FIX: I did a clean up of the "LF PCF7931" code. The write command is not quite done.

FIX: Added some more "clearCommandBuffer" calls before sending..
This commit is contained in:
iceman1001 2015-10-12 21:30:54 +02:00
parent 5ee53a0e75
commit 2285d9dd94
5 changed files with 151 additions and 146 deletions

View file

@ -939,7 +939,6 @@ bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) {
//-----------------------------------------------------------------------------
void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
{
//Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
// This can be used in a reader-only attack.
// (it can also be retrieved via 'hf 14a list', but hey...
@ -1436,7 +1435,7 @@ void PrepareDelayedTransfer(uint16_t delay)
uint8_t bitmask = 0;
uint8_t bits_to_shift = 0;
uint8_t bits_shifted = 0;
delay &= 0x07;
if (delay) {
for (uint16_t i = 0; i < delay; i++) {

View file

@ -122,10 +122,11 @@ int CmdHF14AMfWrBl(const char *Cmd)
PrintAndLog("--block no:%d, key type:%c, key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));
PrintAndLog("--data: %s", sprint_hex(bldata, 16));
UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};
UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};
memcpy(c.d.asBytes, key, 6);
memcpy(c.d.asBytes + 10, bldata, 16);
SendCommand(&c);
clearCommandBuffer();
SendCommand(&c);
UsbCommand resp;
if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
@ -166,9 +167,10 @@ int CmdHF14AMfRdBl(const char *Cmd)
}
PrintAndLog("--block no:%d, key type:%c, key:%s ", blockNo, keyType?'B':'A', sprint_hex(key, 6));
UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};
UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};
memcpy(c.d.asBytes, key, 6);
SendCommand(&c);
clearCommandBuffer();
SendCommand(&c);
UsbCommand resp;
if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
@ -221,6 +223,7 @@ int CmdHF14AMfRdSc(const char *Cmd)
UsbCommand c = {CMD_MIFARE_READSC, {sectorNo, keyType, 0}};
memcpy(c.d.asBytes, key, 6);
clearCommandBuffer();
SendCommand(&c);
PrintAndLog(" ");
@ -327,6 +330,7 @@ int CmdHF14AMfDump(const char *Cmd)
for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {
UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 0, 0}};
memcpy(c.d.asBytes, keyA[sectorNo], 6);
clearCommandBuffer();
SendCommand(&c);
if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
@ -361,6 +365,7 @@ int CmdHF14AMfDump(const char *Cmd)
if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. At least the Access Conditions can always be read with key A.
UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};
memcpy(c.d.asBytes, keyA[sectorNo], 6);
clearCommandBuffer();
SendCommand(&c);
received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
} else { // data block. Check if it can be read with key A or key B
@ -376,6 +381,7 @@ int CmdHF14AMfDump(const char *Cmd)
} else { // key A would work
UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};
memcpy(c.d.asBytes, keyA[sectorNo], 6);
clearCommandBuffer();
SendCommand(&c);
received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
}
@ -468,7 +474,6 @@ int CmdHF14AMfRestore(const char *Cmd)
for (sectorNo = 0; sectorNo < numSectors; sectorNo++) {
if (fread(keyA[sectorNo], 1, 6, fkeys) == 0) {
PrintAndLog("File reading error (dumpkeys.bin).");
fclose(fkeys);
return 2;
}
@ -519,6 +524,7 @@ int CmdHF14AMfRestore(const char *Cmd)
PrintAndLog("Writing to block %3d: %s", FirstBlockOfSector(sectorNo) + blockNo, sprint_hex(bldata, 16));
memcpy(c.d.asBytes + 10, bldata, 16);
clearCommandBuffer();
SendCommand(&c);
UsbCommand resp;
@ -1024,8 +1030,6 @@ int CmdHF14AMf1kSim(const char *Cmd)
uint8_t cmdp = param_getchar(Cmd, 0);
clearCommandBuffer();
if (cmdp == 'h' || cmdp == 'H') {
PrintAndLog("Usage: hf mf sim u <uid (8 hex symbols)> n <numreads> i x");
PrintAndLog(" h this help");
@ -1072,6 +1076,7 @@ int CmdHF14AMf1kSim(const char *Cmd)
UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};
memcpy(c.d.asBytes, uid, sizeof(uid));
clearCommandBuffer();
SendCommand(&c);
if(flags & FLAG_INTERACTIVE)
@ -1132,10 +1137,10 @@ int CmdHF14AMfDbg(const char *Cmd)
return 0;
}
UsbCommand c = {CMD_MIFARE_SET_DBGMODE, {dbgMode, 0, 0}};
SendCommand(&c);
UsbCommand c = {CMD_MIFARE_SET_DBGMODE, {dbgMode, 0, 0}};
SendCommand(&c);
return 0;
return 0;
}
int CmdHF14AMfEGet(const char *Cmd)
@ -1169,12 +1174,11 @@ int CmdHF14AMfEClear(const char *Cmd)
