From 5e6e48f0cf62575672b8c2de58889053db6520b5 Mon Sep 17 00:00:00 2001 From: merlokk Date: Wed, 26 Jul 2017 15:47:35 +0300 Subject: [PATCH 01/17] added new funtion to util.c - param_getlength --- client/util.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/client/util.c b/client/util.c index 38dd3a12..86e8c502 100644 --- a/client/util.c +++ b/client/util.c @@ -322,7 +322,7 @@ char * printBits(size_t const size, void const * const ptr) // ------------------------------------------------------------------------- // line - param line -// bg, en - symbol numbers in param line of beginning an ending parameter +// bg, en - symbol numbers in param line of beginning and ending parameter // paramnum - param number (from 0) // ------------------------------------------------------------------------- int param_getptr(const char *line, int *bg, int *en, int paramnum) @@ -355,6 +355,15 @@ int param_getptr(const char *line, int *bg, int *en, int paramnum) } +int param_getlength(const char *line, int paramnum) +{ + int bg, en; + + if (param_getptr(line, &bg, &en, paramnum)) return 0; + + return en - bg + 1; +} + char param_getchar(const char *line, int paramnum) { int bg, en; From c9c1c76357c28cad29084c3e9fcb3fddd1e9e80a Mon Sep 17 00:00:00 2001 From: merlokk Date: Wed, 26 Jul 2017 15:48:12 +0300 Subject: [PATCH 02/17] added param_getlength to util.h --- client/util.h | 1 + 1 file changed, 1 insertion(+) diff --git a/client/util.h b/client/util.h index 640ef434..6177dd93 100644 --- a/client/util.h +++ b/client/util.h @@ -51,6 +51,7 @@ extern uint32_t SwapBits(uint32_t value, int nrbits); extern uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockSize); extern void SwapEndian64ex(const uint8_t *src, const size_t len, const uint8_t blockSize, uint8_t *dest); +extern int param_getlength(const char *line, int paramnum); extern char param_getchar(const char *line, int paramnum); extern int param_getptr(const char *line, int *bg, int *en, int paramnum); extern uint8_t param_get8(const char *line, int paramnum); From 689092c0e6e3c481813479824851b9e327d5af84 Mon Sep 17 00:00:00 2001 From: merlokk Date: Wed, 26 Jul 2017 15:53:15 +0300 Subject: [PATCH 03/17] Added parameter to 'hf mf csetuid' to initialize memory of the magic chinese card --- client/cmdhfmf.c | 103 +++++++++++++++++++++++++++-------------------- 1 file changed, 60 insertions(+), 43 deletions(-) diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index 90ebc27b..b31ab088 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -1784,64 +1784,81 @@ int CmdHF14AMfEKeyPrn(const char *Cmd) int CmdHF14AMfCSetUID(const char *Cmd) { uint8_t wipeCard = 0; + uint8_t fillCard = 0; uint8_t uid[8] = {0x00}; uint8_t oldUid[8] = {0x00}; uint8_t atqa[2] = {0x00}; uint8_t sak[1] = {0x00}; - uint8_t atqaPresent = 1; + uint8_t atqaPresent = 0; int res; - char ctmp; - int argi=0; - if (strlen(Cmd) < 1 || param_getchar(Cmd, argi) == 'h') { - PrintAndLog("Usage: hf mf csetuid [ATQA 4 hex symbols SAK 2 hex symbols] [w]"); - PrintAndLog("sample: hf mf csetuid 01020304"); - PrintAndLog("sample: hf mf csetuid 01020304 0004 08 w"); - PrintAndLog("Set UID, ATQA, and SAK for magic Chinese card (only works with such cards)"); - PrintAndLog("If you also want to wipe the card then add 'w' at the end of the command line."); - return 0; - } - - if (param_getchar(Cmd, argi) && param_gethex(Cmd, argi, uid, 8)) { + uint8_t needHelp = 0; + char cmdp = 1; + + if (param_getchar(Cmd, 0) && param_gethex(Cmd, 0, uid, 8)) { PrintAndLog("UID must include 8 HEX symbols"); return 1; } - argi++; - ctmp = param_getchar(Cmd, argi); - if (ctmp == 'w' || ctmp == 'W') { - wipeCard = 1; - atqaPresent = 0; - } - - if (atqaPresent) { - if (param_getchar(Cmd, argi)) { - if (param_gethex(Cmd, argi, atqa, 4)) { - PrintAndLog("ATQA must include 4 HEX symbols"); - return 1; - } - argi++; - if (!param_getchar(Cmd, argi) || param_gethex(Cmd, argi, sak, 2)) { - PrintAndLog("SAK must include 2 HEX symbols"); - return 1; - } - argi++; - } else - atqaPresent = 0; - } - - if(!wipeCard) { - ctmp = param_getchar(Cmd, argi); - if (ctmp == 'w' || ctmp == 'W') { - wipeCard = 1; + if (param_getlength(Cmd, 1) > 1 && param_getlength(Cmd, 2) > 1) { + atqaPresent = 1; + cmdp = 3; + + if (param_gethex(Cmd, 1, atqa, 4)) { + PrintAndLog("ATQA must include 4 HEX symbols"); + return 1; + } + + if (param_gethex(Cmd, 2, sak, 2)) { + PrintAndLog("SAK must include 2 HEX symbols"); + return 1; } } - PrintAndLog("--wipe card:%s uid:%s", (wipeCard)?"YES":"NO", sprint_hex(uid, 4)); + while(param_getchar(Cmd, cmdp) != 0x00) + { + switch(param_getchar(Cmd, cmdp)) + { + case 'h': + case 'H': + needHelp = 1; + break; + case 'w': + case 'W': + wipeCard = 1; + break; + case 'k': + case 'K': + fillCard = 1; + break; + default: + PrintAndLog("ERROR: Unknown parameter '%c'", param_getchar(Cmd, cmdp)); + needHelp = 1; + break; + } + cmdp++; + } - res = mfCSetUID(uid, (atqaPresent)?atqa:NULL, (atqaPresent)?sak:NULL, oldUid, wipeCard); + if (strlen(Cmd) < 1 || needHelp) { + PrintAndLog(""); + PrintAndLog("Usage: hf mf csetuid [ATQA 4 hex symbols SAK 2 hex symbols] [w] [k]"); + PrintAndLog("sample: hf mf csetuid 01020304"); + PrintAndLog("sample: hf mf csetuid 01020304 0004 08 w"); + PrintAndLog("sample: hf mf csetuid 01020304 0004 08 f"); + PrintAndLog("Set UID, ATQA, and SAK for magic Chinese card (only works with such cards)"); + PrintAndLog("'w' - wipe the card. Works only for cards with this function"); + PrintAndLog("'k' - fill data blocks with 0x00 and keys with 0xFFFFFFFFFFFF"); + return 0; + } + + PrintAndLog("--wipe card:%s fill card:%s uid:%s", (wipeCard)?"YES":"NO", (fillCard)?"YES":"NO", sprint_hex(uid, 4)); + if (atqaPresent) { + PrintAndLog("--atqa:%s sak:%02x", sprint_hex(atqa, 2), sak[0]); + } + + res = mfCSetUID(uid, (atqaPresent)?atqa:NULL, (atqaPresent)?sak:NULL, oldUid, wipeCard, fillCard); if (res) { - PrintAndLog("Can't set UID. error=%d", res); + PrintAndLog("Can't set UID. Error=%d", res); return 1; } From 0a3e6a5448734446576fca3bad38d63d156a43fc Mon Sep 17 00:00:00 2001 From: merlokk Date: Wed, 26 Jul 2017 15:53:49 +0300 Subject: [PATCH 04/17] added logic to hf mf setuid to init card --- client/mifarehost.c | 48 +++++++++++++++++++++++++++++++++------------ 1 file changed, 35 insertions(+), 13 deletions(-) diff --git a/client/mifarehost.c b/client/mifarehost.c index 3b524758..dfbf1747 100644 --- a/client/mifarehost.c +++ b/client/mifarehost.c @@ -451,20 +451,24 @@ int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, bool wantWipe, uin return 0; } -int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool wantWipe) { +int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool wantWipe, bool wantFill) { uint8_t oldblock0[16] = {0x00}; uint8_t block0[16] = {0x00}; - int old, gen = 0; + uint8_t block1[16] = {0x00}; + uint8_t blockK[16] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x08, 77, 0x8F, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; + uint8_t blockt[16] = {0x00}; + int old, gen = 0, res; gen = mfCIdentify(); + /* generation 1a magic card by default */ + uint8_t cmdParams = CSETBLOCK_SINGLE_OPER; if (gen == 2) { /* generation 1b magic card */ - old = mfCGetBlock(0, oldblock0, CSETBLOCK_SINGLE_OPER | CSETBLOCK_MAGIC_1B); - } else { - /* generation 1a magic card by default */ - old = mfCGetBlock(0, oldblock0, CSETBLOCK_SINGLE_OPER); + cmdParams = CSETBLOCK_SINGLE_OPER | CSETBLOCK_MAGIC_1B; } + + old = mfCGetBlock(0, oldblock0, cmdParams); if (old == 0) { memcpy(block0, oldblock0, 16); @@ -485,15 +489,33 @@ int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool w block0[6]=atqa[1]; block0[7]=atqa[0]; } - PrintAndLog("new block 0: %s", sprint_hex(block0,16)); + PrintAndLog("new block 0: %s", sprint_hex(block0, 16)); - if (gen == 2) { - /* generation 1b magic card */ - return mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER | CSETBLOCK_MAGIC_1B); - } else { - /* generation 1a magic card by default */ - return mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER); + res = mfCSetBlock(0, block0, oldUID, wantWipe, cmdParams); + if (res) { + PrintAndLog("Can't set block 0. Error: %s", res); + return res; } + + if (wantFill) { + int blockNo = 1; + + while (blockNo < 16) { + if ((blockNo + 1) % 4) { + res = mfCSetBlock(blockNo, block1, blockt, false, cmdParams); + } else { + res = mfCSetBlock(blockNo, blockk, blockt, false, cmdParams); + } + if (res) { + PrintAndLog("Can't set block %d. Error: %s", blockNo, res); + return res; + } + + blockNo++; + } + } + + return 0; } // SNIFFER From 2c07d7265f82e0c43b857c8edf1184eff1e3bc50 Mon Sep 17 00:00:00 2001 From: merlokk Date: Wed, 26 Jul 2017 16:44:08 +0300 Subject: [PATCH 05/17] hf mf csetuid with fill sectors works. --- client/mifarehost.c | 17 +++++++++++------ client/mifarehost.h | 2 +- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/client/mifarehost.c b/client/mifarehost.c index dfbf1747..a5a0397b 100644 --- a/client/mifarehost.c +++ b/client/mifarehost.c @@ -455,9 +455,9 @@ int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool w uint8_t oldblock0[16] = {0x00}; uint8_t block0[16] = {0x00}; uint8_t block1[16] = {0x00}; - uint8_t blockK[16] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x08, 77, 0x8F, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; + uint8_t blockK[16] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x08, 0x77, 0x8F, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; uint8_t blockt[16] = {0x00}; - int old, gen = 0, res; + int gen = 0, res; gen = mfCIdentify(); @@ -468,9 +468,9 @@ int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool w cmdParams = CSETBLOCK_SINGLE_OPER | CSETBLOCK_MAGIC_1B; } - old = mfCGetBlock(0, oldblock0, cmdParams); + res = mfCGetBlock(0, oldblock0, cmdParams); - if (old == 0) { + if (res == 0) { memcpy(block0, oldblock0, 16); PrintAndLog("old block 0: %s", sprint_hex(block0,16)); } else { @@ -500,19 +500,24 @@ int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool w if (wantFill) { int blockNo = 1; - while (blockNo < 