mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-05-12 11:18:11 -07:00
fix a missing free, and out of band reading if called with large index which was guarded at the caller before.
This commit is contained in:
iceman1001
+23
-17
@@ -279,8 +279,8 @@ static uint8_t card_app2_limit[] = {
|
||||
0xff,
|
||||
};
|
||||
|
||||
static iclass_config_card_item_t iclass_config_options[33] = {
|
||||
//Byte A8 - LED Operations
|
||||
static iclass_config_card_item_t iclass_config_options[] = {
|
||||
// Byte A8 - LED Operations
|
||||
{"(LED) - Led idle (Off) / Led read (Off)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA8, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
|
||||
{"(LED) - Led idle (Red) / Led read (Off)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA8, 0x1F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
|
||||
{"(LED) - Led idle (Grn) / Led read (Off)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA8, 0x2F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
|
||||
@@ -297,43 +297,44 @@ static iclass_config_card_item_t iclass_config_options[33] = {
|
||||
{"(LED) - Led idle (Red) / Led read (Amber)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA8, 0xDF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
|
||||
{"(LED) - Led idle (Grn) / Led read (Amber)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA8, 0xEF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
|
||||
{"(LED) - Led idle (Amber) / Led read (Amber)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA8, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
|
||||
//Byte A9 - Potentially associated with led blinking / led heartbeat operations?
|
||||
//Byte A6 - Potentially associated with beep pitch?
|
||||
//Byte A7 - BEEP Operations
|
||||
// Byte A9 - Potentially associated with led blinking / led heartbeat operations?
|
||||
// Byte A6 - Potentially associated with beep pitch?
|
||||
// Byte A7 - BEEP Operations
|
||||
{"(BEEP) - Beep on Read (On)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA7, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
|
||||
{"(BEEP) - Beep on Read (Off)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA7, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
|
||||
//Byte AC - MIFARE CSN Operations
|
||||
// Byte AC - MIFARE CSN Operations
|
||||
{"(MIFARE) - CSN Default Output", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xAC, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
|
||||
{"(MIFARE) - CSN 32 bit Reverse Output", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xAC, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
|
||||
{"(MIFARE) - CSN 16 bit Output", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xAC, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
|
||||
{"(MIFARE) - CSN 34 bit Output", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xAC, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
|
||||
//Bytes AD, AE, AF, B3 - Keypad Operations + not fully mapped
|
||||
// Bytes AD, AE, AF, B3 - Keypad Operations + not fully mapped
|
||||
{"(KEYPAD Output) - Buffer ONE key (8 bit Dorado)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xAE, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
|
||||
{"(KEYPAD Output) - Buffer ONE to FIVE keys (standard 26 bit)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xAE, 0x0B, 0xAF, 0xFF, 0xAD, 0x15, 0xB3, 0x03}},
|
||||
{"(KEYPAD Output) - Local PIN verify", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xAD, 0x6D, 0xB3, 0x03, 0x00, 0x00, 0x00, 0x00}},
|
||||
//iClass Elite Key Operations
|
||||
// iClass Elite Key Operations
|
||||
{"(ELITE Key) - Set ELITE Key and Enable Dual key (Elite + Standard)", {0x0C, 0x00, 0x00, 0x01, 0x00, 0x00, 0xBF, 0x18, 0xBF, 0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}},
|
||||
{"(ELITE Key) - Set ELITE Key and ENABLE Keyrolling", {0x0C, 0x00, 0x00, 0x01, 0x00, 0x00, 0xBF, 0x18, 0xBF, 0x03, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}},
|
||||
{"(ELITE Key) - Set ELITE Key and DISABLE Standard Key", {0x0C, 0x00, 0x00, 0x01, 0x00, 0x00, 0xBF, 0x18, 0xBF, 0x05, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}},
|
||||
//Erroneous / incorrect reader behaviors (read below)
|
||||
//Elite Bugger:
|
||||
//Sets block 3 of card 0 presented to the reader to 0, sets block 3 of card 1 presented to the reader to the original value of card 0's block 3
|
||||
//Continues setting block 3 of presented cards to block 3 of the previous card the reader scanned
|
||||
//This renders cards unreadable and hardly recoverable unless the order of the scanned cards is known.
|
||||
// Erroneous / incorrect reader behaviors (read below)
|
||||
// Elite Bugger:
|
||||
// Sets block 3 of card 0 presented to the reader to 0, sets block 3 of card 1 presented to the reader to the original value of card 0's block 3
|
||||
// Continues setting block 3 of presented cards to block 3 of the previous card the reader scanned
|
||||
// This renders cards unreadable and hardly recoverable unless the order of the scanned cards is known.
|
||||
{"(ELITE Bugger) - Renders cards unusable.", {0x0C, 0x00, 0x00, 0x01, 0x00, 0x00, 0xBF, 0x18, 0xBF, 0x02, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}},
|
||||
//Reset Operations
|
||||
// Reset Operations
|
||||
{"(RESET) - Reset READER to defaults", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
|
||||
{"(RESET) - Reset ENROLLER to defaults", {0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1C, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0xFF, 0xFF, 0xFF}},
|
||||
//Reader Master Key Operations
|
||||
// Reader Master Key Operations
|
||||
{"(MASTER Key) - Change Reader Master Key to Custom Key", {0x28, 0xCB, 0x91, 0x9D, 0x00, 0x00, 0x00, 0x1C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
|
||||
{"(MASTER Key) - Restore Reader Master Key to Factory Defaults", {0x28, 0xCB, 0x91, 0x9D, 0x00, 0x00, 0x00, 0x1C, 0xE0, 0x5C, 0x91, 0xCF, 0x63, 0x34, 0x23, 0xB9}}
|
||||
{"(MASTER Key) - Restore Reader Master Key to Factory Defaults", {0x28, 0xCB, 0x91, 0x9D, 0x00, 0x00, 0x00, 0x1C, 0xE0, 0x5C, 0x91, 0xCF, 0x63, 0x34, 0x23, 0xB9}},
|
||||
{"", {0}}, // must be the last item
|
||||
};
|
||||
|
||||
static const iclass_config_card_item_t *get_config_card_item(int idx) {
|
||||
if (idx > -1 && idx < ARRAYLEN(iclass_config_options)) {
|
||||
return &iclass_config_options[idx];
|
||||
}
|
||||
return &iclass_config_options[ARRAYLEN(iclass_config_options)];
|
||||
return &iclass_config_options[ARRAYLEN(iclass_config_options) - 1];
|
||||
}
|
||||
|
||||
static void print_config_cards(void) {
|
||||
@@ -7068,6 +7069,7 @@ static void generate(uint8_t *data, uint8_t len) {
|
||||
uint8_t *pkey = calloc(len, sizeof(uint8_t));
|
||||
if (pkey == NULL) {
|
||||
PrintAndLogEx(WARNING, "Failed to allocate memory");
|
||||
free(key);
|
||||
return;
|
||||
}
|
||||
|
||||
@@ -7470,6 +7472,10 @@ static int CmdHFiClassConfigCard(const char *Cmd) {
|
||||
|
||||
if (ccidx > -1 && ccidx < ARRAYLEN(iclass_config_options)) {
|
||||
const iclass_config_card_item_t *item = get_config_card_item(ccidx);
|
||||
if (strlen(item->desc) == 0) {
|
||||
PrintAndLogEx(ERR, "out of range, %u (got %u)", ARRAYLEN(iclass_config_options), ccidx);
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
if (strstr(item->desc, "ELITE") != NULL && got_kr == false) {
|
||||
PrintAndLogEx(ERR, "please specify ELITE Key (--eki) !");
|
||||
return PM3_EINVARG;
|
||||
|
||||
Reference in New Issue
Block a user