github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-20 05:13:46 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

chg: hf mf dbg\nchg: hf mf sim\nchg: hf 14a sim - uses NG

Browse source
This commit is contained in:
iceman1001 2019-05-26 13:42:27 -04:00
commit b05796c7c4
7 changed files with 66 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

25
armsrc/appmain.c
View file

@ -1017,9 +1017,16 @@ static void PacketReceived(PacketCommandNG *packet) {
case CMD_READER_ISO_14443a: case CMD_READER_ISO_14443a:
ReaderIso14443a(packet); ReaderIso14443a(packet);
break; break;
case CMD_SIMULATE_TAG_ISO_14443a: case CMD_SIMULATE_TAG_ISO_14443a: {
SimulateIso14443aTag(packet->oldarg[0], packet->oldarg[1], packet->data.asBytes); // ## Simulate iso14443a tag - pass tag type & UID struct p {
uint8_t tagtype;
uint8_t flags;
uint8_t uid[10];
} PACKED;
struct p* payload = (struct p*) packet->data.asBytes;
SimulateIso14443aTag(payload->tagtype, payload->flags, payload->uid); // ## Simulate iso14443a tag - pass tag type & UID
break; break;
}
case CMD_ANTIFUZZ_ISO_14443a: case CMD_ANTIFUZZ_ISO_14443a:
iso14443a_antifuzz(packet->oldarg[0]); iso14443a_antifuzz(packet->oldarg[0]);
break; break;
@ -1076,13 +1083,20 @@ static void PacketReceived(PacketCommandNG *packet) {
MifareChkKeys_fast(packet->oldarg[0], packet->oldarg[1], packet->oldarg[2], packet->data.asBytes); MifareChkKeys_fast(packet->oldarg[0], packet->oldarg[1], packet->oldarg[2], packet->data.asBytes);
break; break;
} }
case CMD_SIMULATE_MIFARE_CARD: case CMD_SIMULATE_MIFARE_CARD: {
Mifare1ksim(packet->oldarg[0], packet->oldarg[1], packet->data.asBytes); struct p {
uint16_t flags;
uint8_t exitAfter;
uint8_t uid[10];
} PACKED;
struct p* payload = (struct p*) packet->data.asBytes;
Mifare1ksim(payload->flags, payload->exitAfter, payload->uid);
}
break; break;
// emulator // emulator
case CMD_MIFARE_SET_DBGMODE: case CMD_MIFARE_SET_DBGMODE:
MifareSetDbgLvl(packet->oldarg[0]); MifareSetDbgLvl(packet->data.asBytes[0]);
break; break;
case CMD_MIFARE_EML_MEMCLR: case CMD_MIFARE_EML_MEMCLR:
MifareEMemClr(); MifareEMemClr();
@ -1362,6 +1376,7 @@ static void PacketReceived(PacketCommandNG *packet) {
uint8_t *mem = BigBuf_get_addr(); uint8_t *mem = BigBuf_get_addr();
uint32_t startidx = packet->oldarg[0]; uint32_t startidx = packet->oldarg[0];
uint32_t numofbytes = packet->oldarg[1]; uint32_t numofbytes = packet->oldarg[1];
// arg0 = startindex // arg0 = startindex
// arg1 = length bytes to transfer // arg1 = length bytes to transfer
// arg2 = BigBuf tracelen // arg2 = BigBuf tracelen

1
armsrc/apps.h
View file

@ -129,7 +129,6 @@ void ClearFpgaShiftingRegisters(void);
// iso14443a.h // iso14443a.h
void RAMFUNC SniffIso14443a(uint8_t param); void RAMFUNC SniffIso14443a(uint8_t param);
void SimulateIso14443aTag(int tagType, int flags, uint8_t *data);
void ReaderIso14443a(PacketCommandNG *c); void ReaderIso14443a(PacketCommandNG *c);
// Also used in iclass.c // Also used in iclass.c

2
armsrc/iso14443a.c
View file

@ -1028,7 +1028,7 @@ static bool SimulateIso14443aInit(int tagType, int flags, uint8_t *data, tag_res
// response to send, and send it. // response to send, and send it.
// 'hf 14a sim' // 'hf 14a sim'
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
void SimulateIso14443aTag(int tagType, int flags, uint8_t *data) { void SimulateIso14443aTag(uint8_t tagType, uint8_t flags, uint8_t *data) {
#define ATTACK_KEY_COUNT 8 // keep same as define in cmdhfmf.c -> readerAttack() #define ATTACK_KEY_COUNT 8 // keep same as define in cmdhfmf.c -> readerAttack()

