mirror of
https://github.com/Proxmark/proxmark3.git
synced 2025-07-06 21:21:17 -07:00
mf check keys in lua-space
This commit is contained in:
martin.holst@gmail.com
parent
c00f0dbfda
commit
16b04cb291
2 changed files with 296 additions and 0 deletions
153
client/mf_default_keys.lua
Normal file
153
client/mf_default_keys.lua
Normal file
|
|
@ -0,0 +1,153 @@
|
||||||
|
|
||||||
|
|
||||||
|
local _keys = {
|
||||||
|
|
||||||
|
--[[
|
||||||
|
|
||||||
|
These keys are from the pm3 c-codebase.
|
||||||
|
|
||||||
|
--]]
|
||||||
|
'fffffffffff0', -- Default key (first key used by program if no user defined key)
|
||||||
|
'000000000000', -- Blank key
|
||||||
|
'a0a1a2a3a4a5', -- NFCForum MAD key
|
||||||
|
'b0b1b2b3b4b5',
|
||||||
|
'aabbccddeeff',
|
||||||
|
'4d3a99c351dd',
|
||||||
|
'1a982c7e459a',
|
||||||
|
'd3f7d3f7d3f7',
|
||||||
|
'714c5c886e97',
|
||||||
|
'587ee5f9350f',
|
||||||
|
'a0478cc39091',
|
||||||
|
'533cb6c723f6',
|
||||||
|
'8fd0a4f256e9',
|
||||||
|
|
||||||
|
|
||||||
|
--[[
|
||||||
|
The data below is taken form the Slurp project,
|
||||||
|
https://github.com/4ZM/slurp/blob/master/res/xml/mifare_default_keys.xml
|
||||||
|
released as GPLV3.
|
||||||
|
|
||||||
|
--]]
|
||||||
|
|
||||||
|
'000000000000', -- Default key
|
||||||
|
'fffffffffff0', -- Default key
|
||||||
|
'b0b1b2b3b4b5', -- Key from mfoc
|
||||||
|
'4d3a99c351dd', -- Key from mfoc
|
||||||
|
'1a982c7e459a', -- Key from mfoc
|
||||||
|
'aabbccddeeff', -- Key from mfoc
|
||||||
|
'714c5c886e97', -- Key from mfoc
|
||||||
|
'587ee5f9350f', -- Key from mfoc
|
||||||
|
'a0478cc39091', -- Key from mfoc
|
||||||
|
'533cb6c723f6', -- Key from mfoc
|
||||||
|
'8fd0a4f256e9', -- Key from mfoc
|
||||||
|
-- Data from: http://pastebin.com/wcTHXLZZ
|
||||||
|
'a64598a77478', -- RKF SL Key A
|
||||||
|
'26940b21ff5d', -- RKF SL Key A
|
||||||
|
'fc00018778f7', -- RKF SL Key A
|
||||||
|
'00000ffe2488', -- RKF SL Key B
|
||||||
|
'5c598c9c58b5', -- RKF SL Key B
|
||||||
|
'e4d2770a89be', -- RKF SL Key B
|
||||||
|
-- Data from: http://pastebin.com/svGjN30Q
|
||||||
|
'434f4d4d4f41', -- RKF JOJO GROUP Key A
|
||||||
|
'434f4d4d4f42', -- RKF JOJO GROUP Key B
|
||||||
|
'47524f555041', -- RKF JOJO GROUP Key A
|
||||||
|
'47524f555042', -- RKF JOJO GROUP Key B
|
||||||
|
'505249564141', -- RKF JOJO PRIVA Key A
|
||||||
|
'505249564142', -- RKF JOJO PRIVA Key B
|
||||||
|
-- Data from: http://pastebin.com/d7sSetef
|
||||||
|
'fc00018778f7', -- RKF Rejskort Danmark Key A
|
||||||
|
'00000ffe2488', -- RKF Rejskort Danmark Key B
|
||||||
|
'0297927c0f77', -- RKF Rejskort Danmark Key A
|
||||||
|
'ee0042f88840', -- RKF Rejskort Danmark Key B
