mirror of
https://github.com/Proxmark/proxmark3.git
synced 2025-07-11 07:46:09 -07:00
hf mf nested add some functionality (#403)
* Added nested auto mode. it checks known keys and then launches nested * Check if we allready have all keys after nested
This commit is contained in:
Oleg Moiseenko
pwpiwi
parent
5191ad9e55
commit
adf023ffe3
2 changed files with 192 additions and 73 deletions
|
|
@ -8,6 +8,8 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
|||
### Changed
|
||||
- Improved backdoor detection missbehaving magic s50/1k tag (Fl0-0)
|
||||
- Deleted wipe functionality from `hf mf csetuid` (Merlok)
|
||||
- Changed `hf mf nested` logic (Merlok)
|
||||
- Added `hf mf nested` mode: autosearch keys for attack (from well known keys) (Merlok)
|
||||
|
||||
### Fixed
|
||||
|
||||
|
|
@ -19,6 +21,8 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
|||
- Added data fsktonrz, a fsk cleaning/demodulating routine for weak fsk signal. Note: follow this up with a `data rawdemod nr` to finish demoding your signal. (marshmellow)
|
||||
- Added lf em 410xbrute, LF EM410x reader bruteforce attack by simulating UIDs from a file (Fl0-0)
|
||||
- Added `hf mf cwipe` command. It wipes "magic Chinese" card. For 1a generation it uses card's "wipe" command. For gen1a and gen1b it uses a write command. (Merlok)
|
||||
- Added to `hf mf nested` source key check before attack (Merlok)
|
||||
- Added to `hf mf nested` after attack it checks all found keys on non-open sectors (Merlok)
|
||||
|
||||
## [3.0.1][2017-06-08]
|
||||
|
||||
|
|
|
|||
265
client/cmdhfmf.c
265
client/cmdhfmf.c
|
|
@ -222,6 +222,28 @@ uint8_t NumBlocksPerSector(uint8_t sectorNo)
|
|||
}
|
||||
}
|
||||
|
||||
static int ParamCardSizeSectors(const char c) {
|
||||
int numBlocks = 16;
|
||||
switch (c) {
|
||||
case '0' : numBlocks = 5; break;
|
||||
case '2' : numBlocks = 32; break;
|
||||
case '4' : numBlocks = 40; break;
|
||||
default: numBlocks = 16;
|
||||
}
|
||||
return numBlocks;
|
||||
}
|
||||
|
||||
static int ParamCardSizeBlocks(const char c) {
|
||||
int numBlocks = 16 * 4;
|
||||
switch (c) {
|
||||
case '0' : numBlocks = 5 * 4; break;
|
||||
case '2' : numBlocks = 32 * 4; break;
|
||||
case '4' : numBlocks = 32 * 4 + 8 * 16; break;
|
||||
default: numBlocks = 16 * 4;
|
||||
}
|
||||
return numBlocks;
|
||||
}
|
||||
|
||||
int CmdHF14AMfDump(const char *Cmd)
|
||||
{
|
||||
uint8_t sectorNo, blockNo;
|
||||
|
|
@ -238,14 +260,7 @@ int CmdHF14AMfDump(const char *Cmd)
|
|||
UsbCommand resp;
|
||||
|
||||
char cmdp = param_getchar(Cmd, 0);
|
||||
switch (cmdp) {
|
||||
case '0' : numSectors = 5; break;
|
||||
case '1' :
|
||||
case '\0': numSectors = 16; break;
|
||||
case '2' : numSectors = 32; break;
|
||||
case '4' : numSectors = 40; break;
|
||||
default: numSectors = 16;
|
||||
}
|
||||
numSectors = ParamCardSizeSectors(cmdp);
|
||||
|
||||
if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
|
||||
PrintAndLog("Usage: hf mf dump [card memory]");
|
||||
|
|
@ -516,6 +531,7 @@ typedef struct {
|
|||
} sector_t;
|
||||
|
||||
|
||||
# define NESTED_KEY_COUNT 15
|
||||
