dash/proxmark3
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Added 'mf mfu sim t 7 n <numreads>' - MFU emulation now supports automatic exit after <num> blocks read.

Browse Source
This commit is contained in:
cyberpunk-re
2020-11-30 20:07:51 +00:00
parent 681975d937
commit 5486bdd18c
8 changed files with 35 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
armsrc/Standalone/hf_aveful.c
View File

@@ -243,7 +243,7 @@ void RunMod(void) {
uint8_t flags = FLAG_7B_UID_IN_DATA;
Dbprintf("Starting simulation, press pm3-button to stop and go back to search state.");
SimulateIso14443aTag(7, flags, card.uid);
SimulateIso14443aTag(7, flags, card.uid, 0);
// Go back to search state if user presses pm3-button
state = STATE_SEARCH;

12
armsrc/Standalone/hf_young.c
View File

@@ -244,22 +244,22 @@ void RunMod(void) {
if (uids[selected].sak == 0x08 && uids[selected].atqa[0] == 0x04 && uids[selected].atqa[1] == 0) {
DbpString("Mifare Classic 1k");
SimulateIso14443aTag(1, flags, data);
SimulateIso14443aTag(1, flags, data, 0);
} else if (uids[selected].sak == 0x18 && uids[selected].atqa[0] == 0x02 && uids[selected].atqa[1] == 0) {
DbpString("Mifare Classic 4k (4b uid)");
SimulateIso14443aTag(8, flags, data);
SimulateIso14443aTag(8, flags, data, 0);
} else if (uids[selected].sak == 0x08 && uids[selected].atqa[0] == 0x44 && uids[selected].atqa[1] == 0) {
DbpString("Mifare Classic 4k (7b uid)");
SimulateIso14443aTag(8, flags, data);
SimulateIso14443aTag(8, flags, data, 0);
} else if (uids[selected].sak == 0x00 && uids[selected].atqa[0] == 0x44 && uids[selected].atqa[1] == 0) {
DbpString("Mifare Ultralight");
SimulateIso14443aTag(2, flags, data);
SimulateIso14443aTag(2, flags, data, 0);
} else if (uids[selected].sak == 0x20 && uids[selected].atqa[0] == 0x04 && uids[selected].atqa[1] == 0x03) {
DbpString("Mifare DESFire");
SimulateIso14443aTag(3, flags, data);
SimulateIso14443aTag(3, flags, data, 0);
} else {
Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
SimulateIso14443aTag(1, flags, data);
SimulateIso14443aTag(1, flags, data, 0);
}
} else if (button_pressed == BUTTON_SINGLE_CLICK) {

3
armsrc/appmain.c
View File

@@ -1274,9 +1274,10 @@ static void PacketReceived(PacketCommandNG *packet) {
uint8_t tagtype;
uint8_t flags;
uint8_t uid[10];
uint8_t exitAfter;
} PACKED;
struct p *payload = (struct p *) packet->data.asBytes;
SimulateIso14443aTag(payload->tagtype, payload->flags, payload->uid); // ## Simulate iso14443a tag - pass tag type & UID
SimulateIso14443aTag(payload->tagtype, payload->flags, payload->uid, payload->exitAfter); // ## Simulate iso14443a tag - pass tag type & UID
break;
}
case CMD_HF_ISO14443A_ANTIFUZZ: {

14
armsrc/iso14443a.c
View File

@@ -1252,7 +1252,7 @@ bool SimulateIso14443aInit(int tagType, int flags, uint8_t *data, tag_response_i
// response to send, and send it.
// 'hf 14a sim'
//-----------------------------------------------------------------------------
void SimulateIso14443aTag(uint8_t tagType, uint8_t flags, uint8_t *data) {
void SimulateIso14443aTag(uint8_t tagType, uint8_t flags, uint8_t *data, uint8_t exitAfterNReads) {
#define ATTACK_KEY_COUNT 8 // keep same as define in cmdhfmf.c -> readerAttack()
@@ -1328,6 +1328,7 @@ void SimulateIso14443aTag(uint8_t tagType, uint8_t flags, uint8_t *data) {
int happened = 0;
int happened2 = 0;
int cmdsRecvd = 0;
uint32_t numReads = 0; //Counts numer of times reader reads a block
// compatible write block number
uint8_t wrblock = 0;
@@ -1339,7 +1340,10 @@ void SimulateIso14443aTag(uint8_t tagType, uint8_t flags, uint8_t *data) {
LED_A_ON();
// main loop
for (;;) {
//for (;;) {
bool finished = false;
bool button_pushed = BUTTON_PRESS();
while (!button_pushed && !finished) {
WDT_HIT();
tag_response_info_t *p_response = NULL;
@@ -1468,6 +1472,12 @@ void SimulateIso14443aTag(uint8_t tagType, uint8_t flags, uint8_t *data) {
emlGetMemBt(emdata, start, 16);
AddCrc14A(emdata, 16);
EmSendCmd(emdata, sizeof(emdata));
numReads++; // Increment number of times reader requested a block
if (exitAfterNReads > 0 && numReads == exitAfterNReads) {
Dbprintf("[MFUEMUL_WORK] %d reads done, exiting", numReads);
finished = true;
}
}
// We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
p_response = NULL;

2
armsrc/iso14443a.h
View File

@@ -129,7 +129,7 @@ RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time);
RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time);
void RAMFUNC SniffIso14443a(uint8_t param);
void SimulateIso14443aTag(uint8_t tagType, uint8_t flags, uint8_t *data);
void SimulateIso14443aTag(uint8_t tagType, uint8_t flags, uint8_t *data, uint8_t numReads);
bool SimulateIso14443aInit(int tagType, int flags, uint8_t *data, tag_response_info_t **responses, uint32_t *cuid, uint32_t counters[3], uint8_t tearings[3], uint8_t *pages);
bool GetIso14443aCommandFromReader(uint8_t *received, uint8_t *par, int *len);
void iso14443a_antifuzz(uint32_t flags);