Supercard keys recovery from second generation card

CHANGELOG.md

@@ -3,7 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
- - Changed `hf mf supercard` - Support editing UID (@AloneLiberty)
+ - Changed `hf mf supercard` - Support editing UID and recovery of keys from second generation card (@AloneLiberty)
  - Added `hf mf gdmsetblk` - Support Gen4 GDM write block (@iceman1001)
  - Changed `hf 14a info` - detect Gen GDM magic tags (@iceman1001) 
  - Changed CLI max string argument length limit from 512 to 4096 (@iceman1001)

client/src/cmdhfmf.c

@@ -6568,7 +6568,6 @@ static int CmdHf14AGen3Freeze(const char *Cmd) {
 }
 
 static int CmdHf14AMfSuperCard(const char *Cmd) {
-
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf mf supercard",
                   "Extract info from a `super card`",
@@ -6594,14 +6593,84 @@ static int CmdHf14AMfSuperCard(const char *Cmd) {
         return PM3_EINVARG;
     }
 
-    bool activate_field = true;
+    uint32_t trace = 0;
-    bool keep_field_on = true;
+    uint8_t traces[7][16];
-    int res = 0;
+    for (trace = 0; trace < 7; trace++) {
+        uint8_t data[] = {0x30, 0x00 + trace};
+        uint32_t flags = ISO14A_CONNECT | ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_RATS;
 
+        clearCommandBuffer();
+        SendCommandOLD(CMD_HF_ISO14443A_READER, flags, sizeof(data), 0, data, sizeof(data));
+
+        if (!WaitForResponseTimeout(CMD_ACK, NULL, 1500)) {
+            break; // Select card
+        }
+
+        PacketResponseNG resp;
+        if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
+            break; // Data not received
+        }
+
+        uint16_t len = resp.oldarg[0] & 0xFFFF;
+        if (len != 18) {
+            break; // Not trace data
+        }
+
+        memcpy(&traces[trace], resp.data.asBytes, len - 2);
+    }
+
+    if (trace == 7) {
+        if (uidlen || reset_card) {
+            PrintAndLogEx(FAILED, "Not supported on this card");
+            return PM3_SUCCESS;
+        }
+
+        for (trace = 0; trace < 7; trace++) {
+            uint8_t *trace_data = traces[trace];
+            nonces_t data;
+
+            // first
+            uint16_t NT0 = (trace_data[6] << 8) | trace_data[7];
+            data.cuid = bytes_to_num(trace_data, 4);
+            data.nonce = prng_successor(NT0, 31);
+            data.nr = bytes_to_num(trace_data + 8, 4);
+            data.ar = bytes_to_num(trace_data + 12, 4);
+            data.at = 0;
+
+            // second
+            for (uint8_t s_strace = trace + 1; s_strace < 7; s_strace++) {
+                uint8_t *s_trace_data = traces[s_strace];
+                if (mfSectorNum(s_trace_data[5]) == mfSectorNum(trace_data[5])) {
+                    NT0 = (s_trace_data[6] << 8) | s_trace_data[7];
+                    data.nonce2 = prng_successor(NT0, 31);
+                    data.nr2 = bytes_to_num(s_trace_data + 8, 4);
+                    data.ar2 = bytes_to_num(s_trace_data + 12, 4);
+                    data.sector = mfSectorNum(trace_data[5]);
+                    data.keytype = trace_data[4];
+                    data.state = FIRST;
+
+                    uint64_t key64 = -1;
+                    int res = mfkey32_moebius(&data, &key64);
+
+                    if (res) {
+                        PrintAndLogEx(SUCCESS, "UID: %s Sector %02x key %c [ "
+                        _GREEN_("%012"
+                        PRIX64) " ]", sprint_hex_inrow(trace_data, 4), data.sector, (data.keytype == 0x60) ? 'A'
+                                                                                                           : 'B', key64);
+                        break;
+                    }
+                }
+            }
+        }
+    } else {
         // Commands:
         // a0 - set UID
         // b0 - read traces
         // c0 - clear card
+
+        bool activate_field = true;
+        bool keep_field_on = true;
+        int res = 0;
         if (uidlen) {
             keep_field_on = false;
             uint8_t response[6];
@@ -6610,14 +6679,19 @@ static int CmdHf14AMfSuperCard(const char *Cmd) {
             // --------------- CHANGE UID ----------------
             uint8_t aCHANGE[] = {0x00, 0xa6, 0xa0, 0x00, 0x05, 0xff, 0xff, 0xff, 0xff, 0x00};
             memcpy(aCHANGE + 5, uid, uidlen);
-        res = ExchangeAPDU14a(aCHANGE, sizeof(aCHANGE), activate_field, keep_field_on, response, sizeof(response), &resplen);
+            res = ExchangeAPDU14a(aCHANGE, sizeof(aCHANGE), activate_field, keep_field_on, response, sizeof(response),
+                                  &resplen);
             if (res != PM3_SUCCESS) {
-            PrintAndLogEx(FAILED, "Super card UID change [ " _RED_("fail") " ]");
+                PrintAndLogEx(FAILED, "Super card UID change [ "
+                _RED_("fail")
+                " ]");
                 DropField();
                 return res;
             }
 
-        PrintAndLogEx(SUCCESS, "Super card UID change ( " _GREEN_("ok") " )");
+            PrintAndLogEx(SUCCESS, "Super card UID change ( "
+            _GREEN_("ok")
+            " )");
             return PM3_SUCCESS;
         }
 
@@ -6628,13 +6702,18 @@ static int CmdHf14AMfSuperCard(const char *Cmd) {
 
             // --------------- RESET CARD ----------------
             uint8_t aRESET[] = {0x00, 0xa6, 0xc0, 0x00};
-        res = ExchangeAPDU14a(aRESET, sizeof(aRESET), activate_field, keep_field_on, response, sizeof(response), &resplen);
+            res = ExchangeAPDU14a(aRESET, sizeof(aRESET), activate_field, keep_field_on, response, sizeof(response),
+                                  &resplen);
             if (res != PM3_SUCCESS) {
-            PrintAndLogEx(FAILED, "Super card reset [ " _RED_("fail") " ]");
+                PrintAndLogEx(FAILED, "Super card reset [ "
+                _RED_("fail")
+                " ]");
                 DropField();
                 return res;
             }
-        PrintAndLogEx(SUCCESS, "Super card reset ( " _GREEN_("ok") " )");
+            PrintAndLogEx(SUCCESS, "Super card reset ( "
+            _GREEN_("ok")
+            " )");
             return PM3_SUCCESS;
         }
 
@@ -6646,7 +6725,8 @@ static int CmdHf14AMfSuperCard(const char *Cmd) {
 
         // --------------- First ----------------
         uint8_t aFIRST[] = {0x00, 0xa6, 0xb0, 0x00, 0x10};
-    res = ExchangeAPDU14a(aFIRST, sizeof(aFIRST), activate_field, keep_field_on, responseA, sizeof(responseA), &respAlen);
+        res = ExchangeAPDU14a(aFIRST, sizeof(aFIRST), activate_field, keep_field_on, responseA, sizeof(responseA),
+                              &respAlen);
         if (res != PM3_SUCCESS) {
             DropField();
             return res;
@@ -6657,7 +6737,8 @@ static int CmdHf14AMfSuperCard(const char *Cmd) {
         keep_field_on = false;
 
         uint8_t aSECOND[] = {0x00, 0xa6, 0xb0, 0x01, 0x10};
-    res = ExchangeAPDU14a(aSECOND, sizeof(aSECOND), activate_field, keep_field_on, responseB, sizeof(responseB), &respBlen);
+        res = ExchangeAPDU14a(aSECOND, sizeof(aSECOND), activate_field, keep_field_on, responseB, sizeof(responseB),
+                              &respBlen);
         if (res != PM3_SUCCESS) {
             DropField();
             return res;
@@ -6720,7 +6801,9 @@ static int CmdHf14AMfSuperCard(const char *Cmd) {
         res = mfkey32_moebius(&data, &key64);
 
         if (res) {
-        PrintAndLogEx(SUCCESS, "UID: %s Sector %02x key %c [ " _GREEN_("%12" PRIX64) " ]"
+            PrintAndLogEx(SUCCESS, "UID: %s Sector %02x key %c [ "
+            _GREEN_("%12"
+            PRIX64) " ]"
                     , sprint_hex_inrow(outA, 4)
                     , data.sector
                     , (data.keytype == 0x60) ? 'A' : 'B'
@@ -6728,6 +6811,7 @@ static int CmdHf14AMfSuperCard(const char *Cmd) {
         } else {
             PrintAndLogEx(FAILED, "failed to recover any key");
         }
+    }
     return PM3_SUCCESS;
 }