@iceman1001 s coverity fixes

resource leak in hf mf sniff
possible overflow in hf 14a raw - add check to fix
This commit is contained in:
marshmellow42 2016-02-14 11:26:00 -05:00
parent 33c795d0bd
commit fd9172d5c2
2 changed files with 203 additions and 167 deletions

View file

@ -352,16 +352,16 @@ int CmdHF14AReader(const char *Cmd)
PrintAndLog(" x0 -> <1 kByte");
break;
case 0x01:
PrintAndLog(" x1 -> 1 kByte");
PrintAndLog(" x0 -> 1 kByte");
break;
case 0x02:
PrintAndLog(" x2 -> 2 kByte");
PrintAndLog(" x0 -> 2 kByte");
break;
case 0x03:
PrintAndLog(" x3 -> 4 kByte");
PrintAndLog(" x0 -> 4 kByte");
break;
case 0x04:
PrintAndLog(" x4 -> 8 kByte");
PrintAndLog(" x0 -> 8 kByte");
break;
}
switch (card.ats[pos + 3] & 0xf0) {
@ -458,85 +458,109 @@ int CmdHF14ACUIDs(const char *Cmd)
return 1;
}
// ## simulate iso14443a tag
// ## greg - added ability to specify tag UID
int CmdHF14ASim(const char *Cmd)
{
UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,{0,0,0}};
// Retrieve the tag type
uint8_t tagtype = param_get8ex(Cmd,0,0,10);
// When no argument was given, just print help message
if (tagtype == 0) {
PrintAndLog("");
PrintAndLog(" Emulating ISO/IEC 14443 type A tag with 4 or 7 byte UID");
PrintAndLog("");
PrintAndLog(" syntax: hf 14a sim <type> <uid>");
PrintAndLog(" types: 1 = MIFARE Classic");
int usage_hf_14a_sim(void) {
PrintAndLog("\n Emulating ISO/IEC 14443 type A tag with 4 or 7 byte UID\n");
PrintAndLog("Usage: hf 14a sim t <type> u <uid> x");
PrintAndLog(" Options : ");
PrintAndLog(" h : this help");
PrintAndLog(" t : 1 = MIFARE Classic");
PrintAndLog(" 2 = MIFARE Ultralight");
PrintAndLog(" 3 = MIFARE Desfire");
PrintAndLog(" 4 = ISO/IEC 14443-4");
PrintAndLog(" 5 = MIFARE Tnp3xxx");
PrintAndLog("");
return 1;
PrintAndLog(" 6 = MIFARE Mini");
PrintAndLog(" 7 = NTAG 215 from emu mem");
PrintAndLog(" u : 4 or 7 byte UID");
PrintAndLog(" x : (Optional) performs the 'reader attack', nr/ar attack against a legitimate reader");
PrintAndLog("\n sample : hf 14a sim t 1 u 1122344");
PrintAndLog(" : hf 14a sim t 1 u 1122344 x\n");
return 0;
}
// ## simulate iso14443a tag
// ## greg - added ability to specify tag UID
int CmdHF14ASim(const char *Cmd)
{
bool errors = FALSE;
uint8_t flags = 0;
uint8_t tagtype = 1;
uint64_t uid = 0;
uint8_t cmdp = 0;
// Store the tag type
c.arg[0] = tagtype;
while(param_getchar(Cmd, cmdp) != 0x00)
{
switch(param_getchar(Cmd, cmdp))
{
case 'h':
case 'H':
return usage_hf_14a_sim();
case 't':
case 'T':
// Retrieve the tag type
tagtype = param_get8ex(Cmd, cmdp+1, 0, 10);
if (tagtype == 0)
errors = true;
cmdp += 2;
break;
case 'u':
case 'U':
// Retrieve the full 4 or 7 byte long uid
uint64_t long_uid = param_get64ex(Cmd,1,0,16);
uid = param_get64ex(Cmd, cmdp+1, 0, 16);
if (uid == 0 )
errors = TRUE;
// Are we handling the (optional) second part uid?
