dash/proxmark3
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

chg: hf mf dbg\nchg: hf mf sim\nchg: hf 14a sim - uses NG

Browse Source
This commit is contained in:
iceman1001
2019-05-26 13:42:27 -04:00
parent 51e4df533e
commit b05796c7c4
7 changed files with 66 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
armsrc/appmain.c
View File

@@ -1017,9 +1017,16 @@ static void PacketReceived(PacketCommandNG *packet) {
case CMD_READER_ISO_14443a:
ReaderIso14443a(packet);
break;
case CMD_SIMULATE_TAG_ISO_14443a:
SimulateIso14443aTag(packet->oldarg[0], packet->oldarg[1], packet->data.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
case CMD_SIMULATE_TAG_ISO_14443a: {
struct p {
uint8_t tagtype;
uint8_t flags;
uint8_t uid[10];
} PACKED;
struct p* payload = (struct p*) packet->data.asBytes;
SimulateIso14443aTag(payload->tagtype, payload->flags, payload->uid); // ## Simulate iso14443a tag - pass tag type & UID
break;
}
case CMD_ANTIFUZZ_ISO_14443a:
iso14443a_antifuzz(packet->oldarg[0]);
break;
@@ -1076,13 +1083,20 @@ static void PacketReceived(PacketCommandNG *packet) {
MifareChkKeys_fast(packet->oldarg[0], packet->oldarg[1], packet->oldarg[2], packet->data.asBytes);
break;
}
case CMD_SIMULATE_MIFARE_CARD:
Mifare1ksim(packet->oldarg[0], packet->oldarg[1], packet->data.asBytes);
case CMD_SIMULATE_MIFARE_CARD: {
struct p {
uint16_t flags;
uint8_t exitAfter;
uint8_t uid[10];
} PACKED;
struct p* payload = (struct p*) packet->data.asBytes;
Mifare1ksim(payload->flags, payload->exitAfter, payload->uid);
}
break;
// emulator
case CMD_MIFARE_SET_DBGMODE:
MifareSetDbgLvl(packet->oldarg[0]);
MifareSetDbgLvl(packet->data.asBytes[0]);
break;
case CMD_MIFARE_EML_MEMCLR:
MifareEMemClr();
@@ -1362,6 +1376,7 @@ static void PacketReceived(PacketCommandNG *packet) {
uint8_t *mem = BigBuf_get_addr();
uint32_t startidx = packet->oldarg[0];
uint32_t numofbytes = packet->oldarg[1];
// arg0 = startindex
// arg1 = length bytes to transfer
// arg2 = BigBuf tracelen

1
armsrc/apps.h
View File

@@ -129,7 +129,6 @@ void ClearFpgaShiftingRegisters(void);
// iso14443a.h
void RAMFUNC SniffIso14443a(uint8_t param);
void SimulateIso14443aTag(int tagType, int flags, uint8_t *data);
void ReaderIso14443a(PacketCommandNG *c);
// Also used in iclass.c

2
armsrc/iso14443a.c
View File

@@ -1028,7 +1028,7 @@ static bool SimulateIso14443aInit(int tagType, int flags, uint8_t *data, tag_res
// response to send, and send it.
// 'hf 14a sim'
//-----------------------------------------------------------------------------
void SimulateIso14443aTag(int tagType, int flags, uint8_t *data) {
void SimulateIso14443aTag(uint8_t tagType, uint8_t flags, uint8_t *data) {
#define ATTACK_KEY_COUNT 8 // keep same as define in cmdhfmf.c -> readerAttack()

2
armsrc/iso14443a.h
View File

@@ -119,7 +119,7 @@ RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time);
RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time);
void RAMFUNC SniffIso14443a(uint8_t param);
void SimulateIso14443aTag(int tagType, int flags, uint8_t *data);
void SimulateIso14443aTag(uint8_t tagType, uint8_t flags, uint8_t *data);
void iso14443a_antifuzz(uint32_t flags);
void ReaderIso14443a(PacketCommandNG *c);
void ReaderTransmit(uint8_t *frame, uint16_t len, uint32_t *timing);

10
armsrc/mifaresim.c
View File

@@ -960,7 +960,7 @@ void Mifare1ksim(uint16_t flags, uint8_t exitAfterNReads, uint8_t *datain) {
// Collect AR/NR per keytype & sector
if ((flags & FLAG_NR_AR_ATTACK) == FLAG_NR_AR_ATTACK) {
if (MF_DBGLEVEL >= 0) Dbprintf("FLAG_NR_AR_ATTACK");
for (uint8_t i = 0; i < ATTACK_KEY_COUNT; i++) {
if (ar_nr_collected[i + mM] == 0 || ((cardAUTHSC == ar_nr_resp[i + mM].sector) && (cardAUTHKEY == ar_nr_resp[i + mM].keytype) && (ar_nr_collected[i + mM] > 0))) {
// if first auth for sector, or matches sector and keytype of previous auth
@@ -989,6 +989,7 @@ void Mifare1ksim(uint16_t flags, uint8_t exitAfterNReads, uint8_t *datain) {
ar_nr_resp[i + mM].nonce2 = nonce;
ar_nr_resp[i + mM].nr2 = nr;
ar_nr_resp[i + mM].ar2 = ar;
if (!gettingMoebius) {
nonce2_count++;
// check if this was the last second nonce we need for std attack
@@ -1005,7 +1006,8 @@ void Mifare1ksim(uint16_t flags, uint8_t exitAfterNReads, uint8_t *datain) {
} else {
moebius_n_count++;
// if we've collected all the nonces we need - finish.
if (nonce1_count == moebius_n_count) finished = true;
if (nonce1_count == moebius_n_count)
finished = true;
}
}
ar_nr_collected[i + mM]++;
@@ -1149,7 +1151,7 @@ void Mifare1ksim(uint16_t flags, uint8_t exitAfterNReads, uint8_t *datain) {
// NR AR ATTACK
if (((flags & FLAG_NR_AR_ATTACK) == FLAG_NR_AR_ATTACK) && (MF_DBGLEVEL >= 1)) {
if (((flags & FLAG_NR_AR_ATTACK) == FLAG_NR_AR_ATTACK) && (MF_DBGLEVEL >= MF_DBG_INFO)) {
for (uint8_t i = 0; i < ATTACK_KEY_COUNT; i++) {
if (ar_nr_collected[i] == 2) {
Dbprintf("Collected two pairs of AR/NR which can be used to extract %s from reader for sector %d:", (i < ATTACK_KEY_COUNT / 2) ? "keyA" : "keyB", ar_nr_resp[i].sector);
@@ -1180,7 +1182,7 @@ void Mifare1ksim(uint16_t flags, uint8_t exitAfterNReads, uint8_t *datain) {
}
}
if (MF_DBGLEVEL >= 1) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) {
Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", get_tracing(), BigBuf_get_traceLen());
}