]>
Commit | Line | Data |
---|---|---|
1 | //----------------------------------------------------------------------------- | |
2 | // Copyright (C) 2018 iceman | |
3 | // | |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
5 | // at your option, any later version. See the LICENSE.txt file for the text of | |
6 | // the license. | |
7 | //----------------------------------------------------------------------------- | |
8 | // Proxmark3 RDV40 Smartcard module commands | |
9 | //----------------------------------------------------------------------------- | |
10 | #include "cmdsmartcard.h" | |
11 | ||
12 | #include <ctype.h> | |
13 | ||
14 | #include "ui.h" | |
15 | #include "cmdparser.h" | |
16 | #include "proxmark3.h" | |
17 | #include "util.h" | |
18 | #include "smartcard.h" | |
19 | #include "comms.h" | |
20 | #include "protocols.h" | |
21 | #include "cmdhw.h" | |
22 | #include "cmdhflist.h" | |
23 | #include "emv/apduinfo.h" // APDUcode description | |
24 | #include "emv/emvcore.h" // decodeTVL | |
25 | #include "crypto/libpcrypto.h" // sha512hash | |
26 | #include "emv/dump.h" // dump_buffer | |
27 | #include "pcsc.h" | |
28 | ||
29 | #define SC_UPGRADE_FILES_DIRECTORY "sc_upgrade_firmware/" | |
30 | ||
31 | static bool UseAlternativeSmartcardReader = false; // default: use PM3 RDV40 Smartcard Slot (if available) | |
32 | ||
33 | static int CmdHelp(const char *Cmd); | |
34 | ||
35 | static int usage_sm_raw(void) { | |
36 | PrintAndLogEx(NORMAL, "Usage: sc raw [h|r|c] d <0A 0B 0C ... hex>"); | |
37 | PrintAndLogEx(NORMAL, " h : this help"); | |
38 | PrintAndLogEx(NORMAL, " r : do not read response"); | |
39 | PrintAndLogEx(NORMAL, " a : active smartcard without select (reset sc module)"); | |
40 | PrintAndLogEx(NORMAL, " s : active smartcard with select (get ATR)"); | |
41 | PrintAndLogEx(NORMAL, " t : executes TLV decoder if it possible"); | |
42 | PrintAndLogEx(NORMAL, " 0 : use protocol T=0"); | |
43 | PrintAndLogEx(NORMAL, " d <bytes> : bytes to send"); | |
44 | PrintAndLogEx(NORMAL, ""); | |
45 | PrintAndLogEx(NORMAL, "Examples:"); | |
46 | PrintAndLogEx(NORMAL, " sc raw s 0 d 00a404000e315041592e5359532e4444463031 - `1PAY.SYS.DDF01` PPSE directory with get ATR"); | |
47 | PrintAndLogEx(NORMAL, " sc raw 0 d 00a404000e325041592e5359532e4444463031 - `2PAY.SYS.DDF01` PPSE directory"); | |
48 | return 0; | |
49 | } | |
50 | ||
51 | static int usage_sm_select(void) { | |
52 | PrintAndLogEx(NORMAL, "Usage: sc select [h|<reader name>] "); | |
53 | PrintAndLogEx(NORMAL, " h : this help"); | |
54 | PrintAndLogEx(NORMAL, " <reader name> : a card reader's name, wildcards allowed, leave empty to pick from available readers"); | |
55 | PrintAndLogEx(NORMAL, ""); | |
56 | PrintAndLogEx(NORMAL, "Examples:"); | |
57 | PrintAndLogEx(NORMAL, " sc select : list available card readers and pick"); | |
58 | PrintAndLogEx(NORMAL, " sc select Gemalto* : select a connected Gemalto card reader" ); | |
59 | return 0; | |
60 | } | |
61 | ||
62 | static int usage_sm_reader(void) { | |
63 | PrintAndLogEx(NORMAL, "Usage: sc reader [h|s]"); | |
64 | PrintAndLogEx(NORMAL, " h : this help"); | |
65 | PrintAndLogEx(NORMAL, " s : silent (no messages)"); | |
66 | PrintAndLogEx(NORMAL, ""); | |
67 | PrintAndLogEx(NORMAL, "Examples:"); | |
68 | PrintAndLogEx(NORMAL, " sc reader"); | |
69 | return 0; | |
70 | } | |
71 | ||
72 | static int usage_sm_info(void) { | |
73 | PrintAndLogEx(NORMAL, "Usage: s info [h|s]"); | |
74 | PrintAndLogEx(NORMAL, " h : this help"); | |
75 | PrintAndLogEx(NORMAL, " s : silent (no messages)"); | |
76 | PrintAndLogEx(NORMAL, ""); | |
77 | PrintAndLogEx(NORMAL, "Examples:"); | |
78 | PrintAndLogEx(NORMAL, " sc info"); | |
79 | return 0; | |
80 | } | |
81 | ||
82 | static int usage_sm_upgrade(void) { | |
83 | PrintAndLogEx(NORMAL, "Upgrade RDV4.0 Smartcard Socket Firmware"); | |
84 | PrintAndLogEx(NORMAL, "Usage: sc upgrade f <file name>"); | |
85 | PrintAndLogEx(NORMAL, " h : this help"); | |
86 | PrintAndLogEx(NORMAL, " f <filename> : firmware file name"); | |
87 | PrintAndLogEx(NORMAL, ""); | |
88 | PrintAndLogEx(NORMAL, "Examples:"); | |
89 | PrintAndLogEx(NORMAL, " sc upgrade f SIM010.BIN"); | |
90 | return 0; | |
91 | } | |
92 | ||
93 | static int usage_sm_setclock(void) { | |
94 | PrintAndLogEx(NORMAL, "Usage: sc setclock [h] c <clockspeed>"); | |
95 | PrintAndLogEx(NORMAL, " h : this help"); | |
96 | PrintAndLogEx(NORMAL, " c <> : clockspeed (0 = 16mhz, 1=8mhz, 2=4mhz) "); | |
