mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2025-08-19 21:03:48 -07:00
Merge branch 'master' into mf-supercard
Signed-off-by: AloneLiberty <111039319+AloneLiberty@users.noreply.github.com>
This commit is contained in:
commit
2b248e03e8
8 changed files with 180 additions and 91 deletions
|
@ -4,6 +4,8 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
|||
|
||||
## [unreleased][unreleased]
|
||||
- Changed `hf mf supercard` - Support editing UID and recovery of keys from second generation card (@AloneLiberty)
|
||||
- Added iClass credit key to default iClass key table and reorganized key order (@GuruSteve)
|
||||
- Changed `hf mf value` - ability to use transfer on different block (@AloneLiberty)
|
||||
- Change `hf mf dump --ns` - dump command now supports `no save` of MFC card memory (@iceman1001)
|
||||
- Added `hf mf gdmsetcfg` - Supprt Gen4 GDM write configuration block (@iceman1001)
|
||||
- Added `hf mf gdmcfg` - Support Gen4 GDM read configuration block (@iceman1001)
|
||||
|
|
|
@ -1584,7 +1584,7 @@ static void PacketReceived(PacketCommandNG *packet) {
|
|||
break;
|
||||
}
|
||||
case CMD_HF_MIFARE_VALUE: {
|
||||
MifareValue(packet->oldarg[0], packet->oldarg[1], packet->data.asBytes);
|
||||
MifareValue(packet->oldarg[0], packet->oldarg[1], packet->oldarg[2], packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
case CMD_HF_MIFAREU_WRITEBL: {
|
||||
|
|
|
@ -1053,6 +1053,30 @@ bool SimulateIso14443aInit(uint8_t tagType, uint16_t flags, uint8_t *data, tag_r
|
|||
// some first pages of UL/NTAG dump is special data
|
||||
mfu_dump_t *mfu_header = (mfu_dump_t *) BigBuf_get_EM_addr();
|
||||
*pages = MAX(mfu_header->pages, 15);
|
||||
|
||||
// counters and tearing flags
|
||||
// for old dumps with all zero headers, we need to set default values.
|
||||
for (uint8_t i = 0; i < 3; i++) {
|
||||
|
||||
counters[i] = le24toh(mfu_header->counter_tearing[i]);
|
||||
|
||||
if (mfu_header->counter_tearing[i][3] != 0x00) {
|
||||
tearings[i] = mfu_header->counter_tearing[i][3];
|
||||
}
|
||||
}
|
||||
|
||||
// GET_VERSION
|
||||
if (memcmp(mfu_header->version, "\x00\x00\x00\x00\x00\x00\x00\x00", 8) == 0) {
|
||||
memcpy(rVERSION, "\x00\x04\x04\x02\x01\x00\x11\x03", 8);
|
||||
} else {
|
||||
memcpy(rVERSION, mfu_header->version, 8);
|
||||
}
|
||||
AddCrc14A(rVERSION, sizeof(rVERSION) - 2);
|
||||
|
||||
// READ_SIG
|
||||
memcpy(rSIGN, mfu_header->signature, 32);
|
||||
AddCrc14A(rSIGN, sizeof(rSIGN) - 2);
|
||||
|
||||
}
|
||||
break;
|
||||
case 3: { // MIFARE DESFire
|
||||
|
@ -2577,7 +2601,7 @@ int iso14443a_select_cardEx(uint8_t *uid_ptr, iso14a_card_select_t *p_card, uint
|
|||
uint8_t fudan_read[] = { 0x30, 0x01, 0x8B, 0xB9};
|
||||
ReaderTransmit(fudan_read, sizeof(fudan_read), NULL);
|
||||
if (!ReaderReceive(resp, resp_par)) {
|
||||
Dbprintf("Card didn't answer to select all");
|
||||
if (g_dbglevel >= DBG_INFO) Dbprintf("Card didn't answer to select all");
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
@ -2626,7 +2650,7 @@ int iso14443a_select_cardEx(uint8_t *uid_ptr, iso14a_card_select_t *p_card, uint
|
|||
// SELECT_ALL
|
||||
ReaderTransmit(sel_all, sizeof(sel_all), NULL);
|
||||
if (!ReaderReceive(resp, resp_par)) {
|
||||
Dbprintf("Card didn't answer to CL%i select all", cascade_level + 1);
|
||||
if (g_dbglevel >= DBG_INFO) Dbprintf("Card didn't answer to CL%i select all", cascade_level + 1);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
@ -2704,7 +2728,7 @@ int iso14443a_select_cardEx(uint8_t *uid_ptr, iso14a_card_select_t *p_card, uint
|
|||
|
||||
// Receive the SAK
|
||||
if (!ReaderReceive(resp, resp_par)) {
|
||||
Dbprintf("Card didn't answer to select");
|
||||
if (g_dbglevel >= DBG_INFO) Dbprintf("Card didn't answer to select");
|
||||
return 0;
|
||||
}
|
||||
sak = resp[0];
|
||||
|
|
|
@ -642,21 +642,28 @@ OUT:
|
|||
}
|
||||
|
||||
|
||||
void MifareValue(uint8_t arg0, uint8_t arg1, uint8_t *datain) {
|
||||
void MifareValue(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) {
|
||||
// params
|
||||
uint8_t blockNo = arg0;
|
||||
uint8_t keyType = arg1;
|
||||
uint8_t transferKeyType = arg2;
|
||||
uint64_t ui64Key = 0;
|
||||
uint64_t transferUi64Key = 0;
|
||||
uint8_t blockdata[16] = {0x00};
|
||||
|
||||
ui64Key = bytes_to_num(datain, 6);
|
||||
memcpy(blockdata, datain + 10, 16);
|
||||
memcpy(blockdata, datain + 11, 16);
|
||||
transferUi64Key = bytes_to_num(datain + 27, 6);
|
||||
|
||||
// variables
|
||||
uint8_t action = datain[9];
|
||||
uint8_t transferBlk = datain[10];
|
||||
bool needAuth = datain[33];
|
||||
uint8_t isOK = 0;
|
||||
uint8_t uid[10] = {0x00};
|
||||
uint32_t cuid = 0;
|
||||
uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
|
||||
uint8_t len = 0;
|
||||
struct Crypto1State mpcs = {0, 0};
|
||||
struct Crypto1State *pcs;
|
||||
pcs = &mpcs;
|
||||
|
@ -686,6 +693,21 @@ void MifareValue(uint8_t arg0, uint8_t arg1, uint8_t *datain) {
|
|||
break;
|
||||
};
|
||||
|
||||
if (needAuth) {
|
||||
// transfer to other sector
|
||||
if (mifare_classic_auth(pcs, cuid, transferBlk, transferKeyType, transferUi64Key, AUTH_NESTED)) {
|
||||
if (g_dbglevel >= DBG_ERROR) Dbprintf("Nested auth error");
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
// send transfer (commit the change)
|
||||
len = mifare_sendcmd_short(pcs, 1, MIFARE_CMD_TRANSFER, (transferBlk != 0) ? transferBlk : blockNo, receivedAnswer, NULL, NULL);
|
||||
if (len != 1 && receivedAnswer[0] != 0x0A) { // 0x0a - ACK
|
||||
if (g_dbglevel >= DBG_ERROR) Dbprintf("Cmd Error in transfer: %02x", receivedAnswer[0]);
|
||||
break;
|
||||
}
|
||||
|
||||
if (mifare_classic_halt(pcs, cuid)) {
|
||||
if (g_dbglevel >= DBG_ERROR) Dbprintf("Halt error");
|
||||
break;
|
||||
|
@ -1334,10 +1356,13 @@ void MifareNested(uint8_t blockNo, uint8_t keyType, uint8_t targetBlockNo, uint8
|
|||
LED_C_ON();
|
||||
|
||||
// get crypted nonces for target sector
|
||||
for (i = 0; i < 2 && !isOK; i++) { // look for exactly two different nonces
|
||||
for (i = 0; ((i < 2) && (isOK == PM3_SUCCESS)); i++) {
|
||||
|
||||
// look for exactly two different nonces
|
||||
|
||||
target_nt[i] = 0;
|
||||
while (target_nt[i] == 0) { // continue until we have an unambiguous nonce
|
||||
// continue until we have an unambiguous nonce
|
||||
while (target_nt[i] == 0) {
|
||||
|
||||
// Test if the action was cancelled
|
||||
if (BUTTON_PRESS() || data_available()) {
|
||||
|
@ -1351,7 +1376,7 @@ void MifareNested(uint8_t blockNo, uint8_t keyType, uint8_t targetBlockNo, uint8
|
|||
continue;
|
||||
}
|
||||
|
||||
if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
|
||||
if (iso14443a_select_card(uid, NULL, &cuid, true, 0, true) == false) {
|
||||
if (g_dbglevel >= DBG_INFO) Dbprintf("Nested: Can't select card");
|
||||
continue;
|
||||
};
|
||||
|
@ -1430,6 +1455,7 @@ void MifareNested(uint8_t blockNo, uint8_t keyType, uint8_t targetBlockNo, uint8
|
|||
memcpy(payload.nt_b, &target_nt[1], 4);
|
||||
memcpy(payload.ks_b, &target_ks[1], 4);
|
||||
|
||||
LED_B_ON();
|
||||
reply_ng(CMD_HF_MIFARE_NESTED, PM3_SUCCESS, (uint8_t *)&payload, sizeof(payload));
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
LEDsoff();
|
||||
|
@ -1475,7 +1501,7 @@ void MifareStaticNested(uint8_t blockNo, uint8_t keyType, uint8_t targetBlockNo,
|
|||
continue;
|
||||
};
|
||||
|
||||
// first colleciton
|
||||
// first collection
|
||||
if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {
|
||||
continue;
|
||||
};
|
||||
|
@ -1497,7 +1523,7 @@ void MifareStaticNested(uint8_t blockNo, uint8_t keyType, uint8_t targetBlockNo,
|
|||
nt2 = bytes_to_num(receivedAnswer, 4);
|
||||
target_ks[0] = nt2 ^ target_nt[0];
|
||||
|
||||
// second colleciton
|
||||
// second collection
|
||||
|
||||
if (mifare_classic_halt(pcs, cuid)) {
|
||||
continue;
|
||||
|
@ -2052,7 +2078,6 @@ void MifareChkKeys(uint8_t *datain, uint8_t reserved_mem) {
|
|||
|
||||
uint64_t key = 0;
|
||||
uint32_t cuid = 0;
|
||||
int i, res;
|
||||
uint8_t cascade_levels = 0;
|
||||
struct {
|
||||
uint8_t key[6];
|
||||
|
@ -2091,12 +2116,12 @@ void MifareChkKeys(uint8_t *datain, uint8_t reserved_mem) {
|
|||
|
||||
set_tracing(false);
|
||||
|
||||
for (i = 0; i < key_count; i++) {
|
||||
for (uint16_t i = 0; i < key_count; i++) {
|
||||
|
||||
// Iceman: use piwi's faster nonce collecting part in hardnested.
|
||||
if (!have_uid) { // need a full select cycle to get the uid first
|
||||
if (have_uid == false) { // need a full select cycle to get the uid first
|
||||
iso14a_card_select_t card_info;
|
||||
if (!iso14443a_select_card(uid, &card_info, &cuid, true, 0, true)) {
|
||||
if (iso14443a_select_card(uid, &card_info, &cuid, true, 0, true) == false) {
|
||||
if (g_dbglevel >= DBG_ERROR) Dbprintf("ChkKeys: Can't select card (ALL)");
|
||||
--i; // try same key once again
|
||||
continue;
|
||||
|
@ -2116,7 +2141,7 @@ void MifareChkKeys(uint8_t *datain, uint8_t reserved_mem) {
|
|||
}
|
||||
have_uid = true;
|
||||
} else { // no need for anticollision. We can directly select the card
|
||||
if (!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels, true)) {
|
||||
if (iso14443a_select_card(uid, NULL, NULL, false, cascade_levels, true) == false) {
|
||||
if (g_dbglevel >= DBG_ERROR) Dbprintf("ChkKeys: Can't select card (UID)");
|
||||
--i; // try same key once again
|
||||
continue;
|
||||
|
@ -2124,12 +2149,10 @@ void MifareChkKeys(uint8_t *datain, uint8_t reserved_mem) {
|
|||
}
|
||||
|
||||
key = bytes_to_num(datain + i * 6, 6);
|
||||
res = mifare_classic_auth(pcs, cuid, blockNo, keyType, key, AUTH_FIRST);
|
||||
|
||||
if (mifare_classic_auth(pcs, cuid, blockNo, keyType, key, AUTH_FIRST)) {
|
||||
// CHK_TIMEOUT();
|
||||
|
||||
if (res)
|
||||
continue;
|
||||
}
|
||||
|
||||
memcpy(keyresult.key, datain + i * 6, 6);
|
||||
keyresult.found = true;
|
||||
|
@ -2137,14 +2160,12 @@ void MifareChkKeys(uint8_t *datain, uint8_t reserved_mem) {
|
|||
}
|
||||
|
||||
LED_B_ON();
|
||||
crypto1_deinit(pcs);
|
||||
|
||||
reply_ng(CMD_HF_MIFARE_CHKKEYS, PM3_SUCCESS, (uint8_t *)&keyresult, sizeof(keyresult));
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
LEDsoff();
|
||||
|
||||
set_tracing(false);
|
||||
crypto1_deinit(pcs);
|
||||
|
||||
g_dbglevel = oldbg;
|
||||
}
|
||||
|
||||
|
|
|
@ -26,7 +26,7 @@ void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes);
|
|||
void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain);
|
||||
void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t *datain);
|
||||
void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain);
|
||||
void MifareValue(uint8_t arg0, uint8_t arg1, uint8_t *datain);
|
||||
void MifareValue(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain);
|
||||
void MifareUWriteBlockCompat(uint8_t arg0, uint8_t arg1, uint8_t *datain);
|
||||
|
||||
void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain);
|
||||
|
|
|
@ -533,6 +533,8 @@ int mifare_classic_value(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo
|
|||
|
||||
if (action == 0x01)
|
||||
command = MIFARE_CMD_DEC;
|
||||
if (action == 0x02)
|
||||
command = MIFARE_CMD_RESTORE;
|
||||
|
||||
// Send increment or decrement command
|
||||
len = mifare_sendcmd_short(pcs, 1, command, blockNo, receivedAnswer, receivedAnswerPar, NULL);
|
||||
|
@ -567,13 +569,6 @@ int mifare_classic_value(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo
|
|||
if (g_dbglevel >= DBG_ERROR) Dbprintf("Cmd send data2 Error: %02x", res);
|
||||
return 2;
|
||||
}
|
||||
} else {
|
||||
// send trnasfer (commit the change)
|
||||
len = mifare_sendcmd_short(pcs, 1, MIFARE_CMD_TRANSFER, blockNo, receivedAnswer, receivedAnswerPar, NULL);
|
||||
if ((len != 1) || (receivedAnswer[0] != 0x0A)) { // 0x0a - ACK
|
||||
if (g_dbglevel >= DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
|
|
@ -63,9 +63,9 @@ static void printIclassSIO(uint8_t *iclass_dump);
|
|||
|
||||
static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
|
||||
{ 0xAE, 0xA6, 0x84, 0xA6, 0xDA, 0xB2, 0x32, 0x78 },
|
||||
{ 0x76, 0x65, 0x54, 0x43, 0x32, 0x21, 0x10, 0x00 },
|
||||
{ 0xFD, 0xCB, 0x5A, 0x52, 0xEA, 0x8F, 0x30, 0x90 },
|
||||
{ 0xF0, 0xE1, 0xD2, 0xC3, 0xB4, 0xA5, 0x96, 0x87 },
|
||||
{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
|
||||
{ 0x76, 0x65, 0x54, 0x43, 0x32, 0x21, 0x10, 0x00 },
|
||||
{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
|
||||
{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
|
||||
{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
|
||||
|
|
|
@ -7899,6 +7899,7 @@ static int CmdHF14AMfValue(const char *Cmd) {
|
|||
"hf mf value --blk 16 -k FFFFFFFFFFFF --inc 10\n"
|
||||
"hf mf value --blk 16 -k FFFFFFFFFFFF -b --dec 10\n"
|
||||
"hf mf value --blk 16 -k FFFFFFFFFFFF -b --get\n"
|
||||
"hf mf value --blk 16 -k FFFFFFFFFFFF --res --transfer 30 --tk FFFFFFFFFFFF --> transfer block 16 value to block 30 (even if block can't be incremented by ACL)\n"
|
||||
"hf mf value --get -d 87D612007829EDFF87D6120011EE11EE\n"
|
||||
);
|
||||
