diff --git a/CHANGELOG.md b/CHANGELOG.md index 97acdd258..6e1c60b98 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,13 +3,17 @@ All notable changes to this project will be documented in this file. This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log... ## [unreleased][unreleased] +- Changed flash-stored key dictionaries (Mifare, iClass, T55XX) and T55XX configurations to SPIFFS files (@piotrva) +- Changed `lf em 410x sim` to use default gap value of 0 and extended help (@piotrva) +- Changed `hf 14a info` - now identifies MIAFRE Duox (@iceman1001) +- Added `hf iclass trbl` to perform tear-off attacks on iClass (@antiklesys) - Added support for connection to host device in all Docker envs (@doegox) - Changed `hf 15 info` to show all type matches and check ST25TVxC signature (@doegox) - Added initial support for ST25TN and its signature verification (@doegox) - Changed originality checks handling to refactor code and pk data (@doegox) - Changed `uniq.yaml` workflow to be case-insensitive (@iceman1001) - Fixed `mem load --mfc` not erasing all SPI flash blocks after extending to 4095 keys (@piotrva) -- Extended area for Mifare keys in SPI flash to hold 4095 keys (@piotrva) +- Changed extended area for Mifare keys in SPI flash to hold 4095 keys (@piotrva) - Fixed DESFire D40 secure channel crypto (@nvx) - Fixed `hf mfp info` fix signature check on 4b UID cards (@doegox) - Automatically set maximum read/write block when using predefined types in `hf_mf_ultimatecard` script (@piotrva) diff --git a/armsrc/appmain.c b/armsrc/appmain.c index 2422db883..6d42a0e0c 100644 --- a/armsrc/appmain.c +++ b/armsrc/appmain.c @@ -440,7 +440,41 @@ static void SendStatus(uint32_t wait) { ModInfo(); #ifdef WITH_FLASH - Flashmem_print_info(); + DbpString(_CYAN_("Flash memory dictionary loaded")); + uint32_t num = 0; + + if (exists_in_spiffs(MF_KEYS_FILE)) { + num = size_in_spiffs(MF_KEYS_FILE) / MF_KEY_LENGTH; + } else { + num = 0; + } + if (num > 0) { + Dbprintf(" Mifare.................. "_YELLOW_("%u")" keys (spiffs: "_GREEN_("%s")")", num, MF_KEYS_FILE); + } else { + Dbprintf(" Mifare.................. "_RED_("%u")" keys (spiffs: "_RED_("%s")")", num, MF_KEYS_FILE); + } + + if (exists_in_spiffs(T55XX_KEYS_FILE)) { + num = size_in_spiffs(T55XX_KEYS_FILE) / T55XX_KEY_LENGTH; + } else { + num = 0; + } + if (num > 0) { + Dbprintf(" T55xx................... "_YELLOW_("%u")" keys (spiffs: "_GREEN_("%s")")", num, T55XX_KEYS_FILE); + } else { + Dbprintf(" T55xx................... "_RED_("%u")" keys (spiffs: "_RED_("%s")")", num, T55XX_KEYS_FILE); + } + + if (exists_in_spiffs(ICLASS_KEYS_FILE)) { + num = size_in_spiffs(ICLASS_KEYS_FILE) / ICLASS_KEY_LENGTH; + } else { + num = 0; + } + if (num > 0) { + Dbprintf(" iClass.................. "_YELLOW_("%u")" keys (spiffs: "_GREEN_("%s")")", num, ICLASS_KEYS_FILE); + } else { + Dbprintf(" iClass.................. "_RED_("%u")" keys (spiffs: "_RED_("%s")")", num, ICLASS_KEYS_FILE); + } #endif DbpString(""); reply_ng(CMD_STATUS, PM3_SUCCESS, NULL, 0); @@ -2748,34 +2782,7 @@ static void PacketReceived(PacketCommandNG *packet) { break; } - if (payload->startidx == DEFAULT_T55XX_KEYS_OFFSET_P(spi_flash_pages64k)) { - Flash_CheckBusy(BUSY_TIMEOUT); - Flash_WriteEnable(); - Flash_Erase4k(spi_flash_pages64k - 1, 0xC); - } else if (payload->startidx == DEFAULT_MF_KEYS_OFFSET_P(spi_flash_pages64k)) { - Flash_CheckBusy(BUSY_TIMEOUT); - Flash_WriteEnable(); - Flash_Erase4k(spi_flash_pages64k - 1, 0x5); - Flash_CheckBusy(BUSY_TIMEOUT); - Flash_WriteEnable(); - Flash_Erase4k(spi_flash_pages64k - 1, 0x6); - Flash_CheckBusy(BUSY_TIMEOUT); - Flash_WriteEnable(); - Flash_Erase4k(spi_flash_pages64k - 1, 0x7); - Flash_CheckBusy(BUSY_TIMEOUT); - Flash_WriteEnable(); - Flash_Erase4k(spi_flash_pages64k - 1, 