git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhficlass.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
   3 // Copyright (C) 2011 Gerhard de Koning Gans
   4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
   5 //
   6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   7 // at your option, any later version. See the LICENSE.txt file for the text of
   8 // the license.
   9 //-----------------------------------------------------------------------------
  10 // High frequency iClass commands
  11 //-----------------------------------------------------------------------------
  12
  13 #include <stdio.h>
  14 #include <stdlib.h>
  15 #include <string.h>
  16 #include <sys/stat.h>
  17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
  18 #include "data.h"
  19 //#include "proxusb.h"
  20 #include "proxmark3.h"
  21 #include "ui.h"
  22 #include "cmdparser.h"
  23 #include "cmdhficlass.h"
  24 #include "common.h"
  25 #include "util.h"
  26 #include "cmdmain.h"
  27 #include "loclass/des.h"
  28 #include "loclass/cipherutils.h"
  29 #include "loclass/cipher.h"
  30 #include "loclass/ikeys.h"
  31 #include "loclass/elite_crack.h"
  32 #include "loclass/fileutils.h"
  33
  34 static int CmdHelp(const char *Cmd);
  35
  36 int xorbits_8(uint8_t val)
  37 {
  38     uint8_t res = val ^ (val >> 1); //1st pass
  39     res = res ^ (res >> 1);             // 2nd pass
  40     res = res ^ (res >> 2);             // 3rd pass
  41     res = res ^ (res >> 4);                     // 4th pass
  42     return res & 1;
  43 }
  44
  45 int CmdHFiClassList(const char *Cmd)
  46 {
  47
  48         bool ShowWaitCycles = false;
  49         char param = param_getchar(Cmd, 0);
  50
  51         if (param != 0) {
  52                 PrintAndLog("List data in trace buffer.");
  53                 PrintAndLog("Usage:  hf iclass list");
  54                 PrintAndLog("h - help");
  55                 PrintAndLog("sample: hf iclass list");
  56                 return 0;
  57         }
  58
  59         uint8_t got[1920];
  60         GetFromBigBuf(got,sizeof(got),0);
  61         WaitForResponse(CMD_ACK,NULL);
  62
  63         PrintAndLog("Recorded Activity");
  64         PrintAndLog("");
  65         PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
  66         PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
  67         PrintAndLog("");
  68         PrintAndLog("     Start |       End | Src | Data");
  69         PrintAndLog("-----------|-----------|-----|--------");
  70
  71         int i;
  72         uint32_t first_timestamp = 0;
  73         uint32_t timestamp;
  74         bool tagToReader;
  75         uint32_t parityBits;
  76         uint8_t len;
  77         uint8_t *frame;
  78         uint32_t EndOfTransmissionTimestamp = 0;
  79
  80
  81         for( i=0; i < 1900;)
  82         {
  83                 //First 32 bits contain
  84                 // isResponse (1 bit)
  85                 // timestamp (remaining)
  86                 //Then paritybits
  87                 //Then length
  88                 timestamp = *((uint32_t *)(got+i));
  89                 parityBits = *((uint32_t *)(got+i+4));
  90                 len = got[i+8];
  91         frame = (got+i+9);
  92                 uint32_t next_timestamp = (*((uint32_t *)(got+i+9))) & 0x7fffffff;
  93
  94                 tagToReader = timestamp & 0x80000000;
  95                 timestamp &= 0x7fffffff;
  96
  97                 if(i==0) {
  98                         first_timestamp = timestamp;
  99                 }
 100
 101         // Break and stick with current result idf buffer was not completely full
 102                 if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;
 103
 104                 char line[1000] = "";
 105
 106                 if(len)//We have some data to display
 107                 {
 108                         int j,oddparity;
 109
 110                         for(j = 0; j < len ; j++)
 111                         {
 112                                 oddparity = 0x01 ^ xorbits_8(frame[j] & 0xFF);
 113
 114                                 if (tagToReader && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
 115                                         sprintf(line+(j*4), "%02x!  ", frame[j]);
 116                                 } else {
 117                                         sprintf(line+(j*4), "%02x   ", frame[j]);
 118                                 }
 119                         }
 120                 }else
 121                 {
 122                         if (ShowWaitCycles) {
 123                                 sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
 124                         }
 125                 }
 126
 127                 char *crc = "";
 128
 129                 if(len > 2)
 130                 {
 131                         uint8_t b1, b2;
 132                         if(!tagToReader && len == 4) {
 133                                 // Rough guess that this is a command from the reader
 134                                 // For iClass the command byte is not part of the CRC
 135                                         ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
 136                         }
 137                         else {
 138                                   // For other data.. CRC might not be applicable (UPDATE commands etc.)
 139                                 ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
 140                         }
 141
 142                         if (b1 != frame[len-2] || b2 != frame[len-1]) {
 143                                 crc = (tagToReader & (len < 8)) ? "" : " !crc";
 144                         }
 145                 }
 146
 147                 i += (len + 9);
 148                 EndOfTransmissionTimestamp = (*((uint32_t *)(got+i))) & 0x7fffffff;
 149
 150                 // Not implemented for iclass on the ARM-side
 151                 //if (!ShowWaitCycles) i += 9;
 152
 153                 PrintAndLog(" %9d | %9d | %s | %s %s",
 154                         (timestamp - first_timestamp),
 155                         (EndOfTransmissionTimestamp - first_timestamp),
 156                         (len?(tagToReader ? "Tag" : "Rdr"):"   "),
 157                         line, crc);
 158         }
 159         return 0;
 160 }
 161
 162 int CmdHFiClassListOld(const char *Cmd)
 163 {
 164   uint8_t got[1920];
 165   GetFromBigBuf(got,sizeof(got),0);
 166
 167   PrintAndLog("recorded activity:");
 168   PrintAndLog(" ETU     :rssi: who bytes");
 169   PrintAndLog("---------+----+----+-----------");
 170
 171   int i = 0;
 172   int prev = -1;
 173
 174   for (;;) {
 175     if(i >= 1900) {
 176       break;
 177     }
 178
 179     bool isResponse;
 180     int timestamp = *((uint32_t *)(got+i));
 181     if (timestamp & 0x80000000) {
 182       timestamp &= 0x7fffffff;
 183       isResponse = 1;
 184     } else {
 185       isResponse = 0;
 186     }
 187
 188
 189     int metric = 0;
 190
 191     int parityBits = *((uint32_t *)(got+i+4));
 192     // 4 bytes of additional information...
 193     // maximum of 32 additional parity bit information
 194     //
 195     // TODO:
 196     // at each quarter bit period we can send power level (16 levels)
 197     // or each half bit period in 256 levels.
 198
 199
 200     int len = got[i+8];
 201
 202     if (len > 100) {
 203       break;
 204     }
 205     if (i + len >= 1900) {
 206       break;
 207     }
 208
 209     uint8_t *frame = (got+i+9);
 210
 211     // Break and stick with current result if buffer was not completely full
 212     if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }
 213
 214     char line[1000] = "";
 215     int j;
 216     for (j = 0; j < len; j++) {
 217       int oddparity = 0x01;
 218       int k;
 219
 220       for (k=0;k<8;k++) {
 221         oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
 222       }
 223
 224       //if((parityBits >> (len - j - 1)) & 0x01) {
 225       if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
 226         sprintf(line+(j*4), "%02x!  ", frame[j]);
 227       }
 228       else {
 229         sprintf(line+(j*4), "%02x   ", frame[j]);
 230       }
 231     }
 232
 233     char *crc;
 234     crc = "";
 235     if (len > 2) {
 236       uint8_t b1, b2;
 237       for (j = 0; j < (len - 1); j++) {
 238         // gives problems... search for the reason..