16) { + printf("write blocks "); + while (blockNo < 64) { if ((blockNo + 1) % 4) { res = mfCSetBlock(blockNo, block1, blockt, false, cmdParams); } else { - res = mfCSetBlock(blockNo, blockk, blockt, false, cmdParams); + res = mfCSetBlock(blockNo, blockK, blockt, false, cmdParams); + printf("."); } if (res) { + printf("\n"); PrintAndLog("Can't set block %d. Error: %s", blockNo, res); return res; } blockNo++; } + printf("\n"); + PrintAndLog("64 blocks writed successfully."); } return 0; diff --git a/client/mifarehost.h b/client/mifarehost.h index 7f9a2b45..a479323d 100644 --- a/client/mifarehost.h +++ b/client/mifarehost.h @@ -33,7 +33,7 @@ extern int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint extern int mfEmlGetMem(uint8_t *data, int blockNum, int blocksCount); extern int mfEmlSetMem(uint8_t *data, int blockNum, int blocksCount); -extern int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool wantWipe); +extern int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool wantWipe, bool wantFill); extern int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, bool wantWipe, uint8_t params); extern int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params); From 8d1679a22ad594f4d9e4b8db52424f206e554abc Mon Sep 17 00:00:00 2001 From: merlokk Date: Wed, 26 Jul 2017 16:56:14 +0300 Subject: [PATCH 06/17] small fix 'hf mf csetuid' --- client/mifarehost.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/client/mifarehost.c b/client/mifarehost.c index a5a0397b..215424e8 100644 --- a/client/mifarehost.c +++ b/client/mifarehost.c @@ -437,8 +437,8 @@ int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, bool wantWipe, uin memcpy(c.d.asBytes, data, 16); SendCommand(&c); - UsbCommand resp; - if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) { + UsbCommand resp; + if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) { isOK = resp.arg[0] & 0xff; if (uid != NULL) memcpy(uid, resp.d.asBytes, 4); @@ -448,6 +448,7 @@ int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, bool wantWipe, uin PrintAndLog("Command execute timeout"); return 1; } + return 0; } @@ -456,7 +457,6 @@ int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool w uint8_t block0[16] = {0x00}; uint8_t block1[16] = {0x00}; uint8_t blockK[16] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x08, 0x77, 0x8F, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; - uint8_t blockt[16] = {0x00}; int gen = 0, res; gen = mfCIdentify(); @@ -493,7 +493,7 @@ int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool w res = mfCSetBlock(0, block0, oldUID, wantWipe, cmdParams); if (res) { - PrintAndLog("Can't set block 0. Error: %s", res); + PrintAndLog("Can't set block 0. Error: %d", res); return res; } @@ -503,9 +503,9 @@ int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool w printf("write blocks "); while (blockNo < 64) { if ((blockNo + 1) % 4) { - res = mfCSetBlock(blockNo, block1, blockt, false, cmdParams); + res = mfCSetBlock(blockNo, block1, NULL, false, cmdParams); } else { - res = mfCSetBlock(blockNo, blockK, blockt, false, cmdParams); + res = mfCSetBlock(blockNo, blockK, NULL, false, cmdParams); printf("."); } if (res) { From 143ee0997afeba39bfa665411d171d2d4d034107 Mon Sep 17 00:00:00 2001 From: merlokk Date: Wed, 26 Jul 2017 17:31:33 +0300 Subject: [PATCH 07/17] small fix mifarehost.c --- client/mifarehost.c | 110 +++++++++++++++++++++++--------------------- 1 file changed, 57 insertions(+), 53 deletions(-) diff --git a/client/mifarehost.c b/client/mifarehost.c index 215424e8..4df74093 100644 --- a/client/mifarehost.c +++ b/client/mifarehost.c @@ -481,13 +481,13 @@ int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool w // UID memcpy(block0, uid, 4); // Mifare UID BCC - block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; + block0[4] = block0[0] ^ block0[1] ^ block0[2] ^ block0[3]; // mifare classic SAK(byte 5) and ATQA(byte 6 and 7, reversed) - if (sak!=NULL) - block0[5]=sak[0]; - if (atqa!=NULL) { - block0[6]=atqa[1]; - block0[7]=atqa[0]; + if (sak != NULL) + block0[5] = sak[0]; + if (atqa != NULL) { + block0[6] = atqa[1]; + block0[7] = atqa[0]; } PrintAndLog("new block 0: %s", sprint_hex(block0, 16)); @@ -510,7 +510,7 @@ int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool w } if (res) { printf("\n"); - PrintAndLog("Can't set block %d. Error: %s", blockNo, res); + PrintAndLog("Can't set block %d. Error: %d", blockNo, res); return res; } @@ -523,6 +523,54 @@ int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool w return 0; } +int mfCIdentify() +{ + UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT | ISO14A_NO_DISCONNECT, 0, 0}}; + SendCommand(&c); + + UsbCommand resp; + WaitForResponse(CMD_ACK,&resp); + + iso14a_card_select_t card; + memcpy(&card, (iso14a_card_select_t *)resp.d.asBytes, sizeof(iso14a_card_select_t)); + + uint64_t select_status = resp.arg[0]; // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS, 3: proprietary Anticollision + + if(select_status != 0) { + uint8_t rats[] = { 0xE0, 0x80 }; // FSDI=8 (FSD=256), CID=0 + c.arg[0] = ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT; + c.arg[1] = 2; + c.arg[2] = 0; + memcpy(c.d.asBytes, rats, 2); + SendCommand(&c); + WaitForResponse(CMD_ACK,&resp); + } + + c.cmd = CMD_MIFARE_CIDENT; + c.arg[0] = 0; + c.arg[1] = 0; + c.arg[2] = 0; + SendCommand(&c); + WaitForResponse(CMD_ACK,&resp); + + uint8_t isGeneration = resp.arg[0] & 0xff; + switch( isGeneration ){ + case 1: PrintAndLog("Chinese magic backdoor commands (GEN 1a) detected"); break; + case 2: PrintAndLog("Chinese magic backdoor command (GEN 1b) detected"); break; + default: PrintAndLog("No chinese magic backdoor command detected"); break; + } + + // disconnect + c.cmd = CMD_READER_ISO_14443a; + c.arg[0] = 0; + c.arg[1] = 0; + c.arg[2] = 0; + SendCommand(&c); + + return (int) isGeneration; +} + + // SNIFFER // constants @@ -847,6 +895,8 @@ int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) { return 0; } +// DECODING + int tryDecryptWord(uint32_t nt, uint32_t ar_enc, uint32_t at_enc, uint8_t *data, int len){ /* uint32_t nt; // tag challenge @@ -867,49 +917,3 @@ int tryDecryptWord(uint32_t nt, uint32_t ar_enc, uint32_t at_enc, uint8_t *data, return 0; } -int mfCIdentify() -{ - UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT | ISO14A_NO_DISCONNECT, 0, 0}}; - SendCommand(&c); - - UsbCommand resp; - WaitForResponse(CMD_ACK,&resp); - - iso14a_card_select_t card; - memcpy(&card, (iso14a_card_select_t *)resp.d.asBytes, sizeof(iso14a_card_select_t)); - - uint64_t select_status = resp.arg[0]; // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS, 3: proprietary Anticollision - - if(select_status != 0) { - uint8_t rats[] = { 0xE0, 0x80 }; // FSDI=8 (FSD=256), CID=0 - c.arg[0] = ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT; - c.arg[1] = 2; - c.arg[2] = 0; - memcpy(c.d.asBytes, rats, 2); - SendCommand(&c); - WaitForResponse(CMD_ACK,&resp); - } - - c.cmd = CMD_MIFARE_CIDENT; - c.arg[0] = 0; - c.arg[1] = 0; - c.arg[2] = 0; - SendCommand(&c); - WaitForResponse(CMD_ACK,&resp); - - uint8_t isGeneration = resp.arg[0] & 0xff; - switch( isGeneration ){ - case 1: PrintAndLog("Chinese magic backdoor commands (GEN 1a) detected"); break; - case 2: PrintAndLog("Chinese magic backdoor command (GEN 1b) detected"); break; - default: PrintAndLog("No chinese magic backdoor command detected"); break; - } - - // disconnect - c.cmd = CMD_READER_ISO_14443a; - c.arg[0] = 0; - c.arg[1] = 0; - c.arg[2] = 0; - SendCommand(&c); - - return (int) isGeneration; -} From 997f1e4886f087b557825d10dccf941dedb0b072 Mon Sep 17 00:00:00 2001 From: merlokk Date: Wed, 26 Jul 2017 18:12:15 +0300 Subject: [PATCH 08/17] arm mifarecmd.h. removed break in iso14443 select procedure because if we have wrong block0 we will cant make select, but we need set uid. --- armsrc/mifarecmd.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c index 0e9c3672..1e6bc3e4 100644 --- a/armsrc/mifarecmd.c +++ b/armsrc/mifarecmd.c @@ -1214,13 +1214,14 @@ void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai if (workFlags & 0x01) { if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) { if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card"); - break; + // Continue, if we set wrong UID or wrong UID checksum or some ATQA or SAK we will can't select card. But we need to write block 0 to make card work. + //break; }; if(mifare_classic_halt(NULL, cuid)) { if (MF_DBGLEVEL > 2) Dbprintf("Halt error"); // Continue, some magic tags misbehavies and send an answer to it. - // break; + // break; }; }; From 76fcccd10992566b9fa7187097a3056fbb1c5619 Mon Sep 17 00:00:00 2001 From: merlokk Date: Thu, 27 Jul 2017 13:06:28 +0300 Subject: [PATCH 09/17] Added key check to nested command and some refactoring --- client/cmdhfmf.c | 75 ++++++++++++++++++++++++++++++++---------------- 1 file changed, 50 insertions(+), 25 deletions(-) diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index b31ab088..4c402b2d 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -526,10 +526,10 @@ int CmdHF14AMfNested(const char *Cmd) uint8_t trgKeyType = 0; uint8_t SectorsCnt = 0; uint8_t key[6] = {0, 0, 0, 0, 0, 0}; - uint8_t keyBlock[14*6]; + uint8_t keyBlock[14 * 6]; uint64_t key64 = 0; - bool transferToEml = false; + bool transferToEml = false; bool createDumpFile = false; FILE *fkeys; uint8_t standart[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; @@ -555,8 +555,8 @@ int CmdHF14AMfNested(const char *Cmd) cmdp = param_getchar(Cmd, 0); blockNo = param_get8(Cmd, 1); - ctmp = param_getchar(Cmd, 2); + ctmp = param_getchar(Cmd, 2); if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') { PrintAndLog("Key type must be A or B"); return 1; @@ -570,35 +570,42 @@ int CmdHF14AMfNested(const char *Cmd) return 1; } - if (cmdp == 'o' || cmdp == 'O') { - cmdp = 'o'; - trgBlockNo = param_get8(Cmd, 4); - ctmp = param_getchar(Cmd, 5); - if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') { - PrintAndLog("Target key type must be A or B"); - return 1; - } - if (ctmp != 