fix - some card cant reset so quick. (#713)
[proxmark3-svn] / client / emv / emvcore.c
CommitLineData
a2bb2735 1//-----------------------------------------------------------------------------
2// Copyright (C) 2017 Merlok
3//
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,
5// at your option, any later version. See the LICENSE.txt file for the text of
6// the license.
7//-----------------------------------------------------------------------------
8// EMV core functions
9//-----------------------------------------------------------------------------
10
11#include "emvcore.h"
95b697f0 12#include "emvjson.h"
8fa68384 13#include "util_posix.h"
a2bb2735 14
3c5fce2b
OM
15// Got from here. Thanks)
16// https://eftlab.co.uk/index.php/site-map/knowledge-base/211-emv-aid-rid-pix
87fc2dad 17static const char *PSElist [] = {
3c5fce2b
OM
18 "325041592E5359532E4444463031", // 2PAY.SYS.DDF01 - Visa Proximity Payment System Environment - PPSE
19 "315041592E5359532E4444463031" // 1PAY.SYS.DDF01 - Visa Payment System Environment - PSE
20};
d03fb293 21//static const size_t PSElistLen = sizeof(PSElist)/sizeof(char*);
3c5fce2b 22
95b697f0
OM
23char *TransactionTypeStr[] = {
24 "MSD",
25 "VSDC",
26 "qVCDCMCHIP",
27 "CDA"
28};
29
87fc2dad 30typedef struct {
31 enum CardPSVendor vendor;
32 const char* aid;
33} TAIDList;
34
35static const TAIDList AIDlist [] = {
3c5fce2b 36 // Visa International
87fc2dad 37 { CV_VISA, "A00000000305076010"}, // VISA ELO Credit
38 { CV_VISA, "A0000000031010" }, // VISA Debit/Credit (Classic)
39 { CV_VISA, "A000000003101001" }, // VISA Credit
40 { CV_VISA, "A000000003101002" }, // VISA Debit
41 { CV_VISA, "A0000000032010" }, // VISA Electron
42 { CV_VISA, "A0000000032020" }, // VISA
43 { CV_VISA, "A0000000033010" }, // VISA Interlink
44 { CV_VISA, "A0000000034010" }, // VISA Specific
45 { CV_VISA, "A0000000035010" }, // VISA Specific
46 { CV_VISA, "A0000000036010" }, // Domestic Visa Cash Stored Value
47 { CV_VISA, "A0000000036020" }, // International Visa Cash Stored Value
48 { CV_VISA, "A0000000038002" }, // VISA Auth, VisaRemAuthen EMV-CAP (DPA)
49 { CV_VISA, "A0000000038010" }, // VISA Plus
50 { CV_VISA, "A0000000039010" }, // VISA Loyalty
51 { CV_VISA, "A000000003999910" }, // VISA Proprietary ATM
3c5fce2b 52 // Visa USA
87fc2dad 53 { CV_VISA, "A000000098" }, // Debit Card
54 { CV_VISA, "A0000000980848" }, // Debit Card
3c5fce2b 55 // Mastercard International
87fc2dad 56 { CV_MASTERCARD, "A00000000401" }, // MasterCard PayPass
57 { CV_MASTERCARD, "A0000000041010" }, // MasterCard Credit
58 { CV_MASTERCARD, "A00000000410101213" }, // MasterCard Credit
59 { CV_MASTERCARD, "A00000000410101215" }, // MasterCard Credit
60 { CV_MASTERCARD, "A0000000042010" }, // MasterCard Specific
61 { CV_MASTERCARD, "A0000000043010" }, // MasterCard Specific
62 { CV_MASTERCARD, "A0000000043060" }, // Maestro (Debit)
63 { CV_MASTERCARD, "A000000004306001" }, // Maestro (Debit)
64 { CV_MASTERCARD, "A0000000044010" }, // MasterCard Specific
65 { CV_MASTERCARD, "A0000000045010" }, // MasterCard Specific
66 { CV_MASTERCARD, "A0000000046000" }, // Cirrus
67 { CV_MASTERCARD, "A0000000048002" }, // SecureCode Auth EMV-CAP
68 { CV_MASTERCARD, "A0000000049999" }, // MasterCard PayPass
3c5fce2b 69 // American Express
87fc2dad 70 { CV_AMERICANEXPRESS, "A000000025" },
71 { CV_AMERICANEXPRESS, "A0000000250000" },
72 { CV_AMERICANEXPRESS, "A00000002501" },
73 { CV_AMERICANEXPRESS, "A000000025010402" },
74 { CV_AMERICANEXPRESS, "A000000025010701" },
75 { CV_AMERICANEXPRESS, "A000000025010801" },
3c5fce2b 76 // Groupement des Cartes Bancaires "CB"
87fc2dad 77 { CV_CB, "A0000000421010" }, // Cartes Bancaire EMV Card
78 { CV_CB, "A0000000422010" },
79 { CV_CB, "A0000000423010" },
80 { CV_CB, "A0000000424010" },
81 { CV_CB, "A0000000425010" },
3c5fce2b 82 // JCB CO., LTD.
87fc2dad 83 { CV_JCB, "A00000006510" }, // JCB
84 { CV_JCB, "A0000000651010" }, // JCB J Smart Credit
85 // Other
86 { CV_OTHER, "A0000001544442" }, // Banricompras Debito - Banrisul - Banco do Estado do Rio Grande do SUL - S.A.
87 { CV_OTHER, "F0000000030001" }, // BRADESCO
88 { CV_OTHER, "A0000005241010" }, // RuPay - RuPay
89 { CV_OTHER, "D5780000021010" } // Bankaxept - Bankaxept
3c5fce2b 90};
87fc2dad 91static const size_t AIDlistLen = sizeof(AIDlist)/sizeof(TAIDList);
3c5fce2b
OM
92
93static bool APDULogging = false;
94void SetAPDULogging(bool logging) {
95 APDULogging = logging;
96}
97
87fc2dad 98enum CardPSVendor GetCardPSVendor(uint8_t * AID, size_t AIDlen) {
99 char buf[100] = {0};
100 if (AIDlen < 1)
101 return CV_NA;
102
103 hex_to_buffer((uint8_t *)buf, AID, AIDlen, sizeof(buf) - 1, 0, 0, true);
104
105 for(int i = 0; i < AIDlistLen; i ++) {
106 if (strncmp(AIDlist[i].aid, buf, strlen(AIDlist[i].aid)) == 0){
107 return AIDlist[i].vendor;
108 }
109 }
110
111 return CV_NA;
112}
113
33a9982c 114static bool print_cb(void *data, const struct tlv *tlv, int level, bool is_leaf) {
43912d63 115 emv_tag_dump(tlv, stdout, level);
33a9982c 116 if (is_leaf) {
117 dump_buffer(tlv->value, tlv->len, stdout, level);
118 }
a2bb2735 119
120 return true;
121}
122
123void TLVPrintFromBuffer(uint8_t *data, int datalen) {
124 struct tlvdb *t = NULL;
23207d74 125 t = tlvdb_parse_multi(data, datalen);
a2bb2735 126 if (t) {
3c5fce2b 127 PrintAndLog("-------------------- TLV decoded --------------------");
a2bb2735 128
43912d63 129 tlvdb_visit(t, print_cb, NULL, 0);
a2bb2735 130 tlvdb_free(t);
131 } else {
132 PrintAndLog("TLV ERROR: Can't parse response as TLV tree.");
133 }
134}
3c5fce2b 135
87fc2dad 136void TLVPrintFromTLVLev(struct tlvdb *tlv, int level) {
3c5fce2b
OM
137 if (!tlv)
138 return;
139
87fc2dad 140 tlvdb_visit(tlv, print_cb, NULL, level);
141}
142
143void TLVPrintFromTLV(struct tlvdb *tlv) {
144 TLVPrintFromTLVLev(tlv, 0);
3c5fce2b
OM
145}
146
147void TLVPrintAIDlistFromSelectTLV(struct tlvdb *tlv) {
148 PrintAndLog("|------------------|--------|-------------------------|");
149 PrintAndLog("| AID |Priority| Name |");
150 PrintAndLog("|------------------|--------|-------------------------|");
151
152 struct tlvdb *ttmp = tlvdb_find(tlv, 0x6f);
153 if (!ttmp)
154 PrintAndLog("| none |");
155
156 while (ttmp) {
157 const struct tlv *tgAID = tlvdb_get_inchild(ttmp, 0x84, NULL);
158 const struct tlv *tgName = tlvdb_get_inchild(ttmp, 0x50, NULL);
159 const struct tlv *tgPrio = tlvdb_get_inchild(ttmp, 0x87, NULL);
160 if (!tgAID)
161 break;
162 PrintAndLog("|%s| %s |%s|",
163 sprint_hex_inrow_ex(tgAID->value, tgAID->len, 18),
164 (tgPrio) ? sprint_hex(tgPrio->value, 1) : " ",
165 (tgName) ? sprint_ascii_ex(tgName->value, tgName->len, 25) : " ");
166
167 ttmp = tlvdb_find_next(ttmp, 0x6f);
168 }
169
170 PrintAndLog("|------------------|--------|-------------------------|");
171}
172
87fc2dad 173struct tlvdb *GetPANFromTrack2(const struct tlv *track2) {
174 char track2Hex[200] = {0};
175 uint8_t PAN[100] = {0};
176 int PANlen = 0;
177 char *tmp = track2Hex;
3c5fce2b 178
87fc2dad 179 if (!track2)
180 return NULL;
181
182 for (int i = 0; i < track2->len; ++i, tmp += 2)
183 sprintf(tmp, "%02x", (unsigned int)track2->value[i]);
184
185 int posD = strchr(track2Hex, 'd') - track2Hex;
186 if (posD < 1)
187 return NULL;
188
189 track2Hex[posD] = 0;
190 if (strlen(track2Hex) % 2) {
191 track2Hex[posD] = 'F';
192 track2Hex[posD + 1] = '\0';
193 }
194
195 param_gethex_to_eol(track2Hex, 0, PAN, sizeof(PAN), &PANlen);
196
197 return tlvdb_fixed(0x5a, PANlen, PAN);
198}
199
200struct tlvdb *GetdCVVRawFromTrack2(const struct tlv *track2) {
201 char track2Hex[200] = {0};
202 char dCVVHex[100] = {0};
203 uint8_t dCVV[100] = {0};
204 int dCVVlen = 0;
205 const int PINlen = 5; // must calculated from 9F67 MSD Offset but i have not seen this tag)
206 char *tmp = track2Hex;
207
208 if (!track2)
209 return NULL;
210
211 for (int i = 0; i < track2->len; ++i, tmp += 2)
212 sprintf(tmp, "%02x", (unsigned int)track2->value[i]);
213
214 int posD = strchr(track2Hex, 'd') - track2Hex;
215 if (posD < 1)
216 return NULL;
217
218 memset(dCVVHex, '0', 32);
219 // ATC
220 memcpy(dCVVHex + 0, track2Hex + posD + PINlen + 11, 4);
221 // PAN 5 hex
222 memcpy(dCVVHex + 4, track2Hex, 5);
223 // expire date
224 memcpy(dCVVHex + 9, track2Hex + posD + 1, 4);
225 // service code
226 memcpy(dCVVHex + 13, track2Hex + posD + 5, 3);
227
228 param_gethex_to_eol(dCVVHex, 0, dCVV, sizeof(dCVV), &dCVVlen);
229
230 return tlvdb_fixed(0x02, dCVVlen, dCVV);
231}
232
c80eb8ba 233int EMVExchangeEx(bool ActivateField, bool LeaveFieldON, sAPDU apdu, bool IncludeLe, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
3c5fce2b 234 uint8_t data[APDU_RES_LEN] = {0};
87fc2dad 235
3c5fce2b
OM
236 *ResultLen = 0;
237 if (sw) *sw = 0;
238 uint16_t isw = 0;
239
8fa68384 240 if (ActivateField){
3c5fce2b 241 DropField();
8fa68384
OM
242 msleep(50);
243 }
3c5fce2b 244
87fc2dad 245 // COMPUTE APDU
246 memcpy(data, &apdu, 5);
247 if (apdu.data)
248 memcpy(&data[5], apdu.data, apdu.Lc);
249
3c5fce2b 250 if (APDULogging)
c80eb8ba 251 PrintAndLog(">>>> %s", sprint_hex(data, (IncludeLe?6:5) + apdu.Lc));
3c5fce2b 252
c80eb8ba
OM
253 // 6 byes + data = INS + CLA + P1 + P2 + Lc + <data = Nc> + Le(?IncludeLe)
254 int res = ExchangeAPDU14a(data, (IncludeLe?6:5) + apdu.Lc, ActivateField, LeaveFieldON, Result, (int)MaxResultLen, (int *)ResultLen);
3c5fce2b 255
3c5fce2b
OM
256 if (res) {
257 return res;
258 }
87fc2dad 259
10d4f823 260 if (APDULogging)
261 PrintAndLog("<<<< %s", sprint_hex(Result, *ResultLen));
262
3c5fce2b
OM
263 *ResultLen -= 2;
264 isw = Result[*ResultLen] * 0x0100 + Result[*ResultLen + 1];
265 if (sw)
266 *sw = isw;
267
268 if (isw != 0x9000) {
269 if (APDULogging)
87fc2dad 270 PrintAndLog("APDU(%02x%02x) ERROR: [%4X] %s", apdu.CLA, apdu.INS, isw, GetAPDUCodeDescription(*sw >> 8, *sw & 0xff));
3c5fce2b
OM
271 return 5;
272 }
273
274 // add to tlv tree
275 if (tlv) {
276 struct tlvdb *t = tlvdb_parse_multi(Result, *ResultLen);
277 tlvdb_add(tlv, t);
278 }
279
280 return 0;
281}
282
87fc2dad 283int EMVExchange(bool LeaveFieldON, sAPDU apdu, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
c80eb8ba 284 return EMVExchangeEx(false, LeaveFieldON, apdu, true, Result, MaxResultLen, ResultLen, sw, tlv);
87fc2dad 285}
286
287int EMVSelect(bool ActivateField, bool LeaveFieldON, uint8_t *AID, size_t AIDLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
c80eb8ba 288 return EMVExchangeEx(ActivateField, LeaveFieldON, (sAPDU){0x00, 0xa4, 0x04, 0x00, AIDLen, AID}, true, Result, MaxResultLen, ResultLen, sw, tlv);
87fc2dad 289}
290
3c5fce2b
OM
291int EMVSelectPSE(bool ActivateField, bool LeaveFieldON, uint8_t PSENum, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw) {
292 uint8_t buf[APDU_AID_LEN] = {0};
293 *ResultLen = 0;
294 int len = 0;
295 int res = 0;
296 switch (PSENum) {
297 case 1:
298 param_gethex_to_eol(PSElist[1], 0, buf, sizeof(buf), &len);
299 break;
300 case 2:
301 param_gethex_to_eol(PSElist[0], 0, buf, sizeof(buf), &len);
302 break;
303 default:
304 return -1;
305 }
306
307 // select
308 res = EMVSelect(ActivateField, LeaveFieldON, buf, len, Result, MaxResultLen, ResultLen, sw, NULL);
309
310 return res;
311}
312
313int EMVSearchPSE(bool ActivateField, bool LeaveFieldON, bool decodeTLV, struct tlvdb *tlv) {
314 uint8_t data[APDU_RES_LEN] = {0};
315 size_t datalen = 0;
316 uint16_t sw = 0;
317 int res;
318
319 // select PPSE
320 res = EMVSelectPSE(ActivateField, true, 2, data, sizeof(data), &datalen, &sw);
321
322 if (!res){
323 struct tlvdb *t = NULL;
324 t = tlvdb_parse_multi(data, datalen);
325 if (t) {
326 int retrycnt = 0;
327 struct tlvdb *ttmp = tlvdb_find_path(t, (tlv_tag_t[]){0x6f, 0xa5, 0xbf0c, 0x61, 0x00});
328 if (!ttmp)
329 PrintAndLog("PPSE don't have records.");
330
331 while (ttmp) {
332 const struct tlv *tgAID = tlvdb_get_inchild(ttmp, 0x4f, NULL);
333 if (tgAID) {
334 res = EMVSelect(false, true, (uint8_t *)tgAID->value, tgAID->len, data, sizeof(data), &datalen, &sw, tlv);
335
336 // retry if error and not returned sw error
337 if (res && res != 5) {
338 if (++retrycnt < 3){
339 continue;
340 } else {
341 // card select error, proxmark error
342 if (res == 1) {
343 PrintAndLog("Exit...");
344 return 1;
345 }
346
347 retrycnt = 0;
348 PrintAndLog("Retry failed [%s]. Skiped...", sprint_hex_inrow(tgAID->value, tgAID->len));
349 }
350
351 // next element
352 ttmp = tlvdb_find_next(ttmp, 0x61);
353 continue;
354 }
355 retrycnt = 0;
356
357 // all is ok
358 if (decodeTLV){
359 PrintAndLog("%s:", sprint_hex_inrow(tgAID->value, tgAID->len));
360 TLVPrintFromBuffer(data, datalen);
361 }
362 }
363
364 ttmp = tlvdb_find_next(ttmp, 0x61);
365 }
366
367 tlvdb_free(t);
368 } else {
369 PrintAndLog("PPSE ERROR: Can't get TLV from response.");
370 }
371 } else {
372 PrintAndLog("PPSE ERROR: Can't select PPSE AID. Error: %d", res);
373 }
374
375 if(!LeaveFieldON)
376 DropField();
377
378 return res;
379}
380
381int EMVSearch(bool ActivateField, bool LeaveFieldON, bool decodeTLV, struct tlvdb *tlv) {
382 uint8_t aidbuf[APDU_AID_LEN] = {0};
383 int aidlen = 0;
384 uint8_t data[APDU_RES_LEN] = {0};
385 size_t datalen = 0;
386 uint16_t sw = 0;
387
388 int res = 0;
389 int retrycnt = 0;
390 for(int i = 0; i < AIDlistLen; i ++) {
87fc2dad 391 param_gethex_to_eol(AIDlist[i].aid, 0, aidbuf, sizeof(aidbuf), &aidlen);
3c5fce2b
OM
392 res = EMVSelect((i == 0) ? ActivateField : false, (i == AIDlistLen - 1) ? LeaveFieldON : true, aidbuf, aidlen, data, sizeof(data), &datalen, &sw, tlv);
393 // retry if error and not returned sw error
394 if (res && res != 5) {
395 if (++retrycnt < 3){
396 i--;
397 } else {
398 // card select error, proxmark error
399 if (res == 1) {
400 PrintAndLog("Exit...");
401 return 1;
402 }
403
404 retrycnt = 0;
87fc2dad 405 PrintAndLog("Retry failed [%s]. Skiped...", AIDlist[i].aid);
3c5fce2b
OM
406 }
407 continue;
408 }
409 retrycnt = 0;
410
411 if (res)
412 continue;
413
414 if (decodeTLV){
87fc2dad 415 PrintAndLog("%s:", AIDlist[i].aid);
3c5fce2b
OM
416 TLVPrintFromBuffer(data, datalen);
417 }
418 }
419
420 return 0;
421}
422
423int EMVSelectApplication(struct tlvdb *tlv, uint8_t *AID, size_t *AIDlen) {
87fc2dad 424 // check priority. 0x00 - highest
3c5fce2b
OM
425 int prio = 0xffff;
426
427 *AIDlen = 0;
428
429 struct tlvdb *ttmp = tlvdb_find(tlv, 0x6f);
430 if (!ttmp)
431 return 1;
432
433 while (ttmp) {
434 const struct tlv *tgAID = tlvdb_get_inchild(ttmp, 0x84, NULL);
435 const struct tlv *tgPrio = tlvdb_get_inchild(ttmp, 0x87, NULL);
436
437 if (!tgAID)
438 break;
439
440 if (tgPrio) {
441 int pt = bytes_to_num((uint8_t*)tgPrio->value, (tgPrio->len < 2) ? tgPrio->len : 2);
442 if (pt < prio) {
443 prio = pt;
444
445 memcpy(AID, tgAID->value, tgAID->len);
446 *AIDlen = tgAID->len;
447 }
448 } else {
449 // takes the first application from list wo priority
450 if (!*AIDlen) {
451 memcpy(AID, tgAID->value, tgAID->len);
452 *AIDlen = tgAID->len;
453 }
454 }
455
456 ttmp = tlvdb_find_next(ttmp, 0x6f);
457 }
458
459 return 0;
460}
461
462int EMVGPO(bool LeaveFieldON, uint8_t *PDOL, size_t PDOLLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
87fc2dad 463 return EMVExchange(LeaveFieldON, (sAPDU){0x80, 0xa8, 0x00, 0x00, PDOLLen, PDOL}, Result, MaxResultLen, ResultLen, sw, tlv);
3c5fce2b
OM
464}
465
466int EMVReadRecord(bool LeaveFieldON, uint8_t SFI, uint8_t SFIrec, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
c80eb8ba
OM
467 int res = EMVExchange(LeaveFieldON, (sAPDU){0x00, 0xb2, SFIrec, (SFI << 3) | 0x04, 0, NULL}, Result, MaxResultLen, ResultLen, sw, tlv);
468 if (*sw == 0x6700) {
469 PrintAndLog(">>> trying to reissue command withouth Le...");
470 res = EMVExchangeEx(false, LeaveFieldON, (sAPDU){0x00, 0xb2, SFIrec, (SFI << 3) | 0x04, 0, NULL}, false, Result, MaxResultLen, ResultLen, sw, tlv);
471 }
472 return res;
87fc2dad 473}
3c5fce2b 474
87fc2dad 475int EMVAC(bool LeaveFieldON, uint8_t RefControl, uint8_t *CDOL, size_t CDOLLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
476 return EMVExchange(LeaveFieldON, (sAPDU){0x80, 0xae, RefControl, 0x00, CDOLLen, CDOL}, Result, MaxResultLen, ResultLen, sw, tlv);
3c5fce2b
OM
477}
478
87fc2dad 479int EMVGenerateChallenge(bool LeaveFieldON, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
c80eb8ba
OM
480 int res = EMVExchange(LeaveFieldON, (sAPDU){0x00, 0x84, 0x00, 0x00, 0x00, NULL}, Result, MaxResultLen, ResultLen, sw, tlv);
481 if (*sw == 0x6700) {
482 PrintAndLog(">>> trying to reissue command withouth Le...");
483 res = EMVExchangeEx(false, LeaveFieldON, (sAPDU){0x00, 0x84, 0x00, 0x00, 0x00, NULL}, false, Result, MaxResultLen, ResultLen, sw, tlv);
484 }
485 return res;
87fc2dad 486}
3c5fce2b 487
d03fb293
OM
488int EMVInternalAuthenticate(bool LeaveFieldON, uint8_t *DDOL, size_t DDOLLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
489 return EMVExchange(LeaveFieldON, (sAPDU){0x00, 0x88, 0x00, 0x00, DDOLLen, DDOL}, Result, MaxResultLen, ResultLen, sw, tlv);
490}
491
87fc2dad 492int MSCComputeCryptoChecksum(bool LeaveFieldON, uint8_t *UDOL, uint8_t UDOLlen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
493 return EMVExchange(LeaveFieldON, (sAPDU){0x80, 0x2a, 0x8e, 0x80, UDOLlen, UDOL}, Result, MaxResultLen, ResultLen, sw, tlv);
494}
10d4f823 495
496// Authentication
d03fb293
OM
497static struct emv_pk *get_ca_pk(struct tlvdb *db) {
498 const struct tlv *df_tlv = tlvdb_get(db, 0x84, NULL);
499 const struct tlv *caidx_tlv = tlvdb_get(db, 0x8f, NULL);
500
501 if (!df_tlv || !caidx_tlv || df_tlv->len < 6 || caidx_tlv->len != 1)
502 return NULL;
503
504 PrintAndLog("CA public key index 0x%0x", caidx_tlv->value[0]);
505 return emv_pk_get_ca_pk(df_tlv->value, caidx_tlv->value[0]);
506}
507
508int trSDA(struct tlvdb *tlv) {
509
510 struct emv_pk *pk = get_ca_pk(tlv);
511 if (!pk) {
512 PrintAndLog("ERROR: Key not found. Exit.");
513 return 2;
514 }
10d4f823 515
d03fb293
OM
516 struct emv_pk *issuer_pk = emv_pki_recover_issuer_cert(pk, tlv);
517 if (!issuer_pk) {
518 emv_pk_free(pk);
519 PrintAndLog("ERROR: Issuer certificate not found. Exit.");
520 return 2;
521 }
522
523 PrintAndLog("Issuer PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx",
524 issuer_pk->rid[0],
525 issuer_pk->rid[1],
526 issuer_pk->rid[2],
527 issuer_pk->rid[3],
528 issuer_pk->rid[4],
529 issuer_pk->index,
530 issuer_pk->serial[0],
531 issuer_pk->serial[1],
532 issuer_pk->serial[2]
533 );
534
535 const struct tlv *sda_tlv = tlvdb_get(tlv, 0x21, NULL);
536 if (!sda_tlv || sda_tlv->len < 1) {
537 emv_pk_free(issuer_pk);
538 emv_pk_free(pk);
539 PrintAndLog("ERROR: Can't find input list for Offline Data Authentication. Exit.");
540 return 3;
541 }
10d4f823 542
d03fb293
OM
543 struct tlvdb *dac_db = emv_pki_recover_dac(issuer_pk, tlv, sda_tlv);
544 if (dac_db) {
545 const struct tlv *dac_tlv = tlvdb_get(dac_db, 0x9f45, NULL);
546 PrintAndLog("SDA verified OK. (%02hhx:%02hhx)\n", dac_tlv->value[0], dac_tlv->value[1]);
547 tlvdb_add(tlv, dac_db);
548 } else {
549 emv_pk_free(issuer_pk);
550 emv_pk_free(pk);
551 PrintAndLog("ERROR: SSAD verify error");
552 return 4;
553 }
10d4f823 554
d03fb293
OM
555 emv_pk_free(issuer_pk);
556 emv_pk_free(pk);
557 return 0;
558}
559
560static const unsigned char default_ddol_value[] = {0x9f, 0x37, 0x04};
561static struct tlv default_ddol_tlv = {.tag = 0x9f49, .len = 3, .value = default_ddol_value };
562
563int trDDA(bool decodeTLV, struct tlvdb *tlv) {
564 uint8_t buf[APDU_RES_LEN] = {0};
565 size_t len = 0;
566 uint16_t sw = 0;
567
568 struct emv_pk *pk = get_ca_pk(tlv);
569 if (!pk) {
570 PrintAndLog("ERROR: Key not found. Exit.");
571 return 2;
572 }
573
574 const struct tlv *sda_tlv = tlvdb_get(tlv, 0x21, NULL);
575 if (!sda_tlv || sda_tlv->len < 1) {
576 emv_pk_free(pk);
577 PrintAndLog("ERROR: Can't find input list for Offline Data Authentication. Exit.");
578 return 3;
579 }
580
581 struct emv_pk *issuer_pk = emv_pki_recover_issuer_cert(pk, tlv);
582 if (!issuer_pk) {
583 emv_pk_free(pk);
584 PrintAndLog("ERROR: Issuer certificate not found. Exit.");
585 return 2;
586 }
587 printf("Issuer PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n",
588 issuer_pk->rid[0],
589 issuer_pk->rid[1],
590 issuer_pk->rid[2],
591 issuer_pk->rid[3],
592 issuer_pk->rid[4],
593 issuer_pk->index,
594 issuer_pk->serial[0],
595 issuer_pk->serial[1],
596 issuer_pk->serial[2]
597 );
598
599 struct emv_pk *icc_pk = emv_pki_recover_icc_cert(issuer_pk, tlv, sda_tlv);
600 if (!icc_pk) {
601 emv_pk_free(pk);
602 emv_pk_free(issuer_pk);
603 PrintAndLog("ERROR: ICC setrificate not found. Exit.");
604 return 2;
605 }
606 printf("ICC PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n",
607 icc_pk->rid[0],
608 icc_pk->rid[1],
609 icc_pk->rid[2],
610 icc_pk->rid[3],
611 icc_pk->rid[4],
612 icc_pk->index,
613 icc_pk->serial[0],
614 icc_pk->serial[1],
615 icc_pk->serial[2]
616 );
617
618 struct emv_pk *icc_pe_pk = emv_pki_recover_icc_pe_cert(issuer_pk, tlv);
619 if (!icc_pe_pk) {
620 PrintAndLog("WARNING: ICC PE PK recover error. ");
621 } else {
622 printf("ICC PE PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n",
623 icc_pe_pk->rid[0],
624 icc_pe_pk->rid[1],
625 icc_pe_pk->rid[2],
626 icc_pe_pk->rid[3],
627 icc_pe_pk->rid[4],
628 icc_pe_pk->index,
629 icc_pe_pk->serial[0],
630 icc_pe_pk->serial[1],
631 icc_pe_pk->serial[2]
632 );
633 }
634
635 // 9F4B: Signed Dynamic Application Data
636 const struct tlv *sdad_tlv = tlvdb_get(tlv, 0x9f4b, NULL);
637 // DDA with internal authenticate OR fDDA with filled 0x9F4B tag (GPO result)
638 // EMV kernel3 v2.4, contactless book C-3, C.1., page 147
639 if (sdad_tlv) {
640 PrintAndLog("\n* * Got Signed Dynamic Application Data (9F4B) form GPO. Maybe fDDA...");
641
642 const struct tlvdb *atc_db = emv_pki_recover_atc_ex(icc_pk, tlv, true);
643 if (!atc_db) {
644 PrintAndLog("ERROR: Can't recover IDN (ICC Dynamic Number)");
645 emv_pk_free(pk);
646 emv_pk_free(issuer_pk);
647 emv_pk_free(icc_pk);
648 return 8;
649 }
650
651 // 9f36 Application Transaction Counter (ATC)
652 const struct tlv *atc_tlv = tlvdb_get(atc_db, 0x9f36, NULL);
653 if(atc_tlv) {
654 PrintAndLog("\nATC (Application Transaction Counter) [%zu] %s", atc_tlv->len, sprint_hex_inrow(atc_tlv->value, atc_tlv->len));
655
656 const struct tlv *core_atc_tlv = tlvdb_get(tlv, 0x9f36, NULL);
657 if(tlv_equal(core_atc_tlv, atc_tlv)) {
658 PrintAndLog("ATC check OK.");
659 PrintAndLog("fDDA (fast DDA) verified OK.");
660 } else {
661 PrintAndLog("ERROR: fDDA verified, but ATC in the certificate and ATC in the record not the same.");
662 }
663 } else {
664 PrintAndLog("\nERROR: fDDA (fast DDA) verify error");
665 emv_pk_free(pk);
666 emv_pk_free(issuer_pk);
667 emv_pk_free(icc_pk);
668 return 9;
669 }
670 } else {
671 struct tlvdb *dac_db = emv_pki_recover_dac(issuer_pk, tlv, sda_tlv);
672 if (dac_db) {
673 const struct tlv *dac_tlv = tlvdb_get(dac_db, 0x9f45, NULL);
674 printf("SDA verified OK. (%02hhx:%02hhx)\n", dac_tlv->value[0], dac_tlv->value[1]);
675 tlvdb_add(tlv, dac_db);
676 } else {
677 PrintAndLog("ERROR: SSAD verify error");
678 emv_pk_free(pk);
679 emv_pk_free(issuer_pk);
680 emv_pk_free(icc_pk);
681 return 4;
682 }
683
684 PrintAndLog("\n* Calc DDOL");
685 const struct tlv *ddol_tlv = tlvdb_get(tlv, 0x9f49, NULL);
686 if (!ddol_tlv) {
687 ddol_tlv = &default_ddol_tlv;
688 PrintAndLog("DDOL [9f49] not found. Using default DDOL");
689 }
690
691 struct tlv *ddol_data_tlv = dol_process(ddol_tlv, tlv, 0);
692 if (!ddol_data_tlv) {
693 PrintAndLog("ERROR: Can't create DDOL TLV");
694 emv_pk_free(pk);
695 emv_pk_free(issuer_pk);
696 emv_pk_free(icc_pk);
697 return 5;
698 }
699
700 PrintAndLog("DDOL data[%d]: %s", ddol_data_tlv->len, sprint_hex(ddol_data_tlv->value, ddol_data_tlv->len));
701
702 PrintAndLog("\n* Internal Authenticate");
703 int res = EMVInternalAuthenticate(true, (uint8_t *)ddol_data_tlv->value, ddol_data_tlv->len, buf, sizeof(buf), &len, &sw, NULL);
704 if (res) {
705 PrintAndLog("Internal Authenticate error(%d): %4x. Exit...", res, sw);
706 free(ddol_data_tlv);
707 emv_pk_free(pk);
708 emv_pk_free(issuer_pk);
709 emv_pk_free(icc_pk);
710 return 6;
711 }
712
713 struct tlvdb *dda_db = NULL;
714 if (buf[0] == 0x80) {
715 if (len < 3 ) {
716 PrintAndLog("ERROR: Internal Authenticate format1 parsing error. length=%d", len);
717 } else {
718 // 9f4b Signed Dynamic Application Data
719 dda_db = tlvdb_fixed(0x9f4b, len - 2, buf + 2);
720 tlvdb_add(tlv, dda_db);
721 if (decodeTLV){
722 PrintAndLog("* * Decode response format 1:");
723 TLVPrintFromTLV(dda_db);
724 }
725 }
726 } else {
727 dda_db = tlvdb_parse_multi(buf, len);
728 if(!dda_db) {
729 PrintAndLog("ERROR: Can't parse Internal Authenticate result as TLV");
730 free(ddol_data_tlv);
731 emv_pk_free(pk);
732 emv_pk_free(issuer_pk);
733 emv_pk_free(icc_pk);
734 return 7;
735 }
736 tlvdb_add(tlv, dda_db);
737
738 if (decodeTLV)
739 TLVPrintFromTLV(dda_db);
740 }
741
742 struct tlvdb *idn_db = emv_pki_recover_idn_ex(icc_pk, dda_db, ddol_data_tlv, true);
743 free(ddol_data_tlv);
744 if (!idn_db) {
745 PrintAndLog("ERROR: Can't recover IDN (ICC Dynamic Number)");
746 tlvdb_free(dda_db);
747 emv_pk_free(pk);
748 emv_pk_free(issuer_pk);
749 emv_pk_free(icc_pk);
750 return 8;
751 }
752 tlvdb_free(dda_db);
753
754 // 9f4c ICC Dynamic Number
755 const struct tlv *idn_tlv = tlvdb_get(idn_db, 0x9f4c, NULL);
756 if(idn_tlv) {
757 PrintAndLog("\nIDN (ICC Dynamic Number) [%zu] %s", idn_tlv->len, sprint_hex_inrow(idn_tlv->value, idn_tlv->len));
758 PrintAndLog("DDA verified OK.");
759 tlvdb_add(tlv, idn_db);
760 tlvdb_free(idn_db);
761 } else {
762 PrintAndLog("\nERROR: DDA verify error");
763 tlvdb_free(idn_db);
764
765 emv_pk_free(pk);
766 emv_pk_free(issuer_pk);
767 emv_pk_free(icc_pk);
768 return 9;
769 }
770 }
10d4f823 771
d03fb293
OM
772 emv_pk_free(pk);
773 emv_pk_free(issuer_pk);
774 emv_pk_free(icc_pk);
10d4f823 775 return 0;
776}
777
d03fb293
OM
778int trCDA(struct tlvdb *tlv, struct tlvdb *ac_tlv, struct tlv *pdol_data_tlv, struct tlv *ac_data_tlv) {
779
780 struct emv_pk *pk = get_ca_pk(tlv);
781 if (!pk) {
782 PrintAndLog("ERROR: Key not found. Exit.");
783 return 2;
784 }
785
786 const struct tlv *sda_tlv = tlvdb_get(tlv, 0x21, NULL);
787 if (!sda_tlv || sda_tlv->len < 1) {
788 PrintAndLog("ERROR: Can't find input list for Offline Data Authentication. Exit.");
789 emv_pk_free(pk);
790 return 3;
791 }
792
793 struct emv_pk *issuer_pk = emv_pki_recover_issuer_cert(pk, tlv);
794 if (!issuer_pk) {
795 PrintAndLog("ERROR: Issuer certificate not found. Exit.");
796 emv_pk_free(pk);
797 return 2;
798 }
799 printf("Issuer PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n",
800 issuer_pk->rid[0],
801 issuer_pk->rid[1],
802 issuer_pk->rid[2],
803 issuer_pk->rid[3],
804 issuer_pk->rid[4],
805 issuer_pk->index,
806 issuer_pk->serial[0],
807 issuer_pk->serial[1],
808 issuer_pk->serial[2]
809 );
810
811 struct emv_pk *icc_pk = emv_pki_recover_icc_cert(issuer_pk, tlv, sda_tlv);
812 if (!icc_pk) {
813 PrintAndLog("ERROR: ICC setrificate not found. Exit.");
814 emv_pk_free(pk);
815 emv_pk_free(issuer_pk);
816 return 2;
817 }
818 printf("ICC PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n",
819 icc_pk->rid[0],
820 icc_pk->rid[1],
821 icc_pk->rid[2],
822 icc_pk->rid[3],
823 icc_pk->rid[4],
824 icc_pk->index,
825 icc_pk->serial[0],
826 icc_pk->serial[1],
827 icc_pk->serial[2]
828 );
829
830 struct tlvdb *dac_db = emv_pki_recover_dac(issuer_pk, tlv, sda_tlv);
831 if (dac_db) {
832 const struct tlv *dac_tlv = tlvdb_get(dac_db, 0x9f45, NULL);
833 PrintAndLog("SSAD verified OK. (%02hhx:%02hhx)", dac_tlv->value[0], dac_tlv->value[1]);
834 tlvdb_add(tlv, dac_db);
835 } else {
836 PrintAndLog("ERROR: SSAD verify error");
837 emv_pk_free(pk);
838 emv_pk_free(issuer_pk);
839 emv_pk_free(icc_pk);
840 return 4;
841 }
842
843 PrintAndLog("\n* * Check Signed Dynamic Application Data (SDAD)");
844 struct tlvdb *idn_db = emv_pki_perform_cda_ex(icc_pk, tlv, ac_tlv,
845 pdol_data_tlv, // pdol
846 ac_data_tlv, // cdol1
847 NULL, // cdol2
848 true);
849 if (idn_db) {
850 const struct tlv *idn_tlv = tlvdb_get(idn_db, 0x9f4c, NULL);
851 PrintAndLog("\nIDN (ICC Dynamic Number) [%zu] %s", idn_tlv->len, sprint_hex_inrow(idn_tlv->value, idn_tlv->len));
852 PrintAndLog("CDA verified OK.");
853 tlvdb_add(tlv, idn_db);
854 } else {
855 PrintAndLog("\nERROR: CDA verify error");
856 }
857
858 emv_pk_free(pk);
859 emv_pk_free(issuer_pk);
860 emv_pk_free(icc_pk);
861 return 0;
862}
95b697f0
OM
863
864int RecoveryCertificates(struct tlvdb *tlvRoot, json_t *root) {
865
866 struct emv_pk *pk = get_ca_pk(tlvRoot);
867 if (!pk) {
868 PrintAndLog("ERROR: Key not found. Exit.");
869 return 1;
870 }
871
872 struct emv_pk *issuer_pk = emv_pki_recover_issuer_cert(pk, tlvRoot);
873 if (!issuer_pk) {
874 emv_pk_free(pk);
875 PrintAndLog("WARNING: Issuer certificate not found. Exit.");
876 return 2;
877 }
878 PrintAndLog("Issuer PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx",
879 issuer_pk->rid[0],
880 issuer_pk->rid[1],
881 issuer_pk->rid[2],
882 issuer_pk->rid[3],
883 issuer_pk->rid[4],
884 issuer_pk->index,
885 issuer_pk->serial[0],
886 issuer_pk->serial[1],
887 issuer_pk->serial[2]
888 );
889
890 JsonSaveBufAsHex(root, "$.ApplicationData.RID", issuer_pk->rid, 5);
891
892 char *issuer_pk_c = emv_pk_dump_pk(issuer_pk);
893 JsonSaveStr(root, "$.ApplicationData.IssuerPublicKeyDec", issuer_pk_c);
894 JsonSaveBufAsHex(root, "$.ApplicationData.IssuerPublicKeyModulus", issuer_pk->modulus, issuer_pk->mlen);
895 free(issuer_pk_c);
896
897 struct emv_pk *icc_pk = emv_pki_recover_icc_cert(issuer_pk, tlvRoot, NULL);
898 if (!icc_pk) {
899 emv_pk_free(pk);
900 emv_pk_free(issuer_pk);
901 PrintAndLog("WARNING: ICC certificate not found. Exit.");
902 return 2;
903 }
904 printf("ICC PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n",
905 icc_pk->rid[0],
906 icc_pk->rid[1],
907 icc_pk->rid[2],
908 icc_pk->rid[3],
909 icc_pk->rid[4],
910 icc_pk->index,
911 icc_pk->serial[0],
912 icc_pk->serial[1],
913 icc_pk->serial[2]
914 );
915
916 char *icc_pk_c = emv_pk_dump_pk(icc_pk);
917 JsonSaveStr(root, "$.ApplicationData.ICCPublicKeyDec", icc_pk_c);
918 JsonSaveBufAsHex(root, "$.ApplicationData.ICCPublicKeyModulus", icc_pk->modulus, icc_pk->mlen);
919 free(issuer_pk_c);
920
921 return 0;
922}
Impressum, Datenschutz