mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2024-09-24 09:16:13 +08:00
Oleg Moiseenko
GitHub
commit
efb919f529
|
|
@ -69,7 +69,7 @@ void tdes_nxp_receive(const void *in, void *out, size_t length, const void *key,
|
|||
if (length % 8) return;
|
||||
if (keymode == 2)
|
||||
mbedtls_des3_set2key_dec(&ctx3, key);
|
||||
else
|
||||
else
|
||||
mbedtls_des3_set3key_dec(&ctx3, key);
|
||||
|
||||
uint8_t i;
|
||||
|
|
|
|||
|
|
@ -9,10 +9,10 @@
|
|||
#define lconfig_h
|
||||
|
||||
#if defined(__APPLE__)
|
||||
#include "TargetConditionals.h"
|
||||
#if TARGET_OS_IOS || TARGET_OS_WATCH || TARGET_OS_TV
|
||||
#define system(s) ((s)==NULL ? 0 : -1)
|
||||
#endif // end iOS
|
||||
#include "TargetConditionals.h"
|
||||
#if TARGET_OS_IOS || TARGET_OS_WATCH || TARGET_OS_TV
|
||||
#define system(s) ((s)==NULL ? 0 : -1)
|
||||
#endif // end iOS
|
||||
#endif
|
||||
|
||||
#include <limits.h>
|
||||
|
|
|
|||
|
|
@ -67,7 +67,7 @@ arguments = [[
|
|||
-s Signature data (64 hexsymbols), set signature data on tag.
|
||||
-o OTP data (8 hexsymbols), set `One-Time Programmable` data on tag.
|
||||
-v Version data (16 hexsymbols), set version data on tag.
|
||||
-q ATQA/SAK (<2b ATQA><1b SAK> hexsymbols), set ATQA/SAK on tag.
|
||||
-q ATQA/SAK (<2b ATQA><1b SAK> hexsymbols), set ATQA/SAK on tag.
|
||||
-g GTU Mode (1 hexsymbol), set GTU shadow mode.
|
||||
-z ATS (<1b length><0-16 ATS> hexsymbols), Configure ATS. Length set to 00 will disable ATS.
|
||||
-w Wipe tag. 0 for Mifare or 1 for UL. Fills tag with zeros and put default values for type selected.
|
||||
|
|
@ -177,7 +177,7 @@ local function read_config()
|
|||
local info = connect()
|
||||
if not info then return false, "Can't select card" end
|
||||
-- read Ultimate Magic Card CONFIG
|
||||
if magicconfig == nil then
|
||||
if magicconfig == nil then
|
||||
magicconfig = send("CF".._key.."C6")
|
||||
else print('No Config')
|
||||
end
|
||||
|
|
@ -195,7 +195,7 @@ local function read_config()
|
|||
if ats:sub(1,2) == '00' then atsstr = 'Disabled'
|
||||
else atsstr = (string.sub(ats, 3))
|
||||
end
|
||||
if ulprotocol == '00' then
|
||||
if ulprotocol == '00' then
|
||||
cardprotocol = 'MIFARE Classic Protocol'
|
||||
ultype = 'Disabled'
|
||||
if uidlength == '00' then
|
||||
|
|
@ -211,11 +211,11 @@ local function read_config()
|
|||
elseif atqaf == '00 42' and sak == '18' then cardtype = 'MIFARE 4k S70 7-byte UID'
|
||||
end
|
||||
end
|
||||
elseif ulprotocol == '01' then
|
||||
elseif ulprotocol == '01' then
|
||||
-- Read Ultralight config only if UL protocol is enabled
|
||||
cardprotocol = 'MIFARE Ultralight/NTAG'
|
||||
block0 = send("3000")
|
||||
uid0 = block0:sub(1,6)
|
||||
uid0 = block0:sub(1,6)
|
||||
uid = uid0..block0:sub(9,16)
|
||||
if ulmode == '00' then ultype = 'Ultralight EV1'
|
||||
elseif ulmode == '01' then ultype = 'NTAG21x'
|
||||
|
|
@ -241,7 +241,7 @@ local function read_config()
|
|||
elseif cversion == '0004040502021503' then versionstr = 'NTAG I2C 2K PLUS'
|
||||
elseif cversion == '0004040401000F03' then versionstr = 'NTAG 213F'
|
||||
elseif cversion == '0004040401001303' then versionstr = 'NTAG 216F'
|
||||
end
|
||||
end
|
||||
-- read PWD
|
||||
cpwd = send("30F0"):sub(1,8)
|
||||
pwd = send("30E5"):sub(1,8)
|
||||
|
|
@ -256,7 +256,7 @@ local function read_config()
|
|||
lib14a.disconnect()
|
||||
end
|
||||
if _print < 1 then
|
||||
print(string.rep('=', 88))
|
||||
print(string.rep('=', 88))
|
||||
print('\t\t\tUltimate Magic Card Configuration')
|
||||
print(string.rep('=', 88))
|
||||
print(' - Raw Config ', string.sub(magicconfig, 1, -9))
|
||||
|
|
@ -273,10 +273,10 @@ local function read_config()
|
|||
print(' - ATQA ', atqaf)
|
||||
print(' - SAK ', sak)
|
||||
if ulprotocol == '01' then
|
||||
print('')
|
||||
print(string.rep('=', 88))
|
||||
print('')
|
||||
print(string.rep('=', 88))
|
||||
print('\t\t\tMagic UL/NTAG 21* Configuration')
|
||||
print(string.rep('=', 88))
|
||||
print(string.rep('=', 88))
|
||||
print(' - ATS ', atsstr)
|
||||
print(' - Password ', '[0xE5] '..pwd, '[0xF0] '..cpwd)
|
||||
print(' - Pack ', '[0xE6] '..pack, '[0xF1] '..cpack)
|
||||
|
|
@ -307,7 +307,7 @@ local function write_uid(useruid)
|
|||
local uidbytes = utils.ConvertHexToBytes(useruid)
|
||||
local bcc1 = bxor(bxor(bxor(uidbytes[1], uidbytes[2]), uidbytes[3]), uidbytes[4])
|
||||
local block0 = string.format('%02X%02X%02X%02X%02X', uidbytes[1], uidbytes[2], uidbytes[3], uidbytes[4], bcc1)
|
||||
local resp = send('CF'.._key..'CD00'..block0)
|
||||
local resp = send('CF'.._key..'CD00'..block0)
|
||||
-- Writes a MFUL UID with bcc1, bcc2 using NTAG21xx commands.
|
||||
elseif ulprotocol == '01' then
|
||||
-- uid string checks
|
||||
|
|
@ -339,7 +339,7 @@ end
|
|||
-- Write ATQA/SAK
|
||||
local function write_atqasak(atqasak)
|
||||
-- read CONFIG
|
||||
if not magicconfig then
|
||||
if not magicconfig then
|
||||
_print = 1
|
||||
read_config()
|
||||
end
|
||||
|
|
@ -350,16 +350,16 @@ end
|
|||
local atqauser2 = atqasak:sub(3,4)
|
||||
local atqauserf = atqauser2..atqauser1
|
||||
local sakuser = atqasak:sub(5,6)
|
||||
if sakuser == '04' then
|
||||
if sakuser == '04' then
|
||||
print('Never set SAK bit 3 (e.g. SAK=04), it indicates an extra cascade level is required')
|
||||
return nil
|
||||
elseif (sakuser == '20' or sakuser == '28') and atslen == '00' then
|
||||
elseif (sakuser == '20' or sakuser == '28') and atslen == '00' then
|
||||
print('When SAK equals 20 or 28, ATS must be turned on')
|
||||
return nil
|
||||
elseif atqauser2 == '40' then
|
||||
return nil
|
||||
elseif atqauser2 == '40' then
|
||||
print('ATQA of [00 40] will cause the card to not answer.')
|
||||
return nil
|
||||
else
|
||||
return nil
|
||||
else
|
||||
local info = connect()
|
||||
if not info then return false, "Can't select card" end
|
||||
print('New ATQA: '..atqauser1..' '..atqauser2..' New SAK: '..sakuser)
|
||||
|
|
@ -376,7 +376,7 @@ end
|
|||
-- Write NTAG PWD
|
||||
local function write_ntagpwd(ntagpwd)
|
||||
-- read CONFIG
|
||||
if not magicconfig then
|
||||
if not magicconfig then
|
||||
_print = 1
|
||||
read_config()
|
||||
end
|
||||
|
|
@ -389,7 +389,7 @@ local function write_ntagpwd(ntagpwd)
|
|||
if not info then return false, "Can't select card" end
|
||||
print('Writing new NTAG PWD ', ntagpwd)
|
||||
local resp = send('A2E5'..ntagpwd) -- must add both for password to be read by the reader command B1
|
||||
local resp = send('A2F0'..ntagpwd)
|
||||
local resp = send('A2F0'..ntagpwd)
|
||||
lib14a.disconnect()
|
||||
if resp == nil then
|
||||
return nil, 'Failed to write password'
|
||||
|
|
@ -401,7 +401,7 @@ end
|
|||
-- Write PACK
|
||||
local function write_pack(userpack)
|
||||
-- read CONFIG
|
||||
if not magicconfig then
|
||||
if not magicconfig then
|
||||
_print = 1
|
||||
read_config()
|
||||
end
|
||||
|
|
@ -426,7 +426,7 @@ local function write_otp(block3)
|
|||
if #block3 == 0 then return nil, 'empty OTP string' end
|
||||
if #block3 ~= 8 then return nil, 'OTP wrong length. Should be 4 hex bytes' end
|
||||
-- read CONFIG
|
||||
if not magicconfig then
|
||||
if not magicconfig then
|
||||
_print = 1
|
||||
read_config()
|
||||
end
|
||||
|
|
@ -450,7 +450,7 @@ local function write_version(data)
|
|||
if #data == 0 then return nil, 'empty version string' end
|
||||
if #data ~= 16 then return nil, 'version wrong length. Should be 8 hex bytes' end
|
||||
-- read CONFIG
|
||||
if not magicconfig then
|
||||
if not magicconfig then
|
||||
_print = 1
|
||||
read_config()
|
||||
end
|
||||
|
|
@ -478,7 +478,7 @@ local function write_signature(data)
|
|||
if #data == 0 then return nil, 'empty data string' end
|
||||
if #data ~= 64 then return nil, 'data wrong length. Should be 32 hex bytes' end
|
||||
-- read CONFIG
|
||||
if not magicconfig then
|
||||
if not magicconfig then
|
||||
_print = 1
|
||||
read_config()
|
||||
end
|
||||
|
|
@ -510,16 +510,16 @@ local function write_gtu(gtu)
|
|||
if not info then return false, "Can't select card" end
|
||||
if gtu == '00' then
|
||||
print('Enabling GTU Pre-Write')
|
||||
send('CF'.._key..'32'..gtu)
|
||||
send('CF'.._key..'32'..gtu)
|
||||
elseif gtu == '01' then
|
||||
print('Enabling GTU Restore Mode')
|
||||
send('CF'.._key..'32'..gtu)
|
||||
send('CF'.._key..'32'..gtu)
|
||||
elseif gtu == '02' then
|
||||
print('Disabled GTU')
|
||||
send('CF'.._key..'32'..gtu)
|
||||
send('CF'.._key..'32'..gtu)
|
||||
elseif gtu == '03' then
|
||||
print('Disabled GTU, high speed R/W mode for Ultralight')
|
||||
send('CF'.._key..'32'..gtu)
|
||||
send('CF'.._key..'32'..gtu)
|
||||
else
|
||||
print('Failed to set GTU mode')
|
||||
end
|
||||
|
|
@ -536,7 +536,7 @@ local function write_ats(atsuser)
|
|||
local atscardlen = atsuser:sub(1,2)
|
||||
local atscardlendecimal = tonumber(atscardlen, 16)
|
||||
local atsf = string.sub(atsuser, 3)
|
||||
if (#atsf / 2) ~= atscardlendecimal then
|
||||
if (#atsf / 2) ~= atscardlendecimal then
|
||||
oops('Given length of ATS ('..atscardlendecimal..') does not match the ATS_length ('..(#atsf / 2)..')')
|
||||
return true, 'Ok'
|
||||
else
|
||||
|
|
@ -556,7 +556,7 @@ local function write_ulp(ulp)
|
|||
if #ulp > 2 then return nil, 'type wrong length. Should be 1 hex byte' end
|
||||
local info = connect()
|
||||
if not info then return false, "Can't select card" end
|
||||
if ulp == '00' then
|
||||
if ulp == '00' then
|
||||
print('Changing card to Mifare Classic Protocol')
|
||||
send("CF".._key.."69"..ulp)
|
||||
elseif ulp == '01' then
|
||||
|
|
@ -576,7 +576,7 @@ local function write_ulm(ulm)
|
|||
if #ulm > 2 then return nil, 'type wrong length. Should be 1 hex byte' end
|
||||
local info = connect()
|
||||
if not info then return false, "Can't select card" end
|
||||
if ulm == '00' then
|
||||
if ulm == '00' then
|
||||
print('Changing card UL mode to Ultralight EV1')
|
||||
send("CF".._key.."6A"..ulm)
|
||||
elseif ulm == '01' then
|
||||
|
|
@ -855,7 +855,7 @@ local function wipe(wtype)
|
|||
send("CF".._key.."CD000102030404080400000000000000BEAF")
|
||||
local err, msg, resp
|
||||
local cmd_empty = 'CF'.._key..'CD%02X00000000000000000000000000000000'
|
||||
local cmd_cfg1 = 'CF'.._key..'CD%02XFFFFFFFFFFFFFF078069FFFFFFFFFFFF'
|
||||
local cmd_cfg1 = 'CF'.._key..'CD%02XFFFFFFFFFFFFFF078069FFFFFFFFFFFF'
|
||||
for b = 1, 0xFB do
|
||||
if b == 0x03 or b == 0x07 or b == 0x0B or b == 0x0F or b == 0x13 or b == 0x17 or b == 0x1B or b == 0x1F or b == 0x23 or b == 0x27 or b == 0x2B or b == 0x2F or b == 0x33 or b == 0x37 or b == 0x3B or b == 0x3F then
|
||||
local cmd = (cmd_cfg1):format(b)
|
||||
|
|
|
|||
|
|
@ -797,7 +797,7 @@ int CmdHF14ASniff(const char *Cmd) {
|
|||
}
|
||||
|
||||
int ExchangeRAW14a(uint8_t *datain, int datainlen, bool activateField, bool leaveSignalON, uint8_t *dataout, int maxdataoutlen, int *dataoutlen, bool silentMode) {
|
||||
|
||||
|
||||
uint16_t cmdc = 0;
|
||||
*dataoutlen = 0;
|
||||
|
||||
|
|
|
|||
|
|
@ -1050,7 +1050,7 @@ static int CmdHF14AMfRestore(const char *Cmd) {
|
|||
|
||||
PrintAndLogEx(INFO, "Restoring " _YELLOW_("%s")" to card", datafilename);
|
||||
|
||||
// main loop for restoreing.
|
||||
// main loop for restoreing.
|
||||
// a bit more complicated than needed
|
||||
// this is because of two things.
|
||||
// 1. we are setting keys from a key file or using the existing ones in the dump
|
||||
|
|
@ -1060,11 +1060,11 @@ static int CmdHF14AMfRestore(const char *Cmd) {
|
|||
for (uint8_t b = 0; b < mfNumBlocksPerSector(s); b++) {
|
||||
|
||||
uint8_t bldata[MFBLOCK_SIZE] = {0x00};
|
||||
|
||||
|
||||
memcpy(bldata, dump, MFBLOCK_SIZE);
|
||||
|
||||
// if sector trailer
|
||||
if (mfNumBlocksPerSector(s)-1 == b) {
|
||||
if (mfNumBlocksPerSector(s) - 1 == b) {
|
||||
if (use_keyfile_for_auth == false) {
|
||||
// replace KEY A
|
||||
bldata[0] = (keyA[s][0]);
|
||||
|
|
|
|||
|
|
@ -3404,7 +3404,7 @@ static int DesfireCreateFileParameters(
|
|||
uint8_t pfileid, uint8_t pisofileid,
|
||||
uint8_t amodeid, uint8_t frightsid,
|
||||
uint8_t r_modeid, uint8_t w_modeid, uint8_t rw_modeid, uint8_t ch_modeid,
|
||||
uint8_t *data, size_t *datalen ) {
|
||||
uint8_t *data, size_t *datalen) {
|
||||
|
||||
*datalen = 0;
|
||||
|
||||
|
|
@ -4475,10 +4475,10 @@ static int CmdHF14ADesClearRecordFile(const char *Cmd) {
|
|||
}
|
||||
|
||||
static int DesfileReadISOFileAndPrint(DesfireContext_t *dctx,
|
||||
bool select_current_file, uint8_t fnum,
|
||||
uint16_t fisoid, int filetype,
|
||||
uint32_t offset, uint32_t length,
|
||||
bool noauth, bool verbose) {
|
||||
bool select_current_file, uint8_t fnum,
|
||||
uint16_t fisoid, int filetype,
|
||||
uint32_t offset, uint32_t length,
|
||||
bool noauth, bool verbose) {
|
||||
|
||||
if (filetype == RFTAuto) {
|
||||
PrintAndLogEx(ERR, "ISO mode needs to specify file type");
|
||||
|
|
@ -4572,10 +4572,10 @@ static int DesfileReadISOFileAndPrint(DesfireContext_t *dctx,
|
|||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
static int DesfileReadFileAndPrint(DesfireContext_t *dctx,
|
||||
uint8_t fnum, int filetype,
|
||||
uint32_t offset, uint32_t length,
|
||||
uint32_t maxdatafilelength, bool noauth, bool verbose) {
|
||||
static int DesfileReadFileAndPrint(DesfireContext_t *dctx,
|
||||
uint8_t fnum, int filetype,
|
||||
uint32_t offset, uint32_t length,
|
||||
uint32_t maxdatafilelength, bool noauth, bool verbose) {
|
||||
|
||||
int res;
|
||||
// length of record for record file
|
||||
|
|
@ -4889,10 +4889,10 @@ static int CmdHF14ADesReadData(const char *Cmd) {
|
|||
}
|
||||
|
||||
static int DesfileWriteISOFile(DesfireContext_t *dctx,
|
||||
bool select_current_file, uint8_t fnum,
|
||||
uint16_t fisoid, int filetype,
|
||||
uint32_t offset, uint8_t *data,
|
||||
uint32_t datalen, bool verbose) {
|
||||
bool select_current_file, uint8_t fnum,
|
||||
uint16_t fisoid, int filetype,
|
||||
uint32_t offset, uint8_t *data,
|
||||
uint32_t datalen, bool verbose) {
|
||||
|
||||
if (filetype == RFTAuto) {
|
||||
PrintAndLogEx(ERR, "ISO mode needs to specify file type");
|
||||
|
|
|
|||
|
|
@ -266,9 +266,9 @@ static int CmdGallagherClone(const char *Cmd) {
|
|||
}
|
||||
|
||||
PrintAndLogEx(INFO, "Preparing to clone Gallagher to " _YELLOW_("%s") " from %s.",
|
||||
cardtype,
|
||||
use_raw ? "raw hex" : "specified data"
|
||||
);
|
||||
cardtype,
|
||||
use_raw ? "raw hex" : "specified data"
|
||||
);
|
||||
print_blocks(blocks, ARRAYLEN(blocks));
|
||||
|
||||
if (em) {
|
||||
|
|
|
|||
|
|
@ -236,7 +236,7 @@ static int CmdPyramidClone(const char *Cmd) {
|
|||
"The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated.\n"
|
||||
"Currently only works on 26bit",
|
||||
"lf pyramid clone --fc 123 --cn 11223\n"
|
||||
"lf pyramid clone --raw 0001010101010101010440013223921c\n"
|
||||
"lf pyramid clone --raw 0001010101010101010440013223921c\n"
|
||||
"lf pyramid clone --fc 123 --cn 11223 --q5 -> encode for Q5/T5555 tag\n"
|
||||
"lf pyramid clone --fc 123 --cn 11223 --em -> encode for EM4305/4469\n"
|
||||
);
|
||||
|
|
@ -285,7 +285,7 @@ static int CmdPyramidClone(const char *Cmd) {
|
|||
if (use_raw) {
|
||||
PrintAndLogEx(FAILED, "Can't specify both raw and fc/cn at the same time");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
uint32_t blocks[5];
|
||||
|
|
@ -332,9 +332,9 @@ static int CmdPyramidClone(const char *Cmd) {
|
|||
}
|
||||
|
||||
PrintAndLogEx(INFO, "Preparing to clone Farpointe/Pyramid to " _YELLOW_("%s") " from %s.",
|
||||
cardtype,
|
||||
use_raw ? "raw hex" : "specified data"
|
||||
);
|
||||
cardtype,
|
||||
use_raw ? "raw hex" : "specified data"
|
||||
);
|
||||
print_blocks(blocks, ARRAYLEN(blocks));
|
||||
|
||||
if (em) {
|
||||
|
|
@ -392,12 +392,12 @@ static int CmdPyramidSim(const char *Cmd) {
|
|||
if (use_raw) {
|
||||
PrintAndLogEx(FAILED, "Can't specify both raw and fc/cn at the same time");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
uint8_t bs[sizeof(raw) * 8];
|
||||
memset(bs, 0x00, sizeof(bs));
|
||||
|
||||
|
||||
if (use_raw == false) {
|
||||
uint32_t facilitycode = (fc & 0x000000FF);
|
||||
uint32_t cardnumber = (cn & 0x0000FFFF);
|
||||
|
|
|
|||
|
|
@ -79,7 +79,7 @@ static bool merge_topaz_reader_frames(uint32_t timestamp, uint32_t *duration, ui
|
|||
|
||||
return true;
|
||||
}
|
||||
static uint8_t calc_pos(uint8_t *d){
|
||||
static uint8_t calc_pos(uint8_t *d) {
|
||||
// PCB [CID] [NAD] [INF] CRC CRC
|
||||
uint8_t pos = 1;
|
||||
if ((d[0] & 0x08) == 0x08) // cid byte following
|
||||
|
|
@ -88,7 +88,7 @@ static uint8_t calc_pos(uint8_t *d){
|
|||
if ((d[0] & 0x04) == 0x04) // nad byte following
|
||||
pos++;
|
||||
|
||||
return pos;
|
||||
return pos;
|
||||
}
|
||||
|
||||
static uint8_t extract_uid[10] = {0};
|
||||
|
|
@ -99,7 +99,7 @@ static uint8_t extract_epurse[8] = {0};
|
|||
|
||||
static uint16_t extractChallenges(uint16_t tracepos, uint16_t traceLen, uint8_t *trace) {
|
||||
|
||||
// sanity check
|
||||
// sanity check
|
||||
if (is_last_record(tracepos, traceLen)) {
|
||||
return traceLen;
|
||||
}
|
||||
|
|
@ -111,9 +111,9 @@ static uint16_t extractChallenges(uint16_t tracepos, uint16_t traceLen, uint8_t
|
|||
// sanity check tracking position is less then available trace size
|
||||
if (tracepos + TRACELOG_HDR_LEN + data_len + TRACELOG_PARITY_LEN(hdr) > traceLen) {
|
||||
PrintAndLogEx(DEBUG, "trace pos offset %"PRIu64 " larger than reported tracelen %u",
|
||||
tracepos + TRACELOG_HDR_LEN + data_len + TRACELOG_PARITY_LEN(hdr),
|
||||
traceLen
|
||||
);
|
||||
tracepos + TRACELOG_HDR_LEN + data_len + TRACELOG_PARITY_LEN(hdr),
|
||||
traceLen
|
||||
);
|
||||
return traceLen;
|
||||
}
|
||||
|
||||
|
|
@ -139,7 +139,7 @@ static uint16_t extractChallenges(uint16_t tracepos, uint16_t traceLen, uint8_t
|
|||
}
|
||||
}
|
||||
|
||||
// extract MFU-C
|
||||
// extract MFU-C
|
||||
switch (frame[0]) {
|
||||
case MIFARE_ULC_AUTH_1: {
|
||||
if (data_len != 4) {
|
||||
|
|
@ -154,7 +154,7 @@ static uint16_t extractChallenges(uint16_t tracepos, uint16_t traceLen, uint8_t
|
|||
}
|
||||
|
||||
if (next_hdr->frame[0] != MIFARE_ULC_AUTH_2) {
|
||||
break;
|
||||
break;
|
||||
}
|
||||
|
||||
PrintAndLogEx(INFO, "MFU-C AUTH");
|
||||
|
|
@ -166,16 +166,16 @@ static uint16_t extractChallenges(uint16_t tracepos, uint16_t traceLen, uint8_t
|
|||
if (next_hdr->frame[0] == MIFARE_ULC_AUTH_2 && next_hdr->data_len == 19) {
|
||||
PrintAndLogEx(NORMAL, "%s", sprint_hex_inrow(next_hdr->frame + 1, 16));
|
||||
}
|
||||
|
||||
|
||||
return tracepos;
|
||||
}
|
||||
}
|
||||
|
||||
// extract iCLASS
|
||||
// --csn 9655a400f8ff12e0 --epurse f0ffffffffffffff --macs 0000000089cb984b
|
||||
|
||||
|
||||
if (hdr->isResponse == false) {
|
||||
|
||||
|
||||
uint8_t c = frame[0] & 0x0F;
|
||||
switch (c) {
|
||||
case ICLASS_CMD_SELECT: {
|
||||
|
|
@ -208,7 +208,7 @@ static uint16_t extractChallenges(uint16_t tracepos, uint16_t traceLen, uint8_t
|
|||
if (extract_uidlen == 8) {
|
||||
PrintAndLogEx(INFO, "hf iclass lookup --csn %s " NOLF, sprint_hex_inrow(extract_uid, extract_uidlen));
|
||||
PrintAndLogEx(NORMAL, "--epurse %s " NOLF, sprint_hex_inrow(extract_epurse, 8));
|
||||
PrintAndLogEx(NORMAL, "--macs %s " NOLF, sprint_hex_inrow(frame + 1, 8) );
|
||||
PrintAndLogEx(NORMAL, "--macs %s " NOLF, sprint_hex_inrow(frame + 1, 8));
|
||||
PrintAndLogEx(NORMAL, "-f iclass_default_keys.dic");
|
||||
return tracepos;
|
||||
}
|
||||
|
|
@ -248,7 +248,7 @@ static uint16_t extractChallenges(uint16_t tracepos, uint16_t traceLen, uint8_t
|
|||
memcpy(extract_uid + extract_uidlen, frame + 2, 4);
|
||||
extract_uidlen += 4;
|
||||
PrintAndLogEx(INFO, "UID... " _YELLOW_("%s"), sprint_hex_inrow(extract_uid, extract_uidlen));
|
||||
}
|
||||
}
|
||||
}
|
||||
break;
|
||||
}
|
||||
|
|
@ -279,9 +279,9 @@ static uint16_t extractChallenges(uint16_t tracepos, uint16_t traceLen, uint8_t
|
|||
switch (frame[pos]) {
|
||||
|
||||
case MFDES_AUTHENTICATE: {
|
||||
// Assume wrapped or unwrapped
|
||||
// Assume wrapped or unwrapped
|
||||
PrintAndLogEx(INFO, "AUTH NATIVE (keyNo %d)", frame[pos + long_jmp]);
|
||||
|
||||
|
||||
if (hdr->isResponse == false && next_record_is_response(tracepos, trace)) {
|
||||
|
||||
tracelog_hdr_t *next_hdr = (tracelog_hdr_t *)(trace + tracepos);
|
||||
|
|
@ -299,12 +299,12 @@ static uint16_t extractChallenges(uint16_t tracepos, uint16_t traceLen, uint8_t
|
|||
PrintAndLogEx(NORMAL, "%s", sprint_hex_inrow(next_hdr->frame + pos + long_jmp, 16));
|
||||
}
|
||||
return tracepos;
|
||||
}
|
||||
}
|
||||
break; // AUTHENTICATE_NATIVE
|
||||
}
|
||||
case MFDES_AUTHENTICATE_ISO: {
|
||||
|
||||
// Assume wrapped or unwrapped
|
||||
// Assume wrapped or unwrapped
|
||||
PrintAndLogEx(INFO, "AUTH ISO (keyNo %d)", frame[pos + long_jmp]);
|
||||
if (hdr->isResponse == false && next_record_is_response(tracepos, trace)) {
|
||||
|
||||
|
|
@ -326,7 +326,7 @@ static uint16_t extractChallenges(uint16_t tracepos, uint16_t traceLen, uint8_t
|
|||
tracepos += TRACELOG_HDR_LEN + next_hdr->data_len + TRACELOG_PARITY_LEN(next_hdr);
|
||||
|
||||
if (next_hdr->frame[pos] == MFDES_ADDITIONAL_FRAME) {
|
||||
PrintAndLogEx(NORMAL, "%s", sprint_hex_inrow(next_hdr->frame + pos + long_jmp, (tdea<<1)));
|
||||
PrintAndLogEx(NORMAL, "%s", sprint_hex_inrow(next_hdr->frame + pos + long_jmp, (tdea << 1)));
|
||||
}
|
||||
return tracepos;
|
||||
}
|
||||
|
|
@ -334,7 +334,7 @@ static uint16_t extractChallenges(uint16_t tracepos, uint16_t traceLen, uint8_t
|
|||
break; // AUTHENTICATE_STANDARD
|
||||
}
|
||||
case MFDES_AUTHENTICATE_AES: {
|
||||
// Assume wrapped or unwrapped
|
||||
// Assume wrapped or unwrapped
|
||||
PrintAndLogEx(INFO, "AUTH AES (keyNo %d)", frame[pos + long_jmp]);
|
||||
if (hdr->isResponse == false && next_record_is_response(tracepos, trace)) {
|
||||
|
||||
|
|
@ -368,7 +368,7 @@ static uint16_t extractChallenges(uint16_t tracepos, uint16_t traceLen, uint8_t
|
|||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return tracepos;
|
||||
}
|
||||
|
|
@ -455,9 +455,9 @@ static uint16_t printTraceLine(uint16_t tracepos, uint16_t traceLen, uint8_t *tr
|
|||
|
||||
if (tracepos + TRACELOG_HDR_LEN + data_len + TRACELOG_PARITY_LEN(hdr) > traceLen) {
|
||||
PrintAndLogEx(DEBUG, "trace pos offset %"PRIu64 " larger than reported tracelen %u",
|
||||
tracepos + TRACELOG_HDR_LEN + data_len + TRACELOG_PARITY_LEN(hdr),
|
||||
traceLen
|
||||
);
|
||||
tracepos + TRACELOG_HDR_LEN + data_len + TRACELOG_PARITY_LEN(hdr),
|
||||
traceLen
|
||||
);
|
||||
return traceLen;
|
||||
}
|
||||
|
||||
|
|
@ -895,7 +895,7 @@ static int CmdTraceExtract(const char *Cmd) {
|
|||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_lit0("1", "buffer", "use data from trace buffer"),
|
||||
arg_lit0("1", "buffer", "use data from trace buffer"),
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
|
|
|||
|
|
@ -806,7 +806,7 @@ static void DesfireSplitBytesToBlock(uint8_t *blockdata, size_t *blockdatacount,
|
|||
}
|
||||
|
||||
int DesfireExchangeEx(bool activate_field, DesfireContext_t *ctx, uint8_t cmd, uint8_t *data, size_t datalen, uint8_t *respcode,
|
||||
uint8_t *resp, size_t *resplen, bool enable_chaining, size_t splitbysize) {
|
||||
uint8_t *resp, size_t *resplen, bool enable_chaining, size_t splitbysize) {
|
||||
int res = PM3_SUCCESS;
|
||||
|
||||
if (!PrintChannelModeWarning(cmd, ctx->secureChannel, ctx->cmdSet, ctx->commMode))
|
||||
|
|
|
|||
|
|
@ -87,17 +87,17 @@ static void ln_command_completion(const char *text, linenoiseCompletions *lc) {
|
|||
// When no pm3 device present
|
||||
// and the command is not available offline,
|
||||
// we skip it.
|
||||
if ((g_session.pm3_present == false) && (vocabulory[index].offline == false )) {
|
||||
if ((g_session.pm3_present == false) && (vocabulory[index].offline == false)) {
|
||||
index++;
|
||||
continue;
|
||||
}
|
||||
|
||||
index++;
|
||||
|
||||
if (strncmp (command, text, len) == 0) {
|
||||
if (strncmp(command, text, len) == 0) {
|
||||
const char *space = strstr(command + len, " ");
|
||||
if (space != NULL) {
|
||||
if ((prev_match_len == 0) || (strncmp (prev_match, command, prev_match_len < space - command ? prev_match_len : space - command) != 0)) {
|
||||
if ((prev_match_len == 0) || (strncmp(prev_match, command, prev_match_len < space - command ? prev_match_len : space - command) != 0)) {
|
||||
linenoiseAddCompletion(lc, str_ndup(command, space - command + 1));
|
||||
prev_match = command;
|
||||
prev_match_len = space - command + 1;
|
||||
|
|
|
|||
|
|
@ -176,10 +176,14 @@ const static vocabulory_t vocabulory[] = {
|
|||
{ 0, "hf 15 csetuid" },
|
||||
{ 1, "hf cipurse help" },
|
||||
{ 0, "hf cipurse info" },
|
||||
{ 0, "hf cipurse select" },
|
||||
{ 0, "hf cipurse auth" },
|
||||
{ 0, "hf cipurse read" },
|
||||
{ 0, "hf cipurse write" },
|
||||
{ 0, "hf cipurse aread" },
|
||||
{ 0, "hf cipurse awrite" },
|
||||
{ 0, "hf cipurse formatall" },
|
||||
{ 0, "hf cipurse create" },
|
||||
{ 0, "hf cipurse delete" },
|
||||
{ 0, "hf cipurse default" },
|
||||
{ 1, "hf cipurse test" },
|
||||
|
|
@ -694,6 +698,7 @@ const static vocabulory_t vocabulory[] = {
|
|||
{ 1, "script list" },
|
||||
{ 1, "script run" },
|
||||
{ 1, "trace help" },
|
||||
{ 1, "trace extract" },
|
||||
{ 1, "trace list" },
|
||||
{ 1, "trace load" },
|
||||
{ 1, "trace save" },
|
||||
|
|
|
|||
|
|
@ -4083,7 +4083,7 @@
|
|||
},
|
||||
"hf mf restore": {
|
||||
"command": "hf mf restore",
|
||||
"description": "restore mifare classic binary file to tag. the key file and data file will program the card sector trailers. by default we authenticate to card with key b 0xffffffffffff. `--uid` param is used for filename templates `hf-mf-<uid>-dump.bin` and `hf-mf-<uid>-key.bin. if not specified, it will read the card uid instead. `--ka` param you can indicate that the key file should be used for authentication instead. if so we also try both b/a keys",
|
||||
"description": "restore mifare classic dump file to tag. the key file and dump file will program the card sector trailers. by default we authenticate to card with key b 0xffffffffffff. if access rights in dump file is all zeros, it will be replaced with default values `--uid` param is used for filename templates `hf-mf-<uid>-dump.bin` and `hf-mf-<uid>-key.bin. if not specified, it will read the card uid instead. `--ka` param you can indicate that the key file should be used for authentication instead. if so we also try both b/a keys",
|
||||
"notes": [
|
||||
"hf mf restore",
|
||||
"hf mf restore --1k --uid 04010203",
|
||||
|
|
@ -4098,7 +4098,7 @@
|
|||
"--2k mifare classic/plus 2k",
|
||||
"--4k mifare classic 4k / s70",
|
||||
"-u, --uid <hex> uid, 6 hex bytes",
|
||||
"-f, --file <fn> data filename",
|
||||
"-f, --file <fn> specify dump filename (bin/eml/json)",
|
||||
"-k, --kfn <fn> key filename",
|
||||
"--ka use specified keyfile to authenticate"
|
||||
],
|
||||
|
|
@ -4152,24 +4152,24 @@
|
|||
},
|
||||
"hf mf staticnested": {
|
||||
"command": "hf mf staticnested",
|
||||
"description": "execute nested attack against mifare classic card with static nonce for key recovery",
|
||||
"description": "execute nested attack against mifare classic card with static nonce for key recovery. supply a known key from one block to recover all keys",
|
||||
"notes": [
|
||||
"hf mf staticnested --mini --blk 0 -a -k ffffffffffff -> key recovery against mifare mini",
|
||||
"hf mf staticnested --1k --blk 0 -a -k ffffffffffff -> key recovery against mifare classic 1k",
|
||||
"hf mf staticnested --2k --blk 0 -a -k ffffffffffff -> key recovery against mifare 2k",
|
||||
"hf mf staticnested --4k --blk 0 -a -k ffffffffffff -> key recovery against mifare 4k"
|
||||
"hf mf staticnested --mini --blk 0 -a -k ffffffffffff",
|
||||
"hf mf staticnested --1k --blk 0 -a -k ffffffffffff",
|
||||
"hf mf staticnested --2k --blk 0 -a -k ffffffffffff",
|
||||
"hf mf staticnested --4k --blk 0 -a -k ffffffffffff"
|
||||
],
|
||||
"offline": false,
|
||||
"options": [
|
||||
"-h, --help this help",
|
||||
"-k, --key <hex> key specified as 12 hex symbols",
|
||||
"-k, --key <hex> known key (12 hex symbols)",
|
||||
"--mini mifare classic mini / s20",
|
||||
"--1k mifare classic 1k / s50",
|
||||
"--2k mifare classic/plus 2k",
|
||||
"--4k mifare classic 4k / s70",
|
||||
"--blk <dec> input block number",
|
||||
"-a input key specified is a key (default)",
|
||||
"-b input key specified is b key",
|
||||
"-a input key specified is keya (def)",
|
||||
"-b input key specified is keyb",
|
||||
"-e, --emukeys fill simulator keys from found keys",
|
||||
"--dumpkeys dump found keys to file"
|
||||
],
|
||||
|
|
@ -10345,6 +10345,6 @@
|
|||
"metadata": {
|
||||
"commands_extracted": 603,
|
||||
"extracted_by": "PM3Help2JSON v1.00",
|
||||
"extracted_on": "2022-02-04T13:37:03"
|
||||
"extracted_on": "2022-02-05T11:30:03"
|
||||
}
|
||||
}
|
||||
|
|
@ -63,19 +63,19 @@ static int decrypt(uint8_t ciphertext[], int ciphertext_len, uint8_t key[], uint
|
|||
int len;
|
||||
int plaintext_len;
|
||||
|
||||
if(!(ctx = EVP_CIPHER_CTX_new()))
|
||||
if (!(ctx = EVP_CIPHER_CTX_new()))
|
||||
handleErrors();
|
||||
|
||||
if(1 != EVP_DecryptInit_ex(ctx, EVP_aes_128_cbc(), NULL, key, iv))
|
||||
if (1 != EVP_DecryptInit_ex(ctx, EVP_aes_128_cbc(), NULL, key, iv))
|
||||
handleErrors();
|
||||
|
||||
EVP_CIPHER_CTX_set_padding(ctx, 0);
|
||||
|
||||
if(1 != EVP_DecryptUpdate(ctx, plaintext, &len, ciphertext, ciphertext_len))
|
||||
if (1 != EVP_DecryptUpdate(ctx, plaintext, &len, ciphertext, ciphertext_len))
|
||||
handleErrors();
|
||||
plaintext_len = len;
|
||||
|
||||
if(1 != EVP_DecryptFinal_ex(ctx, plaintext + len, &len))
|
||||
if (1 != EVP_DecryptFinal_ex(ctx, plaintext + len, &len))
|
||||
handleErrors();
|
||||
plaintext_len += len;
|
||||
|
||||
|
|
@ -89,7 +89,7 @@ static int hexstr_to_byte_array(char hexstr[], uint8_t bytes[], size_t byte_len)
|
|||
if (hexstr_len % 16) {
|
||||
return 1;
|
||||
}
|
||||
if (byte_len < hexstr_len/2) {
|
||||
if (byte_len < hexstr_len / 2) {
|
||||
return 2;
|
||||
}
|
||||
char *pos = &hexstr[0];
|
||||
|
|
@ -100,7 +100,7 @@ static int hexstr_to_byte_array(char hexstr[], uint8_t bytes[], size_t byte_len)
|
|||
return 0;
|
||||
}
|
||||
|
||||
int main (int argc, char* argv[]) {
|
||||
int main(int argc, char *argv[]) {
|
||||
|
||||
uint8_t iv[16] = {0x00};
|
||||
uint8_t key[16] = {0x00};
|
||||
|
|
@ -116,10 +116,10 @@ int main (int argc, char* argv[]) {
|
|||
return 1;
|
||||
}
|
||||
|
||||
if(hexstr_to_byte_array(argv[2], tag_challenge, sizeof(tag_challenge)))
|
||||
if (hexstr_to_byte_array(argv[2], tag_challenge, sizeof(tag_challenge)))
|
||||
return 2;
|
||||
|
||||
if(hexstr_to_byte_array(argv[3], lock_challenge, sizeof(lock_challenge)))
|
||||
if (hexstr_to_byte_array(argv[3], lock_challenge, sizeof(lock_challenge)))
|
||||
return 3;
|
||||
|
||||
uint64_t start_time = time(NULL);
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@
|
|||
#define __STDC_FORMAT_MACROS
|
||||
|
||||
#if !defined(_WIN32) && !defined(__APPLE__)
|
||||
#define _POSIX_C_SOURCE 200112L // need localtime_r()
|
||||
#define _POSIX_C_SOURCE 200112L // need localtime_r()
|
||||
#endif
|
||||
|
||||
#include <stdio.h>
|
||||
|
|
@ -53,7 +53,7 @@ typedef struct thread_args {
|
|||
uint64_t starttime;
|
||||
uint64_t stoptime;
|
||||
uint8_t tag[16];
|
||||
uint8_t rdr[32];
|
||||
uint8_t rdr[32];
|
||||
} targs;
|
||||
|
||||
static void make_key(uint32_t seed, uint8_t key[]) {
|
||||
|
|
@ -134,9 +134,9 @@ static void print_time(uint64_t at) {
|
|||
struct tm lt;
|
||||
|
||||
#if defined(_WIN32)
|
||||
(void)localtime_s(<, &t);
|
||||
(void)localtime_s(<, &t);
|
||||
#else
|
||||
(void)localtime_r(&t, <);
|
||||
(void)localtime_r(&t, <);
|
||||
#endif
|
||||
|
||||
char res[32];
|
||||
|
|
@ -151,9 +151,9 @@ static void *brute_thread(void *arguments) {
|
|||
|
||||
uint64_t starttime = args->starttime;
|
||||
|
||||
uint64_t stoptime = args->stoptime;
|
||||
uint64_t stoptime = args->stoptime;
|
||||
uint8_t local_tag[16];
|
||||
uint8_t local_rdr[32];
|
||||
uint8_t local_rdr[32];
|
||||
memcpy(local_tag, args->tag, 16);
|
||||
memcpy(local_rdr, args->rdr, 32);
|
||||
|
||||
|
|
@ -213,7 +213,7 @@ static void *brute_thread(void *arguments) {
|
|||
return NULL;
|
||||
}
|
||||
|
||||
static int usage(const char* s) {
|
||||
static int usage(const char *s) {
|
||||
printf(_YELLOW_("syntax:") "\n");
|
||||
printf(" %s <unix timestamp> <16 byte tag challenge> <32 byte reader response challenge>\n", s);
|
||||
printf("\n");
|
||||
|
|
@ -223,7 +223,7 @@ static int usage(const char* s) {
|
|||
return 1;
|
||||
}
|
||||
|
||||
int main (int argc, char* argv[]) {
|
||||
int main(int argc, char *argv[]) {
|
||||
|
||||
printf("\n");
|
||||
printf(_CYAN_("Telenot access MIFARE DESFire AES key recovery tool") "\n");
|
||||
|
|
@ -252,7 +252,7 @@ int main (int argc, char* argv[]) {
|
|||
printf("Rdr Resp & Challenge... ");
|
||||
print_hex(rdr_resp_challenge, sizeof(rdr_resp_challenge));
|
||||
|
||||
|
||||
|
||||
uint64_t t1 = msclock();
|
||||
|
||||
#if !defined(_WIN32) || !defined(__WIN32__)
|
||||
|
|
@ -269,7 +269,7 @@ int main (int argc, char* argv[]) {
|
|||
pthread_mutex_init(&print_lock, NULL);
|
||||
|
||||
// threads
|
||||
uint64_t stop_time = time(NULL);
|
||||
uint64_t stop_time = time(NULL);
|
||||
for (int i = 0; i < thread_count; ++i) {
|
||||
struct thread_args *a = calloc(1, sizeof(struct thread_args));
|
||||
a->thread = i;
|
||||
|
|
|
|||
Loading…
Reference in a new issue