Support backdoor command for Chinese Magic Card(GEN 1a)

2025-11-04 08:13:22 +08:00 · 2020-04-25 00:57:28 +08:00 · 2020-04-25 00:57:28 +08:00 · d793c41aa5
commit d793c41aa5
parent 41015fd1fe
9 changed files with 308 additions and 19 deletions
--- a/Proxmark3GUI.pro
+++ b/Proxmark3GUI.pro
@ -20,6 +20,7 @@ SOURCES += \
    common/pm3process.cpp \
    common/util.cpp \
    module/mifare.cpp \
+    ui/mf_uid_parameterdialog.cpp \
    ui/mainwindow.cpp \
    ui/mf_attack_hardnesteddialog.cpp \

@ -27,10 +28,12 @@ HEADERS += \
    common/pm3process.h \
    common/util.h \
    module/mifare.h \
+    ui/mf_uid_parameterdialog.h \
    ui/mainwindow.h \
    ui/mf_attack_hardnesteddialog.h \

 FORMS += \
+    ui/mf_uid_parameterdialog.ui \
    ui/mainwindow.ui \
    ui/mf_attack_hardnesteddialog.ui

--- a/module/mifare.cpp
+++ b/module/mifare.cpp
@ -308,6 +308,102 @@ void Mifare::writeAll()
    }
 }

+void Mifare::readC()
+{
+    int waitTime = 300;
+    int currblk = ui->MF_RW_blockBox->currentText().toInt();
+    QString result = util->execCMDWithOutput("hf mf cgetblk "
+                     + QString::number(currblk), waitTime);
+    if(result.indexOf("No chinese") == -1)
+    {
+        result = result.mid(result.indexOf(*dataPattern, 0), 47).toUpper();
+        ui->MF_RW_dataEdit->setText(result);
+    }
+}
+
+void Mifare::readAllC()
+{
+    QString result;
+    const int waitTime = 150;
+
+    QString tmp;
+    int offset = 0;
+    for(int i = 0; i < cardType.sectors; i++)
+    {
+        result = util->execCMDWithOutput("hf mf cgetsc "
+                                         + QString::number(i), waitTime);
+        qDebug() << result;
+        if(result.indexOf("No chinese") == -1)
+        {
+            offset = 0;
+            for(int j = 0; j < cardType.blk[i]; j++)
+            {
+                offset = result.indexOf(*dataPattern, offset);
+                tmp = result.mid(offset, 47).toUpper();
+                offset += 47;
+                qDebug() << tmp;
+                tmp.replace(" ", "");
+                dataList->replace(cardType.blks[i] + j, tmp);
+                data_syncWithDataWidget(false, cardType.blks[i] + j);
+            }
+            keyAList->replace(i, dataList->at(cardType.blks[i] + cardType.blk[i] - 1).left(12));
+            keyBList->replace(i, dataList->at(cardType.blks[i] + cardType.blk[i] - 1).right(12));
+            data_syncWithKeyWidget(false, i, true);
+            data_syncWithKeyWidget(false, i, false);
+        }
+    }
+}
+
+void Mifare::writeC()
+{
+    int waitTime = 150;
+    QString result = util->execCMDWithOutput("hf mf csetblk "
+                     + ui->MF_RW_blockBox->currentText()
+                     + " "
+                     + ui->MF_RW_dataEdit->text().replace(" ", ""), waitTime);
+    if(result.indexOf("No chinese") == -1)
+    {
+        QMessageBox::information(parent, tr("info"), tr("Success!"));
+    }
+    else
+    {
+        QMessageBox::information(parent, tr("info"), tr("Failed!"));
+    }
+}
+
+void Mifare::writeAllC()
+{
+    const int waitTime = 150;
+    QString result;
+    for(int i = 0; i < cardType.sectors; i++)
+    {
+        for(int j = 0; j < cardType.blk[i]; j++)
+        {
+            result = ""; // if the KeyA is invalid and the result is not empty, the KeyB will not be tested.
+            if(data_isDataValid(dataList->at(cardType.blks[i] + j)) != DATA_NOSPACE || dataList->at(cardType.blks[i] + j).contains('?'))
+                continue;
+            result = util->execCMDWithOutput("hf mf csetblk "
+                                             + QString::number(cardType.blks[i] + j)
+                                             + " "
+                                             + dataList->at(cardType.blks[i] + j), waitTime);
+        }
+    }
+}
+
+void Mifare::wipeC()
+{
+    util->execCMD("hf mf cwipe "
+                  + QString::number(cardType.type)
+                  + " f");
+    ui->funcTab->setCurrentIndex(1);
+}
+
+void Mifare::setParameterC()
+{
+
+}
+
+
 void Mifare::dump()
 {
    util->execCMD("hf mf dump");
--- a/module/mifare.h
+++ b/module/mifare.h
@ -82,6 +82,12 @@ public:
    CardType cardType;
    Mifare::CardType getCardType();
    void setCardType(int type);
+    void writeAllC();
+    void writeC();
+    void readAllC();
+    void readC();
+    void wipeC();
+    void setParameterC();
 public slots:
 signals:

--- a/ui/mainwindow.cpp
+++ b/ui/mainwindow.cpp
@ -198,16 +198,6 @@ void MainWindow::on_MF_Attack_hardnestedButton_clicked()
    mifare->hardnested();
 }

-void MainWindow::on_MF_Attack_sniffButton_clicked()
-{
-    mifare->sniff();
-}
-
-void MainWindow::on_MF_Attack_listButton_clicked()
-{
-    mifare->list();
-}
-
 void MainWindow::on_MF_RW_readAllButton_clicked()
 {
    mifare->readAll();
@ -238,6 +228,36 @@ void MainWindow::on_MF_RW_restoreButton_clicked()
    mifare->restore();
 }

+void MainWindow::on_MF_UID_readAllButton_clicked()
+{
+    mifare->readAllC();
+}
+
+void MainWindow::on_MF_UID_readBlockButton_clicked()
+{
+    mifare->readC();
+}
+
+void MainWindow::on_MF_UID_writeAllButton_clicked()
+{
+    mifare->writeAllC();
+}
+
+void MainWindow::on_MF_UID_writeBlockButton_clicked()
+{
+    mifare->writeC();
+}
+
+void MainWindow::on_MF_Sniff_sniffButton_clicked()
+{
+    mifare->sniff();
+}
+
+void MainWindow::on_MF_Sniff_listButton_clicked()
+{
+    mifare->list();
+}
+
 void MainWindow::MF_widgetReset()
 {
    int secs = mifare->cardType.sectors;
@ -352,4 +372,3 @@ void MainWindow::setTableItem(QTableWidget* widget, int row, int column, const Q
    widget->item(row, column)->setText(text);
 }
 // ***********************************************
-
--- a/ui/mainwindow.h
+++ b/ui/mainwindow.h
@ -61,9 +61,9 @@ private slots:

    void on_MF_Attack_hardnestedButton_clicked();

-    void on_MF_Attack_sniffButton_clicked();
+    void on_MF_Sniff_sniffButton_clicked();

-    void on_MF_Attack_listButton_clicked();
+    void on_MF_Sniff_listButton_clicked();

    void on_MF_RW_readAllButton_clicked();

@ -80,6 +80,14 @@ private slots:

    void on_MF_RW_restoreButton_clicked();

