pax_global_header00006660000000000000000000000064134233411320014506gustar00rootroot0000000000000052 comment=e13d373cc23c4e0b89f112b5e4e6d21f737d937e mfterm-master/000077500000000000000000000000001342334113200136355ustar00rootroot00000000000000mfterm-master/.gitignore000066400000000000000000000005441342334113200156300ustar00rootroot00000000000000mfterm .depends .deps *.o *.a *~ *.bak Makefile Makefile.in aclocal.m4 autom4te.cache config.h config.h.in config.log config.status configure compile ylwrap depcomp install-sh stamp-h1 missing libdp_a-dictionary_parser.c libsp_a-spec_tokenizer.c libsp_a-spec_parser.c libsp_a-spec_parser.h debian/files debian/mfterm.debhelper.log debian/mfterm.substvars mfterm-master/.travis.yml000066400000000000000000000005421342334113200157470ustar00rootroot00000000000000language: c script: ./autogen.sh && ./configure && make before_install: - sudo apt-get -qq update - sudo apt-get install -y libusb-dev install: - wget https://github.com/nfc-tools/libnfc/releases/download/libnfc-1.7.1/libnfc-1.7.1.tar.bz2 - tar jxf libnfc-1.7.1.tar.bz2 - pushd libnfc-1.7.1 && ./configure && make && sudo make install && popd mfterm-master/AUTHORS000066400000000000000000000001031342334113200146770ustar00rootroot00000000000000Anders Sundman Markus Näsman mfterm-master/COPYING000066400000000000000000001045131342334113200146740ustar00rootroot00000000000000 GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The GNU General Public License is a free, copyleft license for software and other kinds of works. The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things. To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others. For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it. For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions. Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users. Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free. The precise terms and conditions for copying, distribution and modification follow. TERMS AND CONDITIONS 0. Definitions. "This License" refers to version 3 of the GNU General Public License. "Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks. "The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations. To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work. A "covered work" means either the unmodified Program or a work based on the Program. To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well. To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying. An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion. 1. Source Code. The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work. A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language. The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it. The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work. The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source. The Corresponding Source for a work in source code form is that same work. 2. Basic Permissions. All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law. You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you. Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary. 3. Protecting Users' Legal Rights From Anti-Circumvention Law. No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures. When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures. 4. Conveying Verbatim Copies. You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program. You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee. 5. Conveying Modified Source Versions. You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions: a) The work must carry prominent notices stating that you modified it, and giving a relevant date. b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices". c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it. d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so. A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b. d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements. e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work. A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product. "Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM). The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network. Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying. 7. Additional Terms. "Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions. When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission. Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms: a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or d) Limiting the use for publicity purposes of names of licensors or authors of the material; or e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors. All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying. If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms. Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way. 8. Termination. You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11). However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation. Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice. Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10. 9. Acceptance Not Required for Having Copies. You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so. 10. Automatic Licensing of Downstream Recipients. Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License. An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts. You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it. 11. Patents. A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version". A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License. Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version. In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party. If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid. If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it. A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007. Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law. 12. No Surrender of Others' Freedom. If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program. 13. Use with the GNU Affero General Public License. Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such. 14. Revised Versions of this License. The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation. If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program. Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version. 15. Disclaimer of Warranty. THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16. Limitation of Liability. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 17. Interpretation of Sections 15 and 16. If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . Also add information on how to contact you by electronic and paper mail. If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode: Copyright (C) This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an "about box". You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see . The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read . mfterm-master/INSTALL000066400000000000000000000021751342334113200146730ustar00rootroot00000000000000Installation of mfterm If you got the sources from git, run "./autogen.sh" to have the auto tools generate some files requried for the build. If you got the source from a source code distribution, then you do not have to perform this step. To build and install mfterm issue the commands: $ ./autogen.sh # If using the sources from the git repo $ ./configure # Possibly with some options, use --help $ make $ make install # Possibly using sudo Dependencies for building mfterm are: libnfc (1.7.0), libreadline, libcrypto, OpenSSL, bison, flex. Trouble shooting: If you get error messages when trying to read a tag. Verify that libnfc is installed and configured correctly with the 'nfc-list' utility program (supplied with libnfc). It should not give you any error messages and if you place a tag on your reader, it should be detected. When building, if you get the error message: "error: implicit declaration of function ‘rpl_malloc’" Try this: after running the autogen, but before running the configure, set the shell variable: $ export ac_cv_func_malloc_0_nonnull=yes then run configure, make, make install again. mfterm-master/Makefile.am000066400000000000000000000036361342334113200157010ustar00rootroot00000000000000# Copyright (C) 2012 Anders Sundman # # This file is part of mfterm. # # mfterm is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # mfterm is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with mfterm. If not, see . AM_CFLAGS = -g -Wall -Wconversion -std=c99 -Werror SUBDIRS = . bin_PROGRAMS = mfterm mfterm_SOURCES = \ mfterm.h mfterm.c \ term_cmd.h term_cmd.c \ util.h util.c \ tag.h tag.c \ mifare.h mifare.c \ mifare_ctrl.h mifare_ctrl.c \ dictionary.h dictionary.c \ spec_syntax.h spec_syntax.c \ mac.h mac.c mfterm_LDADD = libdp.a libsp.a -lreadline -lnfc -lcrypto man1_MANS = mfterm.man dist_man1_MANS = mfterm.man # We create two convenience libraries fot the parser targets. This is # to allow us to use different flags (since automake doesn't support # per file, but only per target flags). noinst_LIBRARIES = libdp.a libsp.a libdp_a_SOURCES = dictionary_parser.l libdp_a_LFLAGS = --prefix=dp_ -o$(LEX_OUTPUT_ROOT).c libdp_a_CFLAGS = -g -std=c99 -Wall -Wno-unused-function -Wno-unused-but-set-variable -Wno-implicit-function-declaration libsp_a_SOURCES = spec_tokenizer.l spec_parser.y libsp_a_LFLAGS = --prefix=sp_ -o$(LEX_OUTPUT_ROOT).c libsp_a_YFLAGS = --name-prefix=sp_ -d libsp_a_CFLAGS = -g -std=c99 -Wall -Wno-unused-function -Wno-unused-but-set-variable -Wno-implicit-function-declaration BUILT_SOURCES = libsp_a-spec_parser.h mfterm-master/README.md000066400000000000000000000110001342334113200151040ustar00rootroot00000000000000# Mfterm [![Build Status](https://travis-ci.org/4ZM/mfterm.svg?branch=master)](https://travis-ci.org/4ZM/mfterm) mfterm is a terminal interface for working with Mifare Classic tags. Installation ----------- ### Mac OS `brew install mfterm` ### Linux Precompiled package in [Kali Linux](https://www.kali.org/) Usage ----------- Tab completion on commands is available. Also, commands that have file name arguments provide tab completion on files. There is also a command history, like in most normal shells. Working with the mfterm program there are a few state variables that are used. Current Tag ----------- The "current tag" is populated with the 'load' or 'read' commands. The 'read' command will read data from a physical tag and requires the "current keys" to be set to the keys of the tag. Clear the "current tag" by using the 'clear' command. Display the "current tag" by using the 'print' command. The keys of the "current tag" are displayed with the 'print keys' command. Note: the tag keys could be different from the "current keys" displayed by the 'keys print' command. The data of the "current tag" can be manipulated with the 'set' command. The "current tag" can be persisted by writing it to a file with the 'save' command. It can also be written to a physical tag with the 'write' command. For the 'write' command to succeed, the "current keys" have to be set to appropriate values. The 'write unlocked' command can be used to write to block 0 on some 1k pirate cards. If you are reading or loading a 1k tag, the mfterm program will still use a full 4k tag to represent it. The last 3k will be all zeroes. This is in analogy with the other libnfc tools. Current Keys ------------ The "current keys" are used to authenticate when performing operations on a physical tag. They can be displayed using the 'keys' command. Clear the "current keys" by using the 'keys clear' command. The keys are stored just like a tag in a file using the 'keys save', but with all the data fields except the sector trailers cleared. The keys can be loaded from a file, either a real tag dump or a key tag dump, with the 'keys load' command. The "current keys" can be set to match the "current tag" by using the 'keys import' command. It is also possible to manually set a key using the 'keys set' command. Use the 'keys test' command to test if the "current keys" can be used to authenticate with a physical tag. Dictionary ---------- A key dictionary can be imported from a file using the 'dict load' command. This dictionary can then be used to perform a dictionary attack on the sectors of a tag by using the 'dict attack' command. The format of the dictionary file is simple. One key (6 bytes, 12 hex characters) per line and # is a comment. Performing 'dict load' on several files will produce a dictionary that is the union of those files. Duplicates will be removed. To list all the keys in the dictionary, use the command 'dict'. To clear the dictionary use 'dict clear'. Other commands -------------- Quit the mfterm program by issuing the 'quit' command. Help is available by writing 'help' MAC Computation --------------- The function 'mac compute' is used for computing DES MACs (message authentication codes). They require a 64 bit key that can be set using the command 'mac key'. The same command, without arguments, is used to display the current key. The input to the DES MAC is UID + 14 left most bytes of the specified block. Using the command 'mac update' is shorthand for a MAC computation and then setting the MAC of the same block. Specification Files ------------------- A specification file defines names for parts of the tag data. See the file mfc-spec.txt for a sample specification. Specification files are loaded with the command 'spec load'. They can be cleared with 'spec clear'. To display the data structure loaded use the command 'spec'. Once a specification has been loaded, it can be used to access the data in the tag by using a specification path. In the sample specification, the path: '.sector_0.block_0.atqa', when entered in the terminal, will display the two bytes of data starting with byte 6. Building mfterm --------------- Standard: ./configure; make; make install See INSTALL file for details. WARNING: -------- The mfterm software is neither thoroughly tested nor widely used. It likely contains a number of serious bugs that can be exploited to compromise your computer. Do NOT run the mfterm software as a privileged user (e.g. root), and ONLY load tag, dictionary and specification files that you get from people you trust. mfterm-master/autogen.sh000077500000000000000000000001211342334113200156300ustar00rootroot00000000000000#!/bin/bash aclocal autoheader automake --add-missing --copy --foreign autoconf mfterm-master/configure.ac000066400000000000000000000046641342334113200161350ustar00rootroot00000000000000# Copyright (C) 2012 Anders Sundman # # This file is part of mfterm. # # mfterm is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # mfterm is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with mfterm. If not, see . AC_PREREQ([2.67]) AC_INIT([mfterm], [1.0.7], [anders@4zm.org]) AC_CONFIG_SRCDIR([mfterm.c]) AC_CONFIG_HEADERS([config.h]) AM_INIT_AUTOMAKE # Checks for programs. AC_CHECK_PROGS(YACC, 'bison -y' byacc yacc, :) if test "x$YACC" == "x:"; then AC_MSG_ERROR([Bison or some other YACC compatible parser generator is required.]) fi AC_PROG_YACC AC_PROG_CC AC_CHECK_PROGS(LEX, flex lex, :) if test "x$LEX" == "x:"; then AC_MSG_ERROR([Lex or Flex or is required.]) fi AM_PROG_LEX AC_PROG_MAKE_SET AC_PROG_RANLIB AM_PROG_CC_C_O # Checks for libraries. AC_CHECK_LIB([nfc], [nfc_open], [], [AC_MSG_ERROR([libnfc >= 1.7 is required (http://www.libnfc.org/download)])]) AC_CHECK_LIB([readline], [rl_completion_matches], [have_readline=yes], [AC_MSG_ERROR([libreadline is required])]) if test $have_readline = yes then AC_EGREP_HEADER([int rl_completion_suppress_append], [readline/readline.h], AC_DEFINE(HAVE_RL_COMPLETION_SUPPRESS_APPEND, 1, [Define if you have rl_completion_suppress_append]), AC_MSG_WARN([Command completion support limited by installed readline library])) fi AC_CHECK_LIB([crypto], [DES_set_key_unchecked], [HAVE_LIBCRYPTO=yes], [AC_MSG_ERROR([libcrypto is required])]) # Checks for header files. AC_CHECK_HEADERS([stddef.h stdint.h stdlib.h string.h strings.h], [], [AC_MSG_ERROR([A required header file was not found.])]) # Checks for typedefs, structures, and compiler characteristics. AC_HEADER_STDBOOL AC_TYPE_SIZE_T AC_TYPE_UINT8_T AC_CHECK_TYPES([ptrdiff_t]) # Checks for library functions. AC_FUNC_MALLOC AC_CHECK_FUNCS([memset strcasecmp strchr strdup strtol strtoul], [], [AC_MSG_ERROR([A required function was not found.])]) AC_CONFIG_FILES([Makefile]) AC_OUTPUT mfterm-master/debian/000077500000000000000000000000001342334113200150575ustar00rootroot00000000000000mfterm-master/debian/changelog000066400000000000000000000002171342334113200167310ustar00rootroot00000000000000mfterm (1.0.2) unstable; urgency=low * Initial release for Debian. -- Markus Näsman Wed, 02 Jan 2013 21:08:35 +0100 mfterm-master/debian/compat000066400000000000000000000000021342334113200162550ustar00rootroot000000000000008 mfterm-master/debian/control000066400000000000000000000011531342334113200164620ustar00rootroot00000000000000Source: mfterm Section: utils Priority: extra Maintainer: Markus Näsman Build-Depends: debhelper (>= 8.0.0), automake, libssl-dev, libnfc-dev, libnfc4, hardening-wrapper, libusb-0.1-4, libpcsclite1, mime-support, m4, libsigsegv2, perl-modules, flex, gawk, libreadline-dev, bison Standards-Version: 3.9.3 Homepage: https://github.com/4ZM/mfterm Vcs-Git: git://github.com/4ZM/mfterm.git Package: mfterm Architecture: any Depends: ${misc:Depends}, ${shlibs:Depends} Description: Terminal for working with Mifare Classic 1-4k Tags mfterm is a terminal interface for working with Mifare Classic tags. mfterm-master/debian/copyright000066400000000000000000000020711342334113200170120ustar00rootroot00000000000000Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Upstream-Name: mfterm Files: * Copyright: 2011 Anders Sundman , 2013 Markus Näsman License: GPL-3.0+ Files: debian/* Copyright: 2013 Markus Näsman License: GPL-3.0+ License: GPL-3.0+ This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. . This package is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. . You should have received a copy of the GNU General Public License along with this program. If not, see . . On Debian systems, the complete text of the GNU General Public License version 3 can be found in "/usr/share/common-licenses/GPL-3". mfterm-master/debian/rules000077500000000000000000000007701342334113200161430ustar00rootroot00000000000000#!