[proxmark3-svn] / client / cmdhficlass.c

//-----------------------------------------------------------------------------
// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
// Copyright (C) 2011 Gerhard de Koning Gans
// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// High frequency iClass commands
//-----------------------------------------------------------------------------

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
#include "data.h"
//#include "proxusb.h"
#include "proxmark3.h"
#include "ui.h"
#include "cmdparser.h"
#include "cmdhficlass.h"
#include "common.h"
#include "util.h"
#include "cmdmain.h"
#include "loclass/des.h"
#include "loclass/cipherutils.h"
#include "loclass/cipher.h"
#include "loclass/ikeys.h"
#include "loclass/elite_crack.h"
#include "loclass/fileutils.h"

static int CmdHelp(const char *Cmd);

int xorbits_8(uint8_t val)
{
    uint8_t res = val ^ (val >> 1); //1st pass
    res = res ^ (res >> 1); 		// 2nd pass
    res = res ^ (res >> 2); 		// 3rd pass
    res = res ^ (res >> 4); 			// 4th pass
    return res & 1;
}

int CmdHFiClassList(const char *Cmd)
{

	bool ShowWaitCycles = false;
	char param = param_getchar(Cmd, 0);

	if (param != 0) {
		PrintAndLog("List data in trace buffer.");
		PrintAndLog("Usage:  hf iclass list");
		PrintAndLog("h - help");
		PrintAndLog("sample: hf iclass list");
		return 0;
	}

	uint8_t got[1920];
	GetFromBigBuf(got,sizeof(got),0);
	WaitForResponse(CMD_ACK,NULL);

	PrintAndLog("Recorded Activity");
	PrintAndLog("");
	PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
	PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
	PrintAndLog("");
	PrintAndLog("     Start |       End | Src | Data");
	PrintAndLog("-----------|-----------|-----|--------");

	int i;
	uint32_t first_timestamp = 0;
	uint32_t timestamp;
	bool tagToReader;
	uint32_t parityBits;
	uint8_t len;
	uint8_t *frame;
	uint32_t EndOfTransmissionTimestamp = 0;


	for( i=0; i < 1900;)
	{
		//First 32 bits contain
		// isResponse (1 bit)
		// timestamp (remaining)
		//Then paritybits
		//Then length
		timestamp = *((uint32_t *)(got+i));
		parityBits = *((uint32_t *)(got+i+4));
		len = got[i+8];
        frame = (got+i+9);
		uint32_t next_timestamp = (*((uint32_t *)(got+i+9))) & 0x7fffffff;

		tagToReader = timestamp & 0x80000000;
		timestamp &= 0x7fffffff;

		if(i==0) {
			first_timestamp = timestamp;
		}

        // Break and stick with current result idf buffer was not completely full
		if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;

		char line[1000] = "";

		if(len)//We have some data to display
		{
			int j,oddparity;

			for(j = 0; j < len ; j++)
			{
				oddparity = 0x01 ^ xorbits_8(frame[j] & 0xFF);

				if (tagToReader && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
					sprintf(line+(j*4), "%02x!  ", frame[j]);
				} else {
					sprintf(line+(j*4), "%02x   ", frame[j]);
				}
			}
		}else
		{
			if (ShowWaitCycles) {
				sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
			}
		}

		char *crc = "";

		if(len > 2)
		{
			uint8_t b1, b2;
			if(!tagToReader && len == 4) {
				// Rough guess that this is a command from the reader
				// For iClass the command byte is not part of the CRC
					ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
			}
			else {
				  // For other data.. CRC might not be applicable (UPDATE commands etc.)
				ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
			}

			if (b1 != frame[len-2] || b2 != frame[len-1]) {
				crc = (tagToReader & (len < 8)) ? "" : " !crc";
			}
		}

		i += (len + 9);
		EndOfTransmissionTimestamp = (*((uint32_t *)(got+i))) & 0x7fffffff;

		// Not implemented for iclass on the ARM-side
		//if (!ShowWaitCycles) i += 9;

		PrintAndLog(" %9d | %9d | %s | %s %s",
			(timestamp - first_timestamp),
			(EndOfTransmissionTimestamp - first_timestamp),
			(len?(tagToReader ? "Tag" : "Rdr"):"   "),
			line, crc);
	}
	return 0;
}

int CmdHFiClassListOld(const char *Cmd)
{
  uint8_t got[1920];
  GetFromBigBuf(got,sizeof(got),0);

  PrintAndLog("recorded activity:");
  PrintAndLog(" ETU     :rssi: who bytes");
  PrintAndLog("---------+----+----+-----------");

  int i = 0;
  int prev = -1;

  for (;;) {
    if(i >= 1900) {
      break;
    }

    bool isResponse;
    int timestamp = *((uint32_t *)(got+i));
    if (timestamp & 0x80000000) {
      timestamp &= 0x7fffffff;
      isResponse = 1;
    } else {
      isResponse = 0;
    }


    int metric = 0;

    int parityBits = *((uint32_t *)(got+i+4));
    // 4 bytes of additional information...
    // maximum of 32 additional parity bit information
    //
    // TODO:
    // at each quarter bit period we can send power level (16 levels)
    // or each half bit period in 256 levels.


    int len = got[i+8];

    if (len > 100) {
      break;
    }
    if (i + len >= 1900) {
      break;
    }

    uint8_t *frame = (got+i+9);

    // Break and stick with current result if buffer was not completely full
    if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }

    char line[1000] = "";
    int j;
    for (j = 0; j < len; j++) {
      int oddparity = 0x01;
      int k;

      for (k=0;k<8;k++) {
        oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
      }

      //if((parityBits >> (len - j - 1)) & 0x01) {
      if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
        sprintf(line+(j*4), "%02x!  ", frame[j]);
      }
      else {
        sprintf(line+(j*4), "%02x   ", frame[j]);
      }
    }

    char *crc;
    crc = "";
    if (len > 2) {
      uint8_t b1, b2;
      for (j = 0; j < (len - 1); j++) {
        // gives problems... search for the reason..
        /*if(frame[j] == 0xAA) {
          switch(frame[j+1]) {
            case 0x01:
              crc = "[1] Two drops close after each other";
            break;
            case 0x02:
              crc = "[2] Potential SOC with a drop in second half of bitperiod";
              break;
            case 0x03:
              crc = "[3] Segment Z after segment X is not possible";
              break;
            case 0x04:
              crc = "[4] Parity bit of a fully received byte was wrong";
              break;
            default:
              crc = "[?] Unknown error";
              break;
          }
          break;
        }*/
      }

      if (strlen(crc)==0) {
	if(!isResponse && len == 4) {
		// Rough guess that this is a command from the reader
		// For iClass the command byte is not part of the CRC
	        ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
	}
	else {
		// For other data.. CRC might not be applicable (UPDATE commands etc.)
	        ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
	}
	//printf("%1x %1x",(unsigned)b1,(unsigned)b2);
        if (b1 != frame[len-2] || b2 != frame[len-1]) {
          crc = (isResponse & (len < 8)) ? "" : " !crc";
        } else {
          crc = "";
        }
      }
    } else {
      crc = ""; // SHORT
    }

    char metricString[100];
    if (isResponse) {
      sprintf(metricString, "%3d", metric);
    } else {
      strcpy(metricString, "   ");
    }

    PrintAndLog(" +%7d: %s: %s %s %s",
      (prev < 0 ? 0 : (timestamp - prev)),
      metricString,
      (isResponse ? "TAG" : "   "), line, crc);

    prev = timestamp;
    i += (len + 9);
  }
  return 0;
}

int CmdHFiClassSnoop(const char *Cmd)
{
  UsbCommand c = {CMD_SNOOP_ICLASS};
  SendCommand(&c);
  return 0;
}
#define NUM_CSNS 15
int CmdHFiClassSim(const char *Cmd)
{
  uint8_t simType = 0;
  uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  if (strlen(Cmd)<1) {
	PrintAndLog("Usage:  hf iclass sim [0 <CSN>] | x");
	PrintAndLog("        options");
	PrintAndLog("                0 <CSN> simulate the given CSN");
	PrintAndLog("                1       simulate default CSN");
	PrintAndLog("                2       iterate CSNs, gather MACs");
	PrintAndLog("        sample: hf iclass sim 0 031FEC8AF7FF12E0");
	PrintAndLog("        sample: hf iclass sim 2");
	return 0;
  }	

  simType = param_get8(Cmd, 0);

  if(simType == 0)
  {
	  if (param_gethex(Cmd, 1, CSN, 16)) {
		  PrintAndLog("A CSN should consist of 16 HEX symbols");
		  return 1;
	  }
	  PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));

  }
  if(simType > 2)
  {
	  PrintAndLog("Undefined simptype %d", simType);
	  return 1;
  }
  uint8_t numberOfCSNs=0;

	if(simType == 2)
	{
		UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
		UsbCommand resp = {0};

		/*uint8_t csns[8 * NUM_CSNS] = {
			 0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,
			 0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,
			 0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,
			 0x17,0x12,0x01,0xfd,0xf7,0xff,0x12,0xe0 ,
			 0xcd,0x56,0x01,0x7c,0x6f,0xff,0x12,0xe0 ,
			 0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,
			 0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,
			 0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };
*/
      
       uint8_t csns[8*NUM_CSNS] = {
        0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };

		memcpy(c.d.asBytes, csns, 8*NUM_CSNS);

		SendCommand(&c);
		if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
			PrintAndLog("Command timed out");
			return 0;
		}

		uint8_t num_mac_responses  = resp.arg[1];
		PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);

		size_t datalen = NUM_CSNS*24;
		/*
		 * Now, time to dump to file. We'll use this format:
		 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
		 * So, it should wind up as
		 * 8 * 24 bytes.
		 *
		 * The returndata from the pm3 is on the following format
		 * <4 byte NR><4 byte MAC>
		 * CC are all zeroes, CSN is the same as was sent in
		 **/
		void* dump = malloc(datalen);
		memset(dump,0,datalen);//<-- Need zeroes for the CC-field
		uint8_t i = 0;
		for(i = 0 ; i < NUM_CSNS ; i++)
		{
			memcpy(dump+i*24, csns+i*8,8); //CSN
			//8 zero bytes here...
			//Then comes NR_MAC (eight bytes from the response)
			memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);

		}
		/** Now, save to dumpfile **/
		saveFile("iclass_mac_attack", "bin", dump,datalen);
		free(dump);
	}else
	{
		UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
		memcpy(c.d.asBytes, CSN, 8);
		SendCommand(&c);
	}

  return 0;
}

int CmdHFiClassReader(const char *Cmd)
{
  UsbCommand c = {CMD_READER_ICLASS, {0}};
  SendCommand(&c);
    UsbCommand resp;
  while(!ukbhit()){
      if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
            uint8_t isOK    = resp.arg[0] & 0xff;
            uint8_t * data  = resp.d.asBytes;

            PrintAndLog("isOk:%02x", isOK);

            if(isOK > 0)
            {
                PrintAndLog("CSN: %s",sprint_hex(data,8));
            }
            if(isOK >= 1)
            {
                PrintAndLog("CC: %s",sprint_hex(data+8,8));
            }else{
                PrintAndLog("No CC obtained");
            }
        } else {
            PrintAndLog("Command execute timeout");
        }
    }

  return 0;
}

int CmdHFiClassReader_Replay(const char *Cmd)
{
  uint8_t readerType = 0;
  uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};

  if (strlen(Cmd)<1) {
    PrintAndLog("Usage:  hf iclass replay <MAC>");
    PrintAndLog("        sample: hf iclass replay 00112233");
    return 0;
  }

  if (param_gethex(Cmd, 0, MAC, 8)) {
    PrintAndLog("MAC must include 8 HEX symbols");
    return 1;
  }

  UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
  memcpy(c.d.asBytes, MAC, 4);
  SendCommand(&c);

  return 0;
}

int CmdHFiClassReader_Dump(const char *Cmd)
{
  uint8_t readerType = 0;
  uint8_t MAC[4]={0x00,0x00,0x00,0x00};
  uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  //uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t keytable[128] = {0};
  int elite = 0;
  uint8_t *used_key;
  int i;
  if (strlen(Cmd)<1) 
  {
    PrintAndLog("Usage:  hf iclass dump <Key> [e]");
    PrintAndLog("        Key    - A 16 byte master key");
    PrintAndLog("        e      - If 'e' is specified, the key is interpreted as the 16 byte");
    PrintAndLog("                 Custom Key (KCus), which can be obtained via reader-attack");
    PrintAndLog("                 See 'hf iclass sim 2'. This key should be on iclass-format");
    PrintAndLog("        sample: hf iclass dump 0011223344556677");


    return 0;
  }

  if (param_gethex(Cmd, 0, KEY, 16)) 
  {
    PrintAndLog("KEY must include 16 HEX symbols");
    return 1;
  }

  if (param_getchar(Cmd, 1) == 'e')
  {
    PrintAndLog("Elite switch on");
    elite = 1;

    //calc h2
    hash2(KEY, keytable);
    printarr_human_readable("keytable", keytable, 128);

  }


  UsbCommand c = {CMD_READER_ICLASS, {0}};
  c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE;

  SendCommand(&c);
  
  UsbCommand resp;
  uint8_t key_sel[8] = {0};
  uint8_t key_sel_p[8] = { 0 };

  if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
        uint8_t isOK    = resp.arg[0] & 0xff;
        uint8_t * data  = resp.d.asBytes;

        memcpy(CSN,data,8);
        memcpy(CCNR,data+8,8);

        PrintAndLog("isOk:%02x", isOK);

        if(isOK > 0)
        {
            PrintAndLog("CSN: %s",sprint_hex(CSN,8));
        }
        if(isOK > 1)
        {
            if(elite)
            {
                //Get the key index (hash1)
                uint8_t key_index[8] = {0};

                hash1(CSN, key_index);
                printvar("hash1", key_index,8);
                for(i = 0; i < 8 ; i++)
                    key_sel[i] = keytable[key_index[i]] & 0xFF;
                printvar("k_sel", key_sel,8);
                //Permute from iclass format to standard format
                permutekey_rev(key_sel,key_sel_p);
                used_key = key_sel_p;
            }else{
                //Perhaps this should also be permuted to std format?
                // Something like the code below? I have no std system
                // to test this with /Martin

                //uint8_t key_sel_p[8] = { 0 };
                //permutekey_rev(KEY,key_sel_p);
                //used_key = key_sel_p;

                used_key = KEY;

            }
            printvar("Used key",used_key,8);
            diversifyKey(CSN,used_key, div_key);
            printvar("Div key", div_key, 8);
            printvar("CC_NR:",CCNR,12);
            doMAC(CCNR,12,div_key, MAC);
            printvar("MAC", MAC, 4);

            UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
            memcpy(d.d.asBytes, MAC, 4);
            SendCommand(&d);

        }else{
            PrintAndLog("Failed to obtain CC! Aborting");
        }
    } else {
        PrintAndLog("Command execute timeout");
    }

  return 0;
}

int CmdHFiClass_iso14443A_write(const char *Cmd)
{
  uint8_t readerType = 0;
  uint8_t MAC[4]={0x00,0x00,0x00,0x00};
  uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

  uint8_t blockNo=0;
  uint8_t bldata[8]={0};

  if (strlen(Cmd)<3) 
  {
    PrintAndLog("Usage:  hf iclass write <Key> <Block> <Data>");
    PrintAndLog("        sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
    return 0;
  }

  if (param_gethex(Cmd, 0, KEY, 16)) 
  {
    PrintAndLog("KEY must include 16 HEX symbols");
    return 1;
  }
  
  blockNo = param_get8(Cmd, 1);
  if (blockNo>32)
  {
        PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
        return 1;
  }
  if (param_gethex(Cmd, 2, bldata, 8)) 
  {
        PrintAndLog("Block data must include 8 HEX symbols");
        return 1;
  }
  
  UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};
  SendCommand(&c);
  UsbCommand resp;

  if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
    uint8_t isOK    = resp.arg[0] & 0xff;
    uint8_t * data  = resp.d.asBytes;
    
    memcpy(CSN,data,8);
    memcpy(CCNR,data+8,8);
    PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
    PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
	PrintAndLog("isOk:%02x", isOK);
  } else {
	PrintAndLog("Command execute timeout");
  }

  diversifyKey(CSN,KEY, div_key);

  PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
  doMAC(CCNR, 12,div_key, MAC);

  UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
  memcpy(c2.d.asBytes, bldata, 8);
  memcpy(c2.d.asBytes+8, MAC, 4);
  SendCommand(&c2);

  if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
    uint8_t isOK    = resp.arg[0] & 0xff;
    uint8_t * data  = resp.d.asBytes;

    if (isOK)
      PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
    else
      PrintAndLog("isOk:%02x", isOK);
  } else {
      PrintAndLog("Command execute timeout");
  }
  return 0;
}


static command_t CommandTable[] = 
{
  {"help",	CmdHelp,			1,	"This help"},
  {"list",	CmdHFiClassList,	0,	"List iClass history"},
  {"snoop",	CmdHFiClassSnoop,	0,	"Eavesdrop iClass communication"},
  {"sim",	CmdHFiClassSim,		0,	"Simulate iClass tag"},
  {"reader",CmdHFiClassReader,	0,	"Read an iClass tag"},
  {"replay",CmdHFiClassReader_Replay,	0,	"Read an iClass tag via Reply Attack"},
  {"dump",	CmdHFiClassReader_Dump,	0,		"Authenticate and Dump iClass tag"},
  {"write",	CmdHFiClass_iso14443A_write,	0,	"Authenticate and Write iClass block"},
  {NULL, NULL, 0, NULL}
};

int CmdHFiClass(const char *Cmd)
{
  CmdsParse(CommandTable, Cmd);
  return 0;
}

int CmdHelp(const char *Cmd)
{
  CmdsHelp(CommandTable);
  return 0;
}
Commit	Line	Data
cee5a30d	1	//-----------------------------------------------------------------------------
	2	// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
	3	// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833	4	// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d	5	//
	6	// This code is licensed to you under the terms of the GNU GPL, version 2 or,
	7	// at your option, any later version. See the LICENSE.txt file for the text of
	8	// the license.
	9	//-----------------------------------------------------------------------------
	10	// High frequency iClass commands
	11	//-----------------------------------------------------------------------------
	12
	13	#include <stdio.h>
	14	#include <stdlib.h>
	15	#include <string.h>
9f6e9d15	16	#include <sys/stat.h>
cee5a30d	17	#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
cee5a30d	18	#include "data.h"
28fdb04f	19	//#include "proxusb.h"
902cb3c0	20	#include "proxmark3.h"
cee5a30d	21	#include "ui.h"
	22	#include "cmdparser.h"
	23	#include "cmdhficlass.h"
	24	#include "common.h"
14006804	25	#include "util.h"
17cba269	26	#include "cmdmain.h"
a66fca86 AD	27	#include "loclass/des.h"
	28	#include "loclass/cipherutils.h"
	29	#include "loclass/cipher.h"
	30	#include "loclass/ikeys.h"
3ad48540 MHS	31	#include "loclass/elite_crack.h"
3ad48540 MHS	32	#include "loclass/fileutils.h"
cee5a30d	33
	34	static int CmdHelp(const char *Cmd);
	35
17cba269 MHS	36	int xorbits_8(uint8_t val)
17cba269 MHS	37	{
3ad48540 MHS	38	uint8_t res = val ^ (val >> 1); //1st pass
	39	res = res ^ (res >> 1); // 2nd pass
	40	res = res ^ (res >> 2); // 3rd pass
	41	res = res ^ (res >> 4); // 4th pass
	42	return res & 1;
17cba269 MHS	43	}
17cba269 MHS	44
cee5a30d	45	int CmdHFiClassList(const char *Cmd)
17cba269 MHS	46	{
	47
	48	bool ShowWaitCycles = false;
	49	char param = param_getchar(Cmd, 0);
	50
	51	if (param != 0) {
	52	PrintAndLog("List data in trace buffer.");
	53	PrintAndLog("Usage: hf iclass list");
	54	PrintAndLog("h - help");
	55	PrintAndLog("sample: hf iclass list");
	56	return 0;
	57	}
	58
	59	uint8_t got[1920];
	60	GetFromBigBuf(got,sizeof(got),0);
	61	WaitForResponse(CMD_ACK,NULL);
	62
	63	PrintAndLog("Recorded Activity");
	64	PrintAndLog("");
	65	PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
	66	PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
	67	PrintAndLog("");
	68	PrintAndLog(" Start \| End \| Src \| Data");
	69	PrintAndLog("-----------\|-----------\|-----\|--------");
	70
	71	int i;
	72	uint32_t first_timestamp = 0;
	73	uint32_t timestamp;
	74	bool tagToReader;
	75	uint32_t parityBits;
	76	uint8_t len;
	77	uint8_t *frame;
	78	uint32_t EndOfTransmissionTimestamp = 0;
	79
17cba269 MHS	80
	81	for( i=0; i < 1900;)
	82	{
	83	//First 32 bits contain
	84	// isResponse (1 bit)
	85	// timestamp (remaining)
	86	//Then paritybits
	87	//Then length
	88	timestamp = ((uint32_t )(got+i));
	89	parityBits = ((uint32_t )(got+i+4));
	90	len = got[i+8];
26c0d833	91	frame = (got+i+9);
17cba269 MHS	92	uint32_t next_timestamp = (((uint32_t )(got+i+9))) & 0x7fffffff;
	93
	94	tagToReader = timestamp & 0x80000000;
	95	timestamp &= 0x7fffffff;
	96
	97	if(i==0) {
	98	first_timestamp = timestamp;
	99	}
	100
26c0d833	101	// Break and stick with current result idf buffer was not completely full
f83cc126	102	if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;
17cba269 MHS	103
	104	char line[1000] = "";
	105
	106	if(len)//We have some data to display
	107	{
	108	int j,oddparity;
	109
	110	for(j = 0; j < len ; j++)
	111	{
	112	oddparity = 0x01 ^ xorbits_8(frame[j] & 0xFF);
	113
	114	if (tagToReader && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
	115	sprintf(line+(j*4), "%02x! ", frame[j]);
	116	} else {
	117	sprintf(line+(j*4), "%02x ", frame[j]);
	118	}
	119	}
	120	}else
	121	{
	122	if (ShowWaitCycles) {
	123	sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
	124	}
	125	}
	126
	127	char *crc = "";
	128
	129	if(len > 2)
	130	{
	131	uint8_t b1, b2;
	132	if(!tagToReader && len == 4) {
	133	// Rough guess that this is a command from the reader
	134	// For iClass the command byte is not part of the CRC
	135	ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
	136	}
	137	else {
	138	// For other data.. CRC might not be applicable (UPDATE commands etc.)
	139	ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
	140	}
	141
	142	if (b1 != frame[len-2] \|\| b2 != frame[len-1]) {
	143	crc = (tagToReader & (len < 8)) ? "" : " !crc";
	144	}
	145	}
	146
	147	i += (len + 9);
	148	EndOfTransmissionTimestamp = (((uint32_t )(got+i))) & 0x7fffffff;
	149
	150	// Not implemented for iclass on the ARM-side
	151	//if (!ShowWaitCycles) i += 9;
	152
	153	PrintAndLog(" %9d \| %9d \| %s \| %s %s",
	154	(timestamp - first_timestamp),
	155	(EndOfTransmissionTimestamp - first_timestamp),
	156	(len?(tagToReader ? "Tag" : "Rdr"):" "),
	157	line, crc);
	158	}
	159	return 0;
	160	}
	161
	162	int CmdHFiClassListOld(const char *Cmd)
cee5a30d	163	{
cee5a30d	164	uint8_t got[1920];
db09cb3a	165	GetFromBigBuf(got,sizeof(got),0);
cee5a30d	166
	167	PrintAndLog("recorded activity:");
	168	PrintAndLog(" ETU :rssi: who bytes");
	169	PrintAndLog("---------+----+----+-----------");
	170
	171	int i = 0;
	172	int prev = -1;
	173
	174	for (;;) {
	175	if(i >= 1900) {
	176	break;
	177	}
	178
	179	bool isResponse;
	180	int timestamp = ((uint32_t )(got+i));
	181	if (timestamp & 0x80000000) {
	182	timestamp &= 0x7fffffff;
	183	isResponse = 1;
	184	} else {
	185	isResponse = 0;
	186	}
	187
17cba269	188
cee5a30d	189	int metric = 0;
17cba269	190
cee5a30d	191	int parityBits = ((uint32_t )(got+i+4));
	192	// 4 bytes of additional information...
	193	// maximum of 32 additional parity bit information
	194	//
	195	// TODO:
	196	// at each quarter bit period we can send power level (16 levels)
	197	// or each half bit period in 256 levels.
	198
	199
	200	int len = got[i+8];
	201
	202	if (len > 100) {
	203	break;
	204	}
	205	if (i + len >= 1900) {
	206	break;
	207	}
	208
	209	uint8_t *frame = (got+i+9);
	210
	211	// Break and stick with current result if buffer was not completely full
	212	if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }
	213
	214	char line[1000] = "";
	215	int j;
	216	for (j = 0; j < len; j++) {
	217	int oddparity = 0x01;
	218	int k;
	219
	220	for (k=0;k<8;k++) {
	221	oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
	222	}
	223
	224	//if((parityBits >> (len - j - 1)) & 0x01) {
	225	if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
	226	sprintf(line+(j*4), "%02x! ", frame[j]);
	227	}
	228	else {
	229	sprintf(line+(j*4), "%02x ", frame[j]);
	230	}
	231	}
	232
	233	char *crc;
	234	crc = "";
	235	if (len > 2) {
	236	uint8_t b1, b2;
	237	for (j = 0; j < (len - 1); j++) {
	238	// gives problems... search for the reason..
	239	/*if(frame[j] == 0xAA) {
	240	switch(frame[j+1]) {
	241	case 0x01:
	242	crc = "[1] Two drops close after each other";
	243	break;
	244	case 0x02:
	245	crc = "[2] Potential SOC with a drop in second half of bitperiod";
	246	break;
	247	case 0x03:
	248	crc = "[3] Segment Z after segment X is not possible";
	249	break;
	250	case 0x04:
	251	crc = "[4] Parity bit of a fully received byte was wrong";
	252	break;
	253	default:
	254	crc = "[?] Unknown error";
255	break;
256	}
257	break;
258	}*/
259	}
260
261	if (strlen(crc)==0) {
262	if(!isResponse && len == 4) {
263	// Rough guess that this is a command from the reader
264	// For iClass the command byte is not part of the CRC
265	ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
266	}
267	else {
268	// For other data.. CRC might not be applicable (UPDATE commands etc.)
269	ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
270	}
271	//printf("%1x %1x",(unsigned)b1,(unsigned)b2);
272	if (b1 != frame[len-2] \|\| b2 != frame[len-1]) {
273	crc = (isResponse & (len < 8)) ? "" : " !crc";
274	} else {
275	crc = "";
276	}
277	}
278	} else {
279	crc = ""; // SHORT
280	}
281
282	char metricString[100];
283	if (isResponse) {
284	sprintf(metricString, "%3d", metric);
285	} else {
286	strcpy(metricString, " ");
287	}
288
289	PrintAndLog(" +%7d: %s: %s %s %s",
290	(prev < 0 ? 0 : (timestamp - prev)),
291	metricString,
292	(isResponse ? "TAG" : " "), line, crc);
293
294	prev = timestamp;
295	i += (len + 9);
296	}
297	return 0;
298	}
299
cee5a30d	300	int CmdHFiClassSnoop(const char *Cmd)
	301	{
	302	UsbCommand c = {CMD_SNOOP_ICLASS};
	303	SendCommand(&c);
	304	return 0;
	305	}
6116c796	306	#define NUM_CSNS 15
1e262141	307	int CmdHFiClassSim(const char *Cmd)
	308	{
	309	uint8_t simType = 0;
	310	uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
	311
17cba269 MHS	312	if (strlen(Cmd)<1) {
	313	PrintAndLog("Usage: hf iclass sim [0 <CSN>] \| x");
	314	PrintAndLog(" options");
	315	PrintAndLog(" 0 <CSN> simulate the given CSN");
	316	PrintAndLog(" 1 simulate default CSN");
	317	PrintAndLog(" 2 iterate CSNs, gather MACs");
1e262141	318	PrintAndLog(" sample: hf iclass sim 0 031FEC8AF7FF12E0");
17cba269	319	PrintAndLog(" sample: hf iclass sim 2");
1e262141	320	return 0;
	321	}
	322
	323	simType = param_get8(Cmd, 0);
17cba269 MHS	324
	325	if(simType == 0)
	326	{
	327	if (param_gethex(Cmd, 1, CSN, 16)) {
	328	PrintAndLog("A CSN should consist of 16 HEX symbols");
	329	return 1;
	330	}
	331	PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
	332
	333	}
77abe781	334	if(simType > 2)
17cba269 MHS	335	{
	336	PrintAndLog("Undefined simptype %d", simType);
	337	return 1;
1e262141	338	}
17cba269	339	uint8_t numberOfCSNs=0;
1e262141	340
9f6e9d15 MHS	341	if(simType == 2)
9f6e9d15 MHS	342	{
6116c796	343	UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
9f6e9d15	344	UsbCommand resp = {0};
17cba269	345
6116c796	346	/uint8_t csns[8 NUM_CSNS] = {
77abe781 MHS	347	0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,
	348	0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,
	349	0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,
	350	0x17,0x12,0x01,0xfd,0xf7,0xff,0x12,0xe0 ,
	351	0xcd,0x56,0x01,0x7c,0x6f,0xff,0x12,0xe0 ,
	352	0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,
	353	0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,
	354	0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };
6116c796 MHS	355	*/
	356
	357	uint8_t csns[8*NUM_CSNS] = {
	358	0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
	359	0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
	360	0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
	361	0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
	362	0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
	363	0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
	364	0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
	365	0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
	366	0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
	367	0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
	368	0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
	369	0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
	370	0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
	371	0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
	372	0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
	373
	374	memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
9f6e9d15 MHS	375
	376	SendCommand(&c);
	377	if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
	378	PrintAndLog("Command timed out");
	379	return 0;
	380	}
1e262141	381
77abe781	382	uint8_t num_mac_responses = resp.arg[1];
6116c796	383	PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
9f6e9d15	384
6116c796	385	size_t datalen = NUM_CSNS*24;
9f6e9d15 MHS	386	/*
9f6e9d15 MHS	387	* Now, time to dump to file. We'll use this format:
77abe781	388	* <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15	389	* So, it should wind up as
77abe781 MHS	390	* 8 * 24 bytes.
	391	*
	392	* The returndata from the pm3 is on the following format
	393	* <4 byte NR><4 byte MAC>
	394	* CC are all zeroes, CSN is the same as was sent in
9f6e9d15	395	**/
77abe781 MHS	396	void* dump = malloc(datalen);
77abe781 MHS	397	memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15	398	uint8_t i = 0;
6116c796	399	for(i = 0 ; i < NUM_CSNS ; i++)
9f6e9d15	400	{
77abe781 MHS	401	memcpy(dump+i24, csns+i8,8); //CSN
	402	//8 zero bytes here...
	403	//Then comes NR_MAC (eight bytes from the response)
	404	memcpy(dump+i24+16,resp.d.asBytes+i8,8);
1e262141	405
9f6e9d15 MHS	406	}
9f6e9d15 MHS	407	/ Now, save to dumpfile /
77abe781 MHS	408	saveFile("iclass_mac_attack", "bin", dump,datalen);
77abe781 MHS	409	free(dump);
9f6e9d15 MHS	410	}else
	411	{
	412	UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
	413	memcpy(c.d.asBytes, CSN, 8);
	414	SendCommand(&c);
	415	}
1e262141	416
1e262141	417	return 0;
	418	}
	419
	420	int CmdHFiClassReader(const char *Cmd)
	421	{
aa41c605	422	UsbCommand c = {CMD_READER_ICLASS, {0}};
1e262141	423	SendCommand(&c);
aa41c605 MHS	424	UsbCommand resp;
	425	while(!ukbhit()){
	426	if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
	427	uint8_t isOK = resp.arg[0] & 0xff;
	428	uint8_t * data = resp.d.asBytes;
	429
	430	PrintAndLog("isOk:%02x", isOK);
	431
	432	if(isOK > 0)
	433	{
	434	PrintAndLog("CSN: %s",sprint_hex(data,8));
	435	}
	436	if(isOK >= 1)
	437	{
	438	PrintAndLog("CC: %s",sprint_hex(data+8,8));
	439	}else{
	440	PrintAndLog("No CC obtained");
	441	}
	442	} else {
	443	PrintAndLog("Command execute timeout");
	444	}
	445	}
1e262141	446
c3963755	447	return 0;
	448	}
	449
	450	int CmdHFiClassReader_Replay(const char *Cmd)
	451	{
	452	uint8_t readerType = 0;
	453	uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
	454
	455	if (strlen(Cmd)<1) {
	456	PrintAndLog("Usage: hf iclass replay <MAC>");
	457	PrintAndLog(" sample: hf iclass replay 00112233");
	458	return 0;
	459	}
	460
	461	if (param_gethex(Cmd, 0, MAC, 8)) {
	462	PrintAndLog("MAC must include 8 HEX symbols");
	463	return 1;
	464	}
	465
	466	UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
	467	memcpy(c.d.asBytes, MAC, 4);
	468	SendCommand(&c);
1e262141	469
	470	return 0;
	471	}
	472
a66fca86 AD	473	int CmdHFiClassReader_Dump(const char *Cmd)
	474	{
	475	uint8_t readerType = 0;
	476	uint8_t MAC[4]={0x00,0x00,0x00,0x00};
	477	uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	478	uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	479	uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
fecd8202	480	//uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
a66fca86	481	uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
9b82de75 MHS	482	uint8_t keytable[128] = {0};
	483	int elite = 0;
	484	uint8_t *used_key;
	485	int i;
fecd8202	486	if (strlen(Cmd)<1)
fecd8202	487	{
9b82de75 MHS	488	PrintAndLog("Usage: hf iclass dump <Key> [e]");
	489	PrintAndLog(" Key - A 16 byte master key");
	490	PrintAndLog(" e - If 'e' is specified, the key is interpreted as the 16 byte");
	491	PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
	492	PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
fecd8202	493	PrintAndLog(" sample: hf iclass dump 0011223344556677");
9b82de75 MHS	494
9b82de75 MHS	495
a66fca86 AD	496	return 0;
	497	}
	498
fecd8202	499	if (param_gethex(Cmd, 0, KEY, 16))
fecd8202	500	{
a66fca86 AD	501	PrintAndLog("KEY must include 16 HEX symbols");
	502	return 1;
	503	}
9b82de75 MHS	504
	505	if (param_getchar(Cmd, 1) == 'e')
	506	{
	507	PrintAndLog("Elite switch on");
	508	elite = 1;
	509
	510	//calc h2
	511	hash2(KEY, keytable);
9e28ee9f	512	printarr_human_readable("keytable", keytable, 128);
9b82de75 MHS	513
	514	}
	515
	516
aa41c605 MHS	517	UsbCommand c = {CMD_READER_ICLASS, {0}};
aa41c605 MHS	518	c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE;
26c0d833	519
fecd8202	520	SendCommand(&c);
	521
	522	UsbCommand resp;
90e278d3 MHS	523	uint8_t key_sel[8] = {0};
90e278d3 MHS	524	uint8_t key_sel_p[8] = { 0 };
26c0d833	525
fecd8202	526	if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
26c0d833 MHS	527	uint8_t isOK = resp.arg[0] & 0xff;
	528	uint8_t * data = resp.d.asBytes;
	529
26c0d833 MHS	530	memcpy(CSN,data,8);
26c0d833 MHS	531	memcpy(CCNR,data+8,8);
3ad48540	532
26c0d833	533	PrintAndLog("isOk:%02x", isOK);
a66fca86	534
aa41c605	535	if(isOK > 0)
26c0d833 MHS	536	{
	537	PrintAndLog("CSN: %s",sprint_hex(CSN,8));
	538	}
9b82de75	539	if(isOK > 1)
26c0d833	540	{
9b82de75 MHS	541	if(elite)
9b82de75 MHS	542	{
9b82de75 MHS	543	//Get the key index (hash1)
	544	uint8_t key_index[8] = {0};
	545
	546	hash1(CSN, key_index);
	547	printvar("hash1", key_index,8);
	548	for(i = 0; i < 8 ; i++)
	549	key_sel[i] = keytable[key_index[i]] & 0xFF;
	550	printvar("k_sel", key_sel,8);
	551	//Permute from iclass format to standard format
	552	permutekey_rev(key_sel,key_sel_p);
	553	used_key = key_sel_p;
	554	}else{
9e28ee9f MHS	555	//Perhaps this should also be permuted to std format?
	556	// Something like the code below? I have no std system
	557	// to test this with /Martin
	558
	559	//uint8_t key_sel_p[8] = { 0 };
	560	//permutekey_rev(KEY,key_sel_p);
	561	//used_key = key_sel_p;
	562
9b82de75 MHS	563	used_key = KEY;
	564
	565	}
9b82de75 MHS	566	printvar("Used key",used_key,8);
	567	diversifyKey(CSN,used_key, div_key);
	568	printvar("Div key", div_key, 8);
9e28ee9f	569	printvar("CC_NR:",CCNR,12);
74a38802	570	doMAC(CCNR,12,div_key, MAC);
9b82de75 MHS	571	printvar("MAC", MAC, 4);
9b82de75 MHS	572
26c0d833 MHS	573	UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
	574	memcpy(d.d.asBytes, MAC, 4);
	575	SendCommand(&d);
	576
	577	}else{
	578	PrintAndLog("Failed to obtain CC! Aborting");
	579	}
	580	} else {
	581	PrintAndLog("Command execute timeout");
	582	}
1e262141	583
	584	return 0;
	585	}
	586
fecd8202	587	int CmdHFiClass_iso14443A_write(const char *Cmd)
	588	{
	589	uint8_t readerType = 0;
	590	uint8_t MAC[4]={0x00,0x00,0x00,0x00};
	591	uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	592	uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	593	uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
fecd8202	594	uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
3ad48540	595
fecd8202	596	uint8_t blockNo=0;
	597	uint8_t bldata[8]={0};
	598
	599	if (strlen(Cmd)<3)
	600	{
	601	PrintAndLog("Usage: hf iclass write <Key> <Block> <Data>");
	602	PrintAndLog(" sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
	603	return 0;
	604	}
	605
	606	if (param_gethex(Cmd, 0, KEY, 16))
	607	{
	608	PrintAndLog("KEY must include 16 HEX symbols");
	609	return 1;
	610	}
	611
	612	blockNo = param_get8(Cmd, 1);
	613	if (blockNo>32)
	614	{
	615	PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
	616	return 1;
	617	}
	618	if (param_gethex(Cmd, 2, bldata, 8))
	619	{
	620	PrintAndLog("Block data must include 8 HEX symbols");
	621	return 1;
	622	}
	623
aa41c605	624	UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};
fecd8202	625	SendCommand(&c);
fecd8202	626	UsbCommand resp;
3ad48540	627
fecd8202	628	if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
	629	uint8_t isOK = resp.arg[0] & 0xff;
	630	uint8_t * data = resp.d.asBytes;
	631
	632	memcpy(CSN,data,8);
	633	memcpy(CCNR,data+8,8);
	634	PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
	635	PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
	636	PrintAndLog("isOk:%02x", isOK);
	637	} else {
	638	PrintAndLog("Command execute timeout");
	639	}
3ad48540 MHS	640
	641	diversifyKey(CSN,KEY, div_key);
	642
fecd8202	643	PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
74a38802	644	doMAC(CCNR, 12,div_key, MAC);
fecd8202	645
3ad48540 MHS	646	UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
	647	memcpy(c2.d.asBytes, bldata, 8);
	648	memcpy(c2.d.asBytes+8, MAC, 4);
	649	SendCommand(&c2);
a66fca86	650
fecd8202	651	if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
	652	uint8_t isOK = resp.arg[0] & 0xff;
	653	uint8_t * data = resp.d.asBytes;
	654
	655	if (isOK)
	656	PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
	657	else
	658	PrintAndLog("isOk:%02x", isOK);
	659	} else {
	660	PrintAndLog("Command execute timeout");
	661	}
a66fca86 AD	662	return 0;
	663	}
	664
c3963755	665
cee5a30d	666	static command_t CommandTable[] =
cee5a30d	667	{
fecd8202	668	{"help", CmdHelp, 1, "This help"},
	669	{"list", CmdHFiClassList, 0, "List iClass history"},
	670	{"snoop", CmdHFiClassSnoop, 0, "Eavesdrop iClass communication"},
	671	{"sim", CmdHFiClassSim, 0, "Simulate iClass tag"},
	672	{"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
	673	{"replay",CmdHFiClassReader_Replay, 0, "Read an iClass tag via Reply Attack"},
	674	{"dump", CmdHFiClassReader_Dump, 0, "Authenticate and Dump iClass tag"},
	675	{"write", CmdHFiClass_iso14443A_write, 0, "Authenticate and Write iClass block"},
cee5a30d	676	{NULL, NULL, 0, NULL}
	677	};
	678
	679	int CmdHFiClass(const char *Cmd)
	680	{
	681	CmdsParse(CommandTable, Cmd);
	682	return 0;
	683	}
	684
	685	int CmdHelp(const char *Cmd)
	686	{
	687	CmdsHelp(CommandTable);
	688	return 0;
	689	}