97 | PrintAndLogEx(NORMAL, ""); | |
98 | PrintAndLogEx(NORMAL, "Examples:"); | |
99 | PrintAndLogEx(NORMAL, " sc setclock c 2"); | |
100 | return 0; | |
101 | } | |
102 | ||
103 | static int usage_sm_brute(void) { | |
104 | PrintAndLogEx(NORMAL, "Tries to bruteforce SFI, "); | |
105 | PrintAndLogEx(NORMAL, "Usage: sc brute [h]"); | |
106 | PrintAndLogEx(NORMAL, " h : this help"); | |
107 | PrintAndLogEx(NORMAL, ""); | |
108 | PrintAndLogEx(NORMAL, "Examples:"); | |
109 | PrintAndLogEx(NORMAL, " sc brute"); | |
110 | return 0; | |
111 | } | |
112 | ||
113 | uint8_t GetATRTA1(uint8_t *atr, size_t atrlen) { | |
114 | if (atrlen > 2) { | |
115 | uint8_t T0 = atr[1]; | |
116 | if (T0 & 0x10) | |
117 | return atr[2]; | |
118 | } | |
119 | ||
120 | return 0x11; // default value is 0x11, corresponding to fmax=5 MHz, Fi=372, Di=1. | |
121 | } | |
122 | ||
123 | int DiArray[] = { | |
124 | 0, // b0000 RFU | |
125 | 1, // b0001 | |
126 | 2, | |
127 | 4, | |
128 | 8, | |
129 | 16, | |
130 | 32, // b0110 | |
131 | 64, // b0111. This was RFU in ISO/IEC 7816-3:1997 and former. Some card readers or drivers may erroneously reject cards using this value | |
132 | 12, | |
133 | 20, | |
134 | 0, // b1010 RFU | |
135 | 0, | |
136 | 0, // ... | |
137 | 0, | |
138 | 0, | |
139 | 0 // b1111 RFU | |
140 | }; | |
141 | ||
142 | int FiArray[] = { | |
143 | 372, // b0000 Historical note: in ISO/IEC 7816-3:1989, this was assigned to cards with internal clock | |
144 | 372, // b0001 | |
145 | 558, // b0010 | |
146 | 744, // b0011 | |
147 | 1116, // b0100 | |
148 | 1488, // b0101 | |
149 | 1860, // b0110 | |
150 | 0, // b0111 RFU | |
151 | 0, // b1000 RFU | |
152 | 512, // b1001 | |
153 | 768, // b1010 | |
154 | 1024, // b1011 | |
155 | 1536, // b1100 | |
156 | 2048, // b1101 | |
157 | 0, // b1110 RFU | |
158 | 0 // b1111 RFU | |
159 | }; | |
160 | ||
161 | float FArray[] = { | |
162 | 4, // b0000 Historical note: in ISO/IEC 7816-3:1989, this was assigned to cards with internal clock | |
163 | 5, // b0001 | |
164 | 6, // b0010 | |
165 | 8, // b0011 | |
166 | 12, // b0100 | |
167 | 16, // b0101 | |
168 | 20, // b0110 | |
169 | 0, // b0111 RFU | |
170 | 0, // b1000 RFU | |
171 | 5, // b1001 | |
172 | 7.5, // b1010 | |
173 | 10, // b1011 | |
174 | 15, // b1100 | |
175 | 20, // b1101 | |
176 | 0, // b1110 RFU | |
177 | 0 // b1111 RFU | |
178 | }; | |
179 | ||
180 | int GetATRDi(uint8_t *atr, size_t atrlen) { | |
181 | uint8_t TA1 = GetATRTA1(atr, atrlen); | |
182 | ||
183 | return DiArray[TA1 & 0x0f]; // The 4 low-order bits of TA1 (4th MSbit to 1st LSbit) encode Di | |
184 | } | |
185 | ||
186 | int GetATRFi(uint8_t *atr, size_t atrlen) { | |
187 | uint8_t TA1 = GetATRTA1(atr, atrlen); | |
188 | ||
189 | return FiArray[TA1 >> 4]; // The 4 high-order bits of TA1 (8th MSbit to 5th LSbit) encode fmax and Fi | |
190 | } | |
191 | ||
192 | float GetATRF(uint8_t *atr, size_t atrlen) { | |
193 | uint8_t TA1 = GetATRTA1(atr, atrlen); | |
194 | ||
195 | return FArray[TA1 >> 4]; // The 4 high-order bits of TA1 (8th MSbit to 5th LSbit) encode fmax and Fi | |
196 | } | |
197 | ||
198 | static int PrintATR(uint8_t *atr, size_t atrlen) { | |
199 | ||
200 | uint8_t T0 = atr[1]; | |
201 | uint8_t K = T0 & 0x0F; | |
202 | uint8_t TD1 = 0, T1len = 0, TD1len = 0, TDilen = 0; | |
203 | bool protocol_T0_present = true; | |
204 | bool protocol_T15_present = false; | |
205 | ||
206 | if (T0 & 0x10) { | |
207 | PrintAndLog("\t- TA1 (Maximum clock frequency, proposed bit duration) [ 0x%02x ]", atr[2 + T1len]); | |
208 | T1len++; | |
209 | } | |
210 | ||
211 | if (T0 & 0x20) { | |
212 | PrintAndLog("\t- TB1 (Deprecated: VPP requirements) [ 0x%02x ]", atr[2 + T1len]); | |
213 | T1len++; | |
214 | } | |
215 | ||
216 | if (T0 & 0x40) { | |
217 | PrintAndLog("\t- TC1 (Extra delay between bytes required by card) [ 0x%02x ]", atr[2 + T1len]); | |
218 | T1len++; | |
219 | } | |
220 | ||
221 | if (T0 & 0x80) { | |
222 | TD1 = atr[2 + T1len]; | |
223 | PrintAndLog("\t- TD1 (First offered transmission protocol, presence of TA2..TD2) [ 0x%02x ] Protocol T%d", TD1, TD1 & 0x0f); | |
224 | protocol_T0_present = false; | |
225 | if ((TD1 & 0x0f) == 0) { | |
226 | protocol_T0_present = true; | |
227 | } | |
228 | if ((TD1 & 0x0f) == 15) { | |
229 | protocol_T15_present = true; | |
230 | } | |
231 | ||
232 | T1len++; | |
233 | ||
234 | if (TD1 & 0x10) { | |
