mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2025-08-21 22:03:42 -07:00
Merge branch 'master' into allin
update 23.9.2020
This commit is contained in:
commit
59483e8c3b
46 changed files with 164 additions and 158 deletions
|
@ -187,7 +187,7 @@ void RunMod(void) {
|
||||||
read_successful = false;
|
read_successful = false;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
// We're skipping 14 blocks (56 bytes) here, as that "[...] has version/signature/counter data here" according to comments on dumptoemul-mfu
|
// We're skipping 14 blocks (56 bytes) here, as that "[...] has version/signature/counter data here" according to comments on hf_mfu_dumptoemulator
|
||||||
// When converting a bin, it's almost all 0 other than one 0x0F byte, and functionality seems to be unaffected if that byte is set to 0x00.
|
// When converting a bin, it's almost all 0 other than one 0x0F byte, and functionality seems to be unaffected if that byte is set to 0x00.
|
||||||
emlSetMem_xt(dataout, 14 + i, 1, 4);
|
emlSetMem_xt(dataout, 14 + i, 1, 4);
|
||||||
Dbhexdump(4, dataout, 0);
|
Dbhexdump(4, dataout, 0);
|
||||||
|
|
|
@ -15,7 +15,7 @@ The retrieved sniffing session can be acquired by connecting the device
|
||||||
to a client that supports the reconnect capability and issue 'hf 14a list'.
|
to a client that supports the reconnect capability and issue 'hf 14a list'.
|
||||||
|
|
||||||
In order to view the grabbed authentication attempts in the flash mem,
|
In order to view the grabbed authentication attempts in the flash mem,
|
||||||
you can simply run 'script run read_pwd_mem' or just 'mem dump p l 256'
|
you can simply run 'script run mem_readpwd' or just 'mem dump p l 256'
|
||||||
from the client to view the stored quadlets.
|
from the client to view the stored quadlets.
|
||||||
*/
|
*/
|
||||||
|
|
||||||
|
@ -249,5 +249,5 @@ void RunMod(void) {
|
||||||
LEDsoff();
|
LEDsoff();
|
||||||
SpinDelay(300);
|
SpinDelay(300);
|
||||||
Dbprintf("- [ End ] -> You can take shell back ...");
|
Dbprintf("- [ End ] -> You can take shell back ...");
|
||||||
Dbprintf("- [ ! ] -> use 'script run read_pwd_mem_spiffs' to print passwords");
|
Dbprintf("- [ ! ] -> use 'script run data_read_pwd_mem_spiffs' to print passwords");
|
||||||
}
|
}
|
||||||
|
|
|
@ -1363,7 +1363,8 @@ static void PacketReceived(PacketCommandNG *packet) {
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
case CMD_HF_MIFARE_CIDENT: {
|
case CMD_HF_MIFARE_CIDENT: {
|
||||||
MifareCIdent();
|
bool is_mfc = packet->data.asBytes[0];
|
||||||
|
MifareCIdent(is_mfc);
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
// Gen 3 magic cards
|
// Gen 3 magic cards
|
||||||
|
|
|
@ -2236,14 +2236,14 @@ void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain) {
|
||||||
OnSuccessMagic();
|
OnSuccessMagic();
|
||||||
}
|
}
|
||||||
|
|
||||||
void MifareCIdent(void) {
|
void MifareCIdent(bool is_mfc) {
|
||||||
// variables
|
// variables
|
||||||
uint8_t isGen = 0;
|
uint8_t isGen = 0;
|
||||||
uint8_t rec[1] = {0x00};
|
uint8_t rec[1] = {0x00};
|
||||||
uint8_t recpar[1] = {0x00};
|
uint8_t recpar[1] = {0x00};
|
||||||
uint8_t rats[4] = { ISO14443A_CMD_RATS, 0x80, 0x31, 0x73 };
|
uint8_t rats[4] = { ISO14443A_CMD_RATS, 0x80, 0x31, 0x73 };
|
||||||
uint8_t rdbl[4] = { ISO14443A_CMD_READBLOCK, 0xF0, 0x8D, 0x5f};
|
uint8_t rdblf0[4] = { ISO14443A_CMD_READBLOCK, 0xF0, 0x8D, 0x5f};
|
||||||
uint8_t rdbl0[4] = { ISO14443A_CMD_READBLOCK, 0x00, 0x02, 0xa8};
|
uint8_t rdbl00[4] = { ISO14443A_CMD_READBLOCK, 0x00, 0x02, 0xa8};
|
||||||
uint8_t *par = BigBuf_malloc(MAX_PARITY_SIZE);
|
uint8_t *par = BigBuf_malloc(MAX_PARITY_SIZE);
|
||||||
uint8_t *buf = BigBuf_malloc(PM3_CMD_DATA_SIZE);
|
uint8_t *buf = BigBuf_malloc(PM3_CMD_DATA_SIZE);
|
||||||
uint8_t *uid = BigBuf_malloc(10);
|
uint8_t *uid = BigBuf_malloc(10);
|
||||||
|
@ -2323,31 +2323,34 @@ void MifareCIdent(void) {
|
||||||
goto OUT;
|
goto OUT;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (! is_mfc) {
|
||||||
// magic ntag test
|
// magic ntag test
|
||||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||||
SpinDelay(40);
|
SpinDelay(40);
|
||||||
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
|
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
|
||||||
res = iso14443a_select_card(uid, NULL, &cuid, true, 0, true);
|
res = iso14443a_select_card(uid, NULL, &cuid, true, 0, true);
|
||||||
if (res == 2) {
|
if (res == 2) {
|
||||||
ReaderTransmit(rdbl, sizeof(rdbl), NULL);
|
ReaderTransmit(rdblf0, sizeof(rdblf0), NULL);
|
||||||
res = ReaderReceive(buf, par);
|
res = ReaderReceive(buf, par);
|
||||||
if (res == 18) {
|
if (res == 18) {
|
||||||
isGen = MAGIC_NTAG21X;
|
isGen = MAGIC_NTAG21X;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
if (is_mfc) {
|
||||||
// magic MFC Gen3 test
|
// magic MFC Gen3 test
|
||||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||||
SpinDelay(40);
|
SpinDelay(40);
|
||||||
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
|
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
|
||||||
res = iso14443a_select_card(uid, NULL, &cuid, true, 0, true);
|
res = iso14443a_select_card(uid, NULL, &cuid, true, 0, true);
|
||||||
if (res == 2) {
|
if (res == 2) {
|
||||||
ReaderTransmit(rdbl0, sizeof(rdbl0), NULL);
|
ReaderTransmit(rdbl00, sizeof(rdbl00), NULL);
|
||||||
res = ReaderReceive(buf, par);
|
res = ReaderReceive(buf, par);
|
||||||
if (res == 18) {
|
if (res == 18) {
|
||||||
isGen = MAGIC_GEN_3;
|
isGen = MAGIC_GEN_3;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
}
|
||||||
};
|
};
|
||||||
|
|
||||||
OUT:
|
OUT:
|
||||||
|
|
|
@ -41,7 +41,7 @@ int MifareECardLoadExt(uint8_t sectorcnt, uint8_t keytype);
|
||||||
|
|
||||||
void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain); // Work with "magic Chinese" card
|
void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain); // Work with "magic Chinese" card
|
||||||
void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain);
|
void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain);
|
||||||
void MifareCIdent(void); // is "magic chinese" card?