2
armsrc/iso14443a.h
View file

@ -119,7 +119,7 @@ RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time);
RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time); RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time);
void RAMFUNC SniffIso14443a(uint8_t param); void RAMFUNC SniffIso14443a(uint8_t param);
void SimulateIso14443aTag(int tagType, int flags, uint8_t *data); void SimulateIso14443aTag(uint8_t tagType, uint8_t flags, uint8_t *data);
void iso14443a_antifuzz(uint32_t flags); void iso14443a_antifuzz(uint32_t flags);
void ReaderIso14443a(PacketCommandNG *c); void ReaderIso14443a(PacketCommandNG *c);
void ReaderTransmit(uint8_t *frame, uint16_t len, uint32_t *timing); void ReaderTransmit(uint8_t *frame, uint16_t len, uint32_t *timing);

10
armsrc/mifaresim.c
View file

@ -960,7 +960,7 @@ void Mifare1ksim(uint16_t flags, uint8_t exitAfterNReads, uint8_t *datain) {
// Collect AR/NR per keytype & sector // Collect AR/NR per keytype & sector
if ((flags & FLAG_NR_AR_ATTACK) == FLAG_NR_AR_ATTACK) { if ((flags & FLAG_NR_AR_ATTACK) == FLAG_NR_AR_ATTACK) {
if (MF_DBGLEVEL >= 0) Dbprintf("FLAG_NR_AR_ATTACK");
for (uint8_t i = 0; i < ATTACK_KEY_COUNT; i++) { for (uint8_t i = 0; i < ATTACK_KEY_COUNT; i++) {
if (ar_nr_collected[i + mM] == 0 || ((cardAUTHSC == ar_nr_resp[i + mM].sector) && (cardAUTHKEY == ar_nr_resp[i + mM].keytype) && (ar_nr_collected[i + mM] > 0))) { if (ar_nr_collected[i + mM] == 0 || ((cardAUTHSC == ar_nr_resp[i + mM].sector) && (cardAUTHKEY == ar_nr_resp[i + mM].keytype) && (ar_nr_collected[i + mM] > 0))) {
// if first auth for sector, or matches sector and keytype of previous auth // if first auth for sector, or matches sector and keytype of previous auth
@ -989,6 +989,7 @@ void Mifare1ksim(uint16_t flags, uint8_t exitAfterNReads, uint8_t *datain) {
ar_nr_resp[i + mM].nonce2 = nonce; ar_nr_resp[i + mM].nonce2 = nonce;
ar_nr_resp[i + mM].nr2 = nr; ar_nr_resp[i + mM].nr2 = nr;
ar_nr_resp[i + mM].ar2 = ar; ar_nr_resp[i + mM].ar2 = ar;
if (!gettingMoebius) { if (!gettingMoebius) {
nonce2_count++; nonce2_count++;
// check if this was the last second nonce we need for std attack // check if this was the last second nonce we need for std attack
@ -1005,7 +1006,8 @@ void Mifare1ksim(uint16_t flags, uint8_t exitAfterNReads, uint8_t *datain) {
} else { } else {
moebius_n_count++; moebius_n_count++;
// if we've collected all the nonces we need - finish. // if we've collected all the nonces we need - finish.
if (nonce1_count == moebius_n_count) finished = true; if (nonce1_count == moebius_n_count)
finished = true;
} }
} }
ar_nr_collected[i + mM]++; ar_nr_collected[i + mM]++;
@ -1149,7 +1151,7 @@ void Mifare1ksim(uint16_t flags, uint8_t exitAfterNReads, uint8_t *datain) {
// NR AR ATTACK // NR AR ATTACK
if (((flags & FLAG_NR_AR_ATTACK) == FLAG_NR_AR_ATTACK) && (MF_DBGLEVEL >= 1)) { if (((flags & FLAG_NR_AR_ATTACK) == FLAG_NR_AR_ATTACK) && (MF_DBGLEVEL >= MF_DBG_INFO)) {
for (uint8_t i = 0; i < ATTACK_KEY_COUNT; i++) { for (uint8_t i = 0; i < ATTACK_KEY_COUNT; i++) {
if (ar_nr_collected[i] == 2) { if (ar_nr_collected[i] == 2) {
Dbprintf("Collected two pairs of AR/NR which can be used to extract %s from reader for sector %d:", (i < ATTACK_KEY_COUNT / 2) ? "keyA" : "keyB", ar_nr_resp[i].sector); Dbprintf("Collected two pairs of AR/NR which can be used to extract %s from reader for sector %d:", (i < ATTACK_KEY_COUNT / 2) ? "keyA" : "keyB", ar_nr_resp[i].sector);
@ -1180,7 +1182,7 @@ void Mifare1ksim(uint16_t flags, uint8_t exitAfterNReads, uint8_t *datain) {
} }
} }
if (MF_DBGLEVEL >= 1) { if (MF_DBGLEVEL >= MF_DBG_ERROR) {
Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", get_tracing(), BigBuf_get_traceLen()); Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", get_tracing(), BigBuf_get_traceLen());
} }

