]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhficlass.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
FIX: Coverity, unintended sign extention, CID #121363, (numbits << 16…
[proxmark3-svn] / client / cmdhficlass.c
CommitLineData
cee5a30d 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833 4// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// High frequency iClass commands
11//-----------------------------------------------------------------------------
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <string.h>
9f6e9d15 16#include <sys/stat.h>
cee5a30d 17#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18#include "data.h"
902cb3c0 19#include "proxmark3.h"
cee5a30d 20#include "ui.h"
21#include "cmdparser.h"
22#include "cmdhficlass.h"
23#include "common.h"
14006804 24#include "util.h"
17cba269 25#include "cmdmain.h"
a66fca86
AD		 26#include "loclass/des.h"
27#include "loclass/cipherutils.h"
28#include "loclass/cipher.h"
29#include "loclass/ikeys.h"
3ad48540
MHS		 30#include "loclass/elite_crack.h"
31#include "loclass/fileutils.h"
1defcf60 32#include "protocols.h"
caaf9618 33#include "usb_cmd.h"
aa53efc3 34#include "cmdhfmfu.h"
35
36#define llX PRIx64
cee5a30d 37
38static int CmdHelp(const char *Cmd);
39
aa53efc3 40#define ICLASS_KEYS_MAX 8
41static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
49 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
50};
51
52typedef struct iclass_block {
53 uint8_t d[8];
54} iclass_block_t;
55
4d68ec02 56int xorbits_8(uint8_t val) {
53444513
MHS		 57 uint8_t res = val ^ (val >> 1); //1st pass
58 res = res ^ (res >> 1); // 2nd pass
59 res = res ^ (res >> 2); // 3rd pass
60 res = res ^ (res >> 4); // 4th pass
61 return res & 1;
17cba269
MHS		 62}
63
4d68ec02 64int CmdHFiClassList(const char *Cmd) {
4c3de57a 65 PrintAndLog("Deprecated command, use 'hf list iclass' instead");
17cba269
MHS		 66 return 0;
67}
68
4d68ec02 69int CmdHFiClassSnoop(const char *Cmd) {
53444513
MHS		 70 UsbCommand c = {CMD_SNOOP_ICLASS};
71 SendCommand(&c);
72 return 0;
cee5a30d 73}
4d68ec02 74
75int usage_hf_iclass_sim(void) {
41524d8a
MHS		 76 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
77 PrintAndLog(" options");
78 PrintAndLog(" 0 <CSN> simulate the given CSN");
79 PrintAndLog(" 1 simulate default CSN");
80 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
81 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
82 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
83 PrintAndLog(" example: hf iclass sim 2");
84 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
85 PrintAndLog(" hf iclass sim 3");
86 return 0;
87}
88
6116c796 89#define NUM_CSNS 15
4d68ec02 90int CmdHFiClassSim(const char *Cmd) {
53444513
MHS		 91 uint8_t simType = 0;
92 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
93
94 if (strlen(Cmd)<1) {
1defcf60 95 return usage_hf_iclass_sim();
53444513 96 }
1defcf60 97 simType = param_get8ex(Cmd, 0, 0, 10);
53444513
MHS		 98
99 if(simType == 0)
100 {
101 if (param_gethex(Cmd, 1, CSN, 16)) {
102 PrintAndLog("A CSN should consist of 16 HEX symbols");
41524d8a 103 return usage_hf_iclass_sim();
53444513 104 }
53444513 105
41524d8a 106 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
53444513 107 }
41524d8a 108 if(simType > 3)
53444513
MHS		 109 {
110 PrintAndLog("Undefined simptype %d", simType);
41524d8a 111 return usage_hf_iclass_sim();
53444513 112 }
1e262141 113
41524d8a 114 uint8_t numberOfCSNs=0;
9f6e9d15
MHS		 115 if(simType == 2)
116 {
6116c796 117 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
9f6e9d15 118 UsbCommand resp = {0};
17cba269 119
53444513
MHS		 120 uint8_t csns[8*NUM_CSNS] = {
121 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
6116c796
MHS		 136
137 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
9f6e9d15
MHS		 138
139 SendCommand(&c);
140 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
141 PrintAndLog("Command timed out");
142 return 0;
143 }
1e262141 144
77abe781 145 uint8_t num_mac_responses = resp.arg[1];
6116c796 146 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
9f6e9d15 147
6116c796 148 size_t datalen = NUM_CSNS*24;
9f6e9d15
MHS		 149 /*
150 * Now, time to dump to file. We'll use this format:
77abe781 151 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15 152 * So, it should wind up as
77abe781
MHS		 153 * 8 * 24 bytes.
154 *
155 * The returndata from the pm3 is on the following format
156 * <4 byte NR><4 byte MAC>
157 * CC are all zeroes, CSN is the same as was sent in
9f6e9d15 158 **/
77abe781
MHS		 159 void* dump = malloc(datalen);
160 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15 161 uint8_t i = 0;
6116c796 162 for(i = 0 ; i < NUM_CSNS ; i++)
9f6e9d15 163 {
77abe781
MHS		 164 memcpy(dump+i*24, csns+i*8,8); //CSN
165 //8 zero bytes here...
166 //Then comes NR_MAC (eight bytes from the response)
167 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
1e262141 168
9f6e9d15
MHS		 169 }
170 /** Now, save to dumpfile **/
77abe781
MHS		 171 saveFile("iclass_mac_attack", "bin", dump,datalen);
172 free(dump);
9f6e9d15
MHS		 173 }else
174 {
175 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
176 memcpy(c.d.asBytes, CSN, 8);
177 SendCommand(&c);
178 }
1e262141 179
53444513 180 return 0;
1e262141 181}
182
4d68ec02 183int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
6ce0e538 184 bool tagFound = false;
caaf9618
MHS		 185 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
186 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
aa53efc3 187 // loop in client not device - else on windows have a communication error
188 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
53444513
MHS		 189 UsbCommand resp;
190 while(!ukbhit()){
aa53efc3 191 SendCommand(&c);
6ce0e538 192 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
193 uint8_t readStatus = resp.arg[0] & 0xff;
194 uint8_t *data = resp.d.asBytes;
53444513 195
6ce0e538 196 if (verbose)
197 PrintAndLog("Readstatus:%02x", readStatus);
caaf9618 198 if( readStatus == 0){
53444513 199 //Aborted
6ce0e538 200 if (verbose) PrintAndLog("Quitting...");
53444513
MHS		 201 return 0;
202 }
6ce0e538 203 if( readStatus & FLAG_ICLASS_READER_CSN){
204 PrintAndLog("CSN: %s",sprint_hex(data,8));
205 tagFound = true;
206 }
caaf9618
MHS		 207 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
208 if( readStatus & FLAG_ICLASS_READER_CONF){
209 printIclassDumpInfo(data);
53444513 210 }
6ce0e538 211 if (tagFound && !loop) return 1;
53444513 212 } else {
6ce0e538 213 if (verbose) PrintAndLog("Command execute timeout");
53444513 214 }
6ce0e538 215 if (!loop) break;
53444513 216 }
53444513 217 return 0;
6ce0e538 218}
219
4d68ec02 220int CmdHFiClassReader(const char *Cmd) {
6ce0e538 221 return HFiClassReader(Cmd, true, true);
c3963755 222}
223
4d68ec02 224int CmdHFiClassReader_Replay(const char *Cmd) {
53444513
MHS		 225 uint8_t readerType = 0;
226 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
c3963755 227
53444513
MHS		 228 if (strlen(Cmd)<1) {
229 PrintAndLog("Usage: hf iclass replay <MAC>");
230 PrintAndLog(" sample: hf iclass replay 00112233");
231 return 0;
232 }
c3963755 233
53444513
MHS		 234 if (param_gethex(Cmd, 0, MAC, 8)) {
235 PrintAndLog("MAC must include 8 HEX symbols");
236 return 1;
237 }
c3963755 238
53444513
MHS		 239 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
240 memcpy(c.d.asBytes, MAC, 4);
241 SendCommand(&c);
1e262141 242
53444513 243 return 0;
1e262141 244}
245
4d68ec02 246int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
247 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
248 memcpy(c.d.asBytes, data, blocksCount * 16);
249 SendCommand(&c);
250 return 0;
251}
252
253int hf_iclass_eload_usage(void) {
7781a656
MHS		 254 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
255 PrintAndLog("Usage: hf iclass eload f <filename>");
256 PrintAndLog("");
257 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
258 return 0;
7781a656
MHS		 259}
260
4d68ec02 261int CmdHFiClassELoad(const char *Cmd) {
7781a656
MHS		 262
263 char opt = param_getchar(Cmd, 0);
264 if (strlen(Cmd)<1 || opt == 'h')
265 return hf_iclass_eload_usage();
266
267 //File handling and reading
268 FILE *f;
269 char filename[FILE_PATH_SIZE];
270 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
271 {
272 f = fopen(filename, "rb");
273 }else{
274 return hf_iclass_eload_usage();
275 }
276
277 if(!f) {
278 PrintAndLog("Failed to read from file '%s'", filename);
279 return 1;
280 }
281
282 fseek(f, 0, SEEK_END);
283 long fsize = ftell(f);
284 fseek(f, 0, SEEK_SET);
285
286 uint8_t *dump = malloc(fsize);
1defcf60
MHS		 287
288
7781a656
MHS		 289 size_t bytes_read = fread(dump, 1, fsize, f);
290 fclose(f);
291
1defcf60 292 printIclassDumpInfo(dump);
7781a656
MHS		 293 //Validate
294
295 if (bytes_read < fsize)
296 {
297 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
298 free(dump);
299 return 1;
300 }
301 //Send to device
302 uint32_t bytes_sent = 0;
303 uint32_t bytes_remaining = bytes_read;
304
305 while(bytes_remaining > 0){
306 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
307 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
308 memcpy(c.d.asBytes, dump, bytes_in_packet);
309 SendCommand(&c);
310 bytes_remaining -= bytes_in_packet;
311 bytes_sent += bytes_in_packet;
312 }
313 free(dump);
314 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
315 return 0;
316}
317
4d68ec02 318static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
41524d8a
MHS		 319 FILE *f = fopen(filename, "rb");
320 if(!f) {
321 PrintAndLog("Failed to read from file '%s'", filename);
322 return 1;
323 }
324 fseek(f, 0, SEEK_END);
325 long fsize = ftell(f);
326 fseek(f, 0, SEEK_SET);
327 size_t bytes_read = fread(buffer, 1, len, f);
328 fclose(f);
329 if(fsize != len)
330 {
331 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
332 return 1;
333 }
334 if(bytes_read != len)
335 {
336 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
337 return 1;
338 }
339 return 0;
340}
341
4d68ec02 342int usage_hf_iclass_decrypt(void) {
343 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
aa53efc3 344 PrintAndLog("");
345 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
346 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
347 PrintAndLog("");
348 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
349 PrintAndLog("");
350 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
351 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
352 PrintAndLog("which is defined by the configuration block.");
353 return 1;
354}
355
4d68ec02 356int CmdHFiClassDecrypt(const char *Cmd) {
41524d8a
MHS		 357 uint8_t key[16] = { 0 };
358 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
359 {
360 usage_hf_iclass_decrypt();
361 return 1;
362 }
363 PrintAndLog("Decryption file found... ");
364 char opt = param_getchar(Cmd, 0);
365 if (strlen(Cmd)<1 || opt == 'h')
366 return usage_hf_iclass_decrypt();
367
368 //Open the tagdump-file
369 FILE *f;
370 char filename[FILE_PATH_SIZE];
371 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
372 {
373 f = fopen(filename, "rb");
374 }else{
375 return usage_hf_iclass_decrypt();
376 }
377
378 fseek(f, 0, SEEK_END);
379 long fsize = ftell(f);
380 fseek(f, 0, SEEK_SET);
381 uint8_t enc_dump[8] = {0};
382 uint8_t *decrypted = malloc(fsize);
383 des3_context ctx = { DES_DECRYPT ,{ 0 } };
384 des3_set2key_dec( &ctx, key);
385 size_t bytes_read = fread(enc_dump, 1, 8, f);
386
387 //Use the first block (CSN) for filename
388 char outfilename[FILE_PATH_SIZE] = { 0 };
389 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
390 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
391 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
392
393 size_t blocknum =0;
394 while(bytes_read == 8)
395 {
9a9bcea8 396 if(blocknum < 7)
41524d8a
MHS		 397 {
398 memcpy(decrypted+(blocknum*8), enc_dump, 8);
399 }else{
400 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
401 }
402 printvar("decrypted block", decrypted +(blocknum*8), 8);
403 bytes_read = fread(enc_dump, 1, 8, f);
404 blocknum++;
405 }
406 fclose(f);
407
408 saveFile(outfilename,"bin", decrypted, blocknum*8);
c4c3af7c 409 free(decrypted);
41524d8a
MHS		 410 return 0;
411}
7781a656 412
4d68ec02 413int usage_hf_iclass_encrypt(void) {
aa53efc3 414 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
415 PrintAndLog("");
416 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
417 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
418 PrintAndLog("");
419 PrintAndLog("example: hf iclass encrypt 0102030405060708");
420 PrintAndLog("");
421 return 0;
422}
423
4d68ec02 424static int iClassEncryptBlkData(uint8_t *blkData) {
aa53efc3 425 uint8_t key[16] = { 0 };
426 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
427 {
428 usage_hf_iclass_encrypt();
429 return 1;
430 }
431 PrintAndLog("Decryption file found... ");
53444513 432
4d68ec02 433 uint8_t encryptedData[16];
434 uint8_t *encrypted = encryptedData;
aa53efc3 435 des3_context ctx = { DES_DECRYPT ,{ 0 } };
436 des3_set2key_enc( &ctx, key);
437
4d68ec02 438 des3_crypt_ecb(&ctx, blkData,encrypted);
aa53efc3 439 //printvar("decrypted block", decrypted, 8);
4d68ec02 440 memcpy(blkData,encrypted,8);
aa53efc3 441
442 return 1;
443}
444
4d68ec02 445int CmdHFiClassEncryptBlk(const char *Cmd) {
aa53efc3 446 uint8_t blkData[8] = {0};
447 char opt = param_getchar(Cmd, 0);
448 if (strlen(Cmd)<1 || opt == 'h')
449 return usage_hf_iclass_encrypt();
53444513 450
aa53efc3 451 //get the bytes to encrypt
452 if (param_gethex(Cmd, 0, blkData, 16))
53444513 453 {
aa53efc3 454 PrintAndLog("BlockData must include 16 HEX symbols");
53444513
MHS		 455 return 0;
456 }
aa53efc3 457 if (!iClassEncryptBlkData(blkData)) return 0;
53444513 458
aa53efc3 459 printvar("encrypted block", blkData, 8);
460 return 1;
461}
53444513 462
4d68ec02 463void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
aa53efc3 464 uint8_t WB[9];
465 WB[0] = blockno;
466 memcpy(WB + 1,data,8);
467 doMAC_N(WB,sizeof(WB),div_key,MAC);
468 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
469}
53444513 470
4d68ec02 471static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
53444513
MHS		 472 UsbCommand resp;
473
aa53efc3 474 UsbCommand c = {CMD_READER_ICLASS, {0}};
3ac22ee1 475 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
aa53efc3 476 if (use_credit_key)
477 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
53444513 478
aa53efc3 479 clearCommandBuffer();
480 SendCommand(&c);
481 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
482 {
53444513 483 PrintAndLog("Command execute timeout");
aa53efc3 484 return false;
53444513
MHS		 485 }
486
aa53efc3 487 uint8_t isOK = resp.arg[0] & 0xff;
488 uint8_t *data = resp.d.asBytes;
53444513 489
aa53efc3 490 memcpy(CSN,data,8);
491 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
aa53efc3 492 if(isOK > 0)
493 {
494 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
53444513 495 }
aa53efc3 496 if(isOK <= 1){
497 PrintAndLog("Failed to obtain CC! Aborting");
498 return false;
499 }
500 return true;
a66fca86 501}
6f101995 502
bc37cfb3 503static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
aa53efc3 504 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
505 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
aa53efc3 506
507 if (!select_only(CSN, CCNR, use_credit_key, verbose))
508 return false;
509
4d68ec02 510 //get div_key
bc37cfb3
AL		 511 if(rawkey)
512 memcpy(div_key, KEY, 8);
513 else
514 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
515 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
4d68ec02 516
aa53efc3 517 doMAC(CCNR, div_key, MAC);
aa53efc3 518 UsbCommand resp;
519 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
520 memcpy(d.d.asBytes, MAC, 4);
521 clearCommandBuffer();
522 SendCommand(&d);
523 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
524 {
525 PrintAndLog("Auth Command execute timeout");
526 return false;
527 }
528 uint8_t isOK = resp.arg[0] & 0xff;
529 if (!isOK) {
530 PrintAndLog("Authentication error");
531 return false;
532 }
533 return true;
534}
535
4d68ec02 536int usage_hf_iclass_dump(void) {
bc37cfb3 537 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
aa53efc3 538 PrintAndLog("Options:");
539 PrintAndLog(" f <filename> : specify a filename to save dump to");
540 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
541 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
542 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
543 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
544 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
bc37cfb3 545 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
aa53efc3 546 PrintAndLog(" NOTE: * = required");
547 PrintAndLog("Samples:");
548 PrintAndLog(" hf iclass dump k 001122334455667B");
549 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
550 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
551 return 0;
552}
553
4d68ec02 554int CmdHFiClassReader_Dump(const char *Cmd) {
aa53efc3 555
556 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
557 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
558 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
559 uint8_t blockno = 0;
560 uint8_t numblks = 0;
4d68ec02 561 uint8_t maxBlk = 31;
bbd19bec 562 uint8_t app_areas = 1;
b82d8098 563 uint8_t kb = 2;
aa53efc3 564 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
565 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
566 uint8_t keyNbr = 0;
567 uint8_t dataLen = 0;
568 uint8_t fileNameLen = 0;
569 char filename[FILE_PATH_SIZE]={0};
570 char tempStr[50] = {0};
4d68ec02 571 bool have_debit_key = false;
aa53efc3 572 bool have_credit_key = false;
4d68ec02 573 bool use_credit_key = false;
aa53efc3 574 bool elite = false;
bc37cfb3 575 bool rawkey = false;
aa53efc3 576 bool errors = false;
577 uint8_t cmdp = 0;
578
579 while(param_getchar(Cmd, cmdp) != 0x00)
580 {
581 switch(param_getchar(Cmd, cmdp))
582 {
583 case 'h':
584 case 'H':
585 return usage_hf_iclass_dump();
586 case 'c':
587 case 'C':
588 have_credit_key = true;
589 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
590 if (dataLen == 16) {
591 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
592 } else if (dataLen == 1) {
593 keyNbr = param_get8(Cmd, cmdp+1);
594 if (keyNbr <= ICLASS_KEYS_MAX) {
595 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
596 } else {
597 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
598 errors = true;
599 }
600 } else {
601 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
602 errors = true;
603 }
604 cmdp += 2;
605 break;
606 case 'e':
607 case 'E':
608 elite = true;
609 cmdp++;
610 break;
611 case 'f':
612 case 'F':
613 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
614 if (fileNameLen < 1) {
615 PrintAndLog("No filename found after f");
616 errors = true;
617 }
618 cmdp += 2;
619 break;
620 case 'k':
621 case 'K':
4d68ec02 622 have_debit_key = true;
aa53efc3 623 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
624 if (dataLen == 16) {
625 errors = param_gethex(tempStr, 0, KEY, dataLen);
626 } else if (dataLen == 1) {
627 keyNbr = param_get8(Cmd, cmdp+1);
628 if (keyNbr <= ICLASS_KEYS_MAX) {
629 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
630 } else {
631 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
632 errors = true;
633 }
634 } else {
635 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
636 errors = true;
637 }
638 cmdp += 2;
639 break;
bc37cfb3
AL		 640 case 'r':
641 case 'R':
642 rawkey = true;
643 cmdp++;
644 break;
aa53efc3 645 default:
646 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
647 errors = true;
648 break;
649 }
650 if(errors) return usage_hf_iclass_dump();
651 }
652
653 if (cmdp < 2) return usage_hf_iclass_dump();
4d68ec02 654 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
655 if (!have_debit_key && have_credit_key) use_credit_key = true;
aa53efc3 656
657 //get config and first 3 blocks
658 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
659 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
660 UsbCommand resp;
661 uint8_t tag_data[255*8];
4d68ec02 662
aa53efc3 663 clearCommandBuffer();
664 SendCommand(&c);
4d68ec02 665 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
aa53efc3 666 PrintAndLog("Command execute timeout");
3ac22ee1 667 ul_switch_off_field();
aa53efc3 668 return 0;
669 }
4d68ec02 670 uint8_t readStatus = resp.arg[0] & 0xff;
671 uint8_t *data = resp.d.asBytes;
672
673 if(readStatus == 0){
674 PrintAndLog("No tag found...");
3ac22ee1 675 ul_switch_off_field();
4d68ec02 676 return 0;
677 }
678 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
679 memcpy(tag_data, data, 8*3);
680 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
681 numblks = data[8];
bbd19bec 682 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
b82d8098 683 // large memory - not able to dump pages currently
4d68ec02 684 if (numblks > maxBlk) numblks = maxBlk;
685 }
3ac22ee1 686 ul_switch_off_field();
4d68ec02 687 // authenticate debit key and get div_key - later store in dump block 3
bc37cfb3 688 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
aa53efc3 689 //try twice - for some reason it sometimes fails the first time...
bc37cfb3 690 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
aa53efc3 691 ul_switch_off_field();
692 return 0;
693 }
694 }
aa53efc3 695
4d68ec02 696 // begin dump
3ac22ee1 697 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
aa53efc3 698 clearCommandBuffer();
699 SendCommand(&w);
700 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
701 PrintAndLog("Command execute time-out 1");
3ac22ee1 702 ul_switch_off_field();
aa53efc3 703 return 1;
704 }
705 uint32_t blocksRead = resp.arg[1];
706 uint8_t isOK = resp.arg[0] & 0xff;
707 if (!isOK && !blocksRead) {
708 PrintAndLog("Read Block Failed");
3ac22ee1 709 ul_switch_off_field();
aa53efc3 710 return 0;
711 }
712 uint32_t startindex = resp.arg[2];
713 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
714 PrintAndLog("Data exceeded Buffer size!");
715 blocksRead = (sizeof(tag_data)/8) - blockno;
716 }
4d68ec02 717 // response ok - now get bigbuf content of the dump
aa53efc3 718 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
719 WaitForResponse(CMD_ACK,NULL);
4d68ec02 720 size_t gotBytes = blocksRead*8 + blockno*8;
aa53efc3 721
4d68ec02 722 // try AA2
723 if (have_credit_key) {
724 //turn off hf field before authenticating with different key
aa53efc3 725 ul_switch_off_field();
aa53efc3 726 memset(MAC,0,4);
4d68ec02 727 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
bc37cfb3 728 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
aa53efc3 729 //try twice - for some reason it sometimes fails the first time...
bc37cfb3 730 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
aa53efc3 731 ul_switch_off_field();
732 return 0;
733 }
734 }
4d68ec02 735 // do we still need to read more block? (aa2 enabled?)
736 if (maxBlk > blockno+numblks+1) {
737 // setup dump and start
738 w.arg[0] = blockno + blocksRead;
739 w.arg[1] = maxBlk - (blockno + blocksRead);
4d68ec02 740 clearCommandBuffer();
741 SendCommand(&w);
742 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
743 PrintAndLog("Command execute timeout 2");
3ac22ee1 744 ul_switch_off_field();
4d68ec02 745 return 0;
746 }
747 uint8_t isOK = resp.arg[0] & 0xff;
748 blocksRead = resp.arg[1];
749 if (!isOK && !blocksRead) {
750 PrintAndLog("Read Block Failed 2");
3ac22ee1 751 ul_switch_off_field();
4d68ec02 752 return 0;
753 }
aa53efc3 754
4d68ec02 755 startindex = resp.arg[2];
756 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
757 PrintAndLog("Data exceeded Buffer size!");
758 blocksRead = (sizeof(tag_data) - gotBytes)/8;
759 }
760 // get dumped data from bigbuf
761 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
762 WaitForResponse(CMD_ACK,NULL);
aa53efc3 763
4d68ec02 764 gotBytes += blocksRead*8;
765 } else { //field is still on - turn it off...
766 ul_switch_off_field();
767 }
aa53efc3 768 }
769
4d68ec02 770 // add diversified keys to dump
771 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
772 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
773 // print the dump
774 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
775 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
776 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
aa53efc3 777
aa53efc3 778 if (filename[0] == 0){
779 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
780 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
781 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
782 }
4d68ec02 783
784 // save the dump to .bin file
aa53efc3 785 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
4d68ec02 786 saveFile(filename, "bin", tag_data, gotBytes);
aa53efc3 787 return 1;
788}
789
bc37cfb3 790static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
aa53efc3 791 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
792 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
bc37cfb3 793 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
aa53efc3 794 return 0;
795
796 UsbCommand resp;
797
798 Calc_wb_mac(blockno,bldata,div_key,MAC);
3ac22ee1 799 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
aa53efc3 800 memcpy(w.d.asBytes, bldata, 8);
3ac22ee1 801 memcpy(w.d.asBytes + 8, MAC, 4);
aa53efc3 802
803 clearCommandBuffer();
804 SendCommand(&w);
805 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
806 {
807 PrintAndLog("Write Command execute timeout");
808 return 0;
809 }
810 uint8_t isOK = resp.arg[0] & 0xff;
811 if (!isOK) {
812 PrintAndLog("Write Block Failed");
813 return 0;
814 }
815 PrintAndLog("Write Block Successful");
aa53efc3 816 return 1;
817}
818
4d68ec02 819int usage_hf_iclass_writeblock(void) {
aa53efc3 820 PrintAndLog("Options:");
821 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
822 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
823 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
824 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
825 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
bc37cfb3 826 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
aa53efc3 827 PrintAndLog("Samples:");
828 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
829 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
830 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
831 return 0;
832}
833
834int CmdHFiClass_WriteBlock(const char *Cmd) {
835 uint8_t blockno=0;
3ac22ee1 836 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
aa53efc3 837 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
838 uint8_t keyNbr = 0;
839 uint8_t dataLen = 0;
840 char tempStr[50] = {0};
841 bool use_credit_key = false;
842 bool elite = false;
bc37cfb3 843 bool rawkey= false;
aa53efc3 844 bool errors = false;
845 uint8_t cmdp = 0;
846 while(param_getchar(Cmd, cmdp) != 0x00)
847 {
848 switch(param_getchar(Cmd, cmdp))
849 {
850 case 'h':
851 case 'H':
852 return usage_hf_iclass_writeblock();
853 case 'b':
854 case 'B':
855 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
856 PrintAndLog("Block No must include 2 HEX symbols\n");
857 errors = true;
858 }
859 cmdp += 2;
860 break;
861 case 'c':
862 case 'C':
863 use_credit_key = true;
864 cmdp++;
865 break;
866 case 'd':
867 case 'D':
868 if (param_gethex(Cmd, cmdp+1, bldata, 16))
869 {
870 PrintAndLog("KEY must include 16 HEX symbols\n");
871 errors = true;
872 }
873 cmdp += 2;
874 break;
875 case 'e':
876 case 'E':
877 elite = true;
878 cmdp++;
879 break;
880 case 'k':
881 case 'K':
882 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
883 if (dataLen == 16) {
884 errors = param_gethex(tempStr, 0, KEY, dataLen);
885 } else if (dataLen == 1) {
886 keyNbr = param_get8(Cmd, cmdp+1);
887 if (keyNbr <= ICLASS_KEYS_MAX) {
888 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
889 } else {
890 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
891 errors = true;
892 }
893 } else {
894 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
895 errors = true;
896 }
897 cmdp += 2;
898 break;
bc37cfb3
AL		 899 case 'r':
900 case 'R':
901 rawkey = true;
902 cmdp++;
903 break;
aa53efc3 904 default:
905 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
906 errors = true;
907 break;
908 }
909 if(errors) return usage_hf_iclass_writeblock();
910 }
911
912 if (cmdp < 6) return usage_hf_iclass_writeblock();
bc37cfb3 913 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
3ac22ee1 914 ul_switch_off_field();
915 return ans;
aa53efc3 916}
917
4d68ec02 918int usage_hf_iclass_clone(void) {
bc37cfb3 919 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
aa53efc3 920 PrintAndLog("Options:");
921 PrintAndLog(" f <filename>: specify a filename to clone from");
922 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
923 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
924 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
925 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
926 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
bc37cfb3 927 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
aa53efc3 928 PrintAndLog("Samples:");
929 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
930 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
931 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
932 return -1;
933}
934
935int CmdHFiClassCloneTag(const char *Cmd) {
936 char filename[FILE_PATH_SIZE];
937 char tempStr[50]={0};
938 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
939 uint8_t keyNbr = 0;
940 uint8_t fileNameLen = 0;
941 uint8_t startblock = 0;
942 uint8_t endblock = 0;
943 uint8_t dataLen = 0;
944 bool use_credit_key = false;
945 bool elite = false;
bc37cfb3 946 bool rawkey = false;
aa53efc3 947 bool errors = false;
948 uint8_t cmdp = 0;
949 while(param_getchar(Cmd, cmdp) != 0x00)
950 {
951 switch(param_getchar(Cmd, cmdp))
952 {
953 case 'h':
954 case 'H':
955 return usage_hf_iclass_clone();
956 case 'b':
957 case 'B':
958 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
959 PrintAndLog("Start Block No must include 2 HEX symbols\n");
960 errors = true;
961 }
962 cmdp += 2;
963 break;
964 case 'c':
965 case 'C':
966 use_credit_key = true;
967 cmdp++;
968 break;
969 case 'e':
970 case 'E':
971 elite = true;
972 cmdp++;
973 break;
974 case 'f':
975 case 'F':
976 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
977 if (fileNameLen < 1) {
978 PrintAndLog("No filename found after f");
979 errors = true;
980 }
981 cmdp += 2;
982 break;
983 case 'k':
984 case 'K':
985 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
986 if (dataLen == 16) {
987 errors = param_gethex(tempStr, 0, KEY, dataLen);
988 } else if (dataLen == 1) {
989 keyNbr = param_get8(Cmd, cmdp+1);
990 if (keyNbr <= ICLASS_KEYS_MAX) {
991 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
992 } else {
993 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
994 errors = true;
995 }
996 } else {
997 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
998 errors = true;
999 }
1000 cmdp += 2;
1001 break;
1002 case 'l':
1003 case 'L':
1004 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1005 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1006 errors = true;
1007 }
1008 cmdp += 2;
1009 break;
bc37cfb3
AL		 1010 case 'r':
1011 case 'R':
1012 rawkey = true;
1013 cmdp++;
1014 break;
aa53efc3 1015 default:
1016 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1017 errors = true;
1018 break;
1019 }
1020 if(errors) return usage_hf_iclass_clone();
1021 }
1022
1023 if (cmdp < 8) return usage_hf_iclass_clone();
1024
1025 FILE *f;
1026
1027 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1028
1029 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1030 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1031 }
1032 // file handling and reading
1033 f = fopen(filename,"rb");
1034 if(!f) {
1035 PrintAndLog("Failed to read from file '%s'", filename);
1036 return 1;
1037 }
1038
1039 if (startblock<5) {
1040 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1041 return 0;
1042 }
1043 // now read data from the file from block 6 --- 19
1044 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1045 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1046 // else we have to create a share memory
1047 int i;
1048 fseek(f,startblock*8,SEEK_SET);
33c795d0 1049 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0 ) {
1050 PrintAndLog("File reading error.");
1051 fclose(f);
1052 return 2;
1053 }
aa53efc3 1054
1055 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1056 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1057
bc37cfb3 1058 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
aa53efc3 1059 return 0;
1060
3ac22ee1 1061 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
aa53efc3 1062 uint8_t *ptr;
1063 // calculate all mac for every the block we will write
1064 for (i = startblock; i <= endblock; i++){
1065 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1066 // usb command d start pointer = d + (i - 6) * 12
1067 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1068 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1069 // next one
1070 ptr = w.d.asBytes + (i - startblock) * 12;
1071 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1072 memcpy(ptr + 8,MAC, 4);
1073 }
1074 uint8_t p[12];
1075 for (i = 0; i <= endblock - startblock;i++){
1076 memcpy(p,w.d.asBytes + (i * 12),12);
4d68ec02 1077 printf("Block |%02x|",i + startblock);
1078 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1079 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
aa53efc3 1080 }
1081 UsbCommand resp;
1082 SendCommand(&w);
1083 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1084 {
1085 PrintAndLog("Command execute timeout");
1086 return 0;
1087 }
1088 return 1;
1089}
1090
bc37cfb3 1091static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose) {
aa53efc3 1092 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1093 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1094
bc37cfb3 1095 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
aa53efc3 1096 return 0;
1097
1098 UsbCommand resp;
3ac22ee1 1099 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
aa53efc3 1100 clearCommandBuffer();
1101 SendCommand(&w);
1102 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1103 {
1104 PrintAndLog("Command execute timeout");
1105 return 0;
1106 }
1107 uint8_t isOK = resp.arg[0] & 0xff;
1108 if (!isOK) {
1109 PrintAndLog("Read Block Failed");
1110 return 0;
1111 }
1112 //data read is stored in: resp.d.asBytes[0-15]
1113 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1114 return 1;
1115}
1116
4d68ec02 1117int usage_hf_iclass_readblock(void) {
bc37cfb3 1118 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
aa53efc3 1119 PrintAndLog("Options:");
1120 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1121 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1122 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1123 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
bc37cfb3 1124 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
aa53efc3 1125 PrintAndLog("Samples:");
1126 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1127 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1128 PrintAndLog(" hf iclass readblk b 0A k 0");
1129 return 0;
1130}
1131
4d68ec02 1132int CmdHFiClass_ReadBlock(const char *Cmd) {
aa53efc3 1133 uint8_t blockno=0;
1134 uint8_t keyType = 0x88; //debit key
1135 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1136 uint8_t keyNbr = 0;
1137 uint8_t dataLen = 0;
1138 char tempStr[50] = {0};
1139 bool elite = false;
bc37cfb3 1140 bool rawkey = false;
aa53efc3 1141 bool errors = false;
1142 uint8_t cmdp = 0;
1143 while(param_getchar(Cmd, cmdp) != 0x00)
1144 {
1145 switch(param_getchar(Cmd, cmdp))
1146 {
1147 case 'h':
1148 case 'H':
1149 return usage_hf_iclass_readblock();
1150 case 'b':
1151 case 'B':
1152 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1153 PrintAndLog("Block No must include 2 HEX symbols\n");
1154 errors = true;
1155 }
1156 cmdp += 2;
1157 break;
1158 case 'c':
1159 case 'C':
1160 keyType = 0x18;
1161 cmdp++;
1162 break;
1163 case 'e':
1164 case 'E':
1165 elite = true;
1166 cmdp++;
1167 break;
1168 case 'k':
1169 case 'K':
1170 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1171 if (dataLen == 16) {
1172 errors = param_gethex(tempStr, 0, KEY, dataLen);
1173 } else if (dataLen == 1) {
1174 keyNbr = param_get8(Cmd, cmdp+1);
1175 if (keyNbr <= ICLASS_KEYS_MAX) {
1176 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1177 } else {
1178 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1179 errors = true;
1180 }
1181 } else {
1182 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1183 errors = true;
1184 }
1185 cmdp += 2;
1186 break;
bc37cfb3
AL		 1187 case 'r':
1188 case 'R':
1189 rawkey = true;
1190 cmdp++;
1191 break;
aa53efc3 1192 default:
1193 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1194 errors = true;
1195 break;
1196 }
1197 if(errors) return usage_hf_iclass_readblock();
1198 }
1199
1200 if (cmdp < 4) return usage_hf_iclass_readblock();
4d68ec02 1201
bc37cfb3 1202 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true);
aa53efc3 1203}
1204
4d68ec02 1205int CmdHFiClass_loclass(const char *Cmd) {
aa53efc3 1206 char opt = param_getchar(Cmd, 0);
1207
1208 if (strlen(Cmd)<1 || opt == 'h') {
1209 PrintAndLog("Usage: hf iclass loclass [options]");
1210 PrintAndLog("Options:");
1211 PrintAndLog("h Show this help");
6f101995
MHS		 1212 PrintAndLog("t Perform self-test");
1213 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1214 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1215 PrintAndLog(" malicious CSNs, and their protocol responses");
1216 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1217 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1218 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1219 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1220 PrintAndLog(" ... totalling N*24 bytes");
1221 return 0;
1222 }
1223 char fileName[255] = {0};
1224 if(opt == 'f')
1225 {
53444513
MHS		 1226 if(param_getstr(Cmd, 1, fileName) > 0)
1227 {
