rename: ul_switch_off_field -> DropField (inside cmdhf14a.c)

chg:  Fix memory bounds error (@wsmoses)
 c3511781a1
This commit is contained in:
iceman1001 2017-11-11 23:23:01 +01:00
commit 2f3dbbcaa3
15 changed files with 132 additions and 99 deletions

View file

@ -543,13 +543,13 @@ int CmdHFiClassELoad(const char *Cmd) {
//File handling and reading
FILE *f;
char filename[FILE_PATH_SIZE];
if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
if (opt == 'f' && param_getstr(Cmd, 1, filename, sizeof(filename)) > 0) {
f = fopen(filename, "rb");
} else {
return usage_hf_iclass_eload();
}
if(!f) {
if (!f) {
PrintAndLog("Failed to read from file '%s'", filename);
return 1;
}
@ -632,7 +632,7 @@ int CmdHFiClassDecrypt(const char *Cmd) {
//Open the tagdump-file
FILE *f;
char filename[FILE_PATH_SIZE];
if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
if(opt == 'f' && param_getstr(Cmd, 1, filename, sizeof(filename)) > 0) {
f = fopen(filename, "rb");
if (!f) {
PrintAndLog("Could not find file %s", filename);
@ -846,7 +846,7 @@ int CmdHFiClassReader_Dump(const char *Cmd) {
case 'c':
case 'C':
have_credit_key = true;
dataLen = param_getstr(Cmd, cmdp+1, tempStr);
dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
if (dataLen == 16) {
errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
} else if (dataLen == 1) {
@ -870,7 +870,7 @@ int CmdHFiClassReader_Dump(const char *Cmd) {
break;
case 'f':
case 'F':
fileNameLen = param_getstr(Cmd, cmdp+1, filename);
fileNameLen = param_getstr(Cmd, cmdp+1, filename, sizeof(filename));
if (fileNameLen < 1) {
PrintAndLog("No filename found after f");
errors = true;
@ -880,7 +880,7 @@ int CmdHFiClassReader_Dump(const char *Cmd) {
case 'k':
case 'K':
have_debit_key = true;
dataLen = param_getstr(Cmd, cmdp+1, tempStr);
dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
if (dataLen == 16) {
errors = param_gethex(tempStr, 0, KEY, dataLen);
} else if (dataLen == 1) {
@ -923,7 +923,7 @@ int CmdHFiClassReader_Dump(const char *Cmd) {
SendCommand(&c);
if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
PrintAndLog("Command execute timeout");
ul_switch_off_field();
DropField();
return 0;
}
uint8_t readStatus = resp.arg[0] & 0xff;
@ -931,7 +931,7 @@ int CmdHFiClassReader_Dump(const char *Cmd) {
if(readStatus == 0){
PrintAndLog("No tag found...");
ul_switch_off_field();
DropField();
return 0;
}
@ -943,13 +943,12 @@ int CmdHFiClassReader_Dump(const char *Cmd) {
// large memory - not able to dump pages currently
if (numblks > maxBlk) numblks = maxBlk;
}
ul_switch_off_field();
DropField();
// authenticate debit key and get div_key - later store in dump block 3
if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
//try twice - for some reason it sometimes fails the first time...
if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
ul_switch_off_field();
DropField();
return 0;
}
}
@ -960,14 +959,14 @@ int CmdHFiClassReader_Dump(const char *Cmd) {
SendCommand(&w);
if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
PrintAndLog("Command execute time-out 1");
ul_switch_off_field();
DropField();
return 1;
}
uint32_t blocksRead = resp.arg[1];
uint8_t isOK = resp.arg[0] & 0xff;
if (!isOK && !blocksRead) {
PrintAndLog("Read Block Failed");
ul_switch_off_field();
DropField();
return 0;
}
uint32_t startindex = resp.arg[2];
@ -983,13 +982,13 @@ int CmdHFiClassReader_Dump(const char *Cmd) {
// try AA2
if (have_credit_key) {
//turn off hf field before authenticating with different key
ul_switch_off_field();
DropField();
memset(MAC,0,4);
// AA2 authenticate credit key and git c_div_key - later store in dump block 4
if (!select_and_auth(CreditKEY, MAC, c_div_key, true, elite, rawkey, false)){
//try twice - for some reason it sometimes fails the first time...
if (!select_and_auth(CreditKEY, MAC, c_div_key, true, elite, rawkey, false)){
ul_switch_off_field();
DropField();
return 0;
}
}
@ -1002,14 +1001,14 @@ int CmdHFiClassReader_Dump(const char *Cmd) {
SendCommand(&w);
if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
PrintAndLog("Command execute timeout 2");
ul_switch_off_field();
DropField();
return 0;
}
uint8_t isOK = resp.arg[0] & 0xff;
blocksRead = resp.arg[1];
if (!isOK && !blocksRead) {
PrintAndLog("Read Block Failed 2");
ul_switch_off_field();
DropField();
return 0;
}
@ -1024,7 +1023,7 @@ int CmdHFiClassReader_Dump(const char *Cmd) {
gotBytes += blocksRead*8;
} else { //field is still on - turn it off...