'A' && ctmp != 'a') - trgKeyType = 1; - } else { - - switch (cmdp) { - case '0': SectorsCnt = 05; break; - case '1': SectorsCnt = 16; break; - case '2': SectorsCnt = 32; break; - case '4': SectorsCnt = 40; break; - default: SectorsCnt = 16; - } + switch (cmdp) { + case 'o': + case 'O': + cmdp = 'o'; + trgBlockNo = param_get8(Cmd, 4); + ctmp = param_getchar(Cmd, 5); + if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') { + PrintAndLog("Target key type must be A or B"); + return 1; + } + if (ctmp != 'A' && ctmp != 'a') + trgKeyType = 1; + break; + case '0': SectorsCnt = 05; break; + case '1': SectorsCnt = 16; break; + case '2': SectorsCnt = 32; break; + case '4': SectorsCnt = 40; break; + default: SectorsCnt = 16; } ctmp = param_getchar(Cmd, 4); - if (ctmp == 't' || ctmp == 'T') transferToEml = true; - else if (ctmp == 'd' || ctmp == 'D') createDumpFile = true; + transferToEml |= (ctmp == 't' || ctmp == 'T'); + createDumpFile |= (ctmp == 'd' || ctmp == 'D'); ctmp = param_getchar(Cmd, 6); transferToEml |= (ctmp == 't' || ctmp == 'T'); - transferToEml |= (ctmp == 'd' || ctmp == 'D'); + createDumpFile |= (ctmp == 'd' || ctmp == 'D'); + // check if we can authenticate to sector + res = mfCheckKeys(blockNo, keyType, true, 1, key, &key64); + if (res) { + PrintAndLog("Can't authenticate to block:%3d key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6)); + return 3; + } + + // one-sector nested if (cmdp == 'o') { PrintAndLog("--target block no:%3d, target key type:%c ", trgBlockNo, trgKeyType?'B':'A'); int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true); @@ -671,6 +678,24 @@ int CmdHF14AMfNested(const char *Cmd) } } } + + // get known key + if (false) { + key64 = bytes_to_num(keyBlock, 6); + for (i = 0; i < SectorsCnt; i++) { + for (j = 0; j < 2; j++) { + if (e_sector[i].foundKey[j] && e_sector[i].Key[j] == key64) { + // get here + break; + } + } + + // Can't found a key.... + if (i == SectorsCnt - 1) { + + } + } + } // nested sectors iterations = 0; From 09ccaf8b2b6cc133564b2321852ee3d681aa54c9 Mon Sep 17 00:00:00 2001 From: merlokk Date: Thu, 27 Jul 2017 13:23:15 +0300 Subject: [PATCH 10/17] small fix to nested --- client/cmdhfmf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index 4c402b2d..3a6f8240 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -575,6 +575,7 @@ int CmdHF14AMfNested(const char *Cmd) case 'O': cmdp = 'o'; trgBlockNo = param_get8(Cmd, 4); + ctmp = param_getchar(Cmd, 5); if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') { PrintAndLog("Target key type must be A or B"); @@ -637,6 +638,7 @@ int CmdHF14AMfNested(const char *Cmd) else num_to_bytes(key64, 6, &keyBlock[10]); mfEmlSetMem(keyBlock, sectortrailer, 1); + PrintAndLog("Key transferred to emulator memory."); } } else { PrintAndLog("No valid key found"); @@ -755,6 +757,7 @@ int CmdHF14AMfNested(const char *Cmd) num_to_bytes(e_sector[i].Key[1], 6, &keyBlock[10]); mfEmlSetMem(keyBlock, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1); } + PrintAndLog("Keys transferred to emulator memory."); } // Create dump file From 136dde0bb9b95c0fafdf69feac709d35ca62a6d1 Mon Sep 17 00:00:00 2001 From: merlokk Date: Thu, 27 Jul 2017 13:43:25 +0300 Subject: [PATCH 11/17] fix nested bug in finding known keys procedure --- client/cmdhfmf.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index 3a6f8240..709437fe 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -516,6 +516,7 @@ typedef struct { } sector_t; +# define NESTED_KEY_COUNT 15 int CmdHF14AMfNested(const char *Cmd) { int i, j, res, iterations; @@ -526,7 +527,7 @@ int CmdHF14AMfNested(const char *Cmd) uint8_t trgKeyType = 0; uint8_t SectorsCnt = 0; uint8_t key[6] = {0, 0, 0, 0, 0, 0}; - uint8_t keyBlock[14 * 6]; + uint8_t keyBlock[NESTED_KEY_COUNT * 6]; uint64_t key64 = 0; bool transferToEml = false; @@ -542,6 +543,7 @@ int CmdHF14AMfNested(const char *Cmd) PrintAndLog(" all sectors: hf mf nested [t,d]"); PrintAndLog(" one sector: hf mf nested o "); PrintAndLog(" [t]"); +// PrintAndLog(" all sectors autosearch key: hf mf nested s [t,d]"); PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, - 1K"); PrintAndLog("t - transfer keys into emulator memory"); PrintAndLog("d - write keys to binary file"); @@ -666,13 +668,14 @@ int CmdHF14AMfNested(const char *Cmd) num_to_bytes(0xa0478cc39091, 6, (uint8_t*)(keyBlock + 11 * 6)); num_to_bytes(0x533cb6c723f6, 6, (uint8_t*)(keyBlock + 12 * 6)); num_to_bytes(0x8fd0a4f256e9, 6, (uint8_t*)(keyBlock + 13 * 6)); + num_to_bytes(0x1a2b3c4d5e6f, 6, (uint8_t*)(keyBlock + 14 * 6)); PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt); for (i = 0; i < SectorsCnt; i++) { for (j = 0; j < 2; j++) { if (e_sector[i].foundKey[j]) continue; - res = mfCheckKeys(FirstBlockOfSector(i), j, true, 6, keyBlock, &key64); + res = mfCheckKeys(FirstBlockOfSector(i), j, true, NESTED_KEY_COUNT, keyBlock, &key64); // bbbuuuuggg!!!!!!!! if (!res) { e_sector[i].Key[j] = key64; @@ -681,6 +684,18 @@ int CmdHF14AMfNested(const char *Cmd) } } + +// PrintAndLog("---- known