1228 return bruteforceFileNoKeys(fileName);
1229 }else
1230 {
1231 PrintAndLog("You must specify a filename");
1232 }
6f101995
MHS		 1233 }
1234 else if(opt == 't')
1235 {
1236 int errors = testCipherUtils();
1237 errors += testMAC();
1238 errors += doKeyTests(0);
1239 errors += testElite();
1240 if(errors)
1241 {
1242 prnlog("OBS! There were errors!!!");
1243 }
1244 return errors;
1245 }
a66fca86 1246
6f101995
MHS		 1247 return 0;
1248}
c3963755 1249
4d68ec02 1250void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
aa53efc3 1251 uint8_t blockdata[8];
1252 uint8_t mem_config;
1253 memcpy(&mem_config, iclass_dump + 13,1);
1254 uint8_t maxmemcount;
1255 uint8_t filemaxblock = filesize / 8;
4d68ec02 1256 if (mem_config & 0x80)
aa53efc3 1257 maxmemcount = 255;
1258 else
4d68ec02 1259 maxmemcount = 31;
1260 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
aa53efc3 1261
1262 if (startblock == 0)
1263 startblock = 6;
1264 if ((endblock > maxmemcount) || (endblock == 0))
1265 endblock = maxmemcount;
1266 if (endblock > filemaxblock)
1267 endblock = filemaxblock;
1268 int i = startblock;
1269 int j;
4d68ec02 1270 while (i <= endblock){
1271 printf("Block |%02X| ",i);
aa53efc3 1272 memcpy(blockdata,iclass_dump + (i * 8),8);
1273 for (j = 0;j < 8;j++)
1274 printf("%02X ",blockdata[j]);
4d68ec02 1275 printf("|\n");
aa53efc3 1276 i++;
1277 }
aa53efc3 1278}
1279
4d68ec02 1280int usage_hf_iclass_readtagfile() {
1281 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1282 return 1;
1283}
1284
1285int CmdHFiClassReadTagFile(const char *Cmd) {
aa53efc3 1286 int startblock = 0;
1287 int endblock = 0;
1288 char tempnum[5];
1289 FILE *f;
1290 char filename[FILE_PATH_SIZE];
1291 if (param_getstr(Cmd, 0, filename) < 1)
1292 return usage_hf_iclass_readtagfile();
1293 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1294 startblock = 0;
1295 else
1296 sscanf(tempnum,"%d",&startblock);
1297
1298 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1299 endblock = 0;
1300 else
1301 sscanf(tempnum,"%d",&endblock);
1302 // file handling and reading
1303 f = fopen(filename,"rb");
1304 if(!f) {
1305 PrintAndLog("Failed to read from file '%s'", filename);
1306 return 1;
1307 }
1308 fseek(f, 0, SEEK_END);
1309 long fsize = ftell(f);
1310 fseek(f, 0, SEEK_SET);
1311
1312 uint8_t *dump = malloc(fsize);
1313
1314
1315 size_t bytes_read = fread(dump, 1, fsize, f);
1316 fclose(f);
1317 uint8_t *csn = dump;
4d68ec02 1318 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
aa53efc3 1319 // printIclassDumpInfo(dump);
1320 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1321 free(dump);
1322 return 0;
1323}
1324
4d68ec02 1325/*
1326uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
aa53efc3 1327 uint64_t new_div = 0x00;
1328 new_div ^= sdiv;
1329 new_div ^= hdiv;
1330 return new_div;
1331}
1332
4d68ec02 1333uint64_t hexarray_to_uint64(uint8_t *key) {
aa53efc3 1334 char temp[17];
1335 uint64_t uint_key;
1336 for (int i = 0;i < 8;i++)
1337 sprintf(&temp[(i *2)],"%02X",key[i]);
1338 temp[16] = '\0';
1339 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1340 return 0;
1341 return uint_key;
1342}
4d68ec02 1343*/
1344void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
aa53efc3 1345 uint8_t keytable[128] = {0};
1346 uint8_t key_index[8] = {0};
4d68ec02 1347 if (elite) {
1348 uint8_t key_sel[8] = { 0 };
1349 uint8_t key_sel_p[8] = { 0 };
1350 hash2(KEY, keytable);
1351 hash1(CSN, key_index);
1352 for(uint8_t i = 0; i < 8 ; i++)
1353 key_sel[i] = keytable[key_index[i]] & 0xFF;
aa53efc3 1354
4d68ec02 1355 //Permute from iclass format to standard format
1356 permutekey_rev(key_sel, key_sel_p);
1357 diversifyKey(CSN, key_sel_p, div_key);
1358 } else {
1359 diversifyKey(CSN, KEY, div_key);
1360 }
1361}
aa53efc3 1362
4d68ec02 1363//when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1364//calculate and return xor_div_key (ready for a key write command)
1365//print all div_keys if verbose
1366static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1367 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1368 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1369 //get old div key
1370 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1371 //get new div key
1372 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1373
1374 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1375 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1376 }
1377 if (verbose) {
1378 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1379 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1380 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1381 }
1382}
aa53efc3 1383
4d68ec02 1384int usage_hf_iclass_calc_newkey(void) {
1385 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1386 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1387 PrintAndLog(" Options:");
1388 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1389 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1390 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1391 PrintAndLog(" e : specify new key as elite calc");
1392 PrintAndLog(" ee : specify old and new key as elite calc");
1393 PrintAndLog("Samples:");
1394 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1395 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1396 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1397 PrintAndLog("NOTE: * = required\n");
aa53efc3 1398
4d68ec02 1399 return 1;
1400}
aa53efc3 1401
4d68ec02 1402int CmdHFiClassCalcNewKey(const char *Cmd) {
1403 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1404 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1405 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1406 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1407 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1408 uint8_t keyNbr = 0;
1409 uint8_t dataLen = 0;
1410 char tempStr[50] = {0};
1411 bool givenCSN = false;
1412 bool oldElite = false;
1413 bool elite = false;
1414 bool errors = false;
1415 uint8_t cmdp = 0;
1416 while(param_getchar(Cmd, cmdp) != 0x00)
1417 {
1418 switch(param_getchar(Cmd, cmdp))
1419 {
1420 case 'h':
1421 case 'H':
1422 return usage_hf_iclass_calc_newkey();
1423 case 'e':
1424 case 'E':
1425 dataLen = param_getstr(Cmd, cmdp, tempStr);
1426 if (dataLen==2)
1427 oldElite = true;
1428 elite = true;
1429 cmdp++;
1430 break;
1431 case 'n':
1432 case 'N':
1433 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1434 if (dataLen == 16) {
1435 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1436 } else if (dataLen == 1) {
1437 keyNbr = param_get8(Cmd, cmdp+1);
1438 if (keyNbr <= ICLASS_KEYS_MAX) {
1439 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1440 } else {
1441 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1442 errors = true;
1443 }
1444 } else {
1445 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1446 errors = true;
1447 }
1448 cmdp += 2;
1449 break;
1450 case 'o':
1451 case 'O':
1452 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1453 if (dataLen == 16) {
1454 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1455 } else if (dataLen == 1) {
1456 keyNbr = param_get8(Cmd, cmdp+1);
1457 if (keyNbr <= ICLASS_KEYS_MAX) {
1458 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1459 } else {
1460 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1461 errors = true;
1462 }
1463 } else {
1464 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1465 errors = true;
1466 }
1467 cmdp += 2;
1468 break;
1469 case 's':
1470 case 'S':
1471 givenCSN = true;
1472 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1473 return usage_hf_iclass_calc_newkey();
1474 cmdp += 2;
1475 break;
1476 default:
1477 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1478 errors = true;
1479 break;
1480 }
1481 if(errors) return usage_hf_iclass_calc_newkey();
1482 }
aa53efc3 1483
4d68ec02 1484 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
aa53efc3 1485
4d68ec02 1486 if (!givenCSN)
1487 if (!select_only(CSN, CCNR, false, true))
1488 return 0;
1489
1490 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
aa53efc3 1491 return 0;
1492}
1493
4d68ec02 1494static int loadKeys(char *filename) {
aa53efc3 1495 FILE *f;
1496 f = fopen(filename,"rb");
1497 if(!f) {
1498 PrintAndLog("Failed to read from file '%s'", filename);
1499 return 0;
1500 }
1501 fseek(f, 0, SEEK_END);
1502 long fsize = ftell(f);
1503 fseek(f, 0, SEEK_SET);
1504
1505 uint8_t *dump = malloc(fsize);
1506
1507 size_t bytes_read = fread(dump, 1, fsize, f);
1508 fclose(f);
1509 if (bytes_read > ICLASS_KEYS_MAX * 8){
1510 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1511 free(dump);
1512 return 0;
1513 }
1514 uint8_t i = 0;
1515 for (; i < bytes_read/8; i++){
1516 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1517 }
1518 free(dump);
1519 PrintAndLog("%u keys loaded", i);
1520 return 1;
1521}
1522
4d68ec02 1523static int saveKeys(char *filename) {
aa53efc3 1524 FILE *f;
1525 f = fopen(filename,"wb");
1526 if (f == NULL) {
1527 printf("error opening file %s\n",filename);
1528 return 0;
1529 }
1530 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1531 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1532 PrintAndLog("save key failed to write to file: %s", filename);
1533 break;
1534 }
1535 }
1536 fclose(f);
1537 return 0;
1538}
1539
4d68ec02 1540static int printKeys(void) {
aa53efc3 1541 PrintAndLog("");
1542 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1543 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1544 }
1545 PrintAndLog("");
1546 return 0;
1547}
1548
4d68ec02 1549int usage_hf_iclass_managekeys(void) {
aa53efc3 1550 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1551 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1552 PrintAndLog(" Options:");
1553 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1554 PrintAndLog(" k <key> : set a key in memory");
1555 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1556 PrintAndLog(" s : save keys in memory to file specified by filename");
1557 PrintAndLog(" l : load keys to memory from file specified by filename");
1558 PrintAndLog(" p : print keys loaded into memory\n");
1559 PrintAndLog("Samples:");
1560 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1561 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1562 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1563 PrintAndLog(" print keys : hf iclass managekeys p\n");
1564 return 0;
1565}
1566
4d68ec02 1567int CmdHFiClassManageKeys(const char *Cmd) {
aa53efc3 1568 uint8_t keyNbr = 0;
1569 uint8_t dataLen = 0;
1570 uint8_t KEY[8] = {0};
1571 char filename[FILE_PATH_SIZE];
1572 uint8_t fileNameLen = 0;
1573 bool errors = false;
1574 uint8_t operation = 0;
1575 char tempStr[20];
1576 uint8_t cmdp = 0;
1577
1578 while(param_getchar(Cmd, cmdp) != 0x00)
1579 {
1580 switch(param_getchar(Cmd, cmdp))
1581 {
1582 case 'h':
1583 case 'H':
1584 return usage_hf_iclass_managekeys();
1585 case 'f':
1586 case 'F':
1587 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1588 if (fileNameLen < 1) {
1589 PrintAndLog("No filename found after f");
1590 errors = true;
1591 }
1592 cmdp += 2;
1593 break;
1594 case 'n':
1595 case 'N':
1596 keyNbr = param_get8(Cmd, cmdp+1);
1597 if (keyNbr < 0) {
1598 PrintAndLog("Wrong block number");
1599 errors = true;
1600 }
1601 cmdp += 2;
1602 break;
1603 case 'k':
1604 case 'K':
1605 operation += 3; //set key
1606 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1607 if (dataLen == 16) { //ul-c or ev1/ntag key length
1608 errors = param_gethex(tempStr, 0, KEY, dataLen);
1609 } else {
1610 PrintAndLog("\nERROR: Key is incorrect length\n");
1611 errors = true;
1612 }
1613 cmdp += 2;
1614 break;
1615 case 'p':
1616 case 'P':
1617 operation += 4; //print keys in memory
1618 cmdp++;
1619 break;
1620 case 'l':
1621 case 'L':
1622 operation += 5; //load keys from file
1623 cmdp++;
1624 break;
1625 case 's':
1626 case 'S':
1627 operation += 6; //save keys to file
1628 cmdp++;
1629 break;
1630 default:
1631 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1632 errors = true;
1633 break;
1634 }
1635 if(errors) return usage_hf_iclass_managekeys();
1636 }
1637 if (operation == 0){
1638 PrintAndLog("no operation specified (load, save, or print)\n");
1639 return usage_hf_iclass_managekeys();
1640 }
1641 if (operation > 6){
1642 PrintAndLog("Too many operations specified\n");
1643 return usage_hf_iclass_managekeys();
1644 }
1645 if (operation > 4 && fileNameLen == 0){
1646 PrintAndLog("You must enter a filename when loading or saving\n");
1647 return usage_hf_iclass_managekeys();
1648 }
1649
1650 switch (operation){
1651 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1652 case 4: return printKeys();
1653 case 5: return loadKeys(filename);
1654 case 6: return saveKeys(filename);
1655 break;
1656 }
1657 return 0;
1658}
1659
cee5a30d 1660static command_t CommandTable[] =
1661{
aa53efc3 1662 {"help", CmdHelp, 1, "This help"},
4d68ec02 1663 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1664 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1665 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1666 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1667 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1668 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1669 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1670 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1671 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1672 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1673 {"reader", CmdHFiClassReader, 0, " Read an iClass tag"},
1674 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1675 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1676 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1677 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1678 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
6f101995 1679 {NULL, NULL, 0, NULL}
cee5a30d 1680};
1681
1682int CmdHFiClass(const char *Cmd)
1683{
53444513
MHS		 1684 CmdsParse(CommandTable, Cmd);
1685 return 0;
cee5a30d 1686}
1687
1688int CmdHelp(const char *Cmd)
1689{
53444513
MHS		 1690 CmdsHelp(CommandTable);
1691 return 0;
cee5a30d 1692}
Proxmark3 GIT tracking
Impressum, Datenschutz