0x8); - Flash_CheckBusy(BUSY_TIMEOUT); - Flash_WriteEnable(); - Flash_Erase4k(spi_flash_pages64k - 1, 0x9); - Flash_CheckBusy(BUSY_TIMEOUT); - Flash_WriteEnable(); - Flash_Erase4k(spi_flash_pages64k - 1, 0xA); - } else if (payload->startidx == DEFAULT_ICLASS_KEYS_OFFSET_P(spi_flash_pages64k)) { - Flash_CheckBusy(BUSY_TIMEOUT); - Flash_WriteEnable(); - Flash_Erase4k(spi_flash_pages64k - 1, 0xB); - } else if (payload->startidx == FLASH_MEM_SIGNATURE_OFFSET_P(spi_flash_pages64k)) { + if (payload->startidx == FLASH_MEM_SIGNATURE_OFFSET_P(spi_flash_pages64k)) { Flash_CheckBusy(BUSY_TIMEOUT); Flash_WriteEnable(); Flash_Erase4k(spi_flash_pages64k - 1, 0xF); diff --git a/armsrc/lfops.c b/armsrc/lfops.c index 263905466..c93880944 100644 --- a/armsrc/lfops.c +++ b/armsrc/lfops.c @@ -37,7 +37,8 @@ #include "protocols.h" #include "pmflash.h" #include "flashmem.h" // persistence on flash -#include "appmain.h" // print stack +#include "spiffs.h" // spiffs +#include "appmain.h" // print stack /* Notes about EM4xxx timings. @@ -324,31 +325,7 @@ void setT55xxConfig(uint8_t arg0, const t55xx_configurations_t *c) { return; } - if (!FlashInit()) { - BigBuf_free(); - return; - } - - uint8_t *buf = BigBuf_malloc(T55XX_CONFIG_LEN); - Flash_CheckBusy(BUSY_TIMEOUT); - uint16_t res = Flash_ReadDataCont(T55XX_CONFIG_OFFSET, buf, T55XX_CONFIG_LEN); - if (res == 0) { - FlashStop(); - BigBuf_free(); - return; - } - - memcpy(buf, &T55xx_Timing, T55XX_CONFIG_LEN); - - // delete old configuration - Flash_CheckBusy(BUSY_TIMEOUT); - Flash_WriteEnable(); - Flash_Erase4k(3, 0xD); - - // write new - res = Flash_Write(T55XX_CONFIG_OFFSET, buf, T55XX_CONFIG_LEN); - - if (res == T55XX_CONFIG_LEN && g_dbglevel > 1) { + if (SPIFFS_OK == rdv40_spiffs_write(T55XX_CONFIG_FILE, (uint8_t*)&T55xx_Timing, T55XX_CONFIG_LEN, RDV40_SPIFFS_SAFETY_SAFE)) { DbpString("T55XX Config save " _GREEN_("success")); } @@ -363,15 +340,23 @@ t55xx_configurations_t *getT55xxConfig(void) { void loadT55xxConfig(void) { #ifdef WITH_FLASH - if (!FlashInit()) { + uint8_t *buf = BigBuf_malloc(T55XX_CONFIG_LEN); + + uint32_t size = 0; + if (exists_in_spiffs(T55XX_CONFIG_FILE)) { + size = size_in_spiffs(T55XX_CONFIG_FILE); + } + if (size == 0) { + Dbprintf("Spiffs file: %s does not exists or empty.", T55XX_CONFIG_FILE); + BigBuf_free(); return; } - uint8_t *buf = BigBuf_malloc(T55XX_CONFIG_LEN); - - Flash_CheckBusy(BUSY_TIMEOUT); - uint16_t isok = Flash_ReadDataCont(T55XX_CONFIG_OFFSET, buf, T55XX_CONFIG_LEN); - FlashStop(); + if (SPIFFS_OK != rdv40_spiffs_read(T55XX_CONFIG_FILE, buf, T55XX_CONFIG_LEN, RDV40_SPIFFS_SAFETY_SAFE)) { + Dbprintf("Spiffs file: %s cannot be read.", T55XX_CONFIG_FILE); + BigBuf_free(); + return; + } // verify read mem is actual data. uint8_t cntA = T55XX_CONFIG_LEN, cntB = T55XX_CONFIG_LEN; @@ -380,6 +365,7 @@ void loadT55xxConfig(void) { if (buf[i] == 0x00) cntB--; } if (!cntA || !cntB) { + Dbprintf("Spiffs file: %s does not malformed or empty.", T55XX_CONFIG_FILE); BigBuf_free(); return; } @@ -387,7 +373,7 @@ void loadT55xxConfig(void) { if (buf[0] != 0xFF) // if not set for clear memcpy((uint8_t *)&T55xx_Timing, buf, T55XX_CONFIG_LEN); - if (isok == T55XX_CONFIG_LEN) { + if (size == T55XX_CONFIG_LEN) { if (g_dbglevel > 1) DbpString("T55XX Config load success"); } @@ -2146,29 +2132,34 @@ void T55xx_ChkPwds(uint8_t flags, bool ledcontrol) { #ifdef WITH_FLASH BigBuf_Clear_EM(); - uint16_t isok = 0; - uint8_t counter[2] = {0x00, 0x00}; - isok = Flash_ReadData(DEFAULT_T55XX_KEYS_OFFSET_P(spi_flash_pages64k), counter, sizeof(counter)); - if (isok != sizeof(counter)) + uint32_t size = 0; + + if (exists_in_spiffs(T55XX_KEYS_FILE)) { + size = size_in_spiffs(T55XX_KEYS_FILE); + } + if (size == 0) { + Dbprintf("Spiffs file: %s does not exists or empty.", T55XX_KEYS_FILE); goto OUT; + } - pwd_count = (uint16_t)(counter[1] << 8 | counter[0]); + pwd_count = size / T55XX_KEY_LENGTH; if (pwd_count == 0) goto OUT; // since flash can report way too many pwds, we need to limit it. // bigbuff EM size is determined by CARD_MEMORY_SIZE // a password is 4bytes. - uint16_t pwd_size_available = MIN(CARD_MEMORY_SIZE, pwd_count * 4); + uint16_t pwd_size_available = MIN(CARD_MEMORY_SIZE, pwd_count * T55XX_KEY_LENGTH); // adjust available pwd_count - pwd_count = pwd_size_available / 4; + pwd_count = pwd_size_available / T55XX_KEY_LENGTH; - isok = Flash_ReadData(DEFAULT_T55XX_KEYS_OFFSET_P(spi_flash_pages64k) + 2, pwds, pwd_size_available); - if (isok != pwd_size_available) + if (SPIFFS_OK == rdv40_spiffs_read_as_filetype(T55XX_KEYS_FILE, pwds, pwd_size_available, RDV40_SPIFFS_SAFETY_SAFE)) { + if (g_dbglevel >= DBG_ERROR) Dbprintf("Loaded %u passwords from spiffs file: %s", pwd_count, T55XX_KEYS_FILE); + } else { + Dbprintf("Spiffs file: %s cannot be read.", T55XX_KEYS_FILE); goto OUT; - - Dbprintf("Password dictionary count " _YELLOW_("%d"), pwd_count); + } #endif diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c index 9820d19a2..bf308364d 100644 --- a/armsrc/mifarecmd.c +++ b/armsrc/mifarecmd.c @@ -1900,31 +1900,36 @@ void MifareChkKeys_fast(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *da #ifdef WITH_FLASH if (use_flashmem) { BigBuf_free(); - uint16_t isok = 0; - uint8_t size[2] = {0x00, 0x00}; - isok = Flash_ReadData(DEFAULT_MF_KEYS_OFFSET_P(spi_flash_pages64k), size, 2); - if (isok != 2) + uint32_t size = 0; + if (exists_in_spiffs(MF_KEYS_FILE)) { + size = size_in_spiffs(MF_KEYS_FILE); + } + if (size == 0) { + Dbprintf("Spiffs file: %s does not exists or empty.", MF_KEYS_FILE); goto OUT; + } - keyCount = size[1] << 8 | size[0]; + keyCount = size / MF_KEY_LENGTH; if (keyCount == 0) goto OUT; // limit size of available for keys in bigbuff // a key is 6bytes - uint16_t key_mem_available = MIN(BigBuf_get_size(), keyCount * 6); + uint16_t key_mem_available = MIN(BigBuf_get_size(), keyCount * MF_KEY_LENGTH); - keyCount = key_mem_available / 6; + keyCount = key_mem_available / MF_KEY_LENGTH; datain = BigBuf_malloc(key_mem_available); if (datain == NULL) goto OUT; - isok = Flash_ReadData(DEFAULT_MF_KEYS_OFFSET_P(spi_flash_pages64k) + 2, datain, key_mem_available); - if (isok != key_mem_available) + if (SPIFFS_OK == rdv40_spiffs_read_as_filetype(MF_KEYS_FILE, datain, keyCount * MF_KEY_LENGTH, RDV40_SPIFFS_SAFETY_SAFE)) { + if (g_dbglevel >= DBG_ERROR) Dbprintf("Loaded %u keys from spiffs file: %s", keyCount, MF_KEYS_FILE); + } else { + Dbprintf("Spiffs file: %s cannot be read.", MF_KEYS_FILE); goto OUT; - + } } #endif diff --git a/client/src/cmdflashmem.c b/client/src/cmdflashmem.c index d1e9ab672..dbb030bf8 100644 --- a/client/src/cmdflashmem.c +++ b/client/src/cmdflashmem.c @@ -17,6 +17,7 @@ //----------------------------------------------------------------------------- #include "cmdflashmem.h" #include +#include #include "cmdparser.h" // command_t #include "cliparser.h" #include "pmflash.h" // rdv40validation_t @@ -192,7 +193,7 @@ static int CmdFlashMemLoad(const char *Cmd) { CLIParserInit(&ctx, "mem load", "Loads binary file into flash memory on device\n" "Warning: mem area to be written must have been wiped first\n" - "( this is already taken care when loading dictionaries )", + "( dictionaries are serviced as files in spiffs so no wipe is needed )", "mem load -f myfile -> upload file myfile values at default offset 0\n" "mem load -f myfile -o 1024 -> upload file myfile values at offset 1024\n" "mem load -f mfc_default_keys -m -> upload MFC keys\n" @@ -217,6 +218,7 @@ static int CmdFlashMemLoad(const char *Cmd) { bool is_t55xx = arg_get_lit(ctx, 4); int fnlen = 0; char filename[FILE_PATH_SIZE] = {0}; + char spiffsDest[32] = {0}; CLIParamStrToBuf(arg_get_str(ctx, 5), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen); CLIParserFree(ctx); @@ -246,57 +248,46 @@ static int CmdFlashMemLoad(const char *Cmd) { switch (d) { case DICTIONARY_MIFARE: - offset = DEFAULT_MF_KEYS_OFFSET_P(spi_flash_pages); - keylen = 6; - res = loadFileDICTIONARY(filename, data + 2, &datalen, keylen, &keycount); + keylen = MF_KEY_LENGTH; + res = loadFileDICTIONARY(filename, data, &datalen, keylen, &keycount); if (res || !keycount) { free(data); return PM3_EFILE; } - // limited space on flash mem - if (keycount > DEFAULT_MF_KEYS_MAX) { - keycount = DEFAULT_MF_KEYS_MAX; - datalen = keycount * keylen; + if (datalen > FLASH_MEM_MAX_SIZE_P(spi_flash_pages)) { + PrintAndLogEx(ERR, "error, filesize is larger than available memory"); + free(data); + return PM3_EOVFLOW; } - - data[0] = (keycount >> 0) & 0xFF; - data[1] = (keycount >> 8) & 0xFF; - datalen += 2; + strcpy(spiffsDest, MF_KEYS_FILE); break; case DICTIONARY_T55XX: - offset = DEFAULT_T55XX_KEYS_OFFSET_P(spi_flash_pages); - keylen = 4; - res = loadFileDICTIONARY(filename, data + 2, &datalen, keylen, &keycount); + keylen = T55XX_KEY_LENGTH; + res = loadFileDICTIONARY(filename, data, &datalen, keylen, &keycount); if (res || !keycount) { free(data); return PM3_EFILE; } - // limited space on flash mem - if (keycount > DEFAULT_T55XX_KEYS_MAX) { - keycount = DEFAULT_T55XX_KEYS_MAX; - datalen = keycount * keylen; + if (datalen > FLASH_MEM_MAX_SIZE_P(spi_flash_pages)) { + PrintAndLogEx(ERR, "error, filesize is larger than available memory"); + free(data); + return PM3_EOVFLOW; } - - data[0] = (keycount >> 0) & 0xFF; - data[1] = (keycount >> 8) & 0xFF; - datalen += 2; + strcpy(spiffsDest, T55XX_KEYS_FILE); break; case DICTIONARY_ICLASS: - offset = DEFAULT_ICLASS_KEYS_OFFSET_P(spi_flash_pages); - res = loadFileDICTIONARY(filename, data + 2, &datalen, keylen, &keycount); + keylen = ICLASS_KEY_LENGTH; + res = loadFileDICTIONARY(filename, data, &datalen, keylen, &keycount); if (res || !keycount) { free(data); return PM3_EFILE; } - // limited space on flash mem - if (keycount > DEFAULT_ICLASS_KEYS_MAX) { - keycount = DEFAULT_ICLASS_KEYS_MAX; - datalen = keycount * keylen; + if (datalen > FLASH_MEM_MAX_SIZE_P(spi_flash_pages)) { + PrintAndLogEx(ERR, "error, filesize is larger than available memory"); + free(data); + return PM3_EOVFLOW; } - - data[0] = (keycount >> 0) & 0xFF; - data[1] = (keycount >> 8) & 0xFF; - datalen += 2; + strcpy(spiffsDest, ICLASS_KEYS_FILE); break; case DICTIONARY_NONE: res = loadFile_safe(filename, ".bin", (void **)&data, &datalen); @@ -326,44 +317,57 @@ static int CmdFlashMemLoad(const char *Cmd) { uint32_t bytes_sent = 0; uint32_t bytes_remaining = datalen; - - // fast push mode - g_conn.block_after_ACK = true; - - while (bytes_remaining > 0) { - uint32_t bytes_in_packet = MIN(FLASH_MEM_BLOCK_SIZE, bytes_remaining); - - clearCommandBuffer(); - - flashmem_old_write_t payload = { - .startidx = offset + bytes_sent, - .len = bytes_in_packet, - }; - memcpy(payload.data, data + bytes_sent, bytes_in_packet); - SendCommandNG(CMD_FLASHMEM_WRITE, (uint8_t *)&payload, sizeof(payload)); - - bytes_remaining -= bytes_in_packet; - bytes_sent += bytes_in_packet; - - PacketResponseNG resp; - if (WaitForResponseTimeout(CMD_FLASHMEM_WRITE, &resp, 2000) == false) { - PrintAndLogEx(WARNING, "timeout while waiting for reply."); - g_conn.block_after_ACK = false; + // we will treat dictionary files as spiffs files, so we need to handle this here + if (d != DICTIONARY_NONE) { + res = flashmem_spiffs_load(spiffsDest, data, datalen); + if (res != PM3_SUCCESS) { + PrintAndLogEx(FAILED, "Failed writing passwrods to file %s", spiffsDest); free(data); - return PM3_ETIMEOUT; + return res; + } + PrintAndLogEx(SUCCESS, "Wrote "_GREEN_("%u")" passwords to file "_GREEN_("%s"), keycount, spiffsDest); + SendCommandNG(CMD_SPIFFS_UNMOUNT, NULL, 0); + SendCommandNG(CMD_SPIFFS_MOUNT, NULL, 0); + } else { + // fast push mode + g_conn.block_after_ACK = true; + + while (bytes_remaining > 0) { + uint32_t bytes_in_packet = MIN(FLASH_MEM_BLOCK_SIZE, bytes_remaining); + + clearCommandBuffer(); + + flashmem_old_write_t payload = { + .startidx = offset + bytes_sent, + .len = bytes_in_packet, + }; + memcpy(payload.data, data + bytes_sent, bytes_in_packet); + SendCommandNG(CMD_FLASHMEM_WRITE, (uint8_t *)&payload, sizeof(payload)); + + bytes_remaining -= bytes_in_packet; + bytes_sent += bytes_in_packet; + + PacketResponseNG resp; + if (WaitForResponseTimeout(CMD_FLASHMEM_WRITE, &resp, 2000) == false) { + PrintAndLogEx(WARNING, "timeout while waiting for reply."); + g_conn.block_after_ACK = false; + free(data); + return PM3_ETIMEOUT; + } + + if (resp.status != PM3_SUCCESS) { + g_conn.block_after_ACK = false; + PrintAndLogEx(FAILED, "Flash write fail [offset %u]", bytes_sent); + free(data); + return PM3_EFLASH; + } } - if (resp.status != PM3_SUCCESS) { - g_conn.block_after_ACK = false; - PrintAndLogEx(FAILED, "Flash write fail [offset %u]", bytes_sent); - free(data); - return PM3_EFLASH; - } + g_conn.block_after_ACK = false; + PrintAndLogEx(SUCCESS, "Wrote "_GREEN_("%zu")" bytes to offset "_GREEN_("%u"), datalen, offset); } - g_conn.block_after_ACK = false; free(data); - PrintAndLogEx(SUCCESS, "Wrote "_GREEN_("%zu")" bytes to offset "_GREEN_("%u"), datalen, offset); return PM3_SUCCESS; } diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c index cd1db3e08..03e8585e1 100644 --- a/client/src/cmdhf14a.c +++ b/client/src/cmdhf14a.c @@ -1884,6 +1884,7 @@ static int detect_nxp_card_print(uint8_t sak, uint16_t atqa, uint64_t select_sta printTag("MIFARE DESFire EV2 2K/4K/8K/16K/32K"); printTag("MIFARE DESFire EV3 2K/4K/8K"); printTag("MIFARE DESFire Light 640B"); + printTag("MIFARE Duox"); type |= MTDESFIRE; } else { printTag("MIFARE Plus EV1 2K/4K CL2 in SL3"); diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index 42d23d0f1..fbe8a88bc 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -41,6 +41,7 @@ #include "preferences.h" #include "generator.h" #include "cmdhf14b.h" +#include "cmdhw.h" #define NUM_CSNS 9 @@ -2927,6 +2928,199 @@ static int CmdHFiClass_ReadBlock(const char *Cmd) { return PM3_SUCCESS; } +static int CmdHFiClass_TearBlock(const char *Cmd) { + CLIParserContext *ctx; + CLIParserInit(&ctx, "hf iclass trbl", + "Tear off an iCLASS tag block", + "hf iclass trbl --blk 10 -d AAAAAAAAAAAAAAAA -k 001122334455667B --tdb 100 --tde 150\n" + "hf iclass trbl --blk 10 -d AAAAAAAAAAAAAAAA --ki 0 --tdb 100 --tde 150"); + + void *argtable[] = { + arg_param_begin, + arg_str0("k", "key", "", "Access key as 8 hex bytes"), + arg_int0(NULL, "ki", "", "Key index to select key from memory 'hf iclass managekeys'"), + arg_int1(NULL, "blk", "", "block number"), + arg_str1("d", "data", "", "data to write as 8 hex bytes"), + arg_str0("m", "mac", "", "replay mac data (4 hex bytes)"), + arg_lit0(NULL, "credit", "key is assumed to be the credit key"), + arg_lit0(NULL, "elite", "elite computations applied to key"), + arg_lit0(NULL, "raw", "no computations applied to key"), + arg_lit0(NULL, "nr", "replay of NR/MAC"), + arg_lit0("v", "verbose", "verbose output"), + arg_lit0(NULL, "shallow", "use shallow (ASK) reader modulation instead of OOK"), + arg_int1(NULL, "tdb", "", "tearoff delay start in ms"), + arg_int1(NULL, "tde", "", "tearoff delay end in ms"), + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, false); + + int key_len = 0; + uint8_t key[8] = {0}; + + CLIGetHexWithReturn(ctx, 1, key, &key_len); + + int key_nr = arg_get_int_def(ctx, 2, -1); + + if (key_len > 0 && key_nr >= 0) { + PrintAndLogEx(ERR, "Please specify key or index, not both"); + CLIParserFree(ctx); + return PM3_EINVARG; + } + + bool auth = false; + + if (key_len > 0) { + auth = true; + if (key_len != 8) { + PrintAndLogEx(ERR, "Key is incorrect length"); + CLIParserFree(ctx); + return PM3_EINVARG; + } + } else if (key_nr >= 0) { + if (key_nr < ICLASS_KEYS_MAX) { + auth = true; + memcpy(key, iClass_Key_Table[key_nr], 8); + PrintAndLogEx(SUCCESS, "Using key[%d] " _GREEN_("%s"), key_nr, sprint_hex(iClass_Key_Table[key_nr], 8)); + } else { + PrintAndLogEx(ERR, "Key number is invalid"); + CLIParserFree(ctx); + return PM3_EINVARG; + } + } + + int blockno = arg_get_int_def(ctx, 3, 0); + + int data_len = 0; + uint8_t data[8] = {0}; + CLIGetHexWithReturn(ctx, 4, data, &data_len); + + if (data_len != 8) { + PrintAndLogEx(ERR, "Data must be 8 hex bytes (16 hex symbols)"); + CLIParserFree(ctx); + return PM3_EINVARG; + } + + int mac_len = 0; + uint8_t mac[4] = {0}; + CLIGetHexWithReturn(ctx, 5, mac, &mac_len); + + if (mac_len) { + if (mac_len != 4) { + PrintAndLogEx(ERR, "MAC must be 4 hex bytes (8 hex symbols)"); + CLIParserFree(ctx); + return PM3_EINVARG; + } + } + + int tearoff_start = arg_get_int_def(ctx, 12, 100); + int tearoff_end = arg_get_int_def(ctx, 13, 200); + + if(tearoff_end <= tearoff_start){ + PrintAndLogEx(ERR, "Tearoff end delay must be bigger than the start delay."); + return PM3_EINVARG; + } + + if(tearoff_start < 0 || tearoff_end <= 0){ + PrintAndLogEx(ERR, "Tearoff start/end delays should be bigger than 0."); + return PM3_EINVARG; + } + + bool use_credit_key = arg_get_lit(ctx, 6); + bool elite = arg_get_lit(ctx, 7); + bool rawkey = arg_get_lit(ctx, 8); + bool use_replay = arg_get_lit(ctx, 9); + bool verbose = arg_get_lit(ctx, 10); + bool shallow_mod = arg_get_lit(ctx, 11); + + CLIParserFree(ctx); + + if ((use_replay + rawkey + elite) > 1) { + PrintAndLogEx(ERR, "Can not use a combo of 'elite', 'raw', 'nr'"); + return PM3_EINVARG; + } + int isok = 0; + tearoff_params_t params; + bool read_ok = false; + while(tearoff_start < tearoff_end && !read_ok){ + //perform read here, repeat if failed or 00s + + uint8_t data_read_orig[8] = {0}; + bool first_read = false; + bool reread = false; + while(!first_read){ + int res_orig = iclass_read_block_ex(key, blockno, 0x88, elite, rawkey, use_replay, verbose, auth, shallow_mod, data_read_orig, false); + if (res_orig == PM3_SUCCESS && !reread){ + if (memcmp(data_read_orig, zeros, 8) == 0){ + reread = true; + }else{ + first_read = true; + reread = false; + } + } else if (res_orig == PM3_SUCCESS && reread){ + first_read = true; + reread = false; + } + } + + params.on = true; + params.delay_us = tearoff_start; + handle_tearoff(¶ms, false); + PrintAndLogEx(INFO, "Tear off delay: "_YELLOW_("%d")" ms", tearoff_start); + isok = iclass_write_block(blockno, data, mac, key, use_credit_key, elite, rawkey, use_replay, verbose, auth, shallow_mod); + switch (isok) { + case PM3_SUCCESS: + PrintAndLogEx(SUCCESS, "Wrote block " _YELLOW_("%d") " / " _YELLOW_("0x%02X") " ( " _GREEN_("ok") " )", blockno, blockno); + break; + case PM3_ETEAROFF: + break; + default: + PrintAndLogEx(FAILED, "Writing failed"); + break; + } + //read the data back + uint8_t data_read[8] = {0}; + first_read = false; + reread = false; + bool decrease = false; + while(!first_read){ + int res = iclass_read_block_ex(key, blockno, 0x88, elite, rawkey, use_replay, verbose, auth, shallow_mod, data_read, false); + if (res == PM3_SUCCESS && !reread){ + if (memcmp(data_read, zeros, 8) == 0){ + reread = true; + }else{ + first_read = true; + reread = false; + } + } else if (res == PM3_SUCCESS && reread){ + first_read = true; + reread = false; + } else if (res != PM3_SUCCESS){ + decrease = true; + } + } + if (decrease && tearoff_start > 0){ //if there was an error reading repeat the tearoff with the same delay + tearoff_start--; + } + bool tear_success = true; + for (int i=0; i", "<32|64> clock (default 64)"), arg_str1(NULL, "id", "", "EM Tag ID number (5 hex bytes)"), - arg_u64_0(NULL, "gap", "", "gap (0's) between ID repeats (default 20)"), + arg_u64_0(NULL, "gap", "", "gap (0's) between ID repeats (default 0)"), arg_param_end }; CLIExecWithReturn(ctx, Cmd, argtable, false); @@ -467,7 +469,7 @@ static int CmdEM410xSim(const char *Cmd) { // clock is 64 in EM410x tags int clk = arg_get_u32_def(ctx, 1, 64); int uid_len = 0; - int gap = arg_get_u32_def(ctx, 3, 20); + int gap = arg_get_u32_def(ctx, 3, 0); uint8_t uid[5] = {0}; CLIGetHexWithReturn(ctx, 2, uid, &uid_len); CLIParserFree(ctx); diff --git a/client/src/mifare/mifarehost.c b/client/src/mifare/mifarehost.c index 7048173b4..453a3b447 100644 --- a/client/src/mifare/mifarehost.c +++ b/client/src/mifare/mifarehost.c @@ -273,7 +273,9 @@ int mf_check_keys_fast_ex(uint8_t sectorsCnt, uint8_t firstChunk, uint8_t lastCh // max timeout for one chunk of 85keys, 60*3sec = 180seconds // s70 with 40*2 keys to check, 80*85 = 6800 auth. // takes about 97s, still some margin before abort - if (timeout > 180) { + // timeout = 180 => ~360s @ Mifare Classic 1k @ ~2300 keys in dict + // ~2300 keys @ Mifare Classic 1k => ~620s + if (timeout > 60*12) { PrintAndLogEx(WARNING, "\nNo response from Proxmark3. Aborting..."); return PM3_ETIMEOUT; } diff --git a/common_arm/flashmem.c b/common_arm/flashmem.c index 76b475e9c..f515fe994 100644 --- a/common_arm/flashmem.c +++ b/common_arm/flashmem.c @@ -383,43 +383,6 @@ void Flashmem_print_status(void) { FlashStop(); } -void Flashmem_print_info(void) { - - if (!FlashInit()) return; - - DbpString(_CYAN_("Flash memory dictionary loaded")); - - // load dictionary offsets. - uint8_t keysum[2]; - uint16_t num; - - Flash_CheckBusy(BUSY_TIMEOUT); - uint16_t isok = Flash_ReadDataCont(DEFAULT_MF_KEYS_OFFSET_P(spi_flash_pages64k), keysum, 2); - if (isok == 2) { - num = ((keysum[1] << 8) | keysum[0]); - if (num != 0xFFFF && num != 0x0) - Dbprintf(" Mifare.................. "_YELLOW_("%u")" / "_GREEN_("%u")" keys", num, DEFAULT_MF_KEYS_MAX); - } - - Flash_CheckBusy(BUSY_TIMEOUT); - isok = Flash_ReadDataCont(DEFAULT_T55XX_KEYS_OFFSET_P(spi_flash_pages64k), keysum, 2); - if (isok == 2) { - num = ((keysum[1] << 8) | keysum[0]); - if (num != 0xFFFF && num != 0x0) - Dbprintf(" T55x7................... "_YELLOW_("%u")" / "_GREEN_("%u")" keys", num, DEFAULT_T55XX_KEYS_MAX); - } - - Flash_CheckBusy(BUSY_TIMEOUT); - isok = Flash_ReadDataCont(DEFAULT_ICLASS_KEYS_OFFSET_P(spi_flash_pages64k), keysum, 2); - if (isok == 2) { - num = ((keysum[1] << 8) | keysum[0]); - if (num != 0xFFFF && num != 0x0) - Dbprintf(" iClass.................. "_YELLOW_("%u")" / "_GREEN_("%u")" keys", num, DEFAULT_ICLASS_KEYS_MAX); - } - - FlashStop(); -} - bool FlashDetect(void) { flash_device_type_t flash_data = {0}; bool ret = false; diff --git a/common_arm/flashmem.h b/common_arm/flashmem.h index f20dd0bff..45b8e67c2 100644 --- a/common_arm/flashmem.h +++ b/common_arm/flashmem.h @@ -134,7 +134,6 @@ uint16_t Flash_Write(uint32_t address, uint8_t *in, uint16_t len); uint16_t Flash_WriteData(uint32_t address, uint8_t *in, uint16_t len); uint16_t Flash_WriteDataCont(uint32_t address, uint8_t *in, uint16_t len); void Flashmem_print_status(void); -void Flashmem_print_info(void); typedef struct { uint8_t manufacturer_id; diff --git a/doc/ext_flash_notes.md b/doc/ext_flash_notes.md index 6a86c7778..d54c2be53 100644 --- a/doc/ext_flash_notes.md +++ b/doc/ext_flash_notes.md @@ -37,20 +37,20 @@ Therefore a flash address can be interpreted as such: Page 0: * available for user data * to dump it: `mem dump -f page0_dump -o 0 -l 65536` -* to erase it: `mem wipe p 0` +* to erase it: `mem wipe -p 0` Page 1: * available for user data * to dump it: `mem dump -f page1_dump -o 65536 -l 65536` -* to erase it: `mem wipe p 1` +* to erase it: `mem wipe -p 1` Page 2: * available for user data * to dump it: `mem dump -f page2_dump -o 131072 -l 65536` -* to erase it: `mem wipe p 2` +* to erase it: `mem wipe -p 2` Page 3: -* used by Proxmark3 RDV4 specific functions: flash signature and keys dictionaries, see below for details +* used by Proxmark3 RDV4 specific functions: flash signature, see below for details * to dump it: `mem dump -f page3_dump -o 196608 -l 65536` * to erase it: * **Beware** it will erase your flash signature so better to back it up first as you won't be able to regenerate it by yourself! @@ -62,22 +62,6 @@ Page 3: Page3 is used as follows by the Proxmark3 RDV4 firmware: -* **MF_KEYS** - * offset: page 3 sector 5 (0x5) @ 3*0x10000+5*0x1000=0x35000 - * length: 6 sectors - -* **ICLASS_KEYS** - * offset: page 3 sector 11 (0xB) @ 3*0x10000+11*0x1000=0x3B000 - * length: 1 sector - -* **T55XX_KEYS** - * offset: page 3 sector 12 (0xC) @ 3*0x10000+12*0x1000=0x3C000 - * length: 1 sector - -* **T55XX_CONFIG** - * offset: page 3 sector 13 (0xD) @ 3*0x10000+13*0x1000=0x3D000 - * length: 1 sector (actually only a few bytes are used to store `t55xx_config` structure) - * **RSA SIGNATURE**, see below for details * offset: page 3 sector 15 (0xF) offset 0xF7F @ 3*0x10000+15*0x1000+0xF7F=0x3FF7F (decimal 262015) * length: 128 bytes diff --git a/include/pmflash.h b/include/pmflash.h index 3a6b361b6..d40caa725 100644 --- a/include/pmflash.h +++ b/include/pmflash.h @@ -26,9 +26,6 @@ // // 0x3F000 - 1 4kb sector = signature // 0x3E000 - 1 4kb sector = settings -// 0x3D000 - 1 4kb sector = default T55XX keys dictionary -// 0x3B000 - 1 4kb sector = default ICLASS keys dictionary -// 0x35000 - 6 4kb sectors = default MFC keys dictionary // #ifndef FLASH_MEM_BLOCK_SIZE # define FLASH_MEM_BLOCK_SIZE 256 @@ -70,42 +67,19 @@ # define T55XX_CONFIG_LEN sizeof( t55xx_configurations_t ) #endif -#ifndef T55XX_CONFIG_OFFSET -# define T55XX_CONFIG_OFFSET (FLASH_MEM_MAX_4K_SECTOR - 0x2000) -#endif -#ifndef T55XX_CONFIG_OFFSET_P -# define T55XX_CONFIG_OFFSET_P(p64k) (FLASH_MEM_MAX_4K_SECTOR_P(p64k) - 0x2000) -#endif +#define T55XX_CONFIG_FILE "cfg_t55xx.bin" -// Reserved space for T55XX PWD = 4 kb -#ifndef DEFAULT_T55XX_KEYS_OFFSET -# define DEFAULT_T55XX_KEYS_LEN (0x1000) -# define DEFAULT_T55XX_KEYS_OFFSET (T55XX_CONFIG_OFFSET - DEFAULT_T55XX_KEYS_LEN) -# define DEFAULT_T55XX_KEYS_MAX ((DEFAULT_T55XX_KEYS_LEN - 2) / 4) -#endif -#ifndef DEFAULT_T55XX_KEYS_OFFSET_P -# define DEFAULT_T55XX_KEYS_OFFSET_P(p64k) (T55XX_CONFIG_OFFSET_P(p64k) - DEFAULT_T55XX_KEYS_LEN) -#endif +// T55XX PWD stored in spiffs +#define T55XX_KEYS_FILE "dict_t55xx.bin" +#define T55XX_KEY_LENGTH 4 -// Reserved space for iClass keys = 4 kb -#ifndef DEFAULT_ICLASS_KEYS_OFFSET -# define DEFAULT_ICLASS_KEYS_LEN (0x1000) -# define DEFAULT_ICLASS_KEYS_OFFSET (DEFAULT_T55XX_KEYS_OFFSET - DEFAULT_ICLASS_KEYS_LEN) -# define DEFAULT_ICLASS_KEYS_MAX ((DEFAULT_ICLASS_KEYS_LEN - 2) / 8) -#endif -#ifndef DEFAULT_ICLASS_KEYS_OFFSET_P -# define DEFAULT_ICLASS_KEYS_OFFSET_P(p64k) (DEFAULT_T55XX_KEYS_OFFSET_P(p64k) - DEFAULT_ICLASS_KEYS_LEN) -#endif +// iClass keys stored in spiffs +#define ICLASS_KEYS_FILE "dict_iclass.bin" +#define ICLASS_KEY_LENGTH 8 -// Reserved space for MIFARE Keys = 24 kb -#ifndef DEFAULT_MF_KEYS_OFFSET -# define DEFAULT_MF_KEYS_LEN (0x6000) -# define DEFAULT_MF_KEYS_OFFSET (DEFAULT_ICLASS_KEYS_OFFSET - DEFAULT_MF_KEYS_LEN) -# define DEFAULT_MF_KEYS_MAX ((DEFAULT_MF_KEYS_LEN - 2) / 6) -#endif -#ifndef DEFAULT_MF_KEYS_OFFSET_P -# define DEFAULT_MF_KEYS_OFFSET_P(p64k) (DEFAULT_ICLASS_KEYS_OFFSET_P(p64k) - DEFAULT_MF_KEYS_LEN) -#endif +// Mifare keys stored in spiffs +#define MF_KEYS_FILE "dict_mf.bin" +#define MF_KEY_LENGTH 6 // RDV40, validation structure to help identifying that client/firmware is talking with RDV40 typedef struct {