]>
Commit | Line | Data |
---|---|---|
cee5a30d | 1 | //----------------------------------------------------------------------------- |
2 | // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch | |
3 | // Copyright (C) 2011 Gerhard de Koning Gans | |
4 | // | |
5 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
6 | // at your option, any later version. See the LICENSE.txt file for the text of | |
7 | // the license. | |
8 | //----------------------------------------------------------------------------- | |
9 | // High frequency iClass commands | |
10 | //----------------------------------------------------------------------------- | |
11 | ||
12 | #include <stdio.h> | |
13 | #include <stdlib.h> | |
14 | #include <string.h> | |
15 | #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type | |
16 | #include "data.h" | |
28fdb04f | 17 | //#include "proxusb.h" |
902cb3c0 | 18 | #include "proxmark3.h" |
cee5a30d | 19 | #include "ui.h" |
20 | #include "cmdparser.h" | |
21 | #include "cmdhficlass.h" | |
22 | #include "common.h" | |
14006804 | 23 | #include "util.h" |
a66fca86 AD |
24 | #include "loclass/des.h" |
25 | #include "loclass/cipherutils.h" | |
26 | #include "loclass/cipher.h" | |
27 | #include "loclass/ikeys.h" | |
cee5a30d | 28 | |
29 | static int CmdHelp(const char *Cmd); | |
30 | ||
31 | int CmdHFiClassList(const char *Cmd) | |
32 | { | |
33 | uint8_t got[1920]; | |
db09cb3a | 34 | GetFromBigBuf(got,sizeof(got),0); |
cee5a30d | 35 | |
36 | PrintAndLog("recorded activity:"); | |
37 | PrintAndLog(" ETU :rssi: who bytes"); | |
38 | PrintAndLog("---------+----+----+-----------"); | |
39 | ||
40 | int i = 0; | |
41 | int prev = -1; | |
42 | ||
43 | for (;;) { | |
44 | if(i >= 1900) { | |
45 | break; | |
46 | } | |
47 | ||
48 | bool isResponse; | |
49 | int timestamp = *((uint32_t *)(got+i)); | |
50 | if (timestamp & 0x80000000) { | |
51 | timestamp &= 0x7fffffff; | |
52 | isResponse = 1; | |
53 | } else { | |
54 | isResponse = 0; | |
55 | } | |
56 | ||
57 | int metric = 0; | |
58 | int parityBits = *((uint32_t *)(got+i+4)); | |
59 | // 4 bytes of additional information... | |
60 | // maximum of 32 additional parity bit information | |
61 | // | |
62 | // TODO: | |
63 | // at each quarter bit period we can send power level (16 levels) | |
64 | // or each half bit period in 256 levels. | |
65 | ||
66 | ||
67 | int len = got[i+8]; | |
68 | ||
69 | if (len > 100) { | |
70 | break; | |
71 | } | |
72 | if (i + len >= 1900) { | |
73 | break; | |
74 | } | |
75 | ||
76 | uint8_t *frame = (got+i+9); | |
77 | ||
78 | // Break and stick with current result if buffer was not completely full | |
79 | if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; } | |
80 | ||
81 | char line[1000] = ""; | |
82 | int j; | |
83 | for (j = 0; j < len; j++) { | |
84 | int oddparity = 0x01; | |
85 | int k; | |
86 | ||
87 | for (k=0;k<8;k++) { | |
88 | oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01); | |
89 | } | |
90 | ||
91 | //if((parityBits >> (len - j - 1)) & 0x01) { | |
92 | if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) { | |
93 | sprintf(line+(j*4), "%02x! ", frame[j]); | |
94 | } | |
95 | else { | |
96 | sprintf(line+(j*4), "%02x ", frame[j]); | |
97 | } | |
98 | } | |
99 | ||
100 | char *crc; | |
101 | crc = ""; | |
102 | if (len > 2) { | |
103 | uint8_t b1, b2; | |
104 | for (j = 0; j < (len - 1); j++) { | |
105 | // gives problems... search for the reason.. | |
106 | /*if(frame[j] == 0xAA) { | |
107 | switch(frame[j+1]) { | |
108 | case 0x01: | |
109 | crc = "[1] Two drops close after each other"; | |
110 | break; | |
111 | case 0x02: | |
112 | crc = "[2] Potential SOC with a drop in second half of bitperiod"; | |
113 | break; | |
114 | case 0x03: | |
115 | crc = "[3] Segment Z after segment X is not possible"; | |
116 | break; | |
117 | case 0x04: | |
118 | crc = "[4] Parity bit of a fully received byte was wrong"; | |
119 | break; | |
120 | default: | |
121 | crc = "[?] Unknown error"; | |
122 | break; | |
123 | } | |
124 | break; | |
125 | }*/ | |
126 | } | |
127 | ||
128 | if (strlen(crc)==0) { | |
129 | if(!isResponse && len == 4) { | |
130 | // Rough guess that this is a command from the reader | |
131 | // For iClass the command byte is not part of the CRC | |
132 | ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2); | |
133 | } | |
134 | else { | |
135 | // For other data.. CRC might not be applicable (UPDATE commands etc.) | |
136 | ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2); | |
137 | } | |
138 | //printf("%1x %1x",(unsigned)b1,(unsigned)b2); | |
139 | if (b1 != frame[len-2] || b2 != frame[len-1]) { | |
140 | crc = (isResponse & (len < 8)) ? "" : " !crc"; | |
141 | } else { | |
142 | crc = ""; | |
143 | } | |
144 | } | |
145 | } else { | |
146 | crc = ""; // SHORT | |
147 | } | |
148 | ||
149 | char metricString[100]; | |
150 | if (isResponse) { | |
151 | sprintf(metricString, "%3d", metric); | |
152 | } else { | |
153 | strcpy(metricString, " "); | |
154 | } | |
155 | ||
156 | PrintAndLog(" +%7d: %s: %s %s %s", | |
157 | (prev < 0 ? 0 : (timestamp - prev)), | |
158 | metricString, | |
159 | (isResponse ? "TAG" : " "), line, crc); | |
160 | ||
161 | prev = timestamp; | |
162 | i += (len + 9); | |
163 | } | |
164 | return 0; | |
165 | } | |
166 | ||
167 | /*void iso14a_set_timeout(uint32_t timeout) { | |
168 | UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_SET_TIMEOUT, 0, timeout}}; | |
169 | SendCommand(&c); | |
170 | }*/ | |
171 | ||
172 | int CmdHFiClassSnoop(const char *Cmd) | |
173 | { | |
174 | UsbCommand c = {CMD_SNOOP_ICLASS}; | |
175 | SendCommand(&c); | |
176 | return 0; | |
177 | } | |
178 | ||
1e262141 | 179 | int CmdHFiClassSim(const char *Cmd) |
180 | { | |
181 | uint8_t simType = 0; | |
182 | uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0}; | |
183 | ||
184 | if (strlen(Cmd)<2) { | |
185 | PrintAndLog("Usage: hf iclass sim <sim type> <CSN (16 hex symbols)>"); | |
186 | PrintAndLog(" sample: hf iclass sim 0 031FEC8AF7FF12E0"); | |
187 | return 0; | |
188 | } | |
189 | ||
190 | simType = param_get8(Cmd, 0); | |
191 | if (param_gethex(Cmd, 1, CSN, 16)) { | |
192 | PrintAndLog("A CSN should consist of 16 HEX symbols"); | |
193 | return 1; | |
194 | } | |
195 | PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8)); | |
196 | ||
197 | UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType}}; | |
198 | memcpy(c.d.asBytes, CSN, 8); | |
199 | SendCommand(&c); | |
200 | ||
201 | /*UsbCommand * resp = WaitForResponseTimeout(CMD_ACK, 1500); | |
202 | if (resp != NULL) { | |
203 | uint8_t isOK = resp->arg[0] & 0xff; | |
204 | PrintAndLog("isOk:%02x", isOK); | |
205 | } else { | |
206 | PrintAndLog("Command execute timeout"); | |
207 | }*/ | |
208 | ||
209 | return 0; | |
210 | } | |
211 | ||
212 | int CmdHFiClassReader(const char *Cmd) | |
213 | { | |
214 | uint8_t readerType = 0; | |
215 | ||
216 | if (strlen(Cmd)<1) { | |
217 | PrintAndLog("Usage: hf iclass reader <reader type>"); | |
218 | PrintAndLog(" sample: hf iclass reader 0"); | |
219 | return 0; | |
220 | } | |
221 | ||
222 | readerType = param_get8(Cmd, 0); | |
223 | PrintAndLog("--readertype:%02x", readerType); | |
224 | ||
225 | UsbCommand c = {CMD_READER_ICLASS, {readerType}}; | |
1e262141 | 226 | SendCommand(&c); |
227 | ||
c3963755 | 228 | return 0; |
229 | } | |
230 | ||
231 | int CmdHFiClassReader_Replay(const char *Cmd) | |
232 | { | |
233 | uint8_t readerType = 0; | |
234 | uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00}; | |
235 | ||
236 | if (strlen(Cmd)<1) { | |
237 | PrintAndLog("Usage: hf iclass replay <MAC>"); | |
238 | PrintAndLog(" sample: hf iclass replay 00112233"); | |
239 | return 0; | |
240 | } | |
241 | ||
242 | if (param_gethex(Cmd, 0, MAC, 8)) { | |
243 | PrintAndLog("MAC must include 8 HEX symbols"); | |
244 | return 1; | |
245 | } | |
246 | ||
247 | UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}}; | |
248 | memcpy(c.d.asBytes, MAC, 4); | |
249 | SendCommand(&c); | |
1e262141 | 250 | |
251 | return 0; | |
252 | } | |
253 | ||
a66fca86 AD |
254 | int CmdHFiClassReader_Dump(const char *Cmd) |
255 | { | |
256 | uint8_t readerType = 0; | |
257 | uint8_t MAC[4]={0x00,0x00,0x00,0x00}; | |
258 | uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}; | |
259 | uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}; | |
260 | uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}; | |
261 | uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}; | |
262 | uint8_t result[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}; | |
263 | uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}; | |
264 | des_context ctx_enc; | |
265 | uint64_t crypted_id=0; | |
266 | ||
267 | if (strlen(Cmd)<3) { | |
268 | PrintAndLog("Usage: hf iclass dump <Key> <CSN> <CC>"); | |
269 | PrintAndLog(" sample: hf iclass dump 0011223344556677 aabbccddeeffgghh FFFFFFFFFFFFFFFF"); | |
270 | return 0; | |
271 | } | |
272 | ||
273 | if (param_gethex(Cmd, 0, KEY, 16)) { | |
274 | PrintAndLog("KEY must include 16 HEX symbols"); | |
275 | return 1; | |
276 | } | |
277 | ||
278 | if (param_gethex(Cmd, 1, CSN, 16)) { | |
279 | PrintAndLog("CSN must include 16 HEX symbols"); | |
280 | return 1; | |
281 | } | |
282 | if (param_gethex(Cmd, 2, CC_temp, 16)) { | |
283 | PrintAndLog("CC must include 16 HEX symbols"); | |
284 | return 1; | |
285 | } | |
286 | ||
287 | memcpy(CCNR,CC_temp,8); | |
288 | des_setkey_enc( &ctx_enc, KEY); | |
289 | des_crypt_ecb(&ctx_enc,CSN,result); | |
290 | PrintAndLog("DES Key: %s",sprint_hex(result,8)); | |
291 | uint64_t newz=0; | |
292 | crypted_id = bytes_to_num(result,8); | |
293 | uint64_t x = (crypted_id & 0xFFFF000000000000 ); | |
294 | pushbackSixBitByte(&newz, getSixBitByte(crypted_id,0),7); | |
295 | pushbackSixBitByte(&newz, getSixBitByte(crypted_id,1),6); | |
296 | pushbackSixBitByte(&newz, getSixBitByte(crypted_id,2),5); | |
297 | pushbackSixBitByte(&newz, getSixBitByte(crypted_id,3),4); | |
298 | pushbackSixBitByte(&newz, getSixBitByte(crypted_id,4),3); | |
299 | pushbackSixBitByte(&newz, getSixBitByte(crypted_id,5),2); | |
300 | pushbackSixBitByte(&newz, getSixBitByte(crypted_id,6),1); | |
301 | pushbackSixBitByte(&newz, getSixBitByte(crypted_id,7),0); | |
302 | newz|= x; | |
303 | crypted_id=newz; | |
304 | num_to_bytes(crypted_id,8,result); | |
305 | PrintAndLog("DESr Key: %s",sprint_hex(result,8)); | |
306 | //crypted_id = bytes_to_num(result,8); | |
307 | //memset(result,0,8); | |
308 | hash0(crypted_id,div_key); | |
309 | //memcpy(div_key,result,8); | |
310 | PrintAndLog("Div Key: %s",sprint_hex(div_key,8)); | |
311 | calc_iclass_mac(CCNR,div_key,MAC); | |
312 | ||
313 | UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}}; | |
314 | memcpy(c.d.asBytes, MAC, 4); | |
315 | SendCommand(&c); | |
316 | ||
317 | return 0; | |
318 | } | |
319 | ||
c3963755 | 320 | |
cee5a30d | 321 | static command_t CommandTable[] = |
322 | { | |
323 | {"help", CmdHelp, 1, "This help"}, | |
324 | {"list", CmdHFiClassList, 0, "List iClass history"}, | |
325 | {"snoop", CmdHFiClassSnoop, 0, "Eavesdrop iClass communication"}, | |
1e262141 | 326 | {"sim", CmdHFiClassSim, 0, "Simulate iClass tag"}, |
327 | {"reader", CmdHFiClassReader, 0, "Read an iClass tag"}, | |
c3963755 | 328 | {"replay", CmdHFiClassReader_Replay, 0, "Read an iClass tag via Reply Attack"}, |
a66fca86 | 329 | {"dump", CmdHFiClassReader_Dump, 0, "Authenticate and Dump iClass tag"}, |
cee5a30d | 330 | {NULL, NULL, 0, NULL} |
331 | }; | |
332 | ||
333 | int CmdHFiClass(const char *Cmd) | |
334 | { | |
335 | CmdsParse(CommandTable, Cmd); | |
336 | return 0; | |
337 | } | |
338 | ||
339 | int CmdHelp(const char *Cmd) | |
340 | { | |
341 | CmdsHelp(CommandTable); | |
342 | return 0; | |
343 | } |