void *argtable[] = {
|
||||
|
@ -7906,17 +7907,22 @@ static int CmdHF14AMfValue(const char *Cmd) {
|
|||
arg_str0("k", "key", "<hex>", "key, 6 hex bytes"),
|
||||
arg_lit0("a", NULL, "input key type is key A (def)"),
|
||||
arg_lit0("b", NULL, "input key type is key B"),
|
||||
arg_u64_0(NULL, "inc", "<dec>", "Incremenet value by X (0 - 2147483647)"),
|
||||
arg_u64_0(NULL, "dec", "<dec>", "Dcrement value by X (0 - 2147483647)"),
|
||||
arg_u64_0(NULL, "inc", "<dec>", "Increment value by X (0 - 2147483647)"),
|
||||
arg_u64_0(NULL, "dec", "<dec>", "Decrement value by X (0 - 2147483647)"),
|
||||
arg_u64_0(NULL, "set", "<dec>", "Set value to X (-2147483647 - 2147483647)"),
|
||||
arg_u64_0(NULL, "transfer", "<dec>", "Transfer value to other block (after inc/dec/restore)"),
|
||||
arg_str0(NULL, "tkey", "<hex>", "transfer key, 6 hex bytes (if transfer is preformed to other sector)"),
|
||||
arg_lit0(NULL, "ta", "transfer key type is key A (def)"),
|
||||
arg_lit0(NULL, "tb", "transfer key type is key B"),
|
||||
arg_lit0(NULL, "get", "Get value from block"),
|
||||
arg_lit0(NULL, "res", "Restore (copy value to card buffer, should be used with --transfer)"),
|
||||
arg_int0(NULL, "blk", "<dec>", "block number"),
|
||||
arg_str0("d", "data", "<hex>", "block data to extract values from (16 hex bytes)"),
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
||||
|
||||
uint8_t blockno = (uint8_t)arg_get_int_def(ctx, 8, 1);
|
||||
uint8_t blockno = (uint8_t)arg_get_int_def(ctx, 13, 1);
|
||||
|
||||
uint8_t keytype = MF_KEY_A;
|
||||
if (arg_get_lit(ctx, 2) && arg_get_lit(ctx, 3)) {
|
||||
|
@ -7927,29 +7933,44 @@ static int CmdHF14AMfValue(const char *Cmd) {
|
|||
keytype = MF_KEY_B;;
|
||||
}
|
||||
|
||||
uint8_t transferkeytype = MF_KEY_A;
|
||||
if (arg_get_lit(ctx, 9) && arg_get_lit(ctx, 10)) {
|
||||
CLIParserFree(ctx);
|
||||
PrintAndLogEx(WARNING, "Input key type must be A or B");
|
||||
return PM3_EINVARG;
|
||||
} else if (arg_get_lit(ctx, 10)) {
|
||||
keytype = MF_KEY_B;;
|
||||
}
|
||||
|
||||
int keylen = 0;
|
||||
uint8_t key[6] = {0};
|
||||
CLIGetHexWithReturn(ctx, 1, key, &keylen);
|
||||
|
||||
int transferkeylen = 0;
|
||||
uint8_t transferkey[6] = {0};
|
||||
CLIGetHexWithReturn(ctx, 8, transferkey, &transferkeylen);
|
||||
|
||||
/*
|
||||
Value /Value Value BLK /BLK BLK /BLK
|
||||
00000000 FFFFFFFF 00000000 10 EF 10 EF
|
||||
BLK is used to referece where the backup come from, I suspect its just the current block for the actual value ?
|
||||
BLK is used to reference where the backup come from, I suspect it's just the current block for the actual value ?
|
||||
increment and decrement are an unsigned value
|
||||
set value is a signed value
|
||||
|
||||
We are getting signed and/or bigger values to allow a defult to be set meaning users did not supply that option.
|
||||
We are getting signed and/or bigger values to allow a default to be set meaning users did not supply that option.
|
||||
*/
|
||||
int64_t incval = (int64_t)arg_get_u64_def(ctx, 4, -1); // Inc by -1 is invalid, so not set.
|
||||
int64_t decval = (int64_t)arg_get_u64_def(ctx, 5, -1); // Inc by -1 is invalid, so not set.
|
||||
int64_t decval = (int64_t)arg_get_u64_def(ctx, 5, -1); // Dec by -1 is invalid, so not set.
|
||||
int64_t setval = (int64_t)arg_get_u64_def(ctx, 6, 0x7FFFFFFFFFFFFFFF); // out of bounds (for int32) so not set
|
||||
bool getval = arg_get_lit(ctx, 7);
|
||||
int64_t trnval = (int64_t)arg_get_u64_def(ctx, 7, -1); // block to transfer to
|
||||
bool getval = arg_get_lit(ctx, 11);
|
||||
bool resval = arg_get_lit(ctx, 12);
|
||||
int dlen = 0;
|
||||
uint8_t data[16] = {0};
|
||||
CLIGetHexWithReturn(ctx, 9, data, &dlen);
|
||||
CLIGetHexWithReturn(ctx, 14, data, &dlen);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
uint8_t action = 3; // 0 Increment, 1 - Decrement, 2 - Set, 3 - Get, 4 - Decode from data
|
||||
uint8_t action = 4; // 0 Increment, 1 - Decrement, 2 - Restore, 3 - Set, 4 - Get, 5 - Decode from data
|
||||
uint32_t value = 0;
|
||||
|
||||
// Need to check we only have 1 of inc/dec/set and get the value from the selected option
|
||||
|
@ -7977,7 +7998,7 @@ static int CmdHF14AMfValue(const char *Cmd) {
|
|||
|
||||
if (setval != 0x7FFFFFFFFFFFFFFF) {
|
||||
optionsprovided++;
|
||||
action = 2;
|
||||
action = 3;
|
||||
if ((setval < -2147483647) || (setval > 2147483647)) {
|
||||
PrintAndLogEx(WARNING, "set value must be between -2147483647 and 2147483647. Got %lli", setval);
|
||||
return PM3_EINVARG;
|
||||
|
@ -7985,9 +8006,19 @@ static int CmdHF14AMfValue(const char *Cmd) {
|
|||
value = (uint32_t)setval;
|
||||
}
|
||||
|
||||
if (resval) {
|
||||
if (trnval == -1) {
|
||||
PrintAndLogEx(WARNING, "You can't use restore without using transfer");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
optionsprovided++;
|
||||
action = 2;
|
||||
}
|
||||
|
||||
if (dlen != 0) {
|
||||
optionsprovided++;
|
||||
action = 4;
|
||||
action = 5;
|
||||
if (dlen != 16) {
|
||||
PrintAndLogEx(WARNING, "date length must be 16 hex bytes long, got %d", dlen);
|
||||
return PM3_EINVARG;
|
||||
|
@ -7999,34 +8030,52 @@ static int CmdHF14AMfValue(const char *Cmd) {
|
|||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
// dont want to write value data and break something
|
||||
if ((blockno == 0) || (mfIsSectorTrailer(blockno))) {
|
||||
PrintAndLogEx(WARNING, "invlaid block number, should be a data block ");
|
||||
if (trnval != -1 && action > 2) {
|
||||
PrintAndLogEx(WARNING, "You can't use transfer without using --inc, --dec or --res");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
if (action < 3) {
|
||||
if (trnval != -1 && transferkeylen == 0 && mfSectorNum(trnval) != mfSectorNum(blockno)) {
|
||||
PrintAndLogEx(WARNING, "Transfer is preformed to other sector, but no key for new sector provided");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
// don't want to write value data and break something
|
||||
if ((blockno == 0) || (mfIsSectorTrailer(blockno)) || (trnval == 0) || (trnval != -1 && mfIsSectorTrailer(trnval))) {
|
||||
PrintAndLogEx(WARNING, "invalid block number, should be a data block");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
if (action < 4) {
|
||||
uint8_t isok = true;
|
||||
if (g_session.pm3_present == false)
|
||||
return PM3_ENOTTY;
|
||||
|
||||
if (action <= 1) { // increment/decrement value
|
||||
// 0 Increment, 1 - Decrement, 2 - Restore, 3 - Set, 4 - Get, 5 - Decode from data
|
||||
if (action <= 2) { // increment/decrement/restore value
|
||||
uint8_t block[MFBLOCK_SIZE] = {0x00};
|
||||
memcpy(block, (uint8_t *)&value, 4);
|
||||
uint8_t cmddata[26];
|
||||
uint8_t cmddata[34];
|
||||
memcpy(cmddata, key, sizeof(key)); // Key == 6 data went to 10, so lets offset 9 for inc/dec
|
||||
if (action == 0)
|
||||
PrintAndLogEx(INFO, "value increment by : %d", value);
|
||||
else
|
||||
PrintAndLogEx(INFO, "value decrement by : %d", value);
|
||||
PrintAndLogEx(INFO, "Value incremented by : %d", value);
|
||||
if (action == 1)
|
||||
PrintAndLogEx(INFO, "Value decremented by : %d", value);
|
||||
|
||||
cmddata[9] = action; // 00 if increment, 01 if decrement, 02 if restore
|
||||
if (trnval != -1) {
|
||||
cmddata[10] = trnval; // transfer to block
|
||||
memcpy(cmddata + 27, transferkey, sizeof(transferkey));
|
||||
if (mfSectorNum(trnval) != mfSectorNum(blockno))
|
||||
cmddata[33] = 1; // should send nested auth
|
||||
PrintAndLogEx(INFO, "Transfer block no %d to block %d", blockno, trnval);
|
||||
} else {
|
||||
cmddata[10] = 0;
|
||||
PrintAndLogEx(INFO, "Writing block no %d, key %c - %s", blockno, (keytype == MF_KEY_B) ? 'B' : 'A', sprint_hex_inrow(key, sizeof(key)));
|
||||
|
||||
cmddata[9] = action; // 00 if increment, 01 if decrement.
|
||||
memcpy(cmddata + 10, block, sizeof(block));
|
||||
}
|
||||
memcpy(cmddata + 11, block, sizeof(block));
|
||||
|
||||
clearCommandBuffer();
|
||||
SendCommandMIX(CMD_HF_MIFARE_VALUE, blockno, keytype, 0, cmddata, sizeof(cmddata));
|
||||
SendCommandMIX(CMD_HF_MIFARE_VALUE, blockno, keytype, transferkeytype, cmddata, sizeof(cmddata));
|
||||
|
||||
PacketResponseNG resp;
|
||||
if (WaitForResponseTimeout(CMD_ACK, &resp, 1500) == false) {
|
||||
|
@ -8034,14 +8083,7 @@ static int CmdHF14AMfValue(const char *Cmd) {
|
|||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
if (resp.oldarg[0] & 0xFF) {
|
||||
// all ok so set flag to read current value
|
||||
getval = true;
|
||||
PrintAndLogEx(SUCCESS, "Update ( " _GREEN_("success") " )");
|
||||
} else {
|
||||
PrintAndLogEx(FAILED, "Update ( " _RED_("failed") " )");
|
||||
}
|
||||
|
||||
isok = resp.oldarg[0] & 0xff;
|
||||
} else { // set value
|
||||
// To set a value block (or setup) we can use the normal mifare classic write block
|
||||
// So build the command options can call CMD_HF_MIFARE_WRITEBL
|
||||
|
@ -8066,17 +8108,15 @@ static int CmdHF14AMfValue(const char *Cmd) {
|
|||
PrintAndLogEx(FAILED, "Command execute timeout");
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
int status = resp.oldarg[0];
|
||||
if (status) {
|
||||
// all ok so set flag to read current value
|
||||
getval = true;
|
||||
PrintAndLogEx(SUCCESS, "Update ( " _GREEN_("success") " )");
|
||||
} else if (status == PM3_ETEAROFF) {
|
||||
// all ok so set flag to read current value
|
||||
getval = true;
|
||||
} else {
|
||||
PrintAndLogEx(FAILED, "Update ( " _RED_("failed") " )");
|
||||
|
||||
isok = resp.oldarg[0] & 0xff;
|
||||
}
|
||||
|
||||
if (isok) {
|
||||
PrintAndLogEx(SUCCESS, "Update ... : " _GREEN_("success"));
|
||||
getval = true; // all ok so set flag to read current value
|
||||
} else {
|
||||
PrintAndLogEx(FAILED, "Update ... : " _RED_("failed"));
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -8085,10 +8125,17 @@ static int CmdHF14AMfValue(const char *Cmd) {
|
|||
int32_t readvalue;
|
||||
int res = -1;
|
||||
|
||||
if (action == 4) {
|
||||
res = PM3_SUCCESS; // alread have data from command line
|
||||
if (action == 5) {
|
||||
res = PM3_SUCCESS; // already have data from command line
|
||||
} else {
|
||||
if (trnval == -1) {
|
||||
res = mfReadBlock(blockno, keytype, key, data);
|
||||
} else {
|
||||
if (mfSectorNum(trnval) != mfSectorNum(blockno))
|
||||
res = mfReadBlock(trnval, transferkeytype, transferkey, data);
|
||||
else
|
||||
res = mfReadBlock(trnval, keytype, key, data);
|
||||
}
|
||||
}
|
||||
|
||||
if (res == PM3_SUCCESS) {
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue