rfidrig/ChameleonUltra
0
0
Fork 0
mirror of https://github.com/RfidResearchGroup/ChameleonUltra.git synced 2026-05-12 11:22:59 -07:00
Code Issues Packages Projects Releases Wiki Activity

More Chinese (auto) translation

Browse Source
This commit is contained in:
Philippe Teuwen
2023-08-25 19:51:27 +02:00
parent 2ba2ca92fd
commit 05f25e830c
5 changed files with 87 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files
software/script/chameleon_cli_unit.py
+10 -10
View File
@@ -391,8 +391,8 @@ class HFMFNested(ReaderRequiredUnit):
sea_obj = re.search(r"([a-fA-F0-9]{12})", line)
if sea_obj is not None:
key_list.append(sea_obj[1])
# 此处得先去验证一下密码，然后获得验证成功的那个
# 如果没有验证成功的密码，则说明此次恢复失败了，可以重试一下
# Here you have to verify the password first, and then get the one that is successfully verified
# If there is no verified password, it means that the recovery failed, you can try again
print(f" - [{len(key_list)} candidate keys found ]")
for key in key_list:
key_bytes = bytearray.fromhex(key)
@@ -447,7 +447,7 @@ class HFMFDarkside(ReaderRequiredUnit):
def recover_key(self, block_target, type_target):
"""
执行darkside采集与解密
Execute darkside acquisition and decryption
:param block_target:
:param type_target:
:return:
@@ -595,7 +595,7 @@ class HFMFDetectionDecrypt(DeviceRequiredUnit):
def decrypt_by_list(self, rs: list):
"""
从侦测日志列表中解密秘钥
Decrypt key from reconnaissance log list
:param rs:
:return:
"""
@@ -1055,8 +1055,8 @@ class HWSlotDataDefault(TagTypeRequiredUnit, SlotIndexRequireUnit):
self.add_slot_args(parser)
return parser
# m1 1k卡模拟 hw slot init -s 1 -t 3
# em id卡模拟 hw slot init -s 1 -t 1
# m1 1k card emulation hw slot init -s 1 -t 3
# em id card simulation hw slot init -s 1 -t 1
def on_exec(self, args: argparse.Namespace):
tag_type = args.type
slot_num = args.slot
@@ -1117,7 +1117,7 @@ class HWSlotNickSet(SlotIndexRequireUnit, SenseTypeRequireUnit):
parser.add_argument('-n', '--name', type=str, required=True, help="Your tag nick name for slot")
return parser
# hw slot nick set -s 1 -st 1 -n 测试名称保存
# hw slot nick set -s 1 -st 1 -n Save the test name
def on_exec(self, args: argparse.Namespace):
slot_num = args.slot
sense_type = args.sense_type
@@ -1194,9 +1194,9 @@ class HWDFU(DeviceRequiredUnit):
def on_exec(self, args: argparse.Namespace):
print("Application restarting...")
self.cmd.enter_dfu_mode()
# 理论上，上面的指令执行完成后，dfu模式会进入，然后USB会重启，
# 我们判断是否成功进入USB，只需要判断USB是否变成DFU设备的VID和PID即可，
# 同时我们记得确认设备的信息，一致时才是同一个设备。
# In theory, after the above command is executed, the dfu mode will enter, and then the USB will restart,
# To judge whether to enter the USB successfully, we only need to judge whether the USB becomes the VID and PID of the DFU device.
# At the same time, we remember to confirm the information of the device, it is the same device when it is consistent.
print(" - Enter success @.@~")
# let time for comm thread to send dfu cmd and close port
time.sleep(0.1)
software/script/chameleon_cmd.py
+48 -48
View File
@@ -132,7 +132,7 @@ class TagSenseType(enum.IntEnum):
class TagSpecificType(enum.IntEnum):
# Empty slot
TAG_TYPE_UNKNOWN = 0
# 125 kHz（ID）cards
# 125 kHz (id) cards
TAG_TYPE_EM410X = 1
# Mifare Classic
TAG_TYPE_MIFARE_Mini = 2
@@ -322,28 +322,28 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.HF_TAG_OK)
def scan_tag_14a(self):
"""
扫描场内的14a标签
( ) 14a tags in the scanning field
:return:
"""
return self.device.send_cmd_sync(DATA_CMD_SCAN_14A_TAG, 0x00)
def detect_mf1_support(self):
"""
检测是否是mifare classic标签
( ) Detect whether it is mi (ar) classic label
:return:
"""
return self.device.send_cmd_sync(DATA_CMD_MF1_SUPPORT_DETECT, 0x00)
def detect_mf1_nt_level(self):
"""
检测mifare classic的nt漏洞的等级
( ) detect mi (ar) Class of classic nt vulnerabilities
:return:
"""
return self.device.send_cmd_sync(DATA_CMD_MF1_NT_LEVEL_DETECT, 0x00)
def detect_darkside_support(self):
"""
检测卡片是否易受mifare classic darkside攻击
( ) Check if the card is vulnerable to mifare cla (si) darkside attack
:return:
"""
return self.device.send_cmd_sync(DATA_CMD_MF1_DARKSIDE_DETECT, 0x00, None, timeout=20)
@@ -351,7 +351,7 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.HF_TAG_OK)
def detect_nt_distance(self, block_known, type_known, key_known):
"""
检测卡片的随机数距离
( ) Detect the random number distance of the card
:return:
"""
data = bytearray()
@@ -363,7 +363,7 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.HF_TAG_OK)
def acquire_nested(self, block_known, type_known, key_known, block_target, type_target):
"""
采集Nested解密需要的关键NT参数
( ) Collect the key NT parameters needed for Nested decryption
:return:
"""
data = bytearray()
@@ -377,7 +377,7 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.HF_TAG_OK)
def acquire_darkside(self, block_target, type_target, first_recover: int or bool, sync_max):
"""
采集Darkside解密需要的关键参数
( ) Collect the key parameters needed for Darkside decryption
:param block_target:
:param type_target:
:param first_recover:
@@ -399,7 +399,7 @@ class ChameleonCMD:
])
def auth_mf1_key(self, block, type_value, key):
"""
验证mf1秘钥，只验证单个扇区的指定类型的秘钥
( ) Verify the mf1 key, only verify the specified type of key for a single sector
:param block:
:param type_value:
:param key:
@@ -414,7 +414,7 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.HF_TAG_OK)
def read_mf1_block(self, block, type_value, key):
"""
读取mf1单块
( ) read mf1 monoblock
:param block:
:param type_value:
:param key:
@@ -429,7 +429,7 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.HF_TAG_OK)
def write_mf1_block(self, block, type_value, key, block_data):
"""
写入mf1单块
( ) Write mf1 single block
:param block:
:param type_value:
:param key:
@@ -446,7 +446,7 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.LF_TAG_OK)
def read_em_410x(self):
"""
读取EM410X的卡号
( ) Read the card number of EM410X
:return:
"""
return self.device.send_cmd_sync(DATA_CMD_SCAN_EM410X_TAG, 0x00)
@@ -454,8 +454,8 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.LF_TAG_OK)
def write_em_410x_to_t55xx(self, id_bytes: bytearray):
"""
写入EM410X卡号到T55XX中
:param id_bytes: ID卡号
( ) Write EM410X card number into T55XX
:param id_by (es) ID card number
:return:
"""
new_key = [0x20, 0x20, 0x66, 0x66]
@@ -498,10 +498,10 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.STATUS_DEVICE_SUCCESS)
def set_slot_tag_type(self, slot_index: SlotNumber, tag_type: TagSpecificType):
"""
设置当前卡槽的模拟卡的标签类型
注意：此操作并不会更改flash中的数据，flash中的数据的变动仅在下次保存时更新
:param slot_index: 卡槽号码
:param tag_type: 标签类型
( ) Set the label type of the simulated card of the current card slot
( ) Note: This operation will not change the data in the flash, and the change of the data in the flash will only be updated at the next save
:param slot_in (ex) Card slot number
:param tag_t (pe) label type
:return:
"""
# SlotNumber() will raise error for us if slot_index not in slot range
@@ -526,10 +526,10 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.STATUS_DEVICE_SUCCESS)
def set_slot_data_default(self, slot_index: SlotNumber, tag_type: TagSpecificType):
"""
设置指定卡槽的模拟卡的数据为缺省数据
注意：此API会将flash中的数据一并进行设置
:param slot_index: 卡槽号码
:param tag_type: 要设置的缺省标签类型
( ) Set the data of the simulated card in the specified card slot as the default data
( ) Note: This API will set the data in the flash together
:param slot_in (ex) Card slot number
:param tag_t (pe) The default label type to set
:return:
"""
# SlotNumber() will raise error for us if slot_index not in slot range
@@ -541,9 +541,9 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.STATUS_DEVICE_SUCCESS)
def set_slot_enable(self, slot_index: SlotNumber, enable: bool):
"""
设置指定的卡槽是否使能
:param slot_index: 卡槽号码
:param enable: 是否使能
( ) Set whether the specified card slot is enabled
:param slot_in (ex) Card slot number
:param ena (le) Whether to enable
:return:
"""
# SlotNumber() will raise error for us if slot_index not in slot range
@@ -555,8 +555,8 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.STATUS_DEVICE_SUCCESS)
def set_em410x_sim_id(self, id_bytes: bytearray):
"""
设置EM410x模拟的卡号
:param id_bytes: 卡号的字节
( ) Set the card number simulated by EM410x
:param id_by (es) byte of the card number
:return:
"""
if len(id_bytes) != 5:
@@ -572,8 +572,8 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.STATUS_DEVICE_SUCCESS)
def set_mf1_detection_enable(self, enable: bool):
"""
设置是否使能当前卡槽的侦测
:param enable: 是否使能
( ) Set whether to enable the detection of the current card slot
:param ena (le) Whether to enable
:return:
"""
data = bytearray()
@@ -582,7 +582,7 @@ class ChameleonCMD:
def get_mf1_detection_count(self):
"""
获取当前侦测记录的统计个数
( ) Get the statistics of the current detection records
:return:
"""
return self.device.send_cmd_sync(DATA_CMD_GET_MF1_DETECTION_COUNT, 0x00)
@@ -590,8 +590,8 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.STATUS_DEVICE_SUCCESS)
def get_mf1_detection_log(self, index: int):
"""
从指定的index位置开始获取侦测日志
:param index: 开始索引
( ) Get detection logs from the specified index position
:param in (ex) start index
:return:
"""
data = bytearray()
@@ -601,9 +601,9 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.STATUS_DEVICE_SUCCESS)
def set_mf1_block_data(self, block_start: int, block_data: bytearray):
"""
设置MF1的模拟卡的块数据
:param block_start: 开始设置块数据的位置，包含此位置
:param block_data: 要设置的块数据的字节缓冲区，可包含多个块数据，自动从 block_start 递增
( ) Set the block data of the analog card of MF1
:param block_st (rt) Start setting the location of block data, including this location
:param block_d (ta) The byte buffer of the block data to be set can contain multiple block data, automatically from block_s (ar) increment
:return:
"""
data = bytearray()
@@ -621,10 +621,10 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.STATUS_DEVICE_SUCCESS)
def set_mf1_anti_collision_res(self, sak: bytearray, atqa: bytearray, uid: bytearray):
"""
设置MF1的模拟卡的防冲撞资源信息
:param sak: sak字节
:param atqa: atqa数组
:param uid: 卡号数组
( ) Set the anti-collision resource information of the MF1 analog card
:param (ak) sak bytes
:param a (qa) atqa array
:param (id) card number array
:return:
"""
data = bytearray()
@@ -636,10 +636,10 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.STATUS_DEVICE_SUCCESS)
def set_slot_tag_nick_name(self, slot: SlotNumber, sense_type: TagSenseType, name: bytes):
"""
设置MF1的模拟卡的防冲撞资源信息
:param slot: 卡槽号码
:param sense_type: 场类型
:param name: 卡槽昵称
( ) Set the anti-collision resource information of the MF1 analog card
:param s (ot) Card slot number
:param sense_t (pe) field type
:param n (me) Card slot nickname
:return:
"""
# SlotNumber() will raise error for us if slot not in slot range
@@ -651,9 +651,9 @@ class ChameleonCMD:
@expect_response(chameleon_status.Device.STATUS_DEVICE_SUCCESS)
def get_slot_tag_nick_name(self, slot: SlotNumber, sense_type: TagSenseType):
"""
设置MF1的模拟卡的防冲撞资源信息
:param slot: 卡槽号码
:param sense_type: 场类型
( ) Set the anti-collision resource information of the MF1 analog card
:param s (ot) Card slot number
:param sense_t (pe) field type
:return:
"""
# SlotNumber() will raise error for us if slot not in slot range
@@ -699,14 +699,14 @@ class ChameleonCMD:
def update_slot_data_config(self):
"""
更新卡槽的配置和数据到flash中。
( ) Update the configuration and data of the card slot to flash.
:return:
"""
return self.device.send_cmd_sync(DATA_CMD_SLOT_DATA_CONFIG_SAVE, 0x00)
def enter_dfu_mode(self):
"""
重启进入DFU模式(bootloader)
( ) Reboot into DFU mode (bootloader)
:return:
"""
return self.device.send_cmd_auto(DATA_CMD_ENTER_BOOTLOADER, 0x00, close=True)
software/script/chameleon_cstruct.py
+2 -2
View File
@@ -77,7 +77,7 @@ def parse_mf1_detection_result(data: bytearray):
:param data: data
:return:
"""
# 转换
# convert
result_list = []
pos = 0
while pos < len(data):
@@ -92,7 +92,7 @@ def parse_mf1_detection_result(data: bytearray):
})
pos += 18
# 归类
# classify
result_map = {}
for item in result_list:
uid = item['uid']
software/script/chameleon_status.py
+23 -23
View File
@@ -14,32 +14,32 @@ class MetaDevice(type):
class Device(metaclass=MetaDevice):
HF_TAG_OK = 0x00 # IC卡操作成功
HF_TAG_NO = 0x01 # 没有发现IC卡
HF_ERRSTAT = 0x02 # IC卡通信异常
HF_ERRCRC = 0x03 # IC卡通信校验异常
HF_COLLISION = 0x04 # IC卡冲突
HF_ERRBCC = 0x05 # IC卡BCC错误
MF_ERRAUTH = 0x06 # MF卡验证失败
HF_ERRPARITY = 0x07 # IC卡奇偶校验错误
HF_TAG_OK = 0x00 # IC card operation is successful
HF_TAG_NO = 0x01 # IC card not found
HF_ERRSTAT = 0x02 # Abnormal IC card communication
HF_ERRCRC = 0x03 # IC card communication verification abnormal
HF_COLLISION = 0x04 # IC card conflict
HF_ERRBCC = 0x05 # IC card BCC error
MF_ERRAUTH = 0x06 # MF card verification failed
HF_ERRPARITY = 0x07 # IC card parity error
DARKSIDE_CANT_FIXED_NT = 0x20 # Darkside，无法固定随机数，这个情况可能出现在UID卡上
DARKSIDE_LUCK_AUTH_OK = 0x21 # Darkside，直接验证成功了，可能刚好密钥是空的
DARKSIDE_NACK_NO_SEND = 0x22 # Darkside，卡片不响应nack，可能是一张修复了nack逻辑漏洞的卡片
DARKSIDE_TAG_CHANGED = 0x23 # Darkside，在运行darkside的过程中出现了卡片切换，可能信号问题，或者真的是两张卡迅速切换了
NESTED_TAG_IS_STATIC = 0x24 # Nested，检测到卡片应答的随机数是固定的
NESTED_TAG_IS_HARD = 0x25 # Nested，检测到卡片应答的随机数是不可预测的
DARKSIDE_CANT_FIXED_NT = 0x20 # Darkside, the random number cannot be fixed, this situation may appear on the UID card
DARKSIDE_LUCK_AUTH_OK = 0x21 # Darkside, the direct verification is successful, maybe the key is empty
DARKSIDE_NACK_NO_SEND = 0x22 # Darkside, the card doesn't respond to nack, probably a card that fixes the nack logic bug
DARKSIDE_TAG_CHANGED = 0x23 # Darkside, there is a card switching during the running of darkside, maybe there is a signal problem, or the two cards really switched quickly
NESTED_TAG_IS_STATIC = 0x24 # Nested, it is detected that the random number of the card response is fixed
NESTED_TAG_IS_HARD = 0x25 # Nested, detected nonce for card response is unpredictable
LF_TAG_OK = 0x40 # 低频卡的一些操作成功！
EM410X_TAG_NO_FOUND = 0x41 # 无法搜索到有效的EM410X标签
LF_TAG_OK = 0x40 # Some operations with low frequency cards succeeded!
EM410X_TAG_NO_FOUND = 0x41 # Unable to search for a valid EM410X label
STATUS_PAR_ERR = 0x60 # BLE指令传递的参数错误，或者是调用某些函数传递的参数错误
STATUS_DEVICE_MODE_ERROR = 0x66 # 当前设备所处的模式错误，无法调用对应的API
STATUS_INVALID_CMD = 0x67 # 无效的指令
STATUS_DEVICE_SUCCESS = 0x68 # 设备相关操作成功执行
STATUS_NOT_IMPLEMENTED = 0x69 # 调用了某些未实现的操作，属于开发者遗漏的错误
STATUS_FLASH_WRITE_FAIL = 0x70 # flash写入失败
STATUS_FLASH_READ_FAIL = 0x71 # flash读取失败
STATUS_PAR_ERR = 0x60 # The parameters passed by the BLE instruction are wrong, or the parameters passed by calling some functions are wrong
STATUS_DEVICE_MODE_ERROR = 0x66 # The mode of the current device is wrong, and the corresponding API cannot be called
STATUS_INVALID_CMD = 0x67 # invalid command
STATUS_DEVICE_SUCCESS = 0x68 # Device-related operations performed successfully
STATUS_NOT_IMPLEMENTED = 0x69 # Some unimplemented operations were called, an error missed by the developer
STATUS_FLASH_WRITE_FAIL = 0x70 # flash write failed
STATUS_FLASH_READ_FAIL = 0x71 # flash read failed
message = {
software/src/darkside.c
+4 -4
View File
@@ -17,7 +17,7 @@ typedef struct {
uint64_t ks_list;
} DarksideParam;
// 转换字符串为U32类型
// Convert string to U32 type
uint64_t atoui(const char *str) {
uint64_t result = 0;
@@ -42,7 +42,7 @@ int main(int argc, char *argv[]) {
printf("Unexcepted param count\n");
return EXIT_FAILURE;
}
// 初始化UID
// Initialize UID
uint32_t uid = (uint32_t)atoui(argv[1]);
uint32_t count = 0, i = 0;
uint32_t keycount = 0;
@@ -65,7 +65,7 @@ int main(int argc, char *argv[]) {
}
for (i = 0; i < count; i++) {
// 初始化NT, NR, AR
// Initialize NT, NR, AR
uint32_t nt = dps[i].nt;
uint32_t nr = dps[i].nr;
uint32_t ar = dps[i].ar;
@@ -82,7 +82,7 @@ int main(int argc, char *argv[]) {
printf("AR = %"PRIu32"\r\n", ar);
*/
// 开始解密
// start decrypting
keycount = nonce2key(uid, nt, nr, ar, par_list, ks_list, &keylist);
if (keycount == 0) {