key:"); +// PrintAndLog("|sec|key A |res|key B |res|"); +// for (i = 0; i < SectorsCnt; i++) { +// PrintAndLog("|%03d| %012" PRIx64 " | %d | %012" PRIx64 " | %d |", i, +// e_sector[i].Key[0], e_sector[i].foundKey[0], e_sector[i].Key[1], e_sector[i].foundKey[1]); +// } +// PrintAndLog("|---|----------------|---|----------------|---|"); + + +// return 0; + // get known key if (false) { key64 = bytes_to_num(keyBlock, 6); From 2709391d3b176cfe58dee919caafb99a2f147388 Mon Sep 17 00:00:00 2001 From: merlokk Date: Thu, 27 Jul 2017 18:30:27 +0300 Subject: [PATCH 12/17] Added nested auto mode. it checks known keys and thel launches nested --- client/cmdhfmf.c | 118 ++++++++++++++++++++++++++++------------------- 1 file changed, 71 insertions(+), 47 deletions(-) diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index 709437fe..34e9be32 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -529,6 +529,8 @@ int CmdHF14AMfNested(const char *Cmd) uint8_t key[6] = {0, 0, 0, 0, 0, 0}; uint8_t keyBlock[NESTED_KEY_COUNT * 6]; uint64_t key64 = 0; + + bool autosearchKey = false; bool transferToEml = false; bool createDumpFile = false; @@ -543,7 +545,7 @@ int CmdHF14AMfNested(const char *Cmd) PrintAndLog(" all sectors: hf mf nested [t,d]"); PrintAndLog(" one sector: hf mf nested o "); PrintAndLog(" [t]"); -// PrintAndLog(" all sectors autosearch key: hf mf nested s [t,d]"); + PrintAndLog(" all sectors autosearch key: hf mf nested * [t,d]"); PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, - 1K"); PrintAndLog("t - transfer keys into emulator memory"); PrintAndLog("d - write keys to binary file"); @@ -556,22 +558,6 @@ int CmdHF14AMfNested(const char *Cmd) } cmdp = param_getchar(Cmd, 0); - blockNo = param_get8(Cmd, 1); - - ctmp = param_getchar(Cmd, 2); - if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') { - PrintAndLog("Key type must be A or B"); - return 1; - } - - if (ctmp != 'A' && ctmp != 'a') - keyType = 1; - - if (param_gethex(Cmd, 3, key, 12)) { - PrintAndLog("Key must include 12 HEX symbols"); - return 1; - } - switch (cmdp) { case 'o': case 'O': @@ -593,19 +579,43 @@ int CmdHF14AMfNested(const char *Cmd) default: SectorsCnt = 16; } - ctmp = param_getchar(Cmd, 4); - transferToEml |= (ctmp == 't' || ctmp == 'T'); - createDumpFile |= (ctmp == 'd' || ctmp == 'D'); + if (param_getchar(Cmd, 1) == '*') { + autosearchKey = true; - ctmp = param_getchar(Cmd, 6); - transferToEml |= (ctmp == 't' || ctmp == 'T'); - createDumpFile |= (ctmp == 'd' || ctmp == 'D'); + ctmp = param_getchar(Cmd, 2); + transferToEml |= (ctmp == 't' || ctmp == 'T'); + createDumpFile |= (ctmp == 'd' || ctmp == 'D'); + } else { + blockNo = param_get8(Cmd, 1); - // check if we can authenticate to sector - res = mfCheckKeys(blockNo, keyType, true, 1, key, &key64); - if (res) { - PrintAndLog("Can't authenticate to block:%3d key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6)); - return 3; + ctmp = param_getchar(Cmd, 2); + if (ctmp != 'a' && ctmp != 'A' && ctmp != 'b' && ctmp != 'B') { + PrintAndLog("Key type must be A or B"); + return 1; + } + + if (ctmp != 'A' && ctmp != 'a') + keyType = 1; + + if (param_gethex(Cmd, 3, key, 12)) { + PrintAndLog("Key must include 12 HEX symbols"); + return 1; + } + + ctmp = param_getchar(Cmd, 4); + transferToEml |= (ctmp == 't' || ctmp == 'T'); + createDumpFile |= (ctmp == 'd' || ctmp == 'D'); + + ctmp = param_getchar(Cmd, 6); + transferToEml |= (ctmp == 't' || ctmp == 'T'); + createDumpFile |= (ctmp == 'd' || ctmp == 'D'); + + // check if we can authenticate to sector + res = mfCheckKeys(blockNo, keyType, true, 1, key, &key64); + if (res) { + PrintAndLog("Can't authenticate to block:%3d key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6)); + return 3; + } } // one-sector nested @@ -675,7 +685,7 @@ int CmdHF14AMfNested(const char *Cmd) for (j = 0; j < 2; j++) { if (e_sector[i].foundKey[j]) continue; - res = mfCheckKeys(FirstBlockOfSector(i), j, true, NESTED_KEY_COUNT, keyBlock, &key64); // bbbuuuuggg!!!!!!!! + res = mfCheckKeys(FirstBlockOfSector(i), j, true, NESTED_KEY_COUNT, keyBlock, &key64); if (!res) { e_sector[i].Key[j] = key64; @@ -685,35 +695,49 @@ int CmdHF14AMfNested(const char *Cmd) } -// PrintAndLog("---- known key:"); -// PrintAndLog("|sec|key A |res|key B |res|"); -// for (i = 0; i < SectorsCnt; i++) { -// PrintAndLog("|%03d| %012" PRIx64 " | %d | %012" PRIx64 " | %d |", i, -// e_sector[i].Key[0], e_sector[i].foundKey[0], e_sector[i].Key[1], e_sector[i].foundKey[1]); -// } -// PrintAndLog("|---|----------------|---|----------------|---|"); -// return 0; - // get known key - if (false) { - key64 = bytes_to_num(keyBlock, 6); + + + + PrintAndLog("---- known key:"); + PrintAndLog("|sec|key A |res|key B |res|"); + for (i = 0; i < SectorsCnt; i++) { + PrintAndLog("|%03d| %012" PRIx64 " | %d | %012" PRIx64 " | %d |", i, + e_sector[i].Key[0], e_sector[i].foundKey[0], e_sector[i].Key[1], e_sector[i].foundKey[1]); + } + PrintAndLog("|---|----------------|---|----------------|---|"); + + + // get known key from array + bool keyFound = false; + if (autosearchKey) { for (i = 0; i < SectorsCnt; i++) { for (j = 0; j < 2; j++) { - if (e_sector[i].foundKey[j] && e_sector[i].Key[j] == key64) { - // get here + if (e_sector[i].foundKey[j]) { + // get known key + blockNo = i * 4; + keyType = j; + num_to_bytes(e_sector[i].Key[j], 6, key); + + keyFound = true; break; } } - - // Can't found a key.... - if (i == SectorsCnt - 1) { - - } + if (keyFound) break; } + + // Can't found a key.... + if (!keyFound) { + PrintAndLog("Can't found any of the known keys."); + return 4; + } + PrintAndLog("--auto key. block no:%3d, key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6)); } +// return 0; + // nested sectors iterations = 0; PrintAndLog("nested..."); From 5780d83edffb5f6ee18063ce271896f1512d5443 Mon Sep 17 00:00:00 2001 From: merlokk Date: Thu, 27 Jul 2017 18:38:01 +0300 Subject: [PATCH 13/17] small fix in nested --- client/cmdhfmf.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index 34e9be32..0ecda419 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -736,8 +736,6 @@ int CmdHF14AMfNested(const char *Cmd) PrintAndLog("--auto key. block no:%3d, key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6)); } -// return 0; - // nested sectors iterations = 0; PrintAndLog("nested..."); @@ -773,9 +771,9 @@ int CmdHF14AMfNested(const char *Cmd) } } - printf("Time in nested: %1.3f (%1.3f sec per key)\n\n", ((float)(msclock() - msclock1))/1000.0, ((float)(msclock() - msclock1))/iterations/1000.0); - + // print result PrintAndLog("-----------------------------------------------\nIterations count: %d\n\n", iterations); + printf("Time in nested: %1.3f (%1.3f sec per key)\n\n", ((float)(msclock() - msclock1))/1000.0, ((float)(msclock() - msclock1))/iterations/1000.0); //print them PrintAndLog("|---|----------------|---|----------------|---|"); PrintAndLog("|sec|key A |res|key B |res|"); @@ -786,7 +784,7 @@ int CmdHF14AMfNested(const char *Cmd) } PrintAndLog("|---|----------------|---|----------------|---|"); - // transfer them to the emulator + // transfer keys to the emulator memory if (transferToEml) { for (i = 0; i < SectorsCnt; i++) { mfEmlGetMem(keyBlock, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1); From 560aad9a32bc98d32c6390d871b1dddf43ff18a6 Mon Sep 17 00:00:00 2001 From: merlokk Date: Thu, 27 Jul 2017 19:14:48 +0300 Subject: [PATCH 14/17] Check if we allready have keys after nested --- client/cmdhfmf.c | 95 +++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 77 insertions(+), 18 deletions(-) diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index 0ecda419..59ac3131 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -694,22 +694,6 @@ int CmdHF14AMfNested(const char *Cmd) } } - - - - - - - - PrintAndLog("---- known key:"); - PrintAndLog("|sec|key A |res|key B |res|"); - for (i = 0; i < SectorsCnt; i++) { - PrintAndLog("|%03d| %012" PRIx64 " | %d | %012" PRIx64 " | %d |", i, - e_sector[i].Key[0], e_sector[i].foundKey[0], e_sector[i].Key[1], e_sector[i].foundKey[1]); - } - PrintAndLog("|---|----------------|---|----------------|---|"); - - // get known key from array bool keyFound = false; if (autosearchKey) { @@ -770,10 +754,85 @@ int CmdHF14AMfNested(const char *Cmd) } } } + + // check if we have unrecognized keys + bool notFoundKeys = false; + for (i = 0; i < SectorsCnt; i++) { + for (j = 0; j < 2; j++) { + if (!e_sector[i].foundKey[j]) { + notFoundKeys = true; + break; + } + } + if (notFoundKeys) break; + } + + + + + + + + + + PrintAndLog("---- found key:"); + for (i = 0; i < SectorsCnt; i++) { + PrintAndLog("|%03d| %012" PRIx64 " | %d | %012" PRIx64 " | %d |", i, + e_sector[i].Key[0], e_sector[i].foundKey[0], e_sector[i].Key[1], e_sector[i].foundKey[1]); + } + + if (notFoundKeys) { + PrintAndLog("-----------------------------------------------\n"); + PrintAndLog("We have unrecognized keys. Trying to check if we have this keys on key buffer..."); + + // fill keyBlock with known keys + int cnt = 0; + for (i = 0; i < SectorsCnt; i++) { + for (j = 0; j < 2; j++) { + if (e_sector[i].foundKey[j]) { + // try to insert key to keyBlock + if (cnt < NESTED_KEY_COUNT) { + + // search for dublicates + bool dubl = false; + for (int v = 0; v < NESTED_KEY_COUNT; v++) { + if (e_sector[i].Key[j] == bytes_to_num((uint8_t*)(keyBlock + v * 6), 6)) { + dubl = true; + break; + } + } + + // insert + if (!dubl) { + num_to_bytes(e_sector[i].Key[j], 6, (uint8_t*)(keyBlock + cnt * 6)); + cnt++; + } + } + } + } + } + + // try to auth with known keys to not recognized sectors keys + PrintAndLog("Testing keys. Sector count=%d", SectorsCnt); + for (i = 0; i < SectorsCnt; i++) { + for (j = 0; j < 2; j++) { + if (e_sector[i].foundKey[j]) continue; + + res = mfCheckKeys(FirstBlockOfSector(i), j, true, cnt, keyBlock, &key64); + + if (!res) { + e_sector[i].Key[j] = key64; + e_sector[i].foundKey[j] = 1; + } + } + } + + } // if (notFoundKeys) + // print result - PrintAndLog("-----------------------------------------------\nIterations count: %d\n\n", iterations); - printf("Time