github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-20 05:13:46 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

FIX: this fixes the "hf mf sniff l d f" command, which has been broken for a while. The cuid is correct used for decrypting.

Browse source 
FIX: The flushing of logentries.
ADD: "hf mf sniff" - added the sniffing of UID's with a uidlen of 10.

Whats left? The key is not always found even if we use the "mfkey64" approach.

ADD: added the parity_zero attack in "hf mf mifare".  Still not working since piwi's changes to the iso14443a.c,  maybe needs a param to tell it to collect nonces for this special attack.
CHG: extracted some help-texts into usage_* methods. Changed some text as well

FIX:  "hf mf sim" command now uses both  mfkey32 and mfkey32_moebius version to find the key in attack mode.
CHG:  "hf mf sim" also now defaults to emul_memory to read a 4 byte UID.
This commit is contained in:
iceman1001 2016-04-18 13:18:02 +02:00
commit 6c84c90017
4 changed files with 313 additions and 339 deletions
Download patch file Download diff file Expand all files Collapse all files

526
client/cmdhfmf.c
View file

@ -13,9 +13,60 @@
#include "nonce2key/nonce2key.h" #include "nonce2key/nonce2key.h"
static int CmdHelp(const char *Cmd); static int CmdHelp(const char *Cmd);
int usage_hf14_mifare(void){
PrintAndLog("Usage: hf mf mifare [h] <block number>");
PrintAndLog("options:");
PrintAndLog(" h this help");
PrintAndLog(" <block number> (Optional) target other key A than block 0.");
PrintAndLog("sample:");
PrintAndLog(" hf mf mifare");
PrintAndLog(" hf mf mifare 16");
return 0;
}
int usage_hf14_mf1ksim(void){
PrintAndLog("Usage: hf mf sim [h] u <uid (8,14,20 hex symbols)> n <numreads> i x");
PrintAndLog("options:");
PrintAndLog(" h this help");
PrintAndLog(" u (Optional) UID 4,7 or 10bytes. If not specified, the UID 4b from emulator memory will be used");
PrintAndLog(" n (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");
PrintAndLog(" i (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");
PrintAndLog(" x (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");
PrintAndLog("samples:");
PrintAndLog(" hf mf sim u 0a0a0a0a");
PrintAndLog(" hf mf sim u 11223344556677");
PrintAndLog(" hf mf sim u 112233445566778899AA");
return 0;
}
int usage_hf14_dbg(void){
PrintAndLog("Usage: hf mf dbg [h] <debug level>");
PrintAndLog("options:");
PrintAndLog(" h this help");
PrintAndLog(" <debug level> (Optional) see list for valid levels");
PrintAndLog(" 0 - no debug messages");
PrintAndLog(" 1 - error messages");
PrintAndLog(" 2 - plus information messages");
PrintAndLog(" 3 - plus debug messages");
PrintAndLog(" 4 - print even debug messages in timing critical functions");
PrintAndLog(" Note: this option therefore may cause malfunction itself");
PrintAndLog("samples:");
PrintAndLog(" hf mf dbg 3");
return 0;
}
int usage_hf14_sniff(void){
PrintAndLog("It continuously gets data from the field and saves it to: log, emulator, emulator file.");
PrintAndLog("Usage: hf mf sniff [h] [l] [d] [f]");
PrintAndLog("options:");
PrintAndLog(" h this help");
PrintAndLog(" l save encrypted sequence to logfile `uid.log`");
PrintAndLog(" d decrypt sequence and put it to log file `uid.log`");
// PrintAndLog(" n/a e decrypt sequence, collect read and write commands and save the result of the sequence to emulator memory");
PrintAndLog(" f decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`");
PrintAndLog("sample:");
PrintAndLog(" hf mf sniff l d f");
return 0;
}
int CmdHF14AMifare(const char *Cmd) int CmdHF14AMifare(const char *Cmd) {
{
uint32_t uid = 0; uint32_t uid = 0;
uint32_t nt = 0, nr = 0; uint32_t nt = 0, nr = 0;
uint64_t par_list = 0, ks_list = 0, r_key = 0; uint64_t par_list = 0, ks_list = 0, r_key = 0;
@ -24,21 +75,16 @@ int CmdHF14AMifare(const char *Cmd)
uint8_t blockNo = 0; uint8_t blockNo = 0;
char cmdp = param_getchar(Cmd, 0); char cmdp = param_getchar(Cmd, 0);
if ( cmdp == 'H' || cmdp == 'h') { if ( cmdp == 'H' || cmdp == 'h') return usage_hf14_mifare();
PrintAndLog("Usage: hf mf mifare <block number>");
PrintAndLog(" sample: hf mf mifare 0");
return 0;
}
blockNo = param_get8(Cmd, 0); blockNo = param_get8(Cmd, 0);
UsbCommand c = {CMD_READER_MIFARE, {true, blockNo, 0}}; UsbCommand c = {CMD_READER_MIFARE, {true, blockNo, 0}};
// message // message
printf("-------------------------------------------------------------------------\n"); printf("-------------------------------------------------------------------------\n");
printf("Executing command. Expected execution time: 25sec on average :-)\n"); printf("Executing darkside attack. Expected execution time: 25sec on average :-)\n");
