This commit is contained in:
iceman1001 2019-12-03 14:51:55 +01:00
commit b5be8a3663
5 changed files with 52 additions and 52 deletions

View file

@ -325,10 +325,10 @@ void getKeySettings(uint8_t *aid) {
// LOOP over numOfKeys that we got before. // LOOP over numOfKeys that we got before.
// From 0x01 to numOfKeys. We already got 0x00. (AMK) // From 0x01 to numOfKeys. We already got 0x00. (AMK)
// TODO (iceman) // TODO (iceman)
/* /*
for (int i = 0x01; i <= 0x0f; ++i) { for (int i = 0x01; i <= 0x0f; ++i) {
} }
*/ */
} }
} }

View file

@ -642,9 +642,9 @@ static int CmdHFMFPWrbl(const char *cmd) {
#define AES_KEY_LEN 16 #define AES_KEY_LEN 16
#define MAX_KEYS_LIST_LEN 1024 #define MAX_KEYS_LIST_LEN 1024
int MFPKeyCheck(uint8_t startSector, uint8_t endSector, uint8_t startKeyAB, uint8_t endKeyAB, int MFPKeyCheck(uint8_t startSector, uint8_t endSector, uint8_t startKeyAB, uint8_t endKeyAB,
uint8_t keyList[MAX_KEYS_LIST_LEN][AES_KEY_LEN], size_t keyListLen, uint8_t foundKeys[2][64][AES_KEY_LEN + 1], uint8_t keyList[MAX_KEYS_LIST_LEN][AES_KEY_LEN], size_t keyListLen, uint8_t foundKeys[2][64][AES_KEY_LEN + 1],
bool verbose) { bool verbose) {
int res; int res;
bool selectCard = true; bool selectCard = true;
uint8_t keyn[2] = {0}; uint8_t keyn[2] = {0};
@ -652,7 +652,7 @@ static int CmdHFMFPWrbl(const char *cmd) {
// sector number from 0 // sector number from 0
for (uint8_t sector = startSector; sector <= endSector; sector++) { for (uint8_t sector = startSector; sector <= endSector; sector++) {
// 0-keyA 1-keyB // 0-keyA 1-keyB
for(uint8_t keyAB = startKeyAB; keyAB <= endKeyAB; keyAB++) { for (uint8_t keyAB = startKeyAB; keyAB <= endKeyAB; keyAB++) {
// main cycle with key check // main cycle with key check
for (int i = 0; i < keyListLen; i++) { for (int i = 0; i < keyListLen; i++) {
if (i % 10 == 0) { if (i % 10 == 0) {
@ -668,25 +668,25 @@ static int CmdHFMFPWrbl(const char *cmd) {
uint16_t uKeyNum = 0x4000 + sector * 2 + keyAB; uint16_t uKeyNum = 0x4000 + sector * 2 + keyAB;
keyn[0] = uKeyNum >> 8; keyn[0] = uKeyNum >> 8;
keyn[1] = uKeyNum & 0xff; keyn[1] = uKeyNum & 0xff;
for (int retry = 0; retry < 4; retry++) { for (int retry = 0; retry < 4; retry++) {
res = MifareAuth4(NULL, keyn, keyList[i], selectCard, true, false, false, true); res = MifareAuth4(NULL, keyn, keyList[i], selectCard, true, false, false, true);
if (res != 2) if (res != 2)
break; break;
if (verbose) if (verbose)
PrintAndLogEx(WARNING, "retried[%d]...", retry); PrintAndLogEx(WARNING, "retried[%d]...", retry);
else else
printf("R"); printf("R");
DropField(); DropField();
selectCard = true; selectCard = true;
msleep(100); msleep(100);
} }
if (verbose) if (verbose)
PrintAndLogEx(WARNING, "sector %02d key %d [%s] res: %d", sector, keyAB, sprint_hex_inrow(keyList[i], 16), res); PrintAndLogEx(WARNING, "sector %02d key %d [%s] res: %d", sector, keyAB, sprint_hex_inrow(keyList[i], 16), res);
// key for [sector,keyAB] found // key for [sector,keyAB] found
if (res == 0) { if (res == 0) {
if (verbose) if (verbose)
@ -700,7 +700,7 @@ static int CmdHFMFPWrbl(const char *cmd) {
msleep(50); msleep(50);
break; break;
} }
// 5 - auth error (rnd not equal) // 5 - auth error (rnd not equal)
if (res != 5) { if (res != 5) {
if (verbose) if (verbose)
@ -710,12 +710,12 @@ static int CmdHFMFPWrbl(const char *cmd) {
DropField(); DropField();
return PM3_ECARDEXCHANGE; return PM3_ECARDEXCHANGE;
} }
selectCard = false; selectCard = false;
} }
} }
} }
DropField(); DropField();
return PM3_SUCCESS; return PM3_SUCCESS;
} }
@ -740,7 +740,7 @@ static int CmdHFMFPChk(const char *cmd) {
uint8_t keyList[MAX_KEYS_LIST_LEN][AES_KEY_LEN] = {{0}}; uint8_t keyList[MAX_KEYS_LIST_LEN][AES_KEY_LEN] = {{0}};
size_t keyListLen = 0; size_t keyListLen = 0;
uint8_t foundKeys[2][64][AES_KEY_LEN + 1] = {{{0}}}; uint8_t foundKeys[2][64][AES_KEY_LEN + 1] = {{{0}}};
CLIParserInit("hf mfp chk", CLIParserInit("hf mfp chk",
"Checks keys with Mifare Plus card.", "Checks keys with Mifare Plus card.",
"Usage:\n" "Usage:\n"
@ -771,8 +771,8 @@ static int CmdHFMFPChk(const char *cmd) {
bool keyB = arg_get_lit(2); bool keyB = arg_get_lit(2);
uint8_t startSector = arg_get_int_def(3, 0); uint8_t startSector = arg_get_int_def(3, 0);
uint8_t endSector = arg_get_int_def(4, 0); uint8_t endSector = arg_get_int_def(4, 0);
uint8_t vkey[16] = {0}; uint8_t vkey[16] = {0};
int vkeylen = 0; int vkeylen = 0;
CLIGetHexWithReturn(5, vkey, &vkeylen); CLIGetHexWithReturn(5, vkey, &vkeylen);
if (vkeylen > 0) { if (vkeylen > 0) {
@ -785,7 +785,7 @@ static int CmdHFMFPChk(const char *cmd) {
return PM3_EINVARG; return PM3_EINVARG;
} }
} }
uint8_t dict_filename[FILE_PATH_SIZE + 2] = {0}; uint8_t dict_filename[FILE_PATH_SIZE + 2] = {0};
int dict_filenamelen = 0; int dict_filenamelen = 0;
if (CLIParamStrToBuf(arg_get_str(6), dict_filename, FILE_PATH_SIZE, &dict_filenamelen)) { if (CLIParamStrToBuf(arg_get_str(6), dict_filename, FILE_PATH_SIZE, &dict_filenamelen)) {
@ -793,7 +793,7 @@ static int CmdHFMFPChk(const char *cmd) {
CLIParserFree(); CLIParserFree();
return PM3_EINVARG; return PM3_EINVARG;
} }
bool pattern1b = arg_get_lit(7); bool pattern1b = arg_get_lit(7);
bool pattern2b = arg_get_lit(8); bool pattern2b = arg_get_lit(8);
@ -808,7 +808,7 @@ static int CmdHFMFPChk(const char *cmd) {
CLIParserFree(); CLIParserFree();
return PM3_EINVARG; return PM3_EINVARG;
} }
uint32_t startPattern = 0x0000; uint32_t startPattern = 0x0000;
uint8_t vpattern[2]; uint8_t vpattern[2];
int vpatternlen = 0; int vpatternlen = 0;
@ -824,7 +824,7 @@ static int CmdHFMFPChk(const char *cmd) {
if (!pattern2b) if (!pattern2b)
PrintAndLogEx(WARNING, "Pattern entered, but search mode not is 2-byte search."); PrintAndLogEx(WARNING, "Pattern entered, but search mode not is 2-byte search.");
} }
uint8_t jsonname[250] = {0}; uint8_t jsonname[250] = {0};
int jsonnamelen = 0; int jsonnamelen = 0;
if (CLIParamStrToBuf(arg_get_str(10), jsonname, sizeof(jsonname), &jsonnamelen)) { if (CLIParamStrToBuf(arg_get_str(10), jsonname, sizeof(jsonname), &jsonnamelen)) {
@ -833,9 +833,9 @@ static int CmdHFMFPChk(const char *cmd) {
return PM3_EINVARG; return PM3_EINVARG;
} }
jsonname[jsonnamelen] = 0; jsonname[jsonnamelen] = 0;
bool verbose = arg_get_lit(11); bool verbose = arg_get_lit(11);
CLIParserFree(); CLIParserFree();
uint8_t startKeyAB = 0; uint8_t startKeyAB = 0;
@ -844,22 +844,22 @@ static int CmdHFMFPChk(const char *cmd) {
endKeyAB = 0; endKeyAB = 0;
if (!keyA && keyB) if (!keyA && keyB)
startKeyAB = 1; startKeyAB = 1;
if (endSector < startSector) if (endSector < startSector)
endSector = startSector; endSector = startSector;
// 1-byte pattern search mode // 1-byte pattern search mode
if (pattern1b) { if (pattern1b) {
for (int i = 0; i < 0x100; i++) for (int i = 0; i < 0x100; i++)
memset(keyList[i], i, 16); memset(keyList[i], i, 16);
keyListLen = 0x100; keyListLen = 0x100;
} }
// 2-byte pattern search mode // 2-byte pattern search mode
if (pattern2b) if (pattern2b)
Fill2bPattern(keyList, &keyListLen, &startPattern); Fill2bPattern(keyList, &keyListLen, &startPattern);
// dictionary mode // dictionary mode
size_t endFilePosition = 0; size_t endFilePosition = 0;
if (dict_filenamelen) { if (dict_filenamelen) {
@ -874,7 +874,7 @@ static int CmdHFMFPChk(const char *cmd) {
for (int i = 0; i < g_mifare_plus_default_keys_len; i++) { for (int i = 0; i < g_mifare_plus_default_keys_len; i++) {
if (hex_to_bytes(g_mifare_plus_default_keys[i], keyList[keyListLen], 16) != 16) if (hex_to_bytes(g_mifare_plus_default_keys[i], keyList[keyListLen], 16) != 16)
break; break;
keyListLen++; keyListLen++;
} }
} }
@ -921,17 +921,17 @@ static int CmdHFMFPChk(const char *cmd) {
PrintAndLogEx(INFO, "|------|--------------------------------|--------------------------------|"); PrintAndLogEx(INFO, "|------|--------------------------------|--------------------------------|");
printedHeader = true; printedHeader = true;
} }
PrintAndLogEx(INFO, "| %02d |%32s|%32s|", PrintAndLogEx(INFO, "| %02d |%32s|%32s|",
sector, sector,
(foundKeys[0][sector][0] == 0) ? "------ " : sprint_hex_inrow(&foundKeys[0][sector][1], AES_KEY_LEN), (foundKeys[0][sector][0] == 0) ? "------ " : sprint_hex_inrow(&foundKeys[0][sector][1], AES_KEY_LEN),
(foundKeys[1][sector][0] == 0) ? "------ " : sprint_hex_inrow(&foundKeys[1][sector][1], AES_KEY_LEN)); (foundKeys[1][sector][0] == 0) ? "------ " : sprint_hex_inrow(&foundKeys[1][sector][1], AES_KEY_LEN));
} }
} }
if (!printedHeader) if (!printedHeader)
PrintAndLogEx(INFO, "No keys found("); PrintAndLogEx(INFO, "No keys found(");
else else
PrintAndLogEx(INFO, "'------'--------------------------------'--------------------------------'\n"); PrintAndLogEx(INFO, "'------'--------------------------------'--------------------------------'\n");
// save keys to json // save keys to json
if ((jsonnamelen > 0) && printedHeader) { if ((jsonnamelen > 0) && printedHeader) {
// Mifare Plus info // Mifare Plus info
@ -955,13 +955,13 @@ static int CmdHFMFPChk(const char *cmd) {
atslen = card.ats_len; atslen = card.ats_len;
data[13] = atslen; data[13] = atslen;
memcpy(&data[14], card.ats, atslen); memcpy(&data[14], card.ats, atslen);
} }
// length: UID(10b)+SAK(1b)+ATQA(2b)+ATSlen(1b)+ATS(atslen)+foundKeys[2][64][AES_KEY_LEN + 1] // length: UID(10b)+SAK(1b)+ATQA(2b)+ATSlen(1b)+ATS(atslen)+foundKeys[2][64][AES_KEY_LEN + 1]
memcpy(&data[14 + atslen], foundKeys, 2 * 64 * (AES_KEY_LEN + 1)); memcpy(&data[14 + atslen], foundKeys, 2 * 64 * (AES_KEY_LEN + 1));
saveFileJSON((char *)jsonname, jsfMfPlusKeys, data, 64); saveFileJSON((char *)jsonname, jsfMfPlusKeys, data, 64);
} }
return PM3_SUCCESS; return PM3_SUCCESS;
} }

View file

@ -751,17 +751,17 @@ int loadFileDICTIONARY(const char *preferredName, void *data, size_t *datalen, u
if (keylen != 4 && keylen != 6 && keylen != 8 && keylen != 16) { if (keylen != 4 && keylen != 6 && keylen != 8 && keylen != 16) {
keylen = 6; keylen = 6;
} }
return loadFileDICTIONARYEx(preferredName, data, 0, datalen, keylen, keycnt, 0, NULL, true); return loadFileDICTIONARYEx(preferredName, data, 0, datalen, keylen, keycnt, 0, NULL, true);
} }
int loadFileDICTIONARYEx(const char *preferredName, void *data, size_t maxdatalen, size_t *datalen, uint8_t keylen, uint16_t *keycnt, int loadFileDICTIONARYEx(const char *preferredName, void *data, size_t maxdatalen, size_t *datalen, uint8_t keylen, uint16_t *keycnt,
size_t startFilePosition, size_t *endFilePosition, bool verbose) { size_t startFilePosition, size_t *endFilePosition, bool verbose) {
if (endFilePosition) if (endFilePosition)
*endFilePosition = 0; *endFilePosition = 0;
if (data == NULL) return PM3_EINVARG; if (data == NULL) return PM3_EINVARG;
uint16_t vkeycnt = 0; uint16_t vkeycnt = 0;
char *path; char *path;
if (searchFile(&path, DICTIONARIES_SUBDIR, preferredName, ".dic", false) != PM3_SUCCESS) if (searchFile(&path, DICTIONARIES_SUBDIR, preferredName, ".dic", false) != PM3_SUCCESS)
return PM3_EFILE; return PM3_EFILE;
@ -780,10 +780,10 @@ int loadFileDICTIONARYEx(const char *preferredName, void *data, size_t maxdatale
retval = PM3_EFILE; retval = PM3_EFILE;
goto out; goto out;
} }
if (startFilePosition) if (startFilePosition)
fseek(f, startFilePosition, SEEK_SET); fseek(f, startFilePosition, SEEK_SET);
// read file // read file
while (!feof(f)) { while (!feof(f)) {
size_t filepos = ftell(f); size_t filepos = ftell(f);
@ -791,8 +791,8 @@ int loadFileDICTIONARYEx(const char *preferredName, void *data, size_t maxdatale
if (endFilePosition) if (endFilePosition)
*endFilePosition = 0; *endFilePosition = 0;
break; break;
} }
// add null terminator // add null terminator
line[keylen] = 0; line[keylen] = 0;
@ -814,10 +814,10 @@ int loadFileDICTIONARYEx(const char *preferredName, void *data, size_t maxdatale
*endFilePosition = filepos; *endFilePosition = filepos;
break; break;
} }
if (hex_to_bytes(line, data + counter, keylen >> 1) != (keylen >> 1)) if (hex_to_bytes(line, data + counter, keylen >> 1) != (keylen >> 1))
continue; continue;
vkeycnt++; vkeycnt++;
memset(line, 0, sizeof(line)); memset(line, 0, sizeof(line));
counter += (keylen >> 1); counter += (keylen >> 1);

View file

@ -199,8 +199,8 @@ int loadFileDICTIONARY(const char *preferredName, void *data, size_t *datalen, u
* @param verbose print messages if true * @param verbose print messages if true
* @return 0 for ok, 1 for failz * @return 0 for ok, 1 for failz
*/ */
int loadFileDICTIONARYEx(const char *preferredName, void *data, size_t maxdatalen, size_t *datalen, uint8_t keylen, uint16_t *keycnt, int loadFileDICTIONARYEx(const char *preferredName, void *data, size_t maxdatalen, size_t *datalen, uint8_t keylen, uint16_t *keycnt,
size_t startFilePosition, size_t *endFilePosition, bool verbose); size_t startFilePosition, size_t *endFilePosition, bool verbose);
/** /**
* @brief Utility function to load data safely from a DICTIONARY textfile. This method takes a preferred name. * @brief Utility function to load data safely from a DICTIONARY textfile. This method takes a preferred name.

View file

@ -175,7 +175,7 @@ int MifareAuth4(mf4Session *session, uint8_t *keyn, uint8_t *key, bool activateF
uint8_t RndA[17] = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x00}; uint8_t RndA[17] = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x00};
uint8_t RndB[17] = {0}; uint8_t RndB[17] = {0};
if (silentMode) if (silentMode)
verbose = false; verbose = false;
if (session) if (session)