int CmdHF14AMfNested(const char *Cmd)
|
||||
{
|
||||
int i, j, res, iterations;
|
||||
|
|
@ -526,10 +542,12 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
uint8_t trgKeyType = 0;
|
||||
uint8_t SectorsCnt = 0;
|
||||
uint8_t key[6] = {0, 0, 0, 0, 0, 0};
|
||||
uint8_t keyBlock[14*6];
|
||||
uint8_t keyBlock[NESTED_KEY_COUNT * 6];
|
||||
uint64_t key64 = 0;
|
||||
bool transferToEml = false;
|
||||
|
||||
bool autosearchKey = false;
|
||||
|
||||
bool transferToEml = false;
|
||||
bool createDumpFile = false;
|
||||
FILE *fkeys;
|
||||
uint8_t standart[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
|
||||
|
|
@ -540,66 +558,90 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
if (strlen(Cmd)<3) {
|
||||
PrintAndLog("Usage:");
|
||||
PrintAndLog(" all sectors: hf mf nested <card memory> <block number> <key A/B> <key (12 hex symbols)> [t,d]");
|
||||
PrintAndLog(" all sectors autosearch key: hf mf nested <card memory> * [t,d]");
|
||||
PrintAndLog(" one sector: hf mf nested o <block number> <key A/B> <key (12 hex symbols)>");
|
||||
PrintAndLog(" <target block number> <target key A/B> [t]");
|
||||
PrintAndLog(" ");
|
||||
PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");
|
||||
PrintAndLog("t - transfer keys into emulator memory");
|
||||
PrintAndLog("d - write keys to binary file");
|
||||
PrintAndLog("t - transfer keys to emulator memory");
|
||||
PrintAndLog("d - write keys to binary file dumpkeys.bin");
|
||||
PrintAndLog(" ");
|
||||
PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF ");
|
||||
PrintAndLog(" sample2: hf mf nested 1 0 A FFFFFFFFFFFF t ");
|
||||
PrintAndLog(" sample3: hf mf nested 1 0 A FFFFFFFFFFFF d ");
|
||||
PrintAndLog(" sample4: hf mf nested o 0 A FFFFFFFFFFFF 4 A");
|
||||
PrintAndLog(" sample5: hf mf nested 1 * t");
|
||||
return 0;
|
||||
}
|
||||
|
||||
// <card memory>
|
||||
cmdp = param_getchar(Cmd, 0);
|
||||
blockNo = param_get8(Cmd, 1);
|
||||
ctmp = param_getchar(Cmd, 2);
|
||||
|
||||
if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {
|
||||
PrintAndLog("Key type must be A or B");
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (ctmp != 'A' && ctmp != 'a')
|
||||
keyType = 1;
|
||||
|
||||
if (param_gethex(Cmd, 3, key, 12)) {
|
||||
PrintAndLog("Key must include 12 HEX symbols");
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (cmdp == 'o' || cmdp == 'O') {
|
||||
cmdp = 'o';
|
||||
trgBlockNo = param_get8(Cmd, 4);
|
||||
ctmp = param_getchar(Cmd, 5);
|
||||
if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {
|
||||
PrintAndLog("Target key type must be A or B");
|
||||
return 1;
|
||||
}
|
||||
if (ctmp != 'A' && ctmp != 'a')
|
||||
trgKeyType = 1;
|
||||
SectorsCnt = 1;
|
||||
} else {
|
||||
|
||||
switch (cmdp) {
|
||||
case '0': SectorsCnt = 05; break;
|
||||
case '1': SectorsCnt = 16; break;
|
||||
case '2': SectorsCnt = 32; break;
|
||||
case '4': SectorsCnt = 40; break;
|
||||
default: SectorsCnt = 16;
|
||||
}
|
||||
SectorsCnt = ParamCardSizeSectors(cmdp);
|
||||
}
|
||||
|
||||
ctmp = param_getchar(Cmd, 4);
|
||||
if (ctmp == 't' || ctmp == 'T') transferToEml = true;
