Merge branch 'master' into allin

update 23.9.2020
This commit is contained in:
tharexde 2020-09-23 23:20:18 +02:00
commit 59483e8c3b
46 changed files with 164 additions and 158 deletions

View file

@ -187,7 +187,7 @@ void RunMod(void) {
read_successful = false; read_successful = false;
break; break;
} }
// We're skipping 14 blocks (56 bytes) here, as that "[...] has version/signature/counter data here" according to comments on dumptoemul-mfu // We're skipping 14 blocks (56 bytes) here, as that "[...] has version/signature/counter data here" according to comments on hf_mfu_dumptoemulator
// When converting a bin, it's almost all 0 other than one 0x0F byte, and functionality seems to be unaffected if that byte is set to 0x00. // When converting a bin, it's almost all 0 other than one 0x0F byte, and functionality seems to be unaffected if that byte is set to 0x00.
emlSetMem_xt(dataout, 14 + i, 1, 4); emlSetMem_xt(dataout, 14 + i, 1, 4);
Dbhexdump(4, dataout, 0); Dbhexdump(4, dataout, 0);

View file

@ -15,7 +15,7 @@ The retrieved sniffing session can be acquired by connecting the device
to a client that supports the reconnect capability and issue 'hf 14a list'. to a client that supports the reconnect capability and issue 'hf 14a list'.
In order to view the grabbed authentication attempts in the flash mem, In order to view the grabbed authentication attempts in the flash mem,
you can simply run 'script run read_pwd_mem' or just 'mem dump p l 256' you can simply run 'script run mem_readpwd' or just 'mem dump p l 256'
from the client to view the stored quadlets. from the client to view the stored quadlets.
*/ */
@ -249,5 +249,5 @@ void RunMod(void) {
LEDsoff(); LEDsoff();
SpinDelay(300); SpinDelay(300);
Dbprintf("- [ End ] -> You can take shell back ..."); Dbprintf("- [ End ] -> You can take shell back ...");
Dbprintf("- [ ! ] -> use 'script run read_pwd_mem_spiffs' to print passwords"); Dbprintf("- [ ! ] -> use 'script run data_read_pwd_mem_spiffs' to print passwords");
} }

View file

@ -1363,7 +1363,8 @@ static void PacketReceived(PacketCommandNG *packet) {
break; break;
} }
case CMD_HF_MIFARE_CIDENT: { case CMD_HF_MIFARE_CIDENT: {
MifareCIdent(); bool is_mfc = packet->data.asBytes[0];
MifareCIdent(is_mfc);
break; break;
} }
// Gen 3 magic cards // Gen 3 magic cards

View file

@ -2236,14 +2236,14 @@ void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain) {
OnSuccessMagic(); OnSuccessMagic();
} }
void MifareCIdent(void) { void MifareCIdent(bool is_mfc) {
// variables // variables
uint8_t isGen = 0; uint8_t isGen = 0;
uint8_t rec[1] = {0x00}; uint8_t rec[1] = {0x00};
uint8_t recpar[1] = {0x00}; uint8_t recpar[1] = {0x00};
uint8_t rats[4] = { ISO14443A_CMD_RATS, 0x80, 0x31, 0x73 }; uint8_t rats[4] = { ISO14443A_CMD_RATS, 0x80, 0x31, 0x73 };
uint8_t rdbl[4] = { ISO14443A_CMD_READBLOCK, 0xF0, 0x8D, 0x5f}; uint8_t rdblf0[4] = { ISO14443A_CMD_READBLOCK, 0xF0, 0x8D, 0x5f};
uint8_t rdbl0[4] = { ISO14443A_CMD_READBLOCK, 0x00, 0x02, 0xa8}; uint8_t rdbl00[4] = { ISO14443A_CMD_READBLOCK, 0x00, 0x02, 0xa8};
uint8_t *par = BigBuf_malloc(MAX_PARITY_SIZE); uint8_t *par = BigBuf_malloc(MAX_PARITY_SIZE);
uint8_t *buf = BigBuf_malloc(PM3_CMD_DATA_SIZE); uint8_t *buf = BigBuf_malloc(PM3_CMD_DATA_SIZE);
uint8_t *uid = BigBuf_malloc(10); uint8_t *uid = BigBuf_malloc(10);
@ -2323,31 +2323,34 @@ void MifareCIdent(void) {
goto OUT; goto OUT;
} }
if (! is_mfc) {
// magic ntag test // magic ntag test
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
SpinDelay(40); SpinDelay(40);
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
res = iso14443a_select_card(uid, NULL, &cuid, true, 0, true); res = iso14443a_select_card(uid, NULL, &cuid, true, 0, true);
if (res == 2) { if (res == 2) {
ReaderTransmit(rdbl, sizeof(rdbl), NULL); ReaderTransmit(rdblf0, sizeof(rdblf0), NULL);
res = ReaderReceive(buf, par); res = ReaderReceive(buf, par);
if (res == 18) { if (res == 18) {
isGen = MAGIC_NTAG21X; isGen = MAGIC_NTAG21X;
} }
} }
}
if (is_mfc) {
// magic MFC Gen3 test // magic MFC Gen3 test
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
SpinDelay(40); SpinDelay(40);
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
res = iso14443a_select_card(uid, NULL, &cuid, true, 0, true); res = iso14443a_select_card(uid, NULL, &cuid, true, 0, true);
if (res == 2) { if (res == 2) {
ReaderTransmit(rdbl0, sizeof(rdbl0), NULL); ReaderTransmit(rdbl00, sizeof(rdbl00), NULL);
res = ReaderReceive(buf, par); res = ReaderReceive(buf, par);
if (res == 18) { if (res == 18) {
isGen = MAGIC_GEN_3; isGen = MAGIC_GEN_3;
} }
} }
}
}; };
OUT: OUT:

View file

@ -41,7 +41,7 @@ int MifareECardLoadExt(uint8_t sectorcnt, uint8_t keytype);
void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain); // Work with "magic Chinese" card void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain); // Work with "magic Chinese" card
void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain); void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain);
void MifareCIdent(void); // is "magic chinese" card? void MifareCIdent(bool is_mfc); // is "magic chinese" card?
void MifareHasStaticNonce(void); // Has the tag a static nonce? void MifareHasStaticNonce(void); // Has the tag a static nonce?
int DoGen3Cmd(uint8_t *cmd, uint8_t cmd_len); int DoGen3Cmd(uint8_t *cmd, uint8_t cmd_len);

View file

@ -8,10 +8,10 @@ desc = [[
This script tries to decode Mifare Classic Access bytes This script tries to decode Mifare Classic Access bytes
]] ]]
example = [[ example = [[
1. script run data_mfc_accessdecode -a 7F0F0869 1. script run data_mf_accessdecode -a 7F0F0869
]] ]]
usage = [[ usage = [[
script run data_mfc_accessdecode [-h] [-a <access bytes>] script run data_mf_accessdecode [-h] [-a <access bytes>]
]] ]]
arguments = [[ arguments = [[
-h : this help -h : this help

View file

@ -12,10 +12,10 @@ This script takes a dumpfile from 'hf mf dump' and converts it to a format that
by the emulator by the emulator
]] ]]
example = [[ example = [[
script run hf_mf_dumptoemulator -i dumpdata-foobar.bin script run data_mf_bin2eml -i dumpdata-foobar.bin
]] ]]
usage = [[ usage = [[
script run hf_mf_dumptoemulator [-i <file>] [-o <file>] script run data_mf_bin2eml [-i <file>] [-o <file>]
]] ]]
arguments = [[ arguments = [[
-h This help -h This help

View file

@ -13,10 +13,10 @@ This script takes a dumpfile and produces a html based dump, which is a
bit more easily analyzed. bit more easily analyzed.
]] ]]
example = [[ example = [[
script run data_dumptohtml -o mifarecard_foo.html script run data_mf_bin2html -o mifarecard_foo.html
]] ]]
usage = [[ usage = [[
script run data_dumptohtml [-i <file>] [-o <file>] script run data_mf_bin2html [-i <file>] [-o <file>]
]] ]]
arguments = [[ arguments = [[
-h This help -h This help

View file

@ -10,12 +10,12 @@ desc =[[
This script takes an dumpfile in EML (ASCII) format and converts it to the PM3 dumpbin file to be used with `hf mf restore` This script takes an dumpfile in EML (ASCII) format and converts it to the PM3 dumpbin file to be used with `hf mf restore`
]] ]]
example =[[ example =[[
1. script run data_emulatortodump 1. script run data_mf_eml2bin
2. script run data_emulatortodump -i myfile.eml 2. script run data_mf_eml2bin -i myfile.eml
3. script run data_emulatortodump -i myfile.eml -o myfile.bin 3. script run data_mf_eml2bin -i myfile.eml -o myfile.bin
]] ]]
usage = [[ usage = [[
script run data_emulatortodump [-i <file>] [-o <file>] script run data_mf_eml2bin [-i <file>] [-o <file>]
]] ]]
arguments = [[ arguments = [[
-h This help -h This help

View file

@ -13,10 +13,10 @@ This script takes a dumpfile on EML (ASCII) format and produces a html based dum
bit more easily analyzed. bit more easily analyzed.
]] ]]
example = [[ example = [[
script run data_emulatortohtml -o dumpdata.eml script run data_mf_eml2html -o dumpdata.eml
]] ]]
usage = [[ usage = [[
script run data_emulatortohtml [-i <file>] [-o <file>] script run data_mf_eml2html [-i <file>] [-o <file>]
]] ]]
arguments = [[ arguments = [[
-h This help -h This help

View file

@ -4,7 +4,7 @@ local getopt = require('getopt')
local ansicolors = require('ansicolors') local ansicolors = require('ansicolors')
copyright = '' copyright = ''
usage = 'script run parameters.lua -a 1 -blala -c -de' usage = 'script run example_parameters.lua -a 1 -blala -c -de'
author = 'Martin Holst Swende' author = 'Martin Holst Swende'
version = 'v1.0.2' version = 'v1.0.2'
desc = [[ desc = [[
@ -12,10 +12,10 @@ This is an example script to demonstrate handle parameters in scripts.
For more info, check the comments in the code For more info, check the comments in the code
]] ]]
example = [[ example = [[
1. script run data_example_parameters -a mytestparam_input -c 1. script run example_parameters -a mytestparam_input -c
]] ]]
usage = [[ usage = [[
script run data_example_parameters [-h] [-a <txt>] [-b <txt>] [-c] [-d] [-e] script run example_parameters [-h] [-a <txt>] [-b <txt>] [-c] [-d] [-e]
]] ]]
arguments = [[ arguments = [[
-h This help -h This help
@ -52,7 +52,7 @@ local function main(args)
5 parameters; two with values and three flags. The following 5 parameters; two with values and three flags. The following
should be valid: should be valid:
script run parameters.lua -a 1 -blala -c -de script run example_parameters.lua -a 1 -blala -c -de
Notice two things: Notice two things:
1. 'blala' works just like 'b lala', both set 'b' to 'lala' 1. 'blala' works just like 'b lala', both set 'b' to 'lala'

View file

@ -7,7 +7,7 @@ copyright = ''
author = "Martin Holst Swende" author = "Martin Holst Swende"
version = 'v1.0.2' version = 'v1.0.2'
desc = [[ desc = [[
This is a script to allow raw 1444a commands to be sent and received. This is a script to allow raw 14443a commands to be sent and received.
]] ]]
example = [[ example = [[
# 1. Connect and don't disconnect # 1. Connect and don't disconnect

View file

@ -15,12 +15,12 @@ example = [[
-- ISO15693 slix magic tag -- ISO15693 slix magic tag
script run iso15_magic -u E004013344556677 script run hf_15_magic -u E004013344556677
script run iso15_magic -u E004013344556677 -a script run hf_15_magic -u E004013344556677 -a
]] ]]
usage = [[ usage = [[
script run iso15_magic -h -u <uid> script run hf_15_magic -h -u <uid>
]] ]]
arguments = [[ arguments = [[
-h : this help -h : this help

View file

@ -96,7 +96,7 @@ Known issues; needs to be fixed:
* last byte in last segment is handled incorrectly when it is the last bytes on the card itself (MIM256: => byte 256) * last byte in last segment is handled incorrectly when it is the last bytes on the card itself (MIM256: => byte 256)
--]] --]]
example = "script run legic" example = "script run hf_legic"
author = "Mosci, uhei" author = "Mosci, uhei"
version = "1.0.4" version = "1.0.4"

View file

@ -11,10 +11,10 @@ desc =
This is a script which writes value 0x01 to bytes from position 0x07 until 0xFF on a Legic Prime Tag (MIM256 or MIM1024) -- (created with 'hf legic save my_dump.hex') -- This is a script which writes value 0x01 to bytes from position 0x07 until 0xFF on a Legic Prime Tag (MIM256 or MIM1024) -- (created with 'hf legic save my_dump.hex') --
]] ]]
example = [[ example = [[
script run legic_buffer2card script run hf_legic_buffer2card
]] ]]
usage = [[ usage = [[
script run legic_buffer2card -h script run hf_legic_buffer2card -h
]] ]]
arguments = [[ arguments = [[
-h - Help text -h - Help text

View file

@ -18,7 +18,7 @@ local ansicolors = require('ansicolors')
simplest usage: simplest usage:
Dump a legic tag with 'hf legic dump' Dump a legic tag with 'hf legic dump'
place your 'empty' tag on the reader and run place your 'empty' tag on the reader and run
'script run legic_clone -i orig.bin -w' 'script run hf_legic_clone -i orig.bin -w'
you will see some output like: you will see some output like:
@ -95,11 +95,11 @@ This is a script which creates a clone-dump of a dump from a LEGIC Prime Tag (MI
Create a dump by running `hf legic dump`. Create a dump by running `hf legic dump`.
]] ]]
example = [[ example = [[
script run legic_clone -i my_dump.bin -o my_clone.bin -c f8 script run hf_legic_clone -i my_dump.bin -o my_clone.bin -c f8
script run legic_clone -i my_dump.bin -d -s script run hf_legic_clone -i my_dump.bin -d -s
]] ]]
usage = [[ usage = [[
script run legic_clone [-h] [-i <file>] [-o <file>] [-c <crc>] [-d] [-s] [-w] script run hf_legic_clone [-h] [-i <file>] [-o <file>] [-c <crc>] [-d] [-s] [-w]
]] ]]
arguments = [[ arguments = [[
required : required :

View file

@ -128,10 +128,10 @@ local function dump_tag(uid, numsectors)
-- Save the global args, those are *our* arguments -- Save the global args, those are *our* arguments
local myargs = args local myargs = args
-- Set the arguments for htmldump script -- Set the arguments for data_mf_bin2html script
args =('-i %s.bin -o %s.html'):format(dumpfile, dumpfile) args =('-i %s.bin -o %s.html'):format(dumpfile, dumpfile)
-- call it -- call it
require('htmldump') require('data_mf_bin2html')
-- Set back args. Not that it's used, just for the karma... -- Set back args. Not that it's used, just for the karma...
args = myargs args = myargs

View file

@ -1,7 +1,7 @@
--- ---
-- This Lua script is designed to run with Iceman/RRG Proxmark3 fork -- This Lua script is designed to run with Iceman/RRG Proxmark3 fork
-- Just copy luxeodump.lua to client/luascripts/ -- Just copy hf_mf_dump-luxeo.lua to client/luascripts/
-- and run "script run luxeodump" -- and run "script run hf_mf_dump-luxeo"
-- requirements -- requirements
local cmds = require('commands') local cmds = require('commands')
@ -17,10 +17,10 @@ desc = [[
This is a script that tries to dump and decrypt the data of a specific type of Mifare laundromat token. OBS! Tag must be on the antenna. This is a script that tries to dump and decrypt the data of a specific type of Mifare laundromat token. OBS! Tag must be on the antenna.
]] ]]
example = [[ example = [[
script run hf_mf_dump-laundromat script run hf_mf_dump-luxeo
]] ]]
usage = [[ usage = [[
script run hf_mf_dump-laundromat script run hf_mf_dump-luxeo
]] ]]
arguments = [[ arguments = [[
-h This help -h This help

View file

@ -12,8 +12,7 @@ local read14a = require('read14a')
--[[ --[[
---Suggestions of improvement: ---Suggestions of improvement:
--- Add support another types of dumps: BIN, JSON --- Add support another types of dumps: BIN, JSON
--- Maybe it will be not only as `mfc_gen3_writer`, like a universal dump manager. --- Maybe it will be not only as `hf_mf_gen3_writer`, like a universal dump manager.
--- Add undependence from the operation system. At the moment code not working in Linux.
--- Hide system messages when you writing a dumps, replace it to some of like [#####----------] 40% --- Hide system messages when you writing a dumps, replace it to some of like [#####----------] 40%
-- iceman notes: -- iceman notes:

View file

@ -60,7 +60,7 @@ end
-- waits for answer from pm3 device -- waits for answer from pm3 device
local function checkCommand(response) local function checkCommand(response)
if not response then if not response then
print("Timeout while waiting for response. Increase TIMEOUT in mfckeys.lua to wait longer") print("Timeout while waiting for response. Increase TIMEOUT in hf_mf_keycheck.lua to wait longer")
return nil, "Timeout while waiting for device to respond" return nil, "Timeout while waiting for device to respond"
end end
@ -237,7 +237,7 @@ local function perform_check(uid, numsectors)
local end_time = os.time() local end_time = os.time()
print('') print('')
print('[+] mfckeys - Checkkey execution time: '..os.difftime(end_time, start_time)..' sec') print('[+] hf_mf_keycheck - Checkkey execution time: '..os.difftime(end_time, start_time)..' sec')
core.fast_push_mode(false) core.fast_push_mode(false)

View file

@ -19,7 +19,7 @@ script run hf_mf_magicrevive [-h] [-u]
]] ]]
arguments = [[ arguments = [[
-h this help -h this help
-u remagic a Ultralight tag w 7 bytes UID. -u try to revive a bricked magic Ultralight tag w 7 bytes UID.
]] ]]
--- ---
-- A debug printout-function -- A debug printout-function

View file

@ -16,19 +16,19 @@ This is a script to dump and decrypt the data of a specific type of Mifare Mini
The dump is decrypted. If a raw dump is wanted, use the -r parameter The dump is decrypted. If a raw dump is wanted, use the -r parameter
]] ]]
example = [[ example = [[
script run hf_mfm_dumpdecrypt script run hf_mf_mini_dumpdecrypt
-- selftest -- selftest
script run hf_mfm_dumpdecrypt -t script run hf_mf_mini_dumpdecrypt -t
-- Generate raw dump, into json. -- Generate raw dump, into json.
script run hf_mfm_dumpdecrypt -r script run hf_mf_mini_dumpdecrypt -r
-- load file -- load file
script run hf_mfm_dumpdecrypt -i dumpdata.json script run hf_mf_mini_dumpdecrypt -i dumpdata.json
]] ]]
usage = [[ usage = [[
script run hf_mfm_dumpdecrypt -h -t -r -d -e -v -i dumpdata.json script run hf_mf_mini_dumpdecrypt -h -t -r -d -e -v -i dumpdata.json
]] ]]
arguments = [[ arguments = [[
h this helptext h this helptext

View file

@ -18,14 +18,14 @@ desc = [[
This script will try to make a barebones clone of a tnp3 tag on to a magic generation1 card. This script will try to make a barebones clone of a tnp3 tag on to a magic generation1 card.
]] ]]
example = [[ example = [[
script run hf_mf_clone-tnp3 script run hf_mf_tnp3_clone
script run hf_mf_clone-tnp3 -h script run hf_mf_tnp3_clone -h
script run hf_mf_clone-tnp3 -l script run hf_mf_tnp3_clone -l
script run hf_mf_clone-tnp3 -t aa00 -s 0030 script run hf_mf_tnp3_clone -t aa00 -s 0030
]] ]]
usage = [[ usage = [[
script run hf_mf_clone-tnp3 [-h] [-t <toytype>] [-s <subtype>] script run hf_mf_tnp3_clone [-h] [-t <toytype>] [-s <subtype>]
]] ]]
arguments = [[ arguments = [[
-h : this help -h : this help

View file

@ -16,18 +16,18 @@ This script will try to dump the contents of a Mifare TNP3xxx card.
It will need a valid KeyA in order to find the other keys and decode the card. It will need a valid KeyA in order to find the other keys and decode the card.
]] ]]
example = [[ example = [[
script run hf_mf_dump-tnp3 script run hf_mf_tnp3_dump
script run hf_mf_dump-tnp3 -n script run hf_mf_tnp3_dump -n
script run hf_mf_dump-tnp3 -p script run hf_mf_tnp3_dump -p
script run hf_mf_dump-tnp3 -k aabbccddeeff script run hf_mf_tnp3_dump -k aabbccddeeff
script run hf_mf_dump-tnp3 -k aabbccddeeff -n script run hf_mf_tnp3_dump -k aabbccddeeff -n
script run hf_mf_dump-tnp3 -o myfile script run hf_mf_tnp3_dump -o myfile
script run hf_mf_dump-tnp3 -n -o myfile script run hf_mf_tnp3_dump -n -o myfile
script run hf_mf_dump-tnp3 -p -o myfile script run hf_mf_tnp3_dump -p -o myfile
script run hf_mf_dump-tnp3 -k aabbccddeeff -n -o myfile script run hf_mf_tnp3_dump -k aabbccddeeff -n -o myfile
]] ]]
usage = [[ usage = [[
script run hf_mf_dump-tnp3 [-h] [-k <key>] [-n] [-p] [-o <filename>] script run hf_mf_tnp3_dump [-h] [-k <key>] [-n] [-p] [-o <filename>]
]] ]]
arguments = [[ arguments = [[
-h : this help -h : this help

View file

@ -18,12 +18,12 @@ For an experimental mode, it tries to manipulate some data.
At last it sends all data to the PM3 device memory where it can be used in the command "hf mf sim" At last it sends all data to the PM3 device memory where it can be used in the command "hf mf sim"
]] ]]
example = [[ example = [[
1. script run hf_mf_autosim 1. script run hf_mf_tnp3_sim
2. script run hf_mf_autosim -m 2. script run hf_mf_tnp3_sim -m
3. script run hf_mf_autosim -m -i myfile 3. script run hf_mf_tnp3_sim -m -i myfile
]] ]]
usage = [[ usage = [[
script run hf_mf_autosim [-h] [-m] [-i <filename>] script run hf_mf_tnp3_sim [-h] [-m] [-i <filename>]
]] ]]
arguments = [[ arguments = [[
-h : this help -h : this help

View file

@ -1,5 +1,5 @@
-- Run me like this (connected via USB): ./pm3 -l hf_bruteforce.lua -- Run me like this (connected via USB): ./pm3 -l hf_mf_uidbruteforce.lua
-- Run me like this (connected via Blueshark addon): ./client/proxmark3 /dev/rfcomm0 -l ./hf_bruteforce.lua -- Run me like this (connected via Blueshark addon): ./client/proxmark3 /dev/rfcomm0 -l ./hf_mf_uidbruteforce.lua
local getopt = require('getopt') local getopt = require('getopt')
local ansicolors = require('ansicolors') local ansicolors = require('ansicolors')
@ -13,14 +13,14 @@ This script bruteforces 4 or 7 byte UID Mifare classic card numbers.
example =[[ example =[[
Bruteforce a 4 byte UID Mifare classic card number, starting at 11223344, ending at 11223346. Bruteforce a 4 byte UID Mifare classic card number, starting at 11223344, ending at 11223346.
script run hf_mfc_uidbruteforce -s 0x11223344 -e 0x11223346 -t 1000 -x mfc script run hf_mf_uidbruteforce -s 0x11223344 -e 0x11223346 -t 1000 -x mfc
Bruteforce a 7 byte UID Mifare Ultralight card number, starting at 11223344556677, ending at 11223344556679. Bruteforce a 7 byte UID Mifare Ultralight card number, starting at 11223344556677, ending at 11223344556679.
script run hf_mfc_uidbruteforce -s 0x11223344556677 -e 0x11223344556679 -t 1000 -x mfu script run hf_mf_uidbruteforce -s 0x11223344556677 -e 0x11223344556679 -t 1000 -x mfu
]] ]]
usage = [[ usage = [[
script run hf_mfc_uidbruteforce [-s <start_id>] [-e <end_id>] [-t <timeout>] [-x <mifare_card_type>] script run hf_mf_uidbruteforce [-s <start_id>] [-e <end_id>] [-t <timeout>] [-x <mifare_card_type>]
]] ]]
arguments = [[ arguments = [[
-h this help -h this help

View file

@ -221,13 +221,13 @@ local function configure_magic_ntag(uid)
local pwd, pack = core.keygen_algo_d(uid) local pwd, pack = core.keygen_algo_d(uid)
-- Set the arguments for mfu_magic script v1.0.8 -- Set the arguments for hf_mfu_magicwrite script v1.0.8
-- -t 12 == configure NTAG213F -- -t 12 == configure NTAG213F
-- -u == set UID -- -u == set UID
-- -p == set pwd -- -p == set pwd
-- -a == set pack -- -a == set pack
args =('-t 12 -u %s -p %08X -a %04X'):format(uid, pwd, pack) args =('-t 12 -u %s -p %08X -a %04X'):format(uid, pwd, pack)
require('mfu_magic') require('hf_mfu_magicwrite')
-- Set back args. Not that it's used, just for the karma... -- Set back args. Not that it's used, just for the karma...
args = myargs args = myargs

View file

@ -1,5 +1,5 @@
-- --
-- lf_bulk.lua - A tool to clone a large number of tags at once. -- lf_hid_bulkclone.lua - A tool to clone a large number of tags at once.
-- Updated 2017-04-18 -- Updated 2017-04-18
-- Updated 2018-02-20 iceman -- Updated 2018-02-20 iceman
local getopt = require('getopt') local getopt = require('getopt')

View file

@ -9,31 +9,31 @@ desc = [[
This script will read the flash memory of RDV4 and print the stored passwords/keys. This script will read the flash memory of RDV4 and print the stored passwords/keys.
It was meant to be used as a help tool after using the BogRun standalone mode before SPIFFS. It was meant to be used as a help tool after using the BogRun standalone mode before SPIFFS.
You should now use read_pwd_mem_spiffs instead after the updated BogRun standalone mode. You should now use data_read_pwd_mem_spiffs instead after the updated BogRun standalone mode.
(Iceman) script adapted to read and print keys in the default dictionary flashmemory sections. (Iceman) script adapted to read and print keys in the default dictionary flashmemory sections.
]] ]]
example = [[ example = [[
-- This will scan the first 256 bytes of flash memory for stored passwords -- This will scan the first 256 bytes of flash memory for stored passwords
script run data_readpwdmem script run mem_readpwd
-- This will scan 256 bytes of flash memory at offset 64 for stored passwords -- This will scan 256 bytes of flash memory at offset 64 for stored passwords
script run data_readpwdmem -o 64 script run mem_readpwd -o 64
-- This will scan 32 bytes of flash memory at offset 64 for stored passwords -- This will scan 32 bytes of flash memory at offset 64 for stored passwords
script run data_readpwdmem -o 64 -l 32 script run mem_readpwd -o 64 -l 32
-- This will print the stored Mifare dictionary keys -- This will print the stored Mifare dictionary keys
script run data_readpwdmem -m script run mem_readpwd -m
-- This will print the stored t55xx dictionary passwords -- This will print the stored t55xx dictionary passwords
script run data_readpwdmem -t script run mem_readpwd -t
-- This will print the stored iClass dictionary keys -- This will print the stored iClass dictionary keys
script run data_readpwdmem -i script run mem_readpwd -i
]] ]]
usage = [[ usage = [[
script run data_readpwdmem [-h] [-o <offset>] [-l <length>] [-k <keylength>] [-m] [-t] [-i] script run mem_readpwd [-h] [-o <offset>] [-l <length>] [-k <keylength>] [-m] [-t] [-i]
]] ]]
arguments = [[ arguments = [[
-h : this help -h : this help

View file

@ -11,16 +11,16 @@ It was meant to be used as a help tool after using the BogRun standalone mode.
]] ]]
example = [[ example = [[
-- This will read the hf_bog.log file in SPIFFS and print the stored passwords -- This will read the hf_bog.log file in SPIFFS and print the stored passwords
script run data_readpwdmem-spiffs script run mem_spiffs_readpwd
-- This will read the other.log file in SPIFFS and print the stored passwords -- This will read the other.log file in SPIFFS and print the stored passwords
script run data_readpwdmem-spiffs -f other.log script run mem_spiffs_readpwd -f other.log
-- This will delete the hf_bog.log file from SPIFFS -- This will delete the hf_bog.log file from SPIFFS
script run data_readpwdmem-spiffs -r script run mem_spiffs_readpwd -r
]] ]]
usage = [[ usage = [[
script run data_readpwdmem-spiffs [-h] [-f <filename>] [-r] script run mem_spiffs_readpwd [-h] [-f <filename>] [-r]
]] ]]
arguments = [[ arguments = [[
-h : this help -h : this help

View file

@ -26,16 +26,16 @@ It uses both LF and HF simulations.
-- Author note -- Author note
-- I wrote this as i was doing a PACS audit. This is far from complete, but is easily expandable. -- I wrote this as i was doing a PACS audit. This is far from complete, but is easily expandable.
-- The idea was based on proxbrute, but i needed more options, and support for different readers. -- The idea was based on proxbrute, but i needed more options, and support for different readers.
-- I dont know LUA, so I used Brian Redbeards lf_bulk_program.lua script as a starting point, sorry if its kludgy. -- I dont know LUA, so I used Brian Redbeards lf_hid_bulkclone.lua script as a starting point, sorry if its kludgy.
]] ]]
example = [[ example = [[
-- (the above example would bruteforce pyramid tags, starting at 10:1000, ending at 10:991, and waiting 1 second between each card) -- (the above example would bruteforce pyramid tags, starting at 10:1000, ending at 10:991, and waiting 1 second between each card)
script run hf_lf_multi_bruteforce -r pyramid -f 10 -b 1000 -c 10 -t 1 -d down script run multi_bruteforce -r pyramid -f 10 -b 1000 -c 10 -t 1 -d down
]] ]]
usage = [[ usage = [[
script run hf_lf_multi_bruteforce -r rfid_tag -f facility_code -b base_card_number -c count -t timeout -d direction script run multi_bruteforce -r rfid_tag -f facility_code -b base_card_number -c count -t timeout -d direction
]] ]]
arguments = [[ arguments = [[
-h this help -h this help
@ -110,7 +110,7 @@ local function isempty(s)
return s == nil or s == '' return s == nil or s == ''
end end
-- The code below was blatantly stolen from Brian Redbeard's lf_bulk_program.lua script -- The code below was blatantly stolen from Brian Redbeard's lf_hid_bulkclone.lua script
local function toBits(num, bits) local function toBits(num, bits)
bits = bits or math.max(1, select(2, math.frexp(num))) bits = bits or math.max(1, select(2, math.frexp(num)))
local t = {} local t = {}

View file

@ -35,7 +35,7 @@ example = [[
3. script run lf_t55xx_writetest -t PSK1 3. script run lf_t55xx_writetest -t PSK1
]] ]]
usage = [[ usage = [[
script run test_t55x7 [-h] [-t <modulation type> script run lf_t55xx_writetest [-h] [-t <modulation type>
]] ]]
arguments = [[ arguments = [[
-h this help -h this help