|
||||||
|
'722bfcc5375f', -- RKF Rejskort Danmark Key A
|
||||||
|
'f1d83f964314', -- RKF Rejskort Danmark Key B
|
||||||
|
-- Data from: http://pastebin.com/pvJX0xVS
|
||||||
|
'54726176656C', -- Transport Key A
|
||||||
|
'776974687573', -- Transport Key B
|
||||||
|
'4AF9D7ADEBE4', -- Directory and event log Key A
|
||||||
|
'2BA9621E0A36', -- Directory and event log Key B
|
||||||
|
-- Data from: http://pastebin.com/Dnnc5dFC
|
||||||
|
-- New cards are not encrypted (MF Ultralight)
|
||||||
|
'fc00018778f7', -- Västtrafiken Key A
|
||||||
|
'00000ffe2488', -- Västtrafiken Key B
|
||||||
|
'0297927c0f77', -- Västtrafiken Key A
|
||||||
|
'ee0042f88840', -- Västtrafiken Key B
|
||||||
|
'54726176656c', -- Västtrafiken Key A
|
||||||
|
'776974687573', -- Västtrafiken Key B
|
||||||
|
-- Data from: http://pastebin.com/y3PDBWR1
|
||||||
|
'000000000001',
|
||||||
|
'a0a1a2a3a4a5',
|
||||||
|
'123456789abc',
|
||||||
|
'b127c6f41436',
|
||||||
|
'12f2ee3478c1',
|
||||||
|
'34d1df9934c5',
|
||||||
|
'55f5a5dd38c9',
|
||||||
|
'f1a97341a9fc',
|
||||||
|
'33f974b42769',
|
||||||
|
'14d446e33363',
|
||||||
|
'c934fe34d934',
|
||||||
|
'1999a3554a55',
|
||||||
|
'27dd91f1fcf1',
|
||||||
|
'a94133013401',
|
||||||
|
'99c636334433',
|
||||||
|
'43ab19ef5c31',
|
||||||
|
'a053a292a4af',
|
||||||
|
'434f4d4d4f41',
|
||||||
|
'434f4d4d4f42',
|
||||||
|
'505249565441',
|
||||||
|
'505249565442',
|
||||||
|
-- Data from,:, http://pastebin.com/TUXj17K3
|
||||||
|
'fc0001877bf7', -- RKF ÖstgötaTrafiken Key A
|
||||||
|
'00000ffe2488', -- RKF ÖstgötaTrafiken Key B
|
||||||
|
'0297927c0f77', -- RKF ÖstgötaTrafiken Key A
|
||||||
|
'ee0042f88840', -- RKF ÖstgötaTrafiken Key B
|
||||||
|
'54726176656c', -- RKF ÖstgötaTrafiken Key A
|
||||||
|
'776974687573', -- RKF ÖstgötaTrafiken Key B
|
||||||
|
|
||||||
|
--[[
|
||||||
|
The keys below are taken from from https://code.google.com/p/mifare-key-cracker/downloads/list
|
||||||
|
--]]
|
||||||
|
|
||||||
|
'bd493a3962b6',
|
||||||
|
'010203040506',
|
||||||
|
'111111111111',
|
||||||
|
'222222222222',
|
||||||
|
'333333333333',
|
||||||
|
'444444444444',
|
||||||
|
'555555555555',
|
||||||
|
'666666666666',
|
||||||
|
'777777777777',
|
||||||
|
'888888888888',
|
||||||
|
'999999999999',
|
||||||
|
'aaaaaaaaaaaa',
|
||||||
|
'bbbbbbbbbbbb',
|
||||||
|
'cccccccccccc',
|
||||||
|
'dddddddddddd',
|
||||||
|
'eeeeeeeeeeee',
|
||||||
|
'0123456789ab',
|
||||||
|
'123456789abc',
|
||||||
|
'ffffffffffff', -- Default key
|
||||||
|
}
|
||||||
|
|
||||||
|
--[[
|
||||||
|
The keys above have just been pasted in, for completeness sake. They contain duplicates.
