hf mf dump error handling, revive hf mf chk d option, provide known keys dictionary file

- hf mf dump: abort on unrecoverable errors. Don't create file dumpdata.bin in this case.
- hf mf chk: re-enabled and fixed option d (dump keys to dumpkeys.bin).
  if there are unknown keys, write 0xffffffffffff instead to the file.
- provide a default key dictionary file for hf mf chk (default_keys.dic). Contents taken from
  mf_default_keys.lua
This commit is contained in:
pwpiwi 2014-09-11 20:58:34 +02:00
parent baeaf57950
commit 79db03ef63
2 changed files with 162 additions and 76 deletions

View file

@ -509,6 +509,7 @@ int CmdHF14AMfDump(const char *Cmd)
uint8_t keyA[40][6]; uint8_t keyA[40][6];
uint8_t keyB[40][6]; uint8_t keyB[40][6];
uint8_t rights[40][4]; uint8_t rights[40][4];
uint8_t carddata[256][16];
uint8_t numSectors = 16; uint8_t numSectors = 16;
FILE *fin; FILE *fin;
@ -540,11 +541,6 @@ int CmdHF14AMfDump(const char *Cmd)
return 1; return 1;
} }
if ((fout = fopen("dumpdata.bin","wb")) == NULL) {
PrintAndLog("Could not create file name dumpdata.bin");
return 1;
}
// Read key file // Read key file
for (sectorNo=0; sectorNo<numSectors; sectorNo++) { for (sectorNo=0; sectorNo<numSectors; sectorNo++) {
@ -581,10 +577,12 @@ int CmdHF14AMfDump(const char *Cmd)
rights[sectorNo][2] = ((data[7] & 0x40)>>6) | ((data[8] & 0x4)>>1) | ((data[8] & 0x40)>>4); rights[sectorNo][2] = ((data[7] & 0x40)>>6) | ((data[8] & 0x4)>>1) | ((data[8] & 0x40)>>4);
rights[sectorNo][3] = ((data[7] & 0x80)>>7) | ((data[8] & 0x8)>>2) | ((data[8] & 0x80)>>5); rights[sectorNo][3] = ((data[7] & 0x80)>>7) | ((data[8] & 0x8)>>2) | ((data[8] & 0x80)>>5);
} else { } else {
PrintAndLog("Could not get access rights for sector %2d.", sectorNo); PrintAndLog("Could not get access rights for sector %2d. Trying with defaults...", sectorNo);
rights[sectorNo][0] = rights[sectorNo][1] = rights[sectorNo][2] = rights[sectorNo][3] = 0x01;
} }
} else { } else {
PrintAndLog("Command execute timeout"); PrintAndLog("Command execute timeout when trying to read access rights for sector %2d. Trying with defaults...", sectorNo);
rights[sectorNo][0] = rights[sectorNo][1] = rights[sectorNo][2] = rights[sectorNo][3] = 0x01;
} }
} }
@ -594,9 +592,9 @@ int CmdHF14AMfDump(const char *Cmd)
PrintAndLog("|----- Dumping all blocks to file... -----|"); PrintAndLog("|----- Dumping all blocks to file... -----|");
PrintAndLog("|-----------------------------------------|"); PrintAndLog("|-----------------------------------------|");
bool isOK = true;
for (sectorNo = 0; sectorNo < numSectors; sectorNo++) { for (sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
for (blockNo = 0; blockNo < NumBlocksPerSector(sectorNo); blockNo++) { for (blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
bool received = false; bool received = false;
if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. At least the Access Conditions can always be read with key A. if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. At least the Access Conditions can always be read with key A.
UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}}; UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};
@ -611,6 +609,7 @@ int CmdHF14AMfDump(const char *Cmd)
SendCommand(&c); SendCommand(&c);
received = WaitForResponseTimeout(CMD_ACK,&resp,1500); received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
} else if (rights[sectorNo][data_area] == 7) { // no key would work } else if (rights[sectorNo][data_area] == 7) { // no key would work
isOK = false;
PrintAndLog("Access rights do not allow reading of sector %2d block %3d", sectorNo, blockNo); PrintAndLog("Access rights do not allow reading of sector %2d block %3d", sectorNo, blockNo);
} else { // key A would work } else { // key A would work
UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}}; UsbCommand c = {CMD_MIFARE_READBL, {FirstBlockOfSector(sectorNo) + blockNo, 0, 0}};
@ -621,7 +620,7 @@ int CmdHF14AMfDump(const char *Cmd)
} }
if (received) { if (received) {
uint8_t isOK = resp.arg[0] & 0xff; isOK = resp.arg[0] & 0xff;
uint8_t *data = resp.d.asBytes; uint8_t *data = resp.d.asBytes;
if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. Fill in the keys. if (blockNo == NumBlocksPerSector(sectorNo) - 1) { // sector trailer. Fill in the keys.
data[0] = (keyA[sectorNo][0]); data[0] = (keyA[sectorNo][0]);
@ -638,21 +637,34 @@ int CmdHF14AMfDump(const char *Cmd)
data[15] = (keyB[sectorNo][5]); data[15] = (keyB[sectorNo][5]);
} }
if (isOK) { if (isOK) {
fwrite ( data, 1, 16, fout ); memcpy(carddata[FirstBlockOfSector(sectorNo) + blockNo], data, 16);
PrintAndLog("Dumped block %2d of sector %2d into 'dumpdata.bin'"); PrintAndLog("Successfully read block %2d of sector %2d.", blockNo, sectorNo);
} else { } else {
PrintAndLog("Could not read block %2d of sector %2d", blockNo, sectorNo); PrintAndLog("Could not read block %2d of sector %2d", blockNo, sectorNo);
break;
} }
} }
else { else {
PrintAndLog("Command execute timeout"); isOK = false;
PrintAndLog("Command execute timeout when trying to read block %2d of sector %2d.", blockNo, sectorNo);
break;
} }
} }
} }
if (isOK) {
if ((fout = fopen("dumpdata.bin","wb")) == NULL) {
PrintAndLog("Could not create file name dumpdata.bin");
return 1;
}
uint16_t numblocks = FirstBlockOfSector(numSectors - 1) + NumBlocksPerSector(numSectors - 1);
fwrite(carddata, 1, 16*numblocks, fout);
fclose(fout);
PrintAndLog("Dumped %d blocks (%d bytes) to file dumpdata.bin", numblocks, 16*numblocks);
}
fclose(fin); fclose(fin);
fclose(fout);
return 0; return 0;
} }
@ -792,9 +804,9 @@ int CmdHF14AMfNested(const char *Cmd)
PrintAndLog("d - write keys to binary file"); PrintAndLog("d - write keys to binary file");
PrintAndLog(" "); PrintAndLog(" ");
PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF "); PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF ");
PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF t "); PrintAndLog(" sample2: hf mf nested 1 0 A FFFFFFFFFFFF t ");
PrintAndLog(" sample1: hf mf nested 1 0 A FFFFFFFFFFFF d "); PrintAndLog(" sample3: hf mf nested 1 0 A FFFFFFFFFFFF d ");
PrintAndLog(" sample2: hf mf nested o 0 A FFFFFFFFFFFF 4 A"); PrintAndLog(" sample4: hf mf nested o 0 A FFFFFFFFFFFF 4 A");
return 0; return 0;
} }
@ -988,19 +1000,6 @@ int CmdHF14AMfNested(const char *Cmd)
} }
static uint32_t get_trailer_block (uint32_t uiBlock)
{
// Test if we are in the small or big sectors
uint32_t trailer_block = 0;
if (uiBlock < 128) {
trailer_block = uiBlock + (3 - (uiBlock % 4));
} else {
trailer_block = uiBlock + (15 - (uiBlock % 16));
}
return trailer_block;
}
int CmdHF14AMfChk(const char *Cmd) int CmdHF14AMfChk(const char *Cmd)
{ {
FILE * f; FILE * f;
@ -1050,8 +1049,7 @@ int CmdHF14AMfChk(const char *Cmd)
PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t] [<key (12 hex symbols)>] [<dic (*.dic)>]"); PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t] [<key (12 hex symbols)>] [<dic (*.dic)>]");
PrintAndLog(" * - all sectors"); PrintAndLog(" * - all sectors");
PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K"); PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");
// PrintAndLog("d - write keys to binary file\n"); PrintAndLog("d - write keys to binary file\n");
PrintAndLog(" sample: hf mf chk 0 A 1234567890ab keys.dic"); PrintAndLog(" sample: hf mf chk 0 A 1234567890ab keys.dic");
PrintAndLog(" hf mf chk *1 ? t"); PrintAndLog(" hf mf chk *1 ? t");
return 0; return 0;
@ -1161,10 +1159,22 @@ int CmdHF14AMfChk(const char *Cmd)
(keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4], (keyBlock + 6*keycnt)[5], 6); (keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4], (keyBlock + 6*keycnt)[5], 6);
} }
// initialize storage for found keys
bool validKey[2][40];
uint8_t foundKey[2][40][6];
for (uint16_t t = 0; t < 2; t++) {
for (uint16_t sectorNo = 0; sectorNo < SectorsCnt; sectorNo++) {
validKey[t][sectorNo] = false;
for (uint16_t i = 0; i < 6; i++) {
foundKey[t][sectorNo][i] = 0xff;
}
}
}
for ( int t = !keyType; t < 2; keyType==2?(t++):(t=2) ) { for ( int t = !keyType; t < 2; keyType==2?(t++):(t=2) ) {
int b=blockNo; int b=blockNo;
for (int i = 0; i < SectorsCnt; ++i) { for (int i = 0; i < SectorsCnt; ++i) {
PrintAndLog("--SectorsCnt:%2d, block no:%3d, key type:%C, key count:%2d ", i, b, t?'B':'A', keycnt); PrintAndLog("--sector:%2d, block:%3d, key type:%C, key count:%2d ", i, b, t?'B':'A', keycnt);
uint32_t max_keys = keycnt>USB_CMD_DATA_SIZE/6?USB_CMD_DATA_SIZE/6:keycnt; uint32_t max_keys = keycnt>USB_CMD_DATA_SIZE/6?USB_CMD_DATA_SIZE/6:keycnt;
for (uint32_t c = 0; c < keycnt; c+=max_keys) { for (uint32_t c = 0; c < keycnt; c+=max_keys) {
uint32_t size = keycnt-c>max_keys?max_keys:keycnt-c; uint32_t size = keycnt-c>max_keys?max_keys:keycnt-c;
@ -1172,12 +1182,8 @@ int CmdHF14AMfChk(const char *Cmd)
if (res != 1) { if (res != 1) {
if (!res) { if (!res) {
PrintAndLog("Found valid key:[%012"llx"]",key64); PrintAndLog("Found valid key:[%012"llx"]",key64);
if (transferToEml) { num_to_bytes(key64, 6, foundKey[t][i]);
uint8_t block[16]; validKey[t][i] = true;
mfEmlGetMem(block, get_trailer_block(b), 1);
num_to_bytes(key64, 6, block + t*10);
mfEmlSetMem(block, get_trailer_block(b), 1);
}
} }
} else { } else {
PrintAndLog("Command execute timeout"); PrintAndLog("Command execute timeout");
@ -1187,41 +1193,42 @@ int CmdHF14AMfChk(const char *Cmd)
} }
} }
free(keyBlock); if (transferToEml) {
uint8_t block[16];
for (uint16_t sectorNo = 0; sectorNo < SectorsCnt; sectorNo++) {
if (validKey[0][sectorNo] || validKey[1][sectorNo]) {
mfEmlGetMem(block, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1);
for (uint16_t t = 0; t < 2; t++) {
if (validKey[t][sectorNo]) {
memcpy(block + t*10, foundKey[t][sectorNo], 6);
}
}
mfEmlSetMem(block, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1);
}
}
PrintAndLog("Found keys have been transferred to the emulator memory");
}
/*
// Create dump file
if (createDumpFile) { if (createDumpFile) {
if ((fkeys = fopen("dumpkeys.bin","wb")) == NULL) { FILE *fkeys = fopen("dumpkeys.bin","wb");
if (fkeys == NULL) {
PrintAndLog("Could not create file dumpkeys.bin"); PrintAndLog("Could not create file dumpkeys.bin");
free(e_sector); free(keyBlock);
return 1; return 1;
} }
PrintAndLog("Printing keys to binary file dumpkeys.bin..."); for (uint16_t t = 0; t < 2; t++) {
for(i=0; i<16; i++) { fwrite(foundKey[t], 1, 6*SectorsCnt, fkeys);
if (e_sector[i].foundKey[0]){
num_to_bytes(e_sector[i].Key[0], 6, tempkey);
fwrite ( tempkey, 1, 6, fkeys );
}
else{
fwrite ( &standart, 1, 6, fkeys );
}
}
for(i=0; i<16; i++) {
if (e_sector[i].foundKey[1]){
num_to_bytes(e_sector[i].Key[1], 6, tempkey);
fwrite ( tempkey, 1, 6, fkeys );
}
else{
fwrite ( &standart, 1, 6, fkeys );
}
} }
fclose(fkeys); fclose(fkeys);
PrintAndLog("Found keys have been dumped to file dumpkeys.bin. 0xffffffffffff has been inserted for unknown keys.");
} }
*/
free(keyBlock);
return 0; return 0;
} }
int CmdHF14AMf1kSim(const char *Cmd) int CmdHF14AMf1kSim(const char *Cmd)
{ {
uint8_t uid[7] = {0, 0, 0, 0, 0, 0, 0}; uint8_t uid[7] = {0, 0, 0, 0, 0, 0, 0};

79
client/default_keys.dic Normal file
View file

@ -0,0 +1,79 @@
# Default Keys as already in Proxmark.exe:
ffffffffffff,//Defaultkey(firstkeyusedbyprogramifnouserdefinedkey)
000000000000,//Blankkey
a0a1a2a3a4a5,//NFCForumMADkey
b0b1b2b3b4b5,
aabbccddeeff,
4d3a99c351dd,
1a982c7e459a,
d3f7d3f7d3f7,
714c5c886e97,
587ee5f9350f,
a0478cc39091,
533cb6c723f6,
8fd0a4f256e9
# more Keys from mf_default_keys.lua
000000000001,
000000000002,
00000000000a,
00000000000b,
00000ffe2488,--VästtrafikenKeyB
010203040506,
0123456789ab,
0297927c0f77,--VästtrafikenKeyA
100000000000,
111111111111,
123456789abc,
12f2ee3478c1,
14d446e33363,
1999a3554a55,
200000000000,
222222222222,
26940b21ff5d,--RKFSLKeyA
27dd91f1fcf1,
2BA9621E0A36,--DirectoryandeventlogKeyB
333333333333,
33f974b42769,
34d1df9934c5,
434f4d4d4f41,--RKFJOJOGROUPKeyA
434f4d4d4f42,--RKFJOJOGROUPKeyB
43ab19ef5c31,
444444444444,
47524f555041,--RKFJOJOGROUPKeyA
47524f555042,--RKFJOJOGROUPKeyB
4AF9D7ADEBE4,--DirectoryandeventlogKeyA
505249564141,--RKFJOJOPRIVAKeyA
505249564142,--RKFJOJOPRIVAKeyB
505249565441,
505249565442,
54726176656c,--VästtrafikenKeyA
555555555555,
55f5a5dd38c9,
5c598c9c58b5,--RKFSLKeyB
666666666666,
722bfcc5375f,--RKFRejskortDanmarkKeyA
776974687573,--VästtrafikenKeyB
777777777777,
888888888888,
999999999999,
99c636334433,
a00000000000,
a053a292a4af,
a64598a77478,--RKFSLKeyA
a94133013401,
aaaaaaaaaaaa,
abcdef123456,--Keyfromladyada.net
b00000000000,
b127c6f41436,
bbbbbbbbbbbb,
bd493a3962b6,
c934fe34d934,
cccccccccccc,
dddddddddddd,
e4d2770a89be,--RKFSLKeyB
ee0042f88840,--VästtrafikenKeyB
eeeeeeeeeeee,
f1a97341a9fc,
f1d83f964314,--RKFRejskortDanmarkKeyB
fc00018778f7,--VästtrafikenKeyA
fc0001877bf7,--RKFÖstgötaTrafikenKeyA