mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2024-09-21 15:56:21 +08:00
Merge branch 'master' of https://github.com/iceman1001/proxmark3
This commit is contained in:
iceman
commit
b725f2ca21
|
|
@ -1464,7 +1464,6 @@ void PrepareDelayedTransfer(uint16_t delay)
|
|||
//-------------------------------------------------------------------------------------
|
||||
static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing)
|
||||
{
|
||||
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
|
||||
|
||||
uint32_t ThisTransferTime = 0;
|
||||
|
|
@ -1492,9 +1491,8 @@ static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing
|
|||
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
|
||||
AT91C_BASE_SSC->SSC_THR = cmd[c];
|
||||
c++;
|
||||
if(c >= len) {
|
||||
if(c >= len)
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -1508,7 +1506,7 @@ static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing
|
|||
void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8_t *parity)
|
||||
{
|
||||
int i, j;
|
||||
int last;
|
||||
int last = 0;
|
||||
uint8_t b;
|
||||
|
||||
ToSendReset();
|
||||
|
|
@ -1516,7 +1514,6 @@ void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8
|
|||
// Start of Communication (Seq. Z)
|
||||
ToSend[++ToSendMax] = SEC_Z;
|
||||
LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
|
||||
last = 0;
|
||||
|
||||
size_t bytecount = nbytes(bits);
|
||||
// Generate send structure for the data bits
|
||||
|
|
@ -1729,7 +1726,7 @@ int EmSend4bitEx(uint8_t resp, bool correctionNeeded){
|
|||
Code4bitAnswerAsTag(resp);
|
||||
int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
|
||||
// do the tracing for the previous reader request and this tag answer:
|
||||
uint8_t par[1];
|
||||
uint8_t par[1] = {0x00};
|
||||
GetParity(&resp, 1, par);
|
||||
EmLogTrace(Uart.output,
|
||||
Uart.len,
|
||||
|
|
@ -1766,13 +1763,13 @@ int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8
|
|||
}
|
||||
|
||||
int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded){
|
||||
uint8_t par[MAX_PARITY_SIZE];
|
||||
uint8_t par[MAX_PARITY_SIZE] = {0x00};
|
||||
GetParity(resp, respLen, par);
|
||||
return EmSendCmdExPar(resp, respLen, correctionNeeded, par);
|
||||
}
|
||||
|
||||
int EmSendCmd(uint8_t *resp, uint16_t respLen){
|
||||
uint8_t par[MAX_PARITY_SIZE];
|
||||
uint8_t par[MAX_PARITY_SIZE] = {0x00};
|
||||
GetParity(resp, respLen, par);
|
||||
return EmSendCmdExPar(resp, respLen, false, par);
|
||||
}
|
||||
|
|
@ -1793,9 +1790,12 @@ bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_Start
|
|||
uint16_t exact_fdt = (approx_fdt - 20 + 32)/64 * 64 + 20;
|
||||
reader_EndTime = tag_StartTime - exact_fdt;
|
||||
reader_StartTime = reader_EndTime - reader_modlen;
|
||||
if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_EndTime, reader_Parity, TRUE)) {
|
||||
|
||||
if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_EndTime, reader_Parity, TRUE))
|
||||
return FALSE;
|
||||
} else return(!LogTrace(tag_data, tag_len, tag_StartTime, tag_EndTime, tag_Parity, FALSE));
|
||||
else
|
||||
return(!LogTrace(tag_data, tag_len, tag_StartTime, tag_EndTime, tag_Parity, FALSE));
|
||||
|
||||
} else {
|
||||
return TRUE;
|
||||
}
|
||||
|
|
@ -1847,9 +1847,8 @@ void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t
|
|||
LED_A_ON();
|
||||
|
||||
// Log reader command in trace buffer
|
||||
if (tracing) {
|
||||
if (tracing)
|
||||
LogTrace(frame, nbytes(bits), LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_READER, (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_READER, par, TRUE);
|
||||
}
|
||||
}
|
||||
|
||||
void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing)
|
||||
|
|
@ -1860,7 +1859,7 @@ void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *tim
|
|||
void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing)
|
||||
{
|
||||
// Generate parity and redirect
|
||||
uint8_t par[MAX_PARITY_SIZE];
|
||||
uint8_t par[MAX_PARITY_SIZE] = {0x00};
|
||||
GetParity(frame, len/8, par);
|
||||
ReaderTransmitBitsPar(frame, len, par, timing);
|
||||
}
|
||||
|
|
@ -1868,26 +1867,30 @@ void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing)
|
|||
void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing)
|
||||
{
|
||||
// Generate parity and redirect
|
||||
uint8_t par[MAX_PARITY_SIZE];
|
||||
uint8_t par[MAX_PARITY_SIZE] = {0x00};
|
||||
GetParity(frame, len, par);
|
||||
ReaderTransmitBitsPar(frame, len*8, par, timing);
|
||||
}
|
||||
|
||||
int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity)
|
||||
{
|
||||
if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, offset)) return FALSE;
|
||||
if (tracing) {
|
||||
if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, offset))
|
||||
return FALSE;
|
||||
|
||||
if (tracing)
|
||||
LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
|
||||
}
|
||||
|
||||
return Demod.len;
|
||||
}
|
||||
|
||||
int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity)
|
||||
{
|
||||
if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return FALSE;
|
||||
if (tracing) {
|
||||
if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0))
|
||||
return FALSE;
|
||||
|
||||
if (tracing)
|
||||
LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
|
||||
}
|
||||
|
||||
return Demod.len;
|
||||
}
|
||||
|
||||
|
|
@ -2254,7 +2257,7 @@ void ReaderMifare(bool first_try)
|
|||
static byte_t par_low = 0;
|
||||
bool led_on = TRUE;
|
||||
uint8_t uid[10] = {0};
|
||||
uint32_t cuid;
|
||||
uint32_t cuid = 0;
|
||||
|
||||
uint32_t nt = 0;
|
||||
uint32_t previous_nt = 0;
|
||||
|
|
@ -2267,7 +2270,7 @@ void ReaderMifare(bool first_try)
|
|||
static int32_t sync_cycles = 0;
|
||||
int catch_up_cycles = 0;
|
||||
int last_catch_up = 0;
|
||||
uint16_t elapsed_prng_sequences;
|
||||
uint16_t elapsed_prng_sequences = 0;
|
||||
uint16_t consecutive_resyncs = 0;
|
||||
int isOK = 0;
|
||||
|
||||
|
|
@ -2299,8 +2302,8 @@ void ReaderMifare(bool first_try)
|
|||
int16_t debug_info_nr = -1;
|
||||
uint16_t strategy = 0;
|
||||
int32_t debug_info[MAX_STRATEGY][NUM_DEBUG_INFOS];
|
||||
uint32_t select_time;
|
||||
uint32_t halt_time;
|
||||
uint32_t select_time = 0;
|
||||
uint32_t halt_time = 0;
|
||||
|
||||
for(uint16_t i = 0; TRUE; ++i) {
|
||||
|
||||
|
|
@ -2328,6 +2331,7 @@ void ReaderMifare(bool first_try)
|
|||
SpinDelay(200);
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
|
||||
SpinDelay(100);
|
||||
WDT_HIT();
|
||||
}
|
||||
|
||||
if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
|
||||
|
|
@ -2345,10 +2349,11 @@ void ReaderMifare(bool first_try)
|
|||
while(GetCountSspClk() > sync_time) {
|
||||
elapsed_prng_sequences++;
|
||||
sync_time = (sync_time & 0xfffffff8) + sync_cycles;
|
||||
}
|
||||
}
|
||||
|
||||
// Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
|
||||
ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
|
||||
|
||||
} else {
|
||||
// collect some information on tag nonces for debugging:
|
||||
#define DEBUG_FIXED_SYNC_CYCLES PRNG_SEQUENCE_LENGTH
|
||||
|
|
@ -2473,7 +2478,7 @@ void ReaderMifare(bool first_try)
|
|||
} else {
|
||||
if (nt_diff == 0 && first_try) {
|
||||
par[0]++;
|
||||
if (par[0] == 0x00) { // tried all 256 possible parities without success. Card doesn't send NACK.
|
||||
if (par[0] == 0x00) { // tried all 256 possible parities without success. Card doesn't send NACK.
|
||||
isOK = -2;
|
||||
break;
|
||||
}
|
||||
|
|
@ -2483,9 +2488,10 @@ void ReaderMifare(bool first_try)
|
|||
}
|
||||
}
|
||||
|
||||
|
||||
mf_nr_ar[3] &= 0x1F;
|
||||
|
||||
|
||||
WDT_HIT();
|
||||
|
||||
if (isOK == -4) {
|
||||
if (MF_DBGLEVEL >= 3) {
|
||||
for (uint16_t i = 0; i <= MAX_STRATEGY; ++i) {
|
||||
|
|
@ -2544,10 +2550,10 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
|
|||
struct Crypto1State *pcs;
|
||||
pcs = &mpcs;
|
||||
uint32_t numReads = 0;//Counts numer of times reader read a block
|
||||
uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
|
||||
uint8_t receivedCmd_par[MAX_MIFARE_PARITY_SIZE];
|
||||
uint8_t response[MAX_MIFARE_FRAME_SIZE];
|
||||
uint8_t response_par[MAX_MIFARE_PARITY_SIZE];
|
||||
uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE] = {0x00};
|
||||
uint8_t receivedCmd_par[MAX_MIFARE_PARITY_SIZE] = {0x00};
|
||||
uint8_t response[MAX_MIFARE_FRAME_SIZE] = {0x00};
|
||||
uint8_t response_par[MAX_MIFARE_PARITY_SIZE] = {0x00};
|
||||
|
||||
uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k 4BUID
|
||||
uint8_t rUIDBCC1[] = {0xde, 0xad, 0xbe, 0xaf, 0x62};
|
||||
|
|
|
|||
|
|
@ -750,7 +750,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
|
|||
uint16_t davg = 0;
|
||||
static uint16_t dmin, dmax;
|
||||
uint8_t uid[10] = {0x00};
|
||||
uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
|
||||
uint32_t cuid = 0, nt1, nt2, nttmp, nttest, ks1;
|
||||
uint8_t par[1] = {0x00};
|
||||
uint32_t target_nt[2] = {0x00}, target_ks[2] = {0x00};
|
||||
|
||||
|
|
@ -759,7 +759,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
|
|||
struct Crypto1State mpcs = {0, 0};
|
||||
struct Crypto1State *pcs;
|
||||
pcs = &mpcs;
|
||||
uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
|
||||
uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
|
||||
|
||||
uint32_t auth1_time, auth2_time;
|
||||
static uint16_t delta_time;
|
||||
|
|
|
|||
206
client/cmdhfmf.c
206
client/cmdhfmf.c
|
|
@ -54,7 +54,7 @@ start:
|
|||
}
|
||||
|
||||
UsbCommand resp;
|
||||
if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
|
||||
if (WaitForResponseTimeout(CMD_ACK, &resp, 1000)) {
|
||||
isOK = resp.arg[0];
|
||||
uid = (uint32_t)bytes_to_num(resp.d.asBytes + 0, 4);
|
||||
nt = (uint32_t)bytes_to_num(resp.d.asBytes + 4, 4);
|
||||
|
|
@ -93,7 +93,7 @@ start:
|
|||
}
|
||||
t1 = clock() - t1;
|
||||
if ( t1 > 0 ){
|
||||
PrintAndLog("Time in darkside: %f ticks - %1.2f sec\n", (float)t1, ((float)t1)/CLOCKS_PER_SEC);
|
||||
PrintAndLog("Time in darkside: %.0f ticks - %4.2f sec\n (%u)", (float)t1, ((float)t1)/CLOCKS_PER_SEC, CLOCKS_PER_SEC);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -706,7 +706,7 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
|
||||
if (!res) {
|
||||
e_sector[i].Key[j] = key64;
|
||||
e_sector[i].foundKey[j] = 1;
|
||||
e_sector[i].foundKey[j] = TRUE;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -763,39 +763,24 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500)) continue;
|
||||
|
||||
uint8_t isOK = resp.arg[0] & 0xff;
|
||||
if (!isOK) continue;
|
||||
|
||||
uint8_t *data = resp.d.asBytes;
|
||||
|
||||
if (isOK) {
|
||||
|
||||
key64 = bytes_to_num(data+10, 6);
|
||||
if (key64) {
|
||||
PrintAndLog("Data:%s", sprint_hex(data+10, 6));
|
||||
e_sector[i].foundKey[1] = 1;
|
||||
e_sector[i].Key[1] = key64;
|
||||
}
|
||||
key64 = bytes_to_num(data+10, 6);
|
||||
if (key64) {
|
||||
PrintAndLog("Data:%s", sprint_hex(data+10, 6));
|
||||
e_sector[i].foundKey[1] = 1;
|
||||
e_sector[i].Key[1] = key64;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
t1 = clock() - t1;
|
||||
if ( t1 > 0 ) {
|
||||
PrintAndLog("Time in nested: %f ticks %1.2f sec (%1.2f sec per key)\n\n", (float)t1, ((float)t1)/CLOCKS_PER_SEC, ((float)t1)/iterations/CLOCKS_PER_SEC);
|
||||
}
|
||||
if ( t1 > 0 )
|
||||
PrintAndLog("Time in nested: %.0f ticks %4.2f sec (%4.2f sec per key)\n", (float)t1, ((float)t1)/CLOCKS_PER_SEC, ((float)t1)/iterations/CLOCKS_PER_SEC);
|
||||
|
||||
PrintAndLog("-----------------------------------------------\nIterations count: %d\n\n", iterations);
|
||||
//print them
|
||||
PrintAndLog("|---|----------------|---|----------------|---|");
|
||||
PrintAndLog("|sec|key A |res|key B |res|");
|
||||
PrintAndLog("|---|----------------|---|----------------|---|");
|
||||
for (i = 0; i < SectorsCnt; i++) {
|
||||
PrintAndLog("|%03d| %012"llx" | %d | %012"llx" | %d |", i,
|
||||
e_sector[i].Key[0],
|
||||
e_sector[i].foundKey[0],
|
||||
e_sector[i].Key[1],
|
||||
e_sector[i].foundKey[1]
|
||||
);
|
||||
}
|
||||
PrintAndLog("|---|----------------|---|----------------|---|");
|
||||
printKeyTable( SectorsCnt, e_sector );
|
||||
|
||||
// transfer them to the emulator
|
||||
if (transferToEml) {
|
||||
|
|
@ -979,6 +964,8 @@ int CmdHF14AMfChk(const char *Cmd)
|
|||
uint8_t *keyBlock = NULL, *p;
|
||||
uint8_t stKeyBlock = 20;
|
||||
|
||||
sector *e_sector = NULL;
|
||||
|
||||
int i, res;
|
||||
int keycnt = 0;
|
||||
char ctmp = 0x00;
|
||||
|
|
@ -987,6 +974,8 @@ int CmdHF14AMfChk(const char *Cmd)
|
|||
uint8_t keyType = 0;
|
||||
uint64_t key64 = 0;
|
||||
|
||||
uint8_t tempkey[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
|
||||
|
||||
int transferToEml = 0;
|
||||
int createDumpFile = 0;
|
||||
|
||||
|
|
@ -1124,80 +1113,137 @@ int CmdHF14AMfChk(const char *Cmd)
|
|||
}
|
||||
|
||||
// initialize storage for found keys
|
||||
bool validKey[2][40];
|
||||
uint8_t foundKey[2][40][6];
|
||||
for (uint16_t t = 0; t < 2; t++) {
|
||||
for (uint16_t sectorNo = 0; sectorNo < SectorsCnt; sectorNo++) {
|
||||
validKey[t][sectorNo] = false;
|
||||
for (uint16_t i = 0; i < 6; i++) {
|
||||
foundKey[t][sectorNo][i] = 0xff;
|
||||
}
|
||||
}
|
||||
}
|
||||
// time
|
||||
clock_t t1 = clock();
|
||||
|
||||
for ( int t = !keyType; t < 2; keyType==2?(t++):(t=2) ) {
|
||||
int b=blockNo;
|
||||
for (int i = 0; i < SectorsCnt; ++i) {
|
||||
PrintAndLog("--sector:%2d, block:%3d, key type:%C, key count:%2d ", i, b, t?'B':'A', keycnt);
|
||||
uint32_t max_keys = keycnt>USB_CMD_DATA_SIZE/6?USB_CMD_DATA_SIZE/6:keycnt;
|
||||
for (uint32_t c = 0; c < keycnt; c+=max_keys) {
|
||||
uint32_t size = keycnt-c>max_keys?max_keys:keycnt-c;
|
||||
res = mfCheckKeys(b, t, true, size, &keyBlock[6*c], &key64);
|
||||
if (res != 1) {
|
||||
if (!res) {
|
||||
PrintAndLog("Found valid key:[%012"llx"]",key64);
|
||||
num_to_bytes(key64, 6, foundKey[t][i]);
|
||||
validKey[t][i] = true;
|
||||
}
|
||||
} else {
|
||||
PrintAndLog("Command execute timeout");
|
||||
}
|
||||
}
|
||||
b<127?(b+=4):(b+=16);
|
||||
}
|
||||
}
|
||||
t1 = clock() - t1;
|
||||
if ( t1 > 0 ){
|
||||
printf("Time in checkkeys: %f ticks %1.2f sec (%1.2f sec per key)\n\n", (float)t1, ((float)t1)/CLOCKS_PER_SEC, ((float)t1)/keycnt/CLOCKS_PER_SEC);
|
||||
e_sector = calloc(SectorsCnt, sizeof(sector));
|
||||
if (e_sector == NULL) {
|
||||
free(keyBlock);
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (transferToEml) {
|
||||
uint8_t block[16];
|
||||
for (uint16_t sectorNo = 0; sectorNo < SectorsCnt; sectorNo++) {
|
||||
if (validKey[0][sectorNo] || validKey[1][sectorNo]) {
|
||||
mfEmlGetMem(block, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1);
|
||||
for (uint16_t t = 0; t < 2; t++) {
|
||||
if (validKey[t][sectorNo]) {
|
||||
memcpy(block + t*10, foundKey[t][sectorNo], 6);
|
||||
}
|
||||
uint8_t trgKeyType = 0;
|
||||
|
||||
// time
|
||||
clock_t t1 = clock();
|
||||
|
||||
// check keys.
|
||||
for (trgKeyType = 0; trgKeyType < 2; ++trgKeyType) {
|
||||
int b = blockNo;
|
||||
for (int i = 0; i < SectorsCnt; ++i) {
|
||||
|
||||
// skip already found keys.
|
||||
if (e_sector[i].foundKey[trgKeyType]) continue;
|
||||
|
||||
PrintAndLog("--sector:%2d, block:%3d, key type:%C, key count:%2d ", i, b, trgKeyType ? 'B':'A', keycnt);
|
||||
|
||||
uint32_t max_keys = keycnt > (USB_CMD_DATA_SIZE/6) ? (USB_CMD_DATA_SIZE/6) : keycnt;
|
||||
|
||||
for (uint32_t c = 0; c < keycnt; c += max_keys) {
|
||||
|
||||
uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c;
|
||||
|
||||
res = mfCheckKeys(b, trgKeyType, true, size, &keyBlock[6*c], &key64);
|
||||
if (!res) {
|
||||
PrintAndLog("Found valid key:[%012"llx"]",key64);
|
||||
e_sector[i].Key[trgKeyType] = key64;
|
||||
e_sector[i].foundKey[trgKeyType] = TRUE;
|
||||
break;
|
||||
} else {
|
||||
e_sector[i].Key[trgKeyType] = 0xffffffffffff;
|
||||
e_sector[i].foundKey[trgKeyType] = FALSE;
|
||||
}
|
||||
mfEmlSetMem(block, FirstBlockOfSector(sectorNo) + NumBlocksPerSector(sectorNo) - 1, 1);
|
||||
}
|
||||
b < 127 ? ( b +=4 ) : ( b += 16 );
|
||||
}
|
||||
}
|
||||
// 20160116 If Sector A is found, but not Sector B, try just reading it of the tag?
|
||||
PrintAndLog("testing to read B...");
|
||||
for (i = 0; i < SectorsCnt; i++) {
|
||||
// KEY A but not KEY B
|
||||
if ( e_sector[i].foundKey[0] && !e_sector[i].foundKey[1] ) {
|
||||
|
||||
uint8_t sectrail = (FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1);
|
||||
|
||||
UsbCommand c = {CMD_MIFARE_READBL, {sectrail, 0, 0}};
|
||||
num_to_bytes(e_sector[i].Key[0], 6, c.d.asBytes); // KEY A
|
||||
clearCommandBuffer();
|
||||
SendCommand(&c);
|
||||
|
||||
UsbCommand resp;
|
||||
if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500)) continue;
|
||||
|
||||
uint8_t isOK = resp.arg[0] & 0xff;
|
||||
if (!isOK) continue;
|
||||
|
||||
uint8_t *data = resp.d.asBytes;
|
||||
key64 = bytes_to_num(data+10, 6);
|
||||
if (key64) {
|
||||
PrintAndLog("Data:%s", sprint_hex(data+10, 6));
|
||||
e_sector[i].foundKey[1] = 1;
|
||||
e_sector[i].Key[1] = key64;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
t1 = clock() - t1;
|
||||
if ( t1 > 0 )
|
||||
printf("Time in checkkeys: %.0f ticks %1.2f sec (%1.2f sec per key)\n\n", (float)t1, ((float)t1)/CLOCKS_PER_SEC, ((float)t1)/keycnt/CLOCKS_PER_SEC);
|
||||
|
||||
//print them
|
||||
printKeyTable( SectorsCnt, e_sector );
|
||||
|
||||
if (transferToEml) {
|
||||
uint8_t block[16] = {0x00};
|
||||
for (uint8_t i = 0; i < SectorsCnt; ++i ) {
|
||||
mfEmlGetMem(block, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1);
|
||||
if (e_sector[i].foundKey[0])
|
||||
num_to_bytes(e_sector[i].Key[0], 6, block);
|
||||
if (e_sector[i].foundKey[1])
|
||||
num_to_bytes(e_sector[i].Key[1], 6, block+10);
|
||||
mfEmlSetMem(block, FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1, 1);
|
||||
}
|
||||
PrintAndLog("Found keys have been transferred to the emulator memory");
|
||||
}
|
||||
|
||||
|
||||
if (createDumpFile) {
|
||||
FILE *fkeys = fopen("dumpkeys.bin","wb");
|
||||
if (fkeys == NULL) {
|
||||
PrintAndLog("Could not create file dumpkeys.bin");
|
||||
free(keyBlock);
|
||||
free(e_sector);
|
||||
return 1;
|
||||
}
|
||||
for (uint16_t t = 0; t < 2; t++) {
|
||||
fwrite(foundKey[t], 1, 6*SectorsCnt, fkeys);
|
||||
PrintAndLog("Printing keys to binary file dumpkeys.bin...");
|
||||
|
||||
for( i=0; i<SectorsCnt; i++) {
|
||||
num_to_bytes(e_sector[i].Key[0], 6, tempkey);
|
||||
fwrite ( tempkey, 1, 6, fkeys );
|
||||
}
|
||||
for(i=0; i<SectorsCnt; i++) {
|
||||
num_to_bytes(e_sector[i].Key[1], 6, tempkey);
|
||||
fwrite ( tempkey, 1, 6, fkeys );
|
||||
}
|
||||
fclose(fkeys);
|
||||
PrintAndLog("Found keys have been dumped to file dumpkeys.bin. 0xffffffffffff has been inserted for unknown keys.");
|
||||
PrintAndLog("Found keys have been dumped to file dumpkeys.bin. 0xffffffffffff has been inserted for unknown keys.");
|
||||
}
|
||||
|
||||
|
||||
free(keyBlock);
|
||||
free(e_sector);
|
||||
PrintAndLog("");
|
||||
return 0;
|
||||
}
|
||||
|
||||
void printKeyTable( uint8_t sectorscnt, sector *e_sector ){
|
||||
PrintAndLog("|---|----------------|---|----------------|---|");
|
||||
PrintAndLog("|sec|key A |res|key B |res|");
|
||||
PrintAndLog("|---|----------------|---|----------------|---|");
|
||||
for (uint8_t i = 0; i < sectorscnt; ++i) {
|
||||
PrintAndLog("|%03d| %012"llx" | %d | %012"llx" | %d |", i,
|
||||
e_sector[i].Key[0], e_sector[i].foundKey[0],
|
||||
e_sector[i].Key[1], e_sector[i].foundKey[1]
|
||||
);
|
||||
}
|
||||
PrintAndLog("|---|----------------|---|----------------|---|");
|
||||
}
|
||||
|
||||
int CmdHF14AMf1kSim(const char *Cmd)
|
||||
{
|
||||
uint8_t uid[7] = {0, 0, 0, 0, 0, 0, 0};
|
||||
|
|
|
|||
|
|
@ -56,4 +56,5 @@ int CmdHF14AMfCLoad(const char* cmd);
|
|||
int CmdHF14AMfCSave(const char* cmd);
|
||||
int CmdHf14MfDecryptBytes(const char *Cmd);
|
||||
|
||||
void printKeyTable( uint8_t sectorscnt, sector *e_sector );
|
||||
#endif
|
||||
|
|
|
|||
|
|
@ -33,8 +33,8 @@ int CmdHF14AMfDESAuth(const char *Cmd){
|
|||
|
||||
uint8_t blockNo = 0;
|
||||
//keyNo=0;
|
||||
uint32_t cuid=0;
|
||||
uint8_t reply[16];
|
||||
uint32_t cuid = 0;
|
||||
uint8_t reply[16] = {0x00};
|
||||
//DES_cblock r1_b1;
|
||||
uint8_t b1[8]={ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
|
||||
uint8_t b2[8]={ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
|
||||
|
|
@ -126,8 +126,8 @@ int CmdHF14AMfAESAuth(const char *Cmd){
|
|||
|
||||
uint8_t blockNo = 0;
|
||||
//keyNo=0;
|
||||
uint32_t cuid=0;
|
||||
uint8_t reply[32];
|
||||
uint32_t cuid = 0;
|
||||
uint8_t reply[32] = {0x00};
|
||||
//DES_cblock r1_b1;
|
||||
//unsigned char * b1, b2, nr, b0, r0, r1;
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue