大四上学期的时候因为毕业设计接触到了IC卡破解,当时是花了一个星期的时间破解了学校了水卡、洗衣卡等,毕业后没有再玩过了。
前几天搬家没有门禁卡,每次都是在楼下苦等没有办法。不得已之下又又拿出工具玩了玩。这里记录下流程,以备后用!
一、准备
- 了解IC卡的工作原理,目前仅支持M1卡破解,一般学校一卡通和水卡都是这种类型,可以尝试破解。地铁和公交卡一半则是CPU卡,无法破解。
- 一个读卡模块,PN532模块+uart转接头+卡片。
- 如果你是为了复制卡片,待复制的卡片最好为全扇区可擦除重写。
二、安装libnfc
以下环境都是以root身份运行
依赖库:
sudo apt-get install -y debhelper libtool
sudo apt-get install -y libusb-dev libpcsclite-dev libusb-0.1-4 libpcsclite1 libccid pcscd
安装nfc工具库并添加uart支持:
git clone https://github.com/nfc-tools/libnfc.git
./configure --with-drivers=pn532_uart --enable-serial-autoprobe
make clean && make && make install
将PN532插入PC USB接口运行nfc-list示例程序
> nfc-list
出现以下信息则表示安装成功:
nfc-list uses libnfc 1.7.0-rc7
NFC device: pn532_uart:/dev/ttyUSB0 opened
如果显示:
No NFC device found.
则安装失败,这时候请检查/usr/local/etc/目录下是否有nfc文件夹。如果没有,请在/usr/local/etc/目录下新建nfc文件夹,然后在nfc文件夹下新建一个文件,保存为libnfc.conf,文件内容如下:
# Allow device auto-detection (default: true)
# Note: if this auto-detection is disabled, user has to set manually a device
# configuration using file or environment variable
# allow_autoscan = true
# Allow intrusive auto-detection (default: false)
# Warning: intrusive auto-detection can seriously disturb other devices
# This option is not recommended, user should prefer to add manually his device.
# allow_intrusive_autoscan = true
# Set log level (default: error)
# Valid log levels are (in order of verbosity): 0 (none), 1 (error), 2 (info), 3 (debug)
# Note: if you compiled with --enable-debug option, the default log level is "debug"
# log_level = debug
# Manually set default device (no default)
# To set a default device, you must set both name and connstring for your device
# Note: if autoscan is enabled, default device will be the first device available in device list.
device.name = "microBuilder.eu"
#device.connstring = "pn532_uart:/dev/ttyAMA0"
device.connstring = "pn532_uart:/dev/ttyUSB0"
保存退出后再次尝试,问题解决。
如果抛出以下错误:
nfc-list: error while loading shared libraries: libnfc.so.4: cannot open shared object file: No such file or directory
打开终端执行如下命令
echo "/usr/local/lib" >> /etc/ld.so.conf.d/loc_lib.conf
ldconfig
或者在./configure
时加上--prefix=/usr
选项,重新编译安装。
二、安装mfoc
git clone https://github.com/nfc-tools/mfoc.git
autoreconf -is
./configure
make && sudo make install
三、破解密码
mfoc -O tmp.dump
等待密码破解完毕,然后重新dump一张白卡的数据:
mfoc -O empty.dump
把原来的数据复制到新的卡片中
nfc-mfclassic W empty.dump tmp.dump
卡片复制成功。
此处评论已关闭