|
||||||
|
We need to weed the duplicates out before we expose the list to someone who actually wants to use them
|
||||||
|
|
||||||
|
--]]
|
||||||
|
|
||||||
|
local function uniq(list)
|
||||||
|
|
||||||
|
local foobar = {}
|
||||||
|
--print("list length ", #list)
|
||||||
|
for _, value in pairs(list) do
|
||||||
|
value = value:lower()
|
||||||
|
if not foobar[value] then
|
||||||
|
foobar[value] = true
|
||||||
|
table.insert(foobar, value);
|
||||||
|
end
|
||||||
|
end
|
||||||
|
--print("final list length length ", #foobar)
|
||||||
|
return foobar
|
||||||
|
end
|
||||||
|
|
||||||
|
return uniq(_keys)
|
||||||
143
client/scripts/mfkeys.lua
Normal file
143
client/scripts/mfkeys.lua
Normal file
|
|
@ -0,0 +1,143 @@
|
||||||
|
--[[
|
||||||
|
This is an example of Lua-scripting within proxmark3. This is a lua-side
|
||||||
|
implementation of hf mf chk
|
||||||
|
|
||||||
|
This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||||
|
at your option, any later version. See the LICENSE.txt file for the text of
|
||||||
|
the license.
|
||||||
|
|
||||||
|
Copyright (C) 2013 m h swende <martin at swende.se>
|
||||||
|
]]
|
||||||
|
-- Loads the commands-library
|
||||||
|
local cmds = require('commands')
|
||||||
|
-- Load the default keys
|
||||||
|
local keys = require('mf_default_keys')
|
||||||
|
local desc =
|
||||||
|
("This script implements check keys. It utilises a large list of default keys (currently %d keys).\
|
||||||
|
If you want to add more, just put them inside mf_default_keys.lua. "):format(#keys)
|
||||||
|
|
||||||
|
local TIMEOUT = 10000 -- 10 seconds
|
||||||
|
|
||||||
|
local function checkCommand(command)
|
||||||
|
|
||||||
|
--print("Sending this command : " .. tostring(command))
|
||||||
|
local usbcommand = command:getBytes()
|
||||||
|
core.SendCommand(usbcommand)
|
||||||
|
local result = core.WaitForResponseTimeout(cmds.CMD_ACK,TIMEOUT)
|
||||||
|
if result then
|
||||||
|
local count,cmd,arg0 = bin.unpack('LL',result)
|
||||||
|
if(arg0==1) then
|
||||||
|
local count,arg1,arg2,data = bin.unpack('LLH511',result,count)
|
||||||
|
key = data:sub(1,12)
|
||||||
|
return key
|
||||||
|
else
|
||||||
|
--print("Key not found...")
|
||||||
|
return nil
|
||||||
|
end
|
||||||
|
else
|
||||||
|
print("Timeout while waiting for response. Increase TIMEOUT in keycheck.lua to wait longer")
|
||||||
|
return nil, "Timeout while waiting for device to respond"
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
|
||||||
|
function checkBlock(blockNo, keys, keyType)
|
||||||
|
-- The command data is only 512 bytes, each key is 6 bytes, meaning that we can send max 85 keys in one go.
|
||||||
|
-- If there's more, we need to split it up
|
||||||
|
local start, remaining= 1, #keys
|
||||||
|
local packets = {}
|
||||||
|
while remaining > 0 do
|
||||||
|
local n,data = remaining, nil
|
||||||
|
if remaining > 85 then n = 85 end
|
||||||
|
local data = table.concat(keys,"",start,n)
|
||||||
|
--print("data",data)
|
||||||
|
--print("data len", #data)
|
||||||
|
print(("Testing block %d, keytype %d, with %d keys"):format(blockNo, keyType, n))
|
||||||
|
local command = Command:new{cmd = cmds.CMD_MIFARE_CHKKEYS,
|
||||||
|
arg1 = blockNo,
|
||||||
|
arg2 = keyType,
|
||||||
|
arg3 = n,
|
||||||
|
data = data}
|
||||||
|
local status = checkCommand(command)
|
||||||
|
if status then return status, blockNo end
|
||||||
|
start = start+n+1
|
||||||
|
remaining = remaining - n
|
||||||
|
end
|
||||||
|
return nil
|
||||||
|
end
|
||||||
|
|
||||||
|
-- A function to display the results
|
||||||
|
local function displayresults(results)
|
||||||
|
local sector, blockNo, keyA, keyB,_
|
||||||
|
|
||||||
|
print("________________________________________")
|
||||||
|
print("|Sector|Block| A | B |")
|
||||||
|
print("|--------------------------------------|")
|
||||||
|
|
||||||
|
for sector,_ in pairs(results) do
|
||||||
|
blockNo, keyA, keyB = unpack(_)
|
||||||
|
|
||||||
|
print(("| %3d | %3d |%s|%s|"):format(sector, blockNo, keyA, keyB ))
|
||||||
|
end
|
||||||
|
print("|--------------------------------------|")
|
||||||
|
|
||||||
|
end
|
||||||
|
-- A little helper to place an item first in the list
|
||||||
|
local function placeFirst(akey, list)
|
||||||
|
akey = akey:lower()
|
||||||
|
if list[1] == akey then
|
||||||
|
-- Already at pole position
|
||||||
|
return list
|
||||||
|
end
|
||||||
|
local result = {akey}
|
||||||
|
--print(("Putting '%s' first"):format(akey))
|
||||||
|
for i,v in ipairs(list) do
|
||||||
|
if v ~= akey then
|
||||||
|
result[#result+1] = v
|
||||||
|
end
|
||||||
|
end
|
||||||
|
return result
|
||||||
|
end
|
||||||
|
|
||||||
|
local function main()
|
||||||
|
|
||||||
|
print(desc);
|
||||||
|
|
||||||
|
core.clearCommandBuffer()
|
||||||
|
local blockNo
|
||||||
|
local keyType = 0 -- A=0, B=1
|
||||||
|
local result = {}
|
||||||
|
for sector=1,40,1 do
|
||||||
|
|
||||||
|
--[[
|
||||||
|
The mifare Classic 1k card has 16 sectors of 4 data blocks each. The
|
||||||
|
first 32 sectors of a mifare Classic 4k card consists of 4 data blocks and the remaining
|
||||||
|
8 sectors consist of 16 data blocks.
|
||||||
|
--]]
|
||||||
|
local blockNo = sector * 4 -1
|
||||||
|
|
||||||
|
if sector > 32 then
|
||||||
|
blockNo = 32*4+ (sector-32)*16 -1
|
||||||
|
end
|
||||||
|
|
||||||
|
local keyA = checkBlock(blockNo, keys, 0)
|
||||||
|
if keyA then keys = placeFirst(keyA, keys) end
|
||||||
|
keyA = keyA or ""
|
||||||
|
|
||||||
|
local keyB = checkBlock(blockNo, keys, 1)
|
||||||
|
if keyB then keys = placeFirst(keyB, keys) end
|
||||||
|
keyB = keyB or ""
|
||||||
|
|
||||||
|
result[sector] = {blockNo, keyA, keyB }
|
||||||
|
|
||||||
|
-- Check if user aborted
|
||||||
|
if core.ukbhit() then
|
||||||
|
print("Aborted by user")
|
||||||
|
break
|
||||||
|
end
|
||||||
|
end
|
||||||
|
displayresults(result)
|
||||||
|
end
|
||||||
|
|
||||||
|
main()
|
||||||
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue