RfidResearchGroup/proxmark3
1
1
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-01-30 20:07:55 +08:00
Code Issues Projects Releases Packages Wiki Activity

hf mf sniff - working with emulator files

Browse source
This commit is contained in:
Merlokbr@gmail.com 2012-07-17 11:28:12 +00:00
parent 55acbb2a39
commit e0c635d19c
5 changed files with 108 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
client/cmdhfmf.c
View file

@ -1543,8 +1543,8 @@ int CmdHF14AMfCSave(const char *Cmd) {
int CmdHF14AMfSniff(const char *Cmd){
// params
bool wantLogToFile = 0;
bool wantDecrypt = 0;
bool wantLogToFile = 1;
bool wantDecrypt = 1;
bool wantSaveToEml = 0;
bool wantSaveToEmlFile = 0;
@ -1568,7 +1568,7 @@ int CmdHF14AMfSniff(const char *Cmd){
PrintAndLog(" l - save encrypted sequence to logfile `uid.log`");
PrintAndLog(" d - decrypt sequence and put it to log file `uid.log`");
PrintAndLog(" n/a e - decrypt sequence, collect read and write commands and save the result of the sequence to emulator memory");
PrintAndLog(" n/a r - decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`");
PrintAndLog(" r - decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`");
PrintAndLog("Usage: hf mf sniff [l][d][e][r]");
PrintAndLog(" sample: hf mf sniff l d e");
return 0;
@ -1635,14 +1635,14 @@ int CmdHF14AMfSniff(const char *Cmd){
PrintAndLog("tag select uid:%s atqa:%02x %02x sak:0x%02x", sprint_hex(uid, 7), atqa[0], atqa[1], sak);
if (wantLogToFile) {
FillFileNameByUID(logHexFileName, uid, ".log");
FillFileNameByUID(logHexFileName, uid, ".log", 7);
AddLogCurrentDT(logHexFileName);
}
if (wantDecrypt) mfTraceInit(uid, atqa, sak);
if (wantDecrypt) mfTraceInit(uid, atqa, sak, wantSaveToEmlFile);
} else {
PrintAndLog("%s(%d):%s", isTag ? "TAG":"RDR", num, sprint_hex(bufPtr, len));
if (wantLogToFile) AddLogHex(logHexFileName, isTag ? "TAG: ":"RDR: ", bufPtr, len);
if (wantDecrypt) mfTraceDecode(bufPtr, len);
if (wantDecrypt) mfTraceDecode(bufPtr, len, wantSaveToEmlFile);
}
bufPtr += len;
num++;

94
client/mifarehost.c
View file

@ -275,9 +275,13 @@ int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params) {
// SNIFFER
// constants
static uint8_t trailerAccessBytes[4] = {0x08, 0x77, 0x8F, 0x00};
// variables
char logHexFileName[200] = {0x00};
static uint8_t traceCard[4096];
static uint8_t traceCard[4096] = {0x00};
static char traceFileName[20];
static int traceState = TRACE_IDLE;
static uint8_t traceCurBlock = 0;
static uint8_t traceCurKey = 0;
@ -295,13 +299,79 @@ uint32_t nr_enc; // encrypted reader challenge
uint32_t ar_enc; // encrypted reader response
uint32_t at_enc; // encrypted tag response
int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak) {
int isTraceCardEmpty(void) {
return ((traceCard[0] == 0) && (traceCard[1] == 0) && (traceCard[2] == 0) && (traceCard[3] == 0));
}
int isBlockEmpty(int blockN) {
for (int i = 0; i < 16; i++)
if (traceCard[blockN * 16 + i] != 0) return 0;
return 1;
}
int isBlockTrailer(int blockN) {
return ((blockN & 0x03) == 0x03);
}
int loadTraceCard(uint8_t *tuid) {
FILE * f;
char buf[64];
uint8_t buf8[64];
int i, blockNum;
if (!isTraceCardEmpty()) saveTraceCard();
memset(traceCard, 0x00, 4096);
memcpy(traceCard, tuid + 3, 4);
FillFileNameByUID(traceFileName, tuid, ".eml", 7);
f = fopen(traceFileName, "r");
if (!f) return 1;
blockNum = 0;
while(!feof(f)){
memset(buf, 0, sizeof(buf));
fgets(buf, sizeof(buf), f);
if (strlen(buf) < 32){
if (feof(f)) break;
PrintAndLog("File content error. Block data must include 32 HEX symbols");
return 2;
}
for (i = 0; i < 32; i += 2)
sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]);
memcpy(traceCard + blockNum * 16, buf8, 16);
blockNum++;
}
fclose(f);
return 0;
}
int saveTraceCard(void) {
FILE * f;
if ((!strlen(traceFileName)) || (isTraceCardEmpty())) return 0;
f = fopen(traceFileName, "w+");
for (int i = 0; i < 64; i++) { // blocks
for (int j = 0; j < 16; j++) // bytes
fprintf(f, "%02x", *(traceCard + i * 16 + j));
fprintf(f,"\n");
}
fclose(f);
return 0;
}
int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile) {
if (traceCrypto1) crypto1_destroy(traceCrypto1);
traceCrypto1 = NULL;
memset(traceCard, 0x00, 4096);
memcpy(traceCard, tuid + 3, 4);
if (wantSaveToEmlFile) loadTraceCard(tuid);
traceCard[4] = traceCard[0] ^ traceCard[1] ^ traceCard[2] ^ traceCard[3];
traceCard[5] = sak;
memcpy(&traceCard[6], atqa, 2);
@ -331,7 +401,7 @@ void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len, bool i
}
int mfTraceDecode(uint8_t *data_src, int len) {
int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {
uint8_t data[64];
if (traceState == TRACE_ERROR) return 1;
@ -386,7 +456,12 @@ int mfTraceDecode(uint8_t *data_src, int len) {
if (len == 18) {
traceState = TRACE_IDLE;
if (isBlockTrailer(traceCurBlock)) {
memcpy(traceCard + traceCurBlock * 16 + 6, data + 6, 4);
} else {
memcpy(traceCard + traceCurBlock * 16, data, 16);
}
if (wantSaveToEmlFile) saveTraceCard();
return 0;
} else {
traceState = TRACE_ERROR;
@ -410,6 +485,7 @@ int mfTraceDecode(uint8_t *data_src, int len) {
traceState = TRACE_IDLE;
memcpy(traceCard + traceCurBlock * 16, data, 16);
if (wantSaveToEmlFile) saveTraceCard();
return 0;
} else {
traceState = TRACE_ERROR;
@ -470,11 +546,15 @@ int mfTraceDecode(uint8_t *data_src, int len) {
printf("key> %x%x\n", (unsigned int)((lfsr & 0xFFFFFFFF00000000) >> 32), (unsigned int)(lfsr & 0xFFFFFFFF));
AddLogUint64(logHexFileName, "key> ", lfsr);
int blockShift = ((traceCurBlock & 0xFC) + 3) * 16;
if (isBlockEmpty((traceCurBlock & 0xFC) + 3)) memcpy(traceCard + blockShift + 6, trailerAccessBytes, 4);
if (traceCurKey) {
num_to_bytes(lfsr, 6, traceCard + traceCurBlock * 16 + 10);
num_to_bytes(lfsr, 6, traceCard + blockShift + 10);
} else {
num_to_bytes(lfsr, 6, traceCard + traceCurBlock * 16);
num_to_bytes(lfsr, 6, traceCard + blockShift);
}
if (wantSaveToEmlFile) saveTraceCard();
if (traceCrypto1) {
crypto1_destroy(traceCrypto1);

13
client/mifarehost.h
View file

@ -63,10 +63,19 @@ extern char logHexFileName[200];
int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t * ResultKeys);
int mfCheckKeys (uint8_t blockNo, uint8_t keyType, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key);
int mfEmlGetMem(uint8_t *data, int blockNum, int blocksCount);
int mfEmlSetMem(uint8_t *data, int blockNum, int blocksCount);
int mfCSetUID(uint8_t *uid, uint8_t *oldUID, int wantWipe);
int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, int wantWipe, uint8_t params);
int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params);
int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak);
int mfTraceDecode(uint8_t *data_src, int len);
int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile);
int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile);
int isTraceCardEmpty(void);
int isBlockEmpty(int blockN);
int isBlockTrailer(int blockN);
int loadTraceCard(uint8_t *tuid);
int saveTraceCard(void);

6
client/util.c
View file

@ -80,15 +80,13 @@ void AddLogCurrentDT(char *fileName) {
AddLogLine(fileName, "\nanticollision: ", buff);
}
void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext) {
void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext, int byteCount) {
char * fnameptr = fileName;
memset(fileName, 0x00, 200);
for (int j = 0; j < 7; j++, fnameptr += 2)
for (int j = 0; j < byteCount; j++, fnameptr += 2)
sprintf(fnameptr, "%02x", uid[j]);
sprintf(fnameptr, "%s", ext);
printf("fname:%s", fileName);
}
// printing and converting functions

2
client/util.h
View file

@ -22,7 +22,7 @@ void AddLogLine(char *fileName, char *extData, char *c);
void AddLogHex(char *fileName, char *extData, const uint8_t * data, const size_t len);
void AddLogUint64(char *fileName, char *extData, const uint64_t data);
void AddLogCurrentDT(char *fileName);
void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext);
void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext, int byteCount);
void print_hex(const uint8_t * data, const size_t len);
char * sprint_hex(const uint8_t * data, const size_t len);