This commit is contained in:
iceman1001 2024-01-18 16:41:13 +01:00
parent b19973368d
commit 22fd440c83
14 changed files with 270 additions and 222 deletions

View file

@ -1312,7 +1312,7 @@ static void print_blocks_15693(uint8_t *data, uint16_t bytes, int blocksize, boo
// suppress repeating blocks, truncate as such that the first and last block with the same data is shown // suppress repeating blocks, truncate as such that the first and last block with the same data is shown
// but the blocks in between are replaced with a single line of "......" if dense_output is enabled // but the blocks in between are replaced with a single line of "......" if dense_output is enabled
if ( dense_output && if (dense_output &&
(i > 6) && (i > 6) &&
(i < (blocks - 1)) && (i < (blocks - 1)) &&
(in_repeated_block == false) && (in_repeated_block == false) &&

View file

@ -519,7 +519,7 @@ static const xerox_part_t xerox_part_mappings[] = {
static const xerox_part_t *get_xerox_part_info(const char *pn) { static const xerox_part_t *get_xerox_part_info(const char *pn) {
for (int i = 0; i < ARRAYLEN(xerox_part_mappings); i++) { for (int i = 0; i < ARRAYLEN(xerox_part_mappings); i++) {
// Todo: make str_startswith, accept additional "Maximum number of characters to compare" // Todo: make str_startswith, accept additional "Maximum number of characters to compare"
if(strncmp(pn, xerox_part_mappings[i].partnumber, strlen(pn)-3) == 0){ if (strncmp(pn, xerox_part_mappings[i].partnumber, strlen(pn) - 3) == 0) {
return &xerox_part_mappings[i]; return &xerox_part_mappings[i];
} }
} }
@ -911,7 +911,7 @@ static int CmdHFXeroxDump(const char *Cmd) {
, (decrypt) ? "-dump-dec" : "-dump" , (decrypt) ? "-dump-dec" : "-dump"
, card.uidlen , card.uidlen
); );
} }
pm3_save_dump(filename, data, blockno * XEROX_BLOCK_SIZE, jsf14b_v2); pm3_save_dump(filename, data, blockno * XEROX_BLOCK_SIZE, jsf14b_v2);
return PM3_SUCCESS; return PM3_SUCCESS;

View file

@ -674,7 +674,7 @@ static void printEM4x05config(em_tech_type_t card_type, uint32_t wordData) {
PrintAndLogEx(INFO, "Default read..... " _YELLOW_("%u") " blocks", numblks); PrintAndLogEx(INFO, "Default read..... " _YELLOW_("%u") " blocks", numblks);
PrintAndLogEx(INFO, "Last word read... " _YELLOW_("%u") " th block", LWR); PrintAndLogEx(INFO, "Last word read... " _YELLOW_("%u") " th block", LWR);
uint8_t bits[32+1] = {0}; uint8_t bits[32 + 1] = {0};
num_to_bytebitsLSBF(wordData, 32, bits); num_to_bytebitsLSBF(wordData, 32, bits);
const char *bs = sprint_bytebits_bin(bits, 32); const char *bs = sprint_bytebits_bin(bits, 32);
@ -693,13 +693,13 @@ static void printEM4x05config(em_tech_type_t card_type, uint32_t wordData) {
if (card_type == EM_4369 || card_type == EM_4469) { if (card_type == EM_4369 || card_type == EM_4469) {
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 10, 2, cf)); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 10, 2, cf));
} else { } else {
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin( (PSKcf) ? C_RED : C_NONE, bs, 32, 10, 2, "Must be 0")); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin((PSKcf) ? C_RED : C_NONE, bs, 32, 10, 2, "Must be 0"));
} }
if (card_type == EM_4305) { if (card_type == EM_4305) {
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 12, 2, "Delayed ON")); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 12, 2, "Delayed ON"));
} else { } else {
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin( (delay) ? C_RED : C_NONE, bs, 32, 12, 2, "Must be 0")); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin((delay) ? C_RED : C_NONE, bs, 32, 12, 2, "Must be 0"));
} }
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 14, 4, "LWR, Last default read word ")); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 14, 4, "LWR, Last default read word "));
@ -717,7 +717,7 @@ static void printEM4x05config(em_tech_type_t card_type, uint32_t wordData) {
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_GREEN, bs, 32, 19, 1, "Read HK, not required")); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_GREEN, bs, 32, 19, 1, "Read HK, not required"));
} }
} else { } else {
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin( (readHKL) ? C_RED : C_NONE, bs, 32, 19, 1, "Must be 0")); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin((readHKL) ? C_RED : C_NONE, bs, 32, 19, 1, "Must be 0"));
} }
if (writeLogin) { if (writeLogin) {
@ -733,7 +733,7 @@ static void printEM4x05config(em_tech_type_t card_type, uint32_t wordData) {
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 21, 1, "Write HK, login not required")); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 21, 1, "Write HK, login not required"));
} }
} else { } else {
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin( (writeHKL) ? C_RED : C_NONE, bs, 32, 21, 1, "Must be 0")); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin((writeHKL) ? C_RED : C_NONE, bs, 32, 21, 1, "Must be 0"));
} }
if (card_type == EM_4369 || card_type == EM_4469) { if (card_type == EM_4369 || card_type == EM_4469) {
@ -743,7 +743,7 @@ static void printEM4x05config(em_tech_type_t card_type, uint32_t wordData) {
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 22, 1, "Read after write is OFF")); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 22, 1, "Read after write is OFF"));
} }
} else { } else {
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin( (raw) ? C_RED : C_NONE, bs, 32, 22, 1, "Must be 0")); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin((raw) ? C_RED : C_NONE, bs, 32, 22, 1, "Must be 0"));
} }
if (disable) { if (disable) {
@ -765,7 +765,7 @@ static void printEM4x05config(em_tech_type_t card_type, uint32_t wordData) {
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 25, 1, "Invert data? no")); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 25, 1, "Invert data? no"));
} }
} else { } else {
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin( (invert) ? C_RED : C_NONE, bs, 32, 25, 1, "Must be 0")); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin((invert) ? C_RED : C_NONE, bs, 32, 25, 1, "Must be 0"));
} }
if (card_type == EM_4305) { if (card_type == EM_4305) {
@ -775,7 +775,7 @@ static void printEM4x05config(em_tech_type_t card_type, uint32_t wordData) {
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 26, 1, "Pigeon mode disabled")); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 26, 1, "Pigeon mode disabled"));
} }
} else { } else {
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin( (pigeon) ? C_RED : C_NONE, bs, 32, 26, 1, "Must be 0")); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin((pigeon) ? C_RED : C_NONE, bs, 32, 26, 1, "Must be 0"));
} }
PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 27, 5, "RFU, Reserved for future use")); PrintAndLogEx(INFO, "%s", sprint_breakdown_bin(C_NONE, bs, 32, 27, 5, "RFU, Reserved for future use"));
@ -883,10 +883,10 @@ static void em4x05_print_blocks(uint32_t cardtype, uint8_t *data, uint8_t dlen)
return; return;
} }
uint32_t *d = (uint32_t*)data; uint32_t *d = (uint32_t *)data;
uint8_t i; uint8_t i;
for (i = 0; i< (dlen >> 2); i++) { for (i = 0; i < (dlen >> 2); i++) {
d[i] = BSWAP_32(d[i]); d[i] = BSWAP_32(d[i]);
} }
i = 0; i = 0;
@ -926,7 +926,7 @@ static void em4x05_print_blocks(uint32_t cardtype, uint8_t *data, uint8_t dlen)
, (got_lock_bits) ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?") , (got_lock_bits) ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?")
, em4x05_annotation[i] , em4x05_annotation[i]
); );
} else if ( i == EM_CONFIG_BLOCK) { } else if (i == EM_CONFIG_BLOCK) {
PrintAndLogEx(INFO, " %02u | " _YELLOW_("%08X") " | %s | %s | " _YELLOW_("%s") PrintAndLogEx(INFO, " %02u | " _YELLOW_("%08X") " | %s | %s | " _YELLOW_("%s")
, i , i
, d[i] , d[i]
@ -1017,7 +1017,7 @@ static void em4x05_print_blocks(uint32_t cardtype, uint8_t *data, uint8_t dlen)
, (got_lock_bits) ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?") , (got_lock_bits) ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?")
, em4x69_annotation[i] , em4x69_annotation[i]
); );
} else if ( i == EM_CONFIG_BLOCK) { } else if (i == EM_CONFIG_BLOCK) {
PrintAndLogEx(INFO, " %02u | " _YELLOW_("%08X") " | %s | %s | " _YELLOW_("%s") PrintAndLogEx(INFO, " %02u | " _YELLOW_("%08X") " | %s | %s | " _YELLOW_("%s")
, i , i
, d[i] , d[i]

View file

@ -578,6 +578,7 @@ const static vocabulary_t vocabulary[] = {
{ 0, "lf em 4x05 read" }, { 0, "lf em 4x05 read" },
{ 1, "lf em 4x05 sniff" }, { 1, "lf em 4x05 sniff" },
{ 0, "lf em 4x05 unlock" }, { 0, "lf em 4x05 unlock" },
{ 1, "lf em 4x05 view" },
{ 0, "lf em 4x05 wipe" }, { 0, "lf em 4x05 wipe" },
{ 0, "lf em 4x05 write" }, { 0, "lf em 4x05 write" },
{ 1, "lf em 4x50 help" }, { 1, "lf em 4x50 help" },

View file

@ -558,7 +558,7 @@ char *sprint_ascii(const uint8_t *data, const size_t len) {
return sprint_ascii_ex(data, len, 0); return sprint_ascii_ex(data, len, 0);
} }
char *sprint_breakdown_bin(color_t color, const char* bs, int width, int padn, int bits, const char* msg) { char *sprint_breakdown_bin(color_t color, const char *bs, int width, int padn, int bits, const char *msg) {
if (bs == NULL || width > 32) { if (bs == NULL || width > 32) {
return NULL; return NULL;

View file

@ -88,7 +88,7 @@ char *sprint_hex_ascii(const uint8_t *data, const size_t len);
char *sprint_ascii(const uint8_t *data, const size_t len); char *sprint_ascii(const uint8_t *data, const size_t len);
char *sprint_ascii_ex(const uint8_t *data, const size_t len, const size_t min_str_len); char *sprint_ascii_ex(const uint8_t *data, const size_t len, const size_t min_str_len);
char *sprint_breakdown_bin(color_t color, const char* bs, int width, int padn, int bits, const char* msg); char *sprint_breakdown_bin(color_t color, const char *bs, int width, int padn, int bits, const char *msg);
void print_buffer_with_offset(const uint8_t *data, const size_t len, int offset, bool print_header); void print_buffer_with_offset(const uint8_t *data, const size_t len, int offset, bool print_header);
void print_buffer(const uint8_t *data, const size_t len, int level); void print_buffer(const uint8_t *data, const size_t len, int level);

View file

@ -228,16 +228,16 @@ int smart_generator_nibble_sequence(generator_context_t *ctx) {
// also with offsets - A1A2A3, A2A3A4, etc // also with offsets - A1A2A3, A2A3A4, etc
// counter1 is high nibble (A, B, C), counter2 is low nibble (0,1, etc) // counter1 is high nibble (A, B, C), counter2 is low nibble (0,1, etc)
if(ctx->counter1 == 0){ // init values on first generator call if (ctx->counter1 == 0) { // init values on first generator call
ctx->counter1 = 0x0A; ctx->counter1 = 0x0A;
} }
uint8_t key_byte; uint8_t key_byte;
// we substract %2 value because max_offset must be even number // we substract %2 value because max_offset must be even number
uint8_t max_offset = 10 - (ctx->key_length / 2) - (ctx->key_length/2) % 2; uint8_t max_offset = 10 - (ctx->key_length / 2) - (ctx->key_length / 2) % 2;
if(ctx->counter1 == 0x10){ if (ctx->counter1 == 0x10) {
return BF_GENERATOR_END; return BF_GENERATOR_END;
} }
@ -245,13 +245,13 @@ int smart_generator_nibble_sequence(generator_context_t *ctx) {
for (key_byte = 0; key_byte < ctx->key_length; key_byte++) { for (key_byte = 0; key_byte < ctx->key_length; key_byte++) {
ctx->current_key |= (uint64_t) ctx->counter1 << (((ctx->key_length - key_byte - 1) * 8) + 4); ctx->current_key |= (uint64_t) ctx->counter1 << (((ctx->key_length - key_byte - 1) * 8) + 4);
ctx->current_key |= (uint64_t) (key_byte + ctx->counter2) %10 << ((ctx->key_length - key_byte - 1) * 8); ctx->current_key |= (uint64_t)(key_byte + ctx->counter2) % 10 << ((ctx->key_length - key_byte - 1) * 8);
} }
// counter 2 is the offset // counter 2 is the offset
ctx->counter2++; ctx->counter2++;
if(ctx->counter2 == max_offset){ if (ctx->counter2 == max_offset) {
ctx->counter2 = 0; ctx->counter2 = 0;
ctx->counter1++; ctx->counter1++;
} }

View file

@ -37,7 +37,7 @@ static void CONSTRUCTOR init_lut(void) {
for (uint32_t i = 0; i < 1 << 20; ++i) { for (uint32_t i = 0; i < 1 << 20; ++i) {
filterlut[i] = filter(i); filterlut[i] = filter(i);
} }
for (uint32_t i = 0; i < 0x10E100A; i++) { for (uint32_t i = 0; i < 0x10E100A; i++) {
uc_evenparity32_lut[i] = evenparity32(i); uc_evenparity32_lut[i] = evenparity32(i);
@ -47,7 +47,7 @@ static void CONSTRUCTOR init_lut(void) {
// MSVC // MSVC
#if defined _MSC_VER #if defined _MSC_VER
typedef void(__cdecl* PF)(void); typedef void(__cdecl *PF)(void);
#pragma section(".CRT$XCG", read) #pragma section(".CRT$XCG", read)
__declspec(allocate(".CRT$XCG")) PF f[] = { init_lut }; __declspec(allocate(".CRT$XCG")) PF f[] = { init_lut };
@ -79,16 +79,14 @@ static inline void extend_table(uint32_t *tbl, uint32_t **end, int bit, int m1,
*tbl |= tbl_filter ^ bit; *tbl |= tbl_filter ^ bit;
update_contribution(tbl, m1, m2); update_contribution(tbl, m1, m2);
*tbl ^= in; *tbl ^= in;
} } else if (tbl_filter == bit) {
else if (tbl_filter == bit) {
*++*end = tbl[1]; *++*end = tbl[1];
tbl[1] = tbl[0] | 1; tbl[1] = tbl[0] | 1;
update_contribution(tbl, m1, m2); update_contribution(tbl, m1, m2);
*tbl++ ^= in; *tbl++ ^= in;
update_contribution(tbl, m1, m2); update_contribution(tbl, m1, m2);
*tbl ^= in; *tbl ^= in;
} } else
else
*tbl-- = *(*end)--; *tbl-- = *(*end)--;
} }
} }
@ -102,12 +100,10 @@ static inline void extend_table_simple(uint32_t *tbl, uint32_t **end, int bit) {
tbl_filter = filter(*tbl); tbl_filter = filter(*tbl);
if (tbl_filter ^ filter(*tbl | 1)) { // replace if (tbl_filter ^ filter(*tbl | 1)) { // replace
*tbl |= tbl_filter ^ bit; *tbl |= tbl_filter ^ bit;
} } else if (tbl_filter == bit) { // insert
else if (tbl_filter == bit) { // insert
*++*end = *++tbl; *++*end = *++tbl;
*tbl = tbl[-1] | 1; *tbl = tbl[-1] | 1;
} } else { // drop
else { // drop
*tbl-- = *(*end)--; *tbl-- = *(*end)--;
} }
} }

View file

@ -1277,21 +1277,21 @@
"offline": false, "offline": false,
"options": [ "options": [
"-h, --help This help", "-h, --help This help",
"-a active signal field ON without select", "-a Active signal field ON without select",
"-b <dec> number of bits to send. Useful for send partial byte", "-c Calculate and append CRC",
"-c calculate and append CRC", "-k Keep signal field ON after receive",
"-k keep signal field ON after receive",
"-3 ISO14443-3 select only (skip RATS)", "-3 ISO14443-3 select only (skip RATS)",
"-r do not read response", "-r Do not read response",
"-s active signal field ON with select", "-s Active signal field ON with select",
"-t, --timeout <ms> timeout in milliseconds", "-t, --timeout <ms> Timeout in milliseconds",
"-b <dec> Number of bits to send. Useful for send partial byte",
"-v, --verbose Verbose output", "-v, --verbose Verbose output",
"--topaz use Topaz protocol to send command", "--ecp Use enhanced contactless polling",
"--ecp use enhanced contactless polling", "--mag Use Apple magsafe polling",
"--mag use Apple magsafe polling", "--topaz Use Topaz protocol to send command",
"<hex> raw bytes to send" "<hex> Raw bytes to send"
], ],
"usage": "hf 14a raw [-hack3rsv] [-b <dec>] [-t <ms>] [--topaz] [--ecp] [--mag] <hex> [<hex>]..." "usage": "hf 14a raw [-hack3rsv] [-t <ms>] [-b <dec>] [--ecp] [--mag] [--topaz] <hex> [<hex>]..."
}, },
"hf 14a reader": { "hf 14a reader": {
"command": "hf 14a reader", "command": "hf 14a reader",
@ -1450,7 +1450,7 @@
}, },
"hf 14b raw": { "hf 14b raw": {
"command": "hf 14b raw", "command": "hf 14b raw",
"description": "Sends raw bytes to card", "description": "Sends raw bytes to card. Activates field by default",
"notes": [ "notes": [
"hf 14b raw -cks --data 0200a40400 -> standard select, apdu 0200a4000 (7816)", "hf 14b raw -cks --data 0200a40400 -> standard select, apdu 0200a4000 (7816)",
"hf 14b raw -ck --sr --data 0200a40400 -> SRx select", "hf 14b raw -ck --sr --data 0200a40400 -> SRx select",
@ -1459,18 +1459,20 @@
"offline": false, "offline": false,
"options": [ "options": [
"-h, --help This help", "-h, --help This help",
"-k, --keep leave the signal field ON after receive response", "-a active signal field ON without select",
"-s, --std activate field, use ISO14B select",
"--sr activate field, use SRx ST select",
"--cts activate field, use ASK C-ticket select",
"--xrx activate field, use Fuji/Xerox select",
"-c, --crc calculate and append CRC", "-c, --crc calculate and append CRC",
"-k, --keep leave the signal field ON after receive response",
"-d, --data <hex> data, bytes to send",
"-r do not read response from card", "-r do not read response from card",
"-t, --timeout <dec> timeout in ms", "-t, --timeout <dec> timeout in ms",
"-v, --verbose verbose output", "-s, --std use ISO14B select",
"-d, --data <hex> data, bytes to send" "--sr use SRx ST select",
"--cts use ASK C-ticket select",
"--xrx use Fuji/Xerox select",
"--pico use Picopass select",
"-v, --verbose verbose output"
], ],
"usage": "hf 14b raw [-hkscrv] [--sr] [--cts] [--xrx] [-t <dec>] [-d <hex>]" "usage": "hf 14b raw [-hackrsv] [-d <hex>] [-t <dec>] [--sr] [--cts] [--xrx] [--pico]"
}, },
"hf 14b rdbl": { "hf 14b rdbl": {
"command": "hf 14b rdbl", "command": "hf 14b rdbl",
@ -1659,9 +1661,10 @@
"options": [ "options": [
"-h, --help This help", "-h, --help This help",
"-b, --blocksize <dec> block size (def 4)", "-b, --blocksize <dec> block size (def 4)",
"-c, --count <dec> number of blocks to display (def all)" "-c, --count <dec> number of blocks to display (def all)",
"-z, --dense dense dump output style"
], ],
"usage": "hf 15 eview [-h] [-b <dec>] [-c <dec>]" "usage": "hf 15 eview [-hz] [-b <dec>] [-c <dec>]"
}, },
"hf 15 findafi": { "hf 15 findafi": {
"command": "hf 15 findafi", "command": "hf 15 findafi",
@ -1748,21 +1751,21 @@
"command": "hf 15 raw", "command": "hf 15 raw",
"description": "Sends raw bytes over ISO-15693 to card", "description": "Sends raw bytes over ISO-15693 to card",
"notes": [ "notes": [
"hf 15 raw -sc -d 260100 -> add crc", "hf 15 raw -ac -d 260100 -> activate, add crc",
"hf 15 raw -skrc -d 260100 -> add crc, keep field on, skip response" "hf 15 raw -akrc -d 260100 -> activate, add crc, keep field on, skip response"
], ],
"offline": false, "offline": false,
"options": [ "options": [
"-h, --help This help", "-h, --help This help",
"-2 use slower '1 out of 256' mode", "-a activate field",
"-c, --crc calculate and append CRC", "-c, --crc calculate and append CRC",
"-k keep signal field ON after receive", "-k keep signal field ON after receive",
"-2 use slower '1 out of 256' mode",
"-r do not read response", "-r do not read response",
"-d, --data <hex> raw bytes to send", "-d, --data <hex> raw bytes to send",
"-w, --wait wait longer for response. For writes etc.", "-w, --wait wait longer for response. For writes etc."
"-a activate field"
], ],
"usage": "hf 15 raw [-h2ckrwa] -d <hex>" "usage": "hf 15 raw [-hack2rw] -d <hex>"
}, },
"hf 15 rdbl": { "hf 15 rdbl": {
"command": "hf 15 rdbl", "command": "hf 15 rdbl",
@ -1958,9 +1961,10 @@
"offline": true, "offline": true,
"options": [ "options": [
"-h, --help This help", "-h, --help This help",
"-f, --file <fn> Specify a filename for dump file" "-f, --file <fn> Specify a filename for dump file",
"-z, --dense dense dump output style"
], ],
"usage": "hf 15 view [-h] -f <fn>" "usage": "hf 15 view [-hz] -f <fn>"
}, },
"hf 15 wipe": { "hf 15 wipe": {
"command": "hf 15 wipe", "command": "hf 15 wipe",
@ -4084,6 +4088,29 @@
], ],
"usage": "hf mf autopwn [-hablv] [-k <hex>]... [-s <dec>] [-f <fn>] [--slow] [--mini] [--1k] [--2k] [--4k] [--in] [--im] [--is] [--ia] [--i2] [--i5]" "usage": "hf mf autopwn [-hablv] [-k <hex>]... [-s <dec>] [-f <fn>] [--slow] [--mini] [--1k] [--2k] [--4k] [--in] [--im] [--is] [--ia] [--i2] [--i5]"
}, },
"hf mf brute": {
"command": "hf mf brute",
"description": "This is a smart bruteforce, exploiting common patterns, bugs and bad designs in key generators.",
"notes": [
"hf mf brute --mini -> Key recovery against MIFARE Mini",
"hf mf brute --1k -> Key recovery against MIFARE Classic 1k",
"hf mf brute --2k -> Key recovery against MIFARE 2k",
"hf mf brute --4k -> Key recovery against MIFARE 4k",
"hf mf brute --1k --emu -> Target 1K, write keys to emulator memory",
"hf mf brute --1k --dump -> Target 1K, write keys to file"
],
"offline": false,
"options": [
"-h, --help This help",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (default)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"--emu Fill simulator keys from found keys",
"--dump Dump found keys to binary file"
],
"usage": "hf mf brute [-h] [--mini] [--1k] [--2k] [--4k] [--emu] [--dump]"
},
"hf mf cgetblk": { "hf mf cgetblk": {
"command": "hf mf cgetblk", "command": "hf mf cgetblk",
"description": "Get block data from magic Chinese card. Only works with magic gen1a cards", "description": "Get block data from magic Chinese card. Only works with magic gen1a cards",
@ -4154,9 +4181,13 @@
"options": [ "options": [
"-h, --help This help", "-h, --help This help",
"-f, --file <fn> Specify a filename for dump file", "-f, --file <fn> Specify a filename for dump file",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"--emu from emulator memory" "--emu from emulator memory"
], ],
"usage": "hf mf cload [-h] [-f <fn>] [--emu]" "usage": "hf mf cload [-h] [-f <fn>] [--mini] [--1k] [--2k] [--4k] [--emu]"
}, },
"hf mf csave": { "hf mf csave": {
"command": "hf mf csave", "command": "hf mf csave",
@ -8304,7 +8335,7 @@
}, },
"lf em 4x05 help": { "lf em 4x05 help": {
"command": "lf em 4x05 help", "command": "lf em 4x05 help",
"description": "help This help demod Demodulate a EM4x05/EM4x69 tag from the GraphBuffer sniff Attempt to recover em4x05 commands from sample buffer --------------------------------------------------------------------------------------- lf em 4x05 brute available offline: no This command tries to bruteforce the password of a EM4205/4305/4469/4569 The loop is running on device side, press Proxmark3 button to abort", "description": "help This help ----------- ----------------------- general ----------------------- demod Demodulate a EM4x05/EM4x69 tag from the GraphBuffer sniff Attempt to recover em4x05 commands from sample buffer view Display content from tag dump file --------------------------------------------------------------------------------------- lf em 4x05 brute available offline: no This command tries to bruteforce the password of a EM4205/4305/4469/4569 The loop is running on device side, press Proxmark3 button to abort",
"notes": [ "notes": [
"Note: if you get many false positives, change position on the antennalf em 4x05 brute", "Note: if you get many false positives, change position on the antennalf em 4x05 brute",
"lf em 4x05 brute -n 1 -> stop after first candidate found", "lf em 4x05 brute -n 1 -> stop after first candidate found",
@ -8328,9 +8359,10 @@
"offline": false, "offline": false,
"options": [ "options": [
"-h, --help This help", "-h, --help This help",
"-p, --pwd <hex> optional - password, 4 hex bytes" "-p, --pwd <hex> optional - password, 4 hex bytes",
"-v, --verbose Verbose output"
], ],
"usage": "lf em 4x05 info [-h] [-p <hex>]" "usage": "lf em 4x05 info [-hv] [-p <hex>]"
}, },
"lf em 4x05 read": { "lf em 4x05 read": {
"command": "lf em 4x05 read", "command": "lf em 4x05 read",
@ -8382,6 +8414,20 @@
], ],
"usage": "lf em 4x05 unlock [-hv] [-n <int>] [-s <us>] [-e <us>] [-p <hex>]" "usage": "lf em 4x05 unlock [-hv] [-n <int>] [-s <us>] [-e <us>] [-p <hex>]"
}, },
"lf em 4x05 view": {
"command": "lf em 4x05 view",
"description": "Print a EM4205/4305/4369/4469 dump file (bin/eml/json) note: We don't track if password is known in current dump file formats. All zeros password block might be filler data",
"notes": [
"lf em 4x05 view -f lf-4x05-01020304-dump.json"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-v, --verbose Verbose output"
],
"usage": "lf em ex05 view [-hv] -f <fn>"
},
"lf em 4x05 wipe": { "lf em 4x05 wipe": {
"command": "lf em 4x05 wipe", "command": "lf em 4x05 wipe",
"description": "Wipe EM4x05/EM4x69. Tag must be on antenna.", "description": "Wipe EM4x05/EM4x69. Tag must be on antenna.",
@ -8494,12 +8540,13 @@
"description": "help This help ----------- --------------------- operations --------------------- ----------- --------------------- simulation --------------------- --------------------------------------------------------------------------------------- lf em 4x50 brute available offline: no Tries to bruteforce the password of a EM4x50 card. Function can be stopped by pressing pm3 button.", "description": "help This help ----------- --------------------- operations --------------------- ----------- --------------------- simulation --------------------- --------------------------------------------------------------------------------------- lf em 4x50 brute available offline: no Tries to bruteforce the password of a EM4x50 card. Function can be stopped by pressing pm3 button.",
"notes": [ "notes": [
"lf em 4x50 brute --mode range --begin 12330000 --end 12340000 -> tries pwds from 0x12330000 to 0x12340000", "lf em 4x50 brute --mode range --begin 12330000 --end 12340000 -> tries pwds from 0x12330000 to 0x12340000",
"lf em 4x50 brute --mode charset --digits --uppercase -> tries all combinations of ASCII codes for digits and uppercase letters" "lf em 4x50 brute --mode charset --digits --uppercase -> tries all combinations of ASCII codes for digits and uppercase letters",
"lf em 4x50 brute --mode smart -> enable 'smart' pattern key cracking"
], ],
"offline": true, "offline": true,
"options": [ "options": [
"-h, --help This help", "-h, --help This help",
"--mode <str> Bruteforce mode (range|charset)", "--mode <str> Bruteforce mode (range|charset|smart)",
"--begin <hex> Range mode - start of the key range", "--begin <hex> Range mode - start of the key range",
"--end <hex> Range mode - end of the key range", "--end <hex> Range mode - end of the key range",
"--digits Charset mode - include ASCII codes for digits", "--digits Charset mode - include ASCII codes for digits",
@ -8763,9 +8810,10 @@
"--err <dec> maximum allowed errors (default 100)", "--err <dec> maximum allowed errors (default 100)",
"--len <dec> maximum length", "--len <dec> maximum length",
"-i, --invert invert output", "-i, --invert invert output",
"-a, --amp amplify signal" "-a, --amp amplify signal",
"--bin <bin> Binary string i.e 0001001001"
], ],
"usage": "lf em 410x demod [-hia] [--clk <dec>] [--err <dec>] [--len <dec>]" "usage": "lf em 410x demod [-hia] [--clk <dec>] [--err <dec>] [--len <dec>] [--bin <bin>]"
}, },
"lf fdxb clone": { "lf fdxb clone": {
"command": "lf fdxb clone", "command": "lf fdxb clone",
@ -9304,13 +9352,15 @@
"command": "lf idteck help", "command": "lf idteck help",
"description": "help This help demod demodulate an Idteck tag from the GraphBuffer --------------------------------------------------------------------------------------- lf idteck demod available offline: yes Try to find Idteck preamble, if found decode / descramble data", "description": "help This help demod demodulate an Idteck tag from the GraphBuffer --------------------------------------------------------------------------------------- lf idteck demod available offline: yes Try to find Idteck preamble, if found decode / descramble data",
"notes": [ "notes": [
"lf idteck demod" "lf idteck demod",
"lf idteck demod --raw 4944544B351FBE4B"
], ],
"offline": true, "offline": true,
"options": [ "options": [
"-h, --help This help" "-h, --help This help",
"-r, --raw <hex> raw bytes"
], ],
"usage": "lf idteck demod [-h]" "usage": "lf idteck demod [-h] [-r <hex>]"
}, },
"lf idteck reader": { "lf idteck reader": {
"command": "lf idteck reader", "command": "lf idteck reader",
@ -12240,8 +12290,8 @@
} }
}, },
"metadata": { "metadata": {
"commands_extracted": 707, "commands_extracted": 709,
"extracted_by": "PM3Help2JSON v1.00", "extracted_by": "PM3Help2JSON v1.00",
"extracted_on": "2024-01-16T12:52:56" "extracted_on": "2024-01-18T15:39:50"
} }
} }

View file

@ -909,6 +909,7 @@ Check column "offline" for their availability.
|`lf em 4x05 read `|N |`Read word data from EM4x05/EM4x69` |`lf em 4x05 read `|N |`Read word data from EM4x05/EM4x69`
|`lf em 4x05 sniff `|Y |`Attempt to recover em4x05 commands from sample buffer` |`lf em 4x05 sniff `|Y |`Attempt to recover em4x05 commands from sample buffer`
|`lf em 4x05 unlock `|N |`Execute tear off against EM4x05/EM4x69` |`lf em 4x05 unlock `|N |`Execute tear off against EM4x05/EM4x69`
|`lf em 4x05 view `|Y |`Display content from tag dump file`
|`lf em 4x05 wipe `|N |`Wipe EM4x05/EM4x69 tag` |`lf em 4x05 wipe `|N |`Wipe EM4x05/EM4x69 tag`
|`lf em 4x05 write `|N |`Write word data to EM4x05/EM4x69` |`lf em 4x05 write `|N |`Write word data to EM4x05/EM4x69`