From ec877e04ea930ceed65b020b20c32db0e7117fde Mon Sep 17 00:00:00 2001 From: Ave Date: Thu, 3 Sep 2020 17:33:36 +0300 Subject: [PATCH 1/6] Add hf_aveul standalone mode --- armsrc/Standalone/Makefile.hal | 5 +- armsrc/Standalone/Makefile.inc | 4 ++ armsrc/Standalone/hf_aveul.c | 119 +++++++++++++++++++++++++++++++++ 3 files changed, 127 insertions(+), 1 deletion(-) create mode 100644 armsrc/Standalone/hf_aveul.c diff --git a/armsrc/Standalone/Makefile.hal b/armsrc/Standalone/Makefile.hal index bd66d538c..bab78be83 100644 --- a/armsrc/Standalone/Makefile.hal +++ b/armsrc/Standalone/Makefile.hal @@ -59,10 +59,13 @@ define KNOWN_STANDALONE_DEFINITIONS | HF_YOUNG | Mifare sniff/simulation | | | - Craig Young | +----------------------------------------------------------+ +| HF_AVEUL | Mifare ultralight read/simulation | +| | - Ave Ozkal | ++----------------------------------------------------------+ endef STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN -STANDALONE_MODES += HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_YOUNG +STANDALONE_MODES += HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_YOUNG HF_AVEUL STANDALONE_MODES_REQ_SMARTCARD := STANDALONE_MODES_REQ_FLASH := LF_ICEHID HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES)),) diff --git a/armsrc/Standalone/Makefile.inc b/armsrc/Standalone/Makefile.inc index 131e26e79..d903b02f8 100644 --- a/armsrc/Standalone/Makefile.inc +++ b/armsrc/Standalone/Makefile.inc @@ -37,6 +37,10 @@ endif ifneq (,$(findstring WITH_STANDALONE_HF_14ASNIFF,$(APP_CFLAGS))) SRC_STANDALONE = hf_14asniff.c endif +# WITH_STANDALONE_HF_AVEUL +ifneq (,$(findstring WITH_STANDALONE_HF_AVEUL,$(APP_CFLAGS))) + SRC_STANDALONE = hf_aveul.c +endif # WITH_STANDALONE_LF_ICEHID ifneq (,$(findstring WITH_STANDALONE_LF_ICEHID,$(APP_CFLAGS))) SRC_STANDALONE = lf_icehid.c diff --git a/armsrc/Standalone/hf_aveul.c b/armsrc/Standalone/hf_aveul.c new file mode 100644 index 000000000..64d2b9f22 --- /dev/null +++ b/armsrc/Standalone/hf_aveul.c @@ -0,0 +1,119 @@ +//----------------------------------------------------------------------------- +// A. Ozkal, 2020 +// +// This code is licensed to you under the terms of the GNU GPL, version 2 or, +// at your option, any later version. See the LICENSE.txt file for the text of +// the license. +//----------------------------------------------------------------------------- +// main code for HF Mifare Ultralight read/simulation by Ave Ozkal +//----------------------------------------------------------------------------- + +/* Several parts of this code is based on code by Craig Young from HF_YOUNG */ + +#include "standalone.h" // standalone definitions +#include "proxmark3_arm.h" +#include "appmain.h" +#include "fpgaloader.h" +#include "util.h" +#include "dbprint.h" + +#include "ticks.h" // SpinDelay +#include "mifareutil.h" +#include "iso14443a.h" + +typedef struct { + uint8_t uid[10]; + uint8_t uidlen; + uint8_t atqa[2]; + uint8_t sak; +} PACKED card_clone_t; + +void ModInfo(void) { + DbpString(" HF Mifare Ultralight read/simulation by Ave Ozkal"); +} + +void RunMod(void) { + StandAloneMode(); + Dbprintf("[=] AveUL (MF Ultralight read/emul) started"); + FpgaDownloadAndGo(FPGA_BITSTREAM_HF); + + // the main loop for your standalone mode + for (;;) { + WDT_HIT(); + + // exit from RunMod, send a usbcommand. + if (data_available()) break; + + iso14a_card_select_t card; + + SpinDelay(500); + iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD); + + // 0 = search, 1 = read, 2 = emul + int stage = 0; + + DbpString("Scanning..."); + for (;;) { + // Was our button held down or pressed? + int button_pressed = BUTTON_HELD(1000); + + if (button_pressed != BUTTON_NO_CLICK || data_available()) + break; + else if (stage == 0) { + if (!iso14443a_select_card(NULL, &card, NULL, true, 0, true)) { + continue; + } else { + if (card.sak == 0x00 && card.atqa[0] == 0x44 && card.atqa[1] == 0 && card.uidlen == 7) { + DbpString("Found ultralight with UID: "); + Dbhexdump(7, card.uid, 0); + stage = 1; + } + else { + DbpString("Found non-ultralight card, ignoring"); + } + } + } + else if (stage == 1) { + iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); + iso14443a_select_card(NULL, NULL, NULL, true, 0, true); + int i; + bool read_successful = true; + Dbprintf("Contents:"); + + for (i = 0; i < 16; ++i) + { + uint8_t dataout[4] = {0x00}; + if (mifare_ultra_readblock(i, dataout)) { + // If there's an error reading, go back to stage 0 + read_successful = false; + break; + } + // TODO: I'm not 100% on why I need to do + 14. The bin->eml results have 14 blocks of almost all 0 at start. + // and the bins just don't, so I'll admit that I am a little confused, but it works, so I won't question it much. + emlSetMem_xt(dataout, 14 + i, 1, 4); + Dbhexdump(4, dataout, 0); + } + + if (read_successful) { + Dbprintf("Successfully loaded into emulator memory"); + stage = 2; + } else { + Dbprintf("Read failure, going back to stage 0."); + stage = 0; + } + } + else if (stage == 2) { + uint8_t flags = FLAG_7B_UID_IN_DATA; + + Dbprintf("Starting simulation, press pm3-button to stop and go back to scan"); + SimulateIso14443aTag(2, flags, card.uid); + + // Go back to stage 0 if user presses pm3-button + stage = 0; + } + } + } + + DbpString("[=] exiting"); + LEDsoff(); +} From 51360c4d1a3bc6676ebbed187bc8b5999d3df164 Mon Sep 17 00:00:00 2001 From: Ave Date: Thu, 3 Sep 2020 17:43:47 +0300 Subject: [PATCH 2/6] hf_aveul: Extend comments --- armsrc/Standalone/hf_aveul.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/armsrc/Standalone/hf_aveul.c b/armsrc/Standalone/hf_aveul.c index 64d2b9f22..49f9c6f6f 100644 --- a/armsrc/Standalone/hf_aveul.c +++ b/armsrc/Standalone/hf_aveul.c @@ -10,6 +10,10 @@ /* Several parts of this code is based on code by Craig Young from HF_YOUNG */ +/* This code does not account for: +- Cards with block counts other than 16 +- Cards with authentication (MFU EV1 etc) */ + #include "standalone.h" // standalone definitions #include "proxmark3_arm.h" #include "appmain.h" @@ -34,7 +38,7 @@ void ModInfo(void) { void RunMod(void) { StandAloneMode(); - Dbprintf("[=] AveUL (MF Ultralight read/emul) started"); + Dbprintf("AveUL (MF Ultralight read/emul) started"); FpgaDownloadAndGo(FPGA_BITSTREAM_HF); // the main loop for your standalone mode @@ -88,8 +92,8 @@ void RunMod(void) { read_successful = false; break; } - // TODO: I'm not 100% on why I need to do + 14. The bin->eml results have 14 blocks of almost all 0 at start. - // and the bins just don't, so I'll admit that I am a little confused, but it works, so I won't question it much. + // We're skipping 14 blocks (56 bytes) here, as that "[...] has version/signature/counter data here" according to comments on