); + else + return(!LogTrace(tag_data, tag_len, tag_StartTime, tag_EndTime, tag_Parity, FALSE)); + } else { return TRUE; } @@ -1847,9 +1847,8 @@ void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t LED_A_ON(); // Log reader command in trace buffer - if (tracing) { + if (tracing) LogTrace(frame, nbytes(bits), LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_READER, (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_READER, par, TRUE); - } } void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing) @@ -1860,7 +1859,7 @@ void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *tim void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing) { // Generate parity and redirect - uint8_t par[MAX_PARITY_SIZE]; + uint8_t par[MAX_PARITY_SIZE] = {0x00}; GetParity(frame, len/8, par); ReaderTransmitBitsPar(frame, len, par, timing); } @@ -1868,26 +1867,30 @@ void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing) void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing) { // Generate parity and redirect - uint8_t par[MAX_PARITY_SIZE]; + uint8_t par[MAX_PARITY_SIZE] = {0x00}; GetParity(frame, len, par); ReaderTransmitBitsPar(frame, len*8, par, timing); } int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity) { - if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, offset)) return FALSE; - if (tracing) { + if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, offset)) + return FALSE; + + if (tracing) LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE); - } + return Demod.len; } int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity) { - if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return FALSE; - if (tracing) { + if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) + return FALSE; + + if (tracing) LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE); - } + return Demod.len; } @@ -2254,7 +2257,7 @@ void ReaderMifare(bool first_try) static byte_t par_low = 0; bool led_on = TRUE; uint8_t uid[10] = {0}; - uint32_t cuid; + uint32_t cuid = 0; uint32_t nt = 0; uint32_t previous_nt = 0; @@ -2267,7 +2270,7 @@ void ReaderMifare(bool first_try) static int32_t sync_cycles = 0; int catch_up_cycles = 0; int last_catch_up = 0; - uint16_t elapsed_prng_sequences; + uint16_t elapsed_prng_sequences = 0; uint16_t consecutive_resyncs = 0; int isOK = 0; @@ -2299,8 +2302,8 @@ void ReaderMifare(bool first_try) int16_t debug_info_nr = -1; uint16_t strategy = 0; int32_t debug_info[MAX_STRATEGY][NUM_DEBUG_INFOS]; - uint32_t select_time; - uint32_t halt_time; + uint32_t select_time = 0; + uint32_t halt_time = 0; for(uint16_t i = 0; TRUE; ++i) { @@ -2328,6 +2331,7 @@ void ReaderMifare(bool first_try) SpinDelay(200); iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD); SpinDelay(100); + WDT_HIT(); } if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) { @@ -2345,10 +2349,11 @@ void ReaderMifare(bool first_try) while(GetCountSspClk() > sync_time) { elapsed_prng_sequences++; sync_time = (sync_time & 0xfffffff8) + sync_cycles; - } + } // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked) ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time); + } else { // collect some information on tag nonces for debugging: #define DEBUG_FIXED_SYNC_CYCLES PRNG_SEQUENCE_LENGTH @@ -2473,7 +2478,7 @@ void ReaderMifare(bool first_try) } else { if (nt_diff == 0 && first_try) { par[0]++; - if (par[0] == 0x00) { // tried all 256 possible parities without success. Card doesn't send NACK. + if (par[0] == 0x00) { // tried all 256 possible parities without success. Card doesn't send NACK. isOK = -2; break; } @@ -2483,9 +2488,10 @@ void ReaderMifare(bool first_try) } } - mf_nr_ar[3] &= 0x1F; - + + WDT_HIT(); + if (isOK == -4) { if (MF_DBGLEVEL >= 3) { for (uint16_t i = 0; i <= MAX_STRATEGY; ++i) { @@ -2544,10 +2550,10 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t * struct Crypto1State *pcs; pcs = &mpcs; uint32_t numReads = 0;//Counts numer of times reader read a block - uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE]; - uint8_t receivedCmd_par[MAX_MIFARE_PARITY_SIZE]; - uint8_t response[MAX_MIFARE_FRAME_SIZE]; - uint8_t response_par[MAX_MIFARE_PARITY_SIZE]; + uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE] = {0x00}; + uint8_t receivedCmd_par[MAX_MIFARE_PARITY_SIZE] = {0x00}; + uint8_t response[MAX_MIFARE_FRAME_SIZE] = {0x00}; + uint8_t response_par[MAX_MIFARE_PARITY_SIZE] = {0x00}; uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k 4BUID uint8_t rUIDBCC1[] = {0xde, 0xad, 0xbe, 0xaf, 0x62}; diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c index a00c5a8b..0443c1f1 100644 --- a/armsrc/mifarecmd.c +++ b/armsrc/mifarecmd.c @@ -750,7 +750,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat uint16_t davg = 0; static uint16_t dmin, dmax; uint8_t uid[10] = {0x00}; - uint32_t cuid, nt1, nt2, nttmp, nttest, ks1; + uint32_t cuid = 0, nt1, nt2, nttmp, nttest, ks1; uint8_t par[1] = {0x00}; uint32_t target_nt[2] = {0x00}, target_ks[2] = {0x00}; @@ -759,7 +759,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat struct Crypto1State mpcs = {0, 0}; struct Crypto1State *pcs; pcs = &mpcs; - uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE]; + uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00}; uint32_t auth1_time, auth2_time; static uint16_t delta_time; diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index 1d516ebc..e10a88f3 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -54,7 +54,7 @@ start: } UsbCommand resp; - if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) { + if (WaitForResponseTimeout(CMD_ACK, &resp, 1000)) { isOK = resp.arg[0]; uid = (uint32_t)bytes_to_num(resp.d.asBytes + 0, 4); nt = (uint32_t)bytes_to_num(resp.d.asBytes + 4, 4); @@ -93,7 +93,7 @@ start: } t1 = clock() - t1; if ( t1 > 0 ){ - PrintAndLog("Time in darkside: %f ticks - %1.2f sec\n", (float)t1, ((float)t1)/CLOCKS_PER_SEC); + PrintAndLog("Time in darkside: %.0f ticks - %4.2f sec\n (%u)", (float)t1, ((float)t1)/CLOCKS_PER_SEC, CLOCKS_PER_SEC); } return 0; } @@ -706,7 +706,7 @@ int CmdHF14AMfNested(const char *Cmd) if (!res) { e_sector[i].Key[j] = key64; - e_sector[i].foundKey[j] = 1; + e_sector[i].foundKey[j] = TRUE; } } } @@ -763,39 +763,24 @@ int CmdHF14AMfNested(const char *Cmd) if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500)) continue; uint8_t isOK = resp.arg[0] & 0xff; - uint8_t *data = resp.d.asBytes; - - if (isOK) { + if (!isOK) continue; - key64 = bytes_to_num(data+10, 6); - if (key64) { - PrintAndLog("Data:%s", sprint_hex(data+10, 6)); - e_sector[i].foundKey[1] = 1; - e_sector[i].Key[1] = key64; - } + uint8_t *data = resp.d.asBytes; + key64 = bytes_to_num(data+10, 6); + if (key64) { + PrintAndLog("Data:%s", sprint_hex(data+10, 6)); + e_sector[i].foundKey[1] = 1; + e_sector[i].Key[1] = key64; } } } t1 = clock() - t1; - if ( t1 > 0 ) { - PrintAndLog("Time in nested: %f ticks %1.2f sec (%1.2f sec per key)\n\n", (float)t1, ((float)t1)/CLOCKS_PER_SEC, ((float)t1)/iterations/CLOCKS_PER_SEC); - } + if ( t1 > 0 ) + PrintAndLog("Time in nested: %.0f ticks %4.2f sec (%4.2f sec per key)\n", (float)t1, ((float)t1)/CLOCKS_PER_SEC, ((float)t1)/iterations/CLOCKS_PER_SEC); - PrintAndLog("-----------------------------------------------\nIterations count: %d\n\n", iterations); //print them - PrintAndLog("|---|----------------|---|----------------|---|"); - PrintAndLog("|sec|key A |res|key B |res|"); - PrintAndLog("|---|----------------|---|----------------|---|"); - for (i = 0; i < SectorsCnt; i++) { - PrintAndLog("|%03d| %012"llx" | %d | %012"llx" | %d |", i, - e_sector[i].Key[0], - e_sector[i].foundKey[0], - e_sector[i].Key[1], - e_sector[i].foundKey[1] - ); - } - PrintAndLog("|---|----------------|---|----------------|---|"); + printKeyTable( SectorsCnt, e_sector ); // transfer them to the emulator if (transferToEml) { @@ -979,6 +964,8 @@ int CmdHF14AMfChk(const char *Cmd) uint8_t *keyBlock = NULL, *p; uint8_t stKeyBlock = 20; + sector *e_sector = NULL; + int i, res; int keycnt = 0; char ctmp = 0x00; @@ -987,6 +974,8 @@ int CmdHF14AMfChk(const char *Cmd) uint8_t keyType = 0; uint64_t key64 = 0; + uint8_t tempkey[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; + int transferToEml = 0; int createDumpFile = 0; @@ -1124,80 +1113,137 @@ int CmdHF14AMfChk(const char *Cmd) } // initialize storage for found keys - bool validKey[2][40]; - uint8_t foundKey[2][40][6]; - for (uint16_t t = 0; t < 2; t++) { - for (uint16_t sectorNo = 0; sectorNo < SectorsCnt; sectorNo++) { - validKey[t][sectorNo] = false; - for (uint16_t i = 0; i < 6; i++) { - foundKey[t][sectorNo][i] = 0xff; - } - } + e_sector = calloc(SectorsCnt, sizeof(sector)); + if (e_sector == NULL) { + free(keyBlock); + return 1; } + + uint8_t trgKeyType = 0; + // time clock_t t1 = clock(); - - for ( int t = !keyType; t < 2; keyType==2?(t++):(t=2) ) { - int b=blockNo; + + // check keys. + for (trgKeyType = 0; trgKeyType < 2; ++trgKeyType) { + int b = blockNo; for (int i = 0; i < SectorsCnt; ++i) { - PrintAndLog("--sector:%2d, block:%3d, key type:%C, key count:%2d ", i, b, t?'B':'A', keycnt); - uint32_t max_keys = keycnt>USB_CMD_DATA_SIZE/6?USB_CMD_DATA_SIZE/6:keycnt; - for (uint32_t c = 0; c < keycnt; c+=max_keys) { - uint32_t size = keycnt-c>max_keys?max_keys:keycnt-c; - res = mfCheckKeys(b, t, true, size, &keyBlock[6*c], &key64); - if (res != 1) { - if (!res) { - PrintAndLog("Found valid key:[%012"llx"]",key64); - num_to_bytes(key64, 6, foundKey[t][i]); - validKey[t][i] = true; - } + + // skip already found keys. + if (e_sector[i].foundKey[trgKeyType]) continue; + + PrintAndLog("--sector:%2d, block:%3d, key type:%C, key count:%2d ", i, b, trgKeyType ? 'B':'A', keycnt); + + uint32_t max_keys = keycnt > (USB_CMD_DATA_SIZE/6) ? (USB_CMD_DATA_SIZE/6) : keycnt; + + for (uint32_t c = 0; c < keycnt; c += max_keys) { + + uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c; + + res = mfCheckKeys(b, trgKeyType, true, size, &keyBlock[6*c], &key64); + if (!res) { + PrintAndLog("Found valid key:[%012"llx"]",key64); + e_sector[i].Key[trgKeyType] = key64; + e_sector[i].foundKey[trgKeyType] = TRUE; + break; } else { - PrintAndLog("Command execute timeout"); + e_sector[i].Key[trgKeyType] = 0xffffffffffff; + e_sector[i].foundKey[trgKeyType] = FALSE; } } - b<127?(b+=4):(b+=16); + b < 127 ? ( b +=4 ) : ( b += 16 ); } } - t1 = clock() - t1; - if ( t1 > 0 ){ - printf("Time in checkkeys: %f ticks %1.2f sec (%1.2f sec per key)\n\n", (float)t1, ((float)t1)/CLOCKS_PER_SEC, ((float)t1)/keycnt/CLOCKS_PER_SEC); + // 20160116 If Sector A is found, but not Sector B, try just reading it of the tag? + PrintAndLog("testing to read B..."); + for (i = 0; i < SectorsCnt; i++) { + // KEY A but not KEY B + if ( e_sector[i].foundKey[0] && !e_sector[i].foundKey[1] ) { + + uint8_t sectrail = (FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1); + + UsbCommand c = {CMD_MIFARE_READBL, {sectrail, 0, 0}}; + num_to_bytes(e_sector[i].Key[0], 6, c.d.asBytes); // KEY A + clearCommandBuffer(); + SendCommand(&c); + + UsbCommand resp; + if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500)) continue; + + uint8_t isOK = resp.arg[0] & 0xff; + if (!isOK) continue; + + uint8_t *data = resp.d.asBytes; + key64 = bytes_to_num(data+10, 6); + if (key64) { + PrintAndLog("Data:%s", sprint_hex(data+10, 6)); + e_sector[i].foundKey[1] = 1; + e_sector[i].Key[1] = key64; + } + } } + + t1 = clock() - t1; + if ( t1 > 0 ) + printf("Time in checkkeys: %.0f ticks %1.2f sec (%1.2f sec per key)\n\n", (float)t1, ((float)t1)/CLOCKS_PER_SEC, ((float)t1)/keycnt/CLOCKS_PER_SEC); + //print them + printKeyTable( SectorsCnt, e_sector ); + if (transferToEml) { - uint8_t block[16]; - for (uint16_t sectorNo = 0; sectorNo < SectorsCnt; sectorNo++) { - if (validKey[0][sectorNo] || validKey[1][sectorNo]) { - mfEmlGetMem(block, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1); - for (uint16_t t = 0; t < 2; t++) { - if (validKey[t][sectorNo]) { - memcpy(block + t*10, foundKey[t][sectorNo], 6); - } - } - mfEmlSetMem(block, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1); - } + uint8_t block[16] = {0x00}; + for (uint8_t i = 0; i < SectorsCnt; ++i ) { + mfEmlGetMem(block, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1); + if (e_sector[i].foundKey[0]) + num_to_bytes(e_sector[i].Key[0], 6, block); + if (e_sector[i].foundKey[1]) + num_to_bytes(e_sector[i].Key[1], 6, block+10); + mfEmlSetMem(block, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1); } PrintAndLog("Found keys have been transferred to the emulator memory"); } - + if (createDumpFile) { FILE *fkeys = fopen("dumpkeys.bin","wb"); if (fkeys == NULL) { PrintAndLog("Could not create file dumpkeys.bin"); free(keyBlock); + free(e_sector); return 1; } - for (uint16_t t = 0; t < 2; t++) { - fwrite(foundKey[t], 1, 6*SectorsCnt, fkeys); + PrintAndLog("Printing keys to binary file dumpkeys.bin..."); + + for( i=0; i