]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhficlass.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
fix typo
[proxmark3-svn] / client / cmdhficlass.c
CommitLineData
cee5a30d 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833 4// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// High frequency iClass commands
11//-----------------------------------------------------------------------------
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <string.h>
9f6e9d15 16#include <sys/stat.h>
cee5a30d 17#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18#include "data.h"
902cb3c0 19#include "proxmark3.h"
cee5a30d 20#include "ui.h"
21#include "cmdparser.h"
22#include "cmdhficlass.h"
23#include "common.h"
14006804 24#include "util.h"
17cba269 25#include "cmdmain.h"
a66fca86
AD		 26#include "loclass/des.h"
27#include "loclass/cipherutils.h"
28#include "loclass/cipher.h"
29#include "loclass/ikeys.h"
3ad48540
MHS		 30#include "loclass/elite_crack.h"
31#include "loclass/fileutils.h"
1defcf60 32#include "protocols.h"
caaf9618 33#include "usb_cmd.h"
aa53efc3 34#include "cmdhfmfu.h"
35
36#define llX PRIx64
cee5a30d 37
38static int CmdHelp(const char *Cmd);
39
aa53efc3 40#define ICLASS_KEYS_MAX 8
41static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
49 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
50};
51
52typedef struct iclass_block {
53 uint8_t d[8];
54} iclass_block_t;
55
4d68ec02 56int xorbits_8(uint8_t val) {
53444513
MHS		 57 uint8_t res = val ^ (val >> 1); //1st pass
58 res = res ^ (res >> 1); // 2nd pass
59 res = res ^ (res >> 2); // 3rd pass
60 res = res ^ (res >> 4); // 4th pass
61 return res & 1;
17cba269
MHS		 62}
63
4d68ec02 64int CmdHFiClassList(const char *Cmd) {
4c3de57a 65 PrintAndLog("Deprecated command, use 'hf list iclass' instead");
17cba269
MHS		 66 return 0;
67}
68
4d68ec02 69int CmdHFiClassSnoop(const char *Cmd) {
53444513
MHS		 70 UsbCommand c = {CMD_SNOOP_ICLASS};
71 SendCommand(&c);
72 return 0;
cee5a30d 73}
4d68ec02 74
75int usage_hf_iclass_sim(void) {
41524d8a
MHS		 76 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
77 PrintAndLog(" options");
78 PrintAndLog(" 0 <CSN> simulate the given CSN");
79 PrintAndLog(" 1 simulate default CSN");
80 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
81 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
82 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
83 PrintAndLog(" example: hf iclass sim 2");
84 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
85 PrintAndLog(" hf iclass sim 3");
86 return 0;
87}
88
6116c796 89#define NUM_CSNS 15
4d68ec02 90int CmdHFiClassSim(const char *Cmd) {
53444513
MHS		 91 uint8_t simType = 0;
92 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
93
94 if (strlen(Cmd)<1) {
1defcf60 95 return usage_hf_iclass_sim();
53444513 96 }
1defcf60 97 simType = param_get8ex(Cmd, 0, 0, 10);
53444513
MHS		 98
99 if(simType == 0)
100 {
101 if (param_gethex(Cmd, 1, CSN, 16)) {
102 PrintAndLog("A CSN should consist of 16 HEX symbols");
41524d8a 103 return usage_hf_iclass_sim();
53444513 104 }
53444513 105
41524d8a 106 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
53444513 107 }
41524d8a 108 if(simType > 3)
53444513
MHS		 109 {
110 PrintAndLog("Undefined simptype %d", simType);
41524d8a 111 return usage_hf_iclass_sim();
53444513 112 }
1e262141 113
41524d8a 114 uint8_t numberOfCSNs=0;
9f6e9d15
MHS		 115 if(simType == 2)
116 {
6116c796 117 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
9f6e9d15 118 UsbCommand resp = {0};
17cba269 119
53444513
MHS		 120 uint8_t csns[8*NUM_CSNS] = {
121 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
6116c796
MHS		 136
137 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
9f6e9d15
MHS		 138
139 SendCommand(&c);
140 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
141 PrintAndLog("Command timed out");
142 return 0;
143 }
1e262141 144
77abe781 145 uint8_t num_mac_responses = resp.arg[1];
6116c796 146 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
9f6e9d15 147
6116c796 148 size_t datalen = NUM_CSNS*24;
9f6e9d15
MHS		 149 /*
150 * Now, time to dump to file. We'll use this format:
77abe781 151 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15 152 * So, it should wind up as
77abe781
MHS		 153 * 8 * 24 bytes.
154 *
155 * The returndata from the pm3 is on the following format
156 * <4 byte NR><4 byte MAC>
157 * CC are all zeroes, CSN is the same as was sent in
9f6e9d15 158 **/
77abe781
MHS		 159 void* dump = malloc(datalen);
160 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15 161 uint8_t i = 0;
6116c796 162 for(i = 0 ; i < NUM_CSNS ; i++)
9f6e9d15 163 {
77abe781
MHS		 164 memcpy(dump+i*24, csns+i*8,8); //CSN
165 //8 zero bytes here...
166 //Then comes NR_MAC (eight bytes from the response)
167 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
1e262141 168
9f6e9d15
MHS		 169 }
170 /** Now, save to dumpfile **/
77abe781
MHS		 171 saveFile("iclass_mac_attack", "bin", dump,datalen);
172 free(dump);
9f6e9d15
MHS		 173 }else
174 {
175 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
176 memcpy(c.d.asBytes, CSN, 8);
177 SendCommand(&c);
178 }
1e262141 179
53444513 180 return 0;
1e262141 181}
182
4d68ec02 183int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
6ce0e538 184 bool tagFound = false;
caaf9618
MHS		 185 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
186 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
aa53efc3 187 // loop in client not device - else on windows have a communication error
188 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
53444513
MHS		 189 UsbCommand resp;
190 while(!ukbhit()){
aa53efc3 191 SendCommand(&c);
6ce0e538 192 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
193 uint8_t readStatus = resp.arg[0] & 0xff;
194 uint8_t *data = resp.d.asBytes;
53444513 195
6ce0e538 196 if (verbose)
197 PrintAndLog("Readstatus:%02x", readStatus);
caaf9618 198 if( readStatus == 0){
53444513 199 //Aborted
6ce0e538 200 if (verbose) PrintAndLog("Quitting...");
53444513
MHS		 201 return 0;
202 }
6ce0e538 203 if( readStatus & FLAG_ICLASS_READER_CSN){
204 PrintAndLog("CSN: %s",sprint_hex(data,8));
205 tagFound = true;
206 }
caaf9618
MHS		 207 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
208 if( readStatus & FLAG_ICLASS_READER_CONF){
209 printIclassDumpInfo(data);
53444513 210 }
6ce0e538 211 if (tagFound && !loop) return 1;
53444513 212 } else {
6ce0e538 213 if (verbose) PrintAndLog("Command execute timeout");
53444513 214 }
6ce0e538 215 if (!loop) break;
53444513 216 }
53444513 217 return 0;
6ce0e538 218}
219
4d68ec02 220int CmdHFiClassReader(const char *Cmd) {
6ce0e538 221 return HFiClassReader(Cmd, true, true);
c3963755 222}
223
4d68ec02 224int CmdHFiClassReader_Replay(const char *Cmd) {
53444513
MHS		 225 uint8_t readerType = 0;
226 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
c3963755 227
53444513
MHS		 228 if (strlen(Cmd)<1) {
229 PrintAndLog("Usage: hf iclass replay <MAC>");
230 PrintAndLog(" sample: hf iclass replay 00112233");
231 return 0;
232 }
c3963755 233
53444513
MHS		 234 if (param_gethex(Cmd, 0, MAC, 8)) {
235 PrintAndLog("MAC must include 8 HEX symbols");
236 return 1;
237 }
c3963755 238
53444513
MHS		 239 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
240 memcpy(c.d.asBytes, MAC, 4);
241 SendCommand(&c);
1e262141 242
53444513 243 return 0;
1e262141 244}
245
4d68ec02 246int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
247 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
248 memcpy(c.d.asBytes, data, blocksCount * 16);
249 SendCommand(&c);
250 return 0;
251}
252
253int hf_iclass_eload_usage(void) {
7781a656
MHS		 254 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
255 PrintAndLog("Usage: hf iclass eload f <filename>");
256 PrintAndLog("");
257 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
258 return 0;
7781a656
MHS		 259}
260
4d68ec02 261int CmdHFiClassELoad(const char *Cmd) {
7781a656
MHS		 262
263 char opt = param_getchar(Cmd, 0);
264 if (strlen(Cmd)<1 || opt == 'h')
265 return hf_iclass_eload_usage();
266
267 //File handling and reading
268 FILE *f;
269 char filename[FILE_PATH_SIZE];
270 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
271 {
272 f = fopen(filename, "rb");
273 }else{
274 return hf_iclass_eload_usage();
275 }
276
277 if(!f) {
278 PrintAndLog("Failed to read from file '%s'", filename);
279 return 1;
280 }
281
282 fseek(f, 0, SEEK_END);
283 long fsize = ftell(f);
284 fseek(f, 0, SEEK_SET);
285
286 uint8_t *dump = malloc(fsize);
1defcf60
MHS		 287
288
7781a656
MHS		 289 size_t bytes_read = fread(dump, 1, fsize, f);
290 fclose(f);
291
1defcf60 292 printIclassDumpInfo(dump);
7781a656
MHS		 293 //Validate
294
295 if (bytes_read < fsize)
296 {
297 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
298 free(dump);
299 return 1;
300 }
301 //Send to device
302 uint32_t bytes_sent = 0;
303 uint32_t bytes_remaining = bytes_read;
304
305 while(bytes_remaining > 0){
306 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
307 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
308 memcpy(c.d.asBytes, dump, bytes_in_packet);
309 SendCommand(&c);
310 bytes_remaining -= bytes_in_packet;
311 bytes_sent += bytes_in_packet;
312 }
313 free(dump);
314 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
315 return 0;
316}
317
4d68ec02 318static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
41524d8a
MHS		 319 FILE *f = fopen(filename, "rb");
320 if(!f) {
321 PrintAndLog("Failed to read from file '%s'", filename);
322 return 1;
323 }
324 fseek(f, 0, SEEK_END);
325 long fsize = ftell(f);
326 fseek(f, 0, SEEK_SET);
327 size_t bytes_read = fread(buffer, 1, len, f);
328 fclose(f);
329 if(fsize != len)
330 {
331 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
332 return 1;
333 }
334 if(bytes_read != len)
335 {
336 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
337 return 1;
338 }
339 return 0;
340}
341
4d68ec02 342int usage_hf_iclass_decrypt(void) {
343 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
aa53efc3 344 PrintAndLog("");
345 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
346 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
347 PrintAndLog("");
348 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
349 PrintAndLog("");
350 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
351 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
352 PrintAndLog("which is defined by the configuration block.");
353 return 1;
354}
355
4d68ec02 356int CmdHFiClassDecrypt(const char *Cmd) {
41524d8a
MHS		 357 uint8_t key[16] = { 0 };
358 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
359 {
360 usage_hf_iclass_decrypt();
361 return 1;
362 }
363 PrintAndLog("Decryption file found... ");
364 char opt = param_getchar(Cmd, 0);
365 if (strlen(Cmd)<1 || opt == 'h')
366 return usage_hf_iclass_decrypt();
367
368 //Open the tagdump-file
369 FILE *f;
370 char filename[FILE_PATH_SIZE];
371 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
372 {
373 f = fopen(filename, "rb");
374 }else{
375 return usage_hf_iclass_decrypt();
376 }
377
378 fseek(f, 0, SEEK_END);
379 long fsize = ftell(f);
380 fseek(f, 0, SEEK_SET);
381 uint8_t enc_dump[8] = {0};
382 uint8_t *decrypted = malloc(fsize);
383 des3_context ctx = { DES_DECRYPT ,{ 0 } };
384 des3_set2key_dec( &ctx, key);
385 size_t bytes_read = fread(enc_dump, 1, 8, f);
386
387 //Use the first block (CSN) for filename
388 char outfilename[FILE_PATH_SIZE] = { 0 };
389 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
390 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
391 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
392
393 size_t blocknum =0;
394 while(bytes_read == 8)
395 {
9a9bcea8 396 if(blocknum < 7)
41524d8a
MHS		 397 {
398 memcpy(decrypted+(blocknum*8), enc_dump, 8);
399 }else{
400 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
401 }
402 printvar("decrypted block", decrypted +(blocknum*8), 8);
403 bytes_read = fread(enc_dump, 1, 8, f);
404 blocknum++;
405 }
406 fclose(f);
407
408 saveFile(outfilename,"bin", decrypted, blocknum*8);
409
410 return 0;
411}
7781a656 412
4d68ec02 413int usage_hf_iclass_encrypt(void) {
aa53efc3 414 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
415 PrintAndLog("");
416 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
417 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
418 PrintAndLog("");
419 PrintAndLog("example: hf iclass encrypt 0102030405060708");
420 PrintAndLog("");
421 return 0;
422}
423
4d68ec02 424static int iClassEncryptBlkData(uint8_t *blkData) {
aa53efc3 425 uint8_t key[16] = { 0 };
426 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
427 {
428 usage_hf_iclass_encrypt();
429 return 1;
430 }
431 PrintAndLog("Decryption file found... ");
53444513 432
4d68ec02 433 uint8_t encryptedData[16];
434 uint8_t *encrypted = encryptedData;
aa53efc3 435 des3_context ctx = { DES_DECRYPT ,{ 0 } };
436 des3_set2key_enc( &ctx, key);
437
4d68ec02 438 des3_crypt_ecb(&ctx, blkData,encrypted);
aa53efc3 439 //printvar("decrypted block", decrypted, 8);
4d68ec02 440 memcpy(blkData,encrypted,8);
aa53efc3 441
442 return 1;
443}
444
4d68ec02 445int CmdHFiClassEncryptBlk(const char *Cmd) {
aa53efc3 446 uint8_t blkData[8] = {0};
447 char opt = param_getchar(Cmd, 0);
448 if (strlen(Cmd)<1 || opt == 'h')
449 return usage_hf_iclass_encrypt();
53444513 450
aa53efc3 451 //get the bytes to encrypt
452 if (param_gethex(Cmd, 0, blkData, 16))
53444513 453 {
aa53efc3 454 PrintAndLog("BlockData must include 16 HEX symbols");
53444513
MHS		 455 return 0;
456 }
aa53efc3 457 if (!iClassEncryptBlkData(blkData)) return 0;
53444513 458
aa53efc3 459 printvar("encrypted block", blkData, 8);
460 return 1;
461}
53444513 462
4d68ec02 463void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
aa53efc3 464 uint8_t WB[9];
465 WB[0] = blockno;
466 memcpy(WB + 1,data,8);
467 doMAC_N(WB,sizeof(WB),div_key,MAC);
468 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
469}
53444513 470
4d68ec02 471static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
53444513
MHS		 472 UsbCommand resp;
473
aa53efc3 474 UsbCommand c = {CMD_READER_ICLASS, {0}};
3ac22ee1 475 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
aa53efc3 476 if (use_credit_key)
477 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
53444513 478
aa53efc3 479 clearCommandBuffer();
480 SendCommand(&c);
481 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
482 {
53444513 483 PrintAndLog("Command execute timeout");
aa53efc3 484 return false;
53444513
MHS		 485 }
486
aa53efc3 487 uint8_t isOK = resp.arg[0] & 0xff;
488 uint8_t *data = resp.d.asBytes;
53444513 489
aa53efc3 490 memcpy(CSN,data,8);
491 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
aa53efc3 492 if(isOK > 0)
493 {
494 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
53444513 495 }
aa53efc3 496 if(isOK <= 1){
497 PrintAndLog("Failed to obtain CC! Aborting");
498 return false;
499 }
500 return true;
a66fca86 501}
6f101995 502
aa53efc3 503static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool verbose) {
504 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
505 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
aa53efc3 506
507 if (!select_only(CSN, CCNR, use_credit_key, verbose))
508 return false;
509
4d68ec02 510 //get div_key
511 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
512
aa53efc3 513 doMAC(CCNR, div_key, MAC);
aa53efc3 514 UsbCommand resp;
515 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
516 memcpy(d.d.asBytes, MAC, 4);
517 clearCommandBuffer();
518 SendCommand(&d);
519 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
520 {
521 PrintAndLog("Auth Command execute timeout");
522 return false;
523 }
524 uint8_t isOK = resp.arg[0] & 0xff;
525 if (!isOK) {
526 PrintAndLog("Authentication error");
527 return false;
528 }
529 return true;
530}
531
4d68ec02 532int usage_hf_iclass_dump(void) {
aa53efc3 533 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e\n");
534 PrintAndLog("Options:");
535 PrintAndLog(" f <filename> : specify a filename to save dump to");
536 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
537 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
538 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
539 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
540 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
541 PrintAndLog(" NOTE: * = required");
542 PrintAndLog("Samples:");
543 PrintAndLog(" hf iclass dump k 001122334455667B");
544 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
545 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
546 return 0;
547}
548
4d68ec02 549int CmdHFiClassReader_Dump(const char *Cmd) {
aa53efc3 550
551 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
552 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
553 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
554 uint8_t blockno = 0;
555 uint8_t numblks = 0;
4d68ec02 556 uint8_t maxBlk = 31;
aa53efc3 557 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
558 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
559 uint8_t keyNbr = 0;
560 uint8_t dataLen = 0;
561 uint8_t fileNameLen = 0;
562 char filename[FILE_PATH_SIZE]={0};
563 char tempStr[50] = {0};
4d68ec02 564 bool have_debit_key = false;
aa53efc3 565 bool have_credit_key = false;
4d68ec02 566 bool use_credit_key = false;
aa53efc3 567 bool elite = false;
568 bool errors = false;
569 uint8_t cmdp = 0;
570
571 while(param_getchar(Cmd, cmdp) != 0x00)
572 {
573 switch(param_getchar(Cmd, cmdp))
574 {
575 case 'h':
576 case 'H':
577 return usage_hf_iclass_dump();
578 case 'c':
579 case 'C':
580 have_credit_key = true;
581 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
582 if (dataLen == 16) {
583 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
584 } else if (dataLen == 1) {
585 keyNbr = param_get8(Cmd, cmdp+1);
586 if (keyNbr <= ICLASS_KEYS_MAX) {
587 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
588 } else {
589 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
590 errors = true;
591 }
592 } else {
593 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
594 errors = true;
595 }
596 cmdp += 2;
597 break;
598 case 'e':
599 case 'E':
600 elite = true;
601 cmdp++;
602 break;
603 case 'f':
604 case 'F':
605 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
606 if (fileNameLen < 1) {
607 PrintAndLog("No filename found after f");
608 errors = true;
609 }
610 cmdp += 2;
611 break;
612 case 'k':
613 case 'K':
4d68ec02 614 have_debit_key = true;
aa53efc3 615 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
616 if (dataLen == 16) {
617 errors = param_gethex(tempStr, 0, KEY, dataLen);
618 } else if (dataLen == 1) {
619 keyNbr = param_get8(Cmd, cmdp+1);
620 if (keyNbr <= ICLASS_KEYS_MAX) {
621 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
622 } else {
623 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
624 errors = true;
625 }
626 } else {
627 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
628 errors = true;
629 }
630 cmdp += 2;
631 break;
632 default:
633 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
634 errors = true;
635 break;
636 }
637 if(errors) return usage_hf_iclass_dump();
638 }
639
640 if (cmdp < 2) return usage_hf_iclass_dump();
4d68ec02 641 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
642 if (!have_debit_key && have_credit_key) use_credit_key = true;
aa53efc3 643
644 //get config and first 3 blocks
645 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
646 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
647 UsbCommand resp;
648 uint8_t tag_data[255*8];
4d68ec02 649
aa53efc3 650 clearCommandBuffer();
651 SendCommand(&c);
4d68ec02 652 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
aa53efc3 653 PrintAndLog("Command execute timeout");
3ac22ee1 654 ul_switch_off_field();
aa53efc3 655 return 0;
656 }
4d68ec02 657 uint8_t readStatus = resp.arg[0] & 0xff;
658 uint8_t *data = resp.d.asBytes;
659
660 if(readStatus == 0){
661 PrintAndLog("No tag found...");
3ac22ee1 662 ul_switch_off_field();
4d68ec02 663 return 0;
664 }
665 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
666 memcpy(tag_data, data, 8*3);
667 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
668 numblks = data[8];
aa53efc3 669
4d68ec02 670 if (data[13] & 0x80) {
671 // large memory - not able to dump pages currently
672 maxBlk = 255;
673 } else {
674 maxBlk = 31;
675 }
676 if (numblks > maxBlk) numblks = maxBlk;
677 }
3ac22ee1 678 ul_switch_off_field();
4d68ec02 679 // authenticate debit key and get div_key - later store in dump block 3
680 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
aa53efc3 681 //try twice - for some reason it sometimes fails the first time...
4d68ec02 682 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
aa53efc3 683 ul_switch_off_field();
684 return 0;
685 }
686 }
aa53efc3 687
4d68ec02 688 // begin dump
3ac22ee1 689 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
aa53efc3 690 clearCommandBuffer();
691 SendCommand(&w);
692 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
693 PrintAndLog("Command execute time-out 1");
3ac22ee1 694 ul_switch_off_field();
aa53efc3 695 return 1;
696 }
697 uint32_t blocksRead = resp.arg[1];
698 uint8_t isOK = resp.arg[0] & 0xff;
699 if (!isOK && !blocksRead) {
700 PrintAndLog("Read Block Failed");
3ac22ee1 701 ul_switch_off_field();
aa53efc3 702 return 0;
703 }
704 uint32_t startindex = resp.arg[2];
705 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
706 PrintAndLog("Data exceeded Buffer size!");
707 blocksRead = (sizeof(tag_data)/8) - blockno;
708 }
4d68ec02 709 // response ok - now get bigbuf content of the dump
aa53efc3 710 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
711 WaitForResponse(CMD_ACK,NULL);
4d68ec02 712 size_t gotBytes = blocksRead*8 + blockno*8;
aa53efc3 713
4d68ec02 714 // try AA2
715 if (have_credit_key) {
716 //turn off hf field before authenticating with different key
aa53efc3 717 ul_switch_off_field();
aa53efc3 718 memset(MAC,0,4);
4d68ec02 719 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
aa53efc3 720 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
721 //try twice - for some reason it sometimes fails the first time...
722 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
723 ul_switch_off_field();
724 return 0;
725 }
726 }
4d68ec02 727 // do we still need to read more block? (aa2 enabled?)
728 if (maxBlk > blockno+numblks+1) {
729 // setup dump and start
730 w.arg[0] = blockno + blocksRead;
731 w.arg[1] = maxBlk - (blockno + blocksRead);
4d68ec02 732 clearCommandBuffer();
733 SendCommand(&w);
734 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
735 PrintAndLog("Command execute timeout 2");
3ac22ee1 736 ul_switch_off_field();
4d68ec02 737 return 0;
738 }
739 uint8_t isOK = resp.arg[0] & 0xff;
740 blocksRead = resp.arg[1];
741 if (!isOK && !blocksRead) {
742 PrintAndLog("Read Block Failed 2");
3ac22ee1 743 ul_switch_off_field();
4d68ec02 744 return 0;
745 }
aa53efc3 746
4d68ec02 747 startindex = resp.arg[2];
748 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
749 PrintAndLog("Data exceeded Buffer size!");
750 blocksRead = (sizeof(tag_data) - gotBytes)/8;
751 }
752 // get dumped data from bigbuf
753 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
754 WaitForResponse(CMD_ACK,NULL);
aa53efc3 755
4d68ec02 756 gotBytes += blocksRead*8;
757 } else { //field is still on - turn it off...
758 ul_switch_off_field();
759 }
aa53efc3 760 }
761
4d68ec02 762 // add diversified keys to dump
763 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
764 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
765 // print the dump
766 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
767 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
768 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
aa53efc3 769
aa53efc3 770 if (filename[0] == 0){
771 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
772 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
773 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
774 }
4d68ec02 775
776 // save the dump to .bin file
aa53efc3 777 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
4d68ec02 778 saveFile(filename, "bin", tag_data, gotBytes);
aa53efc3 779 return 1;
780}
781
4d68ec02 782static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool verbose) {
aa53efc3 783 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
784 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
aa53efc3 785 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, verbose))
786 return 0;
787
788 UsbCommand resp;
789
790 Calc_wb_mac(blockno,bldata,div_key,MAC);
3ac22ee1 791 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
aa53efc3 792 memcpy(w.d.asBytes, bldata, 8);
3ac22ee1 793 memcpy(w.d.asBytes + 8, MAC, 4);
aa53efc3 794
795 clearCommandBuffer();
796 SendCommand(&w);
797 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
798 {
799 PrintAndLog("Write Command execute timeout");
800 return 0;
801 }
802 uint8_t isOK = resp.arg[0] & 0xff;
803 if (!isOK) {
804 PrintAndLog("Write Block Failed");
805 return 0;
806 }
807 PrintAndLog("Write Block Successful");
aa53efc3 808 return 1;
809}
810
4d68ec02 811int usage_hf_iclass_writeblock(void) {
aa53efc3 812 PrintAndLog("Options:");
813 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
814 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
815 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
816 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
817 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
818 PrintAndLog("Samples:");
819 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
820 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
821 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
822 return 0;
823}
824
825int CmdHFiClass_WriteBlock(const char *Cmd) {
826 uint8_t blockno=0;
3ac22ee1 827 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
aa53efc3 828 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
829 uint8_t keyNbr = 0;
830 uint8_t dataLen = 0;
831 char tempStr[50] = {0};
832 bool use_credit_key = false;
833 bool elite = false;
834 bool errors = false;
835 uint8_t cmdp = 0;
836 while(param_getchar(Cmd, cmdp) != 0x00)
837 {
838 switch(param_getchar(Cmd, cmdp))
839 {
840 case 'h':
841 case 'H':
842 return usage_hf_iclass_writeblock();
843 case 'b':
844 case 'B':
845 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
846 PrintAndLog("Block No must include 2 HEX symbols\n");
847 errors = true;
848 }
849 cmdp += 2;
850 break;
851 case 'c':
852 case 'C':
853 use_credit_key = true;
854 cmdp++;
855 break;
856 case 'd':
857 case 'D':
858 if (param_gethex(Cmd, cmdp+1, bldata, 16))
859 {
860 PrintAndLog("KEY must include 16 HEX symbols\n");
861 errors = true;
862 }
863 cmdp += 2;
864 break;
865 case 'e':
866 case 'E':
867 elite = true;
868 cmdp++;
869 break;
870 case 'k':
871 case 'K':
872 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
873 if (dataLen == 16) {
874 errors = param_gethex(tempStr, 0, KEY, dataLen);
875 } else if (dataLen == 1) {
876 keyNbr = param_get8(Cmd, cmdp+1);
877 if (keyNbr <= ICLASS_KEYS_MAX) {
878 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
879 } else {
880 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
881 errors = true;
882 }
883 } else {
884 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
885 errors = true;
886 }
887 cmdp += 2;
888 break;
889 default:
890 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
891 errors = true;
892 break;
893 }
894 if(errors) return usage_hf_iclass_writeblock();
895 }
896
897 if (cmdp < 6) return usage_hf_iclass_writeblock();
3ac22ee1 898 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, true);
899 ul_switch_off_field();
900 return ans;
aa53efc3 901}
902
4d68ec02 903int usage_hf_iclass_clone(void) {
aa53efc3 904 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> e c");
905 PrintAndLog("Options:");
906 PrintAndLog(" f <filename>: specify a filename to clone from");
907 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
908 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
909 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
910 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
911 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
912 PrintAndLog("Samples:");
913 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
914 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
915 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
916 return -1;
917}
918
919int CmdHFiClassCloneTag(const char *Cmd) {
920 char filename[FILE_PATH_SIZE];
921 char tempStr[50]={0};
922 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
923 uint8_t keyNbr = 0;
924 uint8_t fileNameLen = 0;
925 uint8_t startblock = 0;
926 uint8_t endblock = 0;
927 uint8_t dataLen = 0;
928 bool use_credit_key = false;
929 bool elite = false;
930 bool errors = false;
931 uint8_t cmdp = 0;
932 while(param_getchar(Cmd, cmdp) != 0x00)
933 {
934 switch(param_getchar(Cmd, cmdp))
935 {
936 case 'h':
937 case 'H':
938 return usage_hf_iclass_clone();
939 case 'b':
940 case 'B':
941 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
942 PrintAndLog("Start Block No must include 2 HEX symbols\n");
943 errors = true;
944 }
945 cmdp += 2;
946 break;
947 case 'c':
948 case 'C':
949 use_credit_key = true;
950 cmdp++;
951 break;
952 case 'e':
953 case 'E':
954 elite = true;
955 cmdp++;
956 break;
957 case 'f':
958 case 'F':
959 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
960 if (fileNameLen < 1) {
961 PrintAndLog("No filename found after f");
962 errors = true;
963 }
964 cmdp += 2;
965 break;
966 case 'k':
967 case 'K':
968 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
969 if (dataLen == 16) {
970 errors = param_gethex(tempStr, 0, KEY, dataLen);
971 } else if (dataLen == 1) {
972 keyNbr = param_get8(Cmd, cmdp+1);
973 if (keyNbr <= ICLASS_KEYS_MAX) {
974 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
975 } else {
976 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
977 errors = true;
978 }
979 } else {
980 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
981 errors = true;
982 }
983 cmdp += 2;
984 break;
985 case 'l':
986 case 'L':
987 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
988 PrintAndLog("Start Block No must include 2 HEX symbols\n");
989 errors = true;
990 }
991 cmdp += 2;
992 break;
993 default:
994 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
995 errors = true;
996 break;
997 }
998 if(errors) return usage_hf_iclass_clone();
999 }
1000
1001 if (cmdp < 8) return usage_hf_iclass_clone();
1002
1003 FILE *f;
1004
1005 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1006
1007 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1008 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1009 }
1010 // file handling and reading
1011 f = fopen(filename,"rb");
1012 if(!f) {
1013 PrintAndLog("Failed to read from file '%s'", filename);
1014 return 1;
1015 }
1016
1017 if (startblock<5) {
1018 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1019 return 0;
1020 }
1021 // now read data from the file from block 6 --- 19
1022 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1023 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1024 // else we have to create a share memory
1025 int i;
1026 fseek(f,startblock*8,SEEK_SET);
1027 fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f);
aa53efc3 1028
1029 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1030 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1031
1032 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, true))
1033 return 0;
1034
3ac22ee1 1035 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
aa53efc3 1036 uint8_t *ptr;
1037 // calculate all mac for every the block we will write
1038 for (i = startblock; i <= endblock; i++){
1039 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1040 // usb command d start pointer = d + (i - 6) * 12
1041 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1042 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1043 // next one
1044 ptr = w.d.asBytes + (i - startblock) * 12;
1045 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1046 memcpy(ptr + 8,MAC, 4);
1047 }
1048 uint8_t p[12];
1049 for (i = 0; i <= endblock - startblock;i++){
1050 memcpy(p,w.d.asBytes + (i * 12),12);
4d68ec02 1051 printf("Block |%02x|",i + startblock);
1052 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1053 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
aa53efc3 1054 }
1055 UsbCommand resp;
1056 SendCommand(&w);
1057 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1058 {
1059 PrintAndLog("Command execute timeout");
1060 return 0;
1061 }
1062 return 1;
1063}
1064
4d68ec02 1065static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool verbose) {
aa53efc3 1066 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1067 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1068
1069 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, verbose))
1070 return 0;
1071
1072 UsbCommand resp;
3ac22ee1 1073 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
aa53efc3 1074 clearCommandBuffer();
1075 SendCommand(&w);
1076 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1077 {
1078 PrintAndLog("Command execute timeout");
1079 return 0;
1080 }
1081 uint8_t isOK = resp.arg[0] & 0xff;
1082 if (!isOK) {
1083 PrintAndLog("Read Block Failed");
1084 return 0;
1085 }
1086 //data read is stored in: resp.d.asBytes[0-15]
1087 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1088 return 1;
1089}
1090
4d68ec02 1091int usage_hf_iclass_readblock(void) {
aa53efc3 1092 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e\n");
1093 PrintAndLog("Options:");
1094 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1095 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1096 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1097 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1098 PrintAndLog("Samples:");
1099 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1100 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1101 PrintAndLog(" hf iclass readblk b 0A k 0");
1102 return 0;
1103}
1104
4d68ec02 1105int CmdHFiClass_ReadBlock(const char *Cmd) {
aa53efc3 1106 uint8_t blockno=0;
1107 uint8_t keyType = 0x88; //debit key
1108 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1109 uint8_t keyNbr = 0;
1110 uint8_t dataLen = 0;
1111 char tempStr[50] = {0};
1112 bool elite = false;
1113 bool errors = false;
1114 uint8_t cmdp = 0;
1115 while(param_getchar(Cmd, cmdp) != 0x00)
1116 {
1117 switch(param_getchar(Cmd, cmdp))
1118 {
1119 case 'h':
1120 case 'H':
1121 return usage_hf_iclass_readblock();
1122 case 'b':
1123 case 'B':
1124 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1125 PrintAndLog("Block No must include 2 HEX symbols\n");
1126 errors = true;
1127 }
1128 cmdp += 2;
1129 break;
1130 case 'c':
1131 case 'C':
1132 keyType = 0x18;
1133 cmdp++;
1134 break;
1135 case 'e':
1136 case 'E':
1137 elite = true;
1138 cmdp++;
1139 break;
1140 case 'k':
1141 case 'K':
1142 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1143 if (dataLen == 16) {
1144 errors = param_gethex(tempStr, 0, KEY, dataLen);
1145 } else if (dataLen == 1) {
1146 keyNbr = param_get8(Cmd, cmdp+1);
1147 if (keyNbr <= ICLASS_KEYS_MAX) {
1148 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1149 } else {
1150 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1151 errors = true;
1152 }
1153 } else {
1154 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1155 errors = true;
1156 }
1157 cmdp += 2;
1158 break;
1159 default:
1160 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1161 errors = true;
1162 break;
1163 }
1164 if(errors) return usage_hf_iclass_readblock();
1165 }
1166
1167 if (cmdp < 4) return usage_hf_iclass_readblock();
4d68ec02 1168
aa53efc3 1169 return ReadBlock(KEY, blockno, keyType, elite, true);
1170}
1171
4d68ec02 1172int CmdHFiClass_loclass(const char *Cmd) {
aa53efc3 1173 char opt = param_getchar(Cmd, 0);
1174
1175 if (strlen(Cmd)<1 || opt == 'h') {
1176 PrintAndLog("Usage: hf iclass loclass [options]");
1177 PrintAndLog("Options:");
1178 PrintAndLog("h Show this help");
6f101995
MHS		 1179 PrintAndLog("t Perform self-test");
1180 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1181 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1182 PrintAndLog(" malicious CSNs, and their protocol responses");
1183 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1184 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1185 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1186 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1187 PrintAndLog(" ... totalling N*24 bytes");
1188 return 0;
1189 }
1190 char fileName[255] = {0};
1191 if(opt == 'f')
1192 {
53444513
MHS		 1193 if(param_getstr(Cmd, 1, fileName) > 0)
1194 {
1195 return bruteforceFileNoKeys(fileName);
1196 }else
1197 {
1198 PrintAndLog("You must specify a filename");
1199 }
6f101995
MHS		 1200 }
1201 else if(opt == 't')
1202 {
1203 int errors = testCipherUtils();
1204 errors += testMAC();
1205 errors += doKeyTests(0);
1206 errors += testElite();
1207 if(errors)
1208 {
1209 prnlog("OBS! There were errors!!!");
1210 }
1211 return errors;
1212 }
a66fca86 1213
6f101995
MHS		 1214 return 0;
1215}
c3963755 1216
4d68ec02 1217void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
aa53efc3 1218 uint8_t blockdata[8];
1219 uint8_t mem_config;
1220 memcpy(&mem_config, iclass_dump + 13,1);
1221 uint8_t maxmemcount;
1222 uint8_t filemaxblock = filesize / 8;
4d68ec02 1223 if (mem_config & 0x80)
aa53efc3 1224 maxmemcount = 255;
1225 else
4d68ec02 1226 maxmemcount = 31;
1227 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
aa53efc3 1228
1229 if (startblock == 0)
1230 startblock = 6;
1231 if ((endblock > maxmemcount) || (endblock == 0))
1232 endblock = maxmemcount;
1233 if (endblock > filemaxblock)
1234 endblock = filemaxblock;
1235 int i = startblock;
1236 int j;
4d68ec02 1237 while (i <= endblock){
1238 printf("Block |%02X| ",i);
aa53efc3 1239 memcpy(blockdata,iclass_dump + (i * 8),8);
1240 for (j = 0;j < 8;j++)
1241 printf("%02X ",blockdata[j]);
4d68ec02 1242 printf("|\n");
aa53efc3 1243 i++;
1244 }
aa53efc3 1245}
1246
4d68ec02 1247int usage_hf_iclass_readtagfile() {
1248 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1249 return 1;
1250}
1251
1252int CmdHFiClassReadTagFile(const char *Cmd) {
aa53efc3 1253 int startblock = 0;
1254 int endblock = 0;
1255 char tempnum[5];
1256 FILE *f;
1257 char filename[FILE_PATH_SIZE];
1258 if (param_getstr(Cmd, 0, filename) < 1)
1259 return usage_hf_iclass_readtagfile();
1260 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1261 startblock = 0;
1262 else
1263 sscanf(tempnum,"%d",&startblock);
1264
1265 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1266 endblock = 0;
1267 else
1268 sscanf(tempnum,"%d",&endblock);
1269 // file handling and reading
1270 f = fopen(filename,"rb");
1271 if(!f) {
1272 PrintAndLog("Failed to read from file '%s'", filename);
1273 return 1;
1274 }
1275 fseek(f, 0, SEEK_END);
1276 long fsize = ftell(f);
1277 fseek(f, 0, SEEK_SET);
1278
1279 uint8_t *dump = malloc(fsize);
1280
1281
1282 size_t bytes_read = fread(dump, 1, fsize, f);
1283 fclose(f);
1284 uint8_t *csn = dump;
4d68ec02 1285 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
aa53efc3 1286 // printIclassDumpInfo(dump);
1287 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1288 free(dump);
1289 return 0;
1290}
1291
4d68ec02 1292/*
1293uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
aa53efc3 1294 uint64_t new_div = 0x00;
1295 new_div ^= sdiv;
1296 new_div ^= hdiv;
1297 return new_div;
1298}
1299
4d68ec02 1300uint64_t hexarray_to_uint64(uint8_t *key) {
aa53efc3 1301 char temp[17];
1302 uint64_t uint_key;
1303 for (int i = 0;i < 8;i++)
1304 sprintf(&temp[(i *2)],"%02X",key[i]);
1305 temp[16] = '\0';
1306 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1307 return 0;
1308 return uint_key;
1309}
4d68ec02 1310*/
1311void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
aa53efc3 1312 uint8_t keytable[128] = {0};
1313 uint8_t key_index[8] = {0};
4d68ec02 1314 if (elite) {
1315 uint8_t key_sel[8] = { 0 };
1316 uint8_t key_sel_p[8] = { 0 };
1317 hash2(KEY, keytable);
1318 hash1(CSN, key_index);
1319 for(uint8_t i = 0; i < 8 ; i++)
1320 key_sel[i] = keytable[key_index[i]] & 0xFF;
aa53efc3 1321
4d68ec02 1322 //Permute from iclass format to standard format
1323 permutekey_rev(key_sel, key_sel_p);
1324 diversifyKey(CSN, key_sel_p, div_key);
1325 } else {
1326 diversifyKey(CSN, KEY, div_key);
1327 }
1328}
aa53efc3 1329
4d68ec02 1330//when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1331//calculate and return xor_div_key (ready for a key write command)
1332//print all div_keys if verbose
1333static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1334 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1335 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1336 //get old div key
1337 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1338 //get new div key
1339 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1340
1341 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1342 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1343 }
1344 if (verbose) {
1345 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1346 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1347 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1348 }
1349}
aa53efc3 1350
4d68ec02 1351int usage_hf_iclass_calc_newkey(void) {
1352 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1353 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1354 PrintAndLog(" Options:");
1355 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1356 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1357 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1358 PrintAndLog(" e : specify new key as elite calc");
1359 PrintAndLog(" ee : specify old and new key as elite calc");
1360 PrintAndLog("Samples:");
1361 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1362 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1363 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1364 PrintAndLog("NOTE: * = required\n");
aa53efc3 1365
4d68ec02 1366 return 1;
1367}
aa53efc3 1368
4d68ec02 1369int CmdHFiClassCalcNewKey(const char *Cmd) {
1370 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1371 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1372 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1373 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1374 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1375 uint8_t keyNbr = 0;
1376 uint8_t dataLen = 0;
1377 char tempStr[50] = {0};
1378 bool givenCSN = false;
1379 bool oldElite = false;
1380 bool elite = false;
1381 bool errors = false;
1382 uint8_t cmdp = 0;
1383 while(param_getchar(Cmd, cmdp) != 0x00)
1384 {
1385 switch(param_getchar(Cmd, cmdp))
1386 {
1387 case 'h':
1388 case 'H':
1389 return usage_hf_iclass_calc_newkey();
1390 case 'e':
1391 case 'E':
1392 dataLen = param_getstr(Cmd, cmdp, tempStr);
1393 if (dataLen==2)
1394 oldElite = true;
1395 elite = true;
1396 cmdp++;
1397 break;
1398 case 'n':
1399 case 'N':
1400 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1401 if (dataLen == 16) {
1402 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1403 } else if (dataLen == 1) {
1404 keyNbr = param_get8(Cmd, cmdp+1);
1405 if (keyNbr <= ICLASS_KEYS_MAX) {
1406 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1407 } else {
1408 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1409 errors = true;
1410 }
1411 } else {
1412 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1413 errors = true;
1414 }
1415 cmdp += 2;
1416 break;
1417 case 'o':
1418 case 'O':
1419 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1420 if (dataLen == 16) {
1421 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1422 } else if (dataLen == 1) {
1423 keyNbr = param_get8(Cmd, cmdp+1);
1424 if (keyNbr <= ICLASS_KEYS_MAX) {
1425 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1426 } else {
1427 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1428 errors = true;
1429 }
1430 } else {
1431 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1432 errors = true;
1433 }
1434 cmdp += 2;
1435 break;
1436 case 's':
1437 case 'S':
1438 givenCSN = true;
1439 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1440 return usage_hf_iclass_calc_newkey();
1441 cmdp += 2;
1442 break;
1443 default:
1444 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1445 errors = true;
1446 break;
1447 }
1448 if(errors) return usage_hf_iclass_calc_newkey();
1449 }
aa53efc3 1450
4d68ec02 1451 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
aa53efc3 1452
4d68ec02 1453 if (!givenCSN)
1454 if (!select_only(CSN, CCNR, false, true))
1455 return 0;
1456
1457 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
aa53efc3 1458 return 0;
1459}
1460
4d68ec02 1461static int loadKeys(char *filename) {
aa53efc3 1462 FILE *f;
1463 f = fopen(filename,"rb");
1464 if(!f) {
1465 PrintAndLog("Failed to read from file '%s'", filename);
1466 return 0;
1467 }
1468 fseek(f, 0, SEEK_END);
1469 long fsize = ftell(f);
1470 fseek(f, 0, SEEK_SET);
1471
1472 uint8_t *dump = malloc(fsize);
1473
1474 size_t bytes_read = fread(dump, 1, fsize, f);
1475 fclose(f);
1476 if (bytes_read > ICLASS_KEYS_MAX * 8){
1477 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1478 free(dump);
1479 return 0;
1480 }
1481 uint8_t i = 0;
1482 for (; i < bytes_read/8; i++){
1483 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1484 }
1485 free(dump);
1486 PrintAndLog("%u keys loaded", i);
1487 return 1;
1488}
1489
4d68ec02 1490static int saveKeys(char *filename) {
aa53efc3 1491 FILE *f;
1492 f = fopen(filename,"wb");
1493 if (f == NULL) {
1494 printf("error opening file %s\n",filename);
1495 return 0;
1496 }
1497 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1498 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1499 PrintAndLog("save key failed to write to file: %s", filename);
1500 break;
1501 }
1502 }
1503 fclose(f);
1504 return 0;
1505}
1506
4d68ec02 1507static int printKeys(void) {
aa53efc3 1508 PrintAndLog("");
1509 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1510 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1511 }
1512 PrintAndLog("");
1513 return 0;
1514}
1515
4d68ec02 1516int usage_hf_iclass_managekeys(void) {
aa53efc3 1517 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1518 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1519 PrintAndLog(" Options:");
1520 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1521 PrintAndLog(" k <key> : set a key in memory");
1522 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1523 PrintAndLog(" s : save keys in memory to file specified by filename");
1524 PrintAndLog(" l : load keys to memory from file specified by filename");
1525 PrintAndLog(" p : print keys loaded into memory\n");
1526 PrintAndLog("Samples:");
1527 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1528 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1529 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1530 PrintAndLog(" print keys : hf iclass managekeys p\n");
1531 return 0;
1532}
1533
4d68ec02 1534int CmdHFiClassManageKeys(const char *Cmd) {
aa53efc3 1535 uint8_t keyNbr = 0;
1536 uint8_t dataLen = 0;
1537 uint8_t KEY[8] = {0};
1538 char filename[FILE_PATH_SIZE];
1539 uint8_t fileNameLen = 0;
1540 bool errors = false;
1541 uint8_t operation = 0;
1542 char tempStr[20];
1543 uint8_t cmdp = 0;
1544
1545 while(param_getchar(Cmd, cmdp) != 0x00)
1546 {
1547 switch(param_getchar(Cmd, cmdp))
1548 {
1549 case 'h':
1550 case 'H':
1551 return usage_hf_iclass_managekeys();
1552 case 'f':
1553 case 'F':
1554 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1555 if (fileNameLen < 1) {
1556 PrintAndLog("No filename found after f");
1557 errors = true;
1558 }
1559 cmdp += 2;
1560 break;
1561 case 'n':
1562 case 'N':
1563 keyNbr = param_get8(Cmd, cmdp+1);
1564 if (keyNbr < 0) {
1565 PrintAndLog("Wrong block number");
1566 errors = true;
1567 }
1568 cmdp += 2;
1569 break;
1570 case 'k':
1571 case 'K':
1572 operation += 3; //set key
1573 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1574 if (dataLen == 16) { //ul-c or ev1/ntag key length
1575 errors = param_gethex(tempStr, 0, KEY, dataLen);
1576 } else {
1577 PrintAndLog("\nERROR: Key is incorrect length\n");
1578 errors = true;
1579 }
1580 cmdp += 2;
1581 break;
1582 case 'p':
1583 case 'P':
1584 operation += 4; //print keys in memory
1585 cmdp++;
1586 break;
1587 case 'l':
1588 case 'L':
1589 operation += 5; //load keys from file
1590 cmdp++;
1591 break;
1592 case 's':
1593 case 'S':
1594 operation += 6; //save keys to file
1595 cmdp++;
1596 break;
1597 default:
1598 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1599 errors = true;
1600 break;
1601 }
1602 if(errors) return usage_hf_iclass_managekeys();
1603 }
1604 if (operation == 0){
1605 PrintAndLog("no operation specified (load, save, or print)\n");
1606 return usage_hf_iclass_managekeys();
1607 }
1608 if (operation > 6){
1609 PrintAndLog("Too many operations specified\n");
1610 return usage_hf_iclass_managekeys();
1611 }
1612 if (operation > 4 && fileNameLen == 0){
1613 PrintAndLog("You must enter a filename when loading or saving\n");
1614 return usage_hf_iclass_managekeys();
1615 }
1616
1617 switch (operation){
1618 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1619 case 4: return printKeys();
1620 case 5: return loadKeys(filename);
1621 case 6: return saveKeys(filename);
1622 break;
1623 }
1624 return 0;
1625}
1626
cee5a30d 1627static command_t CommandTable[] =
1628{
aa53efc3 1629 {"help", CmdHelp, 1, "This help"},
4d68ec02 1630 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1631 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1632 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1633 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1634 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1635 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1636 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1637 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1638 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1639 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1640 {"reader", CmdHFiClassReader, 0, " Read an iClass tag"},
1641 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1642 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1643 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1644 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1645 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
6f101995 1646 {NULL, NULL, 0, NULL}
cee5a30d 1647};
1648
1649int CmdHFiClass(const char *Cmd)
1650{
53444513
MHS		 1651 CmdsParse(CommandTable, Cmd);
1652 return 0;
cee5a30d 1653}
1654
1655int CmdHelp(const char *Cmd)
1656{
53444513
MHS		 1657 CmdsHelp(CommandTable);
1658 return 0;
cee5a30d 1659}
Proxmark3 GIT tracking
Impressum, Datenschutz