dumptoemul-mfu + // When converting a bin, it's almost all 0 other than one 0x0F byte, and functionality seems to be unaffected if that byte is set to 0x00. emlSetMem_xt(dataout, 14 + i, 1, 4); Dbhexdump(4, dataout, 0); } @@ -114,6 +118,6 @@ void RunMod(void) { } } - DbpString("[=] exiting"); + DbpString("exiting"); LEDsoff(); } From c4e01ce81ebc28fa39c99efd0a193e46b35c6715 Mon Sep 17 00:00:00 2001 From: Ave Date: Thu, 3 Sep 2020 18:29:18 +0300 Subject: [PATCH 3/6] hf_aveul: Use defines to make the code easier to configure for other card types --- armsrc/Standalone/hf_aveul.c | 50 +++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 21 deletions(-) diff --git a/armsrc/Standalone/hf_aveul.c b/armsrc/Standalone/hf_aveul.c index 49f9c6f6f..3c3388fb2 100644 --- a/armsrc/Standalone/hf_aveul.c +++ b/armsrc/Standalone/hf_aveul.c @@ -10,9 +10,9 @@ /* Several parts of this code is based on code by Craig Young from HF_YOUNG */ -/* This code does not account for: -- Cards with block counts other than 16 -- Cards with authentication (MFU EV1 etc) */ +/* This code does not: +- Account for cards with authentication (MFU EV1 etc) +- Determine if cards have block count that's not the same as the BLOCKS def */ #include "standalone.h" // standalone definitions #include "proxmark3_arm.h" @@ -25,6 +25,15 @@ #include "mifareutil.h" #include "iso14443a.h" +#define BLOCKS 16 +#define SAK 0x00 +#define ATQA0 0x44 +#define ATQA1 0x00 + +#define STATE_SEARCH 0 +#define STATE_READ 1 +#define STATE_EMUL 2 + typedef struct { uint8_t uid[10]; uint8_t uidlen; @@ -54,7 +63,7 @@ void RunMod(void) { iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD); // 0 = search, 1 = read, 2 = emul - int stage = 0; + int state = STATE_SEARCH; DbpString("Scanning..."); for (;;) { @@ -63,32 +72,31 @@ void RunMod(void) { if (button_pressed != BUTTON_NO_CLICK || data_available()) break; - else if (stage == 0) { + else if (state == STATE_SEARCH) { if (!iso14443a_select_card(NULL, &card, NULL, true, 0, true)) { continue; } else { - if (card.sak == 0x00 && card.atqa[0] == 0x44 && card.atqa[1] == 0 && card.uidlen == 7) { + if (card.sak == SAK && card.atqa[0] == ATQA0 && card.atqa[1] == ATQA1 && card.uidlen == 7) { DbpString("Found ultralight with UID: "); - Dbhexdump(7, card.uid, 0); - stage = 1; + Dbhexdump(card.uidlen, card.uid, 0); + state = STATE_READ; } else { - DbpString("Found non-ultralight card, ignoring"); + DbpString("Found non-ultralight card, ignoring."); } } } - else if (stage == 1) { + else if (state == STATE_READ) { iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); iso14443a_select_card(NULL, NULL, NULL, true, 0, true); - int i; bool read_successful = true; Dbprintf("Contents:"); - for (i = 0; i < 16; ++i) + for (int i = 0; i < BLOCKS; i++) { uint8_t dataout[4] = {0x00}; if (mifare_ultra_readblock(i, dataout)) { - // If there's an error reading, go back to stage 0 + // If there's an error reading, go back to search state read_successful = false; break; } @@ -99,21 +107,21 @@ void RunMod(void) { } if (read_successful) { - Dbprintf("Successfully loaded into emulator memory"); - stage = 2; + Dbprintf("Successfully loaded into emulator memory..."); + state = STATE_EMUL; } else { - Dbprintf("Read failure, going back to stage 0."); - stage = 0; + Dbprintf("Read failure, going back to search state."); + state = STATE_SEARCH; } } - else if (stage == 2) { + else if (state == 2) { uint8_t flags = FLAG_7B_UID_IN_DATA; - Dbprintf("Starting simulation, press pm3-button to stop and go back to scan"); + Dbprintf("Starting simulation, press pm3-button to stop and go back to search state."); SimulateIso14443aTag(2, flags, card.uid); - // Go back to stage 0 if user presses pm3-button - stage = 0; + // Go back to search state if user presses pm3-button + state = STATE_SEARCH; } } } From 6c92b9d1ed2d332ab56f4d2b6a28b0f205cab0c2 Mon Sep 17 00:00:00 2001 From: Ave Date: Thu, 3 Sep 2020 18:38:58 +0300 Subject: [PATCH 4/6] hf_aveful: rename from hf_aveul to hf_aveful --- armsrc/Standalone/Makefile.hal | 4 ++-- armsrc/Standalone/Makefile.inc | 6 +++--- armsrc/Standalone/{hf_aveul.c => hf_aveful.c} | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) rename armsrc/Standalone/{hf_aveul.c => hf_aveful.c} (98%) diff --git a/armsrc/Standalone/Makefile.hal b/armsrc/Standalone/Makefile.hal index bab78be83..1c3bfb02a 100644 --- a/armsrc/Standalone/Makefile.hal +++ b/armsrc/Standalone/Makefile.hal @@ -59,13 +59,13 @@ define KNOWN_STANDALONE_DEFINITIONS | HF_YOUNG | Mifare sniff/simulation | | | - Craig Young | +----------------------------------------------------------+ -| HF_AVEUL | Mifare ultralight read/simulation | +| HF_AVEFUL | Mifare ultralight read/simulation | | | - Ave Ozkal | +----------------------------------------------------------+ endef STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN -STANDALONE_MODES += HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_YOUNG HF_AVEUL +STANDALONE_MODES += HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_YOUNG HF_AVEFUL STANDALONE_MODES_REQ_SMARTCARD := STANDALONE_MODES_REQ_FLASH := LF_ICEHID HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES)),) diff --git a/armsrc/Standalone/Makefile.inc b/armsrc/Standalone/Makefile.inc index d903b02f8..c5730965b 100644 --- a/armsrc/Standalone/Makefile.inc +++ b/armsrc/Standalone/Makefile.inc @@ -37,9 +37,9 @@ endif ifneq (,$(findstring WITH_STANDALONE_HF_14ASNIFF,$(APP_CFLAGS))) SRC_STANDALONE = hf_14asniff.c endif -# WITH_STANDALONE_HF_AVEUL -ifneq (,$(findstring WITH_STANDALONE_HF_AVEUL,$(APP_CFLAGS))) - SRC_STANDALONE = hf_aveul.c +# WITH_STANDALONE_HF_AVEFUL +ifneq (,$(findstring WITH_STANDALONE_HF_AVEFUL,$(APP_CFLAGS))) + SRC_STANDALONE = hf_aveful.c endif # WITH_STANDALONE_LF_ICEHID ifneq (,$(findstring WITH_STANDALONE_LF_ICEHID,$(APP_CFLAGS))) diff --git a/armsrc/Standalone/hf_aveul.c b/armsrc/Standalone/hf_aveful.c similarity index 98% rename from armsrc/Standalone/hf_aveul.c rename to armsrc/Standalone/hf_aveful.c index 3c3388fb2..cc2cffbf6 100644 --- a/armsrc/Standalone/hf_aveul.c +++ b/armsrc/Standalone/hf_aveful.c @@ -47,7 +47,7 @@ void ModInfo(void) { void RunMod(void) { StandAloneMode(); - Dbprintf("AveUL (MF Ultralight read/emul) started"); + Dbprintf("AveFUL (MF Ultralight read/emul) started"); FpgaDownloadAndGo(FPGA_BITSTREAM_HF); // the main loop for your standalone mode From 2687d9f3ecbff0e7683a410c2ab7b1abece93af3 Mon Sep 17 00:00:00 2001 From: Ave Date: Thu, 3 Sep 2020 18:44:30 +0300 Subject: [PATCH 5/6] hf_aveful: last minute code formatting --- armsrc/Standalone/hf_aveful.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/armsrc/Standalone/hf_aveful.c b/armsrc/Standalone/hf_aveful.c index cc2cffbf6..a619459f5 100644 --- a/armsrc/Standalone/hf_aveful.c +++ b/armsrc/Standalone/hf_aveful.c @@ -8,11 +8,11 @@ // main code for HF Mifare Ultralight read/simulation by Ave Ozkal //----------------------------------------------------------------------------- -/* Several parts of this code is based on code by Craig Young from HF_YOUNG */ +// Several parts of this code is based on code by Craig Young from HF_YOUNG -/* This code does not: -- Account for cards with authentication (MFU EV1 etc) -- Determine if cards have block count that's not the same as the BLOCKS def */ +// This code does not: +// - Account for cards with authentication (MFU EV1 etc) +// - Determine if cards have block count that's not the same as the BLOCKS def #include "standalone.h" // standalone definitions #include "proxmark3_arm.h" @@ -80,20 +80,17 @@ void RunMod(void) { DbpString("Found ultralight with UID: "); Dbhexdump(card.uidlen, card.uid, 0); state = STATE_READ; - } - else { + } else { DbpString("Found non-ultralight card, ignoring."); } } - } - else if (state == STATE_READ) { + } else if (state == STATE_READ) { iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); iso14443a_select_card(NULL, NULL, NULL, true, 0, true); bool read_successful = true; Dbprintf("Contents:"); - for (int i = 0; i < BLOCKS; i++) - { + for (int i = 0; i < BLOCKS; i++) { uint8_t dataout[4] = {0x00}; if (mifare_ultra_readblock(i, dataout)) { // If there's an error reading, go back to search state @@ -113,8 +110,7 @@ void RunMod(void) { Dbprintf("Read failure, going back to search state."); state = STATE_SEARCH; } - } - else if (state == 2) { + } else if (state == 2) { uint8_t flags = FLAG_7B_UID_IN_DATA; Dbprintf("Starting simulation, press pm3-button to stop and go back to search state."); From befb5f1c01feae7f7e0cd8b2f1468f5cab4e37cd Mon Sep 17 00:00:00 2001 From: Ave Date: Fri, 4 Sep 2020 00:13:41 +0300 Subject: [PATCH 6/6] hf_aveful: Move Makefile.hal entry to be alphabetic --- armsrc/Standalone/Makefile.hal | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/armsrc/Standalone/Makefile.hal b/armsrc/Standalone/Makefile.hal index 1c3bfb02a..eef4ecf6f 100644 --- a/armsrc/Standalone/Makefile.hal +++ b/armsrc/Standalone/Makefile.hal @@ -38,6 +38,9 @@ define KNOWN_STANDALONE_DEFINITIONS | HF_14ASNIFF | 14a sniff to flashmem | | (RDV4 only) | | +----------------------------------------------------------+ +| HF_AVEFUL | Mifare ultralight read/simulation | +| | - Ave Ozkal | ++----------------------------------------------------------+ | HF_BOG | 14a sniff with ULC/ULEV1/NTAG auth | | (RDV4 only) | storing in flashmem - Bogito | +----------------------------------------------------------+ @@ -59,13 +62,10 @@ define KNOWN_STANDALONE_DEFINITIONS | HF_YOUNG | Mifare sniff/simulation | | | - Craig Young | +----------------------------------------------------------+ -| HF_AVEFUL | Mifare ultralight read/simulation | -| | - Ave Ozkal | -+----------------------------------------------------------+ endef STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN -STANDALONE_MODES += HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_YOUNG HF_AVEFUL +STANDALONE_MODES += HF_14ASNIFF HF_AVEFUL HF_BOG HF_COLIN HF_ICECLASS HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_YOUNG STANDALONE_MODES_REQ_SMARTCARD := STANDALONE_MODES_REQ_FLASH := LF_ICEHID HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES)),)