Philippe Teuwen
46813e0e50
hf mf isen: rewrite counters, add specific NONCE_SUPERSTATIC case (when first nt == nested nt)
2024-11-05 17:07:54 +01:00
Philippe Teuwen
6706bdb13f
hf mf isen: detect special static nonce nt_first==nt_nested
2024-11-05 09:30:22 +01:00
nvx
6d7fcc642a
add gdm flag to hf mf c* commands
...
this enables the use of hf mf c* commands with gdm/uscuid cards when the alt wake up mode 20(7)/23 is enabled rather than gen1 wake up
2024-11-02 22:22:13 +10:00
Simone Spadino
212f108a91
Auto distance measurement
2024-10-23 11:53:49 +02:00
Simone Spadino
846937a684
Support for static nonces card with offset 0
2024-10-23 00:24:07 +02:00
Philippe Teuwen
079689628b
hf mf sim: add nested reader attack (needs data & rf08s nonces)
2024-10-16 19:54:03 +02:00
Philippe Teuwen
5470303588
prepare MifareAcquireStaticEncryptedNonces for standalone
2024-10-16 01:48:36 +02:00
Philippe Teuwen
85e463b222
hf mf isen --collect_fm11rf08s_with_data optimizations:
...
* do not read data blocks twice
* store data in the emulator memory, to be prepared for standalone modes and to not allocate large buffer on stack
* 9->8 bytes to store each key data in emulator memory (half_nt + nt_par_err + flag + nt_enc)
2024-10-14 15:34:25 +02:00
Philippe Teuwen
e7ff2ad1ca
hf mf ecfill: wait for execution and return status
2024-10-13 22:55:41 +02:00
Philippe Teuwen
a11ba61b01
hf mf ecfill: add support for quick dump via backdoor auth
2024-10-13 22:55:41 +02:00
iceman1001
20a0bc3a81
style
2024-09-14 15:03:29 +02:00
iceman1001
cd0ce47d89
when dumping memory also try the MFC_B key
2024-09-13 13:40:24 +02:00
Philippe Teuwen
69d7a7e0c3
fm11rf08s: get advanced verification sector keys as well
2024-09-08 11:57:53 +02:00
iceman1001
72900d1bf9
fix and style
2024-09-06 22:36:44 +02:00
iceman1001
9c181dd83d
step one of bounds checking all responses when receiving ISO14443A frames... because @doegox find a missbehaving IC clone.....
2024-09-05 17:52:10 +02:00
Philippe Teuwen
17ddc2db82
trying to please codeQL
2024-09-03 23:00:50 +02:00
Philippe Teuwen
de86cd85d1
Added support for dumping FM11RF08S data at once
2024-09-03 11:43:57 +02:00
Philippe Teuwen
c73e2ea623
Added support for collecting all fm11rf08s nT/{nT}/par_err at once
2024-09-02 23:11:36 +02:00
iceman1001
5b64df9247
fix magic detection for MFU
2024-08-25 15:12:53 +02:00
Philippe Teuwen
62735e4440
hf mf isen: longer RF reset
2024-08-07 17:01:59 +02:00
Philippe Teuwen
099a37af91
add --hardreset to hf mf isen
2024-08-07 16:09:11 +02:00
Philippe Teuwen
5ca3013d23
hf mf fchk: fix single key mode
2024-08-02 11:02:41 +02:00
Philippe Teuwen
18a3d04de1
hf mf isen incblk2 increment to the next sector
2024-08-01 14:28:00 +02:00
Philippe Teuwen
dc287c232f
hf mf isen: support n=0 to just get first auth data
2024-07-30 13:23:08 +02:00
Philippe Teuwen
e7c4ae2b1e
hf mf isen for analyzing some static encrypted nonces MFC
2024-07-29 23:19:18 +02:00
Philippe Teuwen
de326fc772
hf mf rdbl/wrbl/rdsc/nested: support extended AUTH
2024-07-29 22:38:30 +02:00
Philippe Teuwen
98273d00ae
hf mf fchk: allow to crack a single key and show progress info
2024-07-29 22:24:46 +02:00
iceman1001
c4c1601446
added rudimentary functions for doing AES authentication against MIFARE UL AES tags. (wip)
2024-02-15 16:20:47 +01:00
iceman1001
81ce1fd4ab
changed magic detection to use flags. Fixes previous problems with magic ntag, also renamed defines to seperate them better.
2024-02-02 15:53:57 +01:00
nvx
49f7ae57dc
Changed hf mf gdmcfg/gdmsetcfg commands to support Gen1a and GDM Alt magic wakeups
...
This was implemented with a new pair of RPCs CMD_HF_MIFARE_READBL_EX and CMD_HF_MIFARE_WRITEBL_EX
these RPCs support all combinations of read/write commands, wakeup, and auth options so
in time can replace the other MFC read/write commands too reduce armsrc code size
and complexity.
Also added config parsing for the gdm cfg block when reading with hf mf gdmcfg and
explicitly with hf mf gdmparsecfg.
2024-01-26 20:09:08 +10:00
iceman1001
2288c7e72b
less memory footprint
2024-01-25 16:23:00 +01:00
iceman1001
238572c337
style
2024-01-01 21:52:05 +01:00
iceman1001
c54f6af925
code style, remove unneeded UID array allocations since we just dont use the UID later in those functions
2023-12-31 09:56:46 +01:00
iceman1001
3df5fb6d40
cleaned up style
2023-12-31 09:43:45 +01:00
iceman1001
873c1e57a3
cleaned up and reduced number of arrays used
2023-12-31 09:36:25 +01:00
iceman1001
f840dc810b
made keytype instead of fixed keyB. would help in situations keyB is readable...
2023-12-31 09:35:42 +01:00
iceman1001
1f4f5febae
adapt magic detection and textual output. Hf mf info - now uses found keys to send for magic detection
2023-12-30 23:08:58 +01:00
nvx
8f577ad963
Improved magic detection
...
Magic detection no longer stops when a single type is found as cards may support multiple types of magic, so all detected types will be reported now.
GDM/USCUID chips are now detected when GDM magic auth is disabled but magic WUP (40 or 20) is enabled.
Gen2/CUID/DirectWrite is now detected when default keys and ACLs are used by attempting to write to block 0 but aborting before actually completing the write.
2023-12-30 19:53:23 +10:00
iceman1001
1c8b2110bb
reduce stack usage
2023-12-15 16:39:42 +01:00
merlokk
2517e8b345
make style
2023-12-12 01:11:10 +02:00
merlokk
91892bc1bf
add static encrypted nonce detection
2023-12-11 21:24:26 +02:00
iceman1001
58f9ba0abf
ugly hack to load the signature data if we are on a MFC Ev1 card. First we dont want to trigger the partial read unnecessary and secondly we dont save signature data in our MFC dump file. Need to adapt the JSON format for this
2023-07-27 22:23:33 +02:00
iceman1001
8ef1cdbd75
inceased waiting time..
2023-07-27 18:56:11 +02:00
iceman1001
6ba002725f
rmeoved some fct devices side regarding eml get/ set
2023-07-27 18:55:41 +02:00
iceman1001
42700d3c51
skip sector 16 at all since it seems to always be locked down even if the keys authenticate. MFC Ev1 related and less errrors in autopwn when running against a MFC Ev1 in the dumping phase
2023-07-27 12:40:04 +02:00
iceman1001
123ef14667
style
2023-07-26 23:50:12 +02:00
iceman1001
1cb15c84c1
adapting hf mf cget* commands to longer timeouts. Same with the quick eload used in autopwn among others.\nAlso adapted the return codes, so its more accurate in its reporting back to the client. Also added some more informative messages
2023-07-25 21:29:31 +02:00
iceman1001
6cc59848d5
fix bug in return code for hf mf writeblock where it would say it succeeded when it didnt
2023-07-15 11:51:08 +02:00
nvx
edd8e36d80
Cleanup arm-side reader-mode mifare classic block read/write code.
2023-07-04 00:11:01 +10:00
iceman1001
ed0d18f05d
QL88 tag identification. Thanks to AnnPlusPluss and Atlab for finding the key
2023-06-28 13:27:50 +02:00