return 0;
}
UsbCommand c = {CMD_MIFARE_EML_MEMCLR, {0, 0, 0}};
SendCommand(&c);
return 0;
UsbCommand c = {CMD_MIFARE_EML_MEMCLR, {0, 0, 0}};
SendCommand(&c);
return 0;
}
int CmdHF14AMfESet(const char *Cmd)
{
uint8_t memBlock[16];
@ -1202,7 +1206,6 @@ int CmdHF14AMfESet(const char *Cmd)
return 0;
}
int CmdHF14AMfELoad(const char *Cmd)
{
FILE * f;
@ -1215,7 +1218,7 @@ int CmdHF14AMfELoad(const char *Cmd)
uint8_t blockWidth = 32;
char ctmp = param_getchar(Cmd, 0);
if ( ctmp == 'h' || ctmp == 0x00) {
if ( ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) {
PrintAndLog("It loads emul dump from the file `filename.eml`");
PrintAndLog("Usage: hf mf eload [card memory] <file name w/o `.eml`>");
PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K, u = UL");
@ -1299,7 +1302,6 @@ int CmdHF14AMfELoad(const char *Cmd)
return 0;
}
int CmdHF14AMfESave(const char *Cmd)
{
FILE * f;
@ -1385,7 +1387,6 @@ int CmdHF14AMfESave(const char *Cmd)
return 0;
}
int CmdHF14AMfECFill(const char *Cmd)
{
uint8_t keyType = 0;
@ -1425,15 +1426,16 @@ int CmdHF14AMfECFill(const char *Cmd)
return 0;
}
int CmdHF14AMfEKeyPrn(const char *Cmd)
{
int i;
uint8_t numSectors;
uint8_t data[16];
uint64_t keyA, keyB;
char cmdp = param_getchar(Cmd, 0);
if (param_getchar(Cmd, 0) == 'h') {
if ( cmdp == 'h' || cmdp == 'H' ) {
PrintAndLog("It prints the keys loaded in the emulator memory");
PrintAndLog("Usage: hf mf ekeyprn [card memory]");
PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");
@ -1442,8 +1444,6 @@ int CmdHF14AMfEKeyPrn(const char *Cmd)
return 0;
}
char cmdp = param_getchar(Cmd, 0);
switch (cmdp) {
case '0' : numSectors = 5; break;
case '1' :
@ -1470,7 +1470,6 @@ int CmdHF14AMfEKeyPrn(const char *Cmd)
return 0;
}
int CmdHF14AMfCSetUID(const char *Cmd)
{
uint8_t wipeCard = 0;
@ -1574,7 +1573,6 @@ int CmdHF14AMfCSetBlk(const char *Cmd)
return 0;
}
int CmdHF14AMfCLoad(const char *Cmd)
{
FILE * f;
@ -1584,8 +1582,10 @@ int CmdHF14AMfCLoad(const char *Cmd)
uint8_t buf8[64] = {0x00};
uint8_t fillFromEmulator = 0;
int i, len, blockNum, flags=0;
char ctmp = param_getchar(Cmd, 0);
if (param_getchar(Cmd, 0) == 'h' || param_getchar(Cmd, 0)== 0x00) {
if (ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) {
PrintAndLog("It loads magic Chinese card from the file `filename.eml`");
PrintAndLog("or from emulator memory (option `e`)");
PrintAndLog("Usage: hf mf cload <file name w/o `.eml`>");
@ -1594,7 +1594,6 @@ int CmdHF14AMfCLoad(const char *Cmd)
return 0;
}
char ctmp = param_getchar(Cmd, 0);
if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;
if (fillFromEmulator) {
@ -1701,7 +1700,6 @@ int CmdHF14AMfCGetBlk(const char *Cmd) {
return 0;
}
int CmdHF14AMfCGetSc(const char *Cmd) {
uint8_t memBlock[16] = {0x00};
uint8_t sectorNo = 0;
@ -1738,7 +1736,6 @@ int CmdHF14AMfCGetSc(const char *Cmd) {
return 0;
}
int CmdHF14AMfCSave(const char *Cmd) {
FILE * f;
@ -1750,8 +1747,9 @@ int CmdHF14AMfCSave(const char *Cmd) {
// memset(filename, 0, sizeof(filename));
// memset(buf, 0, sizeof(buf));
if (param_getchar(Cmd, 0) == 'h') {
char ctmp = param_getchar(Cmd, 0);
if ( ctmp == 'h' || ctmp == 'H' ) {
PrintAndLog("It saves `magic Chinese` card dump into the file `filename.eml` or `cardID.eml`");
PrintAndLog("or into emulator memory (option `e`)");
PrintAndLog("Usage: hf mf esave [file name w/o `.eml`][e]");
@ -1760,8 +1758,6 @@ int CmdHF14AMfCSave(const char *Cmd) {
PrintAndLog(" hf mf esave e \n");
return 0;
}
char ctmp = param_getchar(Cmd, 0);
if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;
if (fillFromEmulator) {
@ -1833,7 +1829,6 @@ int CmdHF14AMfCSave(const char *Cmd) {
}
}
int CmdHF14AMfSniff(const char *Cmd){
bool wantLogToFile = 0;
@ -1982,7 +1977,7 @@ int CmdHF14AMfSniff(const char *Cmd){
}
//needs nt, ar, at, Data to decrypt
int CmdDecryptTraceCmds(const char *Cmd){
int CmdHf14MfDecryptBytes(const char *Cmd){
uint8_t data[50];
uint32_t nt = param_get32ex(Cmd,0,0,16);
@ -2028,7 +2023,7 @@ static command_t CommandTable[] =
{"cgetsc", CmdHF14AMfCGetSc, 0, "Read sector - Magic Chinese card"},
{"cload", CmdHF14AMfCLoad, 0, "Load dump into magic Chinese card"},
{"csave", CmdHF14AMfCSave, 0, "Save dump from magic Chinese card into file or emulator"},
{"decrypt", CmdDecryptTraceCmds, 1, "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace"},
{"decrypt", CmdHf14MfDecryptBytes, 1, "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace"},
{NULL, NULL, 0, NULL}
};

View file

@ -21,132 +21,146 @@
static int CmdHelp(const char *Cmd);
struct pcf7931_config configPcf = {{0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF},17500,{0,0}};
#define PCF7931_DEFAULT_INITDELAY 17500
#define PCF7931_DEFAULT_OFFSET_WIDTH 0
#define PCF7931_DEFAULT_OFFSET_POSITION 0
int usage_pcf7931_read()
{
// Default values - Configuration
struct pcf7931_config configPcf = {
{0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF},
PCF7931_DEFAULT_INITDELAY,
{
PCF7931_DEFAULT_OFFSET_WIDTH,
PCF7931_DEFAULT_OFFSET_POSITION
}
};
// Resets the configuration settings to default values.
int pcf7931_resetConfig(){
memset(configPcf.Pwd, 0xFF, sizeof(configPcf.Pwd) );
configPcf.InitDelay = PCF7931_DEFAULT_INITDELAY;
configPcf.Offset[0] = PCF7931_DEFAULT_OFFSET_WIDTH;
configPcf.Offset[1] = PCF7931_DEFAULT_OFFSET_POSITION;
return 0;
}
int pcf7931_printConfig(){
PrintAndLog("Password (LSB first on bytes) : %s", sprint_hex( configPcf.Pwd, sizeof(configPcf.Pwd)));
PrintAndLog("Tag initialization delay : %d us", configPcf.InitDelay);
PrintAndLog("Offset low pulses width : %d us", configPcf.Offset[0]);
PrintAndLog("Offset low pulses position : %d us", configPcf.Offset[1]);
return 0;
}
int usage_pcf7931_read(){
PrintAndLog("Usage: lf pcf7931 read [h] ");
PrintAndLog("This command tries to read a PCF7931 tag.");
PrintAndLog("Options: ");
PrintAndLog(" h This help");
PrintAndLog("Options:");
PrintAndLog(" h This help");
PrintAndLog("Examples:");
PrintAndLog(" lf pcf7931 read");
return 0;
}
int CmdLFPCF7931Read(const char *Cmd)
{
uint8_t cmdp = 0;
if (param_getchar(Cmd, cmdp) == 'H' || param_getchar(Cmd, cmdp) == 'h')
return usage_pcf7931_read();
UsbCommand c = {CMD_PCF7931_READ};
clearCommandBuffer();
SendCommand(&c);
UsbCommand resp;
WaitForResponse(CMD_ACK,&resp);
int usage_pcf7931_write(){
PrintAndLog("Usage: lf pcf7931 write [h] <block address> <byte address> <data>");
PrintAndLog("This command tries to write a PCF7931 tag.");
PrintAndLog("Options:");
PrintAndLog(" h This help");
PrintAndLog(" blockaddress Block to save");
PrintAndLog(" byteaddress Index of byte inside block to overwrite");
PrintAndLog(" data one byte of data");
PrintAndLog("Examples:");
PrintAndLog(" lf pcf7931 write 10 1 FF");
return 0;
}
int CmdLFPCF7931Config(const char *Cmd)
{
int res = 0;
// res = sscanf(Cmd,
// "%02x %02x %hu %hu %hu %hu %hu %hhu %hd %hd",
// &configPcf.password[0],
// &configPcf.password[1],
// &configPcf.password[2],
// &configPcf.password[3],
// &configPcf.password[4],
// &configPcf.password[5],
// &configPcf.password[6],
// &configPcf.init_delay,
// &configPcf.offset[0],
// &configPcf.offset[1]);
if (res >= 7 || res < 1){
if(res == 7) configPcf.init_delay = 17500; //default value
if(res<=8){
configPcf.offset[0] = 0; //default value
configPcf.offset[1] = 0; //default value
}
if(res < 1){
PrintAndLog("Usage: <password byte 1 (in hex, lsb first)> <password byte 2 (in hex, lsb first)> [...] <password byte 7 (in hex, lsb first)> <tag initialization delay (in us)> <optional : offset on the low pulses width (in us)> <optional : offset on the low pulses position (in us)>");
PrintAndLog("The time offsets could be usefull to correct slew rate generated by the antenna.");
}
PrintAndLog("Current configuration :");
PrintAndLog("Password (LSB first on each byte) : %02x %02x %02x %02x %02x %02x %02x", configPcf.password[0], configPcf.password[1], configPcf.password[2], configPcf.password[3], configPcf.password[4], configPcf.password[5], configPcf.password[6]);
PrintAndLog("Tag initialization delay : %d us", configPcf.init_delay);
PrintAndLog("Offsets : %d us on the low pulses width, %d us on the low pulses positions", configPcf.offset[0], configPcf.offset[1]);
return 0;
}
//default values
configPcf.password[0] = 0xFF;
configPcf.password[1] = 0xFF;
configPcf.password[2] = 0xFF;
configPcf.password[3] = 0xFF;
configPcf.password[4] = 0xFF;
configPcf.password[5] = 0xFF;
configPcf.password[6] = 0xFF;
configPcf.init_delay = 17500;
configPcf.offset[0] = 0;
configPcf.offset[1] = 0;
PrintAndLog("Incorrect format");
PrintAndLog("Examples of right usage : lf pcf7931 config 11 22 33 44 55 66 77 20000");
PrintAndLog(" lf pcf7931 config FF FF FF FF FF FF FF 17500 -10 30");
return 0;
int usage_pcf7931_config(){
PrintAndLog("Usage: lf pcf7931 config [h] [r] <pwd> <delay> <offset width> <offset position>");
PrintAndLog("This command tries to set the configuration used with PCF7931 commands");
PrintAndLog("The time offsets could be useful to correct slew rate generated by the antenna");
PrintAndLog("Caling without some parameter will print the current configuration.");
PrintAndLog("Options:");
PrintAndLog(" h This help");
PrintAndLog(" r Reset configuration to default values");
PrintAndLog(" pwd Password, hex, 7bytes, LSB-order");
PrintAndLog(" delay Tag initialization delay (in us) decimal");
PrintAndLog(" offset Low pulses width (in us) decimal");
PrintAndLog(" offset Low pulses position (in us) decimal");
PrintAndLog("Examples:");
PrintAndLog(" lf pcf7931 config");
PrintAndLog(" lf pcf7931 config r");
PrintAndLog(" lf pcf7931 config 11223344556677 20000");
PrintAndLog(" lf pcf7931 config 11223344556677 17500 -10 30");
return 0;
}
int CmdLFPCF7931Write(const char *Cmd)
{
UsbCommand c = {CMD_PCF7931_WRITE};
int CmdLFPCF7931Read(const char *Cmd){
int res = 0;
res = sscanf(Cmd, "%" SCNu64 " %" SCNu64 " %" SCNu64 , &c.arg[0], &c.arg[1], &c.arg[2]);
uint8_t ctmp = param_getchar(Cmd, 0);
if ( ctmp == 'H' || ctmp == 'h' ) return usage_pcf7931_read();
if(res < 1) {
PrintAndLog("Please specify the block address in hex");
return 1;
}
if (res == 1){
PrintAndLog("Please specify the byte address in hex");
return 2;
}
if(res == 2) {
PrintAndLog("Please specify the data in hex (1 byte)");
return 3;
}
if(res == 3) {
UsbCommand resp;
UsbCommand c = {CMD_PCF7931_READ, {0, 0, 0}};
clearCommandBuffer();
SendCommand(&c);
if ( !WaitForResponseTimeout(CMD_ACK, &resp, 2500) ) {
