]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhficlass.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
iclass refactor/cleanup
[proxmark3-svn] / client / cmdhficlass.c
CommitLineData
cee5a30d 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833 4// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// High frequency iClass commands
11//-----------------------------------------------------------------------------
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <string.h>
9f6e9d15 16#include <sys/stat.h>
cee5a30d 17#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18#include "data.h"
902cb3c0 19#include "proxmark3.h"
cee5a30d 20#include "ui.h"
21#include "cmdparser.h"
22#include "cmdhficlass.h"
23#include "common.h"
14006804 24#include "util.h"
17cba269 25#include "cmdmain.h"
a66fca86
AD		 26#include "loclass/des.h"
27#include "loclass/cipherutils.h"
28#include "loclass/cipher.h"
29#include "loclass/ikeys.h"
3ad48540
MHS		 30#include "loclass/elite_crack.h"
31#include "loclass/fileutils.h"
1defcf60 32#include "protocols.h"
caaf9618 33#include "usb_cmd.h"
aa53efc3 34#include "cmdhfmfu.h"
35
36#define llX PRIx64
cee5a30d 37
38static int CmdHelp(const char *Cmd);
39
aa53efc3 40#define ICLASS_KEYS_MAX 8
41static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
49 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
50};
51
52typedef struct iclass_block {
53 uint8_t d[8];
54} iclass_block_t;
55
4d68ec02 56int xorbits_8(uint8_t val) {
53444513
MHS		 57 uint8_t res = val ^ (val >> 1); //1st pass
58 res = res ^ (res >> 1); // 2nd pass
59 res = res ^ (res >> 2); // 3rd pass
60 res = res ^ (res >> 4); // 4th pass
61 return res & 1;
17cba269
MHS		 62}
63
4d68ec02 64int CmdHFiClassList(const char *Cmd) {
4c3de57a 65 PrintAndLog("Deprecated command, use 'hf list iclass' instead");
17cba269
MHS		 66 return 0;
67}
68
4d68ec02 69int CmdHFiClassSnoop(const char *Cmd) {
53444513
MHS		 70 UsbCommand c = {CMD_SNOOP_ICLASS};
71 SendCommand(&c);
72 return 0;
cee5a30d 73}
4d68ec02 74
75int usage_hf_iclass_sim(void) {
41524d8a
MHS		 76 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
77 PrintAndLog(" options");
78 PrintAndLog(" 0 <CSN> simulate the given CSN");
79 PrintAndLog(" 1 simulate default CSN");
80 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
81 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
82 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
83 PrintAndLog(" example: hf iclass sim 2");
84 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
85 PrintAndLog(" hf iclass sim 3");
86 return 0;
87}
88
6116c796 89#define NUM_CSNS 15
4d68ec02 90int CmdHFiClassSim(const char *Cmd) {
53444513
MHS		 91 uint8_t simType = 0;
92 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
93
94 if (strlen(Cmd)<1) {
1defcf60 95 return usage_hf_iclass_sim();
53444513 96 }
1defcf60 97 simType = param_get8ex(Cmd, 0, 0, 10);
53444513
MHS		 98
99 if(simType == 0)
100 {
101 if (param_gethex(Cmd, 1, CSN, 16)) {
102 PrintAndLog("A CSN should consist of 16 HEX symbols");
41524d8a 103 return usage_hf_iclass_sim();
53444513 104 }
53444513 105
41524d8a 106 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
53444513 107 }
41524d8a 108 if(simType > 3)
53444513
MHS		 109 {
110 PrintAndLog("Undefined simptype %d", simType);
41524d8a 111 return usage_hf_iclass_sim();
53444513 112 }
1e262141 113
41524d8a 114 uint8_t numberOfCSNs=0;
9f6e9d15
MHS		 115 if(simType == 2)
116 {
6116c796 117 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
9f6e9d15 118 UsbCommand resp = {0};
17cba269 119
53444513
MHS		 120 uint8_t csns[8*NUM_CSNS] = {
121 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
6116c796
MHS		 136
137 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
9f6e9d15
MHS		 138
139 SendCommand(&c);
140 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
141 PrintAndLog("Command timed out");
142 return 0;
143 }
1e262141 144
77abe781 145 uint8_t num_mac_responses = resp.arg[1];
6116c796 146 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
9f6e9d15 147
6116c796 148 size_t datalen = NUM_CSNS*24;
9f6e9d15
MHS		 149 /*
150 * Now, time to dump to file. We'll use this format:
77abe781 151 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15 152 * So, it should wind up as
77abe781
MHS		 153 * 8 * 24 bytes.
154 *
155 * The returndata from the pm3 is on the following format
156 * <4 byte NR><4 byte MAC>
157 * CC are all zeroes, CSN is the same as was sent in
9f6e9d15 158 **/
77abe781
MHS		 159 void* dump = malloc(datalen);
160 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15 161 uint8_t i = 0;
6116c796 162 for(i = 0 ; i < NUM_CSNS ; i++)
9f6e9d15 163 {
77abe781
MHS		 164 memcpy(dump+i*24, csns+i*8,8); //CSN
165 //8 zero bytes here...
166 //Then comes NR_MAC (eight bytes from the response)
167 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
1e262141 168
9f6e9d15
MHS		 169 }
170 /** Now, save to dumpfile **/
77abe781
MHS		 171 saveFile("iclass_mac_attack", "bin", dump,datalen);
172 free(dump);
9f6e9d15
MHS		 173 }else
174 {
175 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
176 memcpy(c.d.asBytes, CSN, 8);
177 SendCommand(&c);
178 }
1e262141 179
53444513 180 return 0;
1e262141 181}
182
4d68ec02 183int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
6ce0e538 184 bool tagFound = false;
caaf9618
MHS		 185 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
186 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
aa53efc3 187 // loop in client not device - else on windows have a communication error
188 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
53444513
MHS		 189 UsbCommand resp;
190 while(!ukbhit()){
aa53efc3 191 SendCommand(&c);
6ce0e538 192 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
193 uint8_t readStatus = resp.arg[0] & 0xff;
194 uint8_t *data = resp.d.asBytes;
53444513 195
6ce0e538 196 if (verbose)
197 PrintAndLog("Readstatus:%02x", readStatus);
caaf9618 198 if( readStatus == 0){
53444513 199 //Aborted
6ce0e538 200 if (verbose) PrintAndLog("Quitting...");
53444513
MHS		 201 return 0;
202 }
6ce0e538 203 if( readStatus & FLAG_ICLASS_READER_CSN){
204 PrintAndLog("CSN: %s",sprint_hex(data,8));
205 tagFound = true;
206 }
caaf9618
MHS		 207 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
208 if( readStatus & FLAG_ICLASS_READER_CONF){
209 printIclassDumpInfo(data);
53444513 210 }
6ce0e538 211 if (tagFound && !loop) return 1;
53444513 212 } else {
6ce0e538 213 if (verbose) PrintAndLog("Command execute timeout");
53444513 214 }
6ce0e538 215 if (!loop) break;
53444513 216 }
53444513 217 return 0;
6ce0e538 218}
219
4d68ec02 220int CmdHFiClassReader(const char *Cmd) {
6ce0e538 221 return HFiClassReader(Cmd, true, true);
c3963755 222}
223
4d68ec02 224int CmdHFiClassReader_Replay(const char *Cmd) {
53444513
MHS		 225 uint8_t readerType = 0;
226 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
c3963755 227
53444513
MHS		 228 if (strlen(Cmd)<1) {
229 PrintAndLog("Usage: hf iclass replay <MAC>");
230 PrintAndLog(" sample: hf iclass replay 00112233");
231 return 0;
232 }
c3963755 233
53444513
MHS		 234 if (param_gethex(Cmd, 0, MAC, 8)) {
235 PrintAndLog("MAC must include 8 HEX symbols");
236 return 1;
237 }
c3963755 238
53444513
MHS		 239 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
240 memcpy(c.d.asBytes, MAC, 4);
241 SendCommand(&c);
1e262141 242
53444513 243 return 0;
1e262141 244}
245
4d68ec02 246int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
247 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
248 memcpy(c.d.asBytes, data, blocksCount * 16);
249 SendCommand(&c);
250 return 0;
251}
252
253int hf_iclass_eload_usage(void) {
7781a656
MHS		 254 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
255 PrintAndLog("Usage: hf iclass eload f <filename>");
256 PrintAndLog("");
257 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
258 return 0;
7781a656
MHS		 259}
260
4d68ec02 261int CmdHFiClassELoad(const char *Cmd) {
7781a656
MHS		 262
263 char opt = param_getchar(Cmd, 0);
264 if (strlen(Cmd)<1 || opt == 'h')
265 return hf_iclass_eload_usage();
266
267 //File handling and reading
268 FILE *f;
269 char filename[FILE_PATH_SIZE];
270 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
271 {
272 f = fopen(filename, "rb");
273 }else{
274 return hf_iclass_eload_usage();
275 }
276
277 if(!f) {
278 PrintAndLog("Failed to read from file '%s'", filename);
279 return 1;
280 }
281
282 fseek(f, 0, SEEK_END);
283 long fsize = ftell(f);
284 fseek(f, 0, SEEK_SET);
285
286 uint8_t *dump = malloc(fsize);
1defcf60
MHS		 287
288
7781a656
MHS		 289 size_t bytes_read = fread(dump, 1, fsize, f);
290 fclose(f);
291
1defcf60 292 printIclassDumpInfo(dump);
7781a656
MHS		 293 //Validate
294
295 if (bytes_read < fsize)
296 {
297 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
298 free(dump);
299 return 1;
300 }
301 //Send to device
302 uint32_t bytes_sent = 0;
303 uint32_t bytes_remaining = bytes_read;
304
305 while(bytes_remaining > 0){
306 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
307 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
308 memcpy(c.d.asBytes, dump, bytes_in_packet);
309 SendCommand(&c);
310 bytes_remaining -= bytes_in_packet;
311 bytes_sent += bytes_in_packet;
312 }
313 free(dump);
314 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
315 return 0;
316}
317
4d68ec02 318static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
41524d8a
MHS		 319 FILE *f = fopen(filename, "rb");
320 if(!f) {
321 PrintAndLog("Failed to read from file '%s'", filename);
322 return 1;
323 }
324 fseek(f, 0, SEEK_END);
325 long fsize = ftell(f);
326 fseek(f, 0, SEEK_SET);
327 size_t bytes_read = fread(buffer, 1, len, f);
328 fclose(f);
329 if(fsize != len)
330 {
331 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
332 return 1;
333 }
334 if(bytes_read != len)
335 {
336 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
337 return 1;
338 }
339 return 0;
340}
341
4d68ec02 342int usage_hf_iclass_decrypt(void) {
343 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
aa53efc3 344 PrintAndLog("");
345 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
346 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
347 PrintAndLog("");
348 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
349 PrintAndLog("");
350 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
351 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
352 PrintAndLog("which is defined by the configuration block.");
353 return 1;
354}
355
4d68ec02 356int CmdHFiClassDecrypt(const char *Cmd) {
41524d8a
MHS		 357 uint8_t key[16] = { 0 };
358 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
359 {
360 usage_hf_iclass_decrypt();
361 return 1;
362 }
363 PrintAndLog("Decryption file found... ");
364 char opt = param_getchar(Cmd, 0);
365 if (strlen(Cmd)<1 || opt == 'h')
366 return usage_hf_iclass_decrypt();
367
368 //Open the tagdump-file
369 FILE *f;
370 char filename[FILE_PATH_SIZE];
371 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
372 {
373 f = fopen(filename, "rb");
374 }else{
375 return usage_hf_iclass_decrypt();
376 }
377
378 fseek(f, 0, SEEK_END);
379 long fsize = ftell(f);
380 fseek(f, 0, SEEK_SET);
381 uint8_t enc_dump[8] = {0};
382 uint8_t *decrypted = malloc(fsize);
383 des3_context ctx = { DES_DECRYPT ,{ 0 } };
384 des3_set2key_dec( &ctx, key);
385 size_t bytes_read = fread(enc_dump, 1, 8, f);
386
387 //Use the first block (CSN) for filename
388 char outfilename[FILE_PATH_SIZE] = { 0 };
389 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
390 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
391 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
392
393 size_t blocknum =0;
394 while(bytes_read == 8)
395 {
9a9bcea8 396 if(blocknum < 7)
41524d8a
MHS		 397 {
398 memcpy(decrypted+(blocknum*8), enc_dump, 8);
399 }else{
400 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
401 }
402 printvar("decrypted block", decrypted +(blocknum*8), 8);
403 bytes_read = fread(enc_dump, 1, 8, f);
404 blocknum++;
405 }
406 fclose(f);
407
408 saveFile(outfilename,"bin", decrypted, blocknum*8);
409
410 return 0;
411}
7781a656 412
4d68ec02 413int usage_hf_iclass_encrypt(void) {
aa53efc3 414 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
415 PrintAndLog("");
416 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
417 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
418 PrintAndLog("");
419 PrintAndLog("example: hf iclass encrypt 0102030405060708");
420 PrintAndLog("");
421 return 0;
422}
423
4d68ec02 424static int iClassEncryptBlkData(uint8_t *blkData) {
aa53efc3 425 uint8_t key[16] = { 0 };
426 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
427 {
428 usage_hf_iclass_encrypt();
429 return 1;
430 }
431 PrintAndLog("Decryption file found... ");
53444513 432
4d68ec02 433 uint8_t encryptedData[16];
434 uint8_t *encrypted = encryptedData;
aa53efc3 435 des3_context ctx = { DES_DECRYPT ,{ 0 } };
436 des3_set2key_enc( &ctx, key);
437
4d68ec02 438 des3_crypt_ecb(&ctx, blkData,encrypted);
aa53efc3 439 //printvar("decrypted block", decrypted, 8);
4d68ec02 440 memcpy(blkData,encrypted,8);
aa53efc3 441
442 return 1;
443}
444
4d68ec02 445int CmdHFiClassEncryptBlk(const char *Cmd) {
aa53efc3 446 uint8_t blkData[8] = {0};
447 char opt = param_getchar(Cmd, 0);
448 if (strlen(Cmd)<1 || opt == 'h')
449 return usage_hf_iclass_encrypt();
53444513 450
aa53efc3 451 //get the bytes to encrypt
452 if (param_gethex(Cmd, 0, blkData, 16))
53444513 453 {
aa53efc3 454 PrintAndLog("BlockData must include 16 HEX symbols");
53444513
MHS		 455 return 0;
456 }
aa53efc3 457 if (!iClassEncryptBlkData(blkData)) return 0;
53444513 458
aa53efc3 459 printvar("encrypted block", blkData, 8);
460 return 1;
461}
53444513 462
4d68ec02 463void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
aa53efc3 464 uint8_t WB[9];
465 WB[0] = blockno;
466 memcpy(WB + 1,data,8);
467 doMAC_N(WB,sizeof(WB),div_key,MAC);
468 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
469}
53444513 470
4d68ec02 471static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
53444513
MHS		 472 UsbCommand resp;
473
aa53efc3 474 UsbCommand c = {CMD_READER_ICLASS, {0}};
475 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE| FLAG_ICLASS_READER_CC;
476 if (use_credit_key)
477 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
53444513 478
aa53efc3 479 clearCommandBuffer();
480 SendCommand(&c);
481 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
482 {
53444513 483 PrintAndLog("Command execute timeout");
aa53efc3 484 return false;
53444513
MHS		 485 }
486
aa53efc3 487 uint8_t isOK = resp.arg[0] & 0xff;
488 uint8_t *data = resp.d.asBytes;
53444513 489
aa53efc3 490 memcpy(CSN,data,8);
491 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
aa53efc3 492 if(isOK > 0)
493 {
494 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
53444513 495 }
aa53efc3 496 if(isOK <= 1){
497 PrintAndLog("Failed to obtain CC! Aborting");
498 return false;
499 }
500 return true;
a66fca86 501}
6f101995 502
aa53efc3 503static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool verbose) {
504 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
505 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
aa53efc3 506
507 if (!select_only(CSN, CCNR, use_credit_key, verbose))
508 return false;
509
4d68ec02 510 //get div_key
511 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
512
aa53efc3 513 doMAC(CCNR, div_key, MAC);
aa53efc3 514 UsbCommand resp;
515 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
516 memcpy(d.d.asBytes, MAC, 4);
517 clearCommandBuffer();
518 SendCommand(&d);
519 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
520 {
521 PrintAndLog("Auth Command execute timeout");
522 return false;
523 }
524 uint8_t isOK = resp.arg[0] & 0xff;
525 if (!isOK) {
526 PrintAndLog("Authentication error");
527 return false;
528 }
529 return true;
530}
531
4d68ec02 532int usage_hf_iclass_dump(void) {
aa53efc3 533 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e\n");
534 PrintAndLog("Options:");
535 PrintAndLog(" f <filename> : specify a filename to save dump to");
536 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
537 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
538 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
539 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
540 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
541 PrintAndLog(" NOTE: * = required");
542 PrintAndLog("Samples:");
543 PrintAndLog(" hf iclass dump k 001122334455667B");
544 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
545 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
546 return 0;
547}
548
4d68ec02 549int CmdHFiClassReader_Dump(const char *Cmd) {
aa53efc3 550
551 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
552 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
553 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
554 uint8_t blockno = 0;
555 uint8_t numblks = 0;
4d68ec02 556 uint8_t maxBlk = 31;
aa53efc3 557 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
558 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
559 uint8_t keyNbr = 0;
560 uint8_t dataLen = 0;
561 uint8_t fileNameLen = 0;
562 char filename[FILE_PATH_SIZE]={0};
563 char tempStr[50] = {0};
4d68ec02 564 bool have_debit_key = false;
aa53efc3 565 bool have_credit_key = false;
4d68ec02 566 bool use_credit_key = false;
aa53efc3 567 bool elite = false;
568 bool errors = false;
569 uint8_t cmdp = 0;
570
571 while(param_getchar(Cmd, cmdp) != 0x00)
572 {
573 switch(param_getchar(Cmd, cmdp))
574 {
575 case 'h':
576 case 'H':
577 return usage_hf_iclass_dump();
578 case 'c':
579 case 'C':
580 have_credit_key = true;
581 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
582 if (dataLen == 16) {
583 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
584 } else if (dataLen == 1) {
585 keyNbr = param_get8(Cmd, cmdp+1);
586 if (keyNbr <= ICLASS_KEYS_MAX) {
587 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
588 } else {
589 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
590 errors = true;
591 }
592 } else {
593 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
594 errors = true;
595 }
596 cmdp += 2;
597 break;
598 case 'e':
599 case 'E':
600 elite = true;
601 cmdp++;
602 break;
603 case 'f':
604 case 'F':
605 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
606 if (fileNameLen < 1) {
607 PrintAndLog("No filename found after f");
608 errors = true;
609 }
610 cmdp += 2;
611 break;
612 case 'k':
613 case 'K':
4d68ec02 614 have_debit_key = true;
aa53efc3 615 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
616 if (dataLen == 16) {
617 errors = param_gethex(tempStr, 0, KEY, dataLen);
618 } else if (dataLen == 1) {
619 keyNbr = param_get8(Cmd, cmdp+1);
620 if (keyNbr <= ICLASS_KEYS_MAX) {
621 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
622 } else {
623 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
624 errors = true;
625 }
626 } else {
627 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
628 errors = true;
629 }
630 cmdp += 2;
631 break;
632 default:
633 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
634 errors = true;
635 break;
636 }
637 if(errors) return usage_hf_iclass_dump();
638 }
639
640 if (cmdp < 2) return usage_hf_iclass_dump();
4d68ec02 641 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
642 if (!have_debit_key && have_credit_key) use_credit_key = true;
aa53efc3 643
644 //get config and first 3 blocks
645 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
646 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
647 UsbCommand resp;
648 uint8_t tag_data[255*8];
4d68ec02 649
aa53efc3 650 clearCommandBuffer();
651 SendCommand(&c);
4d68ec02 652 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
aa53efc3 653 PrintAndLog("Command execute timeout");
654 return 0;
655 }
4d68ec02 656 uint8_t readStatus = resp.arg[0] & 0xff;
657 uint8_t *data = resp.d.asBytes;
658
659 if(readStatus == 0){
660 PrintAndLog("No tag found...");
661 return 0;
662 }
663 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
664 memcpy(tag_data, data, 8*3);
665 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
666 numblks = data[8];
aa53efc3 667
4d68ec02 668 if (data[13] & 0x80) {
669 // large memory - not able to dump pages currently
670 maxBlk = 255;
671 } else {
672 maxBlk = 31;
673 }
674 if (numblks > maxBlk) numblks = maxBlk;
675 }
676 // authenticate debit key and get div_key - later store in dump block 3
677 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
aa53efc3 678 //try twice - for some reason it sometimes fails the first time...
4d68ec02 679 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
aa53efc3 680 ul_switch_off_field();
681 return 0;
682 }
683 }
aa53efc3 684
4d68ec02 685 // begin dump
aa53efc3 686 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1, 0x88}};
687 clearCommandBuffer();
688 SendCommand(&w);
689 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
690 PrintAndLog("Command execute time-out 1");
691 return 1;
692 }
693 uint32_t blocksRead = resp.arg[1];
694 uint8_t isOK = resp.arg[0] & 0xff;
695 if (!isOK && !blocksRead) {
696 PrintAndLog("Read Block Failed");
697 return 0;
698 }
699 uint32_t startindex = resp.arg[2];
700 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
701 PrintAndLog("Data exceeded Buffer size!");
702 blocksRead = (sizeof(tag_data)/8) - blockno;
703 }
4d68ec02 704 // response ok - now get bigbuf content of the dump
aa53efc3 705 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
706 WaitForResponse(CMD_ACK,NULL);
4d68ec02 707 size_t gotBytes = blocksRead*8 + blockno*8;
aa53efc3 708
4d68ec02 709 // try AA2
710 if (have_credit_key) {
711 //turn off hf field before authenticating with different key
aa53efc3 712 ul_switch_off_field();
aa53efc3 713 memset(MAC,0,4);
4d68ec02 714 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
aa53efc3 715 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
716 //try twice - for some reason it sometimes fails the first time...
717 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
718 ul_switch_off_field();
719 return 0;
720 }
721 }
4d68ec02 722 // do we still need to read more block? (aa2 enabled?)
723 if (maxBlk > blockno+numblks+1) {
724 // setup dump and start
725 w.arg[0] = blockno + blocksRead;
726 w.arg[1] = maxBlk - (blockno + blocksRead);
727 w.arg[2] = 0x18;
728 clearCommandBuffer();
729 SendCommand(&w);
730 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
731 PrintAndLog("Command execute timeout 2");
732 return 0;
733 }
734 uint8_t isOK = resp.arg[0] & 0xff;
735 blocksRead = resp.arg[1];
736 if (!isOK && !blocksRead) {
737 PrintAndLog("Read Block Failed 2");
738 return 0;
739 }
aa53efc3 740
4d68ec02 741 startindex = resp.arg[2];
742 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
743 PrintAndLog("Data exceeded Buffer size!");
744 blocksRead = (sizeof(tag_data) - gotBytes)/8;
745 }
746 // get dumped data from bigbuf
747 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
748 WaitForResponse(CMD_ACK,NULL);
aa53efc3 749
4d68ec02 750 gotBytes += blocksRead*8;
751 } else { //field is still on - turn it off...
752 ul_switch_off_field();
753 }
aa53efc3 754 }
755
4d68ec02 756 // add diversified keys to dump
757 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
758 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
759 // print the dump
760 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
761 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
762 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
aa53efc3 763
aa53efc3 764 if (filename[0] == 0){
765 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
766 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
767 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
768 }
4d68ec02 769
770 // save the dump to .bin file
aa53efc3 771 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
4d68ec02 772 saveFile(filename, "bin", tag_data, gotBytes);
aa53efc3 773 return 1;
774}
775
4d68ec02 776static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool verbose) {
aa53efc3 777 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
778 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
779 uint8_t keyType = (use_credit_key) ? 0x18 : 0x88;
780 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, verbose))
781 return 0;
782
783 UsbCommand resp;
784
785 Calc_wb_mac(blockno,bldata,div_key,MAC);
786 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno, keyType}};
787 memcpy(w.d.asBytes, bldata, 8);
788 memcpy(w.d.asBytes + 8,MAC, 4);
789
790 clearCommandBuffer();
791 SendCommand(&w);
792 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
793 {
794 PrintAndLog("Write Command execute timeout");
795 return 0;
796 }
797 uint8_t isOK = resp.arg[0] & 0xff;
798 if (!isOK) {
799 PrintAndLog("Write Block Failed");
800 return 0;
801 }
802 PrintAndLog("Write Block Successful");
803
804 return 1;
805}
806
4d68ec02 807int usage_hf_iclass_writeblock(void) {
aa53efc3 808 PrintAndLog("Options:");
809 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
810 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
811 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
812 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
813 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
814 PrintAndLog("Samples:");
815 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
816 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
817 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
818 return 0;
819}
820
821int CmdHFiClass_WriteBlock(const char *Cmd) {
822 uint8_t blockno=0;
823 uint8_t bldata[8]={0};
824 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
825 uint8_t keyNbr = 0;
826 uint8_t dataLen = 0;
827 char tempStr[50] = {0};
828 bool use_credit_key = false;
829 bool elite = false;
830 bool errors = false;
831 uint8_t cmdp = 0;
832 while(param_getchar(Cmd, cmdp) != 0x00)
833 {
834 switch(param_getchar(Cmd, cmdp))
835 {
836 case 'h':
837 case 'H':
838 return usage_hf_iclass_writeblock();
839 case 'b':
840 case 'B':
841 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
842 PrintAndLog("Block No must include 2 HEX symbols\n");
843 errors = true;
844 }
845 cmdp += 2;
846 break;
847 case 'c':
848 case 'C':
849 use_credit_key = true;
850 cmdp++;
851 break;
852 case 'd':
853 case 'D':
854 if (param_gethex(Cmd, cmdp+1, bldata, 16))
855 {
856 PrintAndLog("KEY must include 16 HEX symbols\n");
857 errors = true;
858 }
859 cmdp += 2;
860 break;
861 case 'e':
862 case 'E':
863 elite = true;
864 cmdp++;
865 break;
866 case 'k':
867 case 'K':
868 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
869 if (dataLen == 16) {
870 errors = param_gethex(tempStr, 0, KEY, dataLen);
871 } else if (dataLen == 1) {
872 keyNbr = param_get8(Cmd, cmdp+1);
873 if (keyNbr <= ICLASS_KEYS_MAX) {
874 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
875 } else {
876 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
877 errors = true;
878 }
879 } else {
880 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
881 errors = true;
882 }
883 cmdp += 2;
884 break;
885 default:
886 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
887 errors = true;
888 break;
889 }
890 if(errors) return usage_hf_iclass_writeblock();
891 }
892
893 if (cmdp < 6) return usage_hf_iclass_writeblock();
894
895 return WriteBlock(blockno, bldata, KEY, use_credit_key, elite, true);
896}
897
4d68ec02 898int usage_hf_iclass_clone(void) {
aa53efc3 899 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> e c");
900 PrintAndLog("Options:");
901 PrintAndLog(" f <filename>: specify a filename to clone from");
902 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
903 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
904 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
905 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
906 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
907 PrintAndLog("Samples:");
908 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
909 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
910 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
911 return -1;
912}
913
914int CmdHFiClassCloneTag(const char *Cmd) {
915 char filename[FILE_PATH_SIZE];
916 char tempStr[50]={0};
917 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
918 uint8_t keyNbr = 0;
919 uint8_t fileNameLen = 0;
920 uint8_t startblock = 0;
921 uint8_t endblock = 0;
922 uint8_t dataLen = 0;
923 bool use_credit_key = false;
924 bool elite = false;
925 bool errors = false;
926 uint8_t cmdp = 0;
927 while(param_getchar(Cmd, cmdp) != 0x00)
928 {
929 switch(param_getchar(Cmd, cmdp))
930 {
931 case 'h':
932 case 'H':
933 return usage_hf_iclass_clone();
934 case 'b':
935 case 'B':
936 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
937 PrintAndLog("Start Block No must include 2 HEX symbols\n");
938 errors = true;
939 }
940 cmdp += 2;
941 break;
942 case 'c':
943 case 'C':
944 use_credit_key = true;
945 cmdp++;
946 break;
947 case 'e':
948 case 'E':
949 elite = true;
950 cmdp++;
951 break;
952 case 'f':
953 case 'F':
954 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
955 if (fileNameLen < 1) {
956 PrintAndLog("No filename found after f");
957 errors = true;
958 }
959 cmdp += 2;
960 break;
961 case 'k':
962 case 'K':
963 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
964 if (dataLen == 16) {
965 errors = param_gethex(tempStr, 0, KEY, dataLen);
966 } else if (dataLen == 1) {
967 keyNbr = param_get8(Cmd, cmdp+1);
968 if (keyNbr <= ICLASS_KEYS_MAX) {
969 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
970 } else {
971 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
972 errors = true;
973 }
974 } else {
975 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
976 errors = true;
977 }
978 cmdp += 2;
979 break;
980 case 'l':
981 case 'L':
982 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
983 PrintAndLog("Start Block No must include 2 HEX symbols\n");
984 errors = true;
985 }
986 cmdp += 2;
987 break;
988 default:
