ADD: added the 'hf mf hardnested' to be called within LUA scripts.

ADD: 'script run hard' - a first try for a lua script to run the hardnested attack on a complete tag.

client/cmdhfmf.c

@@ -1057,7 +1057,8 @@ int CmdHF14AMfNestedHard(const char *Cmd) {
 			slow ? "Yes" : "No",
 			tests);
 
-	int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key ? trgkey : NULL, nonce_file_read, nonce_file_write, slow, tests);
+	uint64_t foundkey = 0;
+	int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key ? trgkey : NULL, nonce_file_read, nonce_file_write, slow, tests, &foundkey);
 
 	if (isOK) {
 		switch (isOK) {

client/cmdhfmfhard.c

@@ -777,6 +777,7 @@ static int acquire_nonces(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_
 	uint32_t next_fivehundred = 500;
 	uint32_t total_added_nonces = 0;
 	uint32_t idx = 1;
+	uint32_t timeout  = 0;
 	FILE *fnonces = NULL;
 	field_off = false;
 	UsbCommand resp;
@@ -799,10 +800,15 @@ static int acquire_nonces(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_
 		
 		if (field_off) break;
 
-		if (!WaitForResponseTimeout(CMD_ACK, &resp, 6000)) {
+		while(!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
-			if (fnonces) fclose(fnonces);
+			timeout++;
-			return 1;
+			printf(".");
-		}
+			if (timeout > 7) {
+				PrintAndLog("\nNo response from Proxmark. Aborting...");
+				if (fnonces) fclose(fnonces);
+				return 1;
+			}
+		}		
 
 		if (resp.arg[0]) {
 			if (fnonces) fclose(fnonces);
@@ -1723,12 +1729,14 @@ static bool brute_force(void) {
 	return ret;
 }
 
-int mfnestedhard(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *trgkey, bool nonce_file_read, bool nonce_file_write, bool slow, int tests) 
+int mfnestedhard(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *trgkey, bool nonce_file_read, bool nonce_file_write, bool slow, int tests, uint64_t *found_key) 
 {
 	// initialize Random number generator
 	time_t t;
 	srand((unsigned) time(&t));
 	
+	*found_key = 0;
+	
 	if (trgkey != NULL) {
 		known_target_key = bytes_to_num(trgkey, 6);
 	} else {
@@ -1790,5 +1798,6 @@ int mfnestedhard(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBloc
 		free_candidates_memory(candidates);
 		candidates = NULL;
 	}
+	*found_key = foundkey;
 	return 0;
-}
+}

client/cmdhfmfhard.h

@@ -31,6 +31,6 @@
 #endif
 #include <assert.h>
 
-int mfnestedhard(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *trgkey, bool nonce_file_read, bool nonce_file_write, bool slow, int tests);
+int mfnestedhard(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *trgkey, bool nonce_file_read, bool nonce_file_write, bool slow, int tests, uint64_t *foundkey);
 
 #endif

client/scripting.c

@@ -463,6 +463,79 @@ static int l_reveng_RunModel(lua_State *L){
 	return 1;
 }
 
+static int l_hardnested(lua_State *L){
+
+	bool haveTarget = TRUE;
+    size_t size;
+    const char *p_blockno = luaL_checklstring(L, 1, &size);
+    if(size != 2)  return returnToLuaWithError(L,"Wrong size of blockNo, got %d bytes, expected 2", (int) size);
+
+    const char *p_keytype = luaL_checklstring(L, 2, &size);
+    if(size != 1)  return returnToLuaWithError(L,"Wrong size of keyType, got %d bytes, expected 1", (int) size);
+
+	const char *p_key = luaL_checklstring(L, 3, &size);
+    if(size != 12)  return returnToLuaWithError(L,"Wrong size of key, got %d bytes, expected 12", (int) size);
+	
+    const char *p_trg_blockno = luaL_checklstring(L, 4, &size);
+    if(size != 2)  return returnToLuaWithError(L,"Wrong size of trgBlockNo, got %d bytes, expected 2", (int) size);
+
+    const char *p_trg_keytype = luaL_checklstring(L, 5, &size);
+    if(size != 1)  return returnToLuaWithError(L,"Wrong size of trgKeyType, got %d bytes, expected 1", (int) size);
+
+    const char *p_trgkey = luaL_checklstring(L, 6, &size);
+    if(size != 12)
+		haveTarget = FALSE;
+
+	const char *p_nonce_file_read = luaL_checklstring(L, 7, &size);
+    if(size != 1)  return returnToLuaWithError(L,"Wrong size of nonce_file_read, got %d bytes, expected 1", (int) size);
+
+	const char *p_nonce_file_write = luaL_checklstring(L, 8, &size);
+    if(size != 1)  return returnToLuaWithError(L,"Wrong size of nonce_file_write, got %d bytes, expected 1", (int) size);
+
+	const char *p_slow = luaL_checklstring(L, 9, &size);
+    if(size != 1)  return returnToLuaWithError(L,"Wrong size of slow, got %d bytes, expected 1", (int) size);
+
+	const char *p_tests = luaL_checklstring(L, 10, &size);
+    if(size != 1)  return returnToLuaWithError(L,"Wrong size of tests, got %d bytes, expected 1", (int) size);
+	
+	uint32_t blockNo = 0, keyType = 0;
+	uint32_t trgBlockNo = 0, trgKeyType = 0;
+	uint32_t slow = 0, tests = 0;
+	uint32_t nonce_file_read = 0, nonce_file_write = 0;
+	
+    sscanf(p_blockno, "%02x", &blockNo);
+	sscanf(p_keytype, "%x", &keyType);
+    sscanf(p_trg_blockno, "%02x", &trgBlockNo);
+	sscanf(p_trg_keytype, "%x", &trgKeyType);
+	sscanf(p_nonce_file_read, "%x", &nonce_file_read);
+	sscanf(p_nonce_file_write, "%x", &nonce_file_write);
+
+	sscanf(p_slow, "%x", &slow);
+	sscanf(p_tests, "%x", &tests);
+
+	uint8_t key[6] = {0,0,0,0,0,0};
+    uint8_t trgkey[6] = {0,0,0,0,0,0};
+	for (int i = 0; i < 32; i += 2) {
+		sscanf(&p_key[i], "%02x", (unsigned int *)&key[i / 2]);
+		if (haveTarget)
+			sscanf(&p_trgkey[i], "%02x", (unsigned int *)&trgkey[i / 2]);
+	}
+	
+    uint64_t foundkey = 0;
+	int retval = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, haveTarget ? trgkey : NULL, nonce_file_read,  nonce_file_write,  slow,  tests, &foundkey);
+
+    //Push the retval on the stack
+    lua_pushinteger(L,retval);
+
+    //Push the key onto the stack
+    uint8_t dest_key[6];
+    num_to_bytes(foundkey, sizeof(dest_key), dest_key);
+
+    //printf("Pushing to lua stack: %012"llx"\n",key);
+    lua_pushlstring(L, (const char *) dest_key, sizeof(dest_key));
+    return 2; //Two return values
+}
+
 /**
  * @brief Sets the lua path to include "./lualibs/?.lua", in order for a script to be
  * able to do "require('foobar')" if foobar.lua is within lualibs folder.
@@ -489,7 +562,6 @@ int setLuaPath( lua_State* L, const char* path )
 
 int set_pm3_libraries(lua_State *L)
 {
-
     static const luaL_Reg libs[] = {
         {"SendCommand",                 l_SendCommand},
         {"WaitForResponseTimeout",      l_WaitForResponseTimeout},
@@ -511,6 +583,7 @@ int set_pm3_libraries(lua_State *L)
 		{"sha1",						l_sha1},
 		{"reveng_models",				l_reveng_models},
 		{"reveng_runmodel",				l_reveng_RunModel},
+		{"hardnested",					l_hardnested},
         {NULL, NULL}
     };
 

client/scripting.h

@@ -26,6 +26,7 @@
 #include "../common/sha1.h"
 #include "aes.h"
 #include "cmdcrc.h"
+#include "cmdhfmfhard.h"
 
 /**
  * @brief set_libraries loads the core components of pm3 into the 'pm3'

client/scripts/hard.lua

@@ -0,0 +1,109 @@
+local cmds = require('commands')
+local getopt = require('getopt')
+local utils = require('utils')
+local lib14a = require('read14a')
+
+example = "script iterates over all possible sectors for a tag and runs hardnested attack against them to collect the keys."
+author = "Iceman"
+desc =
+[[
+This script iterates over all possible sectors for a tag and runs hardnested attack against them to collect the keys.
+
+Arguments:
+	-k 				Known key, 6 bytes (12 hex digits)
+Examples : 
+	script hard -b 112233445566
+]]
+
+local numBlocks = 64
+local numSectors = 16
+local DEBUG = TRUE
+--- 
+-- A debug printout-function
+function dbg(args)
+	if not DEBUG then return end
+	
+    if type(args) == "table" then
+		local i = 1
+		while result[i] do
+			dbg(result[i])
+			i = i+1
+		end
+	else
+		print("###", args)
+	end	
+end	
+--- 
+-- This is only meant to be used when errors occur
+function oops(err)
+	print("ERROR: ",err)
+	return nil,err
+end
+--- 
+-- Usage help
+function help()
+	print(desc)
+	print("Example usage")
+	print(example)
+end
+--
+-- Exit message
+function ExitMsg(msg)
+	print( string.rep('--',20) )
+	print( string.rep('--',20) )
+	print(msg)
+	print()
+end
+---
+-- a simple selftest function,
+local function selftest()
+	return nil
+end
+
+--- 
+-- The main entry point
+function main(args)
+
+	local blockno = '00'
+	local keytype = 0 --A  01==B
+	local key = 'fc00018778f7'
+	local trgkey = ''
+	
+	local data
+	-- Read the parameters
+	for o, a in getopt.getopt(args, 'hk:t') do
+		if o == "h" then return help() end
+		if o == "k" then key = a end
+		if o == "t" then return selftest() end
+	end
+
+	-- Turn off Debug
+	local cmdSetDbgOff = "hf mf dbg 0"
+	core.console( cmdSetDbgOff) 
+	-- identify tag
+	result, err = lib14a.read1443a(false)
+	if not result then
+		return oops(err)
+	end
+	core.clearCommandBuffer()
+	
+	-- Show tag info
+	print((' Found tag %s'):format(result.name))
+	
+	local keys = {}
+	-- loop
+	for i=4, 12	, 4 do
+		for trgkeytype=0,1 do
+			local trgblockno = ("%02d"):format(i)
+			local err, found_key = core.hardnested(blockno, keytype, key, trgblockno, trgkeytype, trgkey, 0,0,0,0)			
+			
+			table.insert( keys ,  { ["success"] = err, ["sector"] = i, ["type"] = trgkeytype, ["key"] =  utils.ConvertAsciiToHex(found_key) } )
+		end
+	end
+	--print
+	for k,v in pairs(keys) do 
+		for a,b in pairs(v) do print(a,b) end
+	end
+end
+
+main(args)