View file

@ -1979,11 +1979,13 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
} }
int isMagic = 0; int isMagic = 0;
if (isMifareClassic || isMifareUltralight) {
isMagic = detect_classic_magic();
if (isMifareClassic) { if (isMifareClassic) {
isMagic = detect_mf_magic(true);
}
if (isMifareUltralight) {
isMagic = detect_mf_magic(false);
}
if (isMifareClassic) {
int res = detect_classic_static_nonce(); int res = detect_classic_static_nonce();
if (res == NONCE_STATIC) if (res == NONCE_STATIC)
PrintAndLogEx(SUCCESS, "Static nonce: " _YELLOW_("yes")); PrintAndLogEx(SUCCESS, "Static nonce: " _YELLOW_("yes"));
@ -2006,7 +2008,6 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
detect_classic_nackbug(false); detect_classic_nackbug(false);
} }
} }
}
if (isMifareUltralight) if (isMifareUltralight)
PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfu info`")); PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfu info`"));

View file

@ -136,7 +136,7 @@ static int usage_hf_mfu_wrbl(void) {
static int usage_hf_mfu_eload(void) { static int usage_hf_mfu_eload(void) {
PrintAndLogEx(NORMAL, "It loads emul dump from the file " _YELLOW_("`filename.eml`")); PrintAndLogEx(NORMAL, "It loads emul dump from the file " _YELLOW_("`filename.eml`"));
PrintAndLogEx(NORMAL, "Hint: See " _YELLOW_("`script run dumptoemul-mfu`") " to convert the .bin to the eml"); PrintAndLogEx(NORMAL, "Hint: See " _YELLOW_("`script run hf_mfu_dumptoemulator`") " to convert the .bin to the eml");
PrintAndLogEx(NORMAL, "Usage: hf mfu eload u <file name w/o `.eml`> [numblocks]"); PrintAndLogEx(NORMAL, "Usage: hf mfu eload u <file name w/o `.eml`> [numblocks]");
PrintAndLogEx(NORMAL, " Options:"); PrintAndLogEx(NORMAL, " Options:");
PrintAndLogEx(NORMAL, " h : this help"); PrintAndLogEx(NORMAL, " h : this help");
@ -1984,6 +1984,7 @@ static int CmdHF14AMfUDump(const char *Cmd) {
iso14a_card_select_t card; iso14a_card_select_t card;
mfu_dump_t dump_file_data; mfu_dump_t dump_file_data;
memset(&dump_file_data, 0, sizeof(dump_file_data));
uint8_t get_version[] = {0, 0, 0, 0, 0, 0, 0, 0}; uint8_t get_version[] = {0, 0, 0, 0, 0, 0, 0, 0};
uint8_t get_counter_tearing[][4] = {{0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}}; uint8_t get_counter_tearing[][4] = {{0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}};
uint8_t get_signature[32]; uint8_t get_signature[32];

View file

@ -1154,13 +1154,14 @@ int detect_classic_static_nonce(void) {
return NONCE_FAIL; return NONCE_FAIL;
} }
/* try to see if card responses to "chinese magic backdoor" commands. */ /* try to see if card responses to "Chinese magic backdoor" commands. */
int detect_classic_magic(void) { int detect_mf_magic(bool is_mfc) {
uint8_t isGeneration = 0; uint8_t isGeneration = 0;
PacketResponseNG resp; PacketResponseNG resp;
clearCommandBuffer(); clearCommandBuffer();
SendCommandNG(CMD_HF_MIFARE_CIDENT, NULL, 0); uint8_t payload[] = { is_mfc };
SendCommandNG(CMD_HF_MIFARE_CIDENT, payload, sizeof(payload));
if (WaitForResponseTimeout(CMD_HF_MIFARE_CIDENT, &resp, 1500)) { if (WaitForResponseTimeout(CMD_HF_MIFARE_CIDENT, &resp, 1500)) {
if (resp.status == PM3_SUCCESS) if (resp.status == PM3_SUCCESS)
isGeneration = resp.data.asBytes[0]; isGeneration = resp.data.asBytes[0];

View file

@ -88,7 +88,7 @@ int tryDecryptWord(uint32_t nt, uint32_t ar_enc, uint32_t at_enc, uint8_t *data,
int detect_classic_prng(void); int detect_classic_prng(void);
int detect_classic_nackbug(bool verbose); int detect_classic_nackbug(bool verbose);
int detect_classic_magic(void); int detect_mf_magic(bool is_mfc);
int detect_classic_static_nonce(void); int detect_classic_static_nonce(void);
void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len, bool isEncrypted); void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len, bool isEncrypted);
#endif #endif

View file

@ -55,7 +55,7 @@ static int l_clearCommandBuffer(lua_State *L) {
} }
/** /**
* Enable / Disable fast push mode for lua scripts like mfckeys * Enable / Disable fast push mode for lua scripts like hf_mf_keycheck
* The following params expected: * The following params expected:
* *
*@brief l_fast_push_mode *@brief l_fast_push_mode

