git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdsmartcard.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2018 iceman
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // Proxmark3 RDV40 Smartcard module commands
   9 //-----------------------------------------------------------------------------
  10 #include "cmdsmartcard.h"
  11
  12 #include <ctype.h>
  13
  14 #include "ui.h"
  15 #include "cmdparser.h"
  16 #include "proxmark3.h"
  17 #include "util.h"
  18 #include "smartcard.h"
  19 #include "comms.h"
  20 #include "protocols.h"
  21 #include "cmdhflist.h"
  22 #include "emv/apduinfo.h"       // APDUcode description
  23 #include "emv/emvcore.h"        // decodeTVL
  24 #include "crypto/libpcrypto.h"  // sha512hash
  25 #include "emv/dump.h"                   // dump_buffer
  26
  27 #define SC_UPGRADE_FILES_DIRECTORY          "sc_upgrade_firmware/"
  28
  29 static int CmdHelp(const char *Cmd);
  30
  31 static int usage_sm_raw(void) {
  32         PrintAndLogEx(NORMAL, "Usage: sc raw [h|r|c] d <0A 0B 0C ... hex>");
  33         PrintAndLogEx(NORMAL, "       h          :  this help");
  34         PrintAndLogEx(NORMAL, "       r          :  do not read response");
  35         PrintAndLogEx(NORMAL, "       a          :  active smartcard without select (reset sc module)");
  36         PrintAndLogEx(NORMAL, "       s          :  active smartcard with select (get ATR)");
  37         PrintAndLogEx(NORMAL, "       t          :  executes TLV decoder if it possible");
  38         PrintAndLogEx(NORMAL, "       0          :  use protocol T=0");
  39         PrintAndLogEx(NORMAL, "       d <bytes>  :  bytes to send");
  40         PrintAndLogEx(NORMAL, "");
  41         PrintAndLogEx(NORMAL, "Examples:");
  42         PrintAndLogEx(NORMAL, "        sc raw s 0 d 00a404000e315041592e5359532e4444463031  - `1PAY.SYS.DDF01` PPSE directory with get ATR");
  43         PrintAndLogEx(NORMAL, "        sc raw 0 d 00a404000e325041592e5359532e4444463031    - `2PAY.SYS.DDF01` PPSE directory");
  44         return 0;
  45 }
  46
  47 static int usage_sm_reader(void) {
  48         PrintAndLogEx(NORMAL, "Usage: sc reader [h|s]");
  49         PrintAndLogEx(NORMAL, "       h          :  this help");
  50         PrintAndLogEx(NORMAL, "       s          :  silent (no messages)");
  51         PrintAndLogEx(NORMAL, "");
  52         PrintAndLogEx(NORMAL, "Examples:");
  53         PrintAndLogEx(NORMAL, "        sc reader");
  54         return 0;
  55 }
  56
  57 static int usage_sm_info(void) {
  58         PrintAndLogEx(NORMAL, "Usage: s info [h|s]");
  59         PrintAndLogEx(NORMAL, "       h          :  this help");
  60         PrintAndLogEx(NORMAL, "       s          :  silent (no messages)");
  61         PrintAndLogEx(NORMAL, "");
  62         PrintAndLogEx(NORMAL, "Examples:");
  63         PrintAndLogEx(NORMAL, "        sc info");
  64         return 0;
  65 }
  66
  67 static int usage_sm_upgrade(void) {
  68         PrintAndLogEx(NORMAL, "Upgrade RDV4.0 Smartcard Socket Firmware");
  69         PrintAndLogEx(NORMAL, "Usage:  sc upgrade f <file name>");
  70         PrintAndLogEx(NORMAL, "       h               :  this help");
  71         PrintAndLogEx(NORMAL, "       f <filename>    :  firmware file name");
  72         PrintAndLogEx(NORMAL, "");
  73         PrintAndLogEx(NORMAL, "Examples:");
  74         PrintAndLogEx(NORMAL, "        sc upgrade f SIM010.BIN");
  75         return 0;
  76 }
  77
  78 static int usage_sm_setclock(void) {
  79         PrintAndLogEx(NORMAL, "Usage: sc setclock [h] c <clockspeed>");
  80         PrintAndLogEx(NORMAL, "       h          :  this help");
  81         PrintAndLogEx(NORMAL, "       c <>       :  clockspeed (0 = 16mhz, 1=8mhz, 2=4mhz) ");
  82         PrintAndLogEx(NORMAL, "");
  83         PrintAndLogEx(NORMAL, "Examples:");
  84         PrintAndLogEx(NORMAL, "        sc setclock c 2");
  85         return 0;
  86 }
  87
  88 static int usage_sm_brute(void) {
  89         PrintAndLogEx(NORMAL, "Tries to bruteforce SFI, ");
  90         PrintAndLogEx(NORMAL, "Usage: sc brute [h]");
  91         PrintAndLogEx(NORMAL, "       h          :  this help");
  92         PrintAndLogEx(NORMAL, "");
  93         PrintAndLogEx(NORMAL, "Examples:");
  94         PrintAndLogEx(NORMAL, "        sc brute");
  95         return 0;
  96 }
  97
  98 uint8_t GetATRTA1(uint8_t *atr, size_t atrlen) {
  99         if (atrlen > 2) {
 100                 uint8_t T0 = atr[1];
 101                 if (T0 & 0x10)
 102                         return atr[2];
 103         }
 104
 105         return 0x11; // default value is 0x11, corresponding to fmax=5 MHz, Fi=372, Di=1.
 106 }
 107
 108 int DiArray[] = {
 109         0,  // b0000 RFU
 110         1,  // b0001
 111         2,
 112         4,
 113         8,
 114         16,
 115         32,  // b0110
 116         64,  // b0111. This was RFU in ISO/IEC 7816-3:1997 and former. Some card readers or drivers may erroneously reject cards using this value
 117         12,
 118         20,
 119         0,   // b1010 RFU
 120         0,
 121         0,   // ...
 122         0,
 123         0,
 124         0    // b1111 RFU
 125 };
 126
 127 int FiArray[] = {
 128         372,    // b0000 Historical note: in ISO/IEC 7816-3:1989, this was assigned to cards with internal clock
 129         372,    // b0001
 130         558,    // b0010
 131         744,    // b0011
 132         1116,   // b0100
 133         1488,   // b0101
 134         1860,   // b0110
 135         0,      // b0111 RFU
 136         0,      // b1000 RFU
 137         512,    // b1001
 138         768,    // b1010
 139         1024,   // b1011
 140         1536,   // b1100
 141         2048,   // b1101
 142         0,      // b1110 RFU
 143         0       // b1111 RFU
 144 };
 145
 146 float FArray[] = {
 147         4,    // b0000 Historical note: in ISO/IEC 7816-3:1989, this was assigned to cards with internal clock
 148         5,    // b0001
 149         6,    // b0010
 150         8,    // b0011
 151         12,   // b0100
 152         16,   // b0101
 153         20,   // b0110
 154         0,    // b0111 RFU
 155         0,    // b1000 RFU
 156         5,    // b1001
 157         7.5,  // b1010
 158         10,   // b1011
 159         15,   // b1100
 160         20,   // b1101
 161         0,    // b1110 RFU
 162         0     // b1111 RFU
 163 };
 164
 165 int GetATRDi(uint8_t *atr, size_t atrlen) {
 166         uint8_t TA1 = GetATRTA1(atr, atrlen);
 167
 168         return DiArray[TA1 & 0x0f];  // The 4 low-order bits of TA1 (4th MSbit to 1st LSbit) encode Di
 169 }
 170
 171 int GetATRFi(uint8_t *atr, size_t atrlen) {
 172         uint8_t TA1 = GetATRTA1(atr, atrlen);
 173
 174         return FiArray[TA1 >> 4];  // The 4 high-order bits of TA1 (8th MSbit to 5th LSbit) encode fmax and Fi
 175 }
 176
 177 float GetATRF(uint8_t *atr, size_t atrlen) {
 178         uint8_t TA1 = GetATRTA1(atr, atrlen);
 179
 180         return FArray[TA1 >> 4];  // The 4 high-order bits of TA1 (8th MSbit to 5th LSbit) encode fmax and Fi
 181 }
 182
 183 static int PrintATR(uint8_t *atr, size_t atrlen) {
 184
 185         uint8_t T0 = atr[1];
 186         uint8_t K = T0 & 0x0F;
 187         uint8_t TD1 = 0, T1len = 0, TD1len = 0, TDilen = 0;
 188
 189         if (T0 & 0x10) {
 190                 PrintAndLog("\t- TA1 (Maximum clock frequency, proposed bit duration) [ 0x%02x ]", atr[2 + T1len]);
 191                 T1len++;
 192         }
 193
 194         if (T0 & 0x20) {
 195                 PrintAndLog("\t- TB1 (Deprecated: VPP requirements) [ 0x%02x ]", atr[2 + T1len]);
 196                 T1len++;
 197         }
 198
 199         if (T0 & 0x40) {
 200                 PrintAndLog("\t- TC1 (Extra delay between bytes required by card) [ 0x%02x ]", atr[2 + T1len]);
 201                 T1len++;
 202         }
 203
 204         if (T0 & 0x80) {
 205                 TD1 = atr[2 + T1len];
 206                 PrintAndLog("\t- TD1 (First offered transmission protocol, presence of TA2..TD2) [ 0x%02x ] Protocol T%d", TD1, TD1 & 0x0f);
 207                 T1len++;
 208
 209                 if (TD1 & 0x10) {
 210                         PrintAndLog("\t- TA2 (Specific protocol and parameters to be used after the ATR) [ 0x%02x ]", atr[2 + T1len + TD1len]);
 211                         TD1len++;
 212                 }
 213                 if (TD1 & 0x20) {
 214                         PrintAndLog("\t- TB2 (Deprecated: VPP precise voltage requirement) [ 0x%02x ]", atr[2 + T1len + TD1len]);
 215                         TD1len++;
 216                 }
 217                 if (TD1 & 0x40) {
 218                         PrintAndLog("\t- TC2 (Maximum waiting time for protocol T=0) [ 0x%02x ]", atr[2 + T1len + TD1len]);
 219                         TD1len++;
 220                 }
 221                 if (TD1 & 0x80) {
 222                         uint8_t TDi = atr[2 + T1len + TD1len];
 223                         PrintAndLog("\t- TD2 (A supported protocol or more global parameters, presence of TA3..TD3) [ 0x%02x ] Protocol T%d", TDi, TDi & 0x0f);
 224                         TD1len++;
 225
 226                         bool nextCycle = true;
 227                         uint8_t vi = 3;
 228                         while (nextCycle) {
 229                                 nextCycle = false;
 230                                 if (TDi & 0x10) {
 231                                         PrintAndLog("\t- TA%d: 0x%02x", vi, atr[2 + T1len + TD1len + TDilen]);
 232                                         TDilen++;
 233                                 }
 234                                 if (TDi & 0x20) {
 235                                         PrintAndLog("\t- TB%d: 0x%02x", vi, atr[2 + T1len + TD1len + TDilen]);
 236                                         TDilen++;
 237                                 }
 238                                 if (TDi & 0x40) {
 239                                         PrintAndLog("\t- TC%d: 0x%02x", vi, atr[2 + T1len + TD1len + TDilen]);
 240                                         TDilen++;
 241                                 }
 242                                 if (TDi & 0x80) {
 243                                         TDi = atr[2 + T1len + TD1len + TDilen];
 244                                         PrintAndLog("\t- TD%d [ 0x%02x ] Protocol T%d", vi, TDi, TDi & 0x0f);
 245                                         TDilen++;
 246
 247                                         nextCycle = true;
 248                                         vi++;
 249                                 }
 250                         }
 251                 }
 252         }
 253
 254         uint8_t vxor = 0;
 255         for (int i = 1; i < atrlen; i++)
 256                 vxor ^= atr[i];
 257
 258         if (vxor)
 259                 PrintAndLogEx(WARNING, "Check summ error. Must be 0 got 0x%02X", vxor);
 260         else
 261                 PrintAndLogEx(INFO, "Check summ OK.");
 262
 263         if (atr[0] != 0x3b)
 264                 PrintAndLogEx(WARNING, "Not a direct convention [ 0x%02x ]", atr[0]);
 265
 266
 267         uint8_t calen = 2 + T1len + TD1len + TDilen + K;
 268
 269         if (atrlen != calen && atrlen != calen + 1)  // may be CRC
 270                 PrintAndLogEx(ERR, "ATR length error. len: %d, T1len: %d, TD1len: %d, TDilen: %d, K: %d", atrlen, T1len, TD1len, TDilen, K);
 271
 272         if (K > 0)
 273                 PrintAndLogEx(INFO, "\nHistorical bytes | len 0x%02d | format %02x", K, atr[2 + T1len + TD1len + TDilen]);
 274
 275         if (K > 1) {
 276                 PrintAndLogEx(INFO, "\tHistorical bytes");
 277                 dump_buffer(&atr[2 + T1len + TD1len + TDilen], K, NULL, 1);
 278         }
 279
 280         return 0;
 281 }
 282
 283 static bool smart_select(bool silent) {
 284         UsbCommand c = {CMD_SMART_ATR, {0, 0, 0}};
 285         clearCommandBuffer();
 286         SendCommand(&c);
 287         UsbCommand resp;
 288         if ( !WaitForResponseTimeout(CMD_ACK, &resp, 2500) ) {
 289                 if (!silent) PrintAndLogEx(WARNING, "smart card select failed");
 290                 return false;
 291         }
 292
 293         uint8_t isok = resp.arg[0] & 0xFF;
 294         if (!isok) {
 295                 if (!silent) PrintAndLogEx(WARNING, "smart card select failed");
 296                 return false;
 297         }
 298
 299         if (!silent) {
 300                 smart_card_atr_t card;
 301                 memcpy(&card, (smart_card_atr_t *)resp.d.asBytes, sizeof(smart_card_atr_t));
 302
 303                 PrintAndLogEx(INFO, "ISO7816-3 ATR : %s", sprint_hex(card.atr, card.atr_len));
 304         }
 305
 306         return true;
 307 }
 308
 309 static int smart_wait(uint8_t *data) {
 310         UsbCommand resp;
 311         if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) {
 312                 PrintAndLogEx(WARNING, "smart card response timeout");
 313                 return -1;
 314         }
 315
 316         uint32_t len = resp.arg[0];
 317         if ( !len ) {
 318                 PrintAndLogEx(WARNING, "smart card response failed");
 319                 return -2;
 320         }
 321         memcpy(data, resp.d.asBytes, len);
 322         if (len >= 2) {
 323                 PrintAndLogEx(SUCCESS, "%02X%02X | %s", data[len - 2], data[len - 1], GetAPDUCodeDescription(data[len - 2], data[len - 1]));
 324         } else {
 325                 PrintAndLogEx(SUCCESS, " %d | %s", len, sprint_hex_inrow_ex(data,  len, 8));
 326         }
 327
 328         return len;
 329 }
 330
 331 static int smart_response(uint8_t *data) {
 332
 333         int datalen = smart_wait(data);
 334         bool needGetData = false;
 335
 336         if (datalen < 2 ) {
 337                 goto out;
 338         }
 339
 340         if ( data[datalen - 2] == 0x61 || data[datalen - 2] == 0x9F ) {
 341                 needGetData = true;
 342         }
 343
 344         if (needGetData) {
 345                 int len = data[datalen - 1];
 346                 PrintAndLogEx(INFO, "Requesting 0x%02X bytes response", len);
 347                 uint8_t getstatus[] = {0x00, ISO7816_GETSTATUS, 0x00, 0x00, len};
 348                 UsbCommand cStatus = {CMD_SMART_RAW, {SC_RAW, sizeof(getstatus), 0}};
 349                 memcpy(cStatus.d.asBytes, getstatus, sizeof(getstatus) );
 350                 clearCommandBuffer();
 351                 SendCommand(&cStatus);
 352
 353                 datalen = smart_wait(data);
 354
 355                 if (datalen < 2 ) {
 356                         goto out;
 357                 }
 358
 359                 // data wo ACK
 360                 if (datalen != len + 2) {
 361                         // data with ACK
 362                         if (datalen == len + 2 + 1) { // 2 - response, 1 - ACK
 363                                 if (data[0] != ISO7816_GETSTATUS) {
 364                                         PrintAndLogEx(ERR, "GetResponse ACK error. len 0x%x | data[0] %02X", len, data[0]);
 365                                         datalen = 0;
 366                                         goto out;
 367                                 }
 368
 369                                 datalen--;
 370                                 memmove(data, &data[1], datalen);
 371                         } else {
 372                                 // wrong length
 373                                 PrintAndLogEx(WARNING, "GetResponse wrong length. Must be 0x%02X got 0x%02X", len, datalen - 3);
 374                         }
 375                 }
 376         }
 377
 378         out:
 379         return datalen;
 380 }
 381
 382 int CmdSmartRaw(const char *Cmd) {
 383
 384         int hexlen = 0;
 385         bool active = false;
 386         bool active_select = false;
 387     bool useT0 = false;
 388         uint8_t cmdp = 0;
 389         bool errors = false, reply = true, decodeTLV = false, breakloop = false;
 390         uint8_t data[USB_CMD_DATA_SIZE] = {0x00};
 391
 392         while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
 393                 switch (tolower(param_getchar(Cmd, cmdp))) {
 394                 case 'h': return usage_sm_raw();
 395                 case 'r':
 396                         reply = false;
 397                         cmdp++;
 398                         break;
 399                 case 'a':
 400                         active = true;
 401                         cmdp++;
 402                         break;
 403                 case 's':
 404                         active_select = true;
 405                         cmdp++;
 406                         break;
 407                 case 't':
 408                         decodeTLV = true;
 409                         cmdp++;
 410                         break;
 411                 case '0':
 412                         useT0 = true;
 413                         cmdp++;
 414                         break;
 415                 case 'd': {
 416                         switch (param_gethex_to_eol(Cmd, cmdp+1, data, sizeof(data), &hexlen)) {
 417                         case 1:
 418                                 PrintAndLogEx(WARNING, "Invalid HEX value.");
 419                                 return 1;
 420                         case 2:
 421                                 PrintAndLogEx(WARNING, "Too many bytes.  Max %d bytes", sizeof(data));
 422                                 return 1;
 423                         case 3:
 424                                 PrintAndLogEx(WARNING, "Hex must have even number of digits.");
 425                                 return 1;
 426                         }
 427                         cmdp++;
 428                         breakloop = true;
 429                         break;
 430                 }
 431                 default:
 432                         PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
 433                         errors = true;
 434                         break;
 435                 }
 436
 437                 if ( breakloop )
 438                         break;
 439         }
 440
 441         //Validations
 442         if (errors || cmdp == 0 ) return usage_sm_raw();
 443
 444         // arg0 = RFU flags
 445         // arg1 = length
 446         UsbCommand c = {CMD_SMART_RAW, {0, hexlen, 0}};
 447
 448         if (active || active_select) {
 449                 c.arg[0] |= SC_CONNECT;
 450                 if (active_select)
 451                         c.arg[0] |= SC_SELECT;
 452         }
 453
 454         if (hexlen > 0) {
 455                 if (useT0)
 456                         c.arg[0] |= SC_RAW_T0;
 457                 else
 458                         c.arg[0] |= SC_RAW;
 459         }
 460
 461         memcpy(c.d.asBytes, data, hexlen );
 462         clearCommandBuffer();
 463         SendCommand(&c);
 464
 465         // reading response from smart card
 466         if ( reply ) {
 467
 468                 uint8_t* buf = calloc(USB_CMD_DATA_SIZE, sizeof(uint8_t));
 469                 if ( !buf )
 470                         return 1;
 471
 472                 int len = smart_response(buf);
 473                 if ( len < 0 ) {
 474                         free(buf);
 475                         return 2;
 476                 }
 477
 478                 if ( buf[0] == 0x6C ) {
 479                         data[4] = buf[1];
 480
 481                         memcpy(c.d.asBytes, data, sizeof(data) );
 482                         clearCommandBuffer();
 483                         SendCommand(&c);
 484                         len = smart_response(buf);
 485
 486                         data[4] = 0;
 487                 }
 488
 489                 if (decodeTLV && len > 4)
 490                         TLVPrintFromBuffer(buf, len-2);
 491
 492                 free(buf);
 493         }
 494         return 0;
 495 }
 496
 497 int ExchangeAPDUSC(uint8_t *datain, int datainlen, bool activateCard, bool leaveSignalON, uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
 498         *dataoutlen = 0;
 499
 500         if (activateCard)
 501                 smart_select(false);
 502
 503         PrintAndLogEx(DEBUG, "APDU SC");
 504
 505         UsbCommand c = {CMD_SMART_RAW, {SC_RAW_T0, datainlen, 0}};
 506         if (activateCard) {
 507                 c.arg[0] |= SC_SELECT | SC_CONNECT;
 508         }
 509         memcpy(c.d.asBytes, datain, datainlen);
 510         clearCommandBuffer();
 511         SendCommand(&c);
 512
 513         int len = smart_response(dataout);
 514
 515         if ( len < 0 ) {
 516                 return 2;
 517         }
 518
 519         // retry
 520         if (len > 1 && dataout[len - 2] == 0x6c && datainlen > 4) {
 521                 UsbCommand c2 = {CMD_SMART_RAW, {SC_RAW_T0, datainlen, 0}};
 522                 memcpy(c2.d.asBytes, datain, 5);
 523
 524                 // transfer length via T=0
 525                 c2.d.asBytes[4] = dataout[len - 1];
 526
 527                 clearCommandBuffer();
 528                 SendCommand(&c2);
 529
 530                 len = smart_response(dataout);
 531         }
 532         *dataoutlen = len;
 533
 534         return 0;
 535 }
 536
 537
 538 int CmdSmartUpgrade(const char *Cmd) {
 539
 540         PrintAndLogEx(NORMAL, "");
 541         PrintAndLogEx(WARNING, "WARNING - RDV4.0 Smartcard Socket Firmware upgrade.");
 542         PrintAndLogEx(WARNING, "A dangerous command, do wrong and you will brick the smart card socket");
 543         PrintAndLogEx(NORMAL, "");
 544
 545         FILE *f;
 546         char filename[FILE_PATH_SIZE] = {0};
 547         uint8_t cmdp = 0;
 548         bool errors = false;
 549
 550         while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
 551                 switch (tolower(param_getchar(Cmd, cmdp))) {
 552                 case 'f':
 553                         //File handling and reading
 554                         if ( param_getstr(Cmd, cmdp+1, filename, FILE_PATH_SIZE) >= FILE_PATH_SIZE ) {
 555                                 PrintAndLogEx(FAILED, "Filename too long");
 556                                 errors = true;
 557                                 break;
 558                         }
 559                         cmdp += 2;
 560                         break;
 561                 case 'h':
 562                         return usage_sm_upgrade();
 563                 default:
 564                         PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
 565                         errors = true;
 566                         break;
 567                 }
 568         }
 569
 570         //Validations
 571         if (errors || cmdp == 0 ) return usage_sm_upgrade();
 572
 573         if (strchr(filename, '\\') || strchr(filename, '/')) {
 574                 PrintAndLogEx(FAILED, "Filename must not contain \\ or /. Firmware file will be found in client/sc_upgrade_firmware directory.");
 575                 return 1;
 576         }
 577
 578         char sc_upgrade_file_path[strlen(get_my_executable_directory()) + strlen(SC_UPGRADE_FILES_DIRECTORY) + strlen(filename) + 1];
 579         strcpy(sc_upgrade_file_path, get_my_executable_directory());
 580         strcat(sc_upgrade_file_path, SC_UPGRADE_FILES_DIRECTORY);
 581         strcat(sc_upgrade_file_path, filename);
 582         if (strlen(sc_upgrade_file_path) >= FILE_PATH_SIZE ) {
 583                 PrintAndLogEx(FAILED, "Filename too long");
 584                 return 1;
 585         }
 586
 587         char sha512filename[FILE_PATH_SIZE];
 588         char *bin_extension = filename;
 589         char *dot_position = NULL;
 590         while ((dot_position = strchr(bin_extension, '.')) != NULL) {
 591                 bin_extension = dot_position + 1;
 592         }
 593         if (!strcmp(bin_extension, "BIN")
 594 #ifdef _WIN32
 595             || !strcmp(bin_extension, "bin")
 596 #endif
 597             ) {
 598                 strncpy(sha512filename, filename, strlen(filename) - strlen("bin"));
 599                 strcat(sha512filename, "sha512.txt");
 600         } else {
 601                 PrintAndLogEx(FAILED, "Filename extension of Firmware Upgrade File must be .BIN");
 602                 return 1;
 603         }
 604
 605         PrintAndLogEx(INFO, "Checking integrity using SHA512 File %s ...", sha512filename);
 606         char sc_upgrade_sha512file_path[strlen(get_my_executable_directory()) + strlen(SC_UPGRADE_FILES_DIRECTORY) + strlen(sha512filename) + 1];
 607         strcpy(sc_upgrade_sha512file_path, get_my_executable_directory());
 608         strcat(sc_upgrade_sha512file_path, SC_UPGRADE_FILES_DIRECTORY);
 609         strcat(sc_upgrade_sha512file_path, sha512filename);
 610         if (strlen(sc_upgrade_sha512file_path) >= FILE_PATH_SIZE ) {
 611                 PrintAndLogEx(FAILED, "Filename too long");
 612                 return 1;
 613         }
 614
 615         // load firmware file
 616         f = fopen(sc_upgrade_file_path, "rb");
 617         if ( !f ){
 618                 PrintAndLogEx(FAILED, "Firmware file not found or locked.");
 619                 return 1;
 620         }
 621
 622         // get filesize in order to malloc memory
 623         fseek(f, 0, SEEK_END);
 624         size_t fsize = ftell(f);
 625         fseek(f, 0, SEEK_SET);
 626
 627         if (fsize < 0)  {
 628                 PrintAndLogEx(FAILED, "Could not determine size of firmware file");
 629                 fclose(f);
 630                 return 1;
 631         }
 632
 633         uint8_t *dump = calloc(fsize, sizeof(uint8_t));
 634         if (!dump) {
 635                 PrintAndLogEx(FAILED, "Could not allocate memory for firmware");
 636                 fclose(f);
 637                 return 1;
 638         }
 639
 640         size_t firmware_size = fread(dump, 1, fsize, f);
 641         if (f)
 642                 fclose(f);
 643
 644         // load sha512 file
 645         f = fopen(sc_upgrade_sha512file_path, "rb");
 646         if ( !f ){
 647                 PrintAndLogEx(FAILED, "SHA-512 file not found or locked.");
 648                 return 1;
 649         }
 650
 651         // get filesize in order to malloc memory
 652         fseek(f, 0, SEEK_END);
 653         fsize = ftell(f);
 654         fseek(f, 0, SEEK_SET);
 655
 656         if (fsize < 0)  {
 657                 PrintAndLogEx(FAILED, "Could not determine size of SHA-512 file");
 658                 fclose(f);
 659                 return 1;
 660         }
 661
 662         if (fsize < 128) {
 663                 PrintAndLogEx(FAILED, "SHA-512 file too short");
 664                 fclose(f);
 665                 return 1;
 666         }
 667
 668         char hashstring[129];
 669         size_t bytes_read = fread(hashstring, 1, 128, f);
 670         hashstring[128] = '\0';
 671
 672         if (f)
 673                 fclose(f);
 674
 675         uint8_t hash1[64];
 676         if (bytes_read != 128 || param_gethex(hashstring, 0, hash1, 128)) {
 677                 PrintAndLogEx(FAILED, "Couldn't read SHA-512 file");
 678                 return 1;
 679         }
 680
 681         uint8_t hash2[64];
 682         if (sha512hash(dump, firmware_size, hash2)) {
 683                 PrintAndLogEx(FAILED, "Couldn't calculate SHA-512 of Firmware");
 684                 return 1;
 685         }
 686
 687         if (memcmp(hash1, hash2, 64)) {
 688                 PrintAndLogEx(FAILED, "Couldn't verify integrity of Firmware file (wrong SHA-512)");
 689                 return 1;
 690         }
 691
 692         PrintAndLogEx(SUCCESS, "RDV4.0 Smartcard Socket Firmware uploading to PM3");
 693
 694         //Send to device
 695         uint32_t index = 0;
 696         uint32_t bytes_sent = 0;
 697         uint32_t bytes_remaining = firmware_size;
 698
 699         while (bytes_remaining > 0){
 700                 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
 701                 UsbCommand c = {CMD_SMART_UPLOAD, {index + bytes_sent, bytes_in_packet, 0}};
 702
 703                 // Fill usb bytes with 0xFF
 704                 memset(c.d.asBytes, 0xFF, USB_CMD_DATA_SIZE);
 705                 memcpy(c.d.asBytes, dump + bytes_sent, bytes_in_packet);
 706                 clearCommandBuffer();
 707                 SendCommand(&c);
 708                 if ( !WaitForResponseTimeout(CMD_ACK, NULL, 2000) ) {
 709                         PrintAndLogEx(WARNING, "timeout while waiting for reply.");
 710                         free(dump);
 711                         return 1;
 712                 }
 713
 714                 bytes_remaining -= bytes_in_packet;
 715                 bytes_sent += bytes_in_packet;
 716                 printf("."); fflush(stdout);
 717         }
 718         free(dump);
 719         printf("\n");
 720         PrintAndLogEx(SUCCESS, "RDV4.0 Smartcard Socket Firmware updating,  don\'t turn off your PM3!");
 721
 722         // trigger the firmware upgrade
 723         UsbCommand c = {CMD_SMART_UPGRADE, {firmware_size, 0, 0}};
 724         clearCommandBuffer();
 725         SendCommand(&c);
 726         UsbCommand resp;
 727         if ( !WaitForResponseTimeout(CMD_ACK, &resp, 2500) ) {
 728                 PrintAndLogEx(WARNING, "timeout while waiting for reply.");
 729                 return 1;
 730         }
 731         if ( (resp.arg[0] & 0xFF ) )
 732                 PrintAndLogEx(SUCCESS, "RDV4.0 Smartcard Socket Firmware upgraded successful");
 733         else
 734                 PrintAndLogEx(FAILED, "RDV4.0 Smartcard Socket Firmware Upgrade failed");
 735         return 0;
 736 }
 737
 738 int CmdSmartInfo(const char *Cmd){
 739         uint8_t cmdp = 0;
 740         bool errors = false, silent = false;
 741
 742         while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
 743                 switch (tolower(param_getchar(Cmd, cmdp))) {
 744                 case 'h': return usage_sm_info();
 745                 case 's':
 746                         silent = true;
 747                         break;
 748                 default:
 749                         PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
 750                         errors = true;
 751                         break;
 752                 }
 753                 cmdp++;
 754         }
 755
 756         //Validations
 757         if (errors ) return usage_sm_info();
 758
 759         UsbCommand c = {CMD_SMART_ATR, {0, 0, 0}};
 760         clearCommandBuffer();
 761         SendCommand(&c);
 762         UsbCommand resp;
 763         if ( !WaitForResponseTimeout(CMD_ACK, &resp, 2500) ) {
 764                 if (!silent) PrintAndLogEx(WARNING, "smart card select failed");
 765                 return 1;
 766         }
 767
 768         uint8_t isok = resp.arg[0] & 0xFF;
 769         if (!isok) {
 770                 if (!silent) PrintAndLogEx(WARNING, "smart card select failed");
 771                 return 1;
 772         }
 773
 774         smart_card_atr_t card;
 775         memcpy(&card, (smart_card_atr_t *)resp.d.asBytes, sizeof(smart_card_atr_t));
 776
 777         // print header
 778         PrintAndLogEx(INFO, "--- Smartcard Information ---------");
 779         PrintAndLogEx(INFO, "-------------------------------------------------------------");
 780         PrintAndLogEx(INFO, "ISO7618-3 ATR : %s", sprint_hex(card.atr, card.atr_len));
 781         PrintAndLogEx(INFO, "\nhttp://smartcard-atr.appspot.com/parse?ATR=%s", sprint_hex_inrow(card.atr, card.atr_len) );
 782
 783         // print ATR
 784         PrintAndLogEx(NORMAL, "");
 785         PrintAndLogEx(INFO, "ATR");
 786         PrintATR(card.atr, card.atr_len);
 787
 788         // print D/F (brom byte TA1 or defaults)
 789         PrintAndLogEx(NORMAL, "");
 790         PrintAndLogEx(INFO, "D/F (TA1)");
 791         int Di = GetATRDi(card.atr, card.atr_len);
 792         int Fi = GetATRFi(card.atr, card.atr_len);
 793         float F = GetATRF(card.atr, card.atr_len);
 794         if (GetATRTA1(card.atr, card.atr_len) == 0x11)
 795                 PrintAndLogEx(INFO, "Using default values...");
 796
 797         PrintAndLogEx(NORMAL, "\t- Di=%d", Di);
 798         PrintAndLogEx(NORMAL, "\t- Fi=%d", Fi);
 799         PrintAndLogEx(NORMAL, "\t- F=%.1f MHz", F);
 800
 801         if (Di && Fi) {
 802                 PrintAndLogEx(NORMAL, "\t- Cycles/ETU=%d", Fi/Di);
 803                 PrintAndLogEx(NORMAL, "\t- %.1f bits/sec at 4MHz", (float)4000000 / (Fi/Di));
 804                 PrintAndLogEx(NORMAL, "\t- %.1f bits/sec at Fmax=%.1fMHz", (F * 1000000) / (Fi/Di), F);
 805         } else {
 806                 PrintAndLogEx(WARNING, "\t- Di or Fi is RFU.");
 807         };
 808
 809         return 0;
 810 }
 811
 812 int CmdSmartReader(const char *Cmd){
 813         uint8_t cmdp = 0;
 814         bool errors = false, silent = false;
 815
 816         while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
 817                 switch (tolower(param_getchar(Cmd, cmdp))) {
 818                 case 'h': return usage_sm_reader();
 819                 case 's':
 820                         silent = true;
 821                         break;
 822                 default:
 823                         PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
 824                         errors = true;
 825                         break;
 826                 }
 827                 cmdp++;
 828         }
 829
 830         //Validations
 831         if (errors ) return usage_sm_reader();
 832
 833         UsbCommand c = {CMD_SMART_ATR, {0, 0, 0}};
 834         clearCommandBuffer();
 835         SendCommand(&c);
 836         UsbCommand resp;
 837         if ( !WaitForResponseTimeout(CMD_ACK, &resp, 2500) ) {
 838                 if (!silent) PrintAndLogEx(WARNING, "smart card select failed");
 839                 return 1;
 840         }
 841
 842         uint8_t isok = resp.arg[0] & 0xFF;
 843         if (!isok) {
 844                 if (!silent) PrintAndLogEx(WARNING, "smart card select failed");
 845                 return 1;
 846         }
 847         smart_card_atr_t card;
 848         memcpy(&card, (smart_card_atr_t *)resp.d.asBytes, sizeof(smart_card_atr_t));
 849
 850         PrintAndLogEx(INFO, "ISO7816-3 ATR : %s", sprint_hex(card.atr, card.atr_len));
 851         return 0;
 852 }
 853
 854 int CmdSmartSetClock(const char *Cmd){
 855         uint8_t cmdp = 0;
 856         bool errors = false;
 857         uint8_t clock = 0;
 858         while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
 859                 switch (tolower(param_getchar(Cmd, cmdp))) {
 860                 case 'h': return usage_sm_setclock();
 861                 case 'c':
 862                         clock = param_get8ex(Cmd, cmdp+1, 2, 10);
 863                         if ( clock > 2)
 864                                 errors = true;
 865
 866                         cmdp += 2;
 867                         break;
 868                 default:
 869                         PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
 870                         errors = true;
 871                         break;
 872                 }
 873         }
 874
 875         //Validations
 876         if (errors || cmdp == 0) return usage_sm_setclock();
 877
 878         UsbCommand c = {CMD_SMART_SETCLOCK, {clock, 0, 0}};
 879         clearCommandBuffer();
 880         SendCommand(&c);
 881         UsbCommand resp;
 882         if ( !WaitForResponseTimeout(CMD_ACK, &resp, 2500) ) {
 883                 PrintAndLogEx(WARNING, "smart card select failed");
 884                 return 1;
 885         }
 886
 887         uint8_t isok = resp.arg[0] & 0xFF;
 888         if (!isok) {
 889                 PrintAndLogEx(WARNING, "smart card set clock failed");
 890                 return 1;
 891         }
 892
 893         switch (clock) {
 894                 case 0:
 895                         PrintAndLogEx(SUCCESS, "Clock changed to 16mhz giving 10800 baudrate");
 896                         break;
 897                 case 1:
 898                         PrintAndLogEx(SUCCESS, "Clock changed to 8mhz giving 21600 baudrate");
 899                         break;
 900                 case 2:
 901                         PrintAndLogEx(SUCCESS, "Clock changed to 4mhz giving 86400 baudrate");
 902                         break;
 903                 default:
 904                         break;
 905         }
 906         return 0;
 907 }
 908
 909 int CmdSmartList(const char *Cmd) {
 910         CmdHFList("7816");
 911         return 0;
 912 }
 913
 914 int CmdSmartBruteforceSFI(const char *Cmd) {
 915
 916         char ctmp = tolower(param_getchar(Cmd, 0));
 917         if (ctmp == 'h') return usage_sm_brute();
 918
 919         uint8_t data[5] = {0x00, 0xB2, 0x00, 0x00, 0x00};
 920
 921         PrintAndLogEx(INFO, "Selecting card");
 922         if ( !smart_select(false) ) {
 923                 return 1;
 924         }
 925
 926         PrintAndLogEx(INFO, "Selecting PPSE aid");
 927         CmdSmartRaw("s 0 t d 00a404000e325041592e5359532e4444463031");
 928         CmdSmartRaw("0 t d 00a4040007a000000004101000");  // mastercard
 929 //      CmdSmartRaw("0 t d 00a4040007a0000000031010"); // visa
 930
 931         PrintAndLogEx(INFO, "starting");
 932
 933         UsbCommand c = {CMD_SMART_RAW, {SC_RAW, sizeof(data), 0}};
 934         uint8_t* buf = malloc(USB_CMD_DATA_SIZE);
 935         if ( !buf )
 936                 return 1;
 937
 938         for (uint8_t i=1; i < 4; i++) {
 939                 for (int p1=1; p1 < 5; p1++) {
 940
 941                         data[2] = p1;
 942                         data[3] = (i << 3) + 4;
 943
 944                         memcpy(c.d.asBytes, data, sizeof(data) );
 945                         clearCommandBuffer();
 946                         SendCommand(&c);
 947
 948                         smart_response(buf);
 949
 950                         if ( buf[0] == 0x6C ) {
 951                                 data[4] = buf[1];
 952
 953                                 memcpy(c.d.asBytes, data, sizeof(data) );
 954                                 clearCommandBuffer();
 955                                 SendCommand(&c);
 956                                 uint8_t len = smart_response(buf);
 957
 958                                 // TLV decoder
 959                                 if (len > 4)
 960                                         TLVPrintFromBuffer(buf+1, len-3);
 961
 962                                 data[4] = 0;
 963                         }
 964                         memset(buf, 0x00, USB_CMD_DATA_SIZE);
 965                 }
 966         }
 967         free(buf);
 968         return 0;
 969 }
 970
 971 static command_t CommandTable[] = {
 972         {"help",     CmdHelp,               1, "This help"},
 973         {"list",     CmdSmartList,          0, "List ISO 7816 history"},
 974         {"info",     CmdSmartInfo,          0, "Tag information"},
 975         {"reader",   CmdSmartReader,        0, "Act like an IS07816 reader"},
 976         {"raw",      CmdSmartRaw,           0, "Send raw hex data to tag"},
 977         {"upgrade",  CmdSmartUpgrade,       0, "Upgrade firmware"},
 978         {"setclock", CmdSmartSetClock,      0, "Set clock speed"},
 979         {"brute",    CmdSmartBruteforceSFI, 0, "Bruteforce SFI"},
 980         {NULL,       NULL,                  0, NULL}
 981 };
 982
 983 int CmdSmartcard(const char *Cmd) {
 984         clearCommandBuffer();
 985         CmdsParse(CommandTable, Cmd);
 986         return 0;
 987 }
 988
 989 int CmdHelp(const char *Cmd) {
 990         CmdsHelp(CommandTable);
 991         return 0;
 992 }