in nested: %1.3f (%1.3f sec per key)\n\n", ((float)(msclock() - msclock1))/1000.0, ((float)(msclock() - msclock1))/iterations/1000.0); + PrintAndLog("-----------------------------------------------\nIterations count: %d", iterations); + printf("Time in nested: %1.3f (%1.3f sec per key)\n\n\n", ((float)(msclock() - msclock1))/1000.0, ((float)(msclock() - msclock1))/iterations/1000.0); //print them PrintAndLog("|---|----------------|---|----------------|---|"); PrintAndLog("|sec|key A |res|key B |res|"); From 3229f3efd0c7c57a760b879136f8f79be364c1a7 Mon Sep 17 00:00:00 2001 From: merlokk Date: Thu, 27 Jul 2017 19:19:42 +0300 Subject: [PATCH 15/17] nested. updated a debug messages --- client/cmdhfmf.c | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index 59ac3131..44ee0ed0 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -766,24 +766,9 @@ int CmdHF14AMfNested(const char *Cmd) } if (notFoundKeys) break; } - - - - - - - - - - - PrintAndLog("---- found key:"); - for (i = 0; i < SectorsCnt; i++) { - PrintAndLog("|%03d| %012" PRIx64 " | %d | %012" PRIx64 " | %d |", i, - e_sector[i].Key[0], e_sector[i].foundKey[0], e_sector[i].Key[1], e_sector[i].foundKey[1]); - } if (notFoundKeys) { - PrintAndLog("-----------------------------------------------\n"); + PrintAndLog("\n\n-----------------------------------------------\n"); PrintAndLog("We have unrecognized keys. Trying to check if we have this keys on key buffer..."); // fill keyBlock with known keys @@ -814,7 +799,7 @@ int CmdHF14AMfNested(const char *Cmd) } // try to auth with known keys to not recognized sectors keys - PrintAndLog("Testing keys. Sector count=%d", SectorsCnt); + PrintAndLog("Testing keys. Sector count=%d keys count:%d", SectorsCnt, cnt); for (i = 0; i < SectorsCnt; i++) { for (j = 0; j < 2; j++) { if (e_sector[i].foundKey[j]) continue; From db0f112d140cc16c10fe137cbeb6861f5839c3f0 Mon Sep 17 00:00:00 2001 From: merlokk Date: Thu, 27 Jul 2017 19:37:34 +0300 Subject: [PATCH 16/17] nested. fix some debug messages --- client/cmdhfmf.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index 44ee0ed0..65668e4e 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -754,6 +754,10 @@ int CmdHF14AMfNested(const char *Cmd) } } } + + // print nested statistic + PrintAndLog("\n\n-----------------------------------------------\nNested statistic:\nIterations count: %d", iterations); + PrintAndLog("Time in nested: %1.3f (%1.3f sec per key)", ((float)(msclock() - msclock1))/1000.0, ((float)(msclock() - msclock1))/iterations/1000.0); // check if we have unrecognized keys bool notFoundKeys = false; @@ -768,7 +772,7 @@ int CmdHF14AMfNested(const char *Cmd) } if (notFoundKeys) { - PrintAndLog("\n\n-----------------------------------------------\n"); + PrintAndLog("-----------------------------------------------\n"); PrintAndLog("We have unrecognized keys. Trying to check if we have this keys on key buffer..."); // fill keyBlock with known keys @@ -799,7 +803,7 @@ int CmdHF14AMfNested(const char *Cmd) } // try to auth with known keys to not recognized sectors keys - PrintAndLog("Testing keys. Sector count=%d keys count:%d", SectorsCnt, cnt); + PrintAndLog("Testing keys. Sector count=%d known keys count:%d", SectorsCnt, cnt); for (i = 0; i < SectorsCnt; i++) { for (j = 0; j < 2; j++) { if (e_sector[i].foundKey[j]) continue; @@ -816,9 +820,6 @@ int CmdHF14AMfNested(const char *Cmd) } // if (notFoundKeys) // print result - PrintAndLog("-----------------------------------------------\nIterations count: %d", iterations); - printf("Time in nested: %1.3f (%1.3f sec per key)\n\n\n", ((float)(msclock() - msclock1))/1000.0, ((float)(msclock() - msclock1))/iterations/1000.0); - //print them PrintAndLog("|---|----------------|---|----------------|---|"); PrintAndLog("|sec|key A |res|key B |res|"); PrintAndLog("|---|----------------|---|----------------|---|"); From b596441c5cbd8c8367e5b3623440f12b8e507b39 Mon Sep 17 00:00:00 2001 From: merlokk Date: Thu, 27 Jul 2017 20:05:06 +0300 Subject: [PATCH 17/17] nested. added some help messages --- client/cmdhfmf.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index 65668e4e..e78d5e2f 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -546,14 +546,16 @@ int CmdHF14AMfNested(const char *Cmd) PrintAndLog(" one sector: hf mf nested o "); PrintAndLog(" [t]"); PrintAndLog(" all sectors autosearch key: hf mf nested * [t,d]"); + PrintAndLog(" "); PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, - 1K"); - PrintAndLog("t - transfer keys into emulator memory"); - PrintAndLog("d - write keys to binary file"); + PrintAndLog("t - transfer keys to emulator memory"); + PrintAndLog("d - write keys to binary file dumpkeys.bin"); PrintAndLog(" "); PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF "); PrintAndLog(" sample2: hf mf nested 1 0 A FFFFFFFFFFFF t "); PrintAndLog(" sample3: hf mf nested 1 0 A FFFFFFFFFFFF d "); PrintAndLog(" sample4: hf mf nested o 0 A FFFFFFFFFFFF 4 A"); + PrintAndLog(" sample5: hf mf nested 1 * t"); return 0; }