[proxmark3-svn] / client / cmdhficlass.c

//-----------------------------------------------------------------------------
// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
// Copyright (C) 2011 Gerhard de Koning Gans
// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// High frequency iClass commands
//-----------------------------------------------------------------------------

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
#include "data.h"
//#include "proxusb.h"
#include "proxmark3.h"
#include "ui.h"
#include "cmdparser.h"
#include "cmdhficlass.h"
#include "common.h"
#include "util.h"
#include "cmdmain.h"
#include "loclass/des.h"
#include "loclass/cipherutils.h"
#include "loclass/cipher.h"
#include "loclass/ikeys.h"
#include "loclass/elite_crack.h"
#include "loclass/fileutils.h"

static int CmdHelp(const char *Cmd);

int xorbits_8(uint8_t val)
{
    uint8_t res = val ^ (val >> 1); //1st pass
    res = res ^ (res >> 1); 		// 2nd pass
    res = res ^ (res >> 2); 		// 3rd pass
    res = res ^ (res >> 4); 			// 4th pass
    return res & 1;
}

int CmdHFiClassList(const char *Cmd)
{

	bool ShowWaitCycles = false;
	char param = param_getchar(Cmd, 0);

	if (param != 0) {
		PrintAndLog("List data in trace buffer.");
		PrintAndLog("Usage:  hf iclass list");
		PrintAndLog("h - help");
		PrintAndLog("sample: hf iclass list");
		return 0;
	}

	uint8_t got[1920];
	GetFromBigBuf(got,sizeof(got),0);
	WaitForResponse(CMD_ACK,NULL);

	PrintAndLog("Recorded Activity");
	PrintAndLog("");
	PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
	PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
	PrintAndLog("");
	PrintAndLog("     Start |       End | Src | Data");
	PrintAndLog("-----------|-----------|-----|--------");

	int i;
	uint32_t first_timestamp = 0;
	uint32_t timestamp;
	bool tagToReader;
	uint32_t parityBits;
	uint8_t len;
	uint8_t *frame;
	uint32_t EndOfTransmissionTimestamp = 0;


	for( i=0; i < 1900;)
	{
		//First 32 bits contain
		// isResponse (1 bit)
		// timestamp (remaining)
		//Then paritybits
		//Then length
		timestamp = *((uint32_t *)(got+i));
		parityBits = *((uint32_t *)(got+i+4));
		len = got[i+8];
        frame = (got+i+9);
		uint32_t next_timestamp = (*((uint32_t *)(got+i+9))) & 0x7fffffff;

		tagToReader = timestamp & 0x80000000;
		timestamp &= 0x7fffffff;

		if(i==0) {
			first_timestamp = timestamp;
		}

        // Break and stick with current result idf buffer was not completely full
		if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;

		char line[1000] = "";

		if(len)//We have some data to display
		{
			int j,oddparity;

			for(j = 0; j < len ; j++)
			{
				oddparity = 0x01 ^ xorbits_8(frame[j] & 0xFF);

				if (tagToReader && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
					sprintf(line+(j*4), "%02x!  ", frame[j]);
				} else {
					sprintf(line+(j*4), "%02x   ", frame[j]);
				}
			}
		}else
		{
			if (ShowWaitCycles) {
				sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
			}
		}

		char *crc = "";

		if(len > 2)
		{
			uint8_t b1, b2;
			if(!tagToReader && len == 4) {
				// Rough guess that this is a command from the reader
				// For iClass the command byte is not part of the CRC
					ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
			}
			else {
				  // For other data.. CRC might not be applicable (UPDATE commands etc.)
				ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
			}

			if (b1 != frame[len-2] || b2 != frame[len-1]) {
				crc = (tagToReader & (len < 8)) ? "" : " !crc";
			}
		}

		i += (len + 9);
		EndOfTransmissionTimestamp = (*((uint32_t *)(got+i))) & 0x7fffffff;

		// Not implemented for iclass on the ARM-side
		//if (!ShowWaitCycles) i += 9;

		PrintAndLog(" %9d | %9d | %s | %s %s",
			(timestamp - first_timestamp),
			(EndOfTransmissionTimestamp - first_timestamp),
			(len?(tagToReader ? "Tag" : "Rdr"):"   "),
			line, crc);
	}
	return 0;
}

int CmdHFiClassListOld(const char *Cmd)
{
  uint8_t got[1920];
  GetFromBigBuf(got,sizeof(got),0);

  PrintAndLog("recorded activity:");
  PrintAndLog(" ETU     :rssi: who bytes");
  PrintAndLog("---------+----+----+-----------");

  int i = 0;
  int prev = -1;

  for (;;) {
    if(i >= 1900) {
      break;
    }

    bool isResponse;
    int timestamp = *((uint32_t *)(got+i));
    if (timestamp & 0x80000000) {
      timestamp &= 0x7fffffff;
      isResponse = 1;
    } else {
      isResponse = 0;
    }


    int metric = 0;

    int parityBits = *((uint32_t *)(got+i+4));
    // 4 bytes of additional information...
    // maximum of 32 additional parity bit information
    //
    // TODO:
    // at each quarter bit period we can send power level (16 levels)
    // or each half bit period in 256 levels.


    int len = got[i+8];

    if (len > 100) {
      break;
    }
    if (i + len >= 1900) {
      break;
    }

    uint8_t *frame = (got+i+9);

    // Break and stick with current result if buffer was not completely full
    if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }

    char line[1000] = "";
    int j;
    for (j = 0; j < len; j++) {
      int oddparity = 0x01;
      int k;

      for (k=0;k<8;k++) {
        oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
      }

      //if((parityBits >> (len - j - 1)) & 0x01) {
      if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
        sprintf(line+(j*4), "%02x!  ", frame[j]);
      }
      else {
        sprintf(line+(j*4), "%02x   ", frame[j]);
      }
    }

    char *crc;
    crc = "";
    if (len > 2) {
      uint8_t b1, b2;
      for (j = 0; j < (len - 1); j++) {
        // gives problems... search for the reason..
        /*if(frame[j] == 0xAA) {
          switch(frame[j+1]) {
            case 0x01:
              crc = "[1] Two drops close after each other";
            break;
            case 0x02:
              crc = "[2] Potential SOC with a drop in second half of bitperiod";
              break;
            case 0x03:
              crc = "[3] Segment Z after segment X is not possible";
              break;
            case 0x04:
              crc = "[4] Parity bit of a fully received byte was wrong";
              break;
            default:
              crc = "[?] Unknown error";
              break;
          }
          break;
        }*/
      }

      if (strlen(crc)==0) {
	if(!isResponse && len == 4) {
		// Rough guess that this is a command from the reader
		// For iClass the command byte is not part of the CRC
	        ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
	}
	else {
		// For other data.. CRC might not be applicable (UPDATE commands etc.)
	        ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
	}
	//printf("%1x %1x",(unsigned)b1,(unsigned)b2);
        if (b1 != frame[len-2] || b2 != frame[len-1]) {
          crc = (isResponse & (len < 8)) ? "" : " !crc";
        } else {
          crc = "";
        }
      }
    } else {
      crc = ""; // SHORT
    }

    char metricString[100];
    if (isResponse) {
      sprintf(metricString, "%3d", metric);
    } else {
      strcpy(metricString, "   ");
    }

    PrintAndLog(" +%7d: %s: %s %s %s",
      (prev < 0 ? 0 : (timestamp - prev)),
      metricString,
      (isResponse ? "TAG" : "   "), line, crc);

    prev = timestamp;
    i += (len + 9);
  }
  return 0;
}

int CmdHFiClassSnoop(const char *Cmd)
{
  UsbCommand c = {CMD_SNOOP_ICLASS};
  SendCommand(&c);
  return 0;
}

int CmdHFiClassSim(const char *Cmd)
{
  uint8_t simType = 0;
  uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  if (strlen(Cmd)<1) {
	PrintAndLog("Usage:  hf iclass sim [0 <CSN>] | x");
	PrintAndLog("        options");
	PrintAndLog("                0 <CSN> simulate the given CSN");
	PrintAndLog("                1       simulate default CSN");
	PrintAndLog("                2       iterate CSNs, gather MACs");
	PrintAndLog("        sample: hf iclass sim 0 031FEC8AF7FF12E0");
	PrintAndLog("        sample: hf iclass sim 2");
	return 0;
  }	

  simType = param_get8(Cmd, 0);

  if(simType == 0)
  {
	  if (param_gethex(Cmd, 1, CSN, 16)) {
		  PrintAndLog("A CSN should consist of 16 HEX symbols");
		  return 1;
	  }
	  PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));

  }
  if(simType > 2)
  {
	  PrintAndLog("Undefined simptype %d", simType);
	  return 1;
  }
  uint8_t numberOfCSNs=0;

	if(simType == 2)
	{
		UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,63}};
		UsbCommand resp = {0};

		uint8_t csns[64] = {
			 0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,
			 0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,
			 0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,
			 0x17,0x12,0x01,0xfd,0xf7,0xff,0x12,0xe0 ,
			 0xcd,0x56,0x01,0x7c,0x6f,0xff,0x12,0xe0 ,
			 0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,
			 0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,
			 0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };

		memcpy(c.d.asBytes, csns, 64);

		SendCommand(&c);
		if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
			PrintAndLog("Command timed out");
			return 0;
		}

		uint8_t num_mac_responses  = resp.arg[1];
		PrintAndLog("Mac responses: %d MACs obtained (should be 8)", num_mac_responses);

		size_t datalen = 8*24;
		/*
		 * Now, time to dump to file. We'll use this format:
		 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
		 * So, it should wind up as
		 * 8 * 24 bytes.
		 *
		 * The returndata from the pm3 is on the following format
		 * <4 byte NR><4 byte MAC>
		 * CC are all zeroes, CSN is the same as was sent in
		 **/
		void* dump = malloc(datalen);
		memset(dump,0,datalen);//<-- Need zeroes for the CC-field
		uint8_t i = 0;
		for(i = 0 ; i < 8 ; i++)
		{
			memcpy(dump+i*24, csns+i*8,8); //CSN
			//8 zero bytes here...
			//Then comes NR_MAC (eight bytes from the response)
			memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);

		}
		/** Now, save to dumpfile **/
		saveFile("iclass_mac_attack", "bin", dump,datalen);
		free(dump);
	}else
	{
		UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
		memcpy(c.d.asBytes, CSN, 8);
		SendCommand(&c);
	}

  return 0;
}

int CmdHFiClassReader(const char *Cmd)
{
  UsbCommand c = {CMD_READER_ICLASS, {0}};
  SendCommand(&c);
    UsbCommand resp;
  while(!ukbhit()){
      if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
            uint8_t isOK    = resp.arg[0] & 0xff;
            uint8_t * data  = resp.d.asBytes;

            PrintAndLog("isOk:%02x", isOK);

            if(isOK > 0)
            {
                PrintAndLog("CSN: %s",sprint_hex(data,8));
            }
            if(isOK >= 1)
            {
                PrintAndLog("CC: %s",sprint_hex(data+8,8));
            }else{
                PrintAndLog("No CC obtained");
            }
        } else {
            PrintAndLog("Command execute timeout");
        }
    }

  return 0;
}

int CmdHFiClassReader_Replay(const char *Cmd)
{
  uint8_t readerType = 0;
  uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};

  if (strlen(Cmd)<1) {
    PrintAndLog("Usage:  hf iclass replay <MAC>");
    PrintAndLog("        sample: hf iclass replay 00112233");
    return 0;
  }

  if (param_gethex(Cmd, 0, MAC, 8)) {
    PrintAndLog("MAC must include 8 HEX symbols");
    return 1;
  }

  UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
  memcpy(c.d.asBytes, MAC, 4);
  SendCommand(&c);

  return 0;
}

int CmdHFiClassReader_Dump(const char *Cmd)
{
  uint8_t readerType = 0;
  uint8_t MAC[4]={0x00,0x00,0x00,0x00};
  uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  //uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t keytable[128] = {0};
  int elite = 0;
  uint8_t *used_key;
  int i;
  if (strlen(Cmd)<1) 
  {
    PrintAndLog("Usage:  hf iclass dump <Key> [e]");
    PrintAndLog("        Key    - A 16 byte master key");
    PrintAndLog("        e      - If 'e' is specified, the key is interpreted as the 16 byte");
    PrintAndLog("                 Custom Key (KCus), which can be obtained via reader-attack");
    PrintAndLog("                 See 'hf iclass sim 2'. This key should be on iclass-format");
    PrintAndLog("        sample: hf iclass dump 0011223344556677");


    return 0;
  }

  if (param_gethex(Cmd, 0, KEY, 16)) 
  {
    PrintAndLog("KEY must include 16 HEX symbols");
    return 1;
  }

  if (param_getchar(Cmd, 1) == 'e')
  {
    PrintAndLog("Elite switch on");
    elite = 1;

    //calc h2
    hash2(KEY, keytable);
    printarr_human_readable("keytable", keytable, 128);

  }


  UsbCommand c = {CMD_READER_ICLASS, {0}};
  c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE;

  SendCommand(&c);
  
  UsbCommand resp;
  uint8_t key_sel[8] = {0};
  uint8_t key_sel_p[8] = { 0 };

  if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
        uint8_t isOK    = resp.arg[0] & 0xff;
        uint8_t * data  = resp.d.asBytes;

        memcpy(CSN,data,8);
        memcpy(CCNR,data+8,8);

        PrintAndLog("isOk:%02x", isOK);

        if(isOK > 0)
        {
            PrintAndLog("CSN: %s",sprint_hex(CSN,8));
        }
        if(isOK > 1)
        {
            if(elite)
            {
                //Get the key index (hash1)
                uint8_t key_index[8] = {0};

                hash1(CSN, key_index);
                printvar("hash1", key_index,8);
                for(i = 0; i < 8 ; i++)
                    key_sel[i] = keytable[key_index[i]] & 0xFF;
                printvar("k_sel", key_sel,8);
                //Permute from iclass format to standard format
                permutekey_rev(key_sel,key_sel_p);
                used_key = key_sel_p;
            }else{
                //Perhaps this should also be permuted to std format?
                // Something like the code below? I have no std system
                // to test this with /Martin

                //uint8_t key_sel_p[8] = { 0 };
                //permutekey_rev(KEY,key_sel_p);
                //used_key = key_sel_p;

                used_key = KEY;

            }
            printvar("Used key",used_key,8);
            diversifyKey(CSN,used_key, div_key);
            printvar("Div key", div_key, 8);
            printvar("CC_NR:",CCNR,12);
            doMAC(CCNR,12,div_key, MAC);
            printvar("MAC", MAC, 4);

            UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
            memcpy(d.d.asBytes, MAC, 4);
            SendCommand(&d);

        }else{
            PrintAndLog("Failed to obtain CC! Aborting");
        }
    } else {
        PrintAndLog("Command execute timeout");
    }

  return 0;
}

int CmdHFiClass_iso14443A_write(const char *Cmd)
{
  uint8_t readerType = 0;
  uint8_t MAC[4]={0x00,0x00,0x00,0x00};
  uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

  uint8_t blockNo=0;
  uint8_t bldata[8]={0};

  if (strlen(Cmd)<3) 
  {
    PrintAndLog("Usage:  hf iclass write <Key> <Block> <Data>");
    PrintAndLog("        sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
    return 0;
  }

  if (param_gethex(Cmd, 0, KEY, 16)) 
  {
    PrintAndLog("KEY must include 16 HEX symbols");
    return 1;
  }
  
  blockNo = param_get8(Cmd, 1);
  if (blockNo>32)
  {
        PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
        return 1;
  }
  if (param_gethex(Cmd, 2, bldata, 8)) 
  {
        PrintAndLog("Block data must include 8 HEX symbols");
        return 1;
  }
  
  UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};
  SendCommand(&c);
  UsbCommand resp;

  if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
    uint8_t isOK    = resp.arg[0] & 0xff;
    uint8_t * data  = resp.d.asBytes;
    
    memcpy(CSN,data,8);
    memcpy(CCNR,data+8,8);
    PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
    PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
	PrintAndLog("isOk:%02x", isOK);
  } else {
	PrintAndLog("Command execute timeout");
  }

  diversifyKey(CSN,KEY, div_key);

  PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
  doMAC(CCNR, 12,div_key, MAC);

  UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
  memcpy(c2.d.asBytes, bldata, 8);
  memcpy(c2.d.asBytes+8, MAC, 4);
  SendCommand(&c2);

  if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
    uint8_t isOK    = resp.arg[0] & 0xff;
    uint8_t * data  = resp.d.asBytes;

    if (isOK)
      PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
    else
      PrintAndLog("isOk:%02x", isOK);
  } else {
      PrintAndLog("Command execute timeout");
  }
  return 0;
}


static command_t CommandTable[] = 
{
  {"help",	CmdHelp,			1,	"This help"},
  {"list",	CmdHFiClassList,	0,	"List iClass history"},
  {"snoop",	CmdHFiClassSnoop,	0,	"Eavesdrop iClass communication"},
  {"sim",	CmdHFiClassSim,		0,	"Simulate iClass tag"},
  {"reader",CmdHFiClassReader,	0,	"Read an iClass tag"},
  {"replay",CmdHFiClassReader_Replay,	0,	"Read an iClass tag via Reply Attack"},
  {"dump",	CmdHFiClassReader_Dump,	0,		"Authenticate and Dump iClass tag"},
  {"write",	CmdHFiClass_iso14443A_write,	0,	"Authenticate and Write iClass block"},
  {NULL, NULL, 0, NULL}
};

int CmdHFiClass(const char *Cmd)
{
  CmdsParse(CommandTable, Cmd);
  return 0;
}

int CmdHelp(const char *Cmd)
{
  CmdsHelp(CommandTable);
  return 0;
}
Commit	Line	Data
cee5a30d	1	//-----------------------------------------------------------------------------
	2	// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
	3	// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833	4	// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d	5	//
	6	// This code is licensed to you under the terms of the GNU GPL, version 2 or,
	7	// at your option, any later version. See the LICENSE.txt file for the text of
	8	// the license.
	9	//-----------------------------------------------------------------------------
	10	// High frequency iClass commands
	11	//-----------------------------------------------------------------------------
	12
	13	#include <stdio.h>
	14	#include <stdlib.h>
	15	#include <string.h>
9f6e9d15	16	#include <sys/stat.h>
cee5a30d	17	#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
cee5a30d	18	#include "data.h"
28fdb04f	19	//#include "proxusb.h"
902cb3c0	20	#include "proxmark3.h"
cee5a30d	21	#include "ui.h"
	22	#include "cmdparser.h"
	23	#include "cmdhficlass.h"
	24	#include "common.h"
14006804	25	#include "util.h"
17cba269	26	#include "cmdmain.h"
a66fca86 AD	27	#include "loclass/des.h"
	28	#include "loclass/cipherutils.h"
	29	#include "loclass/cipher.h"
	30	#include "loclass/ikeys.h"
3ad48540 MHS	31	#include "loclass/elite_crack.h"
3ad48540 MHS	32	#include "loclass/fileutils.h"
cee5a30d	33
	34	static int CmdHelp(const char *Cmd);
	35
17cba269 MHS	36	int xorbits_8(uint8_t val)
17cba269 MHS	37	{
3ad48540 MHS	38	uint8_t res = val ^ (val >> 1); //1st pass
	39	res = res ^ (res >> 1); // 2nd pass
	40	res = res ^ (res >> 2); // 3rd pass
	41	res = res ^ (res >> 4); // 4th pass
	42	return res & 1;
17cba269 MHS	43	}
17cba269 MHS	44
cee5a30d	45	int CmdHFiClassList(const char *Cmd)
17cba269 MHS	46	{
	47
	48	bool ShowWaitCycles = false;
	49	char param = param_getchar(Cmd, 0);
	50
	51	if (param != 0) {
	52	PrintAndLog("List data in trace buffer.");
	53	PrintAndLog("Usage: hf iclass list");
	54	PrintAndLog("h - help");
	55	PrintAndLog("sample: hf iclass list");
	56	return 0;
	57	}
	58
	59	uint8_t got[1920];
	60	GetFromBigBuf(got,sizeof(got),0);
	61	WaitForResponse(CMD_ACK,NULL);
	62
	63	PrintAndLog("Recorded Activity");
	64	PrintAndLog("");
	65	PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
	66	PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
	67	PrintAndLog("");
	68	PrintAndLog(" Start \| End \| Src \| Data");
	69	PrintAndLog("-----------\|-----------\|-----\|--------");
	70
	71	int i;
	72	uint32_t first_timestamp = 0;
	73	uint32_t timestamp;
	74	bool tagToReader;
	75	uint32_t parityBits;
	76	uint8_t len;
	77	uint8_t *frame;
	78	uint32_t EndOfTransmissionTimestamp = 0;
	79
17cba269 MHS	80
	81	for( i=0; i < 1900;)
	82	{
	83	//First 32 bits contain
	84	// isResponse (1 bit)
	85	// timestamp (remaining)
	86	//Then paritybits
	87	//Then length
	88	timestamp = ((uint32_t )(got+i));
	89	parityBits = ((uint32_t )(got+i+4));
	90	len = got[i+8];
26c0d833	91	frame = (got+i+9);
17cba269 MHS	92	uint32_t next_timestamp = (((uint32_t )(got+i+9))) & 0x7fffffff;
	93
	94	tagToReader = timestamp & 0x80000000;
	95	timestamp &= 0x7fffffff;
	96
	97	if(i==0) {
	98	first_timestamp = timestamp;
	99	}
	100
26c0d833	101	// Break and stick with current result idf buffer was not completely full
f83cc126	102	if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;
17cba269 MHS	103
	104	char line[1000] = "";
	105
	106	if(len)//We have some data to display
	107	{
	108	int j,oddparity;
	109
	110	for(j = 0; j < len ; j++)
	111	{
	112	oddparity = 0x01 ^ xorbits_8(frame[j] & 0xFF);
	113
	114	if (tagToReader && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
	115	sprintf(line+(j*4), "%02x! ", frame[j]);
	116	} else {
	117	sprintf(line+(j*4), "%02x ", frame[j]);
	118	}
	119	}
	120	}else
	121	{
	122	if (ShowWaitCycles) {
	123	sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
	124	}
	125	}
	126
	127	char *crc = "";
	128
	129	if(len > 2)
	130	{
	131	uint8_t b1, b2;
	132	if(!tagToReader && len == 4) {
	133	// Rough guess that this is a command from the reader
	134	// For iClass the command byte is not part of the CRC
	135	ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
	136	}
	137	else {
	138	// For other data.. CRC might not be applicable (UPDATE commands etc.)
	139	ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
	140	}
	141
	142	if (b1 != frame[len-2] \|\| b2 != frame[len-1]) {
	143	crc = (tagToReader & (len < 8)) ? "" : " !crc";
	144	}
	145	}
	146
	147	i += (len + 9);
	148	EndOfTransmissionTimestamp = (((uint32_t )(got+i))) & 0x7fffffff;
	149
	150	// Not implemented for iclass on the ARM-side
	151	//if (!ShowWaitCycles) i += 9;
	152
	153	PrintAndLog(" %9d \| %9d \| %s \| %s %s",
	154	(timestamp - first_timestamp),
	155	(EndOfTransmissionTimestamp - first_timestamp),
	156	(len?(tagToReader ? "Tag" : "Rdr"):" "),
	157	line, crc);
	158	}
	159	return 0;
	160	}
	161
	162	int CmdHFiClassListOld(const char *Cmd)
cee5a30d	163	{
cee5a30d	164	uint8_t got[1920];
db09cb3a	165	GetFromBigBuf(got,sizeof(got),0);
cee5a30d	166
	167	PrintAndLog("recorded activity:");
	168	PrintAndLog(" ETU :rssi: who bytes");
	169	PrintAndLog("---------+----+----+-----------");
	170
	171	int i = 0;
	172	int prev = -1;
	173
	174	for (;;) {
	175	if(i >= 1900) {
	176	break;
	177	}
	178
	179	bool isResponse;
	180	int timestamp = ((uint32_t )(got+i));
	181	if (timestamp & 0x80000000) {
	182	timestamp &= 0x7fffffff;
	183	isResponse = 1;
	184	} else {
	185	isResponse = 0;
	186	}
	187
17cba269	188
cee5a30d	189	int metric = 0;
17cba269	190
cee5a30d	191	int parityBits = ((uint32_t )(got+i+4));
	192	// 4 bytes of additional information...
	193	// maximum of 32 additional parity bit information
	194	//
	195	// TODO:
	196	// at each quarter bit period we can send power level (16 levels)
	197	// or each half bit period in 256 levels.
	198
	199
	200	int len = got[i+8];
	201
	202	if (len > 100) {
	203	break;
	204	}
	205	if (i + len >= 1900) {
	206	break;
	207	}
	208
	209	uint8_t *frame = (got+i+9);
	210
	211	// Break and stick with current result if buffer was not completely full
	212	if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }
	213
	214	char line[1000] = "";
	215	int j;
	216	for (j = 0; j < len; j++) {
	217	int oddparity = 0x01;
	218	int k;
	219
	220	for (k=0;k<8;k++) {
	221	oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
	222	}
	223
	224	//if((parityBits >> (len - j - 1)) & 0x01) {
	225	if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
	226	sprintf(line+(j*4), "%02x! ", frame[j]);
	227	}
	228	else {
	229	sprintf(line+(j*4), "%02x ", frame[j]);
	230	}
	231	}
	232
	233	char *crc;
	234	crc = "";
	235	if (len > 2) {
	236	uint8_t b1, b2;
	237	for (j = 0; j < (len - 1); j++) {
	238	// gives problems... search for the reason..
	239	/*if(frame[j] == 0xAA) {
	240	switch(frame[j+1]) {
	241	case 0x01:
	242	crc = "[1] Two drops close after each other";
	243	break;
	244	case 0x02:
	245	crc = "[2] Potential SOC with a drop in second half of bitperiod";
	246	break;
	247	case 0x03:
	248	crc = "[3] Segment Z after segment X is not possible";
	249	break;
	250	case 0x04:
	251	crc = "[4] Parity bit of a fully received byte was wrong";
	252	break;
	253	default:
	254	crc = "[?] Unknown error";
255	break;
256	}
257	break;
258	}*/
259	}
260
261	if (strlen(crc)==0) {
262	if(!isResponse && len == 4) {
263	// Rough guess that this is a command from the reader
264	// For iClass the command byte is not part of the CRC
265	ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
266	}
267	else {
268	// For other data.. CRC might not be applicable (UPDATE commands etc.)
269	ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
270	}
271	//printf("%1x %1x",(unsigned)b1,(unsigned)b2);
272	if (b1 != frame[len-2] \|\| b2 != frame[len-1]) {
273	crc = (isResponse & (len < 8)) ? "" : " !crc";
274	} else {
275	crc = "";
276	}
277	}
278	} else {
279	crc = ""; // SHORT
280	}
281
282	char metricString[100];
283	if (isResponse) {
284	sprintf(metricString, "%3d", metric);
285	} else {
286	strcpy(metricString, " ");
287	}
288
289	PrintAndLog(" +%7d: %s: %s %s %s",
290	(prev < 0 ? 0 : (timestamp - prev)),
291	metricString,
292	(isResponse ? "TAG" : " "), line, crc);
293
294	prev = timestamp;
295	i += (len + 9);
296	}
297	return 0;
298	}
299
cee5a30d	300	int CmdHFiClassSnoop(const char *Cmd)
	301	{
	302	UsbCommand c = {CMD_SNOOP_ICLASS};
	303	SendCommand(&c);
	304	return 0;
	305	}
	306
1e262141	307	int CmdHFiClassSim(const char *Cmd)
	308	{
	309	uint8_t simType = 0;
	310	uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
	311
17cba269 MHS	312	if (strlen(Cmd)<1) {
	313	PrintAndLog("Usage: hf iclass sim [0 <CSN>] \| x");
	314	PrintAndLog(" options");
	315	PrintAndLog(" 0 <CSN> simulate the given CSN");
	316	PrintAndLog(" 1 simulate default CSN");
	317	PrintAndLog(" 2 iterate CSNs, gather MACs");
1e262141	318	PrintAndLog(" sample: hf iclass sim 0 031FEC8AF7FF12E0");
17cba269	319	PrintAndLog(" sample: hf iclass sim 2");
1e262141	320	return 0;
	321	}
	322
	323	simType = param_get8(Cmd, 0);
17cba269 MHS	324
	325	if(simType == 0)
	326	{
	327	if (param_gethex(Cmd, 1, CSN, 16)) {
	328	PrintAndLog("A CSN should consist of 16 HEX symbols");
	329	return 1;
	330	}
	331	PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
	332
	333	}
77abe781	334	if(simType > 2)
17cba269 MHS	335	{
	336	PrintAndLog("Undefined simptype %d", simType);
	337	return 1;
1e262141	338	}
17cba269	339	uint8_t numberOfCSNs=0;
1e262141	340
9f6e9d15 MHS	341	if(simType == 2)
	342	{
	343	UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,63}};
	344	UsbCommand resp = {0};
17cba269	345
77abe781 MHS	346	uint8_t csns[64] = {
	347	0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,
	348	0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,
	349	0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,
	350	0x17,0x12,0x01,0xfd,0xf7,0xff,0x12,0xe0 ,
	351	0xcd,0x56,0x01,0x7c,0x6f,0xff,0x12,0xe0 ,
	352	0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,
	353	0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,
	354	0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };
	355
	356	memcpy(c.d.asBytes, csns, 64);
9f6e9d15 MHS	357
	358	SendCommand(&c);
	359	if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
	360	PrintAndLog("Command timed out");
	361	return 0;
	362	}
1e262141	363
77abe781 MHS	364	uint8_t num_mac_responses = resp.arg[1];
77abe781 MHS	365	PrintAndLog("Mac responses: %d MACs obtained (should be 8)", num_mac_responses);
9f6e9d15	366
77abe781	367	size_t datalen = 8*24;
9f6e9d15 MHS	368	/*
9f6e9d15 MHS	369	* Now, time to dump to file. We'll use this format:
77abe781	370	* <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15	371	* So, it should wind up as
77abe781 MHS	372	* 8 * 24 bytes.
	373	*
	374	* The returndata from the pm3 is on the following format
	375	* <4 byte NR><4 byte MAC>
	376	* CC are all zeroes, CSN is the same as was sent in
9f6e9d15	377	**/
77abe781 MHS	378	void* dump = malloc(datalen);
77abe781 MHS	379	memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15	380	uint8_t i = 0;
77abe781	381	for(i = 0 ; i < 8 ; i++)
9f6e9d15	382	{
77abe781 MHS	383	memcpy(dump+i24, csns+i8,8); //CSN
	384	//8 zero bytes here...
	385	//Then comes NR_MAC (eight bytes from the response)
	386	memcpy(dump+i24+16,resp.d.asBytes+i8,8);
1e262141	387
9f6e9d15 MHS	388	}
9f6e9d15 MHS	389	/ Now, save to dumpfile /
77abe781 MHS	390	saveFile("iclass_mac_attack", "bin", dump,datalen);
77abe781 MHS	391	free(dump);
9f6e9d15 MHS	392	}else
	393	{
	394	UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
	395	memcpy(c.d.asBytes, CSN, 8);
	396	SendCommand(&c);
	397	}
1e262141	398
1e262141	399	return 0;
	400	}
	401
	402	int CmdHFiClassReader(const char *Cmd)
	403	{
aa41c605	404	UsbCommand c = {CMD_READER_ICLASS, {0}};
1e262141	405	SendCommand(&c);
aa41c605 MHS	406	UsbCommand resp;
	407	while(!ukbhit()){
	408	if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
	409	uint8_t isOK = resp.arg[0] & 0xff;
	410	uint8_t * data = resp.d.asBytes;
	411
	412	PrintAndLog("isOk:%02x", isOK);
	413
	414	if(isOK > 0)
	415	{
	416	PrintAndLog("CSN: %s",sprint_hex(data,8));
	417	}
	418	if(isOK >= 1)
	419	{
	420	PrintAndLog("CC: %s",sprint_hex(data+8,8));
	421	}else{
	422	PrintAndLog("No CC obtained");
	423	}
	424	} else {
	425	PrintAndLog("Command execute timeout");
	426	}
	427	}
1e262141	428
c3963755	429	return 0;
	430	}
	431
	432	int CmdHFiClassReader_Replay(const char *Cmd)
	433	{
	434	uint8_t readerType = 0;
	435	uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
	436
	437	if (strlen(Cmd)<1) {
	438	PrintAndLog("Usage: hf iclass replay <MAC>");
	439	PrintAndLog(" sample: hf iclass replay 00112233");
	440	return 0;
	441	}
	442
	443	if (param_gethex(Cmd, 0, MAC, 8)) {
	444	PrintAndLog("MAC must include 8 HEX symbols");
	445	return 1;
	446	}
	447
	448	UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
	449	memcpy(c.d.asBytes, MAC, 4);
	450	SendCommand(&c);
1e262141	451
	452	return 0;
	453	}
	454
a66fca86 AD	455	int CmdHFiClassReader_Dump(const char *Cmd)
	456	{
	457	uint8_t readerType = 0;
	458	uint8_t MAC[4]={0x00,0x00,0x00,0x00};
	459	uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	460	uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	461	uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
fecd8202	462	//uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
a66fca86	463	uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
9b82de75 MHS	464	uint8_t keytable[128] = {0};
	465	int elite = 0;
	466	uint8_t *used_key;
	467	int i;
fecd8202	468	if (strlen(Cmd)<1)
fecd8202	469	{
9b82de75 MHS	470	PrintAndLog("Usage: hf iclass dump <Key> [e]");
	471	PrintAndLog(" Key - A 16 byte master key");
	472	PrintAndLog(" e - If 'e' is specified, the key is interpreted as the 16 byte");
	473	PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
	474	PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
fecd8202	475	PrintAndLog(" sample: hf iclass dump 0011223344556677");
9b82de75 MHS	476
9b82de75 MHS	477
a66fca86 AD	478	return 0;
	479	}
	480
fecd8202	481	if (param_gethex(Cmd, 0, KEY, 16))
fecd8202	482	{
a66fca86 AD	483	PrintAndLog("KEY must include 16 HEX symbols");
	484	return 1;
	485	}
9b82de75 MHS	486
	487	if (param_getchar(Cmd, 1) == 'e')
	488	{
	489	PrintAndLog("Elite switch on");
	490	elite = 1;
	491
	492	//calc h2
	493	hash2(KEY, keytable);
9e28ee9f	494	printarr_human_readable("keytable", keytable, 128);
9b82de75 MHS	495
	496	}
	497
	498
aa41c605 MHS	499	UsbCommand c = {CMD_READER_ICLASS, {0}};
aa41c605 MHS	500	c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE;
26c0d833	501
fecd8202	502	SendCommand(&c);
	503
	504	UsbCommand resp;
90e278d3 MHS	505	uint8_t key_sel[8] = {0};
90e278d3 MHS	506	uint8_t key_sel_p[8] = { 0 };
26c0d833	507
fecd8202	508	if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
26c0d833 MHS	509	uint8_t isOK = resp.arg[0] & 0xff;
	510	uint8_t * data = resp.d.asBytes;
	511
26c0d833 MHS	512	memcpy(CSN,data,8);
26c0d833 MHS	513	memcpy(CCNR,data+8,8);
3ad48540	514
26c0d833	515	PrintAndLog("isOk:%02x", isOK);
a66fca86	516
aa41c605	517	if(isOK > 0)
26c0d833 MHS	518	{
	519	PrintAndLog("CSN: %s",sprint_hex(CSN,8));
	520	}
9b82de75	521	if(isOK > 1)
26c0d833	522	{
9b82de75 MHS	523	if(elite)
9b82de75 MHS	524	{
9b82de75 MHS	525	//Get the key index (hash1)
	526	uint8_t key_index[8] = {0};
	527
	528	hash1(CSN, key_index);
	529	printvar("hash1", key_index,8);
	530	for(i = 0; i < 8 ; i++)
	531	key_sel[i] = keytable[key_index[i]] & 0xFF;
	532	printvar("k_sel", key_sel,8);
	533	//Permute from iclass format to standard format
	534	permutekey_rev(key_sel,key_sel_p);
	535	used_key = key_sel_p;
	536	}else{
9e28ee9f MHS	537	//Perhaps this should also be permuted to std format?
	538	// Something like the code below? I have no std system
	539	// to test this with /Martin
	540
	541	//uint8_t key_sel_p[8] = { 0 };
	542	//permutekey_rev(KEY,key_sel_p);
	543	//used_key = key_sel_p;
	544
9b82de75 MHS	545	used_key = KEY;
	546
	547	}
9b82de75 MHS	548	printvar("Used key",used_key,8);
	549	diversifyKey(CSN,used_key, div_key);
	550	printvar("Div key", div_key, 8);
9e28ee9f	551	printvar("CC_NR:",CCNR,12);
74a38802	552	doMAC(CCNR,12,div_key, MAC);
9b82de75 MHS	553	printvar("MAC", MAC, 4);
9b82de75 MHS	554
26c0d833 MHS	555	UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
	556	memcpy(d.d.asBytes, MAC, 4);
	557	SendCommand(&d);
	558
	559	}else{
	560	PrintAndLog("Failed to obtain CC! Aborting");
	561	}
	562	} else {
	563	PrintAndLog("Command execute timeout");
	564	}
1e262141	565
	566	return 0;
	567	}
	568
fecd8202	569	int CmdHFiClass_iso14443A_write(const char *Cmd)
	570	{
	571	uint8_t readerType = 0;
	572	uint8_t MAC[4]={0x00,0x00,0x00,0x00};
	573	uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	574	uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	575	uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
fecd8202	576	uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
3ad48540	577
fecd8202	578	uint8_t blockNo=0;
	579	uint8_t bldata[8]={0};
	580
	581	if (strlen(Cmd)<3)
	582	{
	583	PrintAndLog("Usage: hf iclass write <Key> <Block> <Data>");
	584	PrintAndLog(" sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
	585	return 0;
	586	}
	587
	588	if (param_gethex(Cmd, 0, KEY, 16))
	589	{
	590	PrintAndLog("KEY must include 16 HEX symbols");
	591	return 1;
	592	}
	593
	594	blockNo = param_get8(Cmd, 1);
	595	if (blockNo>32)
	596	{
	597	PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
	598	return 1;
	599	}
	600	if (param_gethex(Cmd, 2, bldata, 8))
	601	{
	602	PrintAndLog("Block data must include 8 HEX symbols");
	603	return 1;
	604	}
	605
aa41c605	606	UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};
fecd8202	607	SendCommand(&c);
fecd8202	608	UsbCommand resp;
3ad48540	609
fecd8202	610	if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
	611	uint8_t isOK = resp.arg[0] & 0xff;
	612	uint8_t * data = resp.d.asBytes;
	613
	614	memcpy(CSN,data,8);
	615	memcpy(CCNR,data+8,8);
	616	PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
	617	PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
	618	PrintAndLog("isOk:%02x", isOK);
	619	} else {
	620	PrintAndLog("Command execute timeout");
	621	}
3ad48540 MHS	622
	623	diversifyKey(CSN,KEY, div_key);
	624
fecd8202	625	PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
74a38802	626	doMAC(CCNR, 12,div_key, MAC);
fecd8202	627
3ad48540 MHS	628	UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
	629	memcpy(c2.d.asBytes, bldata, 8);
	630	memcpy(c2.d.asBytes+8, MAC, 4);
	631	SendCommand(&c2);
a66fca86	632
fecd8202	633	if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
	634	uint8_t isOK = resp.arg[0] & 0xff;
	635	uint8_t * data = resp.d.asBytes;
	636
	637	if (isOK)
	638	PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
	639	else
	640	PrintAndLog("isOk:%02x", isOK);
	641	} else {
	642	PrintAndLog("Command execute timeout");
	643	}
a66fca86 AD	644	return 0;
	645	}
	646
c3963755	647
cee5a30d	648	static command_t CommandTable[] =
cee5a30d	649	{
fecd8202	650	{"help", CmdHelp, 1, "This help"},
	651	{"list", CmdHFiClassList, 0, "List iClass history"},
	652	{"snoop", CmdHFiClassSnoop, 0, "Eavesdrop iClass communication"},
	653	{"sim", CmdHFiClassSim, 0, "Simulate iClass tag"},
	654	{"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
	655	{"replay",CmdHFiClassReader_Replay, 0, "Read an iClass tag via Reply Attack"},
	656	{"dump", CmdHFiClassReader_Dump, 0, "Authenticate and Dump iClass tag"},
	657	{"write", CmdHFiClass_iso14443A_write, 0, "Authenticate and Write iClass block"},
cee5a30d	658	{NULL, NULL, 0, NULL}
	659	};
	660
	661	int CmdHFiClass(const char *Cmd)
	662	{
	663	CmdsParse(CommandTable, Cmd);
	664	return 0;
	665	}
	666
	667	int CmdHelp(const char *Cmd)
	668	{
	669	CmdsHelp(CommandTable);
	670	return 0;
	671	}