|
||||
else if (ctmp == 'd' || ctmp == 'D') createDumpFile = true;
|
||||
// <block number>. number or autosearch key (*)
|
||||
if (param_getchar(Cmd, 1) == '*') {
|
||||
autosearchKey = true;
|
||||
|
||||
ctmp = param_getchar(Cmd, 6);
|
||||
transferToEml |= (ctmp == 't' || ctmp == 'T');
|
||||
transferToEml |= (ctmp == 'd' || ctmp == 'D');
|
||||
ctmp = param_getchar(Cmd, 2);
|
||||
transferToEml |= (ctmp == 't' || ctmp == 'T');
|
||||
createDumpFile |= (ctmp == 'd' || ctmp == 'D');
|
||||
|
||||
if (cmdp == 'o') {
|
||||
PrintAndLog("--nested. sectors:%2d, block no:*, eml:%c, dmp=%c ", SectorsCnt, transferToEml?'y':'n', createDumpFile?'y':'n');
|
||||
} else {
|
||||
blockNo = param_get8(Cmd, 1);
|
||||
|
||||
ctmp = param_getchar(Cmd, 2);
|
||||
if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {
|
||||
PrintAndLog("Key type must be A or B");
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (ctmp != 'A' && ctmp != 'a')
|
||||
keyType = 1;
|
||||
|
||||
if (param_gethex(Cmd, 3, key, 12)) {
|
||||
PrintAndLog("Key must include 12 HEX symbols");
|
||||
return 1;
|
||||
}
|
||||
|
||||
// check if we can authenticate to sector
|
||||
res = mfCheckKeys(blockNo, keyType, true, 1, key, &key64);
|
||||
if (res) {
|
||||
PrintAndLog("Can't authenticate to block:%3d key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));
|
||||
return 3;
|
||||
}
|
||||
|
||||
// one sector nested
|
||||
if (cmdp == 'o') {
|
||||
trgBlockNo = param_get8(Cmd, 4);
|
||||
|
||||
ctmp = param_getchar(Cmd, 5);
|
||||
if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') {
|
||||
PrintAndLog("Target key type must be A or B");
|
||||
return 1;
|
||||
}
|
||||
if (ctmp != 'A' && ctmp != 'a')
|
||||
trgKeyType = 1;
|
||||
|
||||
ctmp = param_getchar(Cmd, 6);
|
||||
transferToEml |= (ctmp == 't' || ctmp == 'T');
|
||||
createDumpFile |= (ctmp == 'd' || ctmp == 'D');
|
||||
} else {
|
||||
ctmp = param_getchar(Cmd, 4);
|
||||
transferToEml |= (ctmp == 't' || ctmp == 'T');
|
||||
createDumpFile |= (ctmp == 'd' || ctmp == 'D');
|
||||
}
|
||||
|
||||
PrintAndLog("--nested. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c ", SectorsCnt, blockNo, keyType?'B':'A', transferToEml?'y':'n', createDumpFile?'y':'n');
|
||||
}
|
||||
|
||||
// one-sector nested
|
||||
if (cmdp == 'o') { // ------------------------------------ one sector working
|
||||
PrintAndLog("--target block no:%3d, target key type:%c ", trgBlockNo, trgKeyType?'B':'A');
|
||||
int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true);
|
||||
if (isOK) {
|
||||
|
|
@ -630,6 +672,7 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
else
|
||||
num_to_bytes(key64, 6, &keyBlock[10]);
|
||||
mfEmlSetMem(keyBlock, sectortrailer, 1);
|
||||
PrintAndLog("Key transferred to emulator memory.");
|
||||
}
|
||||
} else {
|
||||
PrintAndLog("No valid key found");
|
||||
|
|
@ -657,13 +700,14 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
num_to_bytes(0xa0478cc39091, 6, (uint8_t*)(keyBlock + 11 * 6));
|
||||
num_to_bytes(0x533cb6c723f6, 6, (uint8_t*)(keyBlock + 12 * 6));
|
||||
num_to_bytes(0x8fd0a4f256e9, 6, (uint8_t*)(keyBlock + 13 * 6));
|
||||
num_to_bytes(0x1a2b3c4d5e6f, 6, (uint8_t*)(keyBlock + 14 * 6));
|
||||
|
||||
PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt);
|
||||
for (i = 0; i < SectorsCnt; i++) {
|
||||
for (j = 0; j < 2; j++) {
|
||||
if (e_sector[i].foundKey[j]) continue;
|
||||
|
||||
res = mfCheckKeys(FirstBlockOfSector(i), j, true, 6, keyBlock, &key64);
|
||||
res = mfCheckKeys(FirstBlockOfSector(i), j, true, NESTED_KEY_COUNT, keyBlock, &key64);
|
||||
|
||||
if (!res) {
|
||||
e_sector[i].Key[j] = key64;
|
||||
|
|
@ -672,6 +716,32 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
}
|
||||
}
|
||||
|
||||
// get known key from array
|
||||
bool keyFound = false;
|
||||
if (autosearchKey) {
|
||||
for (i = 0; i < SectorsCnt; i++) {
|
||||
for (j = 0; j < 2; j++) {
|
||||
if (e_sector[i].foundKey[j]) {
|
||||
// get known key
|
||||
blockNo = i * 4;
|
||||
keyType = j;
|
||||
num_to_bytes(e_sector[i].Key[j], 6, key);
|
||||
|
||||
keyFound = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (keyFound) break;
|
||||
}
|
||||
|
||||
// Can't found a key....
|
||||
if (!keyFound) {
|
||||
PrintAndLog("Can't found any of the known keys.");
|
||||
return 4;
|
||||
}
|
||||
PrintAndLog("--auto key. block no:%3d, key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));
|
||||
}
|
||||
|
||||
// nested sectors
|
||||
iterations = 0;
|
||||
PrintAndLog("nested...");
|
||||
|
|
@ -707,10 +777,71 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
}
|
||||
}
|
||||
|
||||
printf("Time in nested: %1.3f (%1.3f sec per key)\n\n", ((float)(msclock() - msclock1))/1000.0, ((float)(msclock() - msclock1))/iterations/1000.0);
|
||||
// print nested statistic
|
||||
PrintAndLog("\n\n-----------------------------------------------\nNested statistic:\nIterations count: %d", iterations);
|
||||
PrintAndLog("Time in nested: %1.3f (%1.3f sec per key)", ((float)(msclock() - msclock1))/1000.0, ((float)(msclock() - msclock1))/iterations/1000.0);
|
||||
|
||||
PrintAndLog("-----------------------------------------------\nIterations count: %d\n\n", iterations);
|
||||
//print them
|
||||
// check if we have unrecognized keys
|
||||
bool notFoundKeys = false;
|
||||
for (i = 0; i < SectorsCnt; i++) {
|
||||
for (j = 0; j < 2; j++) {
|
||||
if (!e_sector[i].foundKey[j]) {
|
||||
notFoundKeys = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (notFoundKeys) break;
|
||||
}
|
||||
|
||||
if (notFoundKeys) {
|
||||
PrintAndLog("-----------------------------------------------\n");
|
||||
PrintAndLog("We have unrecognized keys. Trying to check if we have this keys on key buffer...");
|
||||
|
||||
// fill keyBlock with known keys
|
||||
int cnt = 0;
|
||||
for (i = 0; i < SectorsCnt; i++) {
|
||||
for (j = 0; j < 2; j++) {
|
||||
if (e_sector[i].foundKey[j]) {
|
||||
// try to insert key to keyBlock
|
||||
if (cnt < NESTED_KEY_COUNT) {
|
||||
|
||||
// search for dublicates
|
||||
bool dubl = false;
|
||||
for (int v = 0; v < NESTED_KEY_COUNT; v++) {
|
||||
if (e_sector[i].Key[j] == bytes_to_num((uint8_t*)(keyBlock + v * 6), 6)) {
|
||||