/usr/bin/make -f # -*- makefile -*- # Sample debian/rules that uses debhelper. # This file was originally written by Joey Hess and Craig Small. # As a special exception, when this file is copied by dh-make into a # dh-make output file, you may use that output file without restriction. # This special exception was added by Craig Small in version 0.37 of dh-make. # Uncomment this to turn on verbose mode. #export DH_VERBOSE=1 override_dh_auto_configure: ./autogen.sh dh_auto_configure %: dh $@ mfterm-master/dictionary.c000066400000000000000000000050411342334113200161460ustar00rootroot00000000000000/** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . */ #include #include #include #include "dictionary.h" static key_list_t* key_list = NULL; key_list_t* kl_add(key_list_t** list, const uint8_t* key); void kl_clear(key_list_t** list); key_list_t* kl_make_node(const uint8_t* key); int key_cmp(const uint8_t* k1, const uint8_t* k2); void dictionary_clear() { kl_clear(&key_list); } int dictionary_add(const uint8_t* key) { return kl_add(&key_list, key) != NULL; } key_list_t* dictionary_get() { return key_list; } // Append a node to the list. Don't append duplicates, O(n) operation. key_list_t* kl_add(key_list_t** list, const uint8_t* key) { if (list == NULL) return NULL; // A new list if (*list == NULL) return *list = kl_make_node(key); // Append (but no duplicates) key_list_t* it = *list; key_list_t* last = NULL; while(it) { // Don't add duplicates, but move the key first in the list if (key_cmp(it->key, key) == 0) { if (last) { last->next = it->next; // disconnect it it->next = *list; // move it fisrt *list = it; // re-point the head } return NULL; // Return null on duplicates } last = it; it = it->next; } return last->next = kl_make_node(key); } void kl_clear(key_list_t** list) { if (list == NULL || *list == NULL) return; // Free the list nodes key_list_t* it = *list; do { key_list_t* next = it->next; free(it); it = next; } while(it); *list = 0; } key_list_t* kl_make_node(const uint8_t* key) { // Create the list node key_list_t* new_node = (key_list_t*) malloc(sizeof(key_list_t)); memcpy((void*)new_node, key, 6); new_node->next = NULL; return new_node; } int key_cmp(const uint8_t* k1, const uint8_t* k2) { for (int i = 0; i < 6; ++i) { if (k1[i] != k2[i]) return -1; } return 0; } mfterm-master/dictionary.h000066400000000000000000000033141342334113200161540ustar00rootroot00000000000000#ifndef DICTIONARY__H #define DICTIONARY__H /** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . */ #include #include typedef struct key_list_t_ { uint8_t key[6]; struct key_list_t_* next; } key_list_t; /** * Parse the input file and import all keys found in the dictionary. */ int dictionary_import(FILE* input); /** * Clear the dictionary and free all allocated memory. */ void dictionary_clear(); /** * Add a new key to the dictionary. If the dictionary does not exist * (is empty), it will be created and the key inserted. If the key * already exists in the list, it will be moved to the head of the * list and 0 will be returned; else != 0 is returned. * Note: this operation is O(n) */ int dictionary_add(const uint8_t* key); /** * Return a head pointer to the current dictionary (or NULL if it is * empty). Don't hang on to this pointer after an add operation, since * the list head migt change; rather, use this function again * everywhere a ref. to the list is required. */ key_list_t* dictionary_get(); #endif mfterm-master/dictionary.txt000066400000000000000000000211071342334113200165440ustar00rootroot00000000000000# More well known keys! # Standard keys FFFFFFFFFFFF A0A1A2A3A4A5 D3F7D3F7D3F7 000000000000 # Keys from mfoc B0B1B2B3B4B5 4D3A99C351DD 1A982C7E459A AABBCCDDEEFF 714C5C886E97 587EE5F9350F A0478CC39091 533CB6C723F6 8FD0A4F256E9 # Keys from: # http://pastebin.com/wcTHXLZZ A64598A77478 26940B21FF5D FC00018778F7 00000FFE2488 5C598C9C58B5 E4D2770A89BE # Keys from: # http://pastebin.com/svGjN30Q 434F4D4D4F41 434F4D4D4F42 47524F555041 47524F555042 505249564141 505249564142 # Keys from: # http://pastebin.com/d7sSetef 0297927C0F77 EE0042F88840 722BFCC5375F F1D83F964314 # Keys from: # http://pastebin.com/pvJX0xVS 54726176656C 776974687573 4AF9D7ADEBE4 2BA9621E0A36 # Keys from: # http://pastebin.com/y3PDBWR1 000000000001 123456789ABC B127C6F41436 12F2EE3478C1 34D1DF9934C5 55F5A5DD38C9 F1A97341A9FC 33F974B42769 14D446E33363 C934FE34D934 1999A3554A55 27DD91F1FCF1 A94133013401 99C636334433 43AB19EF5C31 A053A292A4AF 505249565441 505249565442 # Keys from: # http://pastebin.com/TUXj17K3 FC0001877BF7 # Keys from: # http://0x9000.blogspot.com/2010/12/mifare-classic-default-keys.html A0B0C0D0E0F0 A1B1C1D1E1F1 # Keys from: # https://code.google.com/p/mifare-key-cracker/downloads/list BD493A3962B6 010203040506 111111111111 222222222222 333333333333 444444444444 555555555555 666666666666 777777777777 888888888888 999999999999 AAAAAAAAAAAA BBBBBBBBBBBB CCCCCCCCCCCC DDDDDDDDDDDD EEEEEEEEEEEE 0123456789AB # Keys from: # https://github.com/4ZM/mfterm/blob/master/dictionary.txt 000000000002 00000000000A 00000000000B 100000000000 200000000000 A00000000000 B00000000000 # Key from: # ladyada.net ABCDEF123456 # Key from: # http://irq5.io/2013/04/13/decoding-bcard-conference-badges/ F4A9EF2AFC6D # Keys from: # https://github.com/iceman1001/proxmark 4B0B20107CCB 569369C5A0E5 632193BE1C3C 644672BD4AFE 8FE644038790 9DE89E070277 B5FF67CBA951 EFF603E1EFE9 F14EE7CAE863 44AB09010845 85FED980EA5A 314B49474956 564C505F4D41 0263DE1278F3 067DB45454A9 0DB5E6523F7C 100533B89331 136BDB246CAC 15FC4C7613FE 16F21A82EC84 16F3D5AB1139 17758856B182 186D8C4B93F9 1FC235AC1309 22C1BAE1AACD 243F160918D1 25094DF6F148 2735FC181807 2A3C347A1200 2ABA9519F574 324F5DF65310 32AC3B90AC13 35C3D2CAEE88 3A42F33AF429 3A4BBA8ADAF0 3DF14C8000A1 3E3554AF0E12 3E65E4FB65B3 40EAD80721CE 454841585443 460722122510 48FFE71294A0 491CDCFB7752 4AD1E273EAF1 4B791BEA7BCC 51119DAE5216 51284C3686A6 528C9DFFE28C 5EB8F884C8D1 5F146716E373 6202A38F69E2 6338A371C0ED 63F17A449AF0 643FB6DE2217 64E3C10394C2 653A87594079 67362D90F973 682D401ABB09 68D30288910A 693143F10368 6A470D54127C 740E9A4F9AAF 75CCB59C9BED 75D8690F21B6 75EDE6A84460 7DE02A7F6025 82F435DEDF01 83E3549CE42D 84FD7F7A12B6 85675B200017 871B8C085997 8765B17968A2 937A4FFF3011 97184D136233 97D1101F18B0 9AFA6CB4FC3D 9AFC42372AF1 9F131D8C2057 A27D3804C259 A3F97428DD01 A8966C7CC54B A9F953DEF0A3 AAFB06045877 AC0E24C75527 AE3FF4EEA0DB B0C9DD55DD4D B20B83CB145C B736412614AF BF23A53C1F63 C4652C54261C C6AD00254562 C7C0ADB3284F C82EC29E3235 CB9A1F2D7368 D39BB83F5297 D49E2826664F D8A274B2E026 DF27A8F1CB8E E2C42591368A E3429281EFC1 E444D53D359F F124C2578AD0 F59A36A2546D FEE470A4CB58 0000000018DE 0000014B5C31 003003003003 003CC420001A 013889343891 01FA3FC68349 021209197591 050908080008 0A7932DC7E65 0C669993C776 0C71BCFB7E72 0D258FE90296 0E83A374B513 0F230695923F 0FFBF65B5A14 11428B5BCE06 11428B5BCE07 11428B5BCE08 11428B5BCE09 11428B5BCE0A 11428B5BCE0F 11496F97752A 123F8888F322 1322285230B8 1565A172770F 157B10D84C6B 157C9A513FA5 15CAFD6159F6 160A91D29A9C 16551D52FD20 167A1BE102E0 16DDCB6B3F24 1717E34A7A8A 17193709ADF4 185FA3438949 1877ED29435A 18971D893494 1AB23CD45EF6 1ACC3189578C 1F107328DC8D 1F1A0A111B5B 1F1FFE000000 2031D1E57A3B 204752454154 21A600056CB0 22729A9BD40F 2338B4913111 2548A443DF28 25D60050BF6E 26643965B16E 26973EA74321 27FBC86A00D0 2A2C13CC242A 2A6D9205E7CA 2CB1A90071C8 2DD39A54E1F3 2ED3B15E7C0F 2EF720F2AF76 2FC1F32F51B1 2FEAE851C199 3060206F5B0A 31646241686C 321958042333 321A695BD266 340E40F81CD8 345547514B4D 356D46474348 369A4663ACD2 36ABF5874ED7 374BF468607F 381ECE050FBD 386B4D634A65 38FCF33072E0 3A09594C8587 3B7E4FD575AD 3C5D1C2BCD18 3E84D2612E2A 3FA7217EC575 410B9B40B872 414C41524F4E 415A54454B4D 4186562A5BB2 424C41524F4E 425A73484166 436A46587552 447AB7FD5A6B 44DD5A385AAF 44F0B5FBE344 45635EF66EF3 476242304C53 484558414354 484944204953 484A57696F4A 48734389EDC3 48C739E21A04 49FAE4E3849F 4A6352684677 4C32BAF326E0 4C6B69723461 4C961F23E6BE 4D3248735131 4D5076656D58 4E32336C6E38 4E4175623670 4F9F59C9C875 509359F131B1 51044EFB5AAB 5106CA7E4A69 513C85D06CDE 52264716EFDE 536653644C65 53C11F90822A 543B01B27A95 5481986D2D62 5544564E6E67 564777315276 568C9083F71C 57734F6F6974 57784A533069 584F66326877 5A1B85FCE20A 5EC39B022F2B 623055724556 62387B8D250D 6245E47352E6 62CED42A6D87 62D0C424ED8E 62EFD80AB715 645A166B1EEB 649D2ABBBD20 666E564F4A44 668770666644 66B03ACA6EE9 66D2B7DC39EF 66F3ED00FED7 67546972BC69 675557ECC92E 686A736A356E 68D3F7307C89 69FB7B7CD8EE 6A1987C40A21 6A676C315142 6A696B646631 6B6579737472 6BC1E1AE547D 6C78928E1317 6C94E1CED026 6D44B5AAF464 6D4C5B3658D2 6D4E334B6C48 6DB17C16B35B 6F4B6D644178 6F506F493353 703140FD6D86 70564650584F 710732200D34 71F3A315AD26 744E326B3441 752FBB5B7B45 756EF55E2507 77494C526339 77646B633657 77A84170B574 79674F96C771 7B296C40C486 7B296F353C6B 7C335FB121B5 7F33625BC129 8553263F4FF0 8697389ACA26 86AFD95200F7 87DF99D496CB 8829DA9DAF76 89347350BD36 8AD5517B4B18 8E5D33A6ED51 8ED41E8B8056 8FA1D601D0A2 911E52FD7CE4 9189449EA24E 91CE16C07AC5 91F93A5564C9 925B158F796F 92EE4DC87191 932B9CB730EF 94414C1A07DC 95093F0B2E22 961C0DB4A7ED 987A7F7F1A35 9B832A9881FF 9CB290282F7D 9DC282D46217 9F42971E8322 A10F303FC879 A21680C27773 A22AE129C013 A2ABB693CE34 A4F204203F56 A56C2DF9A26D A57186BDD2B9 A643F952EA57 A6CAC2886412 A7ABBC77CC9E A8D0D850A606 A920F32FE93A AA0720018738 AB4E7045E97D AC70CA327A04 AD4FB33388BF AD9E0A1CA2F7 AFD0BA94D624 B1ACA33180A5 B35A0E4ACC09 B39AE17435DC B468D1991AF9 B578F38A5C61 B725F9CBF183 B7BF0C13066E B8A1F613CF3D BA5B895DA162 BBA840BA1C57 BBE8FFFCF363 BEDB604CC9D1 BF1F4424AF76 BFB6796A11DB BFC8E353AF63 C0C1C2C3C4C5 C0DECE673829 C2B7EC7D4EB1 C3C88C6340B8 C3F19EC592A2 C4104FA3C526 C5132C8980BC C5CFE06D9EA3 C620318EF179 C6D375B99972 C96BD1CE607F CB779C50E1BD CBA6AE869AD5 CC6B3B3CD263 D0D1D2D3D4D5 D21762B2DE3B D2A597D76936 D327083A60A7 D4FE03CE5B06 D4FE03CE5B07 D4FE03CE5B08 D4FE03CE5B09 D4FE03CE5B0A D4FE03CE5B0F D58023BA2BDC D9A37831DCE5 DB1A3338B2EB DD61EB6BCE22 DF37DCB6AFB3 E10623E7A016 E241E8AFCBAF E2A5DC8E066F E4F65C0EF32C E55A3CA71826 E64A986A5D94 E703589DB50B EB0A8FF88ADE EC0A9B1A9E06 ED646C83A4F3 EE4CC572B40E EEB420209D0C F101622750B7 F1B9F5669CC8 F23442436765 F238D78FF48F F26E21EDCEE2 F4396E468114 F4CD5D4C13FF F662248E7E89 F72A29005459 F792C4C76A5C F7A39753D018 F9861526130F FAD63ECB5891 # Some keys of https://w3bsit3-dns.com and https://ikey.ru BC4580B7F20B 8E26E45E7D65 A7141147D430 18E3A02B5EFF E328A1C7156D 8A8D88151A00 7A86AA203788 72F96BDD3714 4B609876BBA3 C76BF71A2509 1B61B2E78C75 045CECA15535 6B07877E2C5C 0CE7CD2CC72B 8C97CD7A0E56 3367BFAA91DB EA0FD73CB149 B81F2B0C2F66 BB52F8CCE07F 46D78E850A7E E4821A377B75 8791B2CCB5C4 D5524F591EED BAFF3053B496 0F318130ED18 42E9B54E51AB 7413B599C4EA 9EA3387A63C1 B27ADDFB64B0 E56AC127DD45 0BE5FAC8B06A FD8705E721B0 7259FA0197C6 22052B480D11 9D993C5D4EF4 C65D4EAA645B 0EB23CC8110B 3A8A139C20B4 19FC84A3784B 0F01CEFF2742 A3FAA6DAFF67 BC2D1791DEC1 7A396F0D633D ACFFFFFFFFFF B9F8A7D83978 77DABC9825E1 518DC6EEA089 044CE1872BC3 114D6BE9440C AFCEF64C9913 # Russian Troika card 08B386463229 0E8F64340BA4 0F1C63013DBA 2AA05ED1856F 2B7F3253FAC5 69A32F1C2F19 73068F118C13 9BECDF3D9273 A73F5DC1D333 A82607B01C0D AE3D65A3DAD4 CD4C61C26E3D D3EAFB5DF46D E35173494A81 FBC2793D540B 5125974CD391 ECF751084A80 7545DF809202 AB16584C972A 7A38E3511A38 C8454C154CB5 04C297B91308 EFCB0E689DB3 07894FFEC1D6 FBA88F109B32 2FE3CB83EA43 B90DE525CEB6 1CC219E9FEC1 A74332F74994 764CD061F1E6 8F79C4FD8A01 CD64E567ABCD CE26ECB95252 ABA208516740 9868925175BA 16A27AF45407 372CC880F216 3EBCE0925B2F 73E5B9D9D3A4 0DB520C78C1C 70D901648CB9 C11F4597EFB5 B39D19A280DF 403D706BA880 7038CD25C408 6B02733BB6EC EAAC88E5DC99 4ACEC1205D75 2910989B6880 31C7610DE3B0 5EFBAECEF46B F8493407799D 6B8BD9860763 D3A297DC2698 FBF225DC5D58 # Keys from RfidResearchGroup proxmark3 project # https://github.com/RfidResearchGroup/proxmark3/blob/master/client/default_keys.dic 0854BF31111E 0C03A720F208 135B88A94B8B 1FCEF3005BCF 2F47741062A0 361F69D2C462 3A09911D860C 3D50D902EA48 400BC9BE8976 4708111C8604 50A11381502C 560F7CFF2D81 60012E9BA3FA 6018522FAC02 66B31E64CA4B 6700F10FEC09 7A09CC1DB70A 81BFBE8CACBA 8A036920AC0C 8A19D40CF2B5 96A301BCE267 9E53491F685B A170D9B59F95 AE8587108640 B4166B0A27EA BB467463ACD6 BFF123126C9B C01FC822C6E5 D58660D1ACDE D80511FC2AB4 D9BCDE7FC489 DE1FCBEC764B E67C8010502D FF58BA1B4478 mfterm-master/dictionary_parser.l000066400000000000000000000036731342334113200175440ustar00rootroot00000000000000/** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . */ %{ #include #include "dictionary.h" static uint8_t key_token[6]; typedef enum { DT_KEY = 1, DT_ERR = 2 } dict_token_t; %} %option yylineno hex_digit [0-9a-fA-F] key {hex_digit}{12} comment #[^\n]* %% {key} { read_key(key_token, dp_text); return DT_KEY; } {comment} {} // eat comments [ \t\r\n]+ {} // eat white space . { printf("Line: %d - Unrecognized input: %s\n", dp_lineno, dp_text); return DT_ERR; } %% // Reset the line numbering at the end of a file int dp_wrap() { dp_lineno = 1; return 1; } // Parser loop. Import keys to the dictionary as they are found. int dictionary_import(FILE* input) { dict_token_t token; int res = 0; int keys_count = 0; int imported_count = 0; dp_in = input; while((token = dp_lex())) { switch(token) { case DT_KEY: ++keys_count; if (dictionary_add(key_token)) ++imported_count; break; case DT_ERR: default: res = -1; break; } } if (res) printf("There were errors.\n"); printf("%d keys (of %d) imported.\n", imported_count, keys_count); return res; } mfterm-master/mac.c000066400000000000000000000054571342334113200145540ustar00rootroot00000000000000/** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . */ #include #include #include "util.h" #include "mac.h" #include "tag.h" // The DES MAC key in use unsigned char current_mac_key[] = { 0, 0, 0, 0, 0, 0, 0, 0 }; /** * Compute a DES MAC, use DES in CBC mode. Key and output should be 8 * bytes. The length specifies the length of the input in bytes. It * will be zero padded to 8 byte alignment if required. */ int compute_mac(const unsigned char* input, unsigned char* output, const unsigned char* key, long length) { DES_cblock des_key = { key[0], key[1], key[2], key[3], key[4], key[5], key[6], key[7] }; // todo zeropad input if required const unsigned char* padded_input = input; // Generate a key schedule. Don't be picky, allow bad keys. DES_key_schedule schedule; DES_set_key_unchecked(&des_key, &schedule); // IV is all zeroes unsigned char ivec[] = { 0, 0, 0, 0, 0, 0, 0, 0 }; // Compute the DES in CBC DES_ncbc_encrypt(padded_input, output, length, &schedule, &ivec, 1); // Move up and truncate (we only want 8 bytes) for (int i = 0; i < 8; ++i) output[i] = output[length - 8 + i]; for (int i = 8; i < length; ++i) output[i] = 0; return 0; } /** * Compute the MAC of a given block with the specified 8 byte * key. Return a 8 byte MAC value. * * The input to MAC algo [ 4 serial | 14 data | 6 0-pad ] * * If update is * nonzero, the mac of the current tag is updated. If * not, the MAC is simply printed. */ unsigned char* compute_block_mac(unsigned int block, const unsigned char* key, int update) { static unsigned char output[8]; // Input to MAC algo [ 4 serial | 14 data | 6 0-pad ] unsigned char input[24]; memcpy(&input, current_tag.amb[0].mbm.abtUID, 4); memcpy(&input[4], current_tag.amb[block].mbd.abtData, 14); memset(&input[18], 0, 6); int res = 0; res = compute_mac(input, output, key, 24); // Ret null on error if (res != 0) return NULL; // Should the new MAC be written back? if (update) { memcpy(¤t_tag.amb[block].mbd.abtData[14], output, 2); } return output; } mfterm-master/mac.h000066400000000000000000000031251342334113200145470ustar00rootroot00000000000000#ifndef MAC__H #define MAC__H /** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . */ // The DES MAC key in use extern unsigned char current_mac_key[]; /** * Compute a DES MAC, use DES in CBC mode. Key and output should be 8 * bytes. The length specifies the length of the input in bytes. It * will be zero padded to 8 byte alignment if required. */ int compute_mac(const unsigned char* input, unsigned char* output, const unsigned char* key, long length); /** * Compute the MAC of a given block with the specified 8 byte * key. Return a 8 byte MAC value. * * The input to MAC algo [ 4 serial | 14 data | 6 0-pad ] * * If update is * nonzero, the mac of the current tag is updated. If * not, the MAC is simply printed. */ unsigned char* compute_block_mac(unsigned int block, const unsigned char* key, int update); #endif mfterm-master/mfc-spec.txt000066400000000000000000000044461342334113200161030ustar00rootroot00000000000000# Copyright (c) 2011 Anders Sundman # # This file is part of rkfterm. # # rkfterm is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # rkfterm is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with rkfterm. If not, see . # About the specification language: # # The primitive types in the specification language are Byte and Bit # and arrays of such. All other types need to be defined. # # Every specification must include the root type '.' # The root type is specified by its type name '.' . { Sector0 sector_0 # The types usesed here are defined below Sector1k[15] sectors_1k Sector4k[12] sectors_4k } # The type Sector_0 represents the first sector. Sector0 { { # This is an anonymous inner type. The type doesn't have a name. Byte[4] uid # Unique ID Byte cd # Check Byte; uid bytes xor:ed with cb should be 0 Bit[4] - # Not used. Use '-' as a name in theese cases Bit[4] sak Byte[2] atqa Byte[8] manufacturer_data } block_0 Block[2] blocks SectorTrailer trailer } Sector1k { Block[3] blocks SectorTrailer trailer } Sector4k { Block[15] blocks SectorTrailer trailer } Block { Byte[16] data } SectorTrailer { Byte[6] key_a ACL acl Byte[1] - # Undefined Byte[6] key_b } # See p.12 of Mifare MF1 IC S50 Functional Specification, rev. 4.0 # _b suffixed bits are inverted versions of non suffixed counterparts ACL { Bit c2x3_b # bit 7 Bit c2x2_b Bit c2x1_b Bit c2x0_b # bit 4 Bit c1x3_b # bit 3 Bit c1x2_b Bit c1x1_b Bit c1x0_b # bit 0 Bit c1x3 # bit 7 Bit c1x2 Bit c1x1 Bit c1x0 # bit 4 Bit c3x3_b # bit 3 Bit c3x2_b Bit c3x1_b Bit c3x0_b # bit 0 Bit c3x3 # bit 7 Bit c3x2 Bit c3x1 Bit c3x0 # bit 4 Bit c2x3 # bit 3 Bit c2x2 Bit c2x1 Bit c2x0 # bit 0 } mfterm-master/mfterm.c000066400000000000000000000231501342334113200152740ustar00rootroot00000000000000/** * Copyright (C) 2011-2013 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . * * Parts of code used in this file are from the GNU readline library file * fileman.c (GPLv3). Copyright (C) 1987-2009 Free Software Foundation, Inc */ #include #include #include #include #include #include #include #include "term_cmd.h" #include "mfterm.h" #include "util.h" #include "spec_syntax.h" #include "config.h" int stop_input_loop_ = 0; void stop_input_loop() { stop_input_loop_ = 1; } char* completion_cmd_generator(const char* text, int state); char* completion_sub_cmd_generator(const char* text, int state); char* completion_spec_generator(const char* text, int state); int perform_filename_completion(); char** mft_completion(char* text, int start, int end); int execute_line(char* line); void initialize_readline(); void parse_cmdline(int argc, char** argv); void print_help(); void print_version(); typedef char** rl_completion_func_t(const char*, int, int); int main(int argc, char** argv) { parse_cmdline(argc, argv); initialize_readline(); input_loop(); return 0; } void parse_cmdline(int argc, char** argv) { static struct option long_options[] = { {"help", no_argument, 0, 'h' }, {"version", no_argument, 0, 'v' }, {"tag", required_argument, 0, 't' }, {"keys", required_argument, 0, 'k' }, {"dict", required_argument, 0, 'd' }, {0, 0, 0, 0 } }; char* tag_file = NULL; char* keys_file = NULL; char* dict_file = NULL; int opt = 0; int long_index = 0; while ((opt = getopt_long(argc, argv,"hvt:k:d:", long_options, &long_index )) != -1) { switch (opt) { case 'h' : print_help(); exit(0); case 'v' : print_version(); exit(0); case 't' : tag_file = optarg; break; case 'k' : keys_file = optarg; break; case 'd' : dict_file = optarg; break; default : exit(1); } } // If a tag file was specified, load it if (tag_file != NULL && com_load_tag(tag_file)) exit(0); // If a keys file was specified, load it if (keys_file != NULL && com_keys_load(keys_file)) exit(0); // If a dictionary file was specified, load it if (dict_file != NULL && com_dict_load(dict_file)) exit(0); // Default is to do nothing, just enter the terminal } // Request user input until stop_intput_loop_ == 0 void input_loop() { char *line, *s; while (stop_input_loop_ == 0) { line = readline ("$ "); if (!line) break; s = trim(line); if (*s) { add_history(s); execute_line(s); } free (line); } } /* Execute a command line. */ int execute_line (char* line) { if (strncmp(line, ".", 1) == 0) return exec_path_command(line); command_t* command = find_command(line); if (!command) { fprintf (stderr, "%s: No such command.\n", line); return -1; } // Skip past command and ws to the arguments line += strlen(command->name); line = trim(line); return (*(command->func))(line); } void initialize_readline() { rl_readline_name = "MFT"; rl_attempted_completion_function = (rl_completion_func_t*)mft_completion; } /* Attempt to complete on the contents of TEXT. START and END bound the region of rl_line_buffer that contains the word to complete. TEXT is the word to complete. We can use the entire contents of rl_line_buffer in case we want to do some simple parsing. Return the array of matches, or NULL if there aren't any. */ char** mft_completion(char* text, int start, int end) { char **matches = (char **)NULL; // Don't complete on files for most cases rl_attempted_completion_over = 1; // Add the trailing space unless told otherwise #ifdef HAVE_RL_COMPLETION_SUPPRESS_APPEND rl_completion_suppress_append = 0; #endif // Complete strings starting with '.' as specification paths if (text[0] == '.' && instance_root) { #ifdef HAVE_RL_COMPLETION_SUPPRESS_APPEND rl_completion_suppress_append = 1; // no trailing space on paths #endif return rl_completion_matches(text, completion_spec_generator); } // Commands start at 0 if (start == 0) return rl_completion_matches(text, completion_cmd_generator); // else: Sub commands and file arguments start at > 0 // Try to match sub commands matches = rl_completion_matches(text, completion_sub_cmd_generator); if (matches) return matches; if (perform_filename_completion()) { // Do complete on filenames rl_attempted_completion_over = 0; return matches; } return matches; } int perform_filename_completion() { for (int i = 0; commands[i].name; ++i) { if (commands[i].fn_arg && strncmp(rl_line_buffer, commands[i].name, strlen(commands[i].name)) == 0) { return 1; } } return 0; } /** Called to generate completion suggestions. state == 0 on first call. */ char* completion_cmd_generator(const char* text, int state) { static int cmd_index; static size_t len; // First call? if (!state) { cmd_index = 0; len = strlen(text); // Cached for performance } // Return next suggestion char *name; while ((name = commands[cmd_index].name)) { ++cmd_index; // Check if the command is applicable if (strncmp(name, text, len) == 0) { char* r = malloc(strlen(name) + 1); strcpy(r, name); return r; } } // No (more) matches return (char*) NULL; } char* completion_sub_cmd_generator(const char* text, int state) { static int cmd_index; static size_t len, full_len; // First call? if (!state) { cmd_index = 0; len = strlen(text); // Cached for performance full_len = strlen(rl_line_buffer); } // Return next suggestion char* name; while ((name = commands[cmd_index].name)) { ++cmd_index; // Extract command and sub-command char buff[128]; strncpy(buff, name, sizeof(buff)); char* cmd = strtok(buff, " "); char* sub = strtok(NULL, " "); // Make sure the command *has* a sub command // and that we have the right command. if (cmd && sub && strncmp(rl_line_buffer, name, full_len) == 0) { // Check if the sub command is applicable if (strncmp(sub, text, len) == 0) { char* r = malloc(strlen(sub) + 1); strcpy(r, sub); return r; } } } // No (more) matches return (char*) NULL; } /** * Called to generate completion suggestions. * state == 0 on first call. */ char* completion_spec_generator(const char* text, int state) { // Parent context is initialized on the first call static instance_t* parent_inst; static const char* parent_end; static size_t parent_end_len; // Instace iter is advanced on each repeated call static instance_list_t* inst_iter; // First call? if (!state) { // Set the parent context if (parse_partial_spec_path(text, &parent_end, &parent_inst) != 0) return NULL; // on error parent_end_len = strlen(parent_end); // The instance iter points to the first fields inst_iter = parent_inst->fields; } while (inst_iter) { instance_t* inst = inst_iter->instance; inst_iter = inst_iter->next_; // Anonymous filler field if (inst->field->name == NULL) continue; char* fname = inst->field->name; size_t fname_len = strlen(fname); // Check if the field is applicable - right prefix if (fname_len >= parent_end_len && strncmp(fname, parent_end, parent_end_len) == 0) { if (parent_end - text <= 0) return NULL; size_t parent_len = (size_t)(parent_end - text); char* str = malloc(parent_len + fname_len + 1); // The parent part ending with '.' strncpy(str, text, parent_len); // The field strncpy(str + parent_len, fname, fname_len); // Null termination *(str + parent_len + fname_len) = '\0'; return str; } } // No (more) matches return NULL; } void print_help() { printf("A terminal interface for working with Mifare Classic tags.\n"); printf("Usage: mfterm [-v] [-h] [-k keyfile]\n"); printf("\n"); printf("Options: \n"); printf(" --help (-h) Show this help message.\n"); printf(" --version (-v) Display version information.\n"); printf(" --tag=tagfile (-t) Load a tag from the specified file.\n"); printf(" --keys=keyfile (-k) Load keys from the specified file.\n"); printf(" --dict=dictfile (-d) Load dictionary from the specified file.\n"); printf("\n"); printf("Report bugs to: anders@4zm.org\n"); printf(PACKAGE_NAME); printf(" home page: \n"); } void print_version() { printf(PACKAGE_STRING); printf("\n"); printf("Copyright (C) 2011-2013 Anders Sundman \n"); printf("License GPLv3+: GNU GPL version 3 or later \n"); printf("This is free software: you are free to change and redistribute it.\n"); printf("There is NO WARRANTY, to the extent permitted by law.\n"); } mfterm-master/mfterm.h000066400000000000000000000015561342334113200153070ustar00rootroot00000000000000#ifndef MFTERM__H #define MFTERM__H /** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . */ // The main loop of mfterm void input_loop(); // Called to exit the mfterm program void stop_input_loop(); #endif mfterm-master/mfterm.man000066400000000000000000000171431342334113200156320ustar00rootroot00000000000000.\" mfterm Manual .\" Contact anders@4zm.org to correct errors or typos. .TH mfterm 1 "14 Sep 2016" "1.0.7" "mfterm Manual" .SH NAME mfterm \- The Mifare Terminal .SH SYNOPSIS .B mfterm [\fB-v\fR\] [\fB-h\fR\] [\fB-t\fR \fItagfile\fR] [\fB-k\fR \fIkeyfile\fR] [\fB-d\fR \fIdictionary\fR] .\" ---------------------- DESCRIPTION ----------------------------- .SH DESCRIPTION .P mfterm is a terminal interface for working with Mifare tags. .PP The program is used as an interactive shell to read and write Mifare tags using libnfc and a libnfc compatible reader or to simply manipulate Mifare data dumps from files. See the \fBCOMMANDS\fR section below for a description of the commands available. .PP In mfterm, there are a number of global state variables. One for tag data, one for keys and some others. Data is read and loaded to this memory and written and saved from the same. The contents of the tag data variable is displayed using the \fBprint\fR command. The keys in the key variable are displayed using the \fBkeys\fR command. Both tag and key variables are 4k, but only the first 1k is used for 1k tags. .PP Please see the \fBREADME\fR and \fBINSTALL\fR files for further information. .\" --------------------------- OPTIONS --------------------------- .SH OPTIONS These are the command line options of mfterm. .TP 5 .TP \fB-h\fR, \fB--help\fR Displays a help message. .TP \fB-v\fR, \fB--version\fR Display version information. .TP \fB-t\fR \fItagfile\fR, \fB--tag=\fR\fItagfile\fR Load a tag from the specified file. Before starting the terminal. .TP \fB-k\fR \fIkeyfile\fR, \fB--keys=\fR\fIkeyfile\fR Load keys from the specified file. Before starting the terminal. .TP \fB-d\fR \fIdictionary\fR, \fB--dict=\fR\fIdictionary\fR Load dictionary from the specified file. Before starting the terminal. .\" --------------------------- COMMANDS --------------------------- .SH COMMANDS These are the commands available from the mfterm prompt. .\" --------------------- TAG - COMMANDS --------------------------- .RS -4 .B Tag Commands: .RE .TP \fBprint \fR[\fB1k\fR|\fB4k\fR] Print the current tag data. The data is formatted to show sectors and blocks in hexadecimal. Optionally specify tag size (default is 1k). .TP \fBread \fR[\fBA\fR|\fBB\fR] Read a tag. A libnfc compatible reader must be connected and a tag present. The keys in the key state variable will be used to authenticate each sector. Optionally specify witch key to use for reading (default is A). .TP \fBwrite \fR[\fBA\fR|\fBB\fR] Write a tag. A libnfc compatible reader must be connected and a tag present. The keys in the key state variable will be used to authenticate each sector. Optionally specify witch key to use for reading (default is A). .TP \fBload\fR Load tag data from a file. The file should be a raw binary file containing exactly 4k. If the tag data represents a 1k tag, the data should be padded. .TP \fBsave\fR Save tag data to a file. A raw binary dump of the data will be written. If the tag is a 1k tag, the data will be padded with zeroes to 4k size. .TP \fBclear\fR Clear the current tag data in memory. .TP \fBprint keys \fR[\fB1k\fR|\fB4k\fR] Extract the key information from the tag loaded into memory and display it. This is not the same as the keys command. The later will print the keys stored in the keys variable, this prints keys from the tag. .TP \fBprint ac\fR Print the access conditions for each block. Possible values are A, B, A|B or '-'. Their meanings are, in turn, that the A or B or both A and B keys or neither key can be used. The columns R, W, I, D represents read, write, increment and decrement. They apply for all non trailer blocks. For the trailer blocks the columns AR, AW, ACR, ACW, BR, BW apply. They are permissions for; reading the A-key, writing the A-key, reading the access control bits, writing the access control bits, reading the B-key and writing the B-key. .TP \fBset \fIblock offset\fR \fB=\fR \fIxx xx xx\fR Write some values to the tag variable in memory. Specify data as hexadecimal bytes separated by spaces. .\" --------------------- KEY - COMMANDS --------------------------- .RS -4 .B Key Management Commands: .RE .TP \fBkeys\fR [\fB1k\fR|\fB4k\fR] Print the keys currently loaded. Optionally specify if keys for the full 4k tag should be displayed or just the ones for the first 1k. Default is 1k. .TP \fBkeys load\fR \fIfile\fR Load keys from a file into memory. The key file is a regular binary tag dump, but only the key fields are used. That means that any tag dump can be loaded as keys. .TP \fBkeys save\fR \fIfile\fR Save the current keys in memory to a file. The keys will be saved as a normal binary tag dump with all values except the keys cleared. .TP \fBkeys import\fR Import keys from the current tag. .TP \fBkeys clear\fR Clear the keys in memory. .TP \fBkeys set\fR \fBA\fR|\fBB\fR \fIsector\fR \fIkey\fR Set a specific key explicitly. Specify the key in hex, if it is an A- or B-key and what sector to set the key for. .TP \fBkeys test\fR Try to authenticate with the keys. Use this command to test a set of keys with a specific tag. .\" ------------------ PIRATE - COMMANDS --------------------------- .RS -4 .B Pirate Card Commands: .RE These commands will only work on the back door:ed pirate cards (aka Chinese magic cards) with writable first block. .TP \fBread unlocked\fR Read the card without using keys and disregard access control bits. .TP \fBwrite unlocked\fR Write to a back door:ed 1k tag. This will write block 0 and possibly modify the UID. .\" -------------------- DICT - COMMANDS --------------------------- .RS -4 .B Dictionary Attack Commands: .RE .TP \fBdict load\fR \fIfile\fR Load a dictionary key file. This is a regular text file with one key written in hex per line. Loading multiple dictionaries will merge their contents and remove duplicates. .TP \fBdict clear\fR Clear the key dictionary in memory. .TP \fBdict attack\fR Find keys of a physical tag by trying all keys in the loaded dictionary. If any keys are found the current keys variable will be updated. .TP \fBdict\fR Print the contents of the key dictionary currently loaded. .\" -------------------- SPEC - COMMANDS --------------------------- .RS -4 .B Contents Specification Commands: .RE .TP \fBspec load\fR \fIfile\fR Load a specification file. .TP \fBspec clear\fR Unload the specification. .TP \fBspec\fR Print the specification. .\" --------------------- MAC - COMMANDS --------------------------- .RS -4 .B MAC Commands: .RE These are commands for creating and validating DES MACs (message authentication codes) to sign the contents of specific blocks. .TP \fBmac key\fR [\fIkey\fR] Get or set MAC key. .TP \fBmac compute\fR \fI#block\fR Compute the MAC for a specified block. .TP \fBmac update\fR \fI#block\fR Compute the MAC for a specified block, truncate it and write it back into the current tag data. .TP \fBmac validate\fR [\fB1k\fR|\fB4k\fR] Validates MACs for every block of the tag. .\" -------------------- MISC - COMMANDS --------------------------- .RS -4 .B General commands: .RE .TP 5 .TP \fBquit\fR Exit the program. .TP \fBhelp\fR Show a list of available commands and a short description of each. .\" ------------------------- NOTES ------------------------------- .SH NOTE The \fBmac\fR and \fBspec\fR command groups are experimental. They .\" ---------------------- TRAILER STUFF --------------------------- .SH SEE ALSO nfc-list(1) .SH LICENSE Copyright (C) 2011-2016 Anders Sundman License GPLv3+: GNU GPL version 3 or later. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. .SH AUTHOR Anders Sundman mfterm-master/mifare.c000066400000000000000000000123201342334113200152420ustar00rootroot00000000000000/*- * Public platform independent Near Field Communication (NFC) library examples * * Copyright (C) 2009 Roel Verdult * Copyright (C) 2010 Romain Tartière * Copyright (C) 2010, 2011 Romuald Conty * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * 1) Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * 2 )Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. * * Note that this license only applies on the examples, NFC library itself is under LGPL * */ /** * @file mifare.c * @brief provide samples structs and functions to manipulate MIFARE Classic and Ultralight tags using libnfc */ #include "mifare.h" #include #include /** * @brief Execute a MIFARE Classic Command * @return Returns true if action was successfully performed; otherwise returns false. * @param pmp Some commands need additional information. This information should be supplied in the mifare_param union. * * The specified MIFARE command will be executed on the tag. There are different commands possible, they all require the destination block number. * @note There are three different types of information (Authenticate, Data and Value). * * First an authentication must take place using Key A or B. It requires a 48 bit Key (6 bytes) and the UID. * They are both used to initialize the internal cipher-state of the PN53X chip. * After a successful authentication it will be possible to execute other commands (e.g. Read/Write). * The MIFARE Classic Specification (http://www.nxp.com/acrobat/other/identification/M001053_MF1ICS50_rev5_3.pdf) explains more about this process. */ bool nfc_initiator_mifare_cmd(nfc_device *pnd, const mifare_cmd mc, const uint8_t ui8Block, mifare_param *pmp) { uint8_t abtRx[265]; size_t szParamLen; uint8_t abtCmd[265]; //bool bEasyFraming; abtCmd[0] = mc; // The MIFARE Classic command abtCmd[1] = ui8Block; // The block address (1K=0x00..0x39, 4K=0x00..0xff) switch (mc) { // Read and store command have no parameter case MC_READ: case MC_STORE: szParamLen = 0; break; // Authenticate command case MC_AUTH_A: case MC_AUTH_B: szParamLen = sizeof(struct mifare_param_auth); break; // Data command case MC_WRITE: szParamLen = sizeof(struct mifare_param_data); break; // Value command case MC_DECREMENT: case MC_INCREMENT: case MC_TRANSFER: szParamLen = sizeof(struct mifare_param_value); break; // Please fix your code, you never should reach this statement default: return false; break; } // When available, copy the parameter bytes if (szParamLen) memcpy(abtCmd + 2, (uint8_t *) pmp, szParamLen); // FIXME: Save and restore bEasyFraming // bEasyFraming = nfc_device_get_property_bool (pnd, NP_EASY_FRAMING, &bEasyFraming); if (nfc_device_set_property_bool(pnd, NP_EASY_FRAMING, true) < 0) { nfc_perror(pnd, "nfc_device_set_property_bool"); return false; } // Fire the mifare command int res; if ((res = nfc_initiator_transceive_bytes(pnd, abtCmd, 2 + szParamLen, abtRx, sizeof(abtRx), -1)) < 0) { if (res == NFC_ERFTRANS) { // "Invalid received frame", usual means we are // authenticated on a sector but the requested MIFARE cmd (read, write) // is not permitted by current acces bytes; // So there is nothing to do here. } else if (res == NFC_EMFCAUTHFAIL) { // Since we implement a dictionary brute force attack, // don't print an error on failed authentications. } else { nfc_perror(pnd, "nfc_initiator_transceive_bytes"); } // XXX nfc_device_set_property_bool (pnd, NP_EASY_FRAMING, bEasyFraming); return false; } /* XXX if (nfc_device_set_property_bool (pnd, NP_EASY_FRAMING, bEasyFraming) < 0) { nfc_perror (pnd, "nfc_device_set_property_bool"); return false; } */ // When we have executed a read command, copy the received bytes into the param if (mc == MC_READ) { if (res == 16) { memcpy(pmp->mpd.abtData, abtRx, 16); } else { return false; } } // Command succesfully executed return true; } mfterm-master/mifare.h000066400000000000000000000073711342334113200152610ustar00rootroot00000000000000/*- * Public platform independent Near Field Communication (NFC) library examples * * Copyright (C) 2009 Roel Verdult * Copyright (C) 2010 Romain Tartière * Copyright (C) 2010, 2011 Romuald Conty * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * 1) Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * 2 )Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. * * Note that this license only applies on the examples, NFC library itself is under LGPL * */ /** * @file mifare.h * @brief provide samples structs and functions to manipulate MIFARE Classic and Ultralight tags using libnfc */ #ifndef _LIBNFC_MIFARE_H_ # define _LIBNFC_MIFARE_H_ # include // Compiler directive, set struct alignment to 1 uint8_t for compatibility # pragma pack(1) typedef enum { MC_AUTH_A = 0x60, MC_AUTH_B = 0x61, MC_READ = 0x30, MC_WRITE = 0xA0, MC_TRANSFER = 0xB0, MC_DECREMENT = 0xC0, MC_INCREMENT = 0xC1, MC_STORE = 0xC2 } mifare_cmd; // MIFARE command params struct mifare_param_auth { uint8_t abtKey[6]; uint8_t abtAuthUid[4]; }; struct mifare_param_data { uint8_t abtData[16]; }; struct mifare_param_value { uint8_t abtValue[4]; }; typedef union { struct mifare_param_auth mpa; struct mifare_param_data mpd; struct mifare_param_value mpv; } mifare_param; // Reset struct alignment to default # pragma pack() bool nfc_initiator_mifare_cmd(nfc_device *pnd, const mifare_cmd mc, const uint8_t ui8Block, mifare_param *pmp); // Compiler directive, set struct alignment to 1 uint8_t for compatibility # pragma pack(1) // MIFARE Classic typedef struct { uint8_t abtUID[4]; uint8_t btBCC; uint8_t btUnknown; uint8_t abtATQA[2]; uint8_t abtUnknown[8]; } mifare_classic_block_manufacturer; typedef struct { uint8_t abtData[16]; } mifare_classic_block_data; typedef struct { uint8_t abtKeyA[6]; uint8_t abtAccessBits[4]; uint8_t abtKeyB[6]; } mifare_classic_block_trailer; typedef union { mifare_classic_block_manufacturer mbm; mifare_classic_block_data mbd; mifare_classic_block_trailer mbt; } mifare_classic_block; typedef struct { mifare_classic_block amb[256]; } mifare_classic_tag; // MIFARE Ultralight typedef struct { uint8_t sn0[3]; uint8_t btBCC0; uint8_t sn1[4]; uint8_t btBCC1; uint8_t internal; uint8_t lock[2]; uint8_t otp[4]; } mifareul_block_manufacturer; typedef struct { uint8_t abtData[16]; } mifareul_block_data; typedef union { mifareul_block_manufacturer mbm; mifareul_block_data mbd; } mifareul_block; typedef struct { mifareul_block amb[4]; } mifareul_tag; // Reset struct alignment to default # pragma pack() #endif // _LIBNFC_MIFARE_H_ mfterm-master/mifare_ctrl.c000066400000000000000000000453261342334113200163020ustar00rootroot00000000000000/** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . * * Parts of code used in this file are based on the Public platform * independent Near Field Communication (NFC) library example * nfc-mfclassic.c. It is thus covered by that license as well: * * Copyright (C) 2009, Roel Verdult * Copyright (C) 2010, Romuald Conty, Romain Tartière * Copyright (C) 2011, Adam Laurie * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * 1) Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * 2 )Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ #include #include #include #include "mifare.h" #include "tag.h" #include "mifare_ctrl.h" // State of the device/tag - should be NULL between high level calls. static nfc_device* device = NULL; static nfc_target target; static mf_size_t size; static nfc_context* context; static const nfc_modulation mf_nfc_modulation = { .nmt = NMT_ISO14443A, .nbr = NBR_106, }; // Buffers used for raw bit/byte writes #define MAX_FRAME_LEN 264 static uint8_t abtRx[MAX_FRAME_LEN]; static int szRxBits; int mf_connect(); int mf_disconnect(int ret_state); bool mf_configure_device(); bool mf_select_target(); bool mf_authenticate(size_t block, const uint8_t* key, mf_key_type_t key_type); bool mf_unlock(); bool mf_read_tag_internal(mf_tag_t* tag, const mf_tag_t* keys, mf_key_type_t key_type); bool mf_write_tag_internal(const mf_tag_t* tag, const mf_tag_t* keys, mf_key_type_t key_type); bool mf_dictionary_attack_internal(mf_tag_t* tag); bool mf_test_auth_internal(const mf_tag_t* keys, mf_size_t size, mf_key_type_t key_type); bool transmit_bits(const uint8_t *pbtTx, const size_t szTxBits); bool transmit_bytes(const uint8_t *pbtTx, const size_t szTx); int mf_disconnect(int ret_state) { nfc_close(device); nfc_exit(context); device = NULL; memset(&target, 0, sizeof(target)); return ret_state; } int mf_connect() { // Initialize libnfc and set the nfc_context nfc_init(&context); // Connect to (any) NFC reader device = nfc_open(context, NULL); if (device == NULL) { printf ("Could not connect to any NFC device\n"); return -1; // Don't jump here, since we don't need to disconnect } // Initialize the device as a reader if (!mf_configure_device()) { printf("Error initializing NFC device\n"); return mf_disconnect(-1); } // Try to find a tag if (!mf_select_target() || target.nti.nai.btSak == 0) { printf("Connected to device, but no tag found.\n"); return mf_disconnect(-1); } // Allow SAK & ATQA == 0. Assume 1k pirate card. if (target.nti.nai.btSak == 0 && target.nti.nai.abtAtqa[1] == 0) { size = MF_1K; return 0; } // Test if we are dealing with a Mifare Classic compatible tag if ((target.nti.nai.btSak & 0x08) == 0) { printf("Incompatible tag type: 0x%02x (i.e. not Mifare Classic).\n", target.nti.nai.btSak); return mf_disconnect(-1); } // Guessing tag size if ((target.nti.nai.abtAtqa[1] & 0x02)) { // 4K size = MF_4K; } else if ((target.nti.nai.abtAtqa[1] & 0x04)) { // 1K size = MF_1K; } else { printf("Unsupported tag size. ATQA 0x%02x 0x%02x (i.e. not [1|4]K.)\n", target.nti.nai.abtAtqa[0], target.nti.nai.abtAtqa[1]); return mf_disconnect(-1); } return 0; // Indicate success - we are now connected } int mf_read_tag(mf_tag_t* tag, mf_key_type_t key_type) { if (mf_connect()) return -1; // No need to disconnect here if (key_type == MF_KEY_UNLOCKED) { if (!mf_unlock()) { printf("Unlocked read requested, but unlock failed!\n"); return false; } } if (!mf_read_tag_internal(tag, ¤t_auth, key_type)) { printf("Read failed!\n"); return mf_disconnect(-1); } // Print the type of card if (target.nti.nai.btSak == 0x08 && target.nti.nai.abtAtqa[0] == 0x00 && target.nti.nai.abtAtqa[1] == 0x04) { printf("Read MIFARE Classic 1k (SAK: 08, ATQA: 00 04)\n"); } else if (target.nti.nai.btSak == 0x18 && target.nti.nai.abtAtqa[0] == 0x00 && target.nti.nai.abtAtqa[1] == 0x02) { printf("Read MIFARE Classic 4k (SAK: 18, ATQA: 00 02)\n"); } else { printf("Read unknown tag.\n"); } return mf_disconnect(0); } int mf_write_tag(const mf_tag_t* tag, mf_key_type_t key_type) { if (mf_connect()) return -1; // No need to disconnect here if (key_type == MF_KEY_UNLOCKED) { if (!mf_unlock()) { printf("Unlocked write requested, but unlock failed!\n"); return false; } } if (!mf_write_tag_internal(tag, ¤t_auth, key_type)) { printf("Write failed!\n"); return mf_disconnect(-1); } return mf_disconnect(0); } int mf_dictionary_attack(mf_tag_t* tag) { if (mf_connect()) { return -1; // No need to disconnect here } if (!mf_dictionary_attack_internal(tag)) { printf("Dictionary attack failed!\n"); return mf_disconnect(-1); } return mf_disconnect(0); } int mf_test_auth(const mf_tag_t* keys, mf_size_t size, mf_key_type_t key_type) { if (mf_connect()) { return -1; // No need to disconnect here } if (!mf_test_auth_internal(keys, size, key_type)) { printf("Test authentication failed!\n"); return mf_disconnect(-1); } return mf_disconnect(0); } bool mf_configure_device() { // Disallow invalid frame if (nfc_device_set_property_bool(device, NP_ACCEPT_INVALID_FRAMES, false) < 0) return false; // Disallow multiple frames if (nfc_device_set_property_bool(device, NP_ACCEPT_MULTIPLE_FRAMES, false) < 0) return false; // Make sure we reset the CRC and parity to chip handling. if (nfc_device_set_property_bool(device, NP_HANDLE_CRC, true) < 0) return false; if (nfc_device_set_property_bool(device, NP_HANDLE_PARITY, true) < 0) return false; // Disable ISO14443-4 switching in order to read devices that emulate // Mifare Classic with ISO14443-4 compliance. if (nfc_device_set_property_bool(device, NP_AUTO_ISO14443_4, false) < 0) return false; // Activate "easy framing" feature by default if (nfc_device_set_property_bool(device, NP_EASY_FRAMING, true) < 0) return false; // Deactivate the CRYPTO1 cipher, it may could cause problems when // still active if (nfc_device_set_property_bool(device, NP_ACTIVATE_CRYPTO1, false) < 0) return false; // Drop explicitely the field if (nfc_device_set_property_bool(device, NP_ACTIVATE_FIELD, false) < 0) return false; // Override default initialization option, only try to select a tag once. if (nfc_device_set_property_bool(device, NP_INFINITE_SELECT, false) < 0) return false; return true; } bool mf_select_target() { if (nfc_initiator_select_passive_target(device, mf_nfc_modulation, NULL, // init data 0, // init data len &target) < 0) { return false; } return true; } /** * Unlocking the card allows writing to block 0 of some pirate cards. */ bool mf_unlock() { static uint8_t abtHalt[4] = { 0x50, 0x00, 0x00, 0x00 }; // Special unlock command static const uint8_t abtUnlock1[1] = { 0x40 }; static const uint8_t abtUnlock2[1] = { 0x43 }; // Disable CRC and parity checking if (nfc_device_set_property_bool(device, NP_HANDLE_CRC, false) < 0) return false; // Disable easy framing. Use raw send/receive methods if (nfc_device_set_property_bool (device, NP_EASY_FRAMING, false) < 0) return false; // Initialize transmision iso14443a_crc_append(abtHalt, 2); transmit_bytes(abtHalt, 4); // Send unlock if (!transmit_bits (abtUnlock1, 7)) return false; if (!transmit_bytes (abtUnlock2, 1)) return false; // Reset reader configuration. CRC and easy framing. if (nfc_device_set_property_bool (device, NP_HANDLE_CRC, true) < 0) return false; if (nfc_device_set_property_bool (device, NP_EASY_FRAMING, true) < 0) return false; return true; } bool mf_read_tag_internal(mf_tag_t* tag, const mf_tag_t* keys, mf_key_type_t key_type) { mifare_param mp; static mf_tag_t buffer_tag; clear_tag(&buffer_tag); int error = 0; printf("Reading: ["); fflush(stdout); // Read the card from end to begin for (int block_it = (int)block_count(size) - 1; block_it >= 0; --block_it) { size_t block = (size_t)block_it; // Print progress for the unlocked read if (key_type == MF_KEY_UNLOCKED && is_trailer_block(block)) { printf("."); fflush(stdout); } // Authenticate everytime we reach a trailer block // unless we are doing an unlocked read if (key_type != MF_KEY_UNLOCKED && is_trailer_block(block)) { // Try to authenticate for the current sector uint8_t* key = key_from_tag(keys, key_type, block); if (!mf_authenticate(block, key, key_type)) { // Progress indication and error report printf("0x%02zx", block_to_sector(block)); if (block != 3) printf("."); fflush(stdout); block_it -= (int)sector_size(block) - 1; // Skip the rest of the sector blocks error = 1; } else { // Try to read the trailer (only to *read* the access bits) if (nfc_initiator_mifare_cmd(device, MC_READ, (uint8_t)block, &mp)) { // Copy the keys over to our tag buffer key_to_tag(&buffer_tag, keys->amb[block].mbt.abtKeyA, MF_KEY_A, block); key_to_tag(&buffer_tag, keys->amb[block].mbt.abtKeyB, MF_KEY_B, block); // Store the retrieved access bits in the tag buffer memcpy(buffer_tag.amb[block].mbt.abtAccessBits, mp.mpd.abtData + 6, 4); } else { printf ("\nUnable to read trailer block: 0x%02zx.\n", block); return false; } printf("."); fflush(stdout); // Progress indicator } } else { // I.e. not a sector trailer // Try to read out the block if (!nfc_initiator_mifare_cmd(device, MC_READ, (uint8_t)block, &mp)) { printf("\nUnable to read block: 0x%02zx.\n", block); return false; } memcpy(buffer_tag.amb[block].mbd.abtData, mp.mpd.abtData, 0x10); } } // Terminate progress indicator if (error) printf("] Auth errors in indicated sectors.\n"); else printf("] Success!\n"); // Success! Copy the data // todo: Or return static ptr? memcpy(tag, &buffer_tag, MF_4K); return true; } bool mf_write_tag_internal(const mf_tag_t* tag, const mf_tag_t* keys, mf_key_type_t key_type) { mifare_param mp; int error = 0; printf("Writing %s tag [", sprint_size(size)); fflush(stdout); // Process each sector in turn for (int header_block_it = sector_header_iterator(0); header_block_it != -1; header_block_it = sector_header_iterator(size)) { size_t header_block = (size_t)header_block_it; // Authenticate uint8_t* key = key_from_tag(keys, key_type, header_block); if (key_type != MF_KEY_UNLOCKED) { if (!mf_authenticate(header_block, key, key_type)) { // Progress indication and error report if (header_block != 0) printf("."); printf("0x%02zx", block_to_sector(header_block)); fflush(stdout); error = 1; continue; // Skip the rest of the sector blocks } } // Write the sectors blocks for (size_t block = header_block, trailer = block_to_trailer(header_block); block < trailer; ++block) { // First block on tag is read only - skip it unless unlocked if (block == 0 && key_type != MF_KEY_UNLOCKED) continue; // Try to write the data block memcpy (mp.mpd.abtData, tag->amb[block].mbd.abtData, 0x10); // do not write a block 0 with incorrect BCC - card will be made invalid! if (block == 0) { if((mp.mpd.abtData[0] ^ mp.mpd.abtData[1] ^ mp.mpd.abtData[2] ^ mp.mpd.abtData[3] ^ mp.mpd.abtData[4]) != 0x00) { printf ("\nError: incorrect BCC in MFD file!\n"); // ADD DATA return false; } } // Write the data block if (!nfc_initiator_mifare_cmd(device, MC_WRITE, (uint8_t)block, &mp)) { printf("\nUnable to write block: 0x%02zx.\n", block); return false; } } // Auth ok and sector read ok, finish up by reading trailer size_t trailer_block = block_to_trailer(header_block); memcpy (mp.mpd.abtData, tag->amb[trailer_block].mbt.abtKeyA, 6); memcpy (mp.mpd.abtData + 6, tag->amb[trailer_block].mbt.abtAccessBits, 4); memcpy (mp.mpd.abtData + 10, tag->amb[trailer_block].mbt.abtKeyB, 6); // Try to write the trailer if (!nfc_initiator_mifare_cmd(device, MC_WRITE, (uint8_t)trailer_block, &mp)) { printf("\nUnable to write block: 0x%02zx.\n", trailer_block); return false; } printf("."); fflush(stdout); // Progress indicator } // Terminate progress indicator if (error) printf("] Auth errors in indicated sectors.\n"); else printf("] Success!\n"); return true; } bool mf_dictionary_attack_internal(mf_tag_t* tag) { // Tag buffer to swap in if we find all keys int all_keys_found = 1; static mf_tag_t buffer_tag; clear_tag(&buffer_tag); // Iterate over the start blocks in all sectors for (int block_it = sector_header_iterator(0); block_it != -1; block_it = sector_header_iterator(size)) { size_t block = (size_t)block_it; printf("Working on sector: %02zx [", block_to_sector(block)); const uint8_t* key_a = NULL; const uint8_t* key_b = NULL; // Iterate we run out of dictionary keys or the sector is cracked const key_list_t* key_it = dictionary_get(); while(key_it && (key_a == NULL || key_b == NULL)) { // Try to authenticate for the current sector if (key_a == NULL && mf_authenticate(block, key_it->key, MF_KEY_A)) { key_a = key_it->key; } // Try to authenticate for the current sector if (key_b == NULL && mf_authenticate(block, key_it->key, MF_KEY_B)) { key_b = key_it->key; } key_it = key_it->next; printf("."); fflush(stdout); // Progress indicator } printf("]\n"); printf(" A Key: "); if (key_a) { printf("%s\n", sprint_key(key_a)); // Optimize dictionary by moving key to the front dictionary_add(key_a); // Save key in the buffer key_to_tag(&buffer_tag, key_a, MF_KEY_A, block); } else { all_keys_found = 0; printf("Not found\n"); } printf(" B Key: "); if (key_b) { printf("%s\n", sprint_key(key_b)); // Optimize dictionary by moving key to the front dictionary_add(key_b); // Save key in the buffer key_to_tag(&buffer_tag, key_b, MF_KEY_B, block); } else { all_keys_found = 0; printf("Not found\n"); } } if (all_keys_found) printf("All keys were found\n"); // Use the found keys memcpy(tag, &buffer_tag, MF_4K); return true; } bool mf_test_auth_internal(const mf_tag_t* keys, mf_size_t size, mf_key_type_t key_type) { printf("xS T Key Status\n"); printf("----------------------------\n"); for (int block_it = sector_header_iterator(0); block_it != -1; block_it = sector_header_iterator(size)) { size_t block = (size_t)block_it; uint8_t* key = key_from_tag(keys, key_type, block); printf("%02zx %c %s ", block_to_sector(block), key_type, sprint_key(key)); if (!mf_authenticate(block, key, key_type)) { printf("Failure"); } else { printf("Success"); } printf("\n"); } return true; } bool mf_authenticate(size_t block, const uint8_t* key, mf_key_type_t key_type) { mifare_param mp; // Set the authentication information (uid) memcpy(mp.mpa.abtAuthUid, target.nti.nai.abtUid + target.nti.nai.szUidLen - 4, 4); // Select key for authentication mifare_cmd mc = (key_type == MF_KEY_A) ? MC_AUTH_A : MC_AUTH_B; // Set the key memcpy(mp.mpa.abtKey, key, 6); // Try to authenticate for the current sector if (nfc_initiator_mifare_cmd(device, mc, (uint8_t)block, &mp)) return true; // Do the hand shaking again if auth failed nfc_initiator_select_passive_target(device, mf_nfc_modulation, NULL, 0, &target); return false; } bool transmit_bits(const uint8_t *pbtTx, const size_t szTxBits) { // Transmit the bit frame command, we don't use the arbitrary parity feature if ((szRxBits = nfc_initiator_transceive_bits(device, pbtTx, szTxBits, NULL, abtRx, sizeof(abtRx), NULL)) < 0) return false; return true; } bool transmit_bytes(const uint8_t *pbtTx, const size_t szTx) { // Transmit the command bytes if (nfc_initiator_transceive_bytes(device, pbtTx, szTx, abtRx, sizeof(abtRx), 0) < 0) return false; return true; } mfterm-master/mifare_ctrl.h000066400000000000000000000047741342334113200163110ustar00rootroot00000000000000#ifndef MIFARE_CTRL__H #define MIFARE_CTRL__H /** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . * * Parts of code used in this file are from the GNU readline library file * fileman.c (GPLv3). Copyright (C) 1987-2009 Free Software Foundation, Inc */ #include "tag.h" #include "dictionary.h" /** * Connect to an nfc device. Then read the tag data, authenticating with the * 'current_auth' keys of specified type, and store it in the * 'current_tag' state variable. Finally, disconnect from the device. * If there are authentication errors, those sectors will be set to * all zeroes. * Return 0 on success != 0 on failure. */ int mf_read_tag(mf_tag_t* tag, mf_key_type_t key_type); /** * Connect to an nfc device. The write the tag data, authenticating with * the 'current_auth' keys of specified type. Finally, disconnect from * the device. If there are authentication errors, those sectors will * not be written. * If the key type is set to MF_UNLOCKED, try to unlock the card prior to * write. This allows some pirate cards to write block 0. * Return 0 on success != 0 on failure. */ int mf_write_tag(const mf_tag_t* tag, mf_key_type_t key_type); /** * Connect to an nfc device. Then, for each sector in turn, try keys in the * dictionary for authentication. Report success or failure. If a key * is found, set it in the state variable 'current_auth'. Finally, * disconnect from the device. * Return 0 on success != 0 on failure. */ int mf_dictionary_attack(mf_tag_t* tag); /** * Connect to an nfc device. Then test the keys in the 'current_auth' * by trying to authenticate to the sectors of the tag. Report success * or failure for each sector. Finally, disconnect from the device. * Return 0 on success != 0 on failure. */ int mf_test_auth(const mf_tag_t* keys, mf_size_t size, mf_key_type_t key_type); #endif mfterm-master/spec_parser.y000066400000000000000000000131571342334113200163440ustar00rootroot00000000000000/** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . */ %{ #include #include #include #include "spec_syntax.h" #include "util.h" /* #define YYDEBUG 1 */ /* sp_debug = 1; */ #define YYERROR_VERBOSE 1 struct YYLTYPE; int sp_lex(void); void sp_error(const char* s, ...); void sp_lerror(struct YYLTYPE loc, const char* s, ...); %} %union { type_t* type_t_ptr; field_t* field_t_ptr; field_list_t* field_list_t_ptr; char* string; int integer; } %token BYTE "Byte" %token BIT "Bit" %token IDENTIFIER "name" %token DEC_NUM "dec-number" %token HEX_NUM "hex-number" %token end_of_file 0 "end-of-file" %type data_type %type primitive_data_type %type named_composite_type_decl %type composite_type_decl %type field_decl %type field_decl_list %type number %destructor { free($$); } IDENTIFIER DEC_NUM HEX_NUM %destructor { free_field($$); } field_decl %destructor { free_field($$->field); free($$); } composite_type_decl field_decl_list %destructor { if ($$ && $$->composite_extras) free_composite_type($$); } named_composite_type_decl primitive_data_type data_type %% /* Grammar rules and actions follow. */ input : /* empty */ { } | input named_composite_type_decl { (void) $2; } | input '.' composite_type_decl { if (tt_get_type(".")) { // Error - the root type has allready been defined sp_lerror(@1, "Root type '.' allready defined."); YYERROR; // abort and initiate error recovery } // Create the type (named '.') type_t* t = make_composite_type(strdup(".")); t->composite_extras->fields = $3; t->composite_extras->decl_status = COMPLETE_DECL; tt_add_type(t); type_root = t; } ; named_composite_type_decl : IDENTIFIER composite_type_decl { type_t* t = tt_get_type($1); if (t && t->composite_extras->decl_status == COMPLETE_DECL) { // Error - the type has been defined once before sp_lerror(@1, "Re-definition of type '%s'", $1); $$ = NULL; YYERROR; // abort and initiate error recovery } // If it's the first time we see the type, create it if(t == NULL) { t = make_composite_type($1); tt_add_type(t); } t->composite_extras->fields = $2; t->composite_extras->decl_status = COMPLETE_DECL; $$ = t; } ; composite_type_decl : '{' field_decl_list '}' { $$ = $2; } ; field_decl_list : /* empty */ { $$ = NULL; } | field_decl_list field_decl { if ($1 == NULL) { $$ = append_field(NULL, $2); } else { if ($2 == NULL) { $$ = NULL; } else if ($2->name == NULL || get_field($1, $2->name) == NULL) { // If it doesn't exist, then all is well. Add it. $$ = append_field($1, $2); } else { // If it allready exists, we have a semantic error. sp_lerror(@2, "A field with the name '%s' is allready defined.", $2->name); $$ = $1; YYERROR; // abort and initiate error recovery } } } | field_decl_list error { $$ = $1; yyclearin; YYERROR; } ; field_decl : data_type IDENTIFIER { $$ = make_field($2, $1, 1); } | data_type '-' { $$ = make_field(NULL, $1, 1); // Anonymous } | data_type '[' number ']' IDENTIFIER { $$ = make_field($5, $1, $3); } | data_type '[' number ']' '-' { $$ = make_field(NULL, $1, $3); } // Error handling | data_type error { (void) $1; $$ = NULL; YYERROR; } | data_type '[' number ']' error { (void) $1; $$ = NULL; YYERROR; } | data_type '[' error ']' IDENTIFIER { (void) $1; (void) $5; $$ = NULL; YYERROR; } | data_type '[' error ']' '-' { (void) $1; $$ = NULL; YYERROR; } | data_type '[' error ']' error { (void) $1; $$ = NULL; YYERROR; } ; data_type : composite_type_decl { type_t* t; t = make_composite_type(NULL); // Anonymous tt_add_type(t); t->composite_extras->fields = $1; t->composite_extras->decl_status = COMPLETE_DECL; $$ = t; } | primitive_data_type { $$ = $1; } | IDENTIFIER { type_t* t = tt_get_type($1); if (t) { $$ = t; // Re-discovered a known type } else { // This is a new type name - decl will hopefully come later. t = make_composite_type($1); t->composite_extras->decl_status = PARTIAL_DECL; tt_add_type(t); $$ = t; } } ; primitive_data_type : BYTE { $$ = &byte_type; } | BIT { $$ = &bit_type; } ; number : DEC_NUM { $$ = strtol($1, NULL, 10); free($1); } | HEX_NUM { $$ = strtol($1, NULL, 16); free($1); } ; %% void sp_lerror(struct YYLTYPE t, const char* s, ...) { va_list ap; va_start(ap, s); if(t.first_line) { if (t.last_line == t.first_line) fprintf(stderr, "Error:%d:%d: ", t.first_line, t.first_column); else fprintf(stderr, "Error:%d-%d: ", t.first_line, t.last_line); } vfprintf(stderr, s, ap); fprintf(stderr, "\n"); } mfterm-master/spec_syntax.c000066400000000000000000000410131342334113200163400ustar00rootroot00000000000000/** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . */ #include #include #include #include #include "util.h" #include "spec_syntax.h" // Forward declarations int sp_parse(); extern FILE* sp_in; // Parse the input file and set up type_root and instance_root. // Return 0 on success. int spec_import(FILE* input) { // Parse the input to build a type hierarchy sp_in = input; if (sp_parse()) { printf("Syntax Error: Specification not imported\n"); goto error; } // Check for missing definitions type_t* partial = tt_contains_partial_types(); if (partial) { printf("Error: Incomplete declaration '%s' in specification.\n", partial->composite_extras->name); goto error; } // Make sure we have a root type defined if (type_root == NULL) { printf("Error: No root type '.' found in specification.\n"); goto error; } // Create the instance tree instance_root = make_instance_tree(type_root); printf("Specification sucessfully imported.\n"); return 0; error: clear_instance_tree(); tt_clear(); return 1; } // The primitive Byte type type_t byte_type = { .type_category = BYTE_TYPE, .composite_extras = NULL, }; // The primitive Bit type type_t bit_type = { .type_category = BIT_TYPE, .composite_extras = NULL, }; // Allocate and return a composite type instance. The type will assume // ownership of the heap allocated name. type_t* make_composite_type(char* name) { type_t* t = malloc(sizeof(type_t)); t->type_category = COMPOSITE_TYPE; t->composite_extras = (composite_type_extras_t*) malloc(sizeof(composite_type_extras_t)); if (name) t->composite_extras->name = name; else t->composite_extras->name = NULL; // Anonymous type t->composite_extras->fields = NULL; return t; } // Free a composite type. This function will also free it's fields. void free_composite_type(type_t* t) { // Free the fields field_list_t* iter = t->composite_extras->fields; while (iter) { field_list_t* tmp = iter; iter = iter->next_; free_field(tmp->field); free(tmp); } // Free the type data free(t->composite_extras->name); free(t->composite_extras); free(t); } // Allocate a new field with the given parameters. Anonymous '-' // filler fields use NULL as name. The field will assume ownership of // the heap allocated name. field_t* make_field(char* name, type_t* type, size_t length) { field_t* f = (field_t*) malloc(sizeof(field_t)); f->name = name; // NULL for fillers f->type = type; f->length = length; return f; } // Free the memory used by a field. void free_field(field_t* field) { if (field == NULL) return; free(field->name); free(field); } // Add a field to an existing list of fields or, if the field_list // parameter is NULL, create a new field list. The order of fields is // significant and this function will append the field to the end of // the field_list. field_list_t* append_field(field_list_t* field_list, field_t* field) { // Create the list node field_list_t* flist = (field_list_t*) malloc(sizeof(field_list_t)); flist->field = field; flist->next_ = NULL; // Create the list or append to the end if (field_list != NULL) { field_list_t* it = field_list; while(it->next_) it = it->next_; it->next_ = flist; } else { field_list = flist; // Won't effect the inarg } // Return the start of the list return field_list; } // Search the field list for a field with the given name field_t* get_field(field_list_t* field_list, const char* name) { if (name == NULL || field_list == NULL) return NULL; field_list_t* it = field_list; while(it) { field_t* f = it->field; if (f && f->name && strcmp(f->name, name) == 0) return f; it = it->next_; } // Not found return NULL; } // The global instance of the type table. If there isn't any, the // variable will be NULL. All the type table operations (tt_) operate // on this global variable. type_table_t* type_table = NULL; // The root type of the type hierarchy type_t* type_root = NULL; // Internal functions for allocating and freeing type table list nodes. type_table_t* tt_make_node_(type_t* t); void tt_free_node_(type_table_t* tt); // Clear the type table - freeing the memory used by the table and by // all the types. void tt_clear() { // Reset the root type_root = NULL; // Free all types and the table itself type_table_t* it = type_table; while(it) { type_table_t* next = it->next_; free_composite_type(it->type); tt_free_node_(it); it = next; }; type_table = NULL; } // Add a type to the type table. type_t* tt_add_type(type_t* t) { if (type_table == NULL) { type_table = tt_make_node_(t); } else { type_table_t* it = type_table; while(it->next_) it = it->next_; it->next_ = tt_make_node_(t); } return t; } // Search the type table for a type with the given name. The first // type found will be returned. If no type is found, NULL is returned. type_t* tt_get_type(const char* type_name) { if (type_name == NULL) return NULL; type_table_t* it = type_table; while(it) { // Anonymous types (name == NULL) will never match if (it->type->composite_extras->name && strcmp(type_name, it->type->composite_extras->name) == 0) return it->type; // Type was found! it = it->next_; } // Not found return NULL; } // Check if there are any partially declared types in the type // table. Return a pointer to the first incomplete type or NULL if // none exists. type_t* tt_contains_partial_types() { type_table_t* it = type_table; while(it) { if (it->type->composite_extras->decl_status == PARTIAL_DECL) return it->type; it = it->next_; } return NULL; } // Allocate a new list entry for the type table type_table_t* tt_make_node_(type_t* t) { type_table_t* tt = malloc(sizeof(type_table_t)); tt->type = t; tt->next_ = NULL; return tt; } // Free a type table list entry (this won't free the type) void tt_free_node_(type_table_t* tt) { free(tt); } // The global variable representing the root instance; it is an // instanciation of the '.' type. instance_t* instance_root = NULL; // Forward decls of internal functions used during creation and // destruction of the instance tree. void clear_instance_tree_(instance_t* root); void make_instance_(instance_t* root, size_t* obytes, size_t* obits, size_t* sbytes, size_t* sbits); instance_t* make_byte_instance_(field_t* field, size_t* obytes, size_t* obits); instance_t* make_bit_instance_(field_t* field, size_t* obytes, size_t* obits); instance_t* make_composite_instance_(field_t* field, size_t* obytes, size_t* obits); instance_list_t* append_instance_(instance_list_t** end_ptr, instance_t* new_field); // Create an instance tree matching the type tree starting at // type_root. The global instance tree is constructed with type_root '.'. instance_t* make_instance_tree(type_t* type_root) { instance_t* root = malloc(sizeof(instance_t)); root->offset_bytes = 0; root->offset_bits = 0; root->size_bytes = 0; root->size_bits = 0; root->field = make_field(strdup("."), type_root, 1); root->fields = NULL; size_t obytes = 0; size_t obits = 0; make_instance_(root, &obytes, &obits, &(root->size_bytes), &(root->size_bits)); return root; } // Clear the global instance tree. Free it and set instance_root NULL void clear_instance_tree() { if (instance_root == NULL) return; clear_instance_tree_(instance_root); instance_root = NULL; } /* Get the child instance with a given name. Only look to children, */ /* not grand children. If no child with the given name exists, return */ /* null. */ instance_t* get_instance_child(instance_t* inst, const char* name) { if (name == NULL) return NULL; return get_instance_child_n(inst, name, strlen(name)); } /** * Like get_instance_child(inst, name), but name does not have to be * null terminated. Instead the length of the name string is given by * the last argument. */ instance_t* get_instance_child_n(instance_t* inst, const char* name, size_t nlen) { if (inst == NULL || name == NULL || nlen == 0) return NULL; instance_list_t* iter = inst->fields; while(iter) { field_t* f = iter->instance->field; // Make sure the field has a name (isn't anaonymous) before comparing. if (f && f->name && strlen(f->name) == nlen && strncmp(f->name, name, nlen) == 0) return iter->instance; iter = iter->next_; } return NULL; } /** * Parse a specification path of the form '.fu.bar.baz' and return the * instance pointed to by baz. In case the path doesn't point to a * loaded instance, return NULL. */ instance_t* parse_spec_path(const char* path) { const char* lastpath; instance_t* inst; // Parse the path up to the last instance if (parse_partial_spec_path(path, &lastpath, &inst) != 0) return NULL; // Find and return the leaf node return get_instance_child(inst, lastpath); } /** * Parse the path to produce a parent section and an instance that * points to the head of the parent. * * The format is .fu.bar.ba(z). Where .fu.bar.ba is the path, fu, bar * and baz are nested fields. The function should return parent_end * pointing into path to the point after the last '.', i.e. to the 'b' * in the last 'ba'. parent_inst will point to bar. * * The function returns 0 on success. */ int parse_partial_spec_path(const char* path, const char** parent_end, instance_t** parent_inst) { // Check input. Paths start with '.' if (path == NULL || path[0] != '.') return 1; instance_t* inst = instance_root; const char* remaining_path = path + 1; char* tok_end; while((tok_end = strchr(remaining_path, '.')) != NULL) { // There is still a part of the path before the last '.' ptrdiff_t tok_name = tok_end - remaining_path; if (tok_name <= 0) return 1; inst = get_instance_child_n(inst, remaining_path, (size_t)tok_name); // Exit early (error in ancestor path) if (inst == NULL) return 1; // Remove the token and the '.' from the start of remaining string remaining_path = tok_end + 1; } // Set the output arguments if (parent_end != NULL) *parent_end = remaining_path; if (parent_inst != NULL) *parent_inst = inst; return 0; } // Count the number of fields in the instance int instance_fields_count(instance_t* inst) { if (inst == NULL) return 0; int count = 0; instance_list_t* it = inst->fields; while (it) { ++count; it = it->next_; } return count; } void clear_instance_tree_(instance_t* root) { instance_list_t* iter = root->fields; while (iter) { instance_list_t* tmp = iter->next_; clear_instance_tree_(iter->instance); free(iter); iter = tmp; } free(root); } void make_instance_(instance_t* root, size_t* obytes, size_t* obits, size_t* sbytes, size_t* sbits) { // Pointers to the matching type field and instance field beign processed. field_list_t* tf_iter = root->field->type->composite_extras->fields; instance_list_t* if_iter = root->fields; // Iterate over all the type fields and add matching instance fields. while(tf_iter) { field_t* f = tf_iter->field; // Create the child sub-tree or instance. instance_t* child; // Byte if (f->type == &byte_type) { child = make_byte_instance_(f, obytes, obits); } // Bit else if (f->type == &bit_type) { child = make_bit_instance_(f, obytes, obits); } // Composite type else { child = make_composite_instance_(f, obytes, obits); child->size_bytes = 0; child->size_bits = 0; make_instance_(child, obytes, obits, &(child->size_bytes), &(child->size_bits)); // Update size with bits % 8 child->size_bytes = child->size_bytes * f->length + (child->size_bits * f->length) / 8; child->size_bits = (child->size_bits * f->length) % 8; } // Add the new instance or instance tree, to the root instance // field list. if_iter = if_iter == NULL ? append_instance_(&(root->fields), child) : append_instance_(&(if_iter->next_), child); // Note that we are changing the value of the input parameters here // this is part of the 'return value' of the function. Wrap the // bit size mod 8. *sbytes = *sbytes + child->size_bytes + (*sbits + child->size_bits) / 8; *sbits = (*sbits + child->size_bits) % 8; tf_iter = tf_iter->next_; } } instance_t* make_byte_instance_(field_t* field, size_t* obytes, size_t* obits) { instance_t* i = malloc(sizeof(instance_t)); i->field = field; i->fields = NULL; i->offset_bytes = *obytes; i->offset_bits = *obits; i->size_bytes = field->length; i->size_bits = 0; *obytes += i->size_bytes; // *obits += 0; return i; } instance_t* make_bit_instance_(field_t* field, size_t* obytes, size_t* obits) { instance_t* i = malloc(sizeof(instance_t)); i->field = field; i->fields = NULL; i->offset_bytes = *obytes; i->offset_bits = *obits; // Bits % 8, overflow in bytes field i->size_bytes = field->length / 8; i->size_bits = field->length % 8; *obytes += i->size_bytes + (*obits + i->size_bits) / 8; *obits = (*obits + i->size_bits) % 8; return i; } instance_t* make_composite_instance_(field_t* field, size_t* obytes, size_t* obits) { instance_t* i = malloc(sizeof(instance_t)); i->field = field; i->fields = NULL; i->offset_bytes = *obytes; i->offset_bits = *obits; // The size will be updated later, after recusion into all child fields. i->size_bytes = 0; i->size_bits = 0; return i; } instance_list_t* append_instance_(instance_list_t** end_ptr, instance_t* new_field) { instance_list_t* il = (instance_list_t*) malloc(sizeof(instance_list_t)); il->instance = new_field; il->next_ = NULL; *end_ptr = il; return il; } // Forward declaration void print_instance_tree_(instance_t* i, int indent); void print_instance_(instance_t* i); void print_instance_tree() { if (instance_root == NULL) { printf("No specification loaded.\n"); return; } printf("[%zu, %zu] [%zu, %zu] -- . (root)\n", instance_root->offset_bytes, instance_root->offset_bits, instance_root->size_bytes, instance_root->size_bits); print_instance_tree_(instance_root, 1); } void print_instance_tree_(instance_t* root, int indent) { // For each field of the root instance instance_list_t* il = root->fields; while(il) { // Indent int count = (indent - 1) * 2; while(count--) printf(" "); printf("+- "); // Print instance field instance_t* inst = il->instance; print_instance_(inst); if (inst->field->type->composite_extras != NULL) print_instance_tree_(inst, indent + 1); il = il->next_; } } void print_instance_(instance_t* i) { if (i->field->type == &byte_type) { printf("[%zu, %zu] [%zu, %zu] -- Byte[%zu] %s\n", i->offset_bytes, i->offset_bits, i->size_bytes, i->size_bits, i->field->length, i->field->name); } else if (i->field->type == &bit_type) { printf("[%zu, %zu] [%zu, %zu] -- Bit[%zu] %s\n", i->offset_bytes, i->offset_bits, i->size_bytes, i->size_bits, i->field->length, i->field->name); } else { printf("[%zu, %zu] [%zu, %zu] -- %s[%zu] %s\n", i->offset_bytes, i->offset_bits, i->size_bytes, i->size_bits, i->field->type->composite_extras->name, i->field->length, i->field->name); } } mfterm-master/spec_syntax.h000066400000000000000000000166421342334113200163570ustar00rootroot00000000000000#ifndef SPEC_SYNTAX__H #define SPEC_SYNTAX__H /** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . */ #include typedef enum { COMPOSITE_TYPE, BYTE_TYPE, BIT_TYPE, } type_category_t; typedef enum { PARTIAL_DECL, COMPLETE_DECL, } type_decl_status_t; typedef struct type_t type_t; typedef struct field_t field_t; typedef struct field_list_t field_list_t; typedef struct composite_type_extras_t composite_type_extras_t; typedef struct type_table_t type_table_t; typedef struct instance_t instance_t; typedef struct instance_list_t instance_list_t; // Parse the input file and set up type_root and instance_root. // Return 0 on success. int spec_import(FILE* input); /** * A struct representing a data type in the specification * language. There are two primitive types, Bit and Bytte. All other * types are user defined and use the composite_extras field to * express the type details. * * The primitive types are allocated statically (constants), while all * the composite types are allocated dynamically. */ struct type_t { type_category_t type_category; composite_type_extras_t* composite_extras; }; // The primitive type instances extern type_t byte_type; extern type_t bit_type; /** * A composite type is made up of an ordered list of fields. A field * is a named use of another type as an array. A field array of length * 1 can be treated without the array syntax in the language; but is * represented like all other fields. */ struct field_t { char* name; // Field name type_t* type; size_t length; }; /** * Type representing the ordered list of fields in a composite type. */ struct field_list_t { field_t* field; field_list_t* next_; }; /** * This structure represents the content of a user defined type. It * holds the name and the fields of the type. * * The type also has a flag to indicate if it has been fully * declared. The specification language allows the use of types before * they have been declared. Once the complete specification has been * parsed, all types must be declared. */ struct composite_type_extras_t { char* name; // Type name type_decl_status_t decl_status; field_list_t* fields; // All fields of the type or NULL. }; // Allocate and return a composite type instance. The type will assume // ownership of the heap allocated name. type_t* make_composite_type(char* name); // Free a composite type. This function will also free it's fields. void free_composite_type(type_t* t); // Allocate a new field with the given parameters. Anonymous '-' // filler fields use NULL as name. The field will assume ownership of // the heap allocated name. field_t* make_field(char* name, type_t* type, size_t length); // Free the memory used by a field. void free_field(field_t* field); // Add a field to an existing list of fields. The order of fields is // significant and this function will append the field to the end of // the field_list. field_list_t* append_field(field_list_t* field_list, field_t* field); // Search the field list for a field with the given name field_t* get_field(field_list_t* field_list, const char* name); /** * A 'table' of all the types in the language. This is part of the * output from the parsing process. The table is actually a list and * operations are typically O(n^2); but since there will probably * never be more than 50 types, this should be ok. */ struct type_table_t { type_t* type; type_table_t* next_; }; // The global instance of the type table. If there isn't any, the // variable will be NULL. All the type table operations (tt_) operate // on this global variable. extern type_table_t* type_table; // The root type of the type hierarchy extern type_t* type_root; // Clear the type table - freeing the memory used by the table and by // all the types. void tt_clear(); // Add a type to the type table. type_t* tt_add_type(type_t* t); // Search the type table for a type with the given name. The first // type found will be returned. If no type is found, NULL is returned. type_t* tt_get_type(const char* type_name); // Check if there are any partially declared types in the type // table. Return a pointer to the first incomplete type or NULL if // none exists. type_t* tt_contains_partial_types(); /** * Type representing instances of types in the spec language. The same * type can be instantiated several times in different spec types and * fields. The instances map agains type fields and thus contains a * length field. * * The size field is inclusive of the instance and all it's child * instances. The bit size field will be < 8; larger bit fields in the * type spec will be included in the byte field. */ struct instance_t { size_t offset_bytes; size_t offset_bits; size_t size_bytes; size_t size_bits; field_t* field; instance_list_t* fields; }; /** * Type representing the ordered list of instance fields in a * composite type instance. */ struct instance_list_t { instance_t* instance; instance_list_t* next_; }; // The global variable representing the root instance; it is an // instanciation of the '.' type. extern instance_t* instance_root; // Create an instance tree matching the type tree starting at // root_type. The global instance tree is constructed with root_type '.'. instance_t* make_instance_tree(type_t* root_type); // Clear the global instance tree. Free it and set instance_tree NULL void clear_instance_tree(); // Print a representation of the instance hierarchy void print_instance_tree(); /** * Get the child instance with a given name. Only look to children, * not grand children. If no child with the given name exists, return * null. */ instance_t* get_instance_child(instance_t* inst, const char* name); /** * Like get_instance_child(inst, name), but name does not have to be * null terminated. Instead the length of the name string is given by * the last argument. */ instance_t* get_instance_child_n(instance_t* inst, const char* name, size_t nlen); /** * Parse a specification path of the form '.fu.bar.baz' and return the * instance pointed to by baz. In case the path doesn't point to a * loaded instance, return NULL. */ instance_t* parse_spec_path(const char* path); /** * Parse the path to produce a parent section and an instance that * points to the head of the parent. * * The format is .fu.bar.ba(z). Where .fu.bar.ba is the path, fu, bar * and baz are nested fields. The function should return parent_end * pointing into path to the point after the last '.', i.e. to the 'b' * in the last 'ba'. parent_inst will point to bar. * * The function returns 0 on success. */ int parse_partial_spec_path(const char* path, const char** parent_end, instance_t** parent_inst); // Return the number of fields the instance has. 0 if inst is NULL. int instance_fields_count(instance_t* inst); #endif mfterm-master/spec_tokenizer.l000066400000000000000000000047531342334113200170470ustar00rootroot00000000000000/** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . */ %{ #include #include #include "util.h" #include "spec_syntax.h" #include "libsp_a-spec_parser.h" int colnum = 0; #define YY_USER_ACTION { \ sp_lloc.first_line = sp_lineno; \ sp_lloc.first_column = colnum; \ colnum = colnum + sp_leng; \ sp_lloc.last_column=colnum; \ sp_lloc.last_line = sp_lineno; \ } %} %option yylineno bison-bridge bison-locations ws [ \t] nl [\r\n] comment #[^\n]* hex_digit [0-9a-fA-F] hex_number 0x{hex_digit}+ dec_number [0-9]+ identifier [a-zA-Z][a-zA-Z0-9_]* byte Byte(\[|{ws}) bit Bit(\[|{ws}) br [\[\]\{\}] %% {identifier} { sp_lval.string = strdup(sp_text); return IDENTIFIER; } {dec_number} { sp_lval.string = strdup(sp_text); return DEC_NUM; } {hex_number} { sp_lval.string = strdup(sp_text); return HEX_NUM; } {byte} { yyless(sp_leng - 1); return BYTE; } {bit} { yyless(sp_leng - 1); return BIT; } {br}|[\.-] { return sp_text[0]; } {comment} {} // eat comments {ws}+ {} // eat white space {nl}+ { colnum = 0; } // eat new lines and reset column . { printf("Line: %d - Unrecognized input: %s\n", sp_lineno, sp_text); return 0; } %% // Report error, reset the line numbering and flush buffer void sp_error(const char* s, ...) { va_list ap; va_start(ap, s); sp_lerror(sp_lloc, s, ap); sp_lineno = 1; YY_FLUSH_BUFFER; } // Reset the line numbering and flush the buffer at the end of a file int sp_wrap() { sp_lineno = 1; YY_FLUSH_BUFFER; return 1; } mfterm-master/tag.c000066400000000000000000000312741342334113200145630ustar00rootroot00000000000000/** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . */ #include #include #include #include "mifare.h" #include "util.h" #include "tag.h" mf_tag_t current_tag; mf_tag_t current_auth; void strip_non_auth_data(mf_tag_t* tag); int load_mfd(const char* fn, mf_tag_t* tag); int save_mfd(const char* fn, const mf_tag_t* tag); int load_mfd(const char* fn, mf_tag_t* tag) { FILE* mfd_file = fopen(fn, "rb"); if (mfd_file == NULL) { printf("Could not open file: %s\n", fn); return 1; } if (fread(tag, 1, sizeof(mf_tag_t), mfd_file) != sizeof(mf_tag_t)) { printf("Could not read file: %s\n", fn); fclose(mfd_file); return 1; } fclose(mfd_file); return 0; } int save_mfd(const char* fn, const mf_tag_t* tag) { FILE* mfd_file = fopen(fn, "w"); if (mfd_file == NULL) { printf("Could not open file for writing: %s\n", fn); return 1; } if (fwrite(tag, 1, sizeof(mf_tag_t), mfd_file) != sizeof(mf_tag_t)) { printf("Could not write file: %s\n", fn); fclose(mfd_file); return 1; } fclose(mfd_file); return 0; } int load_tag(const char* fn) { return load_mfd(fn, ¤t_tag); } int save_tag(const char* fn) { return save_mfd(fn, ¤t_tag); } int load_auth(const char* fn) { if (load_mfd(fn, ¤t_auth)) return 1; strip_non_auth_data(¤t_auth); return 0; } int save_auth(const char* fn) { return save_mfd(fn, ¤t_auth); } int import_auth() { memcpy(¤t_auth, ¤t_tag, sizeof(mf_tag_t)); strip_non_auth_data(¤t_auth); return 0; } void print_tag(mf_size_t size) { if (size == MF_1K) print_tag_block_range(0, MF_1K / sizeof(mf_block_t) - 1); else if (size == MF_4K) print_tag_block_range(0, MF_4K / sizeof(mf_block_t) - 1); else { printf("Unsupported tag size.\n"); } return; } void print_tag_head() { print_tag_block_range(0, 3); return; } void print_tag_byte_bits(size_t byte, size_t first_bit, size_t last_bit) { // The byte to show parts of uint8_t data = current_tag.amb[byte / 16].mbd.abtData[byte % 16]; printf("["); for (size_t i = 0; i < 8; ++i) { // Separate nibbles if (i == 4) printf(" "); // Outside mask if (i < first_bit || i > last_bit) { printf("-"); continue; } // Inside mask if ((1< 15) block_last = 15; print_hex_array_sep(block_data + block_offset, block_last - block_offset + 1, " "); // Fill up end with spaces for (size_t i = block_last; i < 15; ++i) printf("-- "); // Finish of with a nl printf("\n"); first_byte += block_last - block_offset + 1; } } void print_tag_data_range(size_t byte_offset, size_t bit_offset, size_t byte_len, size_t bit_len) { printf("Offset: [%zu, %zu] Length: [%zu, %zu]\n", byte_offset, bit_offset, byte_len, bit_len); // Print partial first byte if (bit_offset) { size_t total_bits = byte_len * 8 + bit_len; size_t last_bit = bit_offset + total_bits - 1; if (last_bit > 7) last_bit = 7; print_tag_byte_bits(byte_offset, bit_offset, last_bit); printf("\n"); total_bits -= last_bit - bit_offset + 1; // Update data to be printed byte_offset++; bit_offset = 0; byte_len = total_bits / 8; bit_len = total_bits % 8; } // Print bytes if (byte_len) { print_tag_bytes(byte_offset, byte_offset + byte_len - 1); // Update data to be printed byte_offset += byte_len; byte_len = 0; } // Print trailing bits if (bit_len) { print_tag_byte_bits(byte_offset, 0, bit_len); printf("\n"); } } void print_tag_block_range(size_t first, size_t last) { // Print header printf("xS xB 00 07 08 0f ASCII \n"); printf("---------------------------------------------------------------------------\n"); // Iterate over all blocks for (size_t block = first; block <= last; ++block) { // Sector number printf("%02zx ", block < 0x10*4 ? block / 4 : 0x10 + (block - 0x10*4) / 0x10); // Block number printf("%02zx ", block); // then print the block data print_hex_array_sep(current_tag.amb[block].mbd.abtData, sizeof(mf_block_t), " "); // finally, an ascii rendering printf(" ["); print_ascii_rendering(current_tag.amb[block].mbd.abtData, sizeof(mf_block_t), '.'); printf("]"); // EOL printf("\n"); // Indicate sector bondaries with extra nl if (block < last && block < 16*4 && (block + 1) % 4 == 0) printf("\n"); else if (block < last && block > 16*4 && (block + 1) % 16 == 0) printf("\n"); } } void print_keys(const mf_tag_t* tag, mf_size_t size) { printf("xS xB KeyA KeyB\n"); printf("----------------------------------\n"); for (int block = 3; block < 0x10 * 4; block += 4) { printf("%02x %02x ", block / 4, block); print_hex_array(tag->amb[block].mbt.abtKeyA, 6); printf(" "); print_hex_array(tag->amb[block].mbt.abtKeyB, 6); printf("\n"); } if (size == MF_1K) return; printf("\n"); for (int block = 0xf; block < 0x0c * 0x10; block += 0x10) { printf("%02x %02x ", 0x10 + block/0x10, 0x10*4 + block); print_hex_array(tag->amb[0x10*4 + block].mbt.abtKeyA, 6); printf(" "); print_hex_array(tag->amb[0x10*4 + block].mbt.abtKeyB, 6); printf("\n"); } } void print_ac(const mf_tag_t* tag) { static const char* ac_data_str[8] = { /* 0 0 0 */ " A|B A|B A|B A|B . . . . . .", /* 0 0 1 */ " A|B x x A|B . . . . . .", /* 0 1 0 */ " A|B x x x . . . . . .", /* 0 1 1 */ " B B x x . . . . . .", /* 1 0 0 */ " A|B B x x . . . . . .", /* 1 0 1 */ " B x x x . . . . . .", /* 1 1 0 */ " A|B B B A|B . . . . . .", /* 1 1 1 */ " x x x x . . . . . .", }; static const char* ac_trailer_str[8] = { /* 0 0 0 */ " . . . . x A A x A A", /* 0 0 1 */ " . . . . x A A A A A", /* 0 1 0 */ " . . . . x x A x A x", /* 0 1 1 */ " . . . . x B A|B B x B", /* 1 0 0 */ " . . . . x B A|B x x B", /* 1 0 1 */ " . . . . x x A|B B x x", /* 1 1 0 */ " . . . . x x A|B x x x", /* 1 1 1 */ " . . . . x x A|B x x x", }; // Print header printf("xS xB Raw C1 C2 C3 R W I D AR AW ACR ACW BR BW\n"); printf("--------------------------------------------------------------------\n"); // Iterate over all blocks (in 1k sectors) for (size_t block = 0; block < 0x10 * 4; ++block) { // Sector number printf("%02zx ", block < 0x10*4 ? block / 4 : 0x10 + (block - 0x10*4) / 0x10); // Block number printf("%02zx ", block); const uint8_t* ac = tag->amb[block_to_trailer(block)].mbt.abtAccessBits; // Print raw bytes print_hex_array(ac, 4); // Print the C1, C2, C3 bits int c1 = (ac[1] & 1<<(4 + (block % 4))) > 0; int c2 = (ac[2] & 1<<(0 + (block % 4))) > 0; int c3 = (ac[2] & 1<<(4 + (block % 4))) > 0; printf(" %d %d %d", c1, c2, c3); // Print enterpretation int c123 = (c1<<2) | (c2<<1) | c3; if (block % 4 < 3) { // Data block printf("%s", ac_data_str[c123]); } else { // Trailer block printf("%s", ac_trailer_str[c123]); } printf("\n"); // Indicate sector bondaries with extra nl if ((block + 1) % 4 == 0) printf("\n"); } } const char* sprint_key(const uint8_t* key) { static char str_buff[13]; if (!key) return NULL; sprintf(str_buff, "%02x%02x%02x%02x%02x%02x", (unsigned int)(key[0]), (unsigned int)(key[1]), (unsigned int)(key[2]), (unsigned int)(key[3]), (unsigned int)(key[4]), (unsigned int)(key[5])); return str_buff; } // Return a string describing the tag type 1k|4k const char* sprint_size(mf_size_t size) { static const char* str_1k = "1k"; static const char* str_4k = "4k"; if (size == MF_1K) return str_1k; if (size == MF_4K) return str_4k; return NULL; } uint8_t* read_key(uint8_t* key, const char* str) { if (!key || !str) return NULL; static char byte_tok[] = {0, 0, 0}; char* byte_tok_end; for (int i = 0; i < 6; ++i) { byte_tok[0] = str[i*2]; byte_tok[1] = str[i*2+1]; key[i] = (uint8_t)strtol(byte_tok, &byte_tok_end, 16); if (*byte_tok_end != '\0') { return NULL; } } return key; } void clear_tag(mf_tag_t* tag) { memset((void*)tag, 0x00, MF_4K); } void strip_non_auth_data(mf_tag_t* tag) { static const size_t bs = sizeof(mf_block_t); // Clear 1k sector data 16 á 4 - only keep sector trailer for (size_t i = 0; i < 0x10; ++i) memset(((void*)tag) + i * 4 * bs, 0x00, 3 * bs); // Clear 2-4k sector data 12 á 16 - only keep sector trailer for (size_t i = 0; i < 0x0c; ++i) memset(((void*)tag) + 0x10 * 4 * bs + i * 0x10 * bs, 0x00, 0x0f * bs); } size_t block_count(mf_size_t size) { return size / 0x10; } size_t sector_count(mf_size_t size) { return size == MF_1K ? 0x10 : 0x1c; } int is_trailer_block(size_t block) { return (block + 1) % (block < 0x80 ? 4 : 0x10) == 0; } size_t block_to_sector(size_t block) { if (block < 0x10*4) return block / 4; return 0x10 + (block - 0x10*4) / 0x10; } size_t block_to_header(size_t block) { if (block < 0x10*4) return block + (block % 4); return block + (block % 0x10); } // Return the trailer block for the specified block size_t block_to_trailer(size_t block) { if (block < 0x10*4) return block + (3 - (block % 4)); return block + (0xf - (block % 0x10)); } // Return the trailer block for the specified sector size_t sector_to_trailer(size_t sector) { if (sector < 0x10) return sector * 4 + 3; else return 0x10 * 4 + (sector - 0x10) * 0x10 + 0xf; } // Return the sector size (in blocks) that contains the block size_t sector_size(size_t block) { return block < 0x10*4 ? 4 : 16; } // Extract the key for the block parameters sector of the tag and return it uint8_t* key_from_tag(const mf_tag_t* tag, mf_key_type_t key_type, size_t block) { static uint8_t key[6]; size_t trailer_block = block_to_trailer(block); if (key_type == MF_KEY_A) memcpy(key, tag->amb[trailer_block].mbt.abtKeyA, 6); else memcpy(key, tag->amb[trailer_block].mbt.abtKeyB, 6); return key; } // Write key to the sector of a tag, where the sector is specified by // the block. void key_to_tag(mf_tag_t* tag, const uint8_t* key, mf_key_type_t key_type, size_t block) { size_t trailer_block = block_to_trailer(block); if (key_type == MF_KEY_A) memcpy(tag->amb[trailer_block].mbt.abtKeyA, key, 6); else memcpy(tag->amb[trailer_block].mbt.abtKeyB, key, 6); } /** * Return block index of the first block in every sector in turn on * repeated calls. Initialize the iterator by calling with state * 0. Subsequent calls should use the tag size as state. The iterator * returns -1 as an end marker. */ int sector_header_iterator(int state) { static int block; if (state == 0) return block = 0; if (block + 4 < 0x10*4) return block += 4; if (state == MF_1K) // End marker for 1k state return -1; if (block + 0x10 < 0x100) return block += 0x10; return -1; // End marker for 4k state } mfterm-master/tag.h000066400000000000000000000072661342334113200145740ustar00rootroot00000000000000#ifndef TAG__H #define TAG__H /** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . * * Parts of code used in this file are from the GNU readline library file * fileman.c (GPLv3). Copyright (C) 1987-2009 Free Software Foundation, Inc */ #include "mifare.h" typedef enum { MF_INVALID_SIZE = 0, MF_1K = 1024, MF_4K = 4096 } mf_size_t; typedef enum { MF_INVALID_KEY_TYPE = 0, MF_KEY_A = 'a', MF_KEY_B = 'b', MF_KEY_UNLOCKED = 0xff, } mf_key_type_t; // Convenience typedefs (shortening) typedef mifare_classic_tag mf_tag_t; typedef mifare_classic_block mf_block_t; // The active tag extern mf_tag_t current_tag; // The ACL + keys used extern mf_tag_t current_auth; // Load/Save tag or keys from file int load_tag(const char* fn); int load_auth(const char* fn); int save_tag(const char* fn); int save_auth(const char* fn); // Copy key data from the 'current_tag' to the 'current_auth' int import_auth(); // Output tag data void print_tag(); void print_tag_head(); void print_tag_block_range(size_t first, size_t last); void print_tag_data_range(size_t byte_offset, size_t bit_offset, size_t byte_len, size_t bit_len); void print_tag_bytes(size_t first_byte, size_t last_byte); void print_keys(const mf_tag_t* tag, mf_size_t size); void print_ac(const mf_tag_t* tag); // Return a hex string representationon of the key const char* sprint_key(const uint8_t* key); // Parse the string and set the key. Return the key, or NULL on error. uint8_t* read_key(uint8_t* key, const char* str); // Return a string describing the tag type 1k|4k const char* sprint_size(mf_size_t size); // Set the contents of a tag to zeroes void clear_tag(mf_tag_t* tag); // Return number of blocks for size size_t block_count(mf_size_t size); // Return number of sectors for size size_t sector_count(mf_size_t size); // Return > 0 if the block is a trailer, 0 otherwise. int is_trailer_block(size_t block); // Return the sector index of the block size_t block_to_sector(size_t block); // Return the head block for the specified block size_t block_to_header(size_t block); // Return the trailer block for the specified block size_t block_to_trailer(size_t block); // Return the trailer block for the specified sector size_t sector_to_trailer(size_t sector); // Return the sector size (in blocks) that contains the block size_t sector_size(size_t block); // Extract the key for the block parameters sector of the tag and return it uint8_t* key_from_tag(const mf_tag_t* tag, mf_key_type_t key_type, size_t block); // Write key to the sector of a tag, where the sector is specified by // the block (anywhere in the sector). void key_to_tag(mf_tag_t* tag, const uint8_t* key, mf_key_type_t key_type, size_t block); /** * Return block index of the first block in every sector in turn on * repeated calls. Initialize the iterator by calling with state * 0. Subsequent calls should use the tag size as state. The iterator * returns -1 as an end marker. */ int sector_header_iterator(int state); #endif mfterm-master/term_cmd.c000066400000000000000000000464321342334113200156040ustar00rootroot00000000000000/** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . * * Parts of code used in this file are from the GNU readline library file * fileman.c (GPLv3). Copyright (C) 1987-2009 Free Software Foundation, Inc */ #include #include #include #include #include "mfterm.h" #include "tag.h" #include "term_cmd.h" #include "mifare_ctrl.h" #include "dictionary.h" #include "spec_syntax.h" #include "util.h" #include "mac.h" command_t commands[] = { { "help", com_help, 0, 0, "Display this text" }, { "?", com_help, 0, 0, "Synonym for 'help'" }, { "quit", com_quit, 0, 1, "Exit the program" }, { "q", com_quit, 0, 0, "Exit the program" }, { "exit", com_quit, 0, 0, "Synonym for 'quit'" }, { "load", com_load_tag, 1, 1, "Load tag data from a file" }, { "save", com_save_tag, 1, 1, "Save tag data to a file" }, { "clear", com_clear_tag, 0, 1, "Clear the current tag data" }, { "read", com_read_tag, 0, 1, "A|B : Read tag data from a physical tag" }, { "read unlocked", com_read_tag_unlocked, 0, 1, "On pirate cards, read card without keys" }, { "write", com_write_tag, 0, 1, "A|B : Write tag data to a physical tag" }, { "write unlocked", com_write_tag_unlocked, 0, 1, "On pirate cards, write 1k tag with block 0" }, { "print", com_print, 0, 1, "1k|4k : Print tag data" }, { "p", com_print, 0, 0, "1k|4k : Print tag data" }, { "print head", com_print_head, 0, 1, "Print first sector" }, { "print keys", com_print_keys, 0, 1, "1k|4k : Print tag's keys" }, { "print ac", com_print_ac, 0, 1, "Print access conditions" }, { "set", com_set, 0, 1, "#block #offset = xx xx xx : Set tag data" }, { "setuid", com_setuid, 0, 1, "xx xx xx xx: Set tag UID" }, { "keys load", com_keys_load, 1, 1, "Load keys from a file" }, { "keys save", com_keys_save, 1, 1, "Save keys to a file" }, { "keys clear", com_keys_clear, 0, 1, "Clear the keys" }, { "keys set", com_keys_set, 0, 1, "A|B #S key : Set a key value" }, { "keys import", com_keys_import, 0, 1, "Import keys from the current tag" }, { "keys test", com_keys_test, 0, 1, "Try to authenticate with the keys" }, { "keys", com_keys_print, 0, 1, "1k|4k : Print the keys" }, { "dict load", com_dict_load, 1, 1, "Load a dictionary key file" }, { "dict clear", com_dict_clear, 0, 1, "Clear the key dictionary" }, { "dict attack", com_dict_attack, 0, 1, "Find keys of a physical tag"}, { "dict", com_dict_print, 0, 1, "Print the key dictionary" }, { "spec load", com_spec_load, 1, 1, "Load a specification file" }, { "spec clear", com_spec_clear, 0, 1, "Unload the specification" }, { "spec", com_spec_print, 0, 1, "Print the specification" }, { "mac key", com_mac_key_get_set, 0, 1, " : Get or set MAC key" }, { "mac compute", com_mac_block_compute, 0, 1, "#block : Compute block MAC" }, { "mac update", com_mac_block_update, 0, 1, "#block : Compute block MAC" }, { "mac validate", com_mac_validate, 0, 1, "1k|4k : Validates block MAC of the whole tag" }, { (char *)NULL, (cmd_func_t)NULL, 0, 0, (char *)NULL } }; // Parse a Mifare size type argument (1k|4k) mf_size_t parse_size(const char* str); // Parse a Mifare size type argument (1k|4k). Return the default // argument value if the string is NULL. mf_size_t parse_size_default(const char* str, mf_size_t default_size); // Parse a Mifare key type argument (A|B) mf_key_type_t parse_key_type(const char* str); // Parse a Mifare key type argument (A|B). Return the default // argument value if the string is NULL. mf_key_type_t parse_key_type_default(const char* str, mf_key_type_t default_type); // Compute the MAC using the current_mac_key. If update is nonzero, // the mac of the current tag is updated. If not, the MAC is simply // printed. int com_mac_block_compute_impl(char* arg, int update); /* Look up NAME as the name of a command, and return a pointer to that command. Return a NULL pointer if NAME isn't a command name. */ command_t* find_command(const char *name) { command_t* cmd = NULL; size_t cmd_len = 0; for (size_t i = 0; commands[i].name; ++i) { size_t l = strlen(commands[i].name); if (l > cmd_len && strncmp(name, commands[i].name, l) == 0) { cmd = &commands[i]; cmd_len = l; } } return cmd; } /** * Helper function to print the specified command alligned with the longest * command name. */ void print_help_(size_t cmd) { // Find longest command (and cache the result) static size_t cmd_len_max = 0; if (cmd_len_max == 0) { for (int i = 0; commands[i].name; ++i) { size_t cmd_len = strlen(commands[i].name); cmd_len_max = cmd_len > cmd_len_max ? cmd_len : cmd_len_max; } } // Format: 4x' ' | cmd | ' '-pad-to-longest-cmd | 4x' ' | doc printf (" %s", commands[cmd].name); for (int j = (int)(cmd_len_max - strlen(commands[cmd].name)); j >= 0; --j) printf(" "); printf (" %s.\n", commands[cmd].doc); } int com_help(char* arg) { // Help request for specific command? if (arg && *arg != '\0') { for (size_t i = 0; commands[i].name; ++i) { if (strcmp(arg, commands[i].name) == 0) { print_help_(i); return 0; } } printf ("No commands match '%s'\n", arg); } // Help for all commands (with doc flag) for (size_t i = 0; commands[i].name; i++) { if (commands[i].document) print_help_(i); } return 0; } int com_quit(char *arg) { stop_input_loop(); return 0; } int com_load_tag(char *arg) { int res = load_tag(arg); if (res == 0) printf("Successfully loaded tag from: %s\n", arg); return 0; } int com_save_tag(char* arg) { int res = save_tag(arg); if (res == 0) printf("Successfully wrote tag to: %s\n", arg); return 0; } int com_clear_tag(char* arg) { clear_tag(¤t_tag); return 0; } int com_read_tag(char* arg) { // Add option to choose key char* ab = strtok(arg, " "); if (ab && strtok(NULL, " ") != (char*)NULL) { printf("Too many arguments\n"); return -1; } if (!ab) printf("No key argument (A|B) given. Defaulting to A\n"); // Parse key selection mf_key_type_t key_type = parse_key_type_default(ab, MF_KEY_A); if (key_type == MF_INVALID_KEY_TYPE) { printf("Invalid argument (A|B): %s\n", ab); return -1; } // Issue the read request mf_read_tag(¤t_tag, key_type); return 0; } int com_read_tag_unlocked(char* arg) { char* ab = strtok(arg, " "); if (ab) { printf("This command doesn't take any arguments\n"); return -1; } // Issue the read request mf_read_tag(¤t_tag, MF_KEY_UNLOCKED); return 0; } int com_write_tag(char* arg) { // Add option to choose key char* ab = strtok(arg, " "); if (!ab) { printf("Too few arguments: (A|B)\n"); return -1; } if (strtok(NULL, " ") != (char*)NULL) { printf("Too many arguments\n"); return -1; } // Parse key selection mf_key_type_t key_type = parse_key_type(ab); if (key_type == MF_INVALID_KEY_TYPE) { printf("Invalid argument (A|B): %s\n", ab); return -1; } // Issue the read request mf_write_tag(¤t_tag, key_type); return 0; } int com_write_tag_unlocked(char* arg) { char* ab = strtok(arg, " "); if (ab) { printf("This command doesn't take any arguments\n"); return -1; } // Issue the write request mf_write_tag(¤t_tag, MF_KEY_UNLOCKED); return 0; } int com_print(char* arg) { char* a = strtok(arg, " "); if (a && strtok(NULL, " ") != (char*)NULL) { printf("Too many arguments\n"); return -1; } mf_size_t size = parse_size_default(a, MF_1K); if (size == MF_INVALID_SIZE) { printf("Unknown argument: %s\n", a); return -1; } print_tag(size); return 0; } int com_print_head(char* arg) { print_tag_head(); return 0; } int com_set(char* arg) { char* block_str = strtok(arg, " "); char* offset_str = strtok(NULL, " "); char* byte_str = strtok(NULL, " "); if (!block_str || !offset_str || !byte_str) { printf("Too few arguments: #block #offset xx xx xx .. xx\n"); return -1; } unsigned int block = (unsigned int) strtoul(block_str, &block_str, 16); if (*block_str != '\0') { printf("Invalid block character (non hex): %s\n", block_str); return -1; } if (block > 0xff) { printf("Invalid block [0,ff]: %x\n", block); return -1; } unsigned int offset = (unsigned int) strtoul(offset_str, &offset_str, 16); if (*offset_str != '\0') { printf("Invalid offset character (non hex): %s\n", offset_str); return -1; } if (offset > 0x0f) { printf("Invalid offset [0,f]: %x\n", offset); return -1; } // Consume the byte tokens do { long int byte = strtol(byte_str, &byte_str, 16); if (*byte_str != '\0') { printf("Invalid byte character (non hex): %s\n", byte_str); return -1; } if (byte < 0 || byte > 0xff) { printf("Invalid byte value [0,ff]: %lx\n", byte); return -1; } if (offset > 0x0f) { printf("Too many bytes specified.\n"); return -1; } // Write the data current_tag.amb[block].mbd.abtData[offset++] = (uint8_t)byte; } while((byte_str = strtok(NULL, " ")) != (char*)NULL); return 0; } int com_setuid(char* arg) { char* byte_str = strtok(arg, " "); int block = 0; /// TODO : Check arg size (display warning if < 4) if (!byte_str) { printf("Too few arguments: xx xx xx xx\n"); return -1; } // Consume the byte tokens do { long int byte = strtol(byte_str, &byte_str, 16); if (byte < 0 || byte > 0xff) { printf("Invalid byte value [0,ff]: %lx\n", byte); return -1; } // Write the data current_tag.amb[0].mbd.abtData[block++] = (uint8_t)byte; } while(((byte_str = strtok(NULL, " ")) != (char*)NULL) && (block < 4)); // Compute and write BCC current_tag.amb[0].mbd.abtData[4] = (uint8_t)current_tag.amb[0].mbd.abtData[0] ^ (uint8_t)current_tag.amb[0].mbd.abtData[1] ^ (uint8_t)current_tag.amb[0].mbd.abtData[2] ^ (uint8_t)current_tag.amb[0].mbd.abtData[3]; return 0; } int com_print_keys(char* arg) { char* a = strtok(arg, " "); if (a && strtok(NULL, " ") != (char*)NULL) { printf("Too many arguments\n"); return -1; } mf_size_t size = parse_size_default(a, MF_1K); if (size == MF_INVALID_SIZE) { printf("Unknown argument: %s\n", a); return -1; } print_keys(¤t_tag, size); return 0; } int com_print_ac(char* arg) { if (strtok(arg, " ") != (char*)NULL) { printf("Too many arguments\n"); return -1; } print_ac(¤t_tag); return 0; } int com_keys_load(char* arg) { int res = load_auth(arg); if (res == 0) printf("Successfully loaded keys from: %s\n", arg); return 0; } int com_keys_save(char* arg) { int res = save_auth(arg); if (res == 0) printf("Successfully wrote keys to: %s\n", arg); return 0; } int com_keys_clear(char* arg) { clear_tag(¤t_auth); return 0; } int com_keys_set(char* arg) { // Arg format: A|B #S key char* ab = strtok(arg, " "); char* sector_str = strtok(NULL, " "); char* key_str = strtok(NULL, " "); if (strtok(NULL, " ") != (char*)NULL) { printf("Too many arguments\n"); return -1; } if (!ab || !sector_str || !key_str) { printf("Too few arguments: (A|B) #sector key\n"); return -1; } // Read sector long int sector = strtol(sector_str, §or_str, 16); // Sanity check sector range if (*sector_str != '\0') { printf("Invalid sector character (non hex): %s\n", sector_str); return -1; } if (sector < 0 || sector > 0x1b) { printf("Invalid sector [0,1b]: %lx\n", sector); return -1; } // Sanity check key length if (strncmp(key_str, "0x", 2) == 0) key_str += 2; if (strlen(key_str) != 12) { printf("Invalid key (6 byte hex): %s\n", key_str); return -1; } // Compute the block that houses the key for the desired sector size_t block = sector_to_trailer((size_t)sector); // Parse key selection and point to appropriate key uint8_t* key; mf_key_type_t key_type = parse_key_type(ab); if (key_type == MF_KEY_A) key = current_auth.amb[block].mbt.abtKeyA; else if (key_type == MF_KEY_B) key = current_auth.amb[block].mbt.abtKeyB; else { printf("Invalid argument (A|B): %s\n", ab); return -1; } // Parse the key if (read_key(key, key_str) == NULL) { printf("Invalid key character (non hex)\n"); return -1; } return 0; } int com_keys_import(char* arg) { import_auth(); return 0; } int com_keys_test(char* arg) { // Arg format: 1k|4k A|B char* s = strtok(arg, " "); char* ab = strtok(NULL, " "); if (s && ab && strtok(NULL, " ") != NULL) { printf("Too many arguments\n"); return -1; } if (!s || !ab) { printf("Too few arguments: (1k|4k) (A|B)\n"); return -1; } // Parse arguments mf_size_t size = parse_size(s); if (size == MF_INVALID_SIZE) { printf("Unknown size argument (1k|4k): %s\n", s); return -1; } mf_key_type_t key_type = parse_key_type(ab); if (key_type == MF_INVALID_KEY_TYPE) { printf("Unknown key type argument (A|B): %s\n", ab); return -1; } // Run the auth test mf_test_auth(¤t_auth, size, key_type); return 0; } int com_keys_print(char* arg) { char* a = strtok(arg, " "); if (a && strtok(NULL, " ") != (char*)NULL) { printf("Too many arguments\n"); return -1; } mf_size_t size = parse_size_default(a, MF_1K); if (size == MF_INVALID_SIZE) { printf("Unknown argument: %s\n", a); return -1; } print_keys(¤t_auth, size); return 0; } int com_dict_load(char* arg) { FILE* dict_file = fopen(arg, "r"); if (dict_file == NULL) { printf("Could not open file: %s\n", arg); return 1; } dictionary_import(dict_file); fclose(dict_file); return 0; } int com_dict_clear(char* arg) { dictionary_clear(); return 0; } int com_dict_attack(char* arg) { // Not much point if we don't have any keys if (!dictionary_get()) { printf("Dictionary is empty!\n"); return -1; } mf_dictionary_attack(¤t_auth); return 0; } int com_dict_print(char* arg) { key_list_t* kl = dictionary_get(); int count = 0; while(kl) { printf("%s\n", sprint_key(kl->key)); kl = kl->next; ++count; } printf("Dictionary contains: %d keys\n", count); return 0; } int com_spec_print(char* arg) { print_instance_tree(); return 0; } int com_spec_load(char* arg) { // Start by clearing the current hierarcy clear_instance_tree(); tt_clear(); // Open the file FILE* spec_file = fopen(arg, "r"); if (spec_file == NULL) { printf("Could not open file: %s\n", arg); return 1; } // Parse the specification spec_import(spec_file); fclose(spec_file); return 0; } int com_spec_clear(char* arg) { clear_instance_tree(); tt_clear(); return 0; } int com_mac_key_get_set(char* arg) { char* key_str = strtok(arg, " "); if (key_str == 0) { printf("Current MAC key: \n"); print_hex_array_sep(current_mac_key, 8, " "); printf("\n"); return 0; } uint8_t key[8]; int key_ptr = 0; // Consume the key tokens do { long int byte = strtol(key_str, &key_str, 16); if (*key_str != '\0') { printf("Invalid key character (non hex): %s\n", key_str); return -1; } if (byte < 0 || byte > 0xff) { printf("Invalid byte value [0,ff]: %lx\n", byte); return -1; } if (key_ptr > sizeof(key)) { printf("Too many bytes specified in key (should be 8).\n"); return -1; } // Accept the byte and add it to the key key[key_ptr++] = (uint8_t)byte; } while((key_str = strtok(NULL, " ")) != (char*)NULL); if (key_ptr != sizeof(key)) { printf("Too few bytes specified in key (should be 8).\n"); return -1; } // Everything ok, so update the global memcpy(current_mac_key, key, 8); return 0; } int com_mac_block_compute(char* arg) { return com_mac_block_compute_impl(arg, 0); } int com_mac_block_update(char* arg) { return com_mac_block_compute_impl(arg, 1); } int com_mac_block_compute_impl(char* arg, int update) { char* block_str = strtok(arg, " "); if (!block_str) { printf("Too few arguments: #block\n"); return -1; } unsigned int block = (unsigned int) strtoul(block_str, &block_str, 16); if (*block_str != '\0') { printf("Invalid block character (non hex): %s\n", block_str); return -1; } if (block > 0xff) { printf("Invalid block [0,ff]: %x\n", block); return -1; } // Use the key unsigned char* mac = compute_block_mac(block, current_mac_key, update); // MAC is null on error, else 8 bytes if (mac == 0) return -1; // Only need 16 MSBs. printf("Block %2.2x, MAC : ", block); print_hex_array_sep(mac, 2, " "); printf("\n"); return 0; } int com_mac_validate(char* arg) { char* a = strtok(arg, " "); if (a && strtok(NULL, " ") != (char*)NULL) { printf("Too many arguments\n"); return -1; } mf_size_t size = parse_size_default(a, MF_1K); if (size == MF_INVALID_SIZE) { printf("Unknown argument: %s\n", a); return -1; } for (unsigned int i = 1; i < block_count(size); ++i) { if (is_trailer_block(i)) continue; unsigned char* mac = compute_block_mac(i, current_mac_key, 0); printf("Block: %2x ", i); printf("Tag: "); print_hex_array_sep(¤t_tag.amb[i].mbd.abtData[14], 2, " "); printf(" Computed: "); print_hex_array_sep(mac, 2, " "); printf(" Result: "); if (memcmp(mac, ¤t_tag.amb[i].mbd.abtData[14], 2) == 0) printf("VALID"); else printf("IN-VALID"); printf("\n"); } return 0; } mf_size_t parse_size(const char* str) { if (str == NULL) return MF_INVALID_SIZE; if (strcasecmp(str, "1k") == 0) return MF_1K; if (strcasecmp(str, "4k") == 0) return MF_4K; return MF_INVALID_SIZE; } mf_size_t parse_size_default(const char* str, mf_size_t default_size) { if (str == NULL) return default_size; return parse_size(str); } mf_key_type_t parse_key_type(const char* str) { if (str == NULL) return MF_INVALID_KEY_TYPE; if (strcasecmp(str, "a") == 0) return MF_KEY_A; if (strcasecmp(str, "b") == 0) return MF_KEY_B; return MF_INVALID_KEY_TYPE; } mf_key_type_t parse_key_type_default(const char* str, mf_key_type_t default_type) { if (str == NULL) return default_type; return parse_key_type(str); } // Any command starting with '.' - path spec int exec_path_command(const char *line) { instance_t* inst = parse_spec_path(line); if (inst) print_tag_data_range(inst->offset_bytes, inst->offset_bits, inst->size_bytes, inst->size_bits); else printf("Invalid Path\n"); return 0; } mfterm-master/term_cmd.h000066400000000000000000000051341342334113200156030ustar00rootroot00000000000000#ifndef TERM_CMD__H #define TERM_CMD__H /** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . */ typedef int (*cmd_func_t)(char*); // Print help command int com_help(char* arg); // Exit mfterm command int com_quit(char* arg); // Load/Save tag file operations int com_load_tag(char* arg); int com_save_tag(char* arg); // Clear (zero) tag command int com_clear_tag(char* arg); // Read/Write tag NFC operations int com_read_tag(char* arg); int com_read_tag_unlocked(char* arg); int com_write_tag(char* arg); int com_write_tag_unlocked(char* arg); // Tag print commands int com_print(char* arg); int com_print_head(char* arg); int com_print_keys(char* arg); int com_print_ac(char* arg); // Tag set (value) command int com_set(char* arg); int com_setuid(char* arg); // Key operations int com_keys_load(char* arg); int com_keys_save(char* arg); int com_keys_clear(char* arg); int com_keys_set(char* arg); int com_keys_import(char* arg); int com_keys_print(char* arg); int com_keys_test(char* arg); // Dictionary operations int com_dict_load(char* arg); int com_dict_clear(char* arg); int com_dict_attack(char* arg); int com_dict_print(char* arg); // Specification operations int com_spec_load(char* arg); int com_spec_clear(char* arg); int com_spec_print(char* arg); // MAC operations int com_mac_key_get_set(char* arg); int com_mac_block_compute(char* arg); int com_mac_block_update(char* arg); int com_mac_validate(char* arg); typedef struct { char *name; // The command cmd_func_t func; // Function to call on command int fn_arg; // File name completion if > 0 int document; // Show in documentation if > 0 char *doc; // String documenting the command } command_t; extern command_t commands[]; // Lookup a command by name. Return a ptr to the command function, or // NULL if the command isn't found. command_t* find_command(const char *name); // Any command starting with '.' - path spec int exec_path_command(const char *line); #endif mfterm-master/util.c000066400000000000000000000041171342334113200147610ustar00rootroot00000000000000/** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . * * Parts of code used in this file are from the GNU readline library file * fileman.c (GPLv3). Copyright (C) 1987-2009 Free Software Foundation, Inc */ #include #include #include #include "util.h" char* strdup(const char* string) { if (string == NULL) return NULL; // Allocate memory for the string + '\0' char* new_string = malloc(strlen(string) + 1); if(new_string) strcpy(new_string, string); return new_string; } int is_space(char c) { return c == ' ' || c == '\t'; } /* Strip whitespace from the start and end of STRING. Return a pointer into STRING. */ char* trim(char* string) { char* s = string; while (is_space(*s)) ++s; if (*s == 0) return s; char* t = s + strlen(s) - 1; while (t > s && is_space(*t)) --t; *++t = '\0'; return s; } void print_hex_array(const unsigned char* data, size_t nbytes) { print_hex_array_sep(data, nbytes, NULL); } void print_hex_array_sep(const unsigned char* data, size_t nbytes, char* sep) { for (int i = 0; i < nbytes; ++i) { printf("%02x", data[i]); if (sep) printf("%s", sep); } } void print_ascii_rendering(const unsigned char* data, size_t nbytes, char nonascii) { for (int i = 0; i < nbytes; ++i) { if (data[i] >= 32 && data[i] < 127) printf("%c", data[i]); else printf("%c", nonascii); } } mfterm-master/util.h000066400000000000000000000030261342334113200147640ustar00rootroot00000000000000#ifndef UTIL__H #define UTIL__H /** * Copyright (C) 2011 Anders Sundman * * This file is part of mfterm. * * mfterm is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * mfterm is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with mfterm. If not, see . * * Parts of code used in this file are from the GNU readline library file * fileman.c (GPLv3). Copyright (C) 1987-2009 Free Software Foundation, Inc */ /* Strip whitespace from the start and end of STRING. Return a pointer into STRING. */ char* trim(char* string); // Allocate a new string and duplicate the argument string. char* strdup(const char* string); // Print a byte array in hex without byte separation void print_hex_array(const unsigned char* data, size_t nbytes); // Print a byte array in hex with the specified byte separation. void print_hex_array_sep(const unsigned char* data, size_t nbytes, char* sep); // Print binary data as ascii - replace non printable chars with nonascii void print_ascii_rendering(const unsigned char* data, size_t nbytes, char nonascii); #endif