 239         /*if(frame[j] == 0xAA) {
 240           switch(frame[j+1]) {
 241             case 0x01:
 242               crc = "[1] Two drops close after each other";
 243             break;
 244             case 0x02:
 245               crc = "[2] Potential SOC with a drop in second half of bitperiod";
 246               break;
 247             case 0x03:
 248               crc = "[3] Segment Z after segment X is not possible";
 249               break;
 250             case 0x04:
 251               crc = "[4] Parity bit of a fully received byte was wrong";
 252               break;
 253             default:
 254               crc = "[?] Unknown error";
 255               break;
 256           }
 257           break;
 258         }*/
 259       }
 260
 261       if (strlen(crc)==0) {
 262         if(!isResponse && len == 4) {
 263                 // Rough guess that this is a command from the reader
 264                 // For iClass the command byte is not part of the CRC
 265                 ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
 266         }
 267         else {
 268                 // For other data.. CRC might not be applicable (UPDATE commands etc.)
 269                 ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
 270         }
 271         //printf("%1x %1x",(unsigned)b1,(unsigned)b2);
 272         if (b1 != frame[len-2] || b2 != frame[len-1]) {
 273           crc = (isResponse & (len < 8)) ? "" : " !crc";
 274         } else {
 275           crc = "";
 276         }
 277       }
 278     } else {
 279       crc = ""; // SHORT
 280     }
 281
 282     char metricString[100];
 283     if (isResponse) {
 284       sprintf(metricString, "%3d", metric);
 285     } else {
 286       strcpy(metricString, "   ");
 287     }
 288
 289     PrintAndLog(" +%7d: %s: %s %s %s",
 290       (prev < 0 ? 0 : (timestamp - prev)),
 291       metricString,
 292       (isResponse ? "TAG" : "   "), line, crc);
 293
 294     prev = timestamp;
 295     i += (len + 9);
 296   }
 297   return 0;
 298 }
 299
 300 int CmdHFiClassSnoop(const char *Cmd)
 301 {
 302   UsbCommand c = {CMD_SNOOP_ICLASS};
 303   SendCommand(&c);
 304   return 0;
 305 }
 306 #define NUM_CSNS 15
 307 int CmdHFiClassSim(const char *Cmd)
 308 {
 309   uint8_t simType = 0;
 310   uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
 311
 312   if (strlen(Cmd)<1) {
 313         PrintAndLog("Usage:  hf iclass sim [0 <CSN>] | x");
 314         PrintAndLog("        options");
 315         PrintAndLog("                0 <CSN> simulate the given CSN");
 316         PrintAndLog("                1       simulate default CSN");
 317         PrintAndLog("                2       iterate CSNs, gather MACs");
 318         PrintAndLog("        sample: hf iclass sim 0 031FEC8AF7FF12E0");
 319         PrintAndLog("        sample: hf iclass sim 2");
 320         return 0;
 321   }
 322
 323   simType = param_get8(Cmd, 0);
 324
 325   if(simType == 0)
 326   {
 327           if (param_gethex(Cmd, 1, CSN, 16)) {
 328                   PrintAndLog("A CSN should consist of 16 HEX symbols");
 329                   return 1;
 330           }
 331           PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
 332
 333   }
 334   if(simType > 2)
 335   {
 336           PrintAndLog("Undefined simptype %d", simType);
 337           return 1;
 338   }
 339   uint8_t numberOfCSNs=0;
 340
 341         if(simType == 2)
 342         {
 343                 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
 344                 UsbCommand resp = {0};
 345
 346                 /*uint8_t csns[8 * NUM_CSNS] = {
 347                          0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,
 348                          0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,
 349                          0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,
 350                          0x17,0x12,0x01,0xfd,0xf7,0xff,0x12,0xe0 ,
 351                          0xcd,0x56,0x01,0x7c,0x6f,0xff,0x12,0xe0 ,
 352                          0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,
 353                          0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,
 354                          0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };
 355 */
 356
 357        uint8_t csns[8*NUM_CSNS] = {
 358         0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
 359         0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
 360         0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
 361         0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
 362         0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
 363         0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
 364         0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
 365         0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
 366         0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
 367         0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
 368         0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
 369         0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
 370         0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
 371         0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
 372         0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
 373
 374                 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
 375
 376                 SendCommand(&c);
 377                 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
 378                         PrintAndLog("Command timed out");
 379                         return 0;
 380                 }
 381
 382                 uint8_t num_mac_responses  = resp.arg[1];
 383                 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
 384
 385                 size_t datalen = NUM_CSNS*24;
 386                 /*
 387                  * Now, time to dump to file. We'll use this format:
 388                  * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
 389                  * So, it should wind up as
 390                  * 8 * 24 bytes.
 391                  *
 392                  * The returndata from the pm3 is on the following format
 393                  * <4 byte NR><4 byte MAC>
 394                  * CC are all zeroes, CSN is the same as was sent in
 395                  **/
 396                 void* dump = malloc(datalen);
 397                 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
 398                 uint8_t i = 0;
 399                 for(i = 0 ; i < NUM_CSNS ; i++)
 400                 {
 401                         memcpy(dump+i*24, csns+i*8,8); //CSN
 402                         //8 zero bytes here...
 403                         //Then comes NR_MAC (eight bytes from the response)
 404                         memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
 405
 406                 }
 407                 /** Now, save to dumpfile **/
 408                 saveFile("iclass_mac_attack", "bin", dump,datalen);
 409                 free(dump);
 410         }else
 411         {
 412                 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
 413                 memcpy(c.d.asBytes, CSN, 8);
 414                 SendCommand(&c);
 415         }
 416
 417   return 0;
 418 }
 419
 420 int CmdHFiClassReader(const char *Cmd)
 421 {
 422   UsbCommand c = {CMD_READER_ICLASS, {0}};
 423   SendCommand(&c);
 424     UsbCommand resp;
 425   while(!ukbhit()){
 426       if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
 427             uint8_t isOK    = resp.arg[0] & 0xff;
 428             uint8_t * data  = resp.d.asBytes;
 429
 430             PrintAndLog("isOk:%02x", isOK);
 431
 432             if(isOK > 0)
 433             {
 434                 PrintAndLog("CSN: %s",sprint_hex(data,8));
 435             }
 436             if(isOK >= 1)
 437             {
 438                 PrintAndLog("CC: %s",sprint_hex(data+8,8));
 439             }else{
 440                 PrintAndLog("No CC obtained");
 441             }
 442         } else {
 443             PrintAndLog("Command execute timeout");
 444         }
 445     }
 446
 447   return 0;
 448 }
 449
 450 int CmdHFiClassReader_Replay(const char *Cmd)
 451 {
 452   uint8_t readerType = 0;
 453   uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
 454
 455   if (strlen(Cmd)<1) {
 456     PrintAndLog("Usage:  hf iclass replay <MAC>");
 457     PrintAndLog("        sample: hf iclass replay 00112233");
 458     return 0;
 459   }
 460
 461   if (param_gethex(Cmd, 0, MAC, 8)) {
 462     PrintAndLog("MAC must include 8 HEX symbols");
 463     return 1;
 464   }
 465
 466   UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
 467   memcpy(c.d.asBytes, MAC, 4);
 468   SendCommand(&c);
 469
 470   return 0;
 471 }
 472
 473 int CmdHFiClassReader_Dump(const char *Cmd)
 474 {
 475   uint8_t readerType = 0;
 476   uint8_t MAC[4]={0x00,0x00,0x00,0x00};
 477   uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 478   uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 479   uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 480   //uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 481   uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 482   uint8_t keytable[128] = {0};
 483   int elite = 0;
 484   uint8_t *used_key;
 485   int i;
 486   if (strlen(Cmd)<1)
 487   {
 488     PrintAndLog("Usage:  hf iclass dump <Key> [e]");
 489     PrintAndLog("        Key    - A 16 byte master key");
 490     PrintAndLog("        e      - If 'e' is specified, the key is interpreted as the 16 byte");
 491     PrintAndLog("                 Custom Key (KCus), which can be obtained via reader-attack");
 492     PrintAndLog("                 See 'hf iclass sim 2'. This key should be on iclass-format");
 493     PrintAndLog("        sample: hf iclass dump 0011223344556677");
 494
 495
 496     return 0;
 497   }
 498
 499   if (param_gethex(Cmd, 0, KEY, 16))
 500   {
 501     PrintAndLog("KEY must include 16 HEX symbols");
 502     return 1;
 503   }
 504
 505   if (param_getchar(Cmd, 1) == 'e')
 506   {
 507     PrintAndLog("Elite switch on");
 508     elite = 1;
 509
 510     //calc h2
 511     hash2(KEY, keytable);
 512     printarr_human_readable("keytable", keytable, 128);
 513
 514   }
 515
 516   UsbCommand resp;
 517   uint8_t key_sel[8] = {0};
 518   uint8_t key_sel_p[8] = { 0 };
 519
 520   //HACK -- Below is for testing without access to a tag
 521   uint8_t xdata[16] = {0x01,0x02,0x03,0x04,0xF7,0xFF,0x12,0xE0, //CSN from http://www.proxmark.org/forum/viewtopic.php?pid=11230#p11230
 522                       0xFE,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF}; // Just a random CC. Would be good to add a real testcase here
 523   memcpy(resp.d.asBytes,xdata, 16);
 524   resp.arg[0] = 2;
 525   uint8_t fake_dummy_test = false;
 526   //End hack
 527
 528
 529   UsbCommand c = {CMD_READER_ICLASS, {0}};
 530   c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE;
 531   if(!fake_dummy_test)
 532     SendCommand(&c);
 533
 534
 535
 536   if (fake_dummy_test || WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
 537         uint8_t isOK    = resp.arg[0] & 0xff;
 538         uint8_t * data  = resp.d.asBytes;
 539
 540         memcpy(CSN,data,8);
 541         memcpy(CCNR,data+8,8);
 542
 543         PrintAndLog("isOk:%02x", isOK);
 544
 545         if(isOK > 0)
 546         {
 547             PrintAndLog("CSN: %s",sprint_hex(CSN,8));
 548         }
 549         if(isOK > 1)
 550         {
 551             if(elite)
 552             {
 553                 //Get the key index (hash1)
 554                 uint8_t key_index[8] = {0};
 555
 556                 hash1(CSN, key_index);
 557                 printvar("hash1", key_index,8);
 558                 for(i = 0; i < 8 ; i++)
 559                     key_sel[i] = keytable[key_index[i]] & 0xFF;
 560                 PrintAndLog("Pre-fortified 'permuted' HS key that would be needed by an iclass reader to talk to above CSN:");
 561                 printvar("k_sel", key_sel,8);
 562                 //Permute from iclass format to standard format
 563                 permutekey_rev(key_sel,key_sel_p);
 564                 used_key = key_sel_p;
 565             }else{
 566                 //Perhaps this should also be permuted to std format?
 567                 // Something like the code below? I have no std system
 568                 // to test this with /Martin
 569
 570                 //uint8_t key_sel_p[8] = { 0 };
 571                 //permutekey_rev(KEY,key_sel_p);
 572                 //used_key = key_sel_p;
 573
 574                 used_key = KEY;
 575
 576             }
 577
 578             PrintAndLog("Pre-fortified key that would be needed by the OmniKey reader to talk to above CSN:");
 579             printvar("Used key",used_key,8);
 580             diversifyKey(CSN,used_key, div_key);
 581             PrintAndLog("Hash0, a.k.a diversified key, that is computed using Ksel and stored in the card (Block 3):");
 582             printvar("Div key", div_key, 8);
 583             printvar("CC_NR:",CCNR,12);
 584             doMAC(CCNR,12,div_key, MAC);
 585             printvar("MAC", MAC, 4);
 586
 587             UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
 588             memcpy(d.d.asBytes, MAC, 4);
 589             if(!fake_dummy_test) SendCommand(&d);
 590
 591         }else{
 592             PrintAndLog("Failed to obtain CC! Aborting");
 593         }
 594     } else {
 595         PrintAndLog("Command execute timeout");
 596     }
 597
 598   return 0;
 599 }
 600
 601 int CmdHFiClass_iso14443A_write(const char *Cmd)
 602 {
 603   uint8_t readerType = 0;
 604   uint8_t MAC[4]={0x00,0x00,0x00,0x00};
 605   uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 606   uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 607   uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 608   uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 609
 610   uint8_t blockNo=0;
 611   uint8_t bldata[8]={0};
 612
 613   if (strlen(Cmd)<3)
 614   {
 615     PrintAndLog("Usage:  hf iclass write <Key> <Block> <Data>");
 616     PrintAndLog("        sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
 617     return 0;
 618   }
 619
 620   if (param_gethex(Cmd, 0, KEY, 16))
 621   {
 622     PrintAndLog("KEY must include 16 HEX symbols");
 623     return 1;
 624   }
 625
 626   blockNo = param_get8(Cmd, 1);
 627   if (blockNo>32)
 628   {
 629         PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
 630         return 1;
 631   }
 632   if (param_gethex(Cmd, 2, bldata, 8))
 633   {
 634         PrintAndLog("Block data must include 8 HEX symbols");
 635         return 1;
 636   }
 637
 638   UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};
 639   SendCommand(&c);
 640   UsbCommand resp;
 641
 642   if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
 643     uint8_t isOK    = resp.arg[0] & 0xff;
 644     uint8_t * data  = resp.d.asBytes;
 645
 646     memcpy(CSN,data,8);
 647     memcpy(CCNR,data+8,8);
 648     PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
 649     PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
 650         PrintAndLog("isOk:%02x", isOK);
 651   } else {
 652         PrintAndLog("Command execute timeout");
 653   }
 654
 655   diversifyKey(CSN,KEY, div_key);
 656
 657   PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
 658   doMAC(CCNR, 12,div_key, MAC);
 659
 660   UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
 661   memcpy(c2.d.asBytes, bldata, 8);
 662   memcpy(c2.d.asBytes+8, MAC, 4);
 663   SendCommand(&c2);
 664
 665   if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 666     uint8_t isOK    = resp.arg[0] & 0xff;
 667     uint8_t * data  = resp.d.asBytes;
 668
 669     if (isOK)
 670       PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
 671     else
 672       PrintAndLog("isOk:%02x", isOK);
 673   } else {
 674       PrintAndLog("Command execute timeout");
 675   }
 676   return 0;
 677 }
 678
 679
 680 static command_t CommandTable[] =
 681 {
 682   {"help",      CmdHelp,                        1,      "This help"},
 683   {"list",      CmdHFiClassList,        0,      "List iClass history"},
 684   {"snoop",     CmdHFiClassSnoop,       0,      "Eavesdrop iClass communication"},
 685   {"sim",       CmdHFiClassSim,         0,      "Simulate iClass tag"},
 686   {"reader",CmdHFiClassReader,  0,      "Read an iClass tag"},
 687   {"replay",CmdHFiClassReader_Replay,   0,      "Read an iClass tag via Reply Attack"},
 688   {"dump",      CmdHFiClassReader_Dump, 0,              "Authenticate and Dump iClass tag"},
 689   {"write",     CmdHFiClass_iso14443A_write,    0,      "Authenticate and Write iClass block"},
 690   {NULL, NULL, 0, NULL}
 691 };
 692
 693 int CmdHFiClass(const char *Cmd)
 694 {
 695   CmdsParse(CommandTable, Cmd);
 696   return 0;
 697 }
 698
 699 int CmdHelp(const char *Cmd)
 700 {
 701   CmdsHelp(CommandTable);
 702   return 0;
 703 }