printf("Press button on the proxmark3 device to abort both proxmark3 and client.\n"); printf("Press button on the proxmark3 device to abort both proxmark3 and client.\n");
printf("-------------------------------------------------------------------------\n"); printf("-------------------------------------------------------------------------\n");
clock_t t1 = clock(); clock_t t1 = clock();
start: start:
@ -65,7 +111,13 @@ start:
UsbCommand resp; UsbCommand resp;
if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) { if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
isOK = resp.arg[0]; isOK = resp.arg[0];
printf("\n\n"); printf("\n");
uid = (uint32_t)bytes_to_num(resp.d.asBytes + 0, 4);
nt = (uint32_t)bytes_to_num(resp.d.asBytes + 4, 4);
par_list = bytes_to_num(resp.d.asBytes + 8, 8);
ks_list = bytes_to_num(resp.d.asBytes + 16, 8);
nr = bytes_to_num(resp.d.asBytes + 24, 4);
switch (isOK) { switch (isOK) {
case -1 : PrintAndLog("Button pressed. Aborted.\n"); break; case -1 : PrintAndLog("Button pressed. Aborted.\n"); break;
case -2 : PrintAndLog("Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests).\n"); break; case -2 : PrintAndLog("Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests).\n"); break;
@ -74,17 +126,19 @@ start:
PrintAndLog("generating polynomial with 16 effective bits only, but shows unexpected behaviour.\n"); break; PrintAndLog("generating polynomial with 16 effective bits only, but shows unexpected behaviour.\n"); break;
default: ; default: ;
} }
uid = (uint32_t)bytes_to_num(resp.d.asBytes + 0, 4);
nt = (uint32_t)bytes_to_num(resp.d.asBytes + 4, 4);
par_list = bytes_to_num(resp.d.asBytes + 8, 8);
ks_list = bytes_to_num(resp.d.asBytes + 16, 8);
nr = bytes_to_num(resp.d.asBytes + 24, 4);
break; break;
} }
} }
printf("\n"); printf("\n");
// par == 0
if (isOK == -1 && par_list == 0) {
if (!nonce2key_ex(uid, nt, nr, ks_list, &r_key) ){
PrintAndLog("Found valid key: %012"llx" \n", r_key);
goto END;
}
}
// error // error
if (isOK != 1) return 1; if (isOK != 1) return 1;
@ -98,7 +152,7 @@ start:
} else { } else {
PrintAndLog("Found valid key: %012"llx" \n", r_key); PrintAndLog("Found valid key: %012"llx" \n", r_key);
} }
END:
t1 = clock() - t1; t1 = clock() - t1;
if ( t1 > 0 ) if ( t1 > 0 )
PrintAndLog("Time in darkside: %.0f ticks\n", (float)t1); PrintAndLog("Time in darkside: %.0f ticks\n", (float)t1);
@ -280,8 +334,7 @@ uint8_t NumBlocksPerSector(uint8_t sectorNo)
} }
} }
int CmdHF14AMfDump(const char *Cmd) int CmdHF14AMfDump(const char *Cmd) {
{
uint8_t sectorNo, blockNo; uint8_t sectorNo, blockNo;
uint8_t keyA[40][6]; uint8_t keyA[40][6];
@ -453,8 +506,7 @@ int CmdHF14AMfDump(const char *Cmd)
return 0; return 0;
} }
int CmdHF14AMfRestore(const char *Cmd) int CmdHF14AMfRestore(const char *Cmd) {
{
uint8_t sectorNo,blockNo; uint8_t sectorNo,blockNo;
uint8_t keyType = 0; uint8_t keyType = 0;
uint8_t key[6] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF}; uint8_t key[6] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
@ -563,8 +615,7 @@ int CmdHF14AMfRestore(const char *Cmd)
return 0; return 0;
} }
int CmdHF14AMfNested(const char *Cmd) int CmdHF14AMfNested(const char *Cmd) {
{
int i, j, res, iterations; int i, j, res, iterations;
sector *e_sector = NULL; sector *e_sector = NULL;
uint8_t blockNo = 0; uint8_t blockNo = 0;
@ -830,8 +881,7 @@ int CmdHF14AMfNested(const char *Cmd)
return 0; return 0;
} }
int CmdHF14AMfNestedHard(const char *Cmd) int CmdHF14AMfNestedHard(const char *Cmd) {
{
uint8_t blockNo = 0; uint8_t blockNo = 0;
uint8_t keyType = 0; uint8_t keyType = 0;
uint8_t trgBlockNo = 0; uint8_t trgBlockNo = 0;
@ -946,8 +996,7 @@ int CmdHF14AMfNestedHard(const char *Cmd)
return 0; return 0;
} }
int CmdHF14AMfChk(const char *Cmd) int CmdHF14AMfChk(const char *Cmd) {
{
if (strlen(Cmd)<3) { if (strlen(Cmd)<3) {
PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d] [<key (12 hex symbols)>] [<dic (*.dic)>]"); PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d] [<key (12 hex symbols)>] [<dic (*.dic)>]");
PrintAndLog(" * - all sectors"); PrintAndLog(" * - all sectors");
@ -1236,116 +1285,242 @@ int CmdHF14AMfChk(const char *Cmd)
return 0; return 0;
} }
int CmdHF14AMf1kSim(const char *Cmd) { int CmdHF14AMf1kSim(const char *Cmd) {
uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0}; uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
uint8_t exitAfterNReads = 0; uint8_t exitAfterNReads = 0;
uint8_t flags = 0; uint8_t flags = (FLAG_UID_IN_EMUL | FLAG_4B_UID_IN_DATA);
int uidlen = 0; int uidlen = 0;
uint8_t pnr = 0;
uint8_t cmdp = param_getchar(Cmd, 0); uint8_t cmdp = param_getchar(Cmd, 0);
if (cmdp == 'h' || cmdp == 'H') { if (cmdp == 'h' || cmdp == 'H') return usage_hf14_mf1ksim();
PrintAndLog("Usage: hf mf sim u <uid (8 hex symbols)> n <numreads> i x");
PrintAndLog(" h this help"); cmdp = param_getchar(Cmd, pnr);
PrintAndLog(" u (Optional) UID 4,7 or 10bytes. If not specified, the UID from emulator memory will be used"); if (cmdp == 'u' || cmdp == 'U') {
PrintAndLog(" n (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");
PrintAndLog(" i (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");
PrintAndLog(" x (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");
PrintAndLog("samples:");
PrintAndLog(" hf mf sim u 0a0a0a0a");
PrintAndLog(" hf mf sim u 11223344556677");
PrintAndLog(" hf mf sim u 112233445566778899AA");
return 0;
}
uint8_t pnr = 0;
if (param_getchar(Cmd, pnr) == 'u') {
param_gethex_ex(Cmd, pnr+1, uid, &uidlen); param_gethex_ex(Cmd, pnr+1, uid, &uidlen);
switch(uidlen){ switch(uidlen){
case 20: flags |= FLAG_10B_UID_IN_DATA; break; case 20: flags = FLAG_10B_UID_IN_DATA; break;
case 14: flags |= FLAG_7B_UID_IN_DATA; break; case 14: flags = FLAG_7B_UID_IN_DATA; break;
case 8: flags |= FLAG_4B_UID_IN_DATA; break; case 8: flags = FLAG_4B_UID_IN_DATA; break;
default: default: return usage_hf14_mf1ksim();
PrintAndLog("UID, if specified, must include 8, 14 or 20 HEX symbols , %d", uidlen>>1);
return 1;
} }
pnr +=2; pnr +=2;
} }
if (param_getchar(Cmd, pnr) == 'n') { cmdp = param_getchar(Cmd, pnr);
exitAfterNReads = param_get8(Cmd,pnr+1); if (cmdp == 'n' || cmdp == 'N') {
exitAfterNReads = param_get8(Cmd, pnr+1);
pnr += 2; pnr += 2;
} }
if (param_getchar(Cmd, pnr) == 'i' ) { cmdp = param_getchar(Cmd, pnr);
if (cmdp == 'i' || cmdp == 'I' ) {
flags |= FLAG_INTERACTIVE; flags |= FLAG_INTERACTIVE;
pnr++; pnr++;
} }
if (param_getchar(Cmd, pnr) == 'x' ) { cmdp = param_getchar(Cmd, pnr);
if (cmdp == 'x' || cmdp == 'X') {
flags |= FLAG_NR_AR_ATTACK; flags |= FLAG_NR_AR_ATTACK;
} }
PrintAndLog(" uid:%s, numreads:%d, flags:%d (0x%02x) " PrintAndLog(" uid:%s, numreads:%d, flags:%d (0x%02x) "
, (uidlen == 0 ) ? "N/A" : sprint_hex(uid, uidlen) , (uidlen == 0 ) ? "N/A" : sprint_hex(uid, uidlen>>1)
, exitAfterNReads , exitAfterNReads
, flags , flags
, flags); , flags);
UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}}; UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads, 0}};
memcpy(c.d.asBytes, uid, sizeof(uid)); memcpy(c.d.asBytes, uid, sizeof(uid));
clearCommandBuffer(); clearCommandBuffer();
SendCommand(&c); SendCommand(&c);
if(flags & FLAG_INTERACTIVE) if(flags & FLAG_INTERACTIVE) {
{ uint8_t data[32];
uint8_t data[40]; uint64_t key;
uint8_t key[6];
UsbCommand resp; UsbCommand resp;
PrintAndLog("Press pm3-button or send another cmd to abort simulation"); PrintAndLog("Press pm3-button or send another cmd to abort simulation");
while( !ukbhit() ){ while( !ukbhit() ){
if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500) ) continue; if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500) ) continue;
if ( !(flags & FLAG_NR_AR_ATTACK) ) break; if ( !(flags & FLAG_NR_AR_ATTACK) ) break;
if ( (resp.arg[0] & 0xffff) != CMD_SIMULATE_MIFARE_CARD ) break; if ( (resp.arg[0] & 0xffff) != CMD_SIMULATE_MIFARE_CARD ) break;
memset(data, 0x00, sizeof(data)); memset(data, 0x00, sizeof(data));
memset(key, 0x00, sizeof(key));
int len = (resp.arg[1] > sizeof(data)) ? sizeof(data) : resp.arg[1]; int len = (resp.arg[1] > sizeof(data)) ? sizeof(data) : resp.arg[1];
memcpy(data, resp.d.asBytes, len); memcpy(data, resp.d.asBytes, len);
key = 0;
// CUID is always 4 first bytes. bool found = tryMfk32(data, &key);
uint64_t cuid = bytes_to_num(data, 4 ); found ^= tryMfk32_moebius(data, &key);
if ( found ) break;
// this needs to be fixed. ICEMAN
if ( memcmp(data, "\x00\x00\x00\x00", 4) == 0 ) {
tryMfk32(cuid, data, key);
} else {
tryMfk64(cuid, data, key);
}
} }
} }
return 0; return 0;
} }
int CmdHF14AMfDbg(const char *Cmd) { int CmdHF14AMfSniff(const char *Cmd){
int dbgMode = param_get32ex(Cmd, 0, 0, 10); bool wantLogToFile = FALSE;
if (dbgMode > 4) bool wantDecrypt = FALSE;
PrintAndLog("Max debug mode parameter is 4 \n"); //bool wantSaveToEml = FALSE; TODO
bool wantSaveToEmlFile = FALSE;
if (strlen(Cmd) < 1 || !param_getchar(Cmd, 0) || dbgMode > 4) { //var
PrintAndLog("Usage: hf mf dbg <debug level>"); int tmpchar;
PrintAndLog(" 0 - no debug messages"); int res = 0;
PrintAndLog(" 1 - error messages"); int len = 0;
PrintAndLog(" 2 - plus information messages"); int blockLen = 0;
PrintAndLog(" 3 - plus debug messages"); int pckNum = 0;
PrintAndLog(" 4 - print even debug messages in timing critical functions"); int num = 0;
PrintAndLog(" Note: this option therefore may cause malfunction itself"); uint8_t uid[10];
return 0; uint8_t uid_len = 0;
} uint8_t atqa[2] = {0x00, 0x00};
uint8_t sak = 0;
bool isTag = FALSE;
uint8_t *buf = NULL;
uint16_t bufsize = 0;
uint8_t *bufPtr = NULL;
uint16_t traceLen = 0;
memset(uid, 0x00, sizeof(uid));
char ctmp = param_getchar(Cmd, 0);
if ( ctmp == 'h' || ctmp == 'H' ) return usage_hf14_sniff();
for (int i = 0; i < 4; i++) {
ctmp = param_getchar(Cmd, i);
if (ctmp == 'l' || ctmp == 'L') wantLogToFile = true;
if (ctmp == 'd' || ctmp == 'D') wantDecrypt = true;
//if (ctmp == 'e' || ctmp == 'E') wantSaveToEml = true; TODO
if (ctmp == 'f' || ctmp == 'F') wantSaveToEmlFile = true;
}
printf("-------------------------------------------------------------------------\n");
printf("Executing mifare sniffing command. \n");
printf("Press the key on the proxmark3 device to abort both proxmark3 and client.\n");
printf("Press the key on pc keyboard to abort the client.\n");
printf("-------------------------------------------------------------------------\n");
UsbCommand c = {CMD_MIFARE_SNIFFER, {0, 0, 0}};
clearCommandBuffer();
SendCommand(&c);
// wait cycle
while (true) {
printf(".");
fflush(stdout);
if (ukbhit()) {
tmpchar = getchar();
(void)tmpchar;
printf("\naborted via keyboard!\n");
break;
}
UsbCommand resp;
if (WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
res = resp.arg[0] & 0xff;
traceLen = resp.arg[1];
len = resp.arg[2];
// we are done?
if (res == 0) {
free(buf);
return 0;
}
if (res == 1) { // there is (more) data to be transferred
if (pckNum == 0) { // first packet, (re)allocate necessary buffer
if (traceLen > bufsize) {
uint8_t *p;
if (buf == NULL) // not yet allocated
p = malloc(traceLen);
else // need more memory
p = realloc(buf, traceLen);
if (p == NULL) {
PrintAndLog("Cannot allocate memory for trace");
free(buf);
return 2;
}
buf = p;
}
bufPtr = buf;
bufsize = traceLen;
memset(buf, 0x00, traceLen);
}
if (bufPtr == NULL) {
PrintAndLog("Cannot allocate memory for trace");
free(buf);
return 2;
}
// what happens if LEN is bigger then TRACELEN --iceman
memcpy(bufPtr, resp.d.asBytes, len);
bufPtr += len;
pckNum++;
}
if (res == 2) { // received all data, start displaying
blockLen = bufPtr - buf;
bufPtr = buf;
printf(">\n");
PrintAndLog("received trace len: %d packages: %d", blockLen, pckNum);
while (bufPtr - buf < blockLen) {
bufPtr += 6; // skip (void) timing information
len = *((uint16_t *)bufPtr);
if(len & 0x8000) {
isTag = true;
len &= 0x7fff;
} else {
isTag = false;
}
bufPtr += 2;
if ((len == 17) && (bufPtr[0] == 0xff) && (bufPtr[1] == 0xff) && (bufPtr[15] == 0xff) && (bufPtr[16] == 0xff)) {
memcpy(uid, bufPtr + 2, 10);
memcpy(atqa, bufPtr + 2 + 10, 2);
switch (atqa[0] & 0xC0) {
case 0x80: uid_len = 10; break;
case 0x40: uid_len = 7; break;
default: uid_len = 4; break;
}
sak = bufPtr[14];
PrintAndLog("tag select uid| %s atqa:0x%02x%02x sak:0x%02x",
sprint_hex(uid, uid_len),
atqa[1],
atqa[0],
sak);
if (wantLogToFile || wantDecrypt) {
FillFileNameByUID(logHexFileName, uid, ".log", uid_len);
AddLogCurrentDT(logHexFileName);
}
if (wantDecrypt)
mfTraceInit(uid, uid_len, atqa, sak, wantSaveToEmlFile);
} else {
PrintAndLog("%03d| %s |%s", num, isTag ? "TAG" : "RDR", sprint_hex(bufPtr, len));
if (wantLogToFile)
AddLogHex(logHexFileName, isTag ? "TAG| ":"RDR| ", bufPtr, len);
if (wantDecrypt)
mfTraceDecode(bufPtr, len, wantSaveToEmlFile);
num++;
}
bufPtr += len;
bufPtr += ((len-1)/8+1); // ignore parity
}
pckNum = 0;
}
} // resp not NULL
} // while (true)
free(buf);
return 0;
}
int CmdHF14AMfDbg(const char *Cmd) {
char ctmp = param_getchar(Cmd, 0);
if (strlen(Cmd) < 1 || ctmp == 'h'|| ctmp == 'H') return usage_hf14_dbg();
uint8_t dbgMode = param_get8ex(Cmd, 0, 0, 10);
if (dbgMode > 4) return usage_hf14_dbg();
UsbCommand c = {CMD_MIFARE_SET_DBGMODE, {dbgMode, 0, 0}}; UsbCommand c = {CMD_MIFARE_SET_DBGMODE, {dbgMode, 0, 0}};
SendCommand(&c); SendCommand(&c);
@ -2066,172 +2241,9 @@ int CmdHF14AMfCSave(const char *Cmd) {
} }
} }
int CmdHF14AMfSniff(const char *Cmd){
bool wantLogToFile = 0;
bool wantDecrypt = 0;
//bool wantSaveToEml = 0; TODO
bool wantSaveToEmlFile = 0;
//var
int tmpchar;
int res = 0;
int len = 0;
int blockLen = 0;
int pckNum = 0;
int num = 0;
uint8_t uid[10];
uint8_t uid_len = 0;
uint8_t atqa[2] = {0x00, 0x00};
uint8_t sak = 0;
bool isTag;
uint8_t *buf = NULL;
uint16_t bufsize = 0;
uint8_t *bufPtr = NULL;
memset(uid, 0x00, sizeof(uid));
char ctmp = param_getchar(Cmd, 0);
if ( ctmp == 'h' || ctmp == 'H' ) {
PrintAndLog("It continuously gets data from the field and saves it to: log, emulator, emulator file.");
PrintAndLog("You can specify:");
PrintAndLog(" l - save encrypted sequence to logfile `uid.log`");
PrintAndLog(" d - decrypt sequence and put it to log file `uid.log`");
PrintAndLog(" n/a e - decrypt sequence, collect read and write commands and save the result of the sequence to emulator memory");
PrintAndLog(" f - decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`");
PrintAndLog("Usage: hf mf sniff [l][d][e][f]");
PrintAndLog(" sample: hf mf sniff l d e");
return 0;
}
for (int i = 0; i < 4; i++) {
ctmp = param_getchar(Cmd, i);
if (ctmp == 'l' || ctmp == 'L') wantLogToFile = true;
if (ctmp == 'd' || ctmp == 'D') wantDecrypt = true;
//if (ctmp == 'e' || ctmp == 'E') wantSaveToEml = true; TODO
if (ctmp == 'f' || ctmp == 'F') wantSaveToEmlFile = true;
}
printf("-------------------------------------------------------------------------\n");
printf("Executing command. \n");
printf("Press the key on the proxmark3 device to abort both proxmark3 and client.\n");
printf("Press the key on pc keyboard to abort the client.\n");
printf("-------------------------------------------------------------------------\n");
UsbCommand c = {CMD_MIFARE_SNIFFER, {0, 0, 0}};
clearCommandBuffer();
SendCommand(&c);
// wait cycle
while (true) {
printf(".");
fflush(stdout);
if (ukbhit()) {
tmpchar = getchar();
(void)tmpchar;
printf("\naborted via keyboard!\n");
break;
}
UsbCommand resp;
if (WaitForResponseTimeout(CMD_ACK,&resp,2000)) {
res = resp.arg[0] & 0xff;
uint16_t traceLen = resp.arg[1];
len = resp.arg[2];
// we are done?
if (res == 0) {
free(buf);
return 0;
}
if (res == 1) { // there is (more) data to be transferred
if (pckNum == 0) { // first packet, (re)allocate necessary buffer
if (traceLen > bufsize) {
uint8_t *p;
if (buf == NULL) { // not yet allocated
p = malloc(traceLen);
} else { // need more memory
p = realloc(buf, traceLen);
}
if (p == NULL) {
PrintAndLog("Cannot allocate memory for trace");
free(buf);
return 2;
}
buf = p;
}
bufPtr = buf;
bufsize = traceLen;
memset(buf, 0x00, traceLen);
}
if (bufPtr == NULL) {
PrintAndLog("Cannot allocate memory for trace");
free(buf);
return 2;
}
memcpy(bufPtr, resp.d.asBytes, len);
bufPtr += len;
pckNum++;
}
if (res == 2) { // received all data, start displaying
blockLen = bufPtr - buf;
bufPtr = buf;
printf(">\n");
PrintAndLog("received trace len: %d packages: %d", blockLen, pckNum);
while (bufPtr - buf < blockLen) {
bufPtr += 6; // skip (void) timing information
len = *((uint16_t *)bufPtr);
if(len & 0x8000) {
isTag = true;
len &= 0x7fff;
} else {
isTag = false;
}
bufPtr += 2;
if ((len == 14) && (bufPtr[0] == 0xff) && (bufPtr[1] == 0xff) && (bufPtr[12] == 0xff) && (bufPtr[13] == 0xff)) {
memcpy(uid, bufPtr + 2, 7);
memcpy(atqa, bufPtr + 2 + 7, 2);
uid_len = (atqa[0] & 0xC0) == 0x40 ? 7 : 4;
sak = bufPtr[11];
PrintAndLog("tag select uid| %s atqa:0x%02x%02x sak:0x%02x",
sprint_hex(uid + (7 - uid_len), uid_len),
atqa[1],
atqa[0],
sak);
if (wantLogToFile || wantDecrypt) {
FillFileNameByUID(logHexFileName, uid + (10 - uid_len), ".log", uid_len);
AddLogCurrentDT(logHexFileName);
}
if (wantDecrypt)
mfTraceInit(uid, atqa, sak, wantSaveToEmlFile);
} else {
PrintAndLog("%03d| %s |%s", num, isTag ? "TAG" : "RDR", sprint_hex(bufPtr, len));
if (wantLogToFile)
AddLogHex(logHexFileName, isTag ? "TAG| ":"RDR| ", bufPtr, len);
if (wantDecrypt)
mfTraceDecode(bufPtr, len, wantSaveToEmlFile);
num++;
}
bufPtr += len;
bufPtr += ((len-1)/8+1); // ignore parity
}
pckNum = 0;
}
} // resp not NULL
} // while (true)
free(buf);
return 0;
}
//needs nt, ar, at, Data to decrypt //needs nt, ar, at, Data to decrypt
int CmdHf14MfDecryptBytes(const char *Cmd){ int CmdHf14MfDecryptBytes(const char *Cmd){
uint8_t data[50]; uint8_t data[50];
uint32_t nt = param_get32ex(Cmd,0,0,16); uint32_t nt = param_get32ex(Cmd,0,0,16);
uint32_t ar_enc = param_get32ex(Cmd,1,0,16); uint32_t ar_enc = param_get32ex(Cmd,1,0,16);
uint32_t at_enc = param_get32ex(Cmd,2,0,16); uint32_t at_enc = param_get32ex(Cmd,2,0,16);
@ -2280,9 +2292,7 @@ static command_t CommandTable[] = {
}; };
int CmdHFMF(const char *Cmd) { int CmdHFMF(const char *Cmd) {
// flush
clearCommandBuffer(); clearCommandBuffer();
//WaitForResponseTimeout(CMD_ACK,NULL,100);
CmdsParse(CommandTable, Cmd); CmdsParse(CommandTable, Cmd);
return 0; return 0;
} }

120
client/mifarehost.c
View file

@ -342,12 +342,11 @@ static uint8_t traceCurKey = 0;
struct Crypto1State *traceCrypto1 = NULL; struct Crypto1State *traceCrypto1 = NULL;
struct Crypto1State *revstate = NULL; struct Crypto1State *revstate = NULL;
uint64_t key = 0; uint64_t key = 0;
uint32_t ks2 = 0; uint32_t ks2 = 0;
uint32_t ks3 = 0; uint32_t ks3 = 0;
uint32_t uid = 0; // serial number uint32_t cuid = 0; // serial number
uint32_t nt =0; // tag challenge uint32_t nt =0; // tag challenge
uint32_t nr_enc =0; // encrypted reader challenge uint32_t nr_enc =0; // encrypted reader challenge
uint32_t ar_enc =0; // encrypted reader response uint32_t ar_enc =0; // encrypted reader response
@ -368,7 +367,7 @@ int isBlockTrailer(int blockN) {
return ((blockN & 0x03) == 0x03); return ((blockN & 0x03) == 0x03);
} }
int loadTraceCard(uint8_t *tuid) { int loadTraceCard(uint8_t *tuid, uint8_t uidlen) {
FILE * f; FILE * f;
char buf[64] = {0x00}; char buf[64] = {0x00};
uint8_t buf8[64] = {0x00}; uint8_t buf8[64] = {0x00};
@ -378,9 +377,9 @@ int loadTraceCard(uint8_t *tuid) {
saveTraceCard(); saveTraceCard();
memset(traceCard, 0x00, 4096); memset(traceCard, 0x00, 4096);
memcpy(traceCard, tuid + 3, 4); memcpy(traceCard, tuid, uidlen);
FillFileNameByUID(traceFileName, tuid, ".eml", 7); FillFileNameByUID(traceFileName, tuid, ".eml", uidlen);
f = fopen(traceFileName, "r"); f = fopen(traceFileName, "r");
if (!f) return 1; if (!f) return 1;
@ -391,7 +390,7 @@ int loadTraceCard(uint8_t *tuid) {
memset(buf, 0, sizeof(buf)); memset(buf, 0, sizeof(buf));
if (fgets(buf, sizeof(buf), f) == NULL) { if (fgets(buf, sizeof(buf), f) == NULL) {
PrintAndLog("File reading error."); PrintAndLog("No trace file found or reading error.");
fclose(f); fclose(f);
return 2; return 2;
} }
@ -403,35 +402,35 @@ int loadTraceCard(uint8_t *tuid) {
return 2; return 2;
} }
for (i = 0; i < 32; i += 2) for (i = 0; i < 32; i += 2)
sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]); sscanf(&buf[i], "%02X", (unsigned int *)&buf8[i / 2]);
memcpy(traceCard + blockNum * 16, buf8, 16); memcpy(traceCard + blockNum * 16, buf8, 16);
blockNum++; blockNum++;
} }
fclose(f); fclose(f);
return 0; return 0;
} }
int saveTraceCard(void) { int saveTraceCard(void) {
FILE * f;
if ((!strlen(traceFileName)) || (isTraceCardEmpty())) return 0; if ((!strlen(traceFileName)) || (isTraceCardEmpty())) return 0;
FILE * f;
f = fopen(traceFileName, "w+"); f = fopen(traceFileName, "w+");
if ( !f ) return 1; if ( !f ) return 1;
for (int i = 0; i < 64; i++) { // blocks for (int i = 0; i < 64; i++) { // blocks
for (int j = 0; j < 16; j++) // bytes for (int j = 0; j < 16; j++) // bytes
fprintf(f, "%02x", *(traceCard + i * 16 + j)); fprintf(f, "%02X", *(traceCard + i * 16 + j));
fprintf(f,"\n"); fprintf(f,"\n");
} }
fflush(f);
fclose(f); fclose(f);
return 0; return 0;
} }
int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile) { int mfTraceInit(uint8_t *tuid, uint8_t uidlen, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile) {
if (traceCrypto1) if (traceCrypto1)
crypto1_destroy(traceCrypto1); crypto1_destroy(traceCrypto1);
@ -439,16 +438,14 @@ int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFil
traceCrypto1 = NULL; traceCrypto1 = NULL;
if (wantSaveToEmlFile) if (wantSaveToEmlFile)
loadTraceCard(tuid); loadTraceCard(tuid, uidlen);
traceCard[4] = traceCard[0] ^ traceCard[1] ^ traceCard[2] ^ traceCard[3]; traceCard[4] = traceCard[0] ^ traceCard[1] ^ traceCard[2] ^ traceCard[3];
traceCard[5] = sak; traceCard[5] = sak;
memcpy(&traceCard[6], atqa, 2); memcpy(&traceCard[6], atqa, 2);
traceCurBlock = 0; traceCurBlock = 0;
uid = bytes_to_num(tuid + 3, 4); cuid = bytes_to_num(tuid+(uidlen-4), 4);
traceState = TRACE_IDLE; traceState = TRACE_IDLE;
return 0; return 0;
} }
@ -471,30 +468,31 @@ void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len, bool i
} }
int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) { int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {
uint8_t data[64];
memset(data, 0x00, sizeof(data));
if (traceState == TRACE_ERROR) return 1; if (traceState == TRACE_ERROR) return 1;
if (len > 64) { if (len > 64) {
traceState = TRACE_ERROR; traceState = TRACE_ERROR;
return 1; return 1;
} }
uint8_t data[64];
memset(data, 0x00, sizeof(data));
memcpy(data, data_src, len); memcpy(data, data_src, len);
if ((traceCrypto1) && ((traceState == TRACE_IDLE) || (traceState > TRACE_AUTH_OK))) { if ((traceCrypto1) && ((traceState == TRACE_IDLE) || (traceState > TRACE_AUTH_OK))) {
mf_crypto1_decrypt(traceCrypto1, data, len, 0); mf_crypto1_decrypt(traceCrypto1, data, len, 0);
PrintAndLog("dec> %s", sprint_hex(data, len)); PrintAndLog("DEC| %s", sprint_hex(data, len));
AddLogHex(logHexFileName, "dec> ", data, len); AddLogHex(logHexFileName, "DEC| ", data, len);
} }
switch (traceState) { switch (traceState) {
case TRACE_IDLE: case TRACE_IDLE:
// check packet crc16! // check packet crc16!
if ((len >= 4) && (!CheckCrc14443(CRC_14443_A, data, len))) { if ((len >= 4) && (!CheckCrc14443(CRC_14443_A, data, len))) {
PrintAndLog("dec> CRC ERROR!!!"); PrintAndLog("DEC| CRC ERROR!!!");
AddLogLine(logHexFileName, "dec> ", "CRC ERROR!!!"); AddLogLine(logHexFileName, "DEC| ", "CRC ERROR!!!");
traceState = TRACE_ERROR; // do not decrypt the next commands traceState = TRACE_ERROR; // do not decrypt the next commands
return 1; return 1;
} }
@ -526,10 +524,7 @@ int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {
traceState = TRACE_ERROR; // do not decrypt the next commands traceState = TRACE_ERROR; // do not decrypt the next commands
return 0; return 0;
} }
return 0; return 0;
break;
case TRACE_READ_DATA: case TRACE_READ_DATA:
if (len == 18) { if (len == 18) {
traceState = TRACE_IDLE; traceState = TRACE_IDLE;
@ -545,23 +540,19 @@ int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {
traceState = TRACE_ERROR; traceState = TRACE_ERROR;
return 1; return 1;
} }
break; break;
case TRACE_WRITE_OK: case TRACE_WRITE_OK:
if ((len == 1) && (data[0] == 0x0a)) { if ((len == 1) && (data[0] == 0x0a)) {
traceState = TRACE_WRITE_DATA; traceState = TRACE_WRITE_DATA;
return 0; return 0;
} else { } else {
traceState = TRACE_ERROR; traceState = TRACE_ERROR;
return 1; return 1;
} }
break; break;
case TRACE_WRITE_DATA: case TRACE_WRITE_DATA:
if (len == 18) { if (len == 18) {
traceState = TRACE_IDLE; traceState = TRACE_IDLE;
memcpy(traceCard + traceCurBlock * 16, data, 16); memcpy(traceCard + traceCurBlock * 16, data, 16);
if (wantSaveToEmlFile) saveTraceCard(); if (wantSaveToEmlFile) saveTraceCard();
return 0; return 0;
@ -569,8 +560,7 @@ int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {
traceState = TRACE_ERROR; traceState = TRACE_ERROR;
return 1; return 1;
} }
break; break;
case TRACE_AUTH1: case TRACE_AUTH1:
if (len == 4) { if (len == 4) {
traceState = TRACE_AUTH2; traceState = TRACE_AUTH2;
@ -580,12 +570,10 @@ int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {
traceState = TRACE_ERROR; traceState = TRACE_ERROR;
return 1; return 1;
} }
break; break;
case TRACE_AUTH2: case TRACE_AUTH2:
if (len == 8) { if (len == 8) {
traceState = TRACE_AUTH_OK; traceState = TRACE_AUTH_OK;
nr_enc = bytes_to_num(data, 4); nr_enc = bytes_to_num(data, 4);
ar_enc = bytes_to_num(data + 4, 4); ar_enc = bytes_to_num(data + 4, 4);
return 0; return 0;
@ -593,12 +581,10 @@ int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {
traceState = TRACE_ERROR; traceState = TRACE_ERROR;
return 1; return 1;
} }
break; break;
case TRACE_AUTH_OK: case TRACE_AUTH_OK:
if (len ==4) { if (len == 4) {
traceState = TRACE_IDLE; traceState = TRACE_IDLE;
at_enc = bytes_to_num(data, 4); at_enc = bytes_to_num(data, 4);
// decode key here) // decode key here)
@ -608,73 +594,51 @@ int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {
lfsr_rollback_word(revstate, 0, 0); lfsr_rollback_word(revstate, 0, 0);
lfsr_rollback_word(revstate, 0, 0); lfsr_rollback_word(revstate, 0, 0);
lfsr_rollback_word(revstate, nr_enc, 1); lfsr_rollback_word(revstate, nr_enc, 1);
lfsr_rollback_word(revstate, uid ^ nt, 0); lfsr_rollback_word(revstate, cuid ^ nt, 0);
crypto1_get_lfsr(revstate, &key); crypto1_get_lfsr(revstate, &key);
printf("Key: %012"llx"\n",key); PrintAndLog("Found Key: [%012"llx"]", key);
AddLogUint64(logHexFileName, "key: ", key);
//if ( tryMfk64(cuid, nt, nr_enc, ar_enc, at_enc, &key) )
AddLogUint64(logHexFileName, "Found Key: ", key);
int blockShift = ((traceCurBlock & 0xFC) + 3) * 16; int blockShift = ((traceCurBlock & 0xFC) + 3) * 16;
if (isBlockEmpty((traceCurBlock & 0xFC) + 3)) memcpy(traceCard + blockShift + 6, trailerAccessBytes, 4); if (isBlockEmpty((traceCurBlock & 0xFC) + 3)) memcpy(traceCard + blockShift + 6, trailerAccessBytes, 4);
if (traceCurKey) { if (traceCurKey)
num_to_bytes(key, 6, traceCard + blockShift + 10); num_to_bytes(key, 6, traceCard + blockShift + 10);
} else { else
num_to_bytes(key, 6, traceCard + blockShift); num_to_bytes(key, 6, traceCard + blockShift);
}
if (wantSaveToEmlFile) saveTraceCard(); if (wantSaveToEmlFile)
saveTraceCard();
if (traceCrypto1) { if (traceCrypto1)
crypto1_destroy(traceCrypto1); crypto1_destroy(traceCrypto1);
}
// set cryptosystem state // set cryptosystem state
traceCrypto1 = lfsr_recovery64(ks2, ks3); traceCrypto1 = lfsr_recovery64(ks2, ks3);
// nt = crypto1_word(traceCrypto1, nt ^ uid, 1) ^ nt;
/* traceCrypto1 = crypto1_create(key); // key in lfsr
crypto1_word(traceCrypto1, nt ^ uid, 0);
crypto1_word(traceCrypto1, ar, 1);
crypto1_word(traceCrypto1, 0, 0);
crypto1_word(traceCrypto1, 0, 0);*/
return 0; return 0;
} else { } else {
traceState = TRACE_ERROR; traceState = TRACE_ERROR;
return 1; return 1;
} }
break; break;
default: default:
traceState = TRACE_ERROR; traceState = TRACE_ERROR;
return 1; return 1;
} }
return 0; return 0;
} }
int tryDecryptWord(uint32_t nt, uint32_t ar_enc, uint32_t at_enc, uint8_t *data, int len){ int tryDecryptWord(uint32_t nt, uint32_t ar_enc, uint32_t at_enc, uint8_t *data, int len){
/* PrintAndLog("\nEncrypted data: [%s]", sprint_hex(data, len) );
uint32_t nt; // tag challenge
uint32_t nr_enc; // encrypted reader challenge
uint32_t ar_enc; // encrypted reader response
uint32_t at_enc; // encrypted tag response
*/
struct Crypto1State *pcs = NULL; struct Crypto1State *pcs = NULL;
ks2 = ar_enc ^ prng_successor(nt, 64); ks2 = ar_enc ^ prng_successor(nt, 64);
ks3 = at_enc ^ prng_successor(nt, 96); ks3 = at_enc ^ prng_successor(nt, 96);
PrintAndLog("Decrypting data with:");
PrintAndLog(" nt: %08x",nt);
PrintAndLog(" ar_enc: %08x",ar_enc);
PrintAndLog(" at_enc: %08x",at_enc);
PrintAndLog("\nEncrypted data: [%s]", sprint_hex(data,len) );
pcs = lfsr_recovery64(ks2, ks3); pcs = lfsr_recovery64(ks2, ks3);
mf_crypto1_decrypt(pcs, data, len, FALSE); mf_crypto1_decrypt(pcs, data, len, FALSE);
PrintAndLog("Decrypted data: [%s]", sprint_hex(data,len) ); PrintAndLog("Decrypted data: [%s]", sprint_hex(data, len) );
crypto1_destroy(pcs); crypto1_destroy(pcs);
return 0; return 0;
} }

5
client/mifarehost.h
View file

@ -40,6 +40,7 @@ typedef struct {
int foundKey[2]; int foundKey[2];
} sector; } sector;
int compar_int(const void * a, const void * b);
extern char logHexFileName[FILE_PATH_SIZE]; extern char logHexFileName[FILE_PATH_SIZE];
int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t * ResultKeys, bool calibrate); int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t * ResultKeys, bool calibrate);
@ -53,12 +54,12 @@ int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, uint8_
int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, uint8_t params); int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, uint8_t params);
int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params); int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params);
int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile); int mfTraceInit(uint8_t *tuid, uint8_t uidlen, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile);
int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile); int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile);
int isTraceCardEmpty(void); int isTraceCardEmpty(void);
int isBlockEmpty(int blockN); int isBlockEmpty(int blockN);
int isBlockTrailer(int blockN); int isBlockTrailer(int blockN);
int loadTraceCard(uint8_t *tuid); int loadTraceCard(uint8_t *tuid, uint8_t uidlen);
int saveTraceCard(void); int saveTraceCard(void);
int tryDecryptWord(uint32_t nt, uint32_t ar_enc, uint32_t at_enc, uint8_t *data, int len); int tryDecryptWord(uint32_t nt, uint32_t ar_enc, uint32_t at_enc, uint8_t *data, int len);

1
client/scripting.c
View file

@ -487,7 +487,6 @@ int setLuaPath( lua_State* L, const char* path )
return 0; // all done! return 0; // all done!
} }
int set_pm3_libraries(lua_State *L) int set_pm3_libraries(lua_State *L)
{ {