]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhficlass.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
resource leak and malloc(x) cannot be negative
[proxmark3-svn] / client / cmdhficlass.c
CommitLineData
cee5a30d 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833 4// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// High frequency iClass commands
11//-----------------------------------------------------------------------------
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <string.h>
9f6e9d15 16#include <sys/stat.h>
cee5a30d 17#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18#include "data.h"
902cb3c0 19#include "proxmark3.h"
cee5a30d 20#include "ui.h"
21#include "cmdparser.h"
22#include "cmdhficlass.h"
23#include "common.h"
14006804 24#include "util.h"
17cba269 25#include "cmdmain.h"
a66fca86
AD		 26#include "loclass/des.h"
27#include "loclass/cipherutils.h"
28#include "loclass/cipher.h"
29#include "loclass/ikeys.h"
3ad48540
MHS		 30#include "loclass/elite_crack.h"
31#include "loclass/fileutils.h"
1defcf60 32#include "protocols.h"
caaf9618 33#include "usb_cmd.h"
aa53efc3 34#include "cmdhfmfu.h"
35
36#define llX PRIx64
cee5a30d 37
38static int CmdHelp(const char *Cmd);
39
aa53efc3 40#define ICLASS_KEYS_MAX 8
41static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
49 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
50};
51
52typedef struct iclass_block {
53 uint8_t d[8];
54} iclass_block_t;
55
4d68ec02 56int xorbits_8(uint8_t val) {
53444513
MHS		 57 uint8_t res = val ^ (val >> 1); //1st pass
58 res = res ^ (res >> 1); // 2nd pass
59 res = res ^ (res >> 2); // 3rd pass
60 res = res ^ (res >> 4); // 4th pass
61 return res & 1;
17cba269
MHS		 62}
63
4d68ec02 64int CmdHFiClassList(const char *Cmd) {
4c3de57a 65 PrintAndLog("Deprecated command, use 'hf list iclass' instead");
17cba269
MHS		 66 return 0;
67}
68
4d68ec02 69int CmdHFiClassSnoop(const char *Cmd) {
53444513
MHS		 70 UsbCommand c = {CMD_SNOOP_ICLASS};
71 SendCommand(&c);
72 return 0;
cee5a30d 73}
4d68ec02 74
75int usage_hf_iclass_sim(void) {
41524d8a
MHS		 76 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
77 PrintAndLog(" options");
78 PrintAndLog(" 0 <CSN> simulate the given CSN");
79 PrintAndLog(" 1 simulate default CSN");
80 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
81 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
82 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
83 PrintAndLog(" example: hf iclass sim 2");
84 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
85 PrintAndLog(" hf iclass sim 3");
86 return 0;
87}
88
6116c796 89#define NUM_CSNS 15
4d68ec02 90int CmdHFiClassSim(const char *Cmd) {
53444513
MHS		 91 uint8_t simType = 0;
92 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
93
94 if (strlen(Cmd)<1) {
1defcf60 95 return usage_hf_iclass_sim();
53444513 96 }
1defcf60 97 simType = param_get8ex(Cmd, 0, 0, 10);
53444513
MHS		 98
99 if(simType == 0)
100 {
101 if (param_gethex(Cmd, 1, CSN, 16)) {
102 PrintAndLog("A CSN should consist of 16 HEX symbols");
41524d8a 103 return usage_hf_iclass_sim();
53444513 104 }
53444513 105
41524d8a 106 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
53444513 107 }
41524d8a 108 if(simType > 3)
53444513
MHS		 109 {
110 PrintAndLog("Undefined simptype %d", simType);
41524d8a 111 return usage_hf_iclass_sim();
53444513 112 }
1e262141 113
41524d8a 114 uint8_t numberOfCSNs=0;
9f6e9d15
MHS		 115 if(simType == 2)
116 {
6116c796 117 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
9f6e9d15 118 UsbCommand resp = {0};
17cba269 119
53444513
MHS		 120 uint8_t csns[8*NUM_CSNS] = {
121 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
6116c796
MHS		 136
137 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
9f6e9d15
MHS		 138
139 SendCommand(&c);
140 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
141 PrintAndLog("Command timed out");
142 return 0;
143 }
1e262141 144
77abe781 145 uint8_t num_mac_responses = resp.arg[1];
6116c796 146 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
9f6e9d15 147
6116c796 148 size_t datalen = NUM_CSNS*24;
9f6e9d15
MHS		 149 /*
150 * Now, time to dump to file. We'll use this format:
77abe781 151 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15 152 * So, it should wind up as
77abe781
MHS		 153 * 8 * 24 bytes.
154 *
155 * The returndata from the pm3 is on the following format
156 * <4 byte NR><4 byte MAC>
157 * CC are all zeroes, CSN is the same as was sent in
9f6e9d15 158 **/
77abe781
MHS		 159 void* dump = malloc(datalen);
160 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15 161 uint8_t i = 0;
6116c796 162 for(i = 0 ; i < NUM_CSNS ; i++)
9f6e9d15 163 {
77abe781
MHS		 164 memcpy(dump+i*24, csns+i*8,8); //CSN
165 //8 zero bytes here...
166 //Then comes NR_MAC (eight bytes from the response)
167 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
1e262141 168
9f6e9d15
MHS		 169 }
170 /** Now, save to dumpfile **/
77abe781
MHS		 171 saveFile("iclass_mac_attack", "bin", dump,datalen);
172 free(dump);
9f6e9d15
MHS		 173 }else
174 {
175 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
176 memcpy(c.d.asBytes, CSN, 8);
177 SendCommand(&c);
178 }
1e262141 179
53444513 180 return 0;
1e262141 181}
182
4d68ec02 183int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
6ce0e538 184 bool tagFound = false;
caaf9618
MHS		 185 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
186 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
aa53efc3 187 // loop in client not device - else on windows have a communication error
188 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
53444513
MHS		 189 UsbCommand resp;
190 while(!ukbhit()){
aa53efc3 191 SendCommand(&c);
6ce0e538 192 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
193 uint8_t readStatus = resp.arg[0] & 0xff;
194 uint8_t *data = resp.d.asBytes;
53444513 195
6ce0e538 196 if (verbose)
197 PrintAndLog("Readstatus:%02x", readStatus);
caaf9618 198 if( readStatus == 0){
53444513 199 //Aborted
6ce0e538 200 if (verbose) PrintAndLog("Quitting...");
53444513
MHS		 201 return 0;
202 }
6ce0e538 203 if( readStatus & FLAG_ICLASS_READER_CSN){
204 PrintAndLog("CSN: %s",sprint_hex(data,8));
205 tagFound = true;
206 }
caaf9618
MHS		 207 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
208 if( readStatus & FLAG_ICLASS_READER_CONF){
209 printIclassDumpInfo(data);
53444513 210 }
6ce0e538 211 if (tagFound && !loop) return 1;
53444513 212 } else {
6ce0e538 213 if (verbose) PrintAndLog("Command execute timeout");
53444513 214 }
6ce0e538 215 if (!loop) break;
53444513 216 }
53444513 217 return 0;
6ce0e538 218}
219
4d68ec02 220int CmdHFiClassReader(const char *Cmd) {
6ce0e538 221 return HFiClassReader(Cmd, true, true);
c3963755 222}
223
4d68ec02 224int CmdHFiClassReader_Replay(const char *Cmd) {
53444513
MHS		 225 uint8_t readerType = 0;
226 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
c3963755 227
53444513
MHS		 228 if (strlen(Cmd)<1) {
229 PrintAndLog("Usage: hf iclass replay <MAC>");
230 PrintAndLog(" sample: hf iclass replay 00112233");
231 return 0;
232 }
c3963755 233
53444513
MHS		 234 if (param_gethex(Cmd, 0, MAC, 8)) {
235 PrintAndLog("MAC must include 8 HEX symbols");
236 return 1;
237 }
c3963755 238
53444513
MHS		 239 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
240 memcpy(c.d.asBytes, MAC, 4);
241 SendCommand(&c);
1e262141 242
53444513 243 return 0;
1e262141 244}
245
4d68ec02 246int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
247 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
248 memcpy(c.d.asBytes, data, blocksCount * 16);
249 SendCommand(&c);
250 return 0;
251}
252
253int hf_iclass_eload_usage(void) {
7781a656
MHS		 254 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
255 PrintAndLog("Usage: hf iclass eload f <filename>");
256 PrintAndLog("");
257 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
258 return 0;
7781a656
MHS		 259}
260
4d68ec02 261int CmdHFiClassELoad(const char *Cmd) {
7781a656
MHS		 262
263 char opt = param_getchar(Cmd, 0);
264 if (strlen(Cmd)<1 || opt == 'h')
265 return hf_iclass_eload_usage();
266
267 //File handling and reading
268 FILE *f;
269 char filename[FILE_PATH_SIZE];
270 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
271 {
272 f = fopen(filename, "rb");
273 }else{
274 return hf_iclass_eload_usage();
275 }
276
277 if(!f) {
278 PrintAndLog("Failed to read from file '%s'", filename);
279 return 1;
280 }
281
282 fseek(f, 0, SEEK_END);
283 long fsize = ftell(f);
284 fseek(f, 0, SEEK_SET);
285
7a616c0d 286 if (fsize < 0) {
287 PrintAndLog("Error, when getting filesize");
eb5b63b4 288 fclose(f);
7a616c0d 289 return 1;
290 }
1defcf60 291
7a616c0d 292 uint8_t *dump = malloc(fsize);
1defcf60 293
7781a656
MHS		 294 size_t bytes_read = fread(dump, 1, fsize, f);
295 fclose(f);
296
1defcf60 297 printIclassDumpInfo(dump);
7781a656
MHS		 298 //Validate
299
300 if (bytes_read < fsize)
301 {
302 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
303 free(dump);
304 return 1;
305 }
306 //Send to device
307 uint32_t bytes_sent = 0;
308 uint32_t bytes_remaining = bytes_read;
309
310 while(bytes_remaining > 0){
311 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
312 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
313 memcpy(c.d.asBytes, dump, bytes_in_packet);
314 SendCommand(&c);
315 bytes_remaining -= bytes_in_packet;
316 bytes_sent += bytes_in_packet;
317 }
318 free(dump);
319 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
320 return 0;
321}
322
4d68ec02 323static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
41524d8a
MHS		 324 FILE *f = fopen(filename, "rb");
325 if(!f) {
326 PrintAndLog("Failed to read from file '%s'", filename);
327 return 1;
328 }
329 fseek(f, 0, SEEK_END);
330 long fsize = ftell(f);
331 fseek(f, 0, SEEK_SET);
332 size_t bytes_read = fread(buffer, 1, len, f);
333 fclose(f);
334 if(fsize != len)
335 {
336 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
337 return 1;
338 }
339 if(bytes_read != len)
340 {
341 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
342 return 1;
343 }
344 return 0;
345}
346
4d68ec02 347int usage_hf_iclass_decrypt(void) {
348 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
aa53efc3 349 PrintAndLog("");
350 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
351 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
352 PrintAndLog("");
353 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
354 PrintAndLog("");
355 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
356 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
357 PrintAndLog("which is defined by the configuration block.");
358 return 1;
359}
360
4d68ec02 361int CmdHFiClassDecrypt(const char *Cmd) {
41524d8a
MHS		 362 uint8_t key[16] = { 0 };
363 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
364 {
365 usage_hf_iclass_decrypt();
366 return 1;
367 }
368 PrintAndLog("Decryption file found... ");
369 char opt = param_getchar(Cmd, 0);
370 if (strlen(Cmd)<1 || opt == 'h')
371 return usage_hf_iclass_decrypt();
372
373 //Open the tagdump-file
374 FILE *f;
375 char filename[FILE_PATH_SIZE];
165e0775 376 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
41524d8a 377 f = fopen(filename, "rb");
165e0775 378 if ( f == NULL ) {
379 PrintAndLog("Could not find file %s", filename);
380 return 1;
381 }
382 } else {
41524d8a
MHS		 383 return usage_hf_iclass_decrypt();
384 }
385
386 fseek(f, 0, SEEK_END);
387 long fsize = ftell(f);
388 fseek(f, 0, SEEK_SET);
389 uint8_t enc_dump[8] = {0};
390 uint8_t *decrypted = malloc(fsize);
391 des3_context ctx = { DES_DECRYPT ,{ 0 } };
392 des3_set2key_dec( &ctx, key);
393 size_t bytes_read = fread(enc_dump, 1, 8, f);
394
395 //Use the first block (CSN) for filename
396 char outfilename[FILE_PATH_SIZE] = { 0 };
397 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
398 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
399 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
400
401 size_t blocknum =0;
402 while(bytes_read == 8)
403 {
9a9bcea8 404 if(blocknum < 7)
41524d8a
MHS		 405 {
406 memcpy(decrypted+(blocknum*8), enc_dump, 8);
407 }else{
408 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
409 }
410 printvar("decrypted block", decrypted +(blocknum*8), 8);
411 bytes_read = fread(enc_dump, 1, 8, f);
412 blocknum++;
413 }
414 fclose(f);
415
416 saveFile(outfilename,"bin", decrypted, blocknum*8);
c4c3af7c 417 free(decrypted);
41524d8a
MHS		 418 return 0;
419}
7781a656 420
4d68ec02 421int usage_hf_iclass_encrypt(void) {
aa53efc3 422 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
423 PrintAndLog("");
424 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
425 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
426 PrintAndLog("");
427 PrintAndLog("example: hf iclass encrypt 0102030405060708");
428 PrintAndLog("");
429 return 0;
430}
431
4d68ec02 432static int iClassEncryptBlkData(uint8_t *blkData) {
aa53efc3 433 uint8_t key[16] = { 0 };
434 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
435 {
436 usage_hf_iclass_encrypt();
437 return 1;
438 }
439 PrintAndLog("Decryption file found... ");
53444513 440
4d68ec02 441 uint8_t encryptedData[16];
442 uint8_t *encrypted = encryptedData;
aa53efc3 443 des3_context ctx = { DES_DECRYPT ,{ 0 } };
444 des3_set2key_enc( &ctx, key);
445
4d68ec02 446 des3_crypt_ecb(&ctx, blkData,encrypted);
aa53efc3 447 //printvar("decrypted block", decrypted, 8);
4d68ec02 448 memcpy(blkData,encrypted,8);
aa53efc3 449
450 return 1;
451}
452
4d68ec02 453int CmdHFiClassEncryptBlk(const char *Cmd) {
aa53efc3 454 uint8_t blkData[8] = {0};
455 char opt = param_getchar(Cmd, 0);
456 if (strlen(Cmd)<1 || opt == 'h')
457 return usage_hf_iclass_encrypt();
53444513 458
aa53efc3 459 //get the bytes to encrypt
460 if (param_gethex(Cmd, 0, blkData, 16))
53444513 461 {
aa53efc3 462 PrintAndLog("BlockData must include 16 HEX symbols");
53444513
MHS		 463 return 0;
464 }
aa53efc3 465 if (!iClassEncryptBlkData(blkData)) return 0;
53444513 466
aa53efc3 467 printvar("encrypted block", blkData, 8);
468 return 1;
469}
53444513 470
4d68ec02 471void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
aa53efc3 472 uint8_t WB[9];
473 WB[0] = blockno;
474 memcpy(WB + 1,data,8);
475 doMAC_N(WB,sizeof(WB),div_key,MAC);
476 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
477}
53444513 478
4d68ec02 479static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
53444513
MHS		 480 UsbCommand resp;
481
aa53efc3 482 UsbCommand c = {CMD_READER_ICLASS, {0}};
3ac22ee1 483 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
aa53efc3 484 if (use_credit_key)
485 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
53444513 486
aa53efc3 487 clearCommandBuffer();
488 SendCommand(&c);
489 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
490 {
53444513 491 PrintAndLog("Command execute timeout");
aa53efc3 492 return false;
53444513
MHS		 493 }
494
aa53efc3 495 uint8_t isOK = resp.arg[0] & 0xff;
496 uint8_t *data = resp.d.asBytes;
53444513 497
aa53efc3 498 memcpy(CSN,data,8);
499 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
aa53efc3 500 if(isOK > 0)
501 {
502 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
53444513 503 }
aa53efc3 504 if(isOK <= 1){
505 PrintAndLog("Failed to obtain CC! Aborting");
506 return false;
507 }
508 return true;
a66fca86 509}
6f101995 510
bc37cfb3 511static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
aa53efc3 512 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
513 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
aa53efc3 514
515 if (!select_only(CSN, CCNR, use_credit_key, verbose))
516 return false;
517
4d68ec02 518 //get div_key
bc37cfb3
AL		 519 if(rawkey)
520 memcpy(div_key, KEY, 8);
521 else
522 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
523 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
4d68ec02 524
aa53efc3 525 doMAC(CCNR, div_key, MAC);
aa53efc3 526 UsbCommand resp;
527 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
528 memcpy(d.d.asBytes, MAC, 4);
529 clearCommandBuffer();
530 SendCommand(&d);
531 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
532 {
533 PrintAndLog("Auth Command execute timeout");
534 return false;
535 }
536 uint8_t isOK = resp.arg[0] & 0xff;
537 if (!isOK) {
538 PrintAndLog("Authentication error");
539 return false;
540 }
541 return true;
542}
543
4d68ec02 544int usage_hf_iclass_dump(void) {
bc37cfb3 545 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
aa53efc3 546 PrintAndLog("Options:");
547 PrintAndLog(" f <filename> : specify a filename to save dump to");
548 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
549 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
550 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
551 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
552 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
bc37cfb3 553 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
aa53efc3 554 PrintAndLog(" NOTE: * = required");
555 PrintAndLog("Samples:");
556 PrintAndLog(" hf iclass dump k 001122334455667B");
557 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
558 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
559 return 0;
560}
561
4d68ec02 562int CmdHFiClassReader_Dump(const char *Cmd) {
aa53efc3 563
564 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
565 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
566 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
567 uint8_t blockno = 0;
568 uint8_t numblks = 0;
4d68ec02 569 uint8_t maxBlk = 31;
bbd19bec 570 uint8_t app_areas = 1;
b82d8098 571 uint8_t kb = 2;
aa53efc3 572 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
573 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
574 uint8_t keyNbr = 0;
575 uint8_t dataLen = 0;
576 uint8_t fileNameLen = 0;
577 char filename[FILE_PATH_SIZE]={0};
578 char tempStr[50] = {0};
4d68ec02 579 bool have_debit_key = false;
aa53efc3 580 bool have_credit_key = false;
4d68ec02 581 bool use_credit_key = false;
aa53efc3 582 bool elite = false;
bc37cfb3 583 bool rawkey = false;
aa53efc3 584 bool errors = false;
585 uint8_t cmdp = 0;
586
587 while(param_getchar(Cmd, cmdp) != 0x00)
588 {
589 switch(param_getchar(Cmd, cmdp))
590 {
591 case 'h':
592 case 'H':
593 return usage_hf_iclass_dump();
594 case 'c':
595 case 'C':
596 have_credit_key = true;
597 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
598 if (dataLen == 16) {
599 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
600 } else if (dataLen == 1) {
601 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 602 if (keyNbr < ICLASS_KEYS_MAX) {
aa53efc3 603 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
604 } else {
605 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
606 errors = true;
607 }
608 } else {
609 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
610 errors = true;
611 }
612 cmdp += 2;
613 break;
614 case 'e':
615 case 'E':
616 elite = true;
617 cmdp++;
618 break;
619 case 'f':
620 case 'F':
621 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
622 if (fileNameLen < 1) {
623 PrintAndLog("No filename found after f");
624 errors = true;
625 }
626 cmdp += 2;
627 break;
628 case 'k':
629 case 'K':
4d68ec02 630 have_debit_key = true;
aa53efc3 631 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
632 if (dataLen == 16) {
633 errors = param_gethex(tempStr, 0, KEY, dataLen);
634 } else if (dataLen == 1) {
635 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 636 if (keyNbr < ICLASS_KEYS_MAX) {
aa53efc3 637 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
638 } else {
639 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
640 errors = true;
641 }
642 } else {
643 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
644 errors = true;
645 }
646 cmdp += 2;
647 break;
bc37cfb3
AL		 648 case 'r':
649 case 'R':
650 rawkey = true;
651 cmdp++;
652 break;
aa53efc3 653 default:
654 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
655 errors = true;
656 break;
657 }
658 if(errors) return usage_hf_iclass_dump();
659 }
660
661 if (cmdp < 2) return usage_hf_iclass_dump();
4d68ec02 662 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
663 if (!have_debit_key && have_credit_key) use_credit_key = true;
aa53efc3 664
665 //get config and first 3 blocks
666 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
667 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
668 UsbCommand resp;
669 uint8_t tag_data[255*8];
4d68ec02 670
aa53efc3 671 clearCommandBuffer();
672 SendCommand(&c);
4d68ec02 673 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
aa53efc3 674 PrintAndLog("Command execute timeout");
3ac22ee1 675 ul_switch_off_field();
aa53efc3 676 return 0;
677 }
4d68ec02 678 uint8_t readStatus = resp.arg[0] & 0xff;
679 uint8_t *data = resp.d.asBytes;
680
681 if(readStatus == 0){
682 PrintAndLog("No tag found...");
3ac22ee1 683 ul_switch_off_field();
4d68ec02 684 return 0;
685 }
686 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
687 memcpy(tag_data, data, 8*3);
688 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
689 numblks = data[8];
bbd19bec 690 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
b82d8098 691 // large memory - not able to dump pages currently
4d68ec02 692 if (numblks > maxBlk) numblks = maxBlk;
693 }
3ac22ee1 694 ul_switch_off_field();
4d68ec02 695 // authenticate debit key and get div_key - later store in dump block 3
bc37cfb3 696 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
aa53efc3 697 //try twice - for some reason it sometimes fails the first time...
bc37cfb3 698 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
aa53efc3 699 ul_switch_off_field();
700 return 0;
701 }
702 }
aa53efc3 703
4d68ec02 704 // begin dump
3ac22ee1 705 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
aa53efc3 706 clearCommandBuffer();
707 SendCommand(&w);
708 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
709 PrintAndLog("Command execute time-out 1");
3ac22ee1 710 ul_switch_off_field();
aa53efc3 711 return 1;
712 }
713 uint32_t blocksRead = resp.arg[1];
714 uint8_t isOK = resp.arg[0] & 0xff;
715 if (!isOK && !blocksRead) {
716 PrintAndLog("Read Block Failed");
3ac22ee1 717 ul_switch_off_field();
aa53efc3 718 return 0;
719 }
720 uint32_t startindex = resp.arg[2];
721 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
722 PrintAndLog("Data exceeded Buffer size!");
723 blocksRead = (sizeof(tag_data)/8) - blockno;
724 }
4d68ec02 725 // response ok - now get bigbuf content of the dump
aa53efc3 726 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
727 WaitForResponse(CMD_ACK,NULL);
4d68ec02 728 size_t gotBytes = blocksRead*8 + blockno*8;
aa53efc3 729
4d68ec02 730 // try AA2
731 if (have_credit_key) {
732 //turn off hf field before authenticating with different key
aa53efc3 733 ul_switch_off_field();
aa53efc3 734 memset(MAC,0,4);
4d68ec02 735 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
bc37cfb3 736 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
aa53efc3 737 //try twice - for some reason it sometimes fails the first time...
bc37cfb3 738 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
aa53efc3 739 ul_switch_off_field();
740 return 0;
741 }
742 }
4d68ec02 743 // do we still need to read more block? (aa2 enabled?)
744 if (maxBlk > blockno+numblks+1) {
745 // setup dump and start
746 w.arg[0] = blockno + blocksRead;
747 w.arg[1] = maxBlk - (blockno + blocksRead);
4d68ec02 748 clearCommandBuffer();
749 SendCommand(&w);
750 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
751 PrintAndLog("Command execute timeout 2");
3ac22ee1 752 ul_switch_off_field();
4d68ec02 753 return 0;
754 }
755 uint8_t isOK = resp.arg[0] & 0xff;
756 blocksRead = resp.arg[1];
757 if (!isOK && !blocksRead) {
758 PrintAndLog("Read Block Failed 2");
3ac22ee1 759 ul_switch_off_field();
4d68ec02 760 return 0;
761 }
aa53efc3 762
4d68ec02 763 startindex = resp.arg[2];
764 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
765 PrintAndLog("Data exceeded Buffer size!");
766 blocksRead = (sizeof(tag_data) - gotBytes)/8;
767 }
768 // get dumped data from bigbuf
769 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
770 WaitForResponse(CMD_ACK,NULL);
aa53efc3 771
4d68ec02 772 gotBytes += blocksRead*8;
773 } else { //field is still on - turn it off...
774 ul_switch_off_field();
775 }
aa53efc3 776 }
777
4d68ec02 778 // add diversified keys to dump
779 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
780 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
781 // print the dump
782 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
783 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
784 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
aa53efc3 785
aa53efc3 786 if (filename[0] == 0){
787 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
788 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
789 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
790 }
4d68ec02 791
792 // save the dump to .bin file
aa53efc3 793 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
4d68ec02 794 saveFile(filename, "bin", tag_data, gotBytes);
aa53efc3 795 return 1;
796}
797
bc37cfb3 798static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
aa53efc3 799 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
800 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
bc37cfb3 801 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
aa53efc3 802 return 0;
803
804 UsbCommand resp;
805
806 Calc_wb_mac(blockno,bldata,div_key,MAC);
3ac22ee1 807 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
aa53efc3 808 memcpy(w.d.asBytes, bldata, 8);
3ac22ee1 809 memcpy(w.d.asBytes + 8, MAC, 4);
aa53efc3 810
811 clearCommandBuffer();
812 SendCommand(&w);
813 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
814 {
815 PrintAndLog("Write Command execute timeout");
816 return 0;
817 }
818 uint8_t isOK = resp.arg[0] & 0xff;
819 if (!isOK) {
820 PrintAndLog("Write Block Failed");
821 return 0;
822 }
823 PrintAndLog("Write Block Successful");
aa53efc3 824 return 1;
825}
826
4d68ec02 827int usage_hf_iclass_writeblock(void) {
aa53efc3 828 PrintAndLog("Options:");
829 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
830 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
831 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
832 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
833 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
bc37cfb3 834 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
aa53efc3 835 PrintAndLog("Samples:");
836 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
837 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
838 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
839 return 0;
840}
841
842int CmdHFiClass_WriteBlock(const char *Cmd) {
843 uint8_t blockno=0;
3ac22ee1 844 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
aa53efc3 845 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
846 uint8_t keyNbr = 0;
847 uint8_t dataLen = 0;
848 char tempStr[50] = {0};
849 bool use_credit_key = false;
850 bool elite = false;
bc37cfb3 851 bool rawkey= false;
aa53efc3 852 bool errors = false;
853 uint8_t cmdp = 0;
854 while(param_getchar(Cmd, cmdp) != 0x00)
855 {
856 switch(param_getchar(Cmd, cmdp))
857 {
858 case 'h':
859 case 'H':
860 return usage_hf_iclass_writeblock();
861 case 'b':
862 case 'B':
863 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
864 PrintAndLog("Block No must include 2 HEX symbols\n");
865 errors = true;
866 }
867 cmdp += 2;
868 break;
869 case 'c':
870 case 'C':
871 use_credit_key = true;
872 cmdp++;
873 break;
874 case 'd':
875 case 'D':
876 if (param_gethex(Cmd, cmdp+1, bldata, 16))
877 {
878 PrintAndLog("KEY must include 16 HEX symbols\n");
879 errors = true;
880 }
881 cmdp += 2;
882 break;
883 case 'e':
884 case 'E':
885 elite = true;
886 cmdp++;
887 break;
888 case 'k':
889 case 'K':
890 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
891 if (dataLen == 16) {
892 errors = param_gethex(tempStr, 0, KEY, dataLen);
893 } else if (dataLen == 1) {
894 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 895 if (keyNbr < ICLASS_KEYS_MAX) {
aa53efc3 896 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
897 } else {
898 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
899 errors = true;
900 }
901 } else {
902 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
903 errors = true;
904 }
905 cmdp += 2;
906 break;
bc37cfb3
AL		 907 case 'r':
908 case 'R':
909 rawkey = true;
910 cmdp++;
911 break;
aa53efc3 912 default:
913 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
914 errors = true;
915 break;
916 }
917 if(errors) return usage_hf_iclass_writeblock();
918 }
919
920 if (cmdp < 6) return usage_hf_iclass_writeblock();
bc37cfb3 921 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
3ac22ee1 922 ul_switch_off_field();
923 return ans;
aa53efc3 924}
925
4d68ec02 926int usage_hf_iclass_clone(void) {
bc37cfb3 927 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
aa53efc3 928 PrintAndLog("Options:");
929 PrintAndLog(" f <filename>: specify a filename to clone from");
930 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
931 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
932 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
933 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
934 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
bc37cfb3 935 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
aa53efc3 936 PrintAndLog("Samples:");
937 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
938 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
939 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
940 return -1;
941}
942
943int CmdHFiClassCloneTag(const char *Cmd) {
165e0775 944 char filename[FILE_PATH_SIZE] = {0};
aa53efc3 945 char tempStr[50]={0};
946 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
947 uint8_t keyNbr = 0;
948 uint8_t fileNameLen = 0;
949 uint8_t startblock = 0;
950 uint8_t endblock = 0;
951 uint8_t dataLen = 0;
952 bool use_credit_key = false;
953 bool elite = false;
bc37cfb3 954 bool rawkey = false;
aa53efc3 955 bool errors = false;
956 uint8_t cmdp = 0;
957 while(param_getchar(Cmd, cmdp) != 0x00)
958 {
959 switch(param_getchar(Cmd, cmdp))
960 {
961 case 'h':
962 case 'H':
963 return usage_hf_iclass_clone();
964 case 'b':
965 case 'B':
966 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
967 PrintAndLog("Start Block No must include 2 HEX symbols\n");
968 errors = true;
969 }
970 cmdp += 2;
971 break;
972 case 'c':
973 case 'C':
974 use_credit_key = true;
975 cmdp++;
976 break;
977 case 'e':
978 case 'E':
979 elite = true;
980 cmdp++;
981 break;
982 case 'f':
983 case 'F':
984 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
985 if (fileNameLen < 1) {
986 PrintAndLog("No filename found after f");
987 errors = true;
988 }
989 cmdp += 2;
990 break;
991 case 'k':
992 case 'K':
993 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
994 if (dataLen == 16) {
995 errors = param_gethex(tempStr, 0, KEY, dataLen);
996 } else if (dataLen == 1) {
997 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 998 if (keyNbr < ICLASS_KEYS_MAX) {
aa53efc3 999 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1000 } else {
1001 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1002 errors = true;
1003 }
1004 } else {
1005 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1006 errors = true;
1007 }
1008 cmdp += 2;
1009 break;
1010 case 'l':
1011 case 'L':
1012 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1013 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1014 errors = true;
1015 }
1016 cmdp += 2;
1017 break;
bc37cfb3
AL		 1018 case 'r':
1019 case 'R':
1020 rawkey = true;
1021 cmdp++;
1022 break;
aa53efc3 1023 default:
1024 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1025 errors = true;
1026 break;
1027 }
1028 if(errors) return usage_hf_iclass_clone();
1029 }
1030
1031 if (cmdp < 8) return usage_hf_iclass_clone();
1032
1033 FILE *f;
1034
1035 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1036
1037 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1038 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1039 }
1040 // file handling and reading
1041 f = fopen(filename,"rb");
1042 if(!f) {
1043 PrintAndLog("Failed to read from file '%s'", filename);
1044 return 1;
1045 }
1046
1047 if (startblock<5) {
1048 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
165e0775 1049 fclose(f);
aa53efc3 1050 return 0;
1051 }
1052 // now read data from the file from block 6 --- 19
1053 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1054 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1055 // else we have to create a share memory
1056 int i;
1057 fseek(f,startblock*8,SEEK_SET);
33c795d0 1058 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0 ) {
1059 PrintAndLog("File reading error.");
1060 fclose(f);
1061 return 2;
1062 }
aa53efc3 1063
1064 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1065 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1066
bc37cfb3 1067 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
aa53efc3 1068 return 0;
1069
3ac22ee1 1070 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
aa53efc3 1071 uint8_t *ptr;
1072 // calculate all mac for every the block we will write
1073 for (i = startblock; i <= endblock; i++){
1074 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1075 // usb command d start pointer = d + (i - 6) * 12
1076 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1077 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1078 // next one
1079 ptr = w.d.asBytes + (i - startblock) * 12;
1080 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1081 memcpy(ptr + 8,MAC, 4);
1082 }
1083 uint8_t p[12];
1084 for (i = 0; i <= endblock - startblock;i++){
1085 memcpy(p,w.d.asBytes + (i * 12),12);
4d68ec02 1086 printf("Block |%02x|",i + startblock);
1087 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1088 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
aa53efc3 1089 }
1090 UsbCommand resp;
1091 SendCommand(&w);
1092 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1093 {
1094 PrintAndLog("Command execute timeout");
1095 return 0;
1096 }
1097 return 1;
1098}
1099
bc37cfb3 1100static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose) {
aa53efc3 1101 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1102 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1103
bc37cfb3 1104 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
aa53efc3 1105 return 0;
1106
1107 UsbCommand resp;
3ac22ee1 1108 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
aa53efc3 1109 clearCommandBuffer();
1110 SendCommand(&w);
1111 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1112 {
1113 PrintAndLog("Command execute timeout");
1114 return 0;
1115 }
1116 uint8_t isOK = resp.arg[0] & 0xff;
1117 if (!isOK) {
1118 PrintAndLog("Read Block Failed");
1119 return 0;
1120 }
1121 //data read is stored in: resp.d.asBytes[0-15]
1122 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1123 return 1;
1124}
1125
4d68ec02 1126int usage_hf_iclass_readblock(void) {
bc37cfb3 1127 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
aa53efc3 1128 PrintAndLog("Options:");
1129 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1130 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1131 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1132 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
bc37cfb3 1133 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
aa53efc3 1134 PrintAndLog("Samples:");
1135 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1136 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1137 PrintAndLog(" hf iclass readblk b 0A k 0");
1138 return 0;
1139}
1140
4d68ec02 1141int CmdHFiClass_ReadBlock(const char *Cmd) {
aa53efc3 1142 uint8_t blockno=0;
1143 uint8_t keyType = 0x88; //debit key
1144 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1145 uint8_t keyNbr = 0;
1146 uint8_t dataLen = 0;
1147 char tempStr[50] = {0};
1148 bool elite = false;
bc37cfb3 1149 bool rawkey = false;
aa53efc3 1150 bool errors = false;
1151 uint8_t cmdp = 0;
1152 while(param_getchar(Cmd, cmdp) != 0x00)
1153 {
1154 switch(param_getchar(Cmd, cmdp))
1155 {
1156 case 'h':
1157 case 'H':
1158 return usage_hf_iclass_readblock();
1159 case 'b':
1160 case 'B':
1161 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1162 PrintAndLog("Block No must include 2 HEX symbols\n");
1163 errors = true;
1164 }
1165 cmdp += 2;
1166 break;
1167 case 'c':
1168 case 'C':
1169 keyType = 0x18;
1170 cmdp++;
1171 break;
1172 case 'e':
1173 case 'E':
1174 elite = true;
1175 cmdp++;
1176 break;
1177 case 'k':
1178 case 'K':
1179 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1180 if (dataLen == 16) {
1181 errors = param_gethex(tempStr, 0, KEY, dataLen);
1182 } else if (dataLen == 1) {
1183 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 1184 if (keyNbr < ICLASS_KEYS_MAX) {
aa53efc3 1185 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1186 } else {
1187 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1188 errors = true;
1189 }
1190 } else {
1191 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1192 errors = true;
1193 }
1194 cmdp += 2;
1195 break;
bc37cfb3
AL		 1196 case 'r':
1197 case 'R':
1198 rawkey = true;
1199 cmdp++;
1200 break;
aa53efc3 1201 default:
1202 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1203 errors = true;
1204 break;
1205 }
1206 if(errors) return usage_hf_iclass_readblock();
1207 }
1208
1209 if (cmdp < 4) return usage_hf_iclass_readblock();
4d68ec02 1210
bc37cfb3 1211 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true);
aa53efc3 1212}
1213
4d68ec02 1214int CmdHFiClass_loclass(const char *Cmd) {
aa53efc3 1215 char opt = param_getchar(Cmd, 0);
1216
1217 if (strlen(Cmd)<1 || opt == 'h') {
1218 PrintAndLog("Usage: hf iclass loclass [options]");
1219 PrintAndLog("Options:");
1220 PrintAndLog("h Show this help");
6f101995
MHS		 1221 PrintAndLog("t Perform self-test");
1222 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1223 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1224 PrintAndLog(" malicious CSNs, and their protocol responses");
1225 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1226 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1227 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1228 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1229 PrintAndLog(" ... totalling N*24 bytes");
1230 return 0;
1231 }
1232 char fileName[255] = {0};
1233 if(opt == 'f')
1234 {
53444513
MHS		 1235 if(param_getstr(Cmd, 1, fileName) > 0)
1236 {
1237 return bruteforceFileNoKeys(fileName);
1238 }else
1239 {
1240 PrintAndLog("You must specify a filename");
1241 }
6f101995
MHS		 1242 }
1243 else if(opt == 't')
1244 {
1245 int errors = testCipherUtils();
1246 errors += testMAC();
1247 errors += doKeyTests(0);
1248 errors += testElite();
1249 if(errors)
1250 {
1251 prnlog("OBS! There were errors!!!");
1252 }
1253 return errors;
1254 }
a66fca86 1255
6f101995
MHS		 1256 return 0;
1257}
c3963755 1258
4d68ec02 1259void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
aa53efc3 1260 uint8_t blockdata[8];
1261 uint8_t mem_config;
1262 memcpy(&mem_config, iclass_dump + 13,1);
1263 uint8_t maxmemcount;
1264 uint8_t filemaxblock = filesize / 8;
4d68ec02 1265 if (mem_config & 0x80)
aa53efc3 1266 maxmemcount = 255;
1267 else
4d68ec02 1268 maxmemcount = 31;
1269 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
aa53efc3 1270
1271 if (startblock == 0)
1272 startblock = 6;
1273 if ((endblock > maxmemcount) || (endblock == 0))
1274 endblock = maxmemcount;
1275 if (endblock > filemaxblock)
1276 endblock = filemaxblock;
1277 int i = startblock;
1278 int j;
4d68ec02 1279 while (i <= endblock){
1280 printf("Block |%02X| ",i);
aa53efc3 1281 memcpy(blockdata,iclass_dump + (i * 8),8);
1282 for (j = 0;j < 8;j++)
1283 printf("%02X ",blockdata[j]);
4d68ec02 1284 printf("|\n");
aa53efc3 1285 i++;
1286 }
aa53efc3 1287}
1288
4d68ec02 1289int usage_hf_iclass_readtagfile() {
1290 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1291 return 1;
1292}
1293
1294int CmdHFiClassReadTagFile(const char *Cmd) {
aa53efc3 1295 int startblock = 0;
1296 int endblock = 0;
1297 char tempnum[5];
1298 FILE *f;
1299 char filename[FILE_PATH_SIZE];
1300 if (param_getstr(Cmd, 0, filename) < 1)
1301 return usage_hf_iclass_readtagfile();
1302 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1303 startblock = 0;
1304 else
1305 sscanf(tempnum,"%d",&startblock);
1306
1307 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1308 endblock = 0;
1309 else
1310 sscanf(tempnum,"%d",&endblock);
1311 // file handling and reading
1312 f = fopen(filename,"rb");
1313 if(!f) {
1314 PrintAndLog("Failed to read from file '%s'", filename);
1315 return 1;
1316 }
1317 fseek(f, 0, SEEK_END);
1318 long fsize = ftell(f);
1319 fseek(f, 0, SEEK_SET);
1320
b0c68b72 1321 if ( fsize < 0 ) {
1322 PrintAndLog("Error, when getting filesize");
1323 fclose(f);
1324 return 1;
1325 }
aa53efc3 1326
b0c68b72 1327 uint8_t *dump = malloc(fsize);
aa53efc3 1328
1329 size_t bytes_read = fread(dump, 1, fsize, f);
1330 fclose(f);
1331 uint8_t *csn = dump;
4d68ec02 1332 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
aa53efc3 1333 // printIclassDumpInfo(dump);
1334 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1335 free(dump);
1336 return 0;
1337}
1338
4d68ec02 1339/*
1340uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
aa53efc3 1341 uint64_t new_div = 0x00;
1342 new_div ^= sdiv;
1343 new_div ^= hdiv;
1344 return new_div;
1345}
1346
4d68ec02 1347uint64_t hexarray_to_uint64(uint8_t *key) {
aa53efc3 1348 char temp[17];
1349 uint64_t uint_key;
1350 for (int i = 0;i < 8;i++)
1351 sprintf(&temp[(i *2)],"%02X",key[i]);
1352 temp[16] = '\0';
1353 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1354 return 0;
1355 return uint_key;
1356}
4d68ec02 1357*/
1358void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
aa53efc3 1359 uint8_t keytable[128] = {0};
1360 uint8_t key_index[8] = {0};
4d68ec02 1361 if (elite) {
1362 uint8_t key_sel[8] = { 0 };
1363 uint8_t key_sel_p[8] = { 0 };
1364 hash2(KEY, keytable);
1365 hash1(CSN, key_index);
1366 for(uint8_t i = 0; i < 8 ; i++)
1367 key_sel[i] = keytable[key_index[i]] & 0xFF;
aa53efc3 1368
4d68ec02 1369 //Permute from iclass format to standard format
1370 permutekey_rev(key_sel, key_sel_p);
1371 diversifyKey(CSN, key_sel_p, div_key);
1372 } else {
1373 diversifyKey(CSN, KEY, div_key);
1374 }
1375}
aa53efc3 1376
4d68ec02 1377//when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1378//calculate and return xor_div_key (ready for a key write command)
1379//print all div_keys if verbose
1380static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1381 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1382 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1383 //get old div key
1384 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1385 //get new div key
1386 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1387
1388 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1389 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1390 }
1391 if (verbose) {
1392 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1393 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1394 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1395 }
1396}
aa53efc3 1397
4d68ec02 1398int usage_hf_iclass_calc_newkey(void) {
1399 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1400 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1401 PrintAndLog(" Options:");
1402 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1403 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1404 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1405 PrintAndLog(" e : specify new key as elite calc");
1406 PrintAndLog(" ee : specify old and new key as elite calc");
1407 PrintAndLog("Samples:");
1408 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1409 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1410 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1411 PrintAndLog("NOTE: * = required\n");
aa53efc3 1412
4d68ec02 1413 return 1;
1414}
aa53efc3 1415
4d68ec02 1416int CmdHFiClassCalcNewKey(const char *Cmd) {
1417 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1418 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1419 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1420 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1421 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1422 uint8_t keyNbr = 0;
1423 uint8_t dataLen = 0;
1424 char tempStr[50] = {0};
1425 bool givenCSN = false;
1426 bool oldElite = false;
1427 bool elite = false;
1428 bool errors = false;
1429 uint8_t cmdp = 0;
1430 while(param_getchar(Cmd, cmdp) != 0x00)
1431 {
1432 switch(param_getchar(Cmd, cmdp))
1433 {
1434 case 'h':
1435 case 'H':
1436 return usage_hf_iclass_calc_newkey();
1437 case 'e':
1438 case 'E':
1439 dataLen = param_getstr(Cmd, cmdp, tempStr);
1440 if (dataLen==2)
1441 oldElite = true;
1442 elite = true;
1443 cmdp++;
1444 break;
1445 case 'n':
1446 case 'N':
1447 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1448 if (dataLen == 16) {
1449 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1450 } else if (dataLen == 1) {
1451 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 1452 if (keyNbr < ICLASS_KEYS_MAX) {
4d68ec02 1453 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1454 } else {
1455 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1456 errors = true;
1457 }
1458 } else {
1459 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1460 errors = true;
1461 }
1462 cmdp += 2;
1463 break;
1464 case 'o':
1465 case 'O':
1466 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1467 if (dataLen == 16) {
1468 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1469 } else if (dataLen == 1) {
1470 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 1471 if (keyNbr < ICLASS_KEYS_MAX) {
4d68ec02 1472 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1473 } else {
1474 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1475 errors = true;
1476 }
1477 } else {
1478 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1479 errors = true;
1480 }
1481 cmdp += 2;
1482 break;
1483 case 's':
1484 case 'S':
1485 givenCSN = true;
1486 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1487 return usage_hf_iclass_calc_newkey();
1488 cmdp += 2;
1489 break;
1490 default:
1491 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1492 errors = true;
1493 break;
1494 }
1495 if(errors) return usage_hf_iclass_calc_newkey();
1496 }
aa53efc3 1497
4d68ec02 1498 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
aa53efc3 1499
4d68ec02 1500 if (!givenCSN)
1501 if (!select_only(CSN, CCNR, false, true))
1502 return 0;
1503
1504 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
aa53efc3 1505 return 0;
1506}
1507
4d68ec02 1508static int loadKeys(char *filename) {
aa53efc3 1509 FILE *f;
1510 f = fopen(filename,"rb");
1511 if(!f) {
1512 PrintAndLog("Failed to read from file '%s'", filename);
1513 return 0;
1514 }
1515 fseek(f, 0, SEEK_END);
1516 long fsize = ftell(f);
1517 fseek(f, 0, SEEK_SET);
1518
eb5b63b4 1519 if ( fsize < 0 ) {
1520 PrintAndLog("Error, when getting filesize");
1521 fclose(f);
1522 return 1;
1523 }
1524
aa53efc3 1525 uint8_t *dump = malloc(fsize);
1526
1527 size_t bytes_read = fread(dump, 1, fsize, f);
1528 fclose(f);
1529 if (bytes_read > ICLASS_KEYS_MAX * 8){
1530 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1531 free(dump);
1532 return 0;
1533 }
1534 uint8_t i = 0;
1535 for (; i < bytes_read/8; i++){
1536 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1537 }
1538 free(dump);
1539 PrintAndLog("%u keys loaded", i);
1540 return 1;
1541}
1542
4d68ec02 1543static int saveKeys(char *filename) {
aa53efc3 1544 FILE *f;
1545 f = fopen(filename,"wb");
1546 if (f == NULL) {
1547 printf("error opening file %s\n",filename);
1548 return 0;
1549 }
1550 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1551 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1552 PrintAndLog("save key failed to write to file: %s", filename);
1553 break;
1554 }
1555 }
1556 fclose(f);
1557 return 0;
1558}
1559
4d68ec02 1560static int printKeys(void) {
aa53efc3 1561 PrintAndLog("");
1562 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1563 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1564 }
1565 PrintAndLog("");
1566 return 0;
1567}
1568
4d68ec02 1569int usage_hf_iclass_managekeys(void) {
aa53efc3 1570 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1571 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1572 PrintAndLog(" Options:");
1573 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1574 PrintAndLog(" k <key> : set a key in memory");
1575 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1576 PrintAndLog(" s : save keys in memory to file specified by filename");
1577 PrintAndLog(" l : load keys to memory from file specified by filename");
1578 PrintAndLog(" p : print keys loaded into memory\n");
1579 PrintAndLog("Samples:");
1580 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1581 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1582 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1583 PrintAndLog(" print keys : hf iclass managekeys p\n");
1584 return 0;
1585}
1586
4d68ec02 1587int CmdHFiClassManageKeys(const char *Cmd) {
aa53efc3 1588 uint8_t keyNbr = 0;
1589 uint8_t dataLen = 0;
1590 uint8_t KEY[8] = {0};
1591 char filename[FILE_PATH_SIZE];
1592 uint8_t fileNameLen = 0;
1593 bool errors = false;
1594 uint8_t operation = 0;
1595 char tempStr[20];
1596 uint8_t cmdp = 0;
1597
1598 while(param_getchar(Cmd, cmdp) != 0x00)
1599 {
1600 switch(param_getchar(Cmd, cmdp))
1601 {
1602 case 'h':
1603 case 'H':
1604 return usage_hf_iclass_managekeys();
1605 case 'f':
1606 case 'F':
1607 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1608 if (fileNameLen < 1) {
1609 PrintAndLog("No filename found after f");
1610 errors = true;
1611 }
1612 cmdp += 2;
1613 break;
1614 case 'n':
1615 case 'N':
1616 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 1617 if (keyNbr >= ICLASS_KEYS_MAX) {
1618 PrintAndLog("Invalid block number");
aa53efc3 1619 errors = true;
1620 }
1621 cmdp += 2;
1622 break;
1623 case 'k':
1624 case 'K':
1625 operation += 3; //set key
1626 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1627 if (dataLen == 16) { //ul-c or ev1/ntag key length
1628 errors = param_gethex(tempStr, 0, KEY, dataLen);
1629 } else {
1630 PrintAndLog("\nERROR: Key is incorrect length\n");
1631 errors = true;
1632 }
1633 cmdp += 2;
1634 break;
1635 case 'p':
1636 case 'P':
1637 operation += 4; //print keys in memory
1638 cmdp++;
1639 break;
1640 case 'l':
1641 case 'L':
1642 operation += 5; //load keys from file
1643 cmdp++;
1644 break;
1645 case 's':
1646 case 'S':
1647 operation += 6; //save keys to file
1648 cmdp++;
1649 break;
1650 default:
1651 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1652 errors = true;
1653 break;
1654 }
1655 if(errors) return usage_hf_iclass_managekeys();
1656 }
1657 if (operation == 0){
1658 PrintAndLog("no operation specified (load, save, or print)\n");
1659 return usage_hf_iclass_managekeys();
1660 }
1661 if (operation > 6){
1662 PrintAndLog("Too many operations specified\n");
1663 return usage_hf_iclass_managekeys();
1664 }
1665 if (operation > 4 && fileNameLen == 0){
1666 PrintAndLog("You must enter a filename when loading or saving\n");
1667 return usage_hf_iclass_managekeys();
1668 }
1669
1670 switch (operation){
1671 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1672 case 4: return printKeys();
1673 case 5: return loadKeys(filename);
1674 case 6: return saveKeys(filename);
1675 break;
1676 }
1677 return 0;
1678}
1679
cee5a30d 1680static command_t CommandTable[] =
1681{
aa53efc3 1682 {"help", CmdHelp, 1, "This help"},
4d68ec02 1683 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1684 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1685 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1686 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1687 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1688 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1689 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1690 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1691 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1692 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1693 {"reader", CmdHFiClassReader, 0, " Read an iClass tag"},
1694 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1695 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1696 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1697 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1698 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
6f101995 1699 {NULL, NULL, 0, NULL}
cee5a30d 1700};
1701
1702int CmdHFiClass(const char *Cmd)
1703{
53444513
MHS		 1704 CmdsParse(CommandTable, Cmd);
1705 return 0;
cee5a30d 1706}
1707
1708int CmdHelp(const char *Cmd)
1709{
53444513
MHS		 1710 CmdsHelp(CommandTable);
1711 return 0;
cee5a30d 1712}
Proxmark3 GIT tracking
Impressum, Datenschutz