+    void on_MF_UID_readAllButton_clicked();
+
+    void on_MF_UID_readBlockButton_clicked();
+
+    void on_MF_UID_writeAllButton_clicked();
+
+    void on_MF_UID_writeBlockButton_clicked();
+
 private:
    Ui::MainWindow *ui;
    QButtonGroup* typeBtnGroup;
--- a/ui/mainwindow.ui
+++ b/ui/mainwindow.ui
@ -670,7 +670,7 @@
                 </widget>
                </item>
                <item row="0" column="1">
-                 <widget class="QPushButton" name="MF_UID_writeUIDButton">
+                 <widget class="QPushButton" name="MF_UID_setParaButton">
                  <property name="sizePolicy">
                   <sizepolicy hsizetype="Minimum" vsizetype="Fixed">
                    <horstretch>0</horstretch>
@ -678,7 +678,7 @@
                   </sizepolicy>
                  </property>
                  <property name="text">
-                   <string>Write UID</string>
+                   <string>Set Parameter</string>
                  </property>
                 </widget>
                </item>
@ -824,7 +824,7 @@
              </spacer>
             </item>
             <item>
-              <widget class="QPushButton" name="MF_Attack_sniffButton">
+              <widget class="QPushButton" name="MF_Sniff_sniffButton">
               <property name="minimumSize">
                <size>
                 <width>40</width>
@ -837,14 +837,14 @@
              </widget>
             </item>
             <item>
-              <widget class="QPushButton" name="MF_Attack_listButton">
+              <widget class="QPushButton" name="MF_Sniff_listButton">
               <property name="text">
                <string>List Sniff Data</string>
               </property>
              </widget>
             </item>
             <item>
-              <widget class="QPushButton" name="pushButton">
+              <widget class="QPushButton" name="MF_Sniff_loadButton">
               <property name="minimumSize">
                <size>
                 <width>40</width>
@ -857,7 +857,7 @@
              </widget>
             </item>
             <item>
-              <widget class="QPushButton" name="pushButton_2">
+              <widget class="QPushButton" name="MF_Sniff_saveButton">
               <property name="minimumSize">
                <size>
                 <width>40</width>
--- a/ui/mf_uid_parameterdialog.cpp
+++ b/ui/mf_uid_parameterdialog.cpp
@ -0,0 +1,14 @@
+#include "mf_uid_parameterdialog.h"
+#include "ui_mf_uid_parameterdialog.h"
+
+MF_UID_parameterDialog::MF_UID_parameterDialog(QWidget *parent) :
+    QDialog(parent),
+    ui(new Ui::MF_UID_parameterDialog)
+{
+    ui->setupUi(this);
+}
+
+MF_UID_parameterDialog::~MF_UID_parameterDialog()
+{
+    delete ui;
+}
--- a/ui/mf_uid_parameterdialog.h
+++ b/ui/mf_uid_parameterdialog.h
@ -0,0 +1,22 @@
+#ifndef MF_UID_PARAMETERDIALOG_H
+#define MF_UID_PARAMETERDIALOG_H
+
+#include <QDialog>
+
+namespace Ui {
+class MF_UID_parameterDialog;
+}
+
+class MF_UID_parameterDialog : public QDialog
+{
+    Q_OBJECT
+
+public:
+    explicit MF_UID_parameterDialog(QWidget *parent = nullptr);
+    ~MF_UID_parameterDialog();
+
+private:
+    Ui::MF_UID_parameterDialog *ui;
+};
+
+#endif // MF_UID_PARAMETERDIALOG_H
--- a/ui/mf_uid_parameterdialog.ui
+++ b/ui/mf_uid_parameterdialog.ui
@ -0,0 +1,121 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ui version="4.0">
+ <class>MF_UID_parameterDialog</class>
+ <widget class="QDialog" name="MF_UID_parameterDialog">
+  <property name="geometry">
+   <rect>
+    <x>0</x>
+    <y>0</y>
+    <width>205</width>
+    <height>186</height>
+   </rect>
+  </property>
+  <property name="windowTitle">
+   <string>Dialog</string>
+  </property>
+  <layout class="QVBoxLayout" name="verticalLayout">
+   <item>
+    <layout class="QFormLayout" name="formLayout">
+     <item row="0" column="0">
+      <widget class="QLabel" name="uIDLabel">
+       <property name="text">
+        <string>UID:</string>
+       </property>
+      </widget>
+     </item>
+     <item row="0" column="1">
+      <widget class="QLineEdit" name="UIDLineEdit"/>
+     </item>
+     <item row="1" column="0">
+      <widget class="QLabel" name="ATQALabel">
+       <property name="text">
+        <string>ATQA:</string>
+       </property>
+      </widget>
+     </item>
+     <item row="1" column="1">
+      <widget class="QLineEdit" name="ATQALineEdit"/>
+     </item>
+     <item row="2" column="0">
+      <widget class="QLabel" name="SAKLabel">
+       <property name="text">
+        <string>SAK:</string>
+       </property>
+      </widget>
+     </item>
+     <item row="2" column="1">
+      <widget class="QLineEdit" name="SAKLineEdit"/>
+     </item>
+    </layout>
+   </item>
+   <item>
+    <widget class="QLabel" name="label">
+     <property name="text">
+      <string>The parameter will not change if you leave it empty.</string>
+     </property>
+     <property name="wordWrap">
+      <bool>true</bool>
+     </property>
+    </widget>
+   </item>
+   <item>
+    <spacer name="verticalSpacer">
+     <property name="orientation">
+      <enum>Qt::Vertical</enum>
+     </property>
+     <property name="sizeHint" stdset="0">
+      <size>
+       <width>20</width>
+       <height>40</height>
+      </size>
+     </property>
+    </spacer>
+   </item>
+   <item>
+    <widget class="QDialogButtonBox" name="buttonBox">
+     <property name="orientation">
+      <enum>Qt::Horizontal</enum>
+     </property>
+     <property name="standardButtons">
+      <set>QDialogButtonBox::Cancel|QDialogButtonBox::Ok</set>
+     </property>
+    </widget>
+   </item>
+  </layout>
+ </widget>
+ <resources/>
+ <connections>
+  <connection>
+   <sender>buttonBox</sender>
+   <signal>accepted()</signal>
+   <receiver>MF_UID_parameterDialog</receiver>
+   <slot>accept()</slot>
+   <hints>
+    <hint type="sourcelabel">
+     <x>248</x>
+     <y>254</y>
+    </hint>
+    <hint type="destinationlabel">
+     <x>157</x>
+     <y>274</y>
+    </hint>
+   </hints>
+  </connection>
+  <connection>
+   <sender>buttonBox</sender>
+   <signal>rejected()</signal>
+   <receiver>MF_UID_parameterDialog</receiver>
+   <slot>reject()</slot>
+   <hints>
+    <hint type="sourcelabel">
+     <x>316</x>
+     <y>260</y>
+    </hint>
+    <hint type="destinationlabel">
+     <x>286</x>
+     <y>274</y>
+    </hint>
+   </hints>
+  </connection>
+ </connections>
+</ui>