235 | PrintAndLog("\t- TA2 (Specific protocol and parameters to be used after the ATR) [ 0x%02x ]", atr[2 + T1len + TD1len]); | |
236 | TD1len++; | |
237 | } | |
238 | if (TD1 & 0x20) { | |
239 | PrintAndLog("\t- TB2 (Deprecated: VPP precise voltage requirement) [ 0x%02x ]", atr[2 + T1len + TD1len]); | |
240 | TD1len++; | |
241 | } | |
242 | if (TD1 & 0x40) { | |
243 | PrintAndLog("\t- TC2 (Maximum waiting time for protocol T=0) [ 0x%02x ]", atr[2 + T1len + TD1len]); | |
244 | TD1len++; | |
245 | } | |
246 | if (TD1 & 0x80) { | |
247 | uint8_t TDi = atr[2 + T1len + TD1len]; | |
248 | PrintAndLog("\t- TD2 (A supported protocol or more global parameters, presence of TA3..TD3) [ 0x%02x ] Protocol T%d", TDi, TDi & 0x0f); | |
249 | if ((TDi & 0x0f) == 0) { | |
250 | protocol_T0_present = true; | |
251 | } | |
252 | if ((TDi & 0x0f) == 15) { | |
253 | protocol_T15_present = true; | |
254 | } | |
255 | TD1len++; | |
256 | ||
257 | bool nextCycle = true; | |
258 | uint8_t vi = 3; | |
259 | while (nextCycle) { | |
260 | nextCycle = false; | |
261 | if (TDi & 0x10) { | |
262 | PrintAndLog("\t- TA%d: 0x%02x", vi, atr[2 + T1len + TD1len + TDilen]); | |
263 | TDilen++; | |
264 | } | |
265 | if (TDi & 0x20) { | |
266 | PrintAndLog("\t- TB%d: 0x%02x", vi, atr[2 + T1len + TD1len + TDilen]); | |
267 | TDilen++; | |
268 | } | |
269 | if (TDi & 0x40) { | |
270 | PrintAndLog("\t- TC%d: 0x%02x", vi, atr[2 + T1len + TD1len + TDilen]); | |
271 | TDilen++; | |
272 | } | |
273 | if (TDi & 0x80) { | |
274 | TDi = atr[2 + T1len + TD1len + TDilen]; | |
275 | PrintAndLog("\t- TD%d [ 0x%02x ] Protocol T%d", vi, TDi, TDi & 0x0f); | |
276 | TDilen++; | |
277 | ||
278 | nextCycle = true; | |
279 | vi++; | |
280 | } | |
281 | } | |
282 | } | |
283 | } | |
284 | ||
285 | if (!protocol_T0_present || protocol_T15_present) { // there is CRC Check Byte TCK | |
286 | uint8_t vxor = 0; | |
287 | for (int i = 1; i < atrlen; i++) | |
288 | vxor ^= atr[i]; | |
289 | ||
290 | if (vxor) | |
291 | PrintAndLogEx(WARNING, "Check sum error. Must be 0 got 0x%02X", vxor); | |
292 | else | |
293 | PrintAndLogEx(INFO, "Check sum OK."); | |
294 | } | |
295 | ||
296 | if (atr[0] != 0x3b) | |
297 | PrintAndLogEx(WARNING, "Not a direct convention [ 0x%02x ]", atr[0]); | |
298 | ||
299 | uint8_t calen = 2 + T1len + TD1len + TDilen + K; | |
300 | ||
301 | if (atrlen != calen && atrlen != calen + 1) // may be CRC | |
302 | PrintAndLogEx(ERR, "ATR length error. len: %d, T1len: %d, TD1len: %d, TDilen: %d, K: %d", atrlen, T1len, TD1len, TDilen, K); | |
303 | ||
304 | if (K > 0) | |
305 | PrintAndLogEx(INFO, "\nHistorical bytes | len %02d | format %02x", K, atr[2 + T1len + TD1len + TDilen]); | |
306 | ||
307 | if (K > 1) { | |
308 | PrintAndLogEx(INFO, "\tHistorical bytes"); | |
309 | dump_buffer(&atr[2 + T1len + TD1len + TDilen], K, NULL, 1); | |
310 | } | |
311 | ||
312 | return 0; | |
313 | } | |
314 | ||
315 | static bool smart_getATR(smart_card_atr_t *card) | |
316 | { | |
317 | if (UseAlternativeSmartcardReader) { | |
318 | return pcscGetATR(card); | |
319 | } else { | |
320 | UsbCommand c = {CMD_SMART_ATR, {0, 0, 0}}; | |
321 | SendCommand(&c); | |
322 | ||
323 | UsbCommand resp; | |
324 | if ( !WaitForResponseTimeout(CMD_ACK, &resp, 2500) ) { | |
325 | return false; | |
326 | } | |
327 | ||
328 | if (resp.arg[0] & 0xff) { | |
329 | return resp.arg[0] & 0xFF; | |
330 | } | |
331 | ||
332 | memcpy(card, (smart_card_atr_t *)resp.d.asBytes, sizeof(smart_card_atr_t)); | |
333 | ||
334 | return true; | |
335 | } | |
336 | } | |
337 | ||
338 | static bool smart_select(bool silent) { | |
339 | ||
340 | smart_card_atr_t card; | |
341 | if (!smart_getATR(&card)) { | |
342 | if (!silent) PrintAndLogEx(WARNING, "smart card select failed"); | |
343 | return false; | |
344 | } | |
345 | ||
346 | if (!silent) { | |
347 | PrintAndLogEx(INFO, "ISO7816-3 ATR : %s", sprint_hex(card.atr, card.atr_len)); | |
348 | } | |
349 | ||
350 | return true; | |
351 | } | |
352 | ||
353 | static int smart_wait(uint8_t *data) { | |
354 | UsbCommand resp; | |
355 | if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) { | |
356 | PrintAndLogEx(WARNING, "smart card response timeout"); | |
357 | return -1; | |
358 | } | |
359 | ||
360 | uint32_t len = resp.arg[0]; | |
361 | if ( !len ) { | |
362 | PrintAndLogEx(WARNING, "smart card response failed"); | |
363 | return -2; | |
364 | } | |
365 | memcpy(data, resp.d.asBytes, len); | |
366 | if (len >= 2) { | |
