进监狱全攻略之 Mifare1 Card 破解

* 函 数 名：write
 * 功能描述：写块数据
 * 输入参数：blockAddr--块地址;writeData--向块写16字节数据
unsigned char write(unsigned char blockAddr, unsigned char *writeData)
{
  unsigned char status;
  unsigned int recvBits;
  unsigned char i;
  unsigned char buff[18];
 
  buff[0] = PICC_WRITE;
  buff[1] = blockAddr;//块地址0-63
  calculateCRC(buff, 2, &buff[2]);
//发送指令
  status = MFRC522ToCard(PCD_TRANSCEIVE, buff, 4, buff, &recvBits);
 
//这里判断返回状态
  if ((status != MI_OK) || (recvBits != 4) || ((buff[0] & 0x0F) != 0x0A))
    status = MI_ERR;
  //准备16byte数据
  if (status == MI_OK){
    for (i=0; i<16; i++)    //?FIFO?16Byte?? Datos a la FIFO 16Byte escribir
      buff[i] = *(writeData+i);
    //计算校验位
calculateCRC(buff, 16, &buff[16]);
//发送数据
    status = MFRC522ToCard(PCD_TRANSCEIVE, buff, 18, buff, &recvBits);
    if ((status != MI_OK) || (recvBits != 4) || ((buff[0] & 0x0F) != 0x0A))
      status = MI_ERR;
  }
  return status;
}

安装
# 下载最新版库文件, 类似bcm2835-1.xx.tar.gz, 然后:
tar zxvf bcm2835-1.xx.tar.gz
cd bcm2835-1.xx
./configure
make
sudo make check
sudo make install
 
Raspberry Pi 2 (RPI2)

sudo raspi-config

under Advanced Options – A5 SPI

root@pi2:~# lsmod
Module                Size Used by
joydev                 9194 0
evdev                 11650 2
cfg80211             499234 0
rfkill                 21397 2 cfg80211
8192cu               555405 0
snd_bcm2835           23163 0
snd_pcm               95441 1 snd_bcm2835
snd_timer             22396 1 snd_pcm
snd                   68368 3 snd_bcm2835,snd_timer,snd_pcm
spi_bcm2835             8032 0 //表示开启
i2c_bcm2708             5740 0
bcm2835_gpiomem         3823 0
bcm2835_wdt             4133 0
uio_pdrv_genirq         3718 0
uio                   10230 1 uio_pdrv_genirq
i2c_dev                 6578 0
ipv6                  367607 24

root@pi2:~# ls /dev/sp*

/dev/spidev0.0 /dev/spidev0.1

The Raspberry Pi GPIO pins used for SPI are:

    P1-19 (MOSI)
    P1-21 (MISO)
    P1-23 (CLK)
    P1-24 (CE0)
    P1-26 (CE1)

// spi.c
//
// Example program for bcm2835 library
// Shows how to interface with SPI to transfer a byte to and from an SPI device
//
// After installing bcm2835, you can build this 
// with something like:
// gcc -o spi spi.c -l bcm2835
// sudo ./spi
//
// Or you can test it before installing with:
// gcc -o spi -I ../../src ../../src/bcm2835.c spi.c
// sudo ./spi
//
// Author: Mike McCauley
// Copyright (C) 2012 Mike McCauley
// $Id: RF22.h,v 1.21 2012/05/30 01:51:25 mikem Exp $
#include <bcm2835.h>
#include <stdio.h>
int main(int argc, char **argv)
{
// If you call this, it will not actually access the GPIO
// Use for testing
// bcm2835_set_debug(1);
if (!bcm2835_init())
{
printf("bcm2835_init failed. Are you running as root??\n");
return 1;
}
if (!bcm2835_spi_begin())
{
printf("bcm2835_spi_begin failedg. Are you running as root??\n");
return 1;
}
bcm2835_spi_setBitOrder(BCM2835_SPI_BIT_ORDER_MSBFIRST); // The default
bcm2835_spi_setDataMode(BCM2835_SPI_MODE0); // The default
bcm2835_spi_setClockDivider(BCM2835_SPI_CLOCK_DIVIDER_65536); // The default
bcm2835_spi_chipSelect(BCM2835_SPI_CS0); // The default
bcm2835_spi_setChipSelectPolarity(BCM2835_SPI_CS0, LOW); // the default
// Send a byte to the slave and simultaneously read a byte back from the slave
// If you tie MISO to MOSI, you should read back what was sent
uint8_t send_data = 0x23;
uint8_t read_data = bcm2835_spi_transfer(send_data);
printf("Sent to SPI: 0x%02X. Read back from SPI: 0x%02X.\n", send_data, read_data);
if (send_data != read_data)
printf("Do you have the loopback from MOSI to MISO connected?\n");
bcm2835_spi_end();
bcm2835_close();
return 0;
}

Name	Pin #	Pin name
SDA	24	GPIO8
SCK	23	GPIO11
MOSI	19	GPIO10
MISO	21	GPIO9
IRQ	None	None
GND	Any	Any Ground
RST	22	GPIO25
3.3V	1	3V3

#include "mfrc522.c"

#include <stdio.h>

#include <string.h>

int main(){

int i,count;

unsigned char s;

unsigned char id[10];

unsigned char key[] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};

unsigned char uid[5]; //4字节卡序列号，第5字节为校验字节

unsigned char str[MAX_LEN];

unsigned char wData[16] = {‘h‘,‘a‘,‘c‘,‘k‘,‘e‘,‘d‘,‘ ‘,‘b‘,‘y‘,‘ ‘,‘r‘,‘u‘,‘o‘};

int isTrue = 1;

if (!bcm2835_init()) return -1;

init();

while(isTrue){

if (findCard(0x52,&s) == MI_OK){

if ( anticoll(id) == MI_OK){

memcpy(uid,id,5);

printf("CARD UID:");

for(i = 0;i < 5;i++)

printf("%x",uid[i]);

printf("\n");

}else {

printf("FindCard ERR.\n");

}

//select Card

selectTag(uid);


//auth

if(auth(0x60,4,key,uid) == MI_OK){

//write data

if(write(4,wData) == MI_OK){

printf("Write data success!\n");

//isTrue = false;

}


//read data

if(read(4,str) == MI_OK){

printf("Hex:");

for(i = 0;i < 16;i++)

printf("%x",str[i]);

printf("\n");

printf("Data:%s\n",str);

}

}else{

printf("Auth faild.\n");

}

}

halt();

}

bcm2835_spi_end();

bcm2835_close();

return 0;

https://github.com/nfc-tools/

git clone https://github.com/nfc-tools/mfoc.git

cd mfoc/

autoreconf -vis

./configure

make

make install

#mfoc -O test.mfd //使用默认key尝试破解

#mfoc -f key.txt -O test.mfd //使用key字典