chg: 'hf mf chk' - let eload part benefit for fast push mode

chg: 'script run mfkeys' -  corrected to use NG frames correct

client/cmdhfmf.c

@@ -1932,7 +1932,7 @@ static int CmdHF14AMfChk(const char *Cmd) {
 
 
     uint8_t trgKeyType = 0;
-    uint32_t max_keys = keycnt > ((PM3_CMD_DATA_SIZE - 4) / 6) ? ((PM3_CMD_DATA_SIZE - 4) / 6) : keycnt;
+    uint16_t max_keys = keycnt > ((PM3_CMD_DATA_SIZE - 4) / 6) ? ((PM3_CMD_DATA_SIZE - 4) / 6) : keycnt;
 
     // time
     uint64_t t1 = msclock();
@@ -1949,7 +1949,7 @@ static int CmdHF14AMfChk(const char *Cmd) {
             // skip already found keys.
             if (e_sector[i].foundKey[trgKeyType]) continue;
 
-            for (uint32_t c = 0; c < keycnt; c += max_keys) {
+            for (uint16_t c = 0; c < keycnt; c += max_keys) {
 
                 printf(".");
                 fflush(stdout);
@@ -1960,15 +1960,13 @@ static int CmdHF14AMfChk(const char *Cmd) {
                     goto out;
                 }
 
-                uint32_t size = keycnt - c > max_keys ? max_keys : keycnt - c;
+                uint16_t size = keycnt - c > max_keys ? max_keys : keycnt - c;
 
                 if (mfCheckKeys(b, trgKeyType, true, size, &keyBlock[6 * c], &key64) == PM3_SUCCESS) {
                     e_sector[i].Key[trgKeyType] = key64;
                     e_sector[i].foundKey[trgKeyType] = true;
                     break;
                 }
-
-
             }
             b < 127 ? (b += 4) : (b += 16);
         }
@@ -2011,11 +2009,6 @@ static int CmdHF14AMfChk(const char *Cmd) {
     }
 
 out:
-    // Disable fast mode and send a dummy command to make it effective
-    conn.block_after_ACK = false;
-    SendCommandMIX(CMD_PING, 0, 0, 0, NULL, 0);
-    WaitForResponseTimeout(CMD_ACK, NULL, 1000);
-
     //print keys
     printKeyTable(SectorsCnt, e_sector);
 
@@ -2032,6 +2025,12 @@ out:
         PrintAndLogEx(SUCCESS, "Found keys have been transferred to the emulator memory");
     }
 
+    // Disable fast mode and send a dummy command to make it effective
+    conn.block_after_ACK = false;
+    SendCommandMIX(CMD_PING, 0, 0, 0, NULL, 0);
+    WaitForResponseTimeout(CMD_ACK, NULL, 1000);
+    
+    
     if (createDumpFile) {
         fptr = GenerateFilename("hf-mf-", "-key.bin");
         if (fptr == NULL) {

client/lualibs/commands.lua

@@ -117,22 +117,6 @@ function Command:getBytes()
     return bin.pack("LLLLH",cmd, arg1, arg2, arg3, data);
 end
 
-function Command:__responsetostring()
-    print('NG package received')
-    print('CMD    ::', _commands.tostring(self.resp_cmd))
-    print('Length ::', tostring(self.resp_length))
-    print('Magic  ::', string.format("0x%08X", self.resp_magic), util.ConvertHexToAscii(string.format("0x%08X", self.resp_magic)))
-    print('Status ::', tostring(self.resp_status))
-    print('crc    ::', string.format("0x%02X", self.resp_crc))
-    print('Args   ::', ("(%s, %s, %s)\r\n"):format(
-                    tostring(self.resp_arg1),
-                    tostring(self.resp_arg2),
-                    tostring(self.resp_arg3)))
-    print('NG     ::', self.resp_ng)
-    print('Data   ::', self.resp_data)
-end
-
-
 --- Sends a packet to the device
 -- @param command - the usb packet to send
 -- @param ignoreresponse - if set to true, we don't read the device answer packet
@@ -177,13 +161,21 @@ function Command:sendMIX( ignore_response, timeout )
 --]]
 
     local packed = bin.pack("LLLLH", cmd, arg1, arg2, arg3, data)
+    --[[
+    return { Cmd = cmd,
+            Arg1 = arg1,
+            Arg2 = arg2,
+            Arg3 = arg3,
+            Data = data,
+    }
+    --]]
     return packed, nil;
 end
 function Command:sendNG( ignore_response, timeout )
     local data = self.data
     local cmd = self.cmd
     local err, msg = core.SendCommandNG(cmd, data)
-    if err == nil then return err, msg end
+    if err == nil then return nil, msg end
 
     if ignore_response then return true, nil end
 
@@ -193,28 +185,36 @@ function Command:sendNG( ignore_response, timeout )
     if response == nil then
         return nil, 'Error, waiting for response timed out :: '..msg
     end
+    local data
+    local count, cmd, length, magic, status, crc, arg0, arg1, arg2 = bin.unpack('SSIsSLLL', response)
+    count, data, ng = bin.unpack('H'..length..'C', response, count)
 
 --[[  uncomment if you want to debug
 
-    -- lets digest response NG package.
-    local data
-    local count, cmd, length, magic, status, crc, arg1, arg2, arg3 = bin.unpack('SSIsSLLL', response)
-    count, data, ng = bin.unpack('H'..length..'C', response, count)
-
-    self.resp_cmd = cmd
-    self.resp_length = length
-    self.resp_magic = magic
-    self.resp_status = status
-    self.resp_crc = crc
-    self.resp_arg1 = arg1
-    self.resp_arg2 = arg2
-    self.resp_arg3 = arg3
-    self.resp_data = data
-    self.resp_ng = ng
-    self:__responsetostring()
+    print('NG package received')
+    print('CMD    ::', tostring(cmd))
+    print('Length ::', tostring(length))
+    print('Magic  ::', string.format("0x%08X", magic), util.ConvertHexToAscii(string.format("0x%08X", magic)))
+    print('Status ::', tostring(status))
+    print('crc    ::', string.format("0x%02X", crc))
+    print('Args   ::', ("(%s, %s, %s)\r\n"):format(
+                    tostring(arg0),
+                    tostring(arg1),
+                    tostring(arg2)))
+    print('NG     ::', ng)
+    print('Data   ::', data)
 --]]
-
-    return response
+    return { Cmd = cmd,
+            Length = length,
+            Magic = magic,
+            Status = status,
+            Crc = crc,
+            Oldarg0 = arg0,
+            Oldarg1 = arg1,
+            Oldarg2 = arg2,
+            Data = data,
+            Ng = ng
+    }
 end
 
 return _commands

client/scripts/mfkeys.lua

@@ -58,15 +58,14 @@ local function checkCommand(response)
         return nil, "Timeout while waiting for device to respond"
     end
 
-    local data
-    local count, cmd, length, magic, status, crc, arg1, arg2, arg3 = bin.unpack('SSIsSLLL', response)
-    count, data, ng = bin.unpack('H'..length..'C', response, count)
-
-    if status == PM3_SUCCESS then
-        key = data:sub(1, 12)
-        return key
+    if response.Status == PM3_SUCCESS then
+        --decode data array
+        key = response.Data:sub(1, 12)
+        found = tonumber(response.Data:sub(13,14))
+        if found == 1 then
+            return key
+        end
     end
-
     return nil
 end
 
@@ -76,8 +75,6 @@ local function checkBlock(blockno, testkeys, keytype)
     -- each key is 6 bytes,
     -- NG args inside dataarray is 4 bytes.  That give us (512-4)/6 or max 84 keys in one go.
     -- If there's more, we need to split it up
-    local arg1 = bit32.bor(bit32.lshift(keytype, 8), blockno)
-    local arg2 = '00' -- don't clear trace
     local start, remaining = 1, #testkeys
     local maxchunk = math.floor((512-4)/6)
     local chunksize = remaining
@@ -85,9 +82,8 @@ local function checkBlock(blockno, testkeys, keytype)
     local n = chunksize
 
     while remaining > 0 do
---        print('start', start, 'chunksize', chunksize, 'testkeys kvar', remaining, 'N-index=', n)
 
-        local d0 = ('%04X%02X%02X'):format(arg1, arg2, chunksize)
+        local d0 = ('%02X%02X00%02X'):format(keytype, blockno, chunksize)
         local d1 = table.concat(testkeys, "", start, n)
 
         core.clearCommandBuffer()
@@ -95,7 +91,7 @@ local function checkBlock(blockno, testkeys, keytype)
         print(("Testing block %d, keytype %d, with %d keys"):format(blockno, keytype, chunksize))
 
         local c = Command:newNG{cmd = cmds.CMD_MIFARE_CHKKEYS, data = d0..d1}
-        key, err = checkCommand(c:sendNG(false, TIMEOUT))
+        key, err = checkCommand(c:sendNG(false))
 
         if key then return key, blockno end