367 | PrintAndLogEx(SUCCESS, "%02X%02X | %s", data[len - 2], data[len - 1], GetAPDUCodeDescription(data[len - 2], data[len - 1])); | |
368 | } else { | |
369 | PrintAndLogEx(SUCCESS, " %d | %s", len, sprint_hex_inrow_ex(data, len, 8)); | |
370 | } | |
371 | ||
372 | return len; | |
373 | } | |
374 | ||
375 | static int smart_response(uint8_t *data) { | |
376 | ||
377 | int datalen = smart_wait(data); | |
378 | bool needGetData = false; | |
379 | ||
380 | if (datalen < 2 ) { | |
381 | goto out; | |
382 | } | |
383 | ||
384 | if ( data[datalen - 2] == 0x61 || data[datalen - 2] == 0x9F ) { | |
385 | needGetData = true; | |
386 | } | |
387 | ||
388 | if (needGetData) { | |
389 | int len = data[datalen - 1]; | |
390 | PrintAndLogEx(INFO, "Requesting 0x%02X bytes response", len); | |
391 | uint8_t getstatus[] = {0x00, ISO7816_GETSTATUS, 0x00, 0x00, len}; | |
392 | UsbCommand cStatus = {CMD_SMART_RAW, {SC_RAW, sizeof(getstatus), 0}}; | |
393 | memcpy(cStatus.d.asBytes, getstatus, sizeof(getstatus) ); | |
394 | clearCommandBuffer(); | |
395 | SendCommand(&cStatus); | |
396 | ||
397 | datalen = smart_wait(data); | |
398 | ||
399 | if (datalen < 2 ) { | |
400 | goto out; | |
401 | } | |
402 | ||
403 | // data wo ACK | |
404 | if (datalen != len + 2) { | |
405 | // data with ACK | |
406 | if (datalen == len + 2 + 1) { // 2 - response, 1 - ACK | |
407 | if (data[0] != ISO7816_GETSTATUS) { | |
408 | PrintAndLogEx(ERR, "GetResponse ACK error. len 0x%x | data[0] %02X", len, data[0]); | |
409 | datalen = 0; | |
410 | goto out; | |
411 | } | |
412 | ||
413 | datalen--; | |
414 | memmove(data, &data[1], datalen); | |
415 | } else { | |
416 | // wrong length | |
417 | PrintAndLogEx(WARNING, "GetResponse wrong length. Must be 0x%02X got 0x%02X", len, datalen - 3); | |
418 | } | |
419 | } | |
420 | } | |
421 | ||
422 | out: | |
423 | return datalen; | |
424 | } | |
425 | ||
426 | ||
427 | int CmdSmartSelect(const char *Cmd) { | |
428 | ||
429 | const char *readername; | |
430 | ||
431 | if (tolower(param_getchar(Cmd, 0)) == 'h') { | |
432 | return usage_sm_select(); | |
433 | } | |
434 | ||
435 | if (!PM3hasSmartcardSlot() && !pcscCheckForCardReaders()) { | |
436 | PrintAndLogEx(WARNING, "No Smartcard Readers available"); | |
437 | UseAlternativeSmartcardReader = false; | |
438 | return 1; | |
439 | } | |
440 | ||
441 | int bg, en; | |
442 | if (param_getptr(Cmd, &bg, &en, 0)) { | |
443 | UseAlternativeSmartcardReader = pcscSelectAlternativeCardReader(NULL); | |
444 | } else { | |
445 | readername = Cmd + bg; | |
446 | UseAlternativeSmartcardReader = pcscSelectAlternativeCardReader(readername); | |
447 | } | |
448 | ||
449 | return 0; | |
450 | } | |
451 | ||
452 | int CmdSmartRaw(const char *Cmd) { | |
453 | ||
454 | int hexlen = 0; | |
455 | bool active = false; | |
456 | bool active_select = false; | |
457 | bool useT0 = false; | |
458 | uint8_t cmdp = 0; | |
459 | bool errors = false, reply = true, decodeTLV = false, breakloop = false; | |
460 | uint8_t data[USB_CMD_DATA_SIZE] = {0x00}; | |
461 | ||
462 | while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { | |
463 | switch (tolower(param_getchar(Cmd, cmdp))) { | |
464 | case 'h': return usage_sm_raw(); | |
465 | case 'r': | |
466 | reply = false; | |
467 | cmdp++; | |
468 | break; | |
469 | case 'a': | |
470 | active = true; | |
471 | cmdp++; | |
472 | break; | |
473 | case 's': | |
474 | active_select = true; | |
475 | cmdp++; | |
476 | break; | |
477 | case 't': | |
478 | decodeTLV = true; | |
479 | cmdp++; | |
480 | break; | |
481 | case '0': | |
482 | useT0 = true; | |
483 | cmdp++; | |
484 | break; | |
485 | case 'd': { | |
486 | switch (param_gethex_to_eol(Cmd, cmdp+1, data, sizeof(data), &hexlen)) { | |
487 | case 1: | |
488 | PrintAndLogEx(WARNING, "Invalid HEX value."); | |
489 | return 1; | |
490 | case 2: | |
491 | PrintAndLogEx(WARNING, "Too many bytes. Max %d bytes", sizeof(data)); | |
492 | return 1; | |
493 | case 3: | |
494 | PrintAndLogEx(WARNING, "Hex must have even number of digits."); | |
495 | return 1; | |
496 | } | |
497 | cmdp++; | |
498 | breakloop = true; | |
499 | break; | |
500 | } | |
501 | default: | |
502 | PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp)); | |
503 | errors = true; | |
504 | break; | |
505 | } | |
506 | ||
507 | if ( breakloop ) | |
508 | break; | |
509 | } | |
510 | ||
511 | //Validations | |
512 | if (errors || cmdp == 0 ) return usage_sm_raw(); | |
513 | ||
514 | // arg0 = RFU flags | |
515 | // arg1 = length | |
516 | UsbCommand c = {CMD_SMART_RAW, {0, hexlen, 0}}; | |
517 | ||
518 | if (active || active_select) { | |
519 | c.arg[0] |= SC_CONNECT; | |
520 | if (active_select) | |
521 | c.arg[0] |= SC_SELECT; | |
522 | } | |
523 | ||
524 | if (hexlen > 0) { | |
525 | if (useT0) | |
526 | c.arg[0] |= SC_RAW_T0; | |
527 | else | |
528 | c.arg[0] |= SC_RAW; | |
529 | } | |
530 | ||
531 | memcpy(c.d.asBytes, data, hexlen ); | |
532 | clearCommandBuffer(); | |
533 | SendCommand(&c); | |
534 | ||
535 | // reading response from smart card | |
536 | if ( reply ) { | |
537 | ||
538 | uint8_t* buf = calloc(USB_CMD_DATA_SIZE, sizeof(uint8_t)); | |
539 | if ( !buf ) | |
540 | return 1; | |
541 | ||
542 | int len = smart_response(buf); | |
543 | if ( len < 0 ) { | |
544 | free(buf); | |
545 | return 2; | |
546 | } | |
547 | ||
548 | if ( buf[0] == 0x6C ) { | |
549 | data[4] = buf[1]; | |
550 | ||
551 | memcpy(c.d.asBytes, data, sizeof(data) ); | |
552 | clearCommandBuffer(); | |
553 | SendCommand(&c); | |
554 | len = smart_response(buf); | |
555 | ||
556 | data[4] = 0; | |
557 | } | |
558 | ||
559 | if (decodeTLV && len > 4) | |
560 | TLVPrintFromBuffer(buf, len-2); | |
561 | ||
562 | free(buf); | |
563 | } | |
564 | return 0; | |
565 | } | |
566 | ||
567 | int ExchangeAPDUSC(uint8_t *datain, int datainlen, bool activateCard, bool leaveSignalON, uint8_t *dataout, int maxdataoutlen, int *dataoutlen) { | |
568 | *dataoutlen = 0; | |
569 | ||
570 | if (activateCard) | |
571 | smart_select(false); | |
572 | ||
573 | PrintAndLogEx(DEBUG, "APDU SC"); | |
574 | ||
575 | UsbCommand c = {CMD_SMART_RAW, {SC_RAW_T0, datainlen, 0}}; | |
576 | if (activateCard) { | |
577 | c.arg[0] |= SC_SELECT | SC_CONNECT; | |
578 | } | |
579 | memcpy(c.d.asBytes, datain, datainlen); | |
580 | clearCommandBuffer(); | |
581 | SendCommand(&c); | |
582 | ||
583 | int len = smart_response(dataout); | |
584 | ||
585 | if ( len < 0 ) { | |
586 | return 2; | |
587 | } | |
588 | ||
589 | // retry | |
590 | if (len > 1 && dataout[len - 2] == 0x6c && datainlen > 4) { | |
591 | UsbCommand c2 = {CMD_SMART_RAW, {SC_RAW_T0, datainlen, 0}}; | |
592 | memcpy(c2.d.asBytes, datain, 5); | |
593 | ||
594 | // transfer length via T=0 | |
595 | c2.d.asBytes[4] = dataout[len - 1]; | |
596 | ||
597 | clearCommandBuffer(); | |
598 | SendCommand(&c2); | |
599 | ||
600 | len = smart_response(dataout); | |
601 | } | |
602 | *dataoutlen = len; | |
603 | ||
604 | return 0; | |
605 | } | |
606 | ||
607 | ||
608 | int CmdSmartUpgrade(const char *Cmd) { | |
609 | ||
610 | PrintAndLogEx(NORMAL, ""); | |
611 | PrintAndLogEx(WARNING, "WARNING - RDV4.0 Smartcard Socket Firmware upgrade."); | |
612 | PrintAndLogEx(WARNING, "A dangerous command, do wrong and you will brick the smart card socket"); | |
613 | PrintAndLogEx(NORMAL, ""); | |
614 | ||
615 | FILE *f; | |
616 | char filename[FILE_PATH_SIZE] = {0}; | |
617 | uint8_t cmdp = 0; | |
618 | bool errors = false; | |
619 | ||
620 | while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { | |
621 | switch (tolower(param_getchar(Cmd, cmdp))) { | |
622 | case 'f': | |
623 | //File handling and reading | |
624 | if ( param_getstr(Cmd, cmdp+1, filename, FILE_PATH_SIZE) >= FILE_PATH_SIZE ) { | |
625 | PrintAndLogEx(FAILED, "Filename too long"); | |
626 | errors = true; | |
627 | break; | |
628 | } | |
629 | cmdp += 2; | |
630 | break; | |
631 | case 'h': | |
632 | return usage_sm_upgrade(); | |
633 | default: | |
634 | PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp)); | |
635 | errors = true; | |
636 | break; | |
637 | } | |
638 | } | |
639 | ||
640 | //Validations | |
641 | if (errors || cmdp == 0 ) return usage_sm_upgrade(); | |
642 | ||
643 | if (strchr(filename, '\\') || strchr(filename, '/')) { | |
644 | PrintAndLogEx(FAILED, "Filename must not contain \\ or /. Firmware file will be found in client/sc_upgrade_firmware directory."); | |
645 | return 1; | |
646 | } | |
647 | ||
648 | char sc_upgrade_file_path[strlen(get_my_executable_directory()) + strlen(SC_UPGRADE_FILES_DIRECTORY) + strlen(filename) + 1]; | |
649 | strcpy(sc_upgrade_file_path, get_my_executable_directory()); | |
650 | strcat(sc_upgrade_file_path, SC_UPGRADE_FILES_DIRECTORY); | |
651 | strcat(sc_upgrade_file_path, filename); | |
652 | if (strlen(sc_upgrade_file_path) >= FILE_PATH_SIZE ) { | |
653 | PrintAndLogEx(FAILED, "Filename too long"); | |
654 | return 1; | |
655 | } | |
656 | ||
657 | char sha512filename[FILE_PATH_SIZE] = {'\0'}; | |
658 | char *bin_extension = filename; | |
659 | char *dot_position = NULL; | |
660 | while ((dot_position = strchr(bin_extension, '.')) != NULL) { | |
661 | bin_extension = dot_position + 1; | |
662 | } | |
663 | if (!strcmp(bin_extension, "BIN") | |
664 | #ifdef _WIN32 | |
665 | || !strcmp(bin_extension, "bin") | |
666 | #endif | |
667 | ) { | |
668 | memcpy(sha512filename, filename, strlen(filename) - strlen("bin")); | |
669 | strcat(sha512filename, "sha512.txt"); | |
670 | } else { | |
671 | PrintAndLogEx(FAILED, "Filename extension of Firmware Upgrade File must be .BIN"); | |
672 | return 1; | |
673 | } | |
674 | ||
675 | PrintAndLogEx(INFO, "Checking integrity using SHA512 File %s ...", sha512filename); | |
676 | char sc_upgrade_sha512file_path[strlen(get_my_executable_directory()) + strlen(SC_UPGRADE_FILES_DIRECTORY) + strlen(sha512filename) + 1]; | |
677 | strcpy(sc_upgrade_sha512file_path, get_my_executable_directory()); | |
678 | strcat(sc_upgrade_sha512file_path, SC_UPGRADE_FILES_DIRECTORY); | |
679 | strcat(sc_upgrade_sha512file_path, sha512filename); | |
680 | if (strlen(sc_upgrade_sha512file_path) >= FILE_PATH_SIZE ) { | |
681 | PrintAndLogEx(FAILED, "Filename too long"); | |
682 | return 1; | |
683 | } | |
684 | ||
685 | // load firmware file | |
686 | f = fopen(sc_upgrade_file_path, "rb"); | |
687 | if ( !f ){ | |
688 | PrintAndLogEx(FAILED, "Firmware file not found or locked."); | |
689 | return 1; | |
690 | } | |
691 | ||
692 | // get filesize in order to malloc memory | |
693 | fseek(f, 0, SEEK_END); | |
694 | size_t fsize = ftell(f); | |
695 | fseek(f, 0, SEEK_SET); | |
696 | ||
697 | if (fsize < 0) { | |
698 | PrintAndLogEx(FAILED, "Could not determine size of firmware file"); | |
699 | fclose(f); | |
700 | return 1; | |
701 | } | |
702 | ||
703 | uint8_t *dump = calloc(fsize, sizeof(uint8_t)); | |
704 | if (!dump) { | |
705 | PrintAndLogEx(FAILED, "Could not allocate memory for firmware"); | |
706 | fclose(f); | |
707 | return 1; | |
708 | } | |
709 | ||
710 | size_t firmware_size = fread(dump, 1, fsize, f); | |
711 | if (f) | |
712 | fclose(f); | |
713 | ||
714 | // load sha512 file | |
715 | f = fopen(sc_upgrade_sha512file_path, "rb"); | |
716 | if ( !f ){ | |
717 | PrintAndLogEx(FAILED, "SHA-512 file not found or locked."); | |
718 | return 1; | |
719 | } | |
720 | ||
721 | // get filesize in order to malloc memory | |
722 | fseek(f, 0, SEEK_END); | |
723 | fsize = ftell(f); | |
724 | fseek(f, 0, SEEK_SET); | |
725 | ||
726 | if (fsize < 0) { | |
727 | PrintAndLogEx(FAILED, "Could not determine size of SHA-512 file"); | |
728 | fclose(f); | |
729 | return 1; | |
730 | } | |
731 | ||
732 | if (fsize < 128) { | |
733 | PrintAndLogEx(FAILED, "SHA-512 file too short"); | |
734 | fclose(f); | |
735 | return 1; | |
736 | } | |
737 | ||
738 | char hashstring[129]; | |
739 | size_t bytes_read = fread(hashstring, 1, 128, f); | |
740 | hashstring[128] = '\0'; | |
741 | ||
742 | if (f) | |
743 | fclose(f); | |
744 | ||
745 | uint8_t hash1[64]; | |
746 | if (bytes_read != 128 || param_gethex(hashstring, 0, hash1, 128)) { | |
747 | PrintAndLogEx(FAILED, "Couldn't read SHA-512 file"); | |
748 | return 1; | |
749 | } | |
750 | ||
751 | uint8_t hash2[64]; | |
752 | if (sha512hash(dump, firmware_size, hash2)) { | |
753 | PrintAndLogEx(FAILED, "Couldn't calculate SHA-512 of Firmware"); | |
754 | return 1; | |
755 | } | |
756 | ||
757 | if (memcmp(hash1, hash2, 64)) { | |
758 | PrintAndLogEx(FAILED, "Couldn't verify integrity of Firmware file (wrong SHA-512)"); | |
759 | return 1; | |
760 | } | |
761 | ||
762 | PrintAndLogEx(SUCCESS, "RDV4.0 Smartcard Socket Firmware uploading to PM3"); | |
763 | ||
764 | //Send to device | |
765 | uint32_t index = 0; | |
766 | uint32_t bytes_sent = 0; | |
767 | uint32_t bytes_remaining = firmware_size; | |
768 | ||
769 | while (bytes_remaining > 0){ | |
770 | uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining); | |
771 | UsbCommand c = {CMD_SMART_UPLOAD, {index + bytes_sent, bytes_in_packet, 0}}; | |
772 | ||
773 | // Fill usb bytes with 0xFF | |
774 | memset(c.d.asBytes, 0xFF, USB_CMD_DATA_SIZE); | |
775 | memcpy(c.d.asBytes, dump + bytes_sent, bytes_in_packet); | |
776 | clearCommandBuffer(); | |
777 | SendCommand(&c); | |
778 | if ( !WaitForResponseTimeout(CMD_ACK, NULL, 2000) ) { | |
779 | PrintAndLogEx(WARNING, "timeout while waiting for reply."); | |
780 | free(dump); | |
781 | return 1; | |
782 | } | |
783 | ||
784 | bytes_remaining -= bytes_in_packet; | |
785 | bytes_sent += bytes_in_packet; | |
786 | printf("."); fflush(stdout); | |
787 | } | |
788 | free(dump); | |
789 | printf("\n"); | |
790 | PrintAndLogEx(SUCCESS, "RDV4.0 Smartcard Socket Firmware updating, don\'t turn off your PM3!"); | |
791 | ||
792 | // trigger the firmware upgrade | |
793 | UsbCommand c = {CMD_SMART_UPGRADE, {firmware_size, 0, 0}}; | |
794 | clearCommandBuffer(); | |
795 | SendCommand(&c); | |
796 | UsbCommand resp; | |
797 | if ( !WaitForResponseTimeout(CMD_ACK, &resp, 2500) ) { | |
798 | PrintAndLogEx(WARNING, "timeout while waiting for reply."); | |
799 | return 1; | |
800 | } | |
801 | if ( (resp.arg[0] & 0xFF ) ) | |
802 | PrintAndLogEx(SUCCESS, "RDV4.0 Smartcard Socket Firmware upgraded successful"); | |
803 | else | |
804 | PrintAndLogEx(FAILED, "RDV4.0 Smartcard Socket Firmware Upgrade failed"); | |
805 | return 0; | |
806 | } | |
807 | ||
808 | int CmdSmartInfo(const char *Cmd){ | |
809 | uint8_t cmdp = 0; | |
810 | bool errors = false, silent = false; | |
811 | ||
812 | while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { | |
813 | switch (tolower(param_getchar(Cmd, cmdp))) { | |
814 | case 'h': return usage_sm_info(); | |
815 | case 's': | |
816 | silent = true; | |
817 | break; | |
818 | default: | |
819 | PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp)); | |
820 | errors = true; | |
821 | break; | |
822 | } | |
823 | cmdp++; | |
824 | } | |
825 | ||
826 | //Validations | |
827 | if (errors ) return usage_sm_info(); | |
828 | ||
829 | smart_card_atr_t card; | |
830 | if (!smart_getATR(&card)) { | |
831 | if (!silent) PrintAndLogEx(WARNING, "smart card select failed"); | |
832 | return 1; | |
833 | } | |
834 | ||
835 | // print header | |
836 | PrintAndLogEx(INFO, "--- Smartcard Information ---------"); | |
837 | PrintAndLogEx(INFO, "-------------------------------------------------------------"); | |
838 | PrintAndLogEx(INFO, "ISO7618-3 ATR : %s", sprint_hex(card.atr, card.atr_len)); | |
839 | PrintAndLogEx(INFO, "\nhttp://smartcard-atr.appspot.com/parse?ATR=%s", sprint_hex_inrow(card.atr, card.atr_len) ); | |
840 | ||
841 | // print ATR | |
842 | PrintAndLogEx(NORMAL, ""); | |
843 | PrintAndLogEx(INFO, "ATR"); | |
844 | PrintATR(card.atr, card.atr_len); | |
845 | ||
846 | // print D/F (brom byte TA1 or defaults) | |
847 | PrintAndLogEx(NORMAL, ""); | |
848 | PrintAndLogEx(INFO, "D/F (TA1)"); | |
849 | int Di = GetATRDi(card.atr, card.atr_len); | |
850 | int Fi = GetATRFi(card.atr, card.atr_len); | |
851 | float F = GetATRF(card.atr, card.atr_len); | |
852 | if (GetATRTA1(card.atr, card.atr_len) == 0x11) | |
853 | PrintAndLogEx(INFO, "Using default values..."); | |
854 | ||
855 | PrintAndLogEx(NORMAL, "\t- Di=%d", Di); | |
856 | PrintAndLogEx(NORMAL, "\t- Fi=%d", Fi); | |
857 | PrintAndLogEx(NORMAL, "\t- F=%.1f MHz", F); | |
858 | ||
859 | if (Di && Fi) { | |
860 | PrintAndLogEx(NORMAL, "\t- Cycles/ETU=%d", Fi/Di); | |
861 | PrintAndLogEx(NORMAL, "\t- %.1f bits/sec at 4MHz", (float)4000000 / (Fi/Di)); | |
862 | PrintAndLogEx(NORMAL, "\t- %.1f bits/sec at Fmax=%.1fMHz", (F * 1000000) / (Fi/Di), F); | |
863 | } else { | |
864 | PrintAndLogEx(WARNING, "\t- Di or Fi is RFU."); | |
865 | }; | |
866 | ||
867 | return 0; | |
868 | } | |
869 | ||
870 | int CmdSmartReader(const char *Cmd){ | |
871 | uint8_t cmdp = 0; | |
872 | bool errors = false, silent = false; | |
873 | ||
874 | while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { | |
875 | switch (tolower(param_getchar(Cmd, cmdp))) { | |
876 | case 'h': return usage_sm_reader(); | |
877 | case 's': | |
878 | silent = true; | |
879 | break; | |
880 | default: | |
881 | PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp)); | |
882 | errors = true; | |
883 | break; | |
884 | } | |
885 | cmdp++; | |
886 | } | |
887 | ||
888 | //Validations | |
889 | if (errors ) return usage_sm_reader(); | |
890 | ||
891 | smart_card_atr_t card; | |
892 | if (!smart_getATR(&card)) { | |
893 | if (!silent) PrintAndLogEx(WARNING, "smart card select failed"); | |
894 | return 1; | |
895 | } | |
896 | ||
897 | PrintAndLogEx(INFO, "ISO7816-3 ATR : %s", sprint_hex(card.atr, card.atr_len)); | |
898 | return 0; | |
899 | } | |
900 | ||
901 | int CmdSmartSetClock(const char *Cmd){ | |
902 | uint8_t cmdp = 0; | |
903 | bool errors = false; | |
904 | uint8_t clock = 0; | |
905 | while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { | |
906 | switch (tolower(param_getchar(Cmd, cmdp))) { | |
907 | case 'h': return usage_sm_setclock(); | |
908 | case 'c': | |
909 | clock = param_get8ex(Cmd, cmdp+1, 2, 10); | |
910 | if ( clock > 2) | |
911 | errors = true; | |
912 | ||
913 | cmdp += 2; | |
914 | break; | |
915 | default: | |
916 | PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp)); | |
917 | errors = true; | |
918 | break; | |
919 | } | |
920 | } | |
921 | ||
922 | //Validations | |
923 | if (errors || cmdp == 0) return usage_sm_setclock(); | |
924 | ||
925 | UsbCommand c = {CMD_SMART_SETCLOCK, {clock, 0, 0}}; | |
926 | clearCommandBuffer(); | |
927 | SendCommand(&c); | |
928 | UsbCommand resp; | |
929 | if ( !WaitForResponseTimeout(CMD_ACK, &resp, 2500) ) { | |
930 | PrintAndLogEx(WARNING, "smart card select failed"); | |
931 | return 1; | |
932 | } | |
933 | ||
934 | uint8_t isok = resp.arg[0] & 0xFF; | |
935 | if (!isok) { | |
936 | PrintAndLogEx(WARNING, "smart card set clock failed"); | |
937 | return 1; | |
938 | } | |
939 | ||
940 | switch (clock) { | |
941 | case 0: | |
942 | PrintAndLogEx(SUCCESS, "Clock changed to 16mhz giving 10800 baudrate"); | |
943 | break; | |
944 | case 1: | |
945 | PrintAndLogEx(SUCCESS, "Clock changed to 8mhz giving 21600 baudrate"); | |
946 | break; | |
947 | case 2: | |
948 | PrintAndLogEx(SUCCESS, "Clock changed to 4mhz giving 86400 baudrate"); | |
949 | break; | |
950 | default: | |
951 | break; | |
952 | } | |
953 | return 0; | |
954 | } | |
955 | ||
956 | int CmdSmartList(const char *Cmd) { | |
957 | CmdHFList("7816"); | |
958 | return 0; | |
959 | } | |
960 | ||
961 | int CmdSmartBruteforceSFI(const char *Cmd) { | |
962 | ||
963 | char ctmp = tolower(param_getchar(Cmd, 0)); | |
964 | if (ctmp == 'h') return usage_sm_brute(); | |
965 | ||
966 | uint8_t data[5] = {0x00, 0xB2, 0x00, 0x00, 0x00}; | |
967 | ||
968 | PrintAndLogEx(INFO, "Selecting card"); | |
969 | if ( !smart_select(false) ) { | |
970 | return 1; | |
971 | } | |
972 | ||
973 | PrintAndLogEx(INFO, "Selecting PPSE aid"); | |
974 | CmdSmartRaw("s 0 t d 00a404000e325041592e5359532e4444463031"); | |
975 | CmdSmartRaw("0 t d 00a4040007a000000004101000"); // mastercard | |
976 | // CmdSmartRaw("0 t d 00a4040007a0000000031010"); // visa | |
977 | ||
978 | PrintAndLogEx(INFO, "starting"); | |
979 | ||
980 | UsbCommand c = {CMD_SMART_RAW, {SC_RAW, sizeof(data), 0}}; | |
981 | uint8_t* buf = malloc(USB_CMD_DATA_SIZE); | |
982 | if ( !buf ) | |
983 | return 1; | |
984 | ||
985 | for (uint8_t i=1; i < 4; i++) { | |
986 | for (int p1=1; p1 < 5; p1++) { | |
987 | ||
988 | data[2] = p1; | |
989 | data[3] = (i << 3) + 4; | |
990 | ||
991 | memcpy(c.d.asBytes, data, sizeof(data) ); | |
992 | clearCommandBuffer(); | |
993 | SendCommand(&c); | |
994 | ||
995 | smart_response(buf); | |
996 | ||
997 | if ( buf[0] == 0x6C ) { | |
998 | data[4] = buf[1]; | |
999 | ||
1000 | memcpy(c.d.asBytes, data, sizeof(data) ); | |
1001 | clearCommandBuffer(); | |
1002 | SendCommand(&c); | |
1003 | uint8_t len = smart_response(buf); | |
1004 | ||
1005 | // TLV decoder | |
1006 | if (len > 4) | |
1007 | TLVPrintFromBuffer(buf+1, len-3); | |
1008 | ||
1009 | data[4] = 0; | |
1010 | } | |
1011 | memset(buf, 0x00, USB_CMD_DATA_SIZE); | |
1012 | } | |
1013 | } | |
1014 | free(buf); | |
1015 | return 0; | |
1016 | } | |
1017 | ||
1018 | static command_t CommandTable[] = { | |
1019 | {"help", CmdHelp, 1, "This help"}, | |
1020 | {"select", CmdSmartSelect, 1, "Select the Smartcard Reader to use"}, | |
1021 | {"list", CmdSmartList, 0, "List ISO 7816 history"}, | |
1022 | {"info", CmdSmartInfo, 0, "Tag information"}, | |
1023 | {"reader", CmdSmartReader, 0, "Act like an IS07816 reader"}, | |
1024 | {"raw", CmdSmartRaw, 0, "Send raw hex data to tag"}, | |
1025 | {"upgrade", CmdSmartUpgrade, 0, "Upgrade firmware"}, | |
1026 | {"setclock", CmdSmartSetClock, 0, "Set clock speed"}, | |
1027 | {"brute", CmdSmartBruteforceSFI, 0, "Bruteforce SFI"}, | |
1028 | {NULL, NULL, 0, NULL} | |
1029 | }; | |
1030 | ||
1031 | int CmdSmartcard(const char *Cmd) { | |
1032 | clearCommandBuffer(); | |
1033 | CmdsParse(CommandTable, Cmd); | |
1034 | return 0; | |
1035 | } | |
1036 | ||
1037 | int CmdHelp(const char *Cmd) { | |
1038 | CmdsHelp(CommandTable); | |
1039 | return 0; | |
1040 | } |