ADD: added the "hf snoop" patch original from @Enio, rearranged by @Etmatrix.

ADD:  added the "t55x7" refactoring by @marshmellow42
This commit is contained in:
iceman1001 2015-10-27 21:47:21 +01:00
commit 1d0ccbe04b
24 changed files with 704 additions and 604 deletions

View file

@ -1209,7 +1209,49 @@ int usage_hf_mfu_eload(void) {
return 0;
}
int usage_hf_mfu_ucauth(void) {
PrintAndLog("Usage: hf mfu cauth k <key number>");
PrintAndLog(" 0 (default): 3DES standard key");
PrintAndLog(" 1 : all 0x00 key");
PrintAndLog(" 2 : 0x00-0x0F key");
PrintAndLog(" 3 : nfc key");
PrintAndLog(" 4 : all 0x01 key");
PrintAndLog(" 5 : all 0xff key");
PrintAndLog(" 6 : 0x00-0xFF key");
PrintAndLog("\n sample : hf mfu cauth k");
PrintAndLog(" : hf mfu cauth k 3");
return 0;
}
int usage_hf_mfu_ucsetpwd(void) {
PrintAndLog("Usage: hf mfu setpwd <password (32 hex symbols)>");
PrintAndLog(" [password] - (32 hex symbols)");
PrintAndLog("");
PrintAndLog("sample: hf mfu setpwd 000102030405060708090a0b0c0d0e0f");
PrintAndLog("");
return 0;
}
int usage_hf_mfu_ucsetuid(void) {
PrintAndLog("Usage: hf mfu setuid <uid (14 hex symbols)>");
PrintAndLog(" [uid] - (14 hex symbols)");
PrintAndLog("\nThis only works for Magic Ultralight tags.");
PrintAndLog("");
PrintAndLog("sample: hf mfu setuid 11223344556677");
PrintAndLog("");
return 0;
}
int usage_hf_mfu_gendiverse(void){
PrintAndLog("Usage: hf mfu gen <uid (8 hex symbols)>");
PrintAndLog("");
PrintAndLog("sample: hf mfu gen 11223344");
PrintAndLog("");
return 0;
}
//
// Mifare Ultralight / Ultralight-C / Ultralight-EV1
// Read and Dump Card Contents, using auto detection of tag size.
int CmdHF14AMfUDump(const char *Cmd){
@ -1455,6 +1497,7 @@ int CmdHF14AMfUDump(const char *Cmd){
// Ultralight C Methods
//-------------------------------------------------------------------------------
//
// Ultralight C Authentication Demo {currently uses hard-coded key}
//
@ -1472,22 +1515,9 @@ int CmdHF14AMfucAuth(const char *Cmd){
errors = true;
}
if (cmdp == 'h' || cmdp == 'H')
errors = true;
if (cmdp == 'h' || cmdp == 'H') errors = true;
if (errors) {
PrintAndLog("Usage: hf mfu cauth k <key number>");
PrintAndLog(" 0 (default): 3DES standard key");
PrintAndLog(" 1 : all 0x00 key");
PrintAndLog(" 2 : 0x00-0x0F key");
PrintAndLog(" 3 : nfc key");
PrintAndLog(" 4 : all 0x01 key");
PrintAndLog(" 5 : all 0xff key");
PrintAndLog(" 6 : 0x00-0xFF key");
PrintAndLog("\n sample : hf mfu cauth k");
PrintAndLog(" : hf mfu cauth k 3");
return 0;
}
if (errors) return usage_hf_mfu_ucauth();
uint8_t *key = default_3des_keys[keyNo];
if (ulc_authentication(key, true))
@ -1601,17 +1631,9 @@ int CmdTestDES(const char * cmd)
int CmdHF14AMfucSetPwd(const char *Cmd){
uint8_t pwd[16] = {0x00};
char cmdp = param_getchar(Cmd, 0);
if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') {
PrintAndLog("Usage: hf mfu setpwd <password (32 hex symbols)>");
PrintAndLog(" [password] - (32 hex symbols)");
PrintAndLog("");
PrintAndLog("sample: hf mfu setpwd 000102030405060708090a0b0c0d0e0f");
PrintAndLog("");
return 0;
}