ul_switch_off_field();
DropField();
}
}
@ -1122,7 +1121,7 @@ int CmdHFiClass_WriteBlock(const char *Cmd) {
break;
case 'k':
case 'K':
dataLen = param_getstr(Cmd, cmdp+1, tempStr);
dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
if (dataLen == 16) {
errors = param_gethex(tempStr, 0, KEY, dataLen);
} else if (dataLen == 1) {
@ -1153,7 +1152,7 @@ int CmdHFiClass_WriteBlock(const char *Cmd) {
if (errors || cmdp < 6) return usage_hf_iclass_writeblock();
int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
ul_switch_off_field();
DropField();
return ans;
}
@ -1196,7 +1195,7 @@ int CmdHFiClassCloneTag(const char *Cmd) {
break;
case 'f':
case 'F':
fileNameLen = param_getstr(Cmd, cmdp+1, filename);
fileNameLen = param_getstr(Cmd, cmdp+1, filename, sizeof(filename));
if (fileNameLen < 1) {
PrintAndLog("No filename found after f");
errors = true;
@ -1205,7 +1204,7 @@ int CmdHFiClassCloneTag(const char *Cmd) {
break;
case 'k':
case 'K':
dataLen = param_getstr(Cmd, cmdp+1, tempStr);
dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
if (dataLen == 16) {
errors = param_gethex(tempStr, 0, KEY, dataLen);
} else if (dataLen == 1) {
@ -1384,7 +1383,7 @@ int CmdHFiClass_ReadBlock(const char *Cmd) {
case 'k':
case 'K':
auth = true;
dataLen = param_getstr(Cmd, cmdp+1, tempStr);
dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
if (dataLen == 16) {
errors = param_gethex(tempStr, 0, KEY, dataLen);
} else if (dataLen == 1) {
@ -1428,7 +1427,7 @@ int CmdHFiClass_loclass(const char *Cmd) {
char fileName[FILE_PATH_SIZE] = {0};
if (opt == 'f') {
if(param_getstr(Cmd, 1, fileName) > 0) {
if (param_getstr(Cmd, 1, fileName, sizeof(fileName)) > 0) {
return bruteforceFileNoKeys(fileName);
} else {
PrintAndLog("You must specify a filename");
@ -1486,15 +1485,15 @@ int CmdHFiClassReadTagFile(const char *Cmd) {
char tempnum[5];
FILE *f;
char filename[FILE_PATH_SIZE];
if (param_getstr(Cmd, 0, filename) < 1)
if (param_getstr(Cmd, 0, filename, sizeof(filename)) < 1)
return usage_hf_iclass_readtagfile();
if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
if (param_getstr(Cmd, 1, tempnum, sizeof(tempnum)) < 1)
startblock = 0;
else
sscanf(tempnum,"%d",&startblock);
if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
if (param_getstr(Cmd,2, tempnum, sizeof(tempnum)) < 1)
endblock = 0;
else
sscanf(tempnum,"%d",&endblock);
@ -1588,7 +1587,7 @@ int CmdHFiClassCalcNewKey(const char *Cmd) {
return usage_hf_iclass_calc_newkey();
case 'e':
case 'E':
dataLen = param_getstr(Cmd, cmdp, tempStr);
dataLen = param_getstr(Cmd, cmdp, tempStr, sizeof(tempStr));
if (dataLen==2)
oldElite = true;
elite = true;
@ -1596,7 +1595,7 @@ int CmdHFiClassCalcNewKey(const char *Cmd) {
break;
case 'n':
case 'N':
dataLen = param_getstr(Cmd, cmdp+1, tempStr);
dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
if (dataLen == 16) {
errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
} else if (dataLen == 1) {
@ -1615,7 +1614,7 @@ int CmdHFiClassCalcNewKey(const char *Cmd) {
break;
case 'o':
case 'O':
dataLen = param_getstr(Cmd, cmdp+1, tempStr);
dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
if (dataLen == 16) {
errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
} else if (dataLen == 1) {
@ -1733,7 +1732,7 @@ int CmdHFiClassManageKeys(const char *Cmd) {
return usage_hf_iclass_managekeys();
case 'f':
case 'F':
fileNameLen = param_getstr(Cmd, cmdp+1, filename);
fileNameLen = param_getstr(Cmd, cmdp+1, filename, sizeof(filename));
if (fileNameLen < 1) {
PrintAndLog("No filename found after f");
errors = true;
@ -1752,7 +1751,7 @@ int CmdHFiClassManageKeys(const char *Cmd) {
case 'k':
case 'K':
operation += 3; //set key
dataLen = param_getstr(Cmd, cmdp+1, tempStr);
dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
if (dataLen == 16) { //ul-c or ev1/ntag key length
errors = param_gethex(tempStr, 0, KEY, dataLen);
} else {
@ -1819,7 +1818,7 @@ static command_t CommandTable[] = {
{"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
{"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
{"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
{"reader", CmdHFiClassReader, 0, "Act like an iClass reader"},
{"reader", CmdHFiClassReader, 0, " Act like an iClass reader"},
{"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
{"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
{"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},