989 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
990 errors = true;
991 break;
992 }
993 if(errors) return usage_hf_iclass_clone();
994 }
995
996 if (cmdp < 8) return usage_hf_iclass_clone();
997
998 FILE *f;
999
1000 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1001
1002 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1003 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1004 }
1005 // file handling and reading
1006 f = fopen(filename,"rb");
1007 if(!f) {
1008 PrintAndLog("Failed to read from file '%s'", filename);
1009 return 1;
1010 }
1011
1012 if (startblock<5) {
1013 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1014 return 0;
1015 }
1016 // now read data from the file from block 6 --- 19
1017 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1018 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1019 // else we have to create a share memory
1020 int i;
1021 fseek(f,startblock*8,SEEK_SET);
1022 fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f);
aa53efc3 1023
1024 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1025 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1026
1027 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, true))
1028 return 0;
1029
1030 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock,((use_credit_key) ? 0x18 : 0x88)}};
1031 uint8_t *ptr;
1032 // calculate all mac for every the block we will write
1033 for (i = startblock; i <= endblock; i++){
1034 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1035 // usb command d start pointer = d + (i - 6) * 12
1036 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1037 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1038 // next one
1039 ptr = w.d.asBytes + (i - startblock) * 12;
1040 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1041 memcpy(ptr + 8,MAC, 4);
1042 }
1043 uint8_t p[12];
1044 for (i = 0; i <= endblock - startblock;i++){
1045 memcpy(p,w.d.asBytes + (i * 12),12);
4d68ec02 1046 printf("Block |%02x|",i + startblock);
1047 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1048 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
aa53efc3 1049 }
1050 UsbCommand resp;
1051 SendCommand(&w);
1052 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1053 {
1054 PrintAndLog("Command execute timeout");
1055 return 0;
1056 }
1057 return 1;
1058}
1059
4d68ec02 1060static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool verbose) {
aa53efc3 1061 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1062 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1063
1064 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, verbose))
1065 return 0;
1066
1067 UsbCommand resp;
1068 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno, keyType}};
1069 clearCommandBuffer();
1070 SendCommand(&w);
1071 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1072 {
1073 PrintAndLog("Command execute timeout");
1074 return 0;
1075 }
1076 uint8_t isOK = resp.arg[0] & 0xff;
1077 if (!isOK) {
1078 PrintAndLog("Read Block Failed");
1079 return 0;
1080 }
1081 //data read is stored in: resp.d.asBytes[0-15]
1082 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1083 return 1;
1084}
1085
4d68ec02 1086int usage_hf_iclass_readblock(void) {
aa53efc3 1087 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e\n");
1088 PrintAndLog("Options:");
1089 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1090 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1091 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1092 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1093 PrintAndLog("Samples:");
1094 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1095 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1096 PrintAndLog(" hf iclass readblk b 0A k 0");
1097 return 0;
1098}
1099
4d68ec02 1100int CmdHFiClass_ReadBlock(const char *Cmd) {
aa53efc3 1101 uint8_t blockno=0;
1102 uint8_t keyType = 0x88; //debit key
1103 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1104 uint8_t keyNbr = 0;
1105 uint8_t dataLen = 0;
1106 char tempStr[50] = {0};
1107 bool elite = false;
1108 bool errors = false;
1109 uint8_t cmdp = 0;
1110 while(param_getchar(Cmd, cmdp) != 0x00)
1111 {
1112 switch(param_getchar(Cmd, cmdp))
1113 {
1114 case 'h':
1115 case 'H':
1116 return usage_hf_iclass_readblock();
1117 case 'b':
1118 case 'B':
1119 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1120 PrintAndLog("Block No must include 2 HEX symbols\n");
1121 errors = true;
1122 }
1123 cmdp += 2;
1124 break;
1125 case 'c':
1126 case 'C':
1127 keyType = 0x18;
1128 cmdp++;
1129 break;
1130 case 'e':
1131 case 'E':
1132 elite = true;
1133 cmdp++;
1134 break;
1135 case 'k':
1136 case 'K':
1137 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1138 if (dataLen == 16) {
1139 errors = param_gethex(tempStr, 0, KEY, dataLen);
1140 } else if (dataLen == 1) {
1141 keyNbr = param_get8(Cmd, cmdp+1);
1142 if (keyNbr <= ICLASS_KEYS_MAX) {
1143 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1144 } else {
1145 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1146 errors = true;
1147 }
1148 } else {
1149 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1150 errors = true;
1151 }
1152 cmdp += 2;
1153 break;
1154 default:
1155 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1156 errors = true;
1157 break;
1158 }
1159 if(errors) return usage_hf_iclass_readblock();
1160 }
1161
1162 if (cmdp < 4) return usage_hf_iclass_readblock();
4d68ec02 1163
aa53efc3 1164 return ReadBlock(KEY, blockno, keyType, elite, true);
1165}
1166
4d68ec02 1167int CmdHFiClass_loclass(const char *Cmd) {
aa53efc3 1168 char opt = param_getchar(Cmd, 0);
1169
1170 if (strlen(Cmd)<1 || opt == 'h') {
1171 PrintAndLog("Usage: hf iclass loclass [options]");
1172 PrintAndLog("Options:");
1173 PrintAndLog("h Show this help");
6f101995
MHS		 1174 PrintAndLog("t Perform self-test");
1175 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1176 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1177 PrintAndLog(" malicious CSNs, and their protocol responses");
1178 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1179 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1180 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1181 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1182 PrintAndLog(" ... totalling N*24 bytes");
1183 return 0;
1184 }
1185 char fileName[255] = {0};
1186 if(opt == 'f')
1187 {
53444513
MHS		 1188 if(param_getstr(Cmd, 1, fileName) > 0)
1189 {
1190 return bruteforceFileNoKeys(fileName);
1191 }else
1192 {
1193 PrintAndLog("You must specify a filename");
1194 }
6f101995
MHS		 1195 }
1196 else if(opt == 't')
1197 {
1198 int errors = testCipherUtils();
1199 errors += testMAC();
1200 errors += doKeyTests(0);
1201 errors += testElite();
1202 if(errors)
1203 {
1204 prnlog("OBS! There were errors!!!");
1205 }
1206 return errors;
1207 }
a66fca86 1208
6f101995
MHS		 1209 return 0;
1210}
c3963755 1211
4d68ec02 1212void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
aa53efc3 1213 uint8_t blockdata[8];
1214 uint8_t mem_config;
1215 memcpy(&mem_config, iclass_dump + 13,1);
1216 uint8_t maxmemcount;
1217 uint8_t filemaxblock = filesize / 8;
4d68ec02 1218 if (mem_config & 0x80)
aa53efc3 1219 maxmemcount = 255;
1220 else
4d68ec02 1221 maxmemcount = 31;
1222 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
aa53efc3 1223
1224 if (startblock == 0)
1225 startblock = 6;
1226 if ((endblock > maxmemcount) || (endblock == 0))
1227 endblock = maxmemcount;
1228 if (endblock > filemaxblock)
1229 endblock = filemaxblock;
1230 int i = startblock;
1231 int j;
4d68ec02 1232 while (i <= endblock){
1233 printf("Block |%02X| ",i);
aa53efc3 1234 memcpy(blockdata,iclass_dump + (i * 8),8);
1235 for (j = 0;j < 8;j++)
1236 printf("%02X ",blockdata[j]);
4d68ec02 1237 printf("|\n");
aa53efc3 1238 i++;
1239 }
aa53efc3 1240}
1241
4d68ec02 1242int usage_hf_iclass_readtagfile() {
1243 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1244 return 1;
1245}
1246
1247int CmdHFiClassReadTagFile(const char *Cmd) {
aa53efc3 1248 int startblock = 0;
1249 int endblock = 0;
1250 char tempnum[5];
1251 FILE *f;
1252 char filename[FILE_PATH_SIZE];
1253 if (param_getstr(Cmd, 0, filename) < 1)
1254 return usage_hf_iclass_readtagfile();
1255 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1256 startblock = 0;
1257 else
1258 sscanf(tempnum,"%d",&startblock);
1259
1260 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1261 endblock = 0;
1262 else
1263 sscanf(tempnum,"%d",&endblock);
1264 // file handling and reading
1265 f = fopen(filename,"rb");
1266 if(!f) {
1267 PrintAndLog("Failed to read from file '%s'", filename);
1268 return 1;
1269 }
1270 fseek(f, 0, SEEK_END);
1271 long fsize = ftell(f);
1272 fseek(f, 0, SEEK_SET);
1273
1274 uint8_t *dump = malloc(fsize);
1275
1276
1277 size_t bytes_read = fread(dump, 1, fsize, f);
1278 fclose(f);
1279 uint8_t *csn = dump;
4d68ec02 1280 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
aa53efc3 1281 // printIclassDumpInfo(dump);
1282 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1283 free(dump);
1284 return 0;
1285}
1286
4d68ec02 1287/*
1288uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
aa53efc3 1289 uint64_t new_div = 0x00;
1290 new_div ^= sdiv;
1291 new_div ^= hdiv;
1292 return new_div;
1293}
1294
4d68ec02 1295uint64_t hexarray_to_uint64(uint8_t *key) {
aa53efc3 1296 char temp[17];
1297 uint64_t uint_key;
1298 for (int i = 0;i < 8;i++)
1299 sprintf(&temp[(i *2)],"%02X",key[i]);
1300 temp[16] = '\0';
1301 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1302 return 0;
1303 return uint_key;
1304}
4d68ec02 1305*/
1306void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
aa53efc3 1307 uint8_t keytable[128] = {0};
1308 uint8_t key_index[8] = {0};
4d68ec02 1309 if (elite) {
1310 uint8_t key_sel[8] = { 0 };
1311 uint8_t key_sel_p[8] = { 0 };
1312 hash2(KEY, keytable);
1313 hash1(CSN, key_index);
1314 for(uint8_t i = 0; i < 8 ; i++)
1315 key_sel[i] = keytable[key_index[i]] & 0xFF;
aa53efc3 1316
4d68ec02 1317 //Permute from iclass format to standard format
1318 permutekey_rev(key_sel, key_sel_p);
1319 diversifyKey(CSN, key_sel_p, div_key);
1320 } else {
1321 diversifyKey(CSN, KEY, div_key);
1322 }
1323}
aa53efc3 1324
4d68ec02 1325//when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1326//calculate and return xor_div_key (ready for a key write command)
1327//print all div_keys if verbose
1328static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1329 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1330 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1331 //get old div key
1332 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1333 //get new div key
1334 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1335
1336 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1337 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1338 }
1339 if (verbose) {
1340 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1341 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1342 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1343 }
1344}
aa53efc3 1345
4d68ec02 1346int usage_hf_iclass_calc_newkey(void) {
1347 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1348 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1349 PrintAndLog(" Options:");
1350 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1351 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1352 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1353 PrintAndLog(" e : specify new key as elite calc");
1354 PrintAndLog(" ee : specify old and new key as elite calc");
1355 PrintAndLog("Samples:");
1356 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1357 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1358 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1359 PrintAndLog("NOTE: * = required\n");
aa53efc3 1360
4d68ec02 1361 return 1;
1362}
aa53efc3 1363
4d68ec02 1364int CmdHFiClassCalcNewKey(const char *Cmd) {
1365 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1366 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1367 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1368 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1369 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1370 uint8_t keyNbr = 0;
1371 uint8_t dataLen = 0;
1372 char tempStr[50] = {0};
1373 bool givenCSN = false;
1374 bool oldElite = false;
1375 bool elite = false;
1376 bool errors = false;
1377 uint8_t cmdp = 0;
1378 while(param_getchar(Cmd, cmdp) != 0x00)
1379 {
1380 switch(param_getchar(Cmd, cmdp))
1381 {
1382 case 'h':
1383 case 'H':
1384 return usage_hf_iclass_calc_newkey();
1385 case 'e':
1386 case 'E':
1387 dataLen = param_getstr(Cmd, cmdp, tempStr);
1388 if (dataLen==2)
1389 oldElite = true;
1390 elite = true;
1391 cmdp++;
1392 break;
1393 case 'n':
1394 case 'N':
1395 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1396 if (dataLen == 16) {
1397 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1398 } else if (dataLen == 1) {
1399 keyNbr = param_get8(Cmd, cmdp+1);
1400 if (keyNbr <= ICLASS_KEYS_MAX) {
1401 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1402 } else {
1403 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1404 errors = true;
1405 }
1406 } else {
1407 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1408 errors = true;
1409 }
1410 cmdp += 2;
1411 break;
1412 case 'o':
1413 case 'O':
1414 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1415 if (dataLen == 16) {
1416 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1417 } else if (dataLen == 1) {
1418 keyNbr = param_get8(Cmd, cmdp+1);
1419 if (keyNbr <= ICLASS_KEYS_MAX) {
1420 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1421 } else {
1422 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1423 errors = true;
1424 }
1425 } else {
1426 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1427 errors = true;
1428 }
1429 cmdp += 2;
1430 break;
1431 case 's':
1432 case 'S':
1433 givenCSN = true;
1434 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1435 return usage_hf_iclass_calc_newkey();
1436 cmdp += 2;
1437 break;
1438 default:
1439 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1440 errors = true;
1441 break;
1442 }
1443 if(errors) return usage_hf_iclass_calc_newkey();
1444 }
aa53efc3 1445
4d68ec02 1446 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
aa53efc3 1447
4d68ec02 1448 if (!givenCSN)
1449 if (!select_only(CSN, CCNR, false, true))
1450 return 0;
1451
1452 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
aa53efc3 1453 return 0;
1454}
1455
4d68ec02 1456static int loadKeys(char *filename) {
aa53efc3 1457 FILE *f;
1458 f = fopen(filename,"rb");
1459 if(!f) {
1460 PrintAndLog("Failed to read from file '%s'", filename);
1461 return 0;
1462 }
1463 fseek(f, 0, SEEK_END);
1464 long fsize = ftell(f);
1465 fseek(f, 0, SEEK_SET);
1466
1467 uint8_t *dump = malloc(fsize);
1468
1469 size_t bytes_read = fread(dump, 1, fsize, f);
1470 fclose(f);
1471 if (bytes_read > ICLASS_KEYS_MAX * 8){
1472 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1473 free(dump);
1474 return 0;
1475 }
1476 uint8_t i = 0;
1477 for (; i < bytes_read/8; i++){
1478 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1479 }
1480 free(dump);
1481 PrintAndLog("%u keys loaded", i);
1482 return 1;
1483}
1484
4d68ec02 1485static int saveKeys(char *filename) {
aa53efc3 1486 FILE *f;
1487 f = fopen(filename,"wb");
1488 if (f == NULL) {
1489 printf("error opening file %s\n",filename);
1490 return 0;
1491 }
1492 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1493 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1494 PrintAndLog("save key failed to write to file: %s", filename);
1495 break;
1496 }
1497 }
1498 fclose(f);
1499 return 0;
1500}
1501
4d68ec02 1502static int printKeys(void) {
aa53efc3 1503 PrintAndLog("");
1504 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1505 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1506 }
1507 PrintAndLog("");
1508 return 0;
1509}
1510
4d68ec02 1511int usage_hf_iclass_managekeys(void) {
aa53efc3 1512 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1513 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1514 PrintAndLog(" Options:");
1515 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1516 PrintAndLog(" k <key> : set a key in memory");
1517 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1518 PrintAndLog(" s : save keys in memory to file specified by filename");
1519 PrintAndLog(" l : load keys to memory from file specified by filename");
1520 PrintAndLog(" p : print keys loaded into memory\n");
1521 PrintAndLog("Samples:");
1522 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1523 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1524 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1525 PrintAndLog(" print keys : hf iclass managekeys p\n");
1526 return 0;
1527}
1528
4d68ec02 1529int CmdHFiClassManageKeys(const char *Cmd) {
aa53efc3 1530 uint8_t keyNbr = 0;
1531 uint8_t dataLen = 0;
1532 uint8_t KEY[8] = {0};
1533 char filename[FILE_PATH_SIZE];
1534 uint8_t fileNameLen = 0;
1535 bool errors = false;
1536 uint8_t operation = 0;
1537 char tempStr[20];
1538 uint8_t cmdp = 0;
1539
1540 while(param_getchar(Cmd, cmdp) != 0x00)
1541 {
1542 switch(param_getchar(Cmd, cmdp))
1543 {
1544 case 'h':
1545 case 'H':
1546 return usage_hf_iclass_managekeys();
1547 case 'f':
1548 case 'F':
1549 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1550 if (fileNameLen < 1) {
1551 PrintAndLog("No filename found after f");
1552 errors = true;
1553 }
1554 cmdp += 2;
1555 break;
1556 case 'n':
1557 case 'N':
1558 keyNbr = param_get8(Cmd, cmdp+1);
1559 if (keyNbr < 0) {
1560 PrintAndLog("Wrong block number");
1561 errors = true;
1562 }
1563 cmdp += 2;
1564 break;
1565 case 'k':
1566 case 'K':
1567 operation += 3; //set key
1568 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1569 if (dataLen == 16) { //ul-c or ev1/ntag key length
1570 errors = param_gethex(tempStr, 0, KEY, dataLen);
1571 } else {
1572 PrintAndLog("\nERROR: Key is incorrect length\n");
1573 errors = true;
1574 }
1575 cmdp += 2;
1576 break;
1577 case 'p':
1578 case 'P':
1579 operation += 4; //print keys in memory
1580 cmdp++;
1581 break;
1582 case 'l':
1583 case 'L':
1584 operation += 5; //load keys from file
1585 cmdp++;
1586 break;
1587 case 's':
1588 case 'S':
1589 operation += 6; //save keys to file
1590 cmdp++;
1591 break;
1592 default:
1593 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1594 errors = true;
1595 break;
1596 }
1597 if(errors) return usage_hf_iclass_managekeys();
1598 }
1599 if (operation == 0){
1600 PrintAndLog("no operation specified (load, save, or print)\n");
1601 return usage_hf_iclass_managekeys();
1602 }
1603 if (operation > 6){
1604 PrintAndLog("Too many operations specified\n");
1605 return usage_hf_iclass_managekeys();
1606 }
1607 if (operation > 4 && fileNameLen == 0){
1608 PrintAndLog("You must enter a filename when loading or saving\n");
1609 return usage_hf_iclass_managekeys();
1610 }
1611
1612 switch (operation){
1613 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1614 case 4: return printKeys();
1615 case 5: return loadKeys(filename);
1616 case 6: return saveKeys(filename);
1617 break;
1618 }
1619 return 0;
1620}
1621
cee5a30d 1622static command_t CommandTable[] =
1623{
aa53efc3 1624 {"help", CmdHelp, 1, "This help"},
4d68ec02 1625 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1626 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1627 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1628 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1629 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1630 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1631 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1632 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1633 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1634 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1635 {"reader", CmdHFiClassReader, 0, " Read an iClass tag"},
1636 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1637 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1638 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1639 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1640 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
6f101995 1641 {NULL, NULL, 0, NULL}
cee5a30d 1642};
1643
1644int CmdHFiClass(const char *Cmd)
1645{
53444513
MHS		 1646 CmdsParse(CommandTable, Cmd);
1647 return 0;
cee5a30d 1648}
1649
1650int CmdHelp(const char *Cmd)
1651{
53444513
MHS		 1652 CmdsHelp(CommandTable);
1653 return 0;
cee5a30d 1654}
Proxmark3 GIT tracking
Impressum, Datenschutz