if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_hf_mfu_ucsetpwd();
if (param_gethex(Cmd, 0, pwd, 32)) {
PrintAndLog("Password must include 32 HEX symbols");
@ -1624,7 +1646,6 @@ int CmdHF14AMfucSetPwd(const char *Cmd){
SendCommand(&c);
UsbCommand resp;
if (WaitForResponseTimeout(CMD_ACK,&resp,1500) ) {
if ( (resp.arg[0] & 0xff) == 1)
PrintAndLog("Ultralight-C new password: %s", sprint_hex(pwd,16));
@ -1636,8 +1657,7 @@ int CmdHF14AMfucSetPwd(const char *Cmd){
else {
PrintAndLog("command execution time out");
return 1;
}
}
return 0;
}
@ -1650,17 +1670,8 @@ int CmdHF14AMfucSetUid(const char *Cmd){
UsbCommand resp;
uint8_t uid[7] = {0x00};
char cmdp = param_getchar(Cmd, 0);
if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') {
PrintAndLog("Usage: hf mfu setuid <uid (14 hex symbols)>");
PrintAndLog(" [uid] - (14 hex symbols)");
PrintAndLog("\nThis only works for Magic Ultralight tags.");
PrintAndLog("");
PrintAndLog("sample: hf mfu setuid 11223344556677");
PrintAndLog("");
return 0;
}
if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_hf_mfu_ucsetuid();
if (param_gethex(Cmd, 0, uid, 14)) {
PrintAndLog("UID must include 14 HEX symbols");
return 1;
@ -1724,14 +1735,20 @@ int CmdHF14AMfucSetUid(const char *Cmd){
}
int CmdHF14AMfuGenDiverseKeys(const char *Cmd){
uint8_t uid[4];
char cmdp = param_getchar(Cmd, 0);
if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_hf_mfu_gendiverse();
if (param_gethex(Cmd, 0, uid, 8)) {
PrintAndLog("UID must include 8 HEX symbols");
return 1;
}
uint8_t iv[8] = { 0x00 };
uint8_t block = 0x07;
uint8_t block = 0x01;
// UL-EV1
//04 57 b6 e2 05 3f 80 UID
//4a f8 4b 19 PWD
uint8_t uid[] = { 0xF4,0xEA, 0x54, 0x8E };
uint8_t mifarekeyA[] = { 0xA0,0xA1,0xA2,0xA3,0xA4,0xA5 };
uint8_t mifarekeyB[] = { 0xB0,0xB1,0xB2,0xB3,0xB4,0xB5 };
uint8_t dkeyA[8] = { 0x00 };
@ -1760,15 +1777,13 @@ int CmdHF14AMfuGenDiverseKeys(const char *Cmd){
, divkey // output
);
PrintAndLog("3DES version");
PrintAndLog("-- 3DES version");
PrintAndLog("Masterkey :\t %s", sprint_hex(masterkey,sizeof(masterkey)));
PrintAndLog("UID :\t %s", sprint_hex(uid, sizeof(uid)));
PrintAndLog("Sector :\t %0d", block);
PrintAndLog("block :\t %0d", block);
PrintAndLog("Mifare key :\t %s", sprint_hex(mifarekeyA, sizeof(mifarekeyA)));
PrintAndLog("Message :\t %s", sprint_hex(mix, sizeof(mix)));
PrintAndLog("Diversified key: %s", sprint_hex(divkey+1, 6));
PrintAndLog("\n DES version");
for (int i=0; i < sizeof(mifarekeyA); ++i){
dkeyA[i] = (mifarekeyA[i] << 1) & 0xff;
@ -1798,20 +1813,19 @@ int CmdHF14AMfuGenDiverseKeys(const char *Cmd){
, newpwd // output
);
PrintAndLog("\n-- DES version");
PrintAndLog("Mifare dkeyA :\t %s", sprint_hex(dkeyA, sizeof(dkeyA)));
PrintAndLog("Mifare dkeyB :\t %s", sprint_hex(dkeyB, sizeof(dkeyB)));
PrintAndLog("Mifare ABA :\t %s", sprint_hex(dmkey, sizeof(dmkey)));
PrintAndLog("Mifare Pwd :\t %s", sprint_hex(newpwd, sizeof(newpwd)));
// next. from the diversify_key method.
return 0;
}
// static uint8_t * diversify_key(uint8_t * key){
// for(int i=0; i<16; i++){
// if(i<=6) key[i]^=cuid[i];
// if(i>6) key[i]^=cuid[i%7];
// }
// return key;
// }