if (long_uid > 0xffffffff) {
PrintAndLog("Emulating ISO/IEC 14443 type A tag with 7 byte UID (%014"llx")",long_uid);
// Store the second part
c.arg[2] = (long_uid & 0xffffffff);
long_uid >>= 32;
// Store the first part, ignore the first byte, it is replaced by cascade byte (0x88)
c.arg[1] = (long_uid & 0xffffff);
if (uid > 0xffffffff) {
PrintAndLog("Emulating ISO/IEC 14443 type A tag with 7 byte UID (%014"llx")",uid);
flags |= FLAG_7B_UID_IN_DATA;
} else {
PrintAndLog("Emulating ISO/IEC 14443 type A tag with 4 byte UID (%08x)",long_uid);
// Only store the first part
c.arg[1] = long_uid & 0xffffffff;
PrintAndLog("Emulating ISO/IEC 14443 type A tag with 4 byte UID (%08x)",uid);
flags |= FLAG_4B_UID_IN_DATA;
}
/*
// At lease save the mandatory first part of the UID
c.arg[0] = long_uid & 0xffffffff;
if (c.arg[1] == 0) {
PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
cmdp += 2;
break;
case 'x':
case 'X':
flags |= FLAG_NR_AR_ATTACK;
cmdp++;
break;
default:
PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
errors = true;
break;
}
if(errors) break;
}
switch (c.arg[0]) {
case 1: {
PrintAndLog("Emulating ISO/IEC 14443-3 type A tag with 4 byte UID");
UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
} break;
case 2: {
PrintAndLog("Emulating ISO/IEC 14443-4 type A tag with 7 byte UID");
} break;
default: {
PrintAndLog("Error: unkown tag type (%d)",c.arg[0]);
PrintAndLog("syntax: hf 14a sim <uid>",c.arg[0]);
PrintAndLog(" type1: 4 ",c.arg[0]);
//Validations
if (errors) return usage_hf_14a_sim();
return 1;
} break;
}
*/
/*
unsigned int hi = 0, lo = 0;
int n = 0, i = 0;
while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
hi= (hi << 4) | (lo >> 28);
lo= (lo << 4) | (n & 0xf);
}
*/
// UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
// PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
PrintAndLog("Press pm3-button to abort simulation");
UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,{ tagtype, flags, 0 }};
num_to_bytes(uid, 7, c.d.asBytes);
clearCommandBuffer();
SendCommand(&c);
//uint8_t data[40];
//uint8_t key[6];
UsbCommand resp;
while(!ukbhit()){
if ( WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
if ( (resp.arg[0] & 0xffff) == CMD_SIMULATE_MIFARE_CARD ){
// attempt to get key:
// TODO:
//memset(data, 0x00, sizeof(data));
//memset(key, 0x00, sizeof(key));
//int len = (resp.arg[1] > sizeof(data)) ? sizeof(data) : resp.arg[1];
//memcpy(data, resp.d.asBytes, len);
//tryMfk32(uid, data, key);
//tryMfk32_moebius(uid, data, key);
//tryMfk64(uid, data, key);
//PrintAndLog("--");
}
}
}
return 0;
}
@ -706,6 +730,7 @@ int CmdHF14ACmdRaw(const char *cmd) {
c.arg[0] |= ISO14A_TOPAZMODE;
// Max buffer is USB_CMD_DATA_SIZE
datalen = (datalen > USB_CMD_DATA_SIZE) ? USB_CMD_DATA_SIZE : datalen;
c.arg[1] = (datalen & 0xFFFF) | (numbits << 16);
memcpy(c.d.asBytes,data,datalen);

View file

@ -124,6 +124,7 @@ int CmdHF14AMfWrBl(const char *Cmd)
UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};
memcpy(c.d.asBytes, key, 6);
memcpy(c.d.asBytes + 10, bldata, 16);
clearCommandBuffer();
SendCommand(&c);
UsbCommand resp;
@ -167,6 +168,7 @@ int CmdHF14AMfRdBl(const char *Cmd)
UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};
memcpy(c.d.asBytes, key, 6);
clearCommandBuffer();
SendCommand(&c);
UsbCommand resp;
@ -220,6 +222,7 @@ int CmdHF14AMfRdSc(const char *Cmd)
UsbCommand c = {CMD_MIFARE_READSC, {sectorNo, keyType, 0}};
memcpy(c.d.asBytes, key, 6);
clearCommandBuffer();
SendCommand(&c);
PrintAndLog(" ");
@ -326,6 +329,7 @@ int CmdHF14AMfDump(const char *Cmd)
for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {
UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 0, 0}};
memcpy(c.d.asBytes, keyA[sectorNo], 6);
clearCommandBuffer();
SendCommand(&c);
if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
@ -360,6 +364,7 @@ int CmdHF14AMfDump(const char *Cmd)
if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. At least the Access Conditions can always be read with key A.
UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};
memcpy(c.d.asBytes, keyA[sectorNo], 6);
clearCommandBuffer();
SendCommand(&c);
received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
} else { // data block. Check if it can be read with key A or key B
@ -367,6 +372,7 @@ int CmdHF14AMfDump(const char *Cmd)
if ((rights[sectorNo][data_area] == 0x03) || (rights[sectorNo][data_area] == 0x05)) { // only key B would work
UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 1, 0}};
memcpy(c.d.asBytes, keyB[sectorNo], 6);
clearCommandBuffer();
SendCommand(&c);
received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
} else if (rights[sectorNo][data_area] == 0x07) { // no key would work
@ -375,6 +381,7 @@ int CmdHF14AMfDump(const char *Cmd)
} else { // key A would work
UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};
memcpy(c.d.asBytes, keyA[sectorNo], 6);
clearCommandBuffer();
SendCommand(&c);
received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
}
@ -518,6 +525,7 @@ int CmdHF14AMfRestore(const char *Cmd)
PrintAndLog("Writing to block %3d: %s", FirstBlockOfSector(sectorNo) + blockNo, sprint_hex(bldata, 16));
memcpy(c.d.asBytes + 10, bldata, 16);
clearCommandBuffer();
SendCommand(&c);
UsbCommand resp;
@ -1069,6 +1077,7 @@ int CmdHF14AMf1kSim(const char *Cmd)
UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};
memcpy(c.d.asBytes, uid, sizeof(uid));
clearCommandBuffer();
SendCommand(&c);
if(flags & FLAG_INTERACTIVE)
@ -1144,7 +1153,6 @@ int CmdHF14AMfEClear(const char *Cmd)
return 0;
}
int CmdHF14AMfESet(const char *Cmd)
{
uint8_t memBlock[16];
@ -1172,7 +1180,6 @@ int CmdHF14AMfESet(const char *Cmd)
return 0;
}
int CmdHF14AMfELoad(const char *Cmd)
{
FILE * f;
@ -1182,13 +1189,13 @@ int CmdHF14AMfELoad(const char *Cmd)
uint8_t buf8[64] = {0x00};
int i, len, blockNum, numBlocks;
int nameParamNo = 1;
uint8_t blockWidth = 32;
char ctmp = param_getchar(Cmd, 0);
if ( ctmp == 'h' || ctmp == 0x00) {
PrintAndLog("It loads emul dump from the file `filename.eml`");
PrintAndLog("Usage: hf mf eload [card memory] <file name w/o `.eml`>");
PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");
PrintAndLog("Usage: hf mf eload [card memory] <file name w/o `.eml`> [numblocks]");
PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K, u = UL");
PrintAndLog("");
PrintAndLog(" sample: hf mf eload filename");
PrintAndLog(" hf mf eload 4 filename");
@ -1201,14 +1208,17 @@ int CmdHF14AMfELoad(const char *Cmd)
case '\0': numBlocks = 16*4; break;
case '2' : numBlocks = 32*4; break;
case '4' : numBlocks = 256; break;
case 'U' : // fall through
case 'u' : numBlocks = 255; blockWidth = 8; break;
default: {
numBlocks = 16*4;
nameParamNo = 0;
}
}
uint32_t numblk2 = param_get32ex(Cmd,2,0,10);
if (numblk2 > 0) numBlocks = numblk2;
len = param_getstr(Cmd,nameParamNo,filename);
if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;
fnameptr += len;
@ -1235,19 +1245,18 @@ int CmdHF14AMfELoad(const char *Cmd)
return 2;
}
if (strlen(buf) < 32){
if (strlen(buf) < blockWidth){
if(strlen(buf) && feof(f))
break;
PrintAndLog("File content error. Block data must include 32 HEX symbols");
PrintAndLog("File content error. Block data must include %d HEX symbols", blockWidth);
fclose(f);
return 2;
}
for (i = 0; i < 32; i += 2) {
for (i = 0; i < blockWidth; i += 2) {
sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]);
}
if (mfEmlSetMem(buf8, blockNum, 1)) {
if (mfEmlSetMem_xt(buf8, blockNum, 1, blockWidth/2)) {
PrintAndLog("Cant set emul block: %3d", blockNum);
fclose(f);
return 3;
@ -1268,7 +1277,6 @@ int CmdHF14AMfELoad(const char *Cmd)
return 0;
}
int CmdHF14AMfESave(const char *Cmd)
{
FILE * f;
@ -1354,7 +1362,6 @@ int CmdHF14AMfESave(const char *Cmd)
return 0;
}
int CmdHF14AMfECFill(const char *Cmd)
{
uint8_t keyType = 0;
@ -1394,7 +1401,6 @@ int CmdHF14AMfECFill(const char *Cmd)
return 0;
}
int CmdHF14AMfEKeyPrn(const char *Cmd)
{
int i;
@ -1402,7 +1408,9 @@ int CmdHF14AMfEKeyPrn(const char *Cmd)
uint8_t data[16];
uint64_t keyA, keyB;
if (param_getchar(Cmd, 0) == 'h') {
char cmdp = param_getchar(Cmd, 0);
if ( cmdp == 'h' || cmdp == 'H') {
PrintAndLog("It prints the keys loaded in the emulator memory");
PrintAndLog("Usage: hf mf ekeyprn [card memory]");
PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");
@ -1411,8 +1419,6 @@ int CmdHF14AMfEKeyPrn(const char *Cmd)
return 0;
}
char cmdp = param_getchar(Cmd, 0);
switch (cmdp) {
case '0' : numSectors = 5; break;
case '1' :
@ -1439,7 +1445,6 @@ int CmdHF14AMfEKeyPrn(const char *Cmd)
return 0;
}
int CmdHF14AMfCSetUID(const char *Cmd)
{
uint8_t wipeCard = 0;
@ -1513,7 +1518,7 @@ int CmdHF14AMfCSetBlk(const char *Cmd)
{
uint8_t memBlock[16] = {0x00};
uint8_t blockNo = 0;
bool wipeCard = FALSE;
uint8_t params = MAGIC_SINGLE;
int res;
if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {
@ -1532,10 +1537,12 @@ int CmdHF14AMfCSetBlk(const char *Cmd)
}
char ctmp = param_getchar(Cmd, 2);
wipeCard = (ctmp == 'w' || ctmp == 'W');
if (ctmp == 'w' || ctmp == 'W')
params |= MAGIC_WIPE;
PrintAndLog("--block number:%2d data:%s", blockNo, sprint_hex(memBlock, 16));
res = mfCSetBlock(blockNo, memBlock, NULL, wipeCard, CSETBLOCK_SINGLE_OPER);
res = mfCSetBlock(blockNo, memBlock, NULL, params);
if (res) {
PrintAndLog("Can't write block. error=%d", res);
return 1;
@ -1543,18 +1550,21 @@ int CmdHF14AMfCSetBlk(const char *Cmd)
return 0;
}
int CmdHF14AMfCLoad(const char *Cmd)
{
FILE * f;
char filename[FILE_PATH_SIZE] = {0x00};
char filename[FILE_PATH_SIZE];
char * fnameptr = filename;
char buf[64] = {0x00};
uint8_t buf8[64] = {0x00};
uint8_t fillFromEmulator = 0;
int i, len, blockNum, flags=0;
if (param_getchar(Cmd, 0) == 'h' || param_getchar(Cmd, 0)== 0x00) {
memset(filename, 0, sizeof(filename));
char ctmp = param_getchar(Cmd, 0);
if (ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) {
PrintAndLog("It loads magic Chinese card from the file `filename.eml`");
PrintAndLog("or from emulator memory (option `e`)");
PrintAndLog("Usage: hf mf cload <file name w/o `.eml`>");
@ -1563,7 +1573,6 @@ int CmdHF14AMfCLoad(const char *Cmd)
return 0;
}
char ctmp = param_getchar(Cmd, 0);
if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;
if (fillFromEmulator) {
@ -1572,11 +1581,11 @@ int CmdHF14AMfCLoad(const char *Cmd)
PrintAndLog("Cant get block: %d", blockNum);
return 2;
}
if (blockNum == 0) flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC; // switch on field and send magic sequence
if (blockNum == 0) flags = MAGIC_INIT + MAGIC_WUPC; // switch on field and send magic sequence
if (blockNum == 1) flags = 0; // just write
if (blockNum == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD; // Done. Magic Halt and switch off field.
if (blockNum == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF; // Done. Magic Halt and switch off field.
if (mfCSetBlock(blockNum, buf8, NULL, 0, flags)) {
if (mfCSetBlock(blockNum, buf8, NULL, flags)) {
PrintAndLog("Cant set magic card block: %d", blockNum);
return 3;
}
@ -1619,11 +1628,11 @@ int CmdHF14AMfCLoad(const char *Cmd)
for (i = 0; i < 32; i += 2)
sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]);
if (blockNum == 0) flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC; // switch on field and send magic sequence
if (blockNum == 0) flags = MAGIC_INIT + MAGIC_WUPC; // switch on field and send magic sequence
if (blockNum == 1) flags = 0; // just write
if (blockNum == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD; // Done. Switch off field.
if (blockNum == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF; // Done. Switch off field.
if (mfCSetBlock(blockNum, buf8, NULL, 0, flags)) {
if (mfCSetBlock(blockNum, buf8, NULL, flags)) {
PrintAndLog("Can't set magic card block: %d", blockNum);
return 3;
}
@ -1644,12 +1653,13 @@ int CmdHF14AMfCLoad(const char *Cmd)
}
int CmdHF14AMfCGetBlk(const char *Cmd) {
uint8_t memBlock[16];
uint8_t data[16];
uint8_t blockNo = 0;
int res;
memset(memBlock, 0x00, sizeof(memBlock));
memset(data, 0x00, sizeof(data));
char ctmp = param_getchar(Cmd, 0);
if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {
if (strlen(Cmd) < 1 || ctmp == 'h' || ctmp == 'H') {
PrintAndLog("Usage: hf mf cgetblk <block number>");
PrintAndLog("sample: hf mf cgetblk 1");
PrintAndLog("Get block data from magic Chinese card (only works with such cards)\n");
@ -1660,23 +1670,24 @@ int CmdHF14AMfCGetBlk(const char *Cmd) {
PrintAndLog("--block number:%2d ", blockNo);
res = mfCGetBlock(blockNo, memBlock, CSETBLOCK_SINGLE_OPER);
res = mfCGetBlock(blockNo, data, MAGIC_SINGLE);
if (res) {
PrintAndLog("Can't read block. error=%d", res);
return 1;
}
PrintAndLog("block data:%s", sprint_hex(memBlock, 16));
PrintAndLog("block data:%s", sprint_hex(data, sizeof(data)));
return 0;
}
int CmdHF14AMfCGetSc(const char *Cmd) {
uint8_t memBlock[16] = {0x00};
uint8_t data[16];
uint8_t sectorNo = 0;
int i, res, flags;
memset(data, 0x00, sizeof(data));
char ctmp = param_getchar(Cmd, 0);
if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {
if (strlen(Cmd) < 1 || ctmp == 'h' || ctmp == 'H') {
PrintAndLog("Usage: hf mf cgetsc <sector number>");
PrintAndLog("sample: hf mf cgetsc 0");
PrintAndLog("Get sector data from magic Chinese card (only works with such cards)\n");
@ -1690,37 +1701,37 @@ int CmdHF14AMfCGetSc(const char *Cmd) {
}
PrintAndLog("--sector number:%d ", sectorNo);
PrintAndLog("block | data");
flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC;
flags = MAGIC_INIT + MAGIC_WUPC;
for (i = 0; i < 4; i++) {
if (i == 1) flags = 0;
if (i == 3) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD;
if (i == 3) flags = MAGIC_HALT + MAGIC_OFF;
res = mfCGetBlock(sectorNo * 4 + i, memBlock, flags);
res = mfCGetBlock(sectorNo * 4 + i, data, flags);
if (res) {
PrintAndLog("Can't read block. %d error=%d", sectorNo * 4 + i, res);
return 1;
}
PrintAndLog("block %3d data:%s", sectorNo * 4 + i, sprint_hex(memBlock, 16));
PrintAndLog(" %3d | %s", sectorNo * 4 + i, sprint_hex(data, sizeof(data)));
}
return 0;
}
int CmdHF14AMfCSave(const char *Cmd) {
FILE * f;
char filename[FILE_PATH_SIZE] = {0x00};
char filename[FILE_PATH_SIZE];
char * fnameptr = filename;
uint8_t fillFromEmulator = 0;
uint8_t buf[64] = {0x00};
uint8_t buf[64];
int i, j, len, flags;
// memset(filename, 0, sizeof(filename));
// memset(buf, 0, sizeof(buf));
memset(filename, 0, sizeof(filename));
memset(buf, 0, sizeof(buf));
char ctmp = param_getchar(Cmd, 0);
if (param_getchar(Cmd, 0) == 'h') {
if ( ctmp == 'h' || ctmp == 'H' ) {
PrintAndLog("It saves `magic Chinese` card dump into the file `filename.eml` or `cardID.eml`");
PrintAndLog("or into emulator memory (option `e`)");
PrintAndLog("Usage: hf mf esave [file name w/o `.eml`][e]");
@ -1729,16 +1740,14 @@ int CmdHF14AMfCSave(const char *Cmd) {
PrintAndLog(" hf mf esave e \n");
return 0;
}
char ctmp = param_getchar(Cmd, 0);
if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;
if (fillFromEmulator) {
// put into emulator
flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC;
flags = MAGIC_INIT + MAGIC_WUPC;
for (i = 0; i < 16 * 4; i++) {
if (i == 1) flags = 0;
if (i == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD;
if (i == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF;
if (mfCGetBlock(i, buf, flags)) {
PrintAndLog("Cant get block: %d", i);
@ -1755,14 +1764,14 @@ int CmdHF14AMfCSave(const char *Cmd) {
len = strlen(Cmd);
if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;
// get filename based on UID
if (len < 1) {
// get filename
if (mfCGetBlock(0, buf, CSETBLOCK_SINGLE_OPER)) {
if (mfCGetBlock(0, buf, MAGIC_SINGLE)) {
PrintAndLog("Cant get block: %d", 0);
len = sprintf(fnameptr, "dump");
fnameptr += len;
}
else {
} else {
for (j = 0; j < 7; j++, fnameptr += 2)
sprintf(fnameptr, "%02x", buf[j]);
}
@ -1771,6 +1780,7 @@ int CmdHF14AMfCSave(const char *Cmd) {
fnameptr += len;
}
// add .eml extension
sprintf(fnameptr, ".eml");
// open file
@ -1782,10 +1792,10 @@ int CmdHF14AMfCSave(const char *Cmd) {
}
// put hex
flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC;
flags = MAGIC_INIT + MAGIC_WUPC;
for (i = 0; i < 16 * 4; i++) {
if (i == 1) flags = 0;
if (i == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD;
if (i == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF;
if (mfCGetBlock(i, buf, flags)) {
PrintAndLog("Cant get block: %d", i);
@ -1795,15 +1805,13 @@ int CmdHF14AMfCSave(const char *Cmd) {
fprintf(f, "%02x", buf[j]);
fprintf(f,"\n");
}
fflush(f);
fclose(f);
PrintAndLog("Saved to file: %s", filename);
return 0;
}
}
int CmdHF14AMfSniff(const char *Cmd){
bool wantLogToFile = 0;
@ -1873,7 +1881,10 @@ int CmdHF14AMfSniff(const char *Cmd){
uint16_t traceLen = resp.arg[1];
len = resp.arg[2];
if (res == 0) return 0; // we are done
if (res == 0) {
free(buf);
return 0; // we are done
}
if (res == 1) { // there is (more) data to be transferred
if (pckNum == 0) { // first packet, (re)allocate necessary buffer
@ -1952,7 +1963,7 @@ int CmdHF14AMfSniff(const char *Cmd){
}
//needs nt, ar, at, Data to decrypt
int CmdDecryptTraceCmds(const char *Cmd){
int CmdHf14MfDecryptBytes(const char *Cmd){
uint8_t data[50];
int len = 0;
param_gethex_ex(Cmd,3,data,&len);
@ -1986,7 +1997,7 @@ static command_t CommandTable[] =
{"cgetsc", CmdHF14AMfCGetSc, 0, "Read sector - Magic Chinese card"},
{"cload", CmdHF14AMfCLoad, 0, "Load dump into magic Chinese card"},
{"csave", CmdHF14AMfCSave, 0, "Save dump from magic Chinese card into file or emulator"},
{"decrypt", CmdDecryptTraceCmds,1, "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace"},
{"decrypt", CmdHf14MfDecryptBytes,1, "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace"},
{NULL, NULL, 0, NULL}
};