38
client/cmdhf14a.c
View file

@ -406,24 +406,21 @@ static int CmdHF14ACUIDs(const char *Cmd) {
} }
// ## simulate iso14443a tag // ## simulate iso14443a tag
int CmdHF14ASim(const char *Cmd) { int CmdHF14ASim(const char *Cmd) {
bool errors = false;
uint8_t flags = 0;
uint8_t tagtype = 1;
uint8_t cmdp = 0;
uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
int uidlen = 0; int uidlen = 0;
uint8_t flags = 0, tagtype = 1, cmdp = 0;
uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
bool useUIDfromEML = true; bool useUIDfromEML = true;
bool setEmulatorMem = false; bool setEmulatorMem = false;
bool verbose = false; bool verbose = false;
bool errors = false;
nonces_t data[1]; nonces_t data[1];
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
switch (param_getchar(Cmd, cmdp)) { switch (tolower(param_getchar(Cmd, cmdp))) {
case 'h': case 'h':
case 'H':
return usage_hf_14a_sim(); return usage_hf_14a_sim();
case 't': case 't':
case 'T':
// Retrieve the tag type // Retrieve the tag type
tagtype = param_get8ex(Cmd, cmdp + 1, 0, 10); tagtype = param_get8ex(Cmd, cmdp + 1, 0, 10);
if (tagtype == 0) if (tagtype == 0)
@ -431,15 +428,15 @@ int CmdHF14ASim(const char *Cmd) {
cmdp += 2; cmdp += 2;
break; break;
case 'u': case 'u':
case 'U':
// Retrieve the full 4,7,10 byte long uid // Retrieve the full 4,7,10 byte long uid
param_gethex_ex(Cmd, cmdp + 1, uid, &uidlen); param_gethex_ex(Cmd, cmdp + 1, uid, &uidlen);
uidlen >>= 1;
switch (uidlen) { switch (uidlen) {
//case 20: flags |= FLAG_10B_UID_IN_DATA; break; //case 10: flags |= FLAG_10B_UID_IN_DATA; break;
case 14: case 7:
flags |= FLAG_7B_UID_IN_DATA; flags |= FLAG_7B_UID_IN_DATA;
break; break;
case 8: case 4:
flags |= FLAG_4B_UID_IN_DATA; flags |= FLAG_4B_UID_IN_DATA;
break; break;
default: default:
@ -447,23 +444,20 @@ int CmdHF14ASim(const char *Cmd) {
break; break;
} }
if (!errors) { if (!errors) {
PrintAndLogEx(SUCCESS, "Emulating ISO/IEC 14443 type A tag with %d byte UID (%s)", uidlen >> 1, sprint_hex(uid, uidlen >> 1)); PrintAndLogEx(SUCCESS, "Emulating ISO/IEC 14443 type A tag with %d byte UID (%s)", uidlen, sprint_hex(uid, uidlen));
useUIDfromEML = false; useUIDfromEML = false;
} }
cmdp += 2; cmdp += 2;
break; break;
case 'v': case 'v':
case 'V':
verbose = true; verbose = true;
cmdp++; cmdp++;
break; break;
case 'x': case 'x':
case 'X':
flags |= FLAG_NR_AR_ATTACK; flags |= FLAG_NR_AR_ATTACK;
cmdp++; cmdp++;
break; break;
case 'e': case 'e':
case 'E':
setEmulatorMem = true; setEmulatorMem = true;
cmdp++; cmdp++;
break; break;
@ -480,8 +474,18 @@ int CmdHF14ASim(const char *Cmd) {
if (useUIDfromEML) if (useUIDfromEML)
flags |= FLAG_UID_IN_EMUL; flags |= FLAG_UID_IN_EMUL;
struct {
uint8_t tagtype;
uint8_t flags;
uint8_t uid[10];
} PACKED payload;
payload.tagtype = tagtype;
payload.flags = flags;
memcpy(payload.uid, uid, uidlen);
clearCommandBuffer(); clearCommandBuffer();
SendCommandOLD(CMD_SIMULATE_TAG_ISO_14443a, tagtype, flags, 0, uid, uidlen >> 1); SendCommandNG(CMD_SIMULATE_TAG_ISO_14443a, (uint8_t *)&payload, sizeof(payload));
PacketResponseNG resp; PacketResponseNG resp;
PrintAndLogEx(SUCCESS, "press pm3-button to abort simulation"); PrintAndLogEx(SUCCESS, "press pm3-button to abort simulation");

23
client/cmdhfmf.c
View file

@ -2200,16 +2200,17 @@ static int CmdHF14AMfSim(const char *Cmd) {
break; break;
case 'u': case 'u':
param_gethex_ex(Cmd, cmdp + 1, uid, &uidlen); param_gethex_ex(Cmd, cmdp + 1, uid, &uidlen);
uidlen >>= 1;
switch (uidlen) { switch (uidlen) {
case 20: case 10:
flags |= FLAG_10B_UID_IN_DATA; flags |= FLAG_10B_UID_IN_DATA;
sprintf(uidsize, "10 byte"); sprintf(uidsize, "10 byte");
break; break;
case 14: case 7:
flags |= FLAG_7B_UID_IN_DATA; flags |= FLAG_7B_UID_IN_DATA;
sprintf(uidsize, "7 byte"); sprintf(uidsize, "7 byte");
break; break;
case 8: case 4:
flags |= FLAG_4B_UID_IN_DATA; flags |= FLAG_4B_UID_IN_DATA;
sprintf(uidsize, "4 byte"); sprintf(uidsize, "4 byte");
break; break;
@ -2243,7 +2244,7 @@ static int CmdHF14AMfSim(const char *Cmd) {
PrintAndLogEx(INFO, _YELLOW_("Mifare %s") " | %s UID " _YELLOW_("%s") "" PrintAndLogEx(INFO, _YELLOW_("Mifare %s") " | %s UID " _YELLOW_("%s") ""
, csize , csize
, uidsize , uidsize
, (uidlen == 0) ? "N/A" : sprint_hex(uid, uidlen >> 1) , (uidlen == 0) ? "N/A" : sprint_hex(uid, uidlen)
); );
PrintAndLogEx(INFO, "Options [ numreads: %d, flags: %d (0x%02x) ]" PrintAndLogEx(INFO, "Options [ numreads: %d, flags: %d (0x%02x) ]"
@ -2251,8 +2252,18 @@ static int CmdHF14AMfSim(const char *Cmd) {
, flags , flags
, flags); , flags);
struct {
uint16_t flags;
uint8_t exitAfter;
uint8_t uid[10];
} PACKED payload;
payload.flags = flags;
payload.exitAfter = exitAfterNReads;
memcpy(payload.uid, uid, uidlen);
clearCommandBuffer(); clearCommandBuffer();
SendCommandOLD(CMD_SIMULATE_MIFARE_CARD, flags, exitAfterNReads, 0, uid, sizeof(uid)); SendCommandNG(CMD_SIMULATE_MIFARE_CARD, (uint8_t *)&payload, sizeof(payload));
PacketResponseNG resp; PacketResponseNG resp;
if (flags & FLAG_INTERACTIVE) { if (flags & FLAG_INTERACTIVE) {
@ -2439,7 +2450,7 @@ int CmdHF14AMfDbg(const char *Cmd) {
uint8_t dbgMode = param_get8ex(Cmd, 0, 0, 10); uint8_t dbgMode = param_get8ex(Cmd, 0, 0, 10);
if (dbgMode > 4) return usage_hf14_dbg(); if (dbgMode > 4) return usage_hf14_dbg();
SendCommandMIX(CMD_MIFARE_SET_DBGMODE, dbgMode, 0, 0, NULL, 0); SendCommandNG(CMD_MIFARE_SET_DBGMODE, &dbgMode, 1);
return 0; return 0;
} }