PrintAndLog("command execution time out");
return 1;
}
return 0;
}
memcpy(c.d.asDwords, configPcf.password, 7);
int CmdLFPCF7931Config(const char *Cmd){
uint8_t ctmp = param_getchar(Cmd, 0);
if ( ctmp == 0) return pcf7931_printConfig();
if ( ctmp == 'H' || ctmp == 'h' ) return usage_pcf7931_config();
if ( ctmp == 'R' || ctmp == 'r' ) return pcf7931_resetConfig();
if ( param_gethex(Cmd, 0, configPcf.Pwd, 14) ) return usage_pcf7931_config();
c.d.asDwords[7] = (configPcf.offset[0]+128);
c.d.asDwords[8] = (configPcf.offset[1]+128);
c.d.asDwords[9] = configPcf.init_delay;
configPcf.InitDelay = (param_get32ex(Cmd,1,0,10) & 0xFFFF);
configPcf.Offset[0] = (int)(param_get32ex(Cmd,2,0,10) & 0xFFFF);
configPcf.Offset[1] = (int)(param_get32ex(Cmd,3,0,10) & 0xFFFF);
pcf7931_printConfig();
return 0;
}
int CmdLFPCF7931Write(const char *Cmd){
uint8_t ctmp = param_getchar(Cmd, 0);
if (strlen(Cmd) < 1 || ctmp == 'h' || ctmp == 'H') return usage_pcf7931_write();
uint64_t blockaddress = param_get64ex(Cmd, 0, 0, 16);
uint64_t byteaddress = param_get64ex(Cmd, 1, 0, 16);
uint8_t data = param_get8ex(Cmd,2,0,16);
PrintAndLog("Please specify the block address in hex");
PrintAndLog("Please specify the byte address in hex");
PrintAndLog("Please specify the data in hex (1 byte)");
PrintAndLog("", blockaddress, byteaddress, data);
return 3;
UsbCommand c = {CMD_PCF7931_WRITE, { blockaddress, byteaddress, data} };
memcpy(c.d.asDwords, configPcf.Pwd, 7);
c.d.asDwords[7] = (configPcf.Offset[0]+128);
c.d.asDwords[8] = (configPcf.Offset[1]+128);
c.d.asDwords[9] = configPcf.InitDelay;
clearCommandBuffer();
SendCommand(&c);
return 0;
}
PrintAndLog("INCORRECT FORMAT");
return 0;
SendCommand(&c);
//no ack?
return 0;
}
static command_t CommandTable[] =
{
{"help", CmdHelp, 1, "This help"},
{"read", CmdLFPCF7931Read, 1, "Read content of a PCF7931 transponder"},
{"write", CmdLFPCF7931Write, 1, "Write data on a PCF7931 transponder. Usage : lf pcf7931 write <bloc address> <byte address> <data>"},
{"write", CmdLFPCF7931Write, 1, "Write data on a PCF7931 transponder."},
{"config", CmdLFPCF7931Config, 1, "Configure the password, the tags initialization delay and time offsets (optional)"},
{NULL, NULL, 0, NULL}
};

View file

@ -13,9 +13,9 @@
#define CMDLFPCF7931_H__
struct pcf7931_config{
uint8_t password[7];
uint16_t init_delay;
int16_t offset[2];
uint8_t Pwd[7];
uint16_t InitDelay;
int16_t Offset[2];
};
int CmdLFPCF7931(const char *Cmd);

View file

@ -219,14 +219,11 @@ int CmdT55xxReadBlock(const char *Cmd) {
int password = 0xFFFFFFFF; //default to blank Block 7
char cmdp = param_getchar(Cmd, 0);
if (cmdp == 'h' || cmdp == 'H')
return usage_t55xx_read();
if (cmdp == 'h' || cmdp == 'H') return usage_t55xx_read();
int res = sscanf(Cmd, "%d %x", &block, &password);
if ( res < 1 || res > 2 )
return usage_t55xx_read();
if ( res < 1 || res > 2 ) return usage_t55xx_read();
if ((block < 0) | (block > 7)) {
PrintAndLog("Block must be between 0 and 7");