github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-07-16 10:03:04 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions
5302 commits 3 branches 17 tags 104 MiB
Commit graph

324 commits

Author SHA1 Message Date
iceman1001
2a4685312a chg: (merlokk) debugstatements 2017-07-31 13:50:55 +02:00
iceman1001
83cd6a7761 CHG: 'hf mf nested' - (merlokk) 76fcccd109 
CHG: 'hf mf hardnested' added same verification also here.
 2017-07-31 13:37:41 +02:00
iceman1001
f28da2da6e monster merge... 
all those changes marshmellow did..  and more...
 2017-07-30 09:17:48 +02:00
iceman1001
3d53f941aa some time_t issues 2017-07-28 01:35:49 +02:00
iceman1001
a8569849d6 part of monstermerge.. 2017-07-27 20:58:59 +02:00
iceman1001
e8015142cd fix: TRUE/FALSE -> bools 
fix: 'iclass'  filepath 255, to use FILE_PATH_SIZE
fix: unified params test
 2017-07-14 20:54:11 +02:00
iceman1001
7cf0bf19e5 FIX: 'mfu authentication' bug where the pack-length was wrong 
ADD: 'hf mfu restore'  - added a restore from file command, see helptext for instructions
CHG: some help-text updates and refactored to functions
CHG: 'hf mfu gen'  - added the possibility to read uid from card as input
CHG: 'hf mfu dump' - refactored out the dump-printing
 2017-07-13 13:10:46 +02:00
iceman1001
310d0da9a4 fixes.. to bool 2017-07-11 18:31:10 +02:00
iceman1001
1f9534e2cc CHG: broke out some help texts and improved them. 
CHG: 'hf mf csave' now save mini,1k,2k,4k and to both a bin and eml file.
 2017-07-11 17:45:23 +02:00
iceman1001
3ca3d401c0 FIX: some adjustments to prng detection 2017-07-04 20:11:25 +02:00
Iceman
08cc2c36d8 fix: 'hf mf chk' 
Dictionary files will load wrong if they exceed 256lines.
 2017-04-26 19:52:03 +02:00
angelsl
ece631fd06 Add Mifare Classic EV1 set load modulation command 2017-03-09 21:37:16 +08:00
iceman1001
be67483e63 syntax sugar 2017-03-09 11:19:30 +01:00
iceman1001
57778a4630 CHG: renamed struct sector -> sector_t 
CHG: defines on armside
CHG: #define WIN32 ->  _WIN32
CHG: started to enhance "hf mf chkkeys"
REM: removed some duplicates etc in default keys.
 2017-03-06 19:11:08 +01:00
iceman1001
a9eeb57698 CHG: Added PR #220 from PM3 Master. ref: https://github.com/Proxmark/proxmark3/pull/220 2017-03-01 20:14:46 +01:00
iceman1001
5215a87442 CHG: @Marshmellow42 's fixes. ref: e88096ba25 2017-02-24 01:14:47 +01:00
iceman1001
9c624f67b3 chg: @piwi's code cleanup and some more. 
ref: 43534cbad2
 2017-02-23 00:03:10 +01:00
iceman1001
84bdbc1917 FIX: 'hf 14a sim x' - adjusted and shows messages when verbose. 
FIX: 'hf mf sim x i' - same as above.

In general we only use Moebius attack for "sim x",  that means a clean up on device side code. simpler to understand. It still tries to gather 8 different collections of nonces combo. When one is complete, it get sent to client which runs moebius direct.
 2017-01-29 23:09:23 +01:00
iceman1001
2ce218042d CHG: 'hf 14a sim e' - it now has a parameter for setfoundkeys to emulator memory. 
CHG: textual changes.
 2017-01-29 13:21:17 +01:00
iceman1001
7e735c1398 FIX: 'hf 14a sim x' - this fixes the error with using moebius attack and sim. Updating the nonce variable doesn't change the premodulated response. And it should update everytime it gets a command. One concering issue is that this takes time. Successfully works with two PM3. One acting reader, another sim. 2017-01-29 11:29:15 +01:00
iceman1001
e108a48ac4 ADD: added the 'hf mf hardnested' to be called within LUA scripts. 
ADD: 'script run hard' - a first try for a lua script to run the hardnested attack on a complete tag.
 2016-11-21 16:08:12 +01:00
iceman1001
2618e313bf CHG: textual change 2016-11-16 17:45:12 +01:00
iceman1001
60c33f7aa8 CHG: minor textual change to fit the minimum two calls nature for the zero parity attack 2016-10-29 21:45:36 +02:00
iceman1001
19693bdc06 FIX: 'hf mf mifare' - special zero parity attack vector now works. Thanks to the dude who figured this vector out: @douniwan5788 (sorry for comments, I was clearly wrong.) @piwi - for proving me wrong. 
this version uses int64_t  (signed)  to signify end-of-lists (-1). It also needs its own compare function for the qsort.  I didn't merge this into existing code which uses uint64_t. (too lazy)
 2016-10-29 21:41:02 +02:00
iceman1001
ba39db376c CHG: just some parameter / variable name changes. Nuttin' special. 2016-10-28 16:37:01 +02:00
Michael Farrell
32beef538e hf {14a,mf} sim: v is for verbose 2016-10-27 23:37:00 +11:00
Michael Farrell
dfdbfa0702 hf mf sim: Be less verbose by default, add option "m" to turn maths back on (Issue #45) 2016-10-27 23:37:00 +11:00
Michael Farrell
b6e05350b2 hf mf sim: Multiple fixes (iceman1001/proxmark3 #45) 
- Fix `hf mf sim` to use nonce_t structures, so key recovery works
- Increases verbosity on the key recovery functionality
- Fix use-after-free for k_sector
- Add help info on `e` option to `hf mf sim`
 2016-10-22 21:53:53 +11:00
iceman1001
2dcf60f3df CHG: "hf mf hardnested" - less printing 
CHG: some filehandles = NULL.
 2016-10-21 16:06:53 +02:00
iceman1001
f885043422 FIX: "hf 14a read" / "hf mf *" / "hf mfdes info" and failure when calling these commands serveral times in row. 
For long transactions the sspclock compare with >1 instead of >=1 ..   Now the timer resets properly.
CHG: use some #define constants for iso-commands.
 2016-09-23 21:28:07 +02:00
iceman1001
5b4664e79f CHG: Adding clarity to the command helptext. 2016-09-01 20:36:42 +02:00
iceman1001
ba1324a5fe some text changes. 2016-08-24 14:58:50 +02:00
iceman1001
760157f50b CHG: added a verification to see if the found candidate key was able to validate against tag. If not ok, start darkside attack again. 2016-08-24 14:10:30 +02:00
iceman1001
6067df30c5 FIX: at least now the special zero parity attack, repeats and doesn't crash. However it doesn't find the key either :( 2016-08-10 10:55:29 +02:00
iceman1001
59e933fc3f started fixing the paritiy == 0 special attack against chinese clones with bad prng, which hasnt been working for ages. 2016-08-09 23:11:07 +02:00
iceman1001
d9ed4e1914 ADD: J-Run's 2nd phase tool mf_key_brute ref: https://github.com/J-Run/mf_key_brute Estimated time to search keyspace is ~18min. 
J_Run's 2nd phase of multiple sector nested authentication key recovery
You have a known 4 last bytes of a key recovered with mf_nonce_brute tool.
First 2 bytes of key will be bruteforced

Usage:  hf mf keybrute [h] <block number> <A|B> <key>
options:
      h               this help
      <block number>  target block number
      <A|B>           target key type
      <key>           candidate key from mf_nonce_brute tool
samples:
           hf mf keybrute 1 A 000011223344
 2016-08-08 17:49:30 +02:00
Alexis Green
170e7c9c51 FIX: erroneous semicolon 2016-08-07 20:07:25 -07:00
iceman1001
df007486f5 ADD: @donwan581 select keytype for the darkside attack. 2016-08-04 21:51:26 +02:00
iceman1001
2fdc489bb4 CHG: printing of progress dots is better now. 2016-05-19 12:47:23 +02:00
iceman1001
ea1ee62e55 CHG: better helptext 2016-04-29 22:24:08 +02:00
iceman1001
222bdb1cb3 Syntax suger 2016-04-24 21:43:38 +02:00
iceman1001
cd777a0545 FIX: Some Coverity Scan warnings. fread, not initialised etc etc 2016-04-23 18:23:46 +02:00
iceman1001
be6e909c5b FIX: time printing, like difftime in MINGW enviroments needs to use 32b time. 2016-04-23 13:02:20 +02:00
iceman1001
9ea10847ea CHG: timeing in chk keys, 2016-04-23 12:26:29 +02:00
iceman1001
fa0e0b109f CHG: moved out some usage_methods for help texts. 
CHG: added some time in the darkside, nested, hardnested, chk commands.
 2016-04-23 12:18:34 +02:00
iceman1001
5dc8b8fe27 CHG: unified some text messaged. 2016-04-23 11:43:02 +02:00
iceman1001
d948e0d140 CHG: 'hf mf chk' now correctly tests to read key B, when we specify target keytype B or ?. 
CHG: 'hf mf chk'  now correctly init all sector keys to 0xFFFFFFFFFFFF,  so it looks unified.
 2016-04-23 11:32:37 +02:00
iceman1001
6c84c90017 FIX: this fixes the "hf mf sniff l d f" command, which has been broken for a while. The cuid is correct used for decrypting. 
FIX: The flushing of logentries.
ADD: "hf mf sniff" - added the sniffing of UID's with a uidlen of 10.

Whats left? The key is not always found even if we use the "mfkey64" approach.

ADD: added the parity_zero attack in "hf mf mifare".  Still not working since piwi's changes to the iso14443a.c,  maybe needs a param to tell it to collect nonces for this special attack.
CHG: extracted some help-texts into usage_* methods. Changed some text as well

FIX:  "hf mf sim" command now uses both  mfkey32 and mfkey32_moebius version to find the key in attack mode.
CHG:  "hf mf sim" also now defaults to emul_memory to read a 4 byte UID.
 2016-04-18 13:18:02 +02:00
iceman1001
0194ce8fc8 ADD: simulating can now handle triplesized UID (10b) 
CHG: moved some mifare #DEFINES into protocols.h  (ACK,NACK..)
 2016-04-14 11:09:17 +02:00
iceman1001
2daa0d0b1e CHG: doesnt flush the printf() calls 2016-04-10 13:34:27 +02:00