|
void MifareCIdent(bool is_mfc); // is "magic chinese" card?
|
||||||
void MifareHasStaticNonce(void); // Has the tag a static nonce?
|
void MifareHasStaticNonce(void); // Has the tag a static nonce?
|
||||||
|
|
||||||
int DoGen3Cmd(uint8_t *cmd, uint8_t cmd_len);
|
int DoGen3Cmd(uint8_t *cmd, uint8_t cmd_len);
|
||||||
|
|
|
@ -8,10 +8,10 @@ desc = [[
|
||||||
This script tries to decode Mifare Classic Access bytes
|
This script tries to decode Mifare Classic Access bytes
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
1. script run data_mfc_accessdecode -a 7F0F0869
|
1. script run data_mf_accessdecode -a 7F0F0869
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run data_mfc_accessdecode [-h] [-a <access bytes>]
|
script run data_mf_accessdecode [-h] [-a <access bytes>]
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h : this help
|
-h : this help
|
|
@ -12,10 +12,10 @@ This script takes a dumpfile from 'hf mf dump' and converts it to a format that
|
||||||
by the emulator
|
by the emulator
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
script run hf_mf_dumptoemulator -i dumpdata-foobar.bin
|
script run data_mf_bin2eml -i dumpdata-foobar.bin
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run hf_mf_dumptoemulator [-i <file>] [-o <file>]
|
script run data_mf_bin2eml [-i <file>] [-o <file>]
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h This help
|
-h This help
|
|
@ -13,10 +13,10 @@ This script takes a dumpfile and produces a html based dump, which is a
|
||||||
bit more easily analyzed.
|
bit more easily analyzed.
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
script run data_dumptohtml -o mifarecard_foo.html
|
script run data_mf_bin2html -o mifarecard_foo.html
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run data_dumptohtml [-i <file>] [-o <file>]
|
script run data_mf_bin2html [-i <file>] [-o <file>]
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h This help
|
-h This help
|
|
@ -10,12 +10,12 @@ desc =[[
|
||||||
This script takes an dumpfile in EML (ASCII) format and converts it to the PM3 dumpbin file to be used with `hf mf restore`
|
This script takes an dumpfile in EML (ASCII) format and converts it to the PM3 dumpbin file to be used with `hf mf restore`
|
||||||
]]
|
]]
|
||||||
example =[[
|
example =[[
|
||||||
1. script run data_emulatortodump
|
1. script run data_mf_eml2bin
|
||||||
2. script run data_emulatortodump -i myfile.eml
|
2. script run data_mf_eml2bin -i myfile.eml
|
||||||
3. script run data_emulatortodump -i myfile.eml -o myfile.bin
|
3. script run data_mf_eml2bin -i myfile.eml -o myfile.bin
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run data_emulatortodump [-i <file>] [-o <file>]
|
script run data_mf_eml2bin [-i <file>] [-o <file>]
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h This help
|
-h This help
|
|
@ -13,10 +13,10 @@ This script takes a dumpfile on EML (ASCII) format and produces a html based dum
|
||||||
bit more easily analyzed.
|
bit more easily analyzed.
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
script run data_emulatortohtml -o dumpdata.eml
|
script run data_mf_eml2html -o dumpdata.eml
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run data_emulatortohtml [-i <file>] [-o <file>]
|
script run data_mf_eml2html [-i <file>] [-o <file>]
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h This help
|
-h This help
|
|
@ -4,7 +4,7 @@ local getopt = require('getopt')
|
||||||
local ansicolors = require('ansicolors')
|
local ansicolors = require('ansicolors')
|
||||||
|
|
||||||
copyright = ''
|
copyright = ''
|
||||||
usage = 'script run parameters.lua -a 1 -blala -c -de'
|
usage = 'script run example_parameters.lua -a 1 -blala -c -de'
|
||||||
author = 'Martin Holst Swende'
|
author = 'Martin Holst Swende'
|
||||||
version = 'v1.0.2'
|
version = 'v1.0.2'
|
||||||
desc = [[
|
desc = [[
|
||||||
|
@ -12,10 +12,10 @@ This is an example script to demonstrate handle parameters in scripts.
|
||||||
For more info, check the comments in the code
|
For more info, check the comments in the code
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
1. script run data_example_parameters -a mytestparam_input -c
|
1. script run example_parameters -a mytestparam_input -c
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run data_example_parameters [-h] [-a <txt>] [-b <txt>] [-c] [-d] [-e]
|
script run example_parameters [-h] [-a <txt>] [-b <txt>] [-c] [-d] [-e]
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h This help
|
-h This help
|
||||||
|
@ -52,7 +52,7 @@ local function main(args)
|
||||||
5 parameters; two with values and three flags. The following
|
5 parameters; two with values and three flags. The following
|
||||||
should be valid:
|
should be valid:
|
||||||
|
|
||||||
script run parameters.lua -a 1 -blala -c -de
|
script run example_parameters.lua -a 1 -blala -c -de
|
||||||
|
|
||||||
Notice two things:
|
Notice two things:
|
||||||
1. 'blala' works just like 'b lala', both set 'b' to 'lala'
|
1. 'blala' works just like 'b lala', both set 'b' to 'lala'
|
|
@ -7,7 +7,7 @@ copyright = ''
|
||||||
author = "Martin Holst Swende"
|
author = "Martin Holst Swende"
|
||||||
version = 'v1.0.2'
|
version = 'v1.0.2'
|
||||||
desc = [[
|
desc = [[
|
||||||
This is a script to allow raw 1444a commands to be sent and received.
|
This is a script to allow raw 14443a commands to be sent and received.
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
# 1. Connect and don't disconnect
|
# 1. Connect and don't disconnect
|
||||||
|
|
|
@ -15,12 +15,12 @@ example = [[
|
||||||
|
|
||||||
-- ISO15693 slix magic tag
|
-- ISO15693 slix magic tag
|
||||||
|
|
||||||
script run iso15_magic -u E004013344556677
|
script run hf_15_magic -u E004013344556677
|
||||||
|
|
||||||
script run iso15_magic -u E004013344556677 -a
|
script run hf_15_magic -u E004013344556677 -a
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run iso15_magic -h -u <uid>
|
script run hf_15_magic -h -u <uid>
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h : this help
|
-h : this help
|
|
@ -96,7 +96,7 @@ Known issues; needs to be fixed:
|
||||||
* last byte in last segment is handled incorrectly when it is the last bytes on the card itself (MIM256: => byte 256)
|
* last byte in last segment is handled incorrectly when it is the last bytes on the card itself (MIM256: => byte 256)
|
||||||
--]]
|
--]]
|
||||||
|
|
||||||
example = "script run legic"
|
example = "script run hf_legic"
|
||||||
author = "Mosci, uhei"
|
author = "Mosci, uhei"
|
||||||
version = "1.0.4"
|
version = "1.0.4"
|
||||||
|
|
|
@ -11,10 +11,10 @@ desc =
|
||||||
This is a script which writes value 0x01 to bytes from position 0x07 until 0xFF on a Legic Prime Tag (MIM256 or MIM1024) -- (created with 'hf legic save my_dump.hex') --
|
This is a script which writes value 0x01 to bytes from position 0x07 until 0xFF on a Legic Prime Tag (MIM256 or MIM1024) -- (created with 'hf legic save my_dump.hex') --
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
script run legic_buffer2card
|
script run hf_legic_buffer2card
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run legic_buffer2card -h
|
script run hf_legic_buffer2card -h
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h - Help text
|
-h - Help text
|
|
@ -18,7 +18,7 @@ local ansicolors = require('ansicolors')
|
||||||
simplest usage:
|
simplest usage:
|
||||||
Dump a legic tag with 'hf legic dump'
|
Dump a legic tag with 'hf legic dump'
|
||||||
place your 'empty' tag on the reader and run
|
place your 'empty' tag on the reader and run
|
||||||
'script run legic_clone -i orig.bin -w'
|
'script run hf_legic_clone -i orig.bin -w'
|
||||||
|
|
||||||
you will see some output like:
|
you will see some output like:
|
||||||
|
|
||||||
|
@ -95,11 +95,11 @@ This is a script which creates a clone-dump of a dump from a LEGIC Prime Tag (MI
|
||||||
Create a dump by running `hf legic dump`.
|
Create a dump by running `hf legic dump`.
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
script run legic_clone -i my_dump.bin -o my_clone.bin -c f8
|
script run hf_legic_clone -i my_dump.bin -o my_clone.bin -c f8
|
||||||
script run legic_clone -i my_dump.bin -d -s
|
script run hf_legic_clone -i my_dump.bin -d -s
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run legic_clone [-h] [-i <file>] [-o <file>] [-c <crc>] [-d] [-s] [-w]
|
script run hf_legic_clone [-h] [-i <file>] [-o <file>] [-c <crc>] [-d] [-s] [-w]
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
required :
|
required :
|
|
@ -128,10 +128,10 @@ local function dump_tag(uid, numsectors)
|
||||||
|
|
||||||
-- Save the global args, those are *our* arguments
|
-- Save the global args, those are *our* arguments
|
||||||
local myargs = args
|
local myargs = args
|
||||||
-- Set the arguments for htmldump script
|
-- Set the arguments for data_mf_bin2html script
|
||||||
args =('-i %s.bin -o %s.html'):format(dumpfile, dumpfile)
|
args =('-i %s.bin -o %s.html'):format(dumpfile, dumpfile)
|
||||||
-- call it
|
-- call it
|
||||||
require('htmldump')
|
require('data_mf_bin2html')
|
||||||
|
|
||||||
-- Set back args. Not that it's used, just for the karma...
|
-- Set back args. Not that it's used, just for the karma...
|
||||||
args = myargs
|
args = myargs
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
---
|
---
|
||||||
-- This Lua script is designed to run with Iceman/RRG Proxmark3 fork
|
-- This Lua script is designed to run with Iceman/RRG Proxmark3 fork
|
||||||
-- Just copy luxeodump.lua to client/luascripts/
|
-- Just copy hf_mf_dump-luxeo.lua to client/luascripts/
|
||||||
-- and run "script run luxeodump"
|
-- and run "script run hf_mf_dump-luxeo"
|
||||||
|
|
||||||
-- requirements
|
-- requirements
|
||||||
local cmds = require('commands')
|
local cmds = require('commands')
|
||||||
|
@ -17,10 +17,10 @@ desc = [[
|
||||||
This is a script that tries to dump and decrypt the data of a specific type of Mifare laundromat token. OBS! Tag must be on the antenna.
|
This is a script that tries to dump and decrypt the data of a specific type of Mifare laundromat token. OBS! Tag must be on the antenna.
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
script run hf_mf_dump-laundromat
|
script run hf_mf_dump-luxeo
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run hf_mf_dump-laundromat
|
script run hf_mf_dump-luxeo
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h This help
|
-h This help
|
|
@ -12,8 +12,7 @@ local read14a = require('read14a')
|
||||||
--[[
|
--[[
|
||||||
---Suggestions of improvement:
|
---Suggestions of improvement:
|
||||||
--- Add support another types of dumps: BIN, JSON
|
--- Add support another types of dumps: BIN, JSON
|
||||||
--- Maybe it will be not only as `mfc_gen3_writer`, like a universal dump manager.
|
--- Maybe it will be not only as `hf_mf_gen3_writer`, like a universal dump manager.
|
||||||
--- Add undependence from the operation system. At the moment code not working in Linux.
|
|
||||||
--- Hide system messages when you writing a dumps, replace it to some of like [#####----------] 40%
|
--- Hide system messages when you writing a dumps, replace it to some of like [#####----------] 40%
|
||||||
|
|
||||||
-- iceman notes:
|
-- iceman notes:
|
|
@ -60,7 +60,7 @@ end
|
||||||
-- waits for answer from pm3 device
|
-- waits for answer from pm3 device
|
||||||
local function checkCommand(response)
|
local function checkCommand(response)
|
||||||
if not response then
|
if not response then
|
||||||
print("Timeout while waiting for response. Increase TIMEOUT in mfckeys.lua to wait longer")
|
print("Timeout while waiting for response. Increase TIMEOUT in hf_mf_keycheck.lua to wait longer")
|
||||||
return nil, "Timeout while waiting for device to respond"
|
return nil, "Timeout while waiting for device to respond"
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@ -237,7 +237,7 @@ local function perform_check(uid, numsectors)
|
||||||
|
|
||||||
local end_time = os.time()
|
local end_time = os.time()
|
||||||
print('')
|
print('')
|
||||||
print('[+] mfckeys - Checkkey execution time: '..os.difftime(end_time, start_time)..' sec')
|
print('[+] hf_mf_keycheck - Checkkey execution time: '..os.difftime(end_time, start_time)..' sec')
|
||||||
|
|
||||||
core.fast_push_mode(false)
|
core.fast_push_mode(false)
|
||||||
|
|
||||||
|
|
|
@ -19,7 +19,7 @@ script run hf_mf_magicrevive [-h] [-u]
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h this help
|
-h this help
|
||||||
-u remagic a Ultralight tag w 7 bytes UID.
|
-u try to revive a bricked magic Ultralight tag w 7 bytes UID.
|
||||||
]]
|
]]
|
||||||
---
|
---
|
||||||
-- A debug printout-function
|
-- A debug printout-function
|
||||||
|
|
|
@ -16,19 +16,19 @@ This is a script to dump and decrypt the data of a specific type of Mifare Mini
|
||||||
The dump is decrypted. If a raw dump is wanted, use the -r parameter
|
The dump is decrypted. If a raw dump is wanted, use the -r parameter
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
script run hf_mfm_dumpdecrypt
|
script run hf_mf_mini_dumpdecrypt
|
||||||
|
|
||||||
-- selftest
|
-- selftest
|
||||||
script run hf_mfm_dumpdecrypt -t
|
script run hf_mf_mini_dumpdecrypt -t
|
||||||
|
|
||||||
-- Generate raw dump, into json.
|
-- Generate raw dump, into json.
|
||||||
script run hf_mfm_dumpdecrypt -r
|
script run hf_mf_mini_dumpdecrypt -r
|
||||||
|
|
||||||
-- load file
|
-- load file
|
||||||
script run hf_mfm_dumpdecrypt -i dumpdata.json
|
script run hf_mf_mini_dumpdecrypt -i dumpdata.json
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run hf_mfm_dumpdecrypt -h -t -r -d -e -v -i dumpdata.json
|
script run hf_mf_mini_dumpdecrypt -h -t -r -d -e -v -i dumpdata.json
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
h this helptext
|
h this helptext
|
|
@ -18,14 +18,14 @@ desc = [[
|
||||||
This script will try to make a barebones clone of a tnp3 tag on to a magic generation1 card.
|
This script will try to make a barebones clone of a tnp3 tag on to a magic generation1 card.
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
script run hf_mf_clone-tnp3
|
script run hf_mf_tnp3_clone
|
||||||
script run hf_mf_clone-tnp3 -h
|
script run hf_mf_tnp3_clone -h
|
||||||
script run hf_mf_clone-tnp3 -l
|
script run hf_mf_tnp3_clone -l
|
||||||
script run hf_mf_clone-tnp3 -t aa00 -s 0030
|
script run hf_mf_tnp3_clone -t aa00 -s 0030
|
||||||
|
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run hf_mf_clone-tnp3 [-h] [-t <toytype>] [-s <subtype>]
|
script run hf_mf_tnp3_clone [-h] [-t <toytype>] [-s <subtype>]
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h : this help
|
-h : this help
|
|
@ -16,18 +16,18 @@ This script will try to dump the contents of a Mifare TNP3xxx card.
|
||||||
It will need a valid KeyA in order to find the other keys and decode the card.
|
It will need a valid KeyA in order to find the other keys and decode the card.
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
script run hf_mf_dump-tnp3
|
script run hf_mf_tnp3_dump
|
||||||
script run hf_mf_dump-tnp3 -n
|
script run hf_mf_tnp3_dump -n
|
||||||
script run hf_mf_dump-tnp3 -p
|
script run hf_mf_tnp3_dump -p
|
||||||
script run hf_mf_dump-tnp3 -k aabbccddeeff
|
script run hf_mf_tnp3_dump -k aabbccddeeff
|
||||||
script run hf_mf_dump-tnp3 -k aabbccddeeff -n
|
script run hf_mf_tnp3_dump -k aabbccddeeff -n
|
||||||
script run hf_mf_dump-tnp3 -o myfile
|
script run hf_mf_tnp3_dump -o myfile
|
||||||
script run hf_mf_dump-tnp3 -n -o myfile
|
script run hf_mf_tnp3_dump -n -o myfile
|
||||||
script run hf_mf_dump-tnp3 -p -o myfile
|
script run hf_mf_tnp3_dump -p -o myfile
|
||||||
script run hf_mf_dump-tnp3 -k aabbccddeeff -n -o myfile
|
script run hf_mf_tnp3_dump -k aabbccddeeff -n -o myfile
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run hf_mf_dump-tnp3 [-h] [-k <key>] [-n] [-p] [-o <filename>]
|
script run hf_mf_tnp3_dump [-h] [-k <key>] [-n] [-p] [-o <filename>]
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h : this help
|
-h : this help
|
|
@ -18,12 +18,12 @@ For an experimental mode, it tries to manipulate some data.
|
||||||
At last it sends all data to the PM3 device memory where it can be used in the command "hf mf sim"
|
At last it sends all data to the PM3 device memory where it can be used in the command "hf mf sim"
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
1. script run hf_mf_autosim
|
1. script run hf_mf_tnp3_sim
|
||||||
2. script run hf_mf_autosim -m
|
2. script run hf_mf_tnp3_sim -m
|
||||||
3. script run hf_mf_autosim -m -i myfile
|
3. script run hf_mf_tnp3_sim -m -i myfile
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run hf_mf_autosim [-h] [-m] [-i <filename>]
|
script run hf_mf_tnp3_sim [-h] [-m] [-i <filename>]
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h : this help
|
-h : this help
|
|
@ -1,5 +1,5 @@
|
||||||
-- Run me like this (connected via USB): ./pm3 -l hf_bruteforce.lua
|
-- Run me like this (connected via USB): ./pm3 -l hf_mf_uidbruteforce.lua
|
||||||
-- Run me like this (connected via Blueshark addon): ./client/proxmark3 /dev/rfcomm0 -l ./hf_bruteforce.lua
|
-- Run me like this (connected via Blueshark addon): ./client/proxmark3 /dev/rfcomm0 -l ./hf_mf_uidbruteforce.lua
|
||||||
|
|
||||||
local getopt = require('getopt')
|
local getopt = require('getopt')
|
||||||
local ansicolors = require('ansicolors')
|
local ansicolors = require('ansicolors')
|
||||||
|
@ -13,14 +13,14 @@ This script bruteforces 4 or 7 byte UID Mifare classic card numbers.
|
||||||
example =[[
|
example =[[
|
||||||
Bruteforce a 4 byte UID Mifare classic card number, starting at 11223344, ending at 11223346.
|
Bruteforce a 4 byte UID Mifare classic card number, starting at 11223344, ending at 11223346.
|
||||||
|
|
||||||
script run hf_mfc_uidbruteforce -s 0x11223344 -e 0x11223346 -t 1000 -x mfc
|
script run hf_mf_uidbruteforce -s 0x11223344 -e 0x11223346 -t 1000 -x mfc
|
||||||
|
|
||||||
Bruteforce a 7 byte UID Mifare Ultralight card number, starting at 11223344556677, ending at 11223344556679.
|
Bruteforce a 7 byte UID Mifare Ultralight card number, starting at 11223344556677, ending at 11223344556679.
|
||||||
|
|
||||||
script run hf_mfc_uidbruteforce -s 0x11223344556677 -e 0x11223344556679 -t 1000 -x mfu
|
script run hf_mf_uidbruteforce -s 0x11223344556677 -e 0x11223344556679 -t 1000 -x mfu
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run hf_mfc_uidbruteforce [-s <start_id>] [-e <end_id>] [-t <timeout>] [-x <mifare_card_type>]
|
script run hf_mf_uidbruteforce [-s <start_id>] [-e <end_id>] [-t <timeout>] [-x <mifare_card_type>]
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h this help
|
-h this help
|
|
@ -221,13 +221,13 @@ local function configure_magic_ntag(uid)
|
||||||
|
|
||||||
local pwd, pack = core.keygen_algo_d(uid)
|
local pwd, pack = core.keygen_algo_d(uid)
|
||||||
|
|
||||||
-- Set the arguments for mfu_magic script v1.0.8
|
-- Set the arguments for hf_mfu_magicwrite script v1.0.8
|
||||||
-- -t 12 == configure NTAG213F
|
-- -t 12 == configure NTAG213F
|
||||||
-- -u == set UID
|
-- -u == set UID
|
||||||
-- -p == set pwd
|
-- -p == set pwd
|
||||||
-- -a == set pack
|
-- -a == set pack
|
||||||
args =('-t 12 -u %s -p %08X -a %04X'):format(uid, pwd, pack)
|
args =('-t 12 -u %s -p %08X -a %04X'):format(uid, pwd, pack)
|
||||||
require('mfu_magic')
|
require('hf_mfu_magicwrite')
|
||||||
|
|
||||||
-- Set back args. Not that it's used, just for the karma...
|
-- Set back args. Not that it's used, just for the karma...
|
||||||
args = myargs
|
args = myargs
|
||||||
|
|
|
@ -1,5 +1,5 @@
|
||||||
--
|
--
|
||||||
-- lf_bulk.lua - A tool to clone a large number of tags at once.
|
-- lf_hid_bulkclone.lua - A tool to clone a large number of tags at once.
|
||||||
-- Updated 2017-04-18
|
-- Updated 2017-04-18
|
||||||
-- Updated 2018-02-20 iceman
|
-- Updated 2018-02-20 iceman
|
||||||
local getopt = require('getopt')
|
local getopt = require('getopt')
|
||||||
|
|
|
@ -9,31 +9,31 @@ desc = [[
|
||||||
This script will read the flash memory of RDV4 and print the stored passwords/keys.
|
This script will read the flash memory of RDV4 and print the stored passwords/keys.
|
||||||
|
|
||||||
It was meant to be used as a help tool after using the BogRun standalone mode before SPIFFS.
|
It was meant to be used as a help tool after using the BogRun standalone mode before SPIFFS.
|
||||||
You should now use read_pwd_mem_spiffs instead after the updated BogRun standalone mode.
|
You should now use data_read_pwd_mem_spiffs instead after the updated BogRun standalone mode.
|
||||||
|
|
||||||
(Iceman) script adapted to read and print keys in the default dictionary flashmemory sections.
|
(Iceman) script adapted to read and print keys in the default dictionary flashmemory sections.
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
-- This will scan the first 256 bytes of flash memory for stored passwords
|
-- This will scan the first 256 bytes of flash memory for stored passwords
|
||||||
script run data_readpwdmem
|
script run mem_readpwd
|
||||||
|
|
||||||
-- This will scan 256 bytes of flash memory at offset 64 for stored passwords
|
-- This will scan 256 bytes of flash memory at offset 64 for stored passwords
|
||||||
script run data_readpwdmem -o 64
|
script run mem_readpwd -o 64
|
||||||
|
|
||||||
-- This will scan 32 bytes of flash memory at offset 64 for stored passwords
|
-- This will scan 32 bytes of flash memory at offset 64 for stored passwords
|
||||||
script run data_readpwdmem -o 64 -l 32
|
script run mem_readpwd -o 64 -l 32
|
||||||
|
|
||||||
-- This will print the stored Mifare dictionary keys
|
-- This will print the stored Mifare dictionary keys
|
||||||
script run data_readpwdmem -m
|
script run mem_readpwd -m
|
||||||
|
|
||||||
-- This will print the stored t55xx dictionary passwords
|
-- This will print the stored t55xx dictionary passwords
|
||||||
script run data_readpwdmem -t
|
script run mem_readpwd -t
|
||||||
|
|
||||||
-- This will print the stored iClass dictionary keys
|
-- This will print the stored iClass dictionary keys
|
||||||
script run data_readpwdmem -i
|
script run mem_readpwd -i
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run data_readpwdmem [-h] [-o <offset>] [-l <length>] [-k <keylength>] [-m] [-t] [-i]
|
script run mem_readpwd [-h] [-o <offset>] [-l <length>] [-k <keylength>] [-m] [-t] [-i]
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h : this help
|
-h : this help
|
|
@ -11,16 +11,16 @@ It was meant to be used as a help tool after using the BogRun standalone mode.
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
-- This will read the hf_bog.log file in SPIFFS and print the stored passwords
|
-- This will read the hf_bog.log file in SPIFFS and print the stored passwords
|
||||||
script run data_readpwdmem-spiffs
|
script run mem_spiffs_readpwd
|
||||||
|
|
||||||
-- This will read the other.log file in SPIFFS and print the stored passwords
|
-- This will read the other.log file in SPIFFS and print the stored passwords
|
||||||
script run data_readpwdmem-spiffs -f other.log
|
script run mem_spiffs_readpwd -f other.log
|
||||||
|
|
||||||
-- This will delete the hf_bog.log file from SPIFFS
|
-- This will delete the hf_bog.log file from SPIFFS
|
||||||
script run data_readpwdmem-spiffs -r
|
script run mem_spiffs_readpwd -r
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run data_readpwdmem-spiffs [-h] [-f <filename>] [-r]
|
script run mem_spiffs_readpwd [-h] [-f <filename>] [-r]
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h : this help
|
-h : this help
|
|
@ -26,16 +26,16 @@ It uses both LF and HF simulations.
|
||||||
-- Author note
|
-- Author note
|
||||||
-- I wrote this as i was doing a PACS audit. This is far from complete, but is easily expandable.
|
-- I wrote this as i was doing a PACS audit. This is far from complete, but is easily expandable.
|
||||||
-- The idea was based on proxbrute, but i needed more options, and support for different readers.
|
-- The idea was based on proxbrute, but i needed more options, and support for different readers.
|
||||||
-- I dont know LUA, so I used Brian Redbeards lf_bulk_program.lua script as a starting point, sorry if its kludgy.
|
-- I dont know LUA, so I used Brian Redbeards lf_hid_bulkclone.lua script as a starting point, sorry if its kludgy.
|
||||||
|
|
||||||
]]
|
]]
|
||||||
example = [[
|
example = [[
|
||||||
-- (the above example would bruteforce pyramid tags, starting at 10:1000, ending at 10:991, and waiting 1 second between each card)
|
-- (the above example would bruteforce pyramid tags, starting at 10:1000, ending at 10:991, and waiting 1 second between each card)
|
||||||
|
|
||||||
script run hf_lf_multi_bruteforce -r pyramid -f 10 -b 1000 -c 10 -t 1 -d down
|
script run multi_bruteforce -r pyramid -f 10 -b 1000 -c 10 -t 1 -d down
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run hf_lf_multi_bruteforce -r rfid_tag -f facility_code -b base_card_number -c count -t timeout -d direction
|
script run multi_bruteforce -r rfid_tag -f facility_code -b base_card_number -c count -t timeout -d direction
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h this help
|
-h this help
|
||||||
|
@ -110,7 +110,7 @@ local function isempty(s)
|
||||||
return s == nil or s == ''
|
return s == nil or s == ''
|
||||||
end
|
end
|
||||||
|
|
||||||
-- The code below was blatantly stolen from Brian Redbeard's lf_bulk_program.lua script
|
-- The code below was blatantly stolen from Brian Redbeard's lf_hid_bulkclone.lua script
|
||||||
local function toBits(num, bits)
|
local function toBits(num, bits)
|
||||||
bits = bits or math.max(1, select(2, math.frexp(num)))
|
bits = bits or math.max(1, select(2, math.frexp(num)))
|
||||||
local t = {}
|
local t = {}
|
|
@ -35,7 +35,7 @@ example = [[
|
||||||
3. script run lf_t55xx_writetest -t PSK1
|
3. script run lf_t55xx_writetest -t PSK1
|
||||||
]]
|
]]
|
||||||
usage = [[
|
usage = [[
|
||||||
script run test_t55x7 [-h] [-t <modulation type>
|
script run lf_t55xx_writetest [-h] [-t <modulation type>
|
||||||
]]
|
]]
|
||||||
arguments = [[
|
arguments = [[
|
||||||
-h this help
|
-h this help
|
|
@ -1979,11 +1979,13 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
|
||||||
}
|
}
|
||||||
|
|
||||||
int isMagic = 0;
|
int isMagic = 0;
|
||||||
if (isMifareClassic || isMifareUltralight) {
|
|
||||||
isMagic = detect_classic_magic();
|
|
||||||
|
|
||||||
if (isMifareClassic) {
|
if (isMifareClassic) {
|
||||||
|
isMagic = detect_mf_magic(true);
|
||||||
|
}
|
||||||
|
if (isMifareUltralight) {
|
||||||
|
isMagic = detect_mf_magic(false);
|
||||||
|
}
|
||||||
|
if (isMifareClassic) {
|
||||||
int res = detect_classic_static_nonce();
|
int res = detect_classic_static_nonce();
|
||||||
if (res == NONCE_STATIC)
|
if (res == NONCE_STATIC)
|
||||||
PrintAndLogEx(SUCCESS, "Static nonce: " _YELLOW_("yes"));
|
PrintAndLogEx(SUCCESS, "Static nonce: " _YELLOW_("yes"));
|
||||||
|
@ -2006,7 +2008,6 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
|
||||||
detect_classic_nackbug(false);
|
detect_classic_nackbug(false);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
|
||||||
|
|
||||||
if (isMifareUltralight)
|
if (isMifareUltralight)
|
||||||
PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfu info`"));
|
PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfu info`"));
|
||||||
|
|
|
@ -136,7 +136,7 @@ static int usage_hf_mfu_wrbl(void) {
|
||||||
|
|
||||||
static int usage_hf_mfu_eload(void) {
|
static int usage_hf_mfu_eload(void) {
|
||||||
PrintAndLogEx(NORMAL, "It loads emul dump from the file " _YELLOW_("`filename.eml`"));
|
PrintAndLogEx(NORMAL, "It loads emul dump from the file " _YELLOW_("`filename.eml`"));
|
||||||
PrintAndLogEx(NORMAL, "Hint: See " _YELLOW_("`script run dumptoemul-mfu`") " to convert the .bin to the eml");
|
PrintAndLogEx(NORMAL, "Hint: See " _YELLOW_("`script run hf_mfu_dumptoemulator`") " to convert the .bin to the eml");
|
||||||
PrintAndLogEx(NORMAL, "Usage: hf mfu eload u <file name w/o `.eml`> [numblocks]");
|
PrintAndLogEx(NORMAL, "Usage: hf mfu eload u <file name w/o `.eml`> [numblocks]");
|
||||||
PrintAndLogEx(NORMAL, " Options:");
|
PrintAndLogEx(NORMAL, " Options:");
|
||||||
PrintAndLogEx(NORMAL, " h : this help");
|
PrintAndLogEx(NORMAL, " h : this help");
|
||||||
|
@ -1984,6 +1984,7 @@ static int CmdHF14AMfUDump(const char *Cmd) {
|
||||||
|
|
||||||
iso14a_card_select_t card;
|
iso14a_card_select_t card;
|
||||||
mfu_dump_t dump_file_data;
|
mfu_dump_t dump_file_data;
|
||||||
|
memset(&dump_file_data, 0, sizeof(dump_file_data));
|
||||||
uint8_t get_version[] = {0, 0, 0, 0, 0, 0, 0, 0};
|
uint8_t get_version[] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||||
uint8_t get_counter_tearing[][4] = {{0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}};
|
uint8_t get_counter_tearing[][4] = {{0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}};
|
||||||
uint8_t get_signature[32];
|
uint8_t get_signature[32];
|
||||||
|
|
|
@ -1154,13 +1154,14 @@ int detect_classic_static_nonce(void) {
|
||||||
return NONCE_FAIL;
|
return NONCE_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* try to see if card responses to "chinese magic backdoor" commands. */
|
/* try to see if card responses to "Chinese magic backdoor" commands. */
|
||||||
int detect_classic_magic(void) {
|
int detect_mf_magic(bool is_mfc) {
|
||||||
|
|
||||||
uint8_t isGeneration = 0;
|
uint8_t isGeneration = 0;
|
||||||
PacketResponseNG resp;
|
PacketResponseNG resp;
|
||||||
clearCommandBuffer();
|
clearCommandBuffer();
|
||||||
SendCommandNG(CMD_HF_MIFARE_CIDENT, NULL, 0);
|
uint8_t payload[] = { is_mfc };
|
||||||
|
SendCommandNG(CMD_HF_MIFARE_CIDENT, payload, sizeof(payload));
|
||||||
if (WaitForResponseTimeout(CMD_HF_MIFARE_CIDENT, &resp, 1500)) {
|
if (WaitForResponseTimeout(CMD_HF_MIFARE_CIDENT, &resp, 1500)) {
|
||||||
if (resp.status == PM3_SUCCESS)
|
if (resp.status == PM3_SUCCESS)
|
||||||
isGeneration = resp.data.asBytes[0];
|
isGeneration = resp.data.asBytes[0];
|
||||||
|
|
|
@ -88,7 +88,7 @@ int tryDecryptWord(uint32_t nt, uint32_t ar_enc, uint32_t at_enc, uint8_t *data,
|
||||||
|
|
||||||
int detect_classic_prng(void);
|
int detect_classic_prng(void);
|
||||||
int detect_classic_nackbug(bool verbose);
|
int detect_classic_nackbug(bool verbose);
|
||||||
int detect_classic_magic(void);
|
int detect_mf_magic(bool is_mfc);
|
||||||
int detect_classic_static_nonce(void);
|
int detect_classic_static_nonce(void);
|
||||||
void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len, bool isEncrypted);
|
void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len, bool isEncrypted);
|
||||||
#endif
|
#endif
|
||||||
|
|
|
@ -55,7 +55,7 @@ static int l_clearCommandBuffer(lua_State *L) {
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Enable / Disable fast push mode for lua scripts like mfckeys
|
* Enable / Disable fast push mode for lua scripts like hf_mf_keycheck
|
||||||
* The following params expected:
|
* The following params expected:
|
||||||
*
|
*
|
||||||
*@brief l_fast_push_mode
|
*@brief l_fast_push_mode
|
||||||
|
|
|
@ -233,7 +233,7 @@ Options
|
||||||
---
|
---
|
||||||
i <file> : Specifies the dump-file (input). If omitted, 'dumpdata.bin' is used
|
i <file> : Specifies the dump-file (input). If omitted, 'dumpdata.bin' is used
|
||||||
|
|
||||||
pm3 --> script run dumptoemul -i dumpdata.bin
|
pm3 --> script run data_mf_bin2eml -i dumpdata.bin
|
||||||
```
|
```
|
||||||
|
|
||||||
Write to MIFARE block
|
Write to MIFARE block
|
||||||
|
@ -285,7 +285,7 @@ Simulate MIFARE Sequence
|
||||||
```
|
```
|
||||||
pm3 --> hf mf chk *1 ? d mfc_default_keys
|
pm3 --> hf mf chk *1 ? d mfc_default_keys
|
||||||
pm3 --> hf mf dump 1
|
pm3 --> hf mf dump 1
|
||||||
pm3 --> script run dumptoemul -i dumpdata.bin
|
pm3 --> script run data_mf_bin2eml -i dumpdata.bin
|
||||||
pm3 --> hf mf eload 353C2AA6
|
pm3 --> hf mf eload 353C2AA6
|
||||||
pm3 --> hf mf sim u 353c2aa6
|
pm3 --> hf mf sim u 353c2aa6
|
||||||
```
|
```
|
||||||
|
@ -305,19 +305,19 @@ pm3 --> hf mfu info
|
||||||
Clone MIFARE Ultralight EV1 Sequence
|
Clone MIFARE Ultralight EV1 Sequence
|
||||||
```
|
```
|
||||||
pm3 --> hf mfu dump k FFFFFFFF
|
pm3 --> hf mfu dump k FFFFFFFF
|
||||||
pm3 --> script run dumptoemul-mfu -i hf-mfu-XXXX-dump.bin -o hf-mfu-XXXX-dump.eml
|
pm3 --> script run hf_mfu_dumptoemulator -i hf-mfu-XXXX-dump.bin -o hf-mfu-XXXX-dump.eml
|
||||||
pm3 --> hf mfu eload u hf-mfu-XXXX-dump.eml
|
pm3 --> hf mfu eload u hf-mfu-XXXX-dump.eml
|
||||||
pm3 --> hf mfu sim t 7 u hf-mfu-XXXX-dump.eml
|
pm3 --> hf mfu sim t 7 u hf-mfu-XXXX-dump.eml
|
||||||
```
|
```
|
||||||
|
|
||||||
Bruteforce MIFARE Classic card numbers from 11223344 to 11223346
|
Bruteforce MIFARE Classic card numbers from 11223344 to 11223346
|
||||||
```
|
```
|
||||||
pm3 --> script run hf_bruteforce -s 0x11223344 -e 0x11223346 -t 1000 -x mfc
|
pm3 --> script run hf_mf_uidbruteforce -s 0x11223344 -e 0x11223346 -t 1000 -x mfc
|
||||||
```
|
```
|
||||||
|
|
||||||
Bruteforce MIFARE Ultralight EV1 card numbers from 11223344556677 to 11223344556679
|
Bruteforce MIFARE Ultralight EV1 card numbers from 11223344556677 to 11223344556679
|
||||||
```
|
```
|
||||||
pm3 --> script run hf_bruteforce -s 0x11223344556677 -e 0x11223344556679 -t 1000 -x mfu
|
pm3 --> script run hf_mf_uidbruteforce -s 0x11223344556677 -e 0x11223344556679 -t 1000 -x mfu
|
||||||
```
|
```
|
||||||
|
|
||||||
## Wiegand manipulation
|
## Wiegand manipulation
|
||||||
|
@ -563,7 +563,7 @@ Options
|
||||||
-i <file> Specifies the dump-file (input). If omitted, 'dumpdata.bin' is used
|
-i <file> Specifies the dump-file (input). If omitted, 'dumpdata.bin' is used
|
||||||
-o <filename> Specifies the output file. If omitted, <uid>.eml is used
|
-o <filename> Specifies the output file. If omitted, <uid>.eml is used
|
||||||
|
|
||||||
pm3 --> script run dumptoemul -i xxxxxxxxxxxxxx.bin
|
pm3 --> script run data_mf_bin2eml -i xxxxxxxxxxxxxx.bin
|
||||||
```
|
```
|
||||||
|
|
||||||
Convert .eml to .bin
|
Convert .eml to .bin
|
||||||
|
@ -573,7 +573,7 @@ Options
|
||||||
-i <filename> Specifies the dump-file (input). If omitted, 'dumpdata.eml' is used
|
-i <filename> Specifies the dump-file (input). If omitted, 'dumpdata.eml' is used
|
||||||
-o <filename> Specifies the output file. If omitted, <currdate>.bin is used
|
-o <filename> Specifies the output file. If omitted, <currdate>.bin is used
|
||||||
|
|
||||||
pm3 --> script run emul2dump -i myfile.eml -o myfile.bin
|
pm3 --> script run data_mf_eml2bin -i myfile.eml -o myfile.bin
|
||||||
```
|
```
|
||||||
|
|
||||||
Format Mifare card
|
Format Mifare card
|
||||||
|
@ -585,7 +585,7 @@ Options
|
||||||
-a <access> The new access bytes that will be written to the card
|
-a <access> The new access bytes that will be written to the card
|
||||||
-x Execute the commands aswell
|
-x Execute the commands aswell
|
||||||
|
|
||||||
pm3 --> script run formatMifare -k FFFFFFFFFFFF -n FFFFFFFFFFFF -x
|
pm3 --> script run hf_mf_format -k FFFFFFFFFFFF -n FFFFFFFFFFFF -x
|
||||||
```
|
```
|
||||||
|
|
||||||
## Memory
|
## Memory
|
||||||
|
|
|
@ -195,7 +195,7 @@ hf mf csetuid 11223344 0044 18
|
||||||
```
|
```
|
||||||
|
|
||||||
```
|
```
|
||||||
script run remagic
|
script run run hf_mf_magicrevive
|
||||||
```
|
```
|
||||||
|
|
||||||
To execute commands manually:
|
To execute commands manually:
|
||||||
|
@ -443,7 +443,7 @@ hf mf gen3freeze
|
||||||
```
|
```
|
||||||
See also
|
See also
|
||||||
```
|
```
|
||||||
script run mfc_gen3_writer -h
|
script run hf_mf_gen3_writer -h
|
||||||
```
|
```
|
||||||
|
|
||||||
Equivalent:
|
Equivalent:
|
||||||
|
@ -518,14 +518,14 @@ Only 7b versions
|
||||||
### Proxmark3 commands
|
### Proxmark3 commands
|
||||||
|
|
||||||
```
|
```
|
||||||
script run ul_uid -h
|
script run hf_mfu_setuid -h
|
||||||
```
|
```
|
||||||
|
|
||||||
When "soft-bricked" (by writing invalid data in block0), these ones may help:
|
When "soft-bricked" (by writing invalid data in block0), these ones may help:
|
||||||
|
|
||||||
```
|
```
|
||||||
hf 14a config h
|
hf 14a config h
|
||||||
script run remagic -u
|
script run run hf_mf_magicrevive -u
|
||||||
```
|
```
|
||||||
|
|
||||||
## MIFARE Ultralight DirectWrite
|
## MIFARE Ultralight DirectWrite
|
||||||
|
@ -723,7 +723,7 @@ Emulates partially UL EV1 48k/128k, NTAG210, NTAG212, NTAGI2C 1K/2K, NTAGI2C 1K
|
||||||
### Proxmark3 commands
|
### Proxmark3 commands
|
||||||
|
|
||||||
```
|
```
|
||||||
script run mfu_magic -h
|
script run hf_mfu_magicwrite -h
|
||||||
```
|
```
|
||||||
|
|
||||||
# DESFire
|
# DESFire
|
||||||
|
@ -840,5 +840,5 @@ hf 15 csetuid E011223344556677
|
||||||
```
|
```
|
||||||
or (ignore errors):
|
or (ignore errors):
|
||||||
```
|
```
|
||||||
script run iso15_magic -u E004013344556677
|
script run hf_15_magic -u E004013344556677
|
||||||
```
|
```
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue