]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhficlass.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
document iclass additions
[proxmark3-svn] / client / cmdhficlass.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3 // Copyright (C) 2011 Gerhard de Koning Gans
4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // High frequency iClass commands
11 //-----------------------------------------------------------------------------
12
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <sys/stat.h>
17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18 #include "data.h"
19 #include "proxmark3.h"
20 #include "ui.h"
21 #include "cmdparser.h"
22 #include "cmdhficlass.h"
23 #include "common.h"
24 #include "util.h"
25 #include "cmdmain.h"
26 #include "loclass/des.h"
27 #include "loclass/cipherutils.h"
28 #include "loclass/cipher.h"
29 #include "loclass/ikeys.h"
30 #include "loclass/elite_crack.h"
31 #include "loclass/fileutils.h"
32 #include "protocols.h"
33 #include "usb_cmd.h"
34 #include "cmdhfmfu.h"
35
36 #define llX PRIx64
37
38 static int CmdHelp(const char *Cmd);
39
40 #define ICLASS_KEYS_MAX 8
41 static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
49 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
50 };
51
52 typedef struct iclass_block {
53 uint8_t d[8];
54 } iclass_block_t;
55
56 int xorbits_8(uint8_t val) {
57 uint8_t res = val ^ (val >> 1); //1st pass
58 res = res ^ (res >> 1); // 2nd pass
59 res = res ^ (res >> 2); // 3rd pass
60 res = res ^ (res >> 4); // 4th pass
61 return res & 1;
62 }
63
64 int CmdHFiClassList(const char *Cmd) {
65 PrintAndLog("Deprecated command, use 'hf list iclass' instead");
66 return 0;
67 }
68
69 int CmdHFiClassSnoop(const char *Cmd) {
70 UsbCommand c = {CMD_SNOOP_ICLASS};
71 SendCommand(&c);
72 return 0;
73 }
74
75 int usage_hf_iclass_sim(void) {
76 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
77 PrintAndLog(" options");
78 PrintAndLog(" 0 <CSN> simulate the given CSN");
79 PrintAndLog(" 1 simulate default CSN");
80 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
81 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
82 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
83 PrintAndLog(" example: hf iclass sim 2");
84 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
85 PrintAndLog(" hf iclass sim 3");
86 return 0;
87 }
88
89 #define NUM_CSNS 15
90 int CmdHFiClassSim(const char *Cmd) {
91 uint8_t simType = 0;
92 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
93
94 if (strlen(Cmd)<1) {
95 return usage_hf_iclass_sim();
96 }
97 simType = param_get8ex(Cmd, 0, 0, 10);
98
99 if(simType == 0)
100 {
101 if (param_gethex(Cmd, 1, CSN, 16)) {
102 PrintAndLog("A CSN should consist of 16 HEX symbols");
103 return usage_hf_iclass_sim();
104 }
105
106 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
107 }
108 if(simType > 3)
109 {
110 PrintAndLog("Undefined simptype %d", simType);
111 return usage_hf_iclass_sim();
112 }
113
114 uint8_t numberOfCSNs=0;
115 if(simType == 2)
116 {
117 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
118 UsbCommand resp = {0};
119
120 uint8_t csns[8*NUM_CSNS] = {
121 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
136
137 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
138
139 SendCommand(&c);
140 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
141 PrintAndLog("Command timed out");
142 return 0;
143 }
144
145 uint8_t num_mac_responses = resp.arg[1];
146 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
147
148 size_t datalen = NUM_CSNS*24;
149 /*
150 * Now, time to dump to file. We'll use this format:
151 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
152 * So, it should wind up as
153 * 8 * 24 bytes.
154 *
155 * The returndata from the pm3 is on the following format
156 * <4 byte NR><4 byte MAC>
157 * CC are all zeroes, CSN is the same as was sent in
158 **/
159 void* dump = malloc(datalen);
160 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
161 uint8_t i = 0;
162 for(i = 0 ; i < NUM_CSNS ; i++)
163 {
164 memcpy(dump+i*24, csns+i*8,8); //CSN
165 //8 zero bytes here...
166 //Then comes NR_MAC (eight bytes from the response)
167 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
168
169 }
170 /** Now, save to dumpfile **/
171 saveFile("iclass_mac_attack", "bin", dump,datalen);
172 free(dump);
173 }else
174 {
175 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
176 memcpy(c.d.asBytes, CSN, 8);
177 SendCommand(&c);
178 }
179
180 return 0;
181 }
182
183 int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
184 bool tagFound = false;
185 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
186 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
187 // loop in client not device - else on windows have a communication error
188 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
189 UsbCommand resp;
190 while(!ukbhit()){
191 SendCommand(&c);
192 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
193 uint8_t readStatus = resp.arg[0] & 0xff;
194 uint8_t *data = resp.d.asBytes;
195
196 