View file

@ -233,7 +233,7 @@ Options
--- ---
i <file> : Specifies the dump-file (input). If omitted, 'dumpdata.bin' is used i <file> : Specifies the dump-file (input). If omitted, 'dumpdata.bin' is used
pm3 --> script run dumptoemul -i dumpdata.bin pm3 --> script run data_mf_bin2eml -i dumpdata.bin
``` ```
Write to MIFARE block Write to MIFARE block
@ -285,7 +285,7 @@ Simulate MIFARE Sequence
``` ```
pm3 --> hf mf chk *1 ? d mfc_default_keys pm3 --> hf mf chk *1 ? d mfc_default_keys
pm3 --> hf mf dump 1 pm3 --> hf mf dump 1
pm3 --> script run dumptoemul -i dumpdata.bin pm3 --> script run data_mf_bin2eml -i dumpdata.bin
pm3 --> hf mf eload 353C2AA6 pm3 --> hf mf eload 353C2AA6
pm3 --> hf mf sim u 353c2aa6 pm3 --> hf mf sim u 353c2aa6
``` ```
@ -305,19 +305,19 @@ pm3 --> hf mfu info
Clone MIFARE Ultralight EV1 Sequence Clone MIFARE Ultralight EV1 Sequence
``` ```
pm3 --> hf mfu dump k FFFFFFFF pm3 --> hf mfu dump k FFFFFFFF
pm3 --> script run dumptoemul-mfu -i hf-mfu-XXXX-dump.bin -o hf-mfu-XXXX-dump.eml pm3 --> script run hf_mfu_dumptoemulator -i hf-mfu-XXXX-dump.bin -o hf-mfu-XXXX-dump.eml
pm3 --> hf mfu eload u hf-mfu-XXXX-dump.eml pm3 --> hf mfu eload u hf-mfu-XXXX-dump.eml
pm3 --> hf mfu sim t 7 u hf-mfu-XXXX-dump.eml pm3 --> hf mfu sim t 7 u hf-mfu-XXXX-dump.eml
``` ```
Bruteforce MIFARE Classic card numbers from 11223344 to 11223346 Bruteforce MIFARE Classic card numbers from 11223344 to 11223346
``` ```
pm3 --> script run hf_bruteforce -s 0x11223344 -e 0x11223346 -t 1000 -x mfc pm3 --> script run hf_mf_uidbruteforce -s 0x11223344 -e 0x11223346 -t 1000 -x mfc
``` ```
Bruteforce MIFARE Ultralight EV1 card numbers from 11223344556677 to 11223344556679 Bruteforce MIFARE Ultralight EV1 card numbers from 11223344556677 to 11223344556679
``` ```
pm3 --> script run hf_bruteforce -s 0x11223344556677 -e 0x11223344556679 -t 1000 -x mfu pm3 --> script run hf_mf_uidbruteforce -s 0x11223344556677 -e 0x11223344556679 -t 1000 -x mfu
``` ```
## Wiegand manipulation ## Wiegand manipulation
@ -563,7 +563,7 @@ Options
-i <file> Specifies the dump-file (input). If omitted, 'dumpdata.bin' is used -i <file> Specifies the dump-file (input). If omitted, 'dumpdata.bin' is used
-o <filename> Specifies the output file. If omitted, <uid>.eml is used -o <filename> Specifies the output file. If omitted, <uid>.eml is used
pm3 --> script run dumptoemul -i xxxxxxxxxxxxxx.bin pm3 --> script run data_mf_bin2eml -i xxxxxxxxxxxxxx.bin
``` ```
Convert .eml to .bin Convert .eml to .bin
@ -573,7 +573,7 @@ Options
-i <filename> Specifies the dump-file (input). If omitted, 'dumpdata.eml' is used -i <filename> Specifies the dump-file (input). If omitted, 'dumpdata.eml' is used
-o <filename> Specifies the output file. If omitted, <currdate>.bin is used -o <filename> Specifies the output file. If omitted, <currdate>.bin is used
pm3 --> script run emul2dump -i myfile.eml -o myfile.bin pm3 --> script run data_mf_eml2bin -i myfile.eml -o myfile.bin
``` ```
Format Mifare card Format Mifare card
@ -585,7 +585,7 @@ Options
-a <access> The new access bytes that will be written to the card -a <access> The new access bytes that will be written to the card
-x Execute the commands aswell -x Execute the commands aswell
pm3 --> script run formatMifare -k FFFFFFFFFFFF -n FFFFFFFFFFFF -x pm3 --> script run hf_mf_format -k FFFFFFFFFFFF -n FFFFFFFFFFFF -x
``` ```
## Memory ## Memory

View file

@ -195,7 +195,7 @@ hf mf csetuid 11223344 0044 18
``` ```
``` ```
script run remagic script run run hf_mf_magicrevive
``` ```
To execute commands manually: To execute commands manually:
@ -443,7 +443,7 @@ hf mf gen3freeze
``` ```
See also See also
``` ```
script run mfc_gen3_writer -h script run hf_mf_gen3_writer -h
``` ```
Equivalent: Equivalent:
@ -518,14 +518,14 @@ Only 7b versions
### Proxmark3 commands ### Proxmark3 commands
``` ```
script run ul_uid -h script run hf_mfu_setuid -h
``` ```
When "soft-bricked" (by writing invalid data in block0), these ones may help: When "soft-bricked" (by writing invalid data in block0), these ones may help:
``` ```
hf 14a config h hf 14a config h
script run remagic -u script run run hf_mf_magicrevive -u
``` ```
## MIFARE Ultralight DirectWrite ## MIFARE Ultralight DirectWrite
@ -723,7 +723,7 @@ Emulates partially UL EV1 48k/128k, NTAG210, NTAG212, NTAGI2C 1K/2K, NTAGI2C 1K
### Proxmark3 commands ### Proxmark3 commands
``` ```
script run mfu_magic -h script run hf_mfu_magicwrite -h
``` ```
# DESFire # DESFire
@ -840,5 +840,5 @@ hf 15 csetuid E011223344556677
``` ```
or (ignore errors): or (ignore errors):
``` ```
script run iso15_magic -u E004013344556677 script run hf_15_magic -u E004013344556677
``` ```