dubl = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
// insert
|
||||
if (!dubl) {
|
||||
num_to_bytes(e_sector[i].Key[j], 6, (uint8_t*)(keyBlock + cnt * 6));
|
||||
cnt++;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// try to auth with known keys to not recognized sectors keys
|
||||
PrintAndLog("Testing keys. Sector count=%d known keys count:%d", SectorsCnt, cnt);
|
||||
for (i = 0; i < SectorsCnt; i++) {
|
||||
for (j = 0; j < 2; j++) {
|
||||
if (e_sector[i].foundKey[j]) continue;
|
||||
|
||||
res = mfCheckKeys(FirstBlockOfSector(i), j, true, cnt, keyBlock, &key64);
|
||||
|
||||
if (!res) {
|
||||
e_sector[i].Key[j] = key64;
|
||||
e_sector[i].foundKey[j] = 1;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
} // if (notFoundKeys)
|
||||
|
||||
// print result
|
||||
PrintAndLog("|---|----------------|---|----------------|---|");
|
||||
PrintAndLog("|sec|key A |res|key B |res|");
|
||||
PrintAndLog("|---|----------------|---|----------------|---|");
|
||||
|
|
@ -720,7 +851,7 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
}
|
||||
PrintAndLog("|---|----------------|---|----------------|---|");
|
||||
|
||||
// transfer them to the emulator
|
||||
// transfer keys to the emulator memory
|
||||
if (transferToEml) {
|
||||
for (i = 0; i < SectorsCnt; i++) {
|
||||
mfEmlGetMem(keyBlock, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1);
|
||||
|
|
@ -730,6 +861,7 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
num_to_bytes(e_sector[i].Key[1], 6, &keyBlock[10]);
|
||||
mfEmlSetMem(keyBlock, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1);
|
||||
}
|
||||
PrintAndLog("Keys transferred to emulator memory.");
|
||||
}
|
||||
|
||||
// Create dump file
|
||||
|
|
@ -946,13 +1078,7 @@ int CmdHF14AMfChk(const char *Cmd)
|
|||
|
||||
if (param_getchar(Cmd, 0)=='*') {
|
||||
blockNo = 3;
|
||||
switch(param_getchar(Cmd+1, 0)) {
|
||||
case '0': SectorsCnt = 5; break;
|
||||
case '1': SectorsCnt = 16; break;
|
||||
case '2': SectorsCnt = 32; break;
|
||||
case '4': SectorsCnt = 40; break;
|
||||
default: SectorsCnt = 16;
|
||||
}
|
||||
SectorsCnt = ParamCardSizeSectors(param_getchar(Cmd + 1, 0));
|
||||
}
|
||||
else
|
||||
blockNo = param_get8(Cmd, 0);
|
||||
|
|
@ -1854,17 +1980,6 @@ int CmdHF14AMfCSetUID(const char *Cmd)
|
|||
return 0;
|
||||
}
|
||||
|
||||
static int ParamGetCardSize(const char c) {
|
||||
int numBlocks = 16 * 4;
|
||||
switch (c) {
|
||||
case '0' : numBlocks = 5 * 4; break;
|
||||
case '2' : numBlocks = 32 * 4; break;
|
||||
case '4' : numBlocks = 32 * 4 + 8 * 16; break;
|
||||
default: numBlocks = 16 * 4;
|
||||
}
|
||||
return numBlocks;
|
||||
}
|
||||
|
||||
int CmdHF14AMfCWipe(const char *Cmd)
|
||||
{
|
||||
int res, gen = 0;
|
||||
|
|
@ -1885,7 +2000,7 @@ int CmdHF14AMfCWipe(const char *Cmd)
|
|||
if ((gen != 1) && (gen != 2))
|
||||
return 1;
|
||||
|
||||
numBlocks = ParamGetCardSize(param_getchar(Cmd, 0));
|
||||
numBlocks = ParamCardSizeBlocks(param_getchar(Cmd, 0));
|
||||
|
||||
char cmdp = 0;
|
||||
while(param_getchar(Cmd, cmdp) != 0x00){
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue