iceman1001
be82f9f018
DEL: 'hf mf sniff' - since it is very similar to 'hf 14a sniff' , I removed this command. The desired functionality will become a new 'hf list mf' option in the future.
2018-01-18 14:11:22 +01:00
iceman1001
9a162c9a79
CHG: 'hf mf sniff' - output adjustments
2018-01-17 00:29:41 +01:00
iceman1001
1b20ff8243
chg, 'hf mf sim' is ok to call without parameter
2018-01-11 22:07:26 +01:00
iceman1001
1d04e8822c
chg: 'hf mf fchk' textual
2018-01-09 16:29:43 +01:00
iceman1001
f865b593d7
chg: 'hf mf fchk' helptext
...
chg: 'hf mf sniff' textual
2018-01-09 16:25:58 +01:00
Chris
d5ce45bae7
FIX: 'hf mf chk' / 'hf mf fchk' - t/d param bug. Now it is not place dependent and can also read several dictionary files :)
2017-12-31 19:36:12 +01:00
iceman1001
b2a5c8e33c
chg: 'hf mf chk' - textual
2017-12-21 10:14:10 +01:00
iceman1001
8ffe97c75b
chg: reseting values
2017-12-18 12:15:03 +01:00
iceman1001
bc639bc3ec
fix: adapting to run all strategies.
2017-12-18 12:14:02 +01:00
iceman1001
e6f0672015
chg: strange behavior when running checks with hardnested
2017-12-18 11:29:34 +01:00
iceman1001
8526e74af8
chg: 'hf mf chk' - break on keypress.
...
chg: 'hf mf fchk' - break on keypress.
2017-12-13 10:17:30 +01:00
iceman1001
4781ee78e8
chg: extracted check-key-fast into its own.
...
chg: added fast check inside nested.
2017-12-12 20:05:36 +01:00
iceman1001
033bc12933
chg: 'hf mf fchk' - adapttions to depth first exits
2017-12-11 22:33:50 +01:00
iceman1001
dd024b5300
chg: 'hf mf fchk' - depth first search
2017-12-11 21:43:29 +01:00
iceman1001
da57e74140
CHG: 'hf mf fchk' - two strategys. depth first for sector 1, AB. and width first with all sectors.
...
first run strategy 1. then 2.
2017-12-11 01:44:55 +01:00
iceman1001
f148d34bc3
chg: 'hf mf chk' - added param h for help
...
chg: 'hf mf fchk' - added param h for help
2017-12-10 09:44:49 +01:00
iceman1001
e1a01dd2ff
CHG: uniformed output for failed key retrivals. Now denoted with -------
2017-12-06 23:56:07 +01:00
iceman1001
2bc60a87aa
CHG: 'hf mf chk' - adding default_key array refactoring (@merlokk)
2017-12-06 20:14:18 +01:00
iceman1001
0a1a48df01
chg: 'hf mf nack' - extracted in into mifarehost for easier usage in other cmds like
...
'hf 14a info'
chg: 'hf mf nack' - changes on devices side from @doegox Thanks!
2017-12-05 23:34:52 +01:00
iceman1001
a43f156370
chg: 'hf mf nack' - minor
2017-12-05 18:04:21 +01:00
iceman1001
6e5038f224
chg: 'hf mf nack' - only test all 256 parities for one nonce when synced.
...
0 nack = has not bug.
1 nack == has bug
x nacks == most likely a clone card which answers nack to all requests.
2017-12-05 17:57:44 +01:00
iceman1001
08193fd2e5
chg: getting crazy out of sync when running against magic cards.
2017-12-05 12:30:40 +01:00
iceman1001
bea28ae654
chg: wrong var name
2017-12-05 11:54:38 +01:00
iceman1001
984a26370d
chg: 'hf mf nack' better output
2017-12-05 11:53:42 +01:00
iceman1001
e02e145fae
draft for a Mifare classic NACK bug detection.
...
the idea is to have a statistically solid conclusion if tag does or does not have the NACK bug.
-in short, ref https://github.com/iceman1001/proxmark3/issues/141
NACK bug; when a tag responds with a NACK to a 8 byte nonce exchange during authentication when the bytes are wrong but the parity bits are correct.
This is a strong oracle which is used in the darkside attack.
2017-12-04 19:36:26 +01:00
iceman1001
73a5e3b23d
chg: 'hf mfu eload' - instead of showing a error, it now tells a warning that we only loaded N blocks of data to emulator memory.
...
It always loads the existing blocks into emulator memory.
The previous message made users belive a error had occured when it actually did load.
2017-12-03 15:23:24 +01:00
iceman1001
b89b3399dc
FIX: if receiving array isnt large enough, previously this will smash the stack..
2017-12-02 20:45:53 +01:00
iceman1001
bb916aa999
fix: removed a warning
2017-12-02 19:07:10 +01:00
iceman1001
2f3dbbcaa3
rename: ul_switch_off_field -> DropField (inside cmdhf14a.c)
...
chg: Fix memory bounds error (@wsmoses)
c3511781a1
2017-11-11 23:23:01 +01:00
iceman1001
b5842e8c1b
fix: usb_cdc don't report that pm3 device is selfpowered.. (since its not by default)
2017-10-29 19:28:23 +01:00
iceman1001
d3654ab41c
chg: some debug
2017-10-12 15:20:41 +02:00
iceman1001
08c65427bc
fix: 'hf mf fchk' - wrong number of params to printf
2017-10-11 13:24:54 +02:00
iceman1001
f04723d3f5
fix: 'hf mf fchk' - some strange output when only using the default keys (no dictionary file)
...
fix: 'hf mf fchk' - helptext corrected
fix: 'hf mf fchk' - allow to call with just 1 argument
2017-10-11 13:20:39 +02:00
iceman1001
2ca0ea8cb4
ADD: 'hf mf fastchk' - new command, improved check keys functionality. It uses a bunch of techniques to get a speedup.
...
Using a dictionary file with 421keys,
Current implementation of checkkeys takes 300 sec.
This implementation of checkkeys takes 250 sec.
I implemented it as a separate command so it will be easier to compare between the old and new checkkeys.
Its also doing much on deviceside, which is a step to much funnier standalone modes :))
2017-10-05 16:00:56 +02:00
iceman1001
11e72b4064
add 'hf mf decrypt' - added a helptext
...
chg 'hf mf decrypt' - increased the available input data array.
2017-08-30 19:13:49 +02:00
iceman1001
c5616dfe76
minor corrections..
2017-08-29 15:47:26 +02:00
iceman1001
9f54a5e4b9
fix 'hf 14a read' needs a disconnect if failed.
...
fix 'hf mf csave' now prints which card size it is trying to dump
2017-08-29 14:47:17 +02:00
iceman1001
1737081a5d
fix 'hf mf csave' the 'i' parameter is renamed to 'o', since its a output filename..
...
fix 'hf mf csave' the 'i' parameter would take the whole inputed command string as filename.. it now correctly takes the string after 'o '...
2017-08-29 14:40:34 +02:00
iceman1001
7484a0dd1e
fix: 'hf mf cgetsc' - a missing array and some new output layout.
2017-08-28 21:25:29 +02:00
iceman1001
fdd4186aa0
chg: 'hf mf cload/csave' - same output with regards to blocks as eload/esave
2017-08-28 17:22:29 +02:00
iceman1001
d8c72242a2
chg: some more fflush...
2017-08-28 17:18:54 +02:00
iceman1001
97452c056c
chg... and fflushing stdout...
2017-08-28 17:13:48 +02:00
iceman1001
0d3208eb95
fix: 'hf mf cload' - the newline chars \d\a was forgotten. buf too small.
...
chg: 'hf mf cload/csave/eload/esave' - ui feedback...
2017-08-28 17:10:23 +02:00
iceman1001
bd71e15289
fix: 'hf mf cload' - too small buffer, needs one more byte for the NULL-terminator
2017-08-28 09:39:20 +02:00
iceman1001
292a4ca602
'hf 14b sniff' - removed stuff which wasn't very useful. cleaner now. Not sure if it works :(
...
'hf iclass sniff' - playing with this one. Don't expect it to work yet :(
- increase dma_buffer_size to 256
- moved initialization to a own function. Just looks cleaner :)
- change the debug output to follow MF_DBGLEVEL
'hf mf sniff' - unnecessary cast removed
2017-08-27 19:41:24 +02:00
iceman1001
94f70caa7a
when you need to add too much changes at the same time...
...
fix: 'hf mf hardnested' test cases doesn't need to verify key.
add: 'hf mf ' - collect nonces from classic tag.
chg: switch_off on armside, a more unified way, so we don't forget to turn of the antenna ...
chg: renamed 'hf iclass snoop' into 'hf iclass sniff' in an attempt to make all sniff/snoop commands only SNIFF
chg: 'standalone' -> starting the work of moving all standalone mods into a plugin kind of style, in its own folder.
2017-08-26 12:57:18 +02:00
iceman1001
2a4685312a
chg: (merlokk) debugstatements
2017-07-31 13:50:55 +02:00
iceman1001
83cd6a7761
CHG: 'hf mf nested' - (merlokk) 76fcccd109
...
CHG: 'hf mf hardnested' added same verification also here.
2017-07-31 13:37:41 +02:00
iceman1001
f28da2da6e
monster merge...
...
all those changes marshmellow did.. and more...
2017-07-30 09:17:48 +02:00
iceman1001
3d53f941aa
some time_t issues
2017-07-28 01:35:49 +02:00
iceman1001
a8569849d6
part of monstermerge..
2017-07-27 20:58:59 +02:00
iceman1001
e8015142cd
fix: TRUE/FALSE -> bools
...
fix: 'iclass' filepath 255, to use FILE_PATH_SIZE
fix: unified params test
2017-07-14 20:54:11 +02:00
iceman1001
7cf0bf19e5
FIX: 'mfu authentication' bug where the pack-length was wrong
...
ADD: 'hf mfu restore' - added a restore from file command, see helptext for instructions
CHG: some help-text updates and refactored to functions
CHG: 'hf mfu gen' - added the possibility to read uid from card as input
CHG: 'hf mfu dump' - refactored out the dump-printing
2017-07-13 13:10:46 +02:00
iceman1001
310d0da9a4
fixes.. to bool
2017-07-11 18:31:10 +02:00
iceman1001
1f9534e2cc
CHG: broke out some help texts and improved them.
...
CHG: 'hf mf csave' now save mini,1k,2k,4k and to both a bin and eml file.
2017-07-11 17:45:23 +02:00
iceman1001
3ca3d401c0
FIX: some adjustments to prng detection
2017-07-04 20:11:25 +02:00
Iceman
08cc2c36d8
fix: 'hf mf chk'
...
Dictionary files will load wrong if they exceed 256lines.
2017-04-26 19:52:03 +02:00
angelsl
ece631fd06
Add Mifare Classic EV1 set load modulation command
2017-03-09 21:37:16 +08:00
iceman1001
be67483e63
syntax sugar
2017-03-09 11:19:30 +01:00
iceman1001
57778a4630
CHG: renamed struct sector -> sector_t
...
CHG: defines on armside
CHG: #define WIN32 -> _WIN32
CHG: started to enhance "hf mf chkkeys"
REM: removed some duplicates etc in default keys.
2017-03-06 19:11:08 +01:00
iceman1001
a9eeb57698
CHG: Added PR #220 from PM3 Master. ref: https://github.com/Proxmark/proxmark3/pull/220
2017-03-01 20:14:46 +01:00
iceman1001
5215a87442
CHG: @Marshmellow42 's fixes. ref: e88096ba25
2017-02-24 01:14:47 +01:00
iceman1001
9c624f67b3
chg: @piwi's code cleanup and some more.
...
ref: 43534cbad2
2017-02-23 00:03:10 +01:00
iceman1001
84bdbc1917
FIX: 'hf 14a sim x' - adjusted and shows messages when verbose.
...
FIX: 'hf mf sim x i' - same as above.
In general we only use Moebius attack for "sim x", that means a clean up on device side code. simpler to understand. It still tries to gather 8 different collections of nonces combo. When one is complete, it get sent to client which runs moebius direct.
2017-01-29 23:09:23 +01:00
iceman1001
2ce218042d
CHG: 'hf 14a sim e' - it now has a parameter for setfoundkeys to emulator memory.
...
CHG: textual changes.
2017-01-29 13:21:17 +01:00
iceman1001
7e735c1398
FIX: 'hf 14a sim x' - this fixes the error with using moebius attack and sim. Updating the nonce variable doesn't change the premodulated response. And it should update everytime it gets a command. One concering issue is that this takes time. Successfully works with two PM3. One acting reader, another sim.
2017-01-29 11:29:15 +01:00
iceman1001
e108a48ac4
ADD: added the 'hf mf hardnested' to be called within LUA scripts.
...
ADD: 'script run hard' - a first try for a lua script to run the hardnested attack on a complete tag.
2016-11-21 16:08:12 +01:00
iceman1001
2618e313bf
CHG: textual change
2016-11-16 17:45:12 +01:00
iceman1001
60c33f7aa8
CHG: minor textual change to fit the minimum two calls nature for the zero parity attack
2016-10-29 21:45:36 +02:00
iceman1001
19693bdc06
FIX: 'hf mf mifare' - special zero parity attack vector now works. Thanks to the dude who figured this vector out: @douniwan5788 (sorry for comments, I was clearly wrong.) @piwi - for proving me wrong.
...
this version uses int64_t (signed) to signify end-of-lists (-1). It also needs its own compare function for the qsort. I didn't merge this into existing code which uses uint64_t. (too lazy)
2016-10-29 21:41:02 +02:00
iceman1001
ba39db376c
CHG: just some parameter / variable name changes. Nuttin' special.
2016-10-28 16:37:01 +02:00
Michael Farrell
32beef538e
hf {14a,mf} sim: v is for verbose
2016-10-27 23:37:00 +11:00
Michael Farrell
dfdbfa0702
hf mf sim: Be less verbose by default, add option "m" to turn maths back on (Issue #45 )
2016-10-27 23:37:00 +11:00
Michael Farrell
b6e05350b2
hf mf sim: Multiple fixes (iceman1001/proxmark3 #45 )
...
- Fix `hf mf sim` to use nonce_t structures, so key recovery works
- Increases verbosity on the key recovery functionality
- Fix use-after-free for k_sector
- Add help info on `e` option to `hf mf sim`
2016-10-22 21:53:53 +11:00
iceman1001
2dcf60f3df
CHG: "hf mf hardnested" - less printing
...
CHG: some filehandles = NULL.
2016-10-21 16:06:53 +02:00
iceman1001
f885043422
FIX: "hf 14a read" / "hf mf *" / "hf mfdes info" and failure when calling these commands serveral times in row.
...
For long transactions the sspclock compare with >1 instead of >=1 .. Now the timer resets properly.
CHG: use some #define constants for iso-commands.
2016-09-23 21:28:07 +02:00
iceman1001
5b4664e79f
CHG: Adding clarity to the command helptext.
2016-09-01 20:36:42 +02:00
iceman1001
ba1324a5fe
some text changes.
2016-08-24 14:58:50 +02:00
iceman1001
760157f50b
CHG: added a verification to see if the found candidate key was able to validate against tag. If not ok, start darkside attack again.
2016-08-24 14:10:30 +02:00
iceman1001
6067df30c5
FIX: at least now the special zero parity attack, repeats and doesn't crash. However it doesn't find the key either :(
2016-08-10 10:55:29 +02:00
iceman1001
59e933fc3f
started fixing the paritiy == 0 special attack against chinese clones with bad prng, which hasnt been working for ages.
2016-08-09 23:11:07 +02:00
iceman1001
d9ed4e1914
ADD: J-Run's 2nd phase tool mf_key_brute ref: https://github.com/J-Run/mf_key_brute Estimated time to search keyspace is ~18min.
...
J_Run's 2nd phase of multiple sector nested authentication key recovery
You have a known 4 last bytes of a key recovered with mf_nonce_brute tool.
First 2 bytes of key will be bruteforced
Usage: hf mf keybrute [h] <block number> <A|B> <key>
options:
h this help
<block number> target block number
<A|B> target key type
<key> candidate key from mf_nonce_brute tool
samples:
hf mf keybrute 1 A 000011223344
2016-08-08 17:49:30 +02:00
Alexis Green
170e7c9c51
FIX: erroneous semicolon
2016-08-07 20:07:25 -07:00
iceman1001
df007486f5
ADD: @donwan581 select keytype for the darkside attack.
2016-08-04 21:51:26 +02:00
iceman1001
2fdc489bb4
CHG: printing of progress dots is better now.
2016-05-19 12:47:23 +02:00
iceman1001
ea1ee62e55
CHG: better helptext
2016-04-29 22:24:08 +02:00
iceman1001
222bdb1cb3
Syntax suger
2016-04-24 21:43:38 +02:00
iceman1001
cd777a0545
FIX: Some Coverity Scan warnings. fread, not initialised etc etc
2016-04-23 18:23:46 +02:00
iceman1001
be6e909c5b
FIX: time printing, like difftime in MINGW enviroments needs to use 32b time.
2016-04-23 13:02:20 +02:00
iceman1001
9ea10847ea
CHG: timeing in chk keys,
2016-04-23 12:26:29 +02:00
iceman1001
fa0e0b109f
CHG: moved out some usage_methods for help texts.
...
CHG: added some time in the darkside, nested, hardnested, chk commands.
2016-04-23 12:18:34 +02:00
iceman1001
5dc8b8fe27
CHG: unified some text messaged.
2016-04-23 11:43:02 +02:00
iceman1001
d948e0d140
CHG: 'hf mf chk' now correctly tests to read key B, when we specify target keytype B or ?.
...
CHG: 'hf mf chk' now correctly init all sector keys to 0xFFFFFFFFFFFF, so it looks unified.
2016-04-23 11:32:37 +02:00
iceman1001
6c84c90017
FIX: this fixes the "hf mf sniff l d f" command, which has been broken for a while. The cuid is correct used for decrypting.
...
FIX: The flushing of logentries.
ADD: "hf mf sniff" - added the sniffing of UID's with a uidlen of 10.
Whats left? The key is not always found even if we use the "mfkey64" approach.
ADD: added the parity_zero attack in "hf mf mifare". Still not working since piwi's changes to the iso14443a.c, maybe needs a param to tell it to collect nonces for this special attack.
CHG: extracted some help-texts into usage_* methods. Changed some text as well
FIX: "hf mf sim" command now uses both mfkey32 and mfkey32_moebius version to find the key in attack mode.
CHG: "hf mf sim" also now defaults to emul_memory to read a 4 byte UID.
2016-04-18 13:18:02 +02:00
iceman1001
0194ce8fc8
ADD: simulating can now handle triplesized UID (10b)
...
CHG: moved some mifare #DEFINES into protocols.h (ACK,NACK..)
2016-04-14 11:09:17 +02:00
iceman1001
2daa0d0b1e
CHG: doesnt flush the printf() calls
2016-04-10 13:34:27 +02:00
iceman1001
c3559d162a
textual changes
2016-03-23 14:04:10 +01:00
iceman1001
b03006794f
CHG: removing some time-debug statements.
...
CHG: increased the time-out message 2sec, in proxmark, to make "hf mf chk" work better.
CHG: still trying to solve the "hf mf mifare" WDT_HIT bug.
With these changes, the "hf mf chk" / "Hf mf nested" looks similar and should be a bit faster.
2016-02-19 22:34:39 +01:00
iceman1001
b882b54314
FIX: introduced a bug in a loop by uint8_t inside crapto1.c
...
CHG: textual helptext change in "hf mf nested"
CHG: loop inside "nested". Still not fast enough. I wonder if qsort can be exchanged for radixsort or bucket sort?
2016-02-16 23:46:34 +01:00
iceman
e7902ca0a5
chg: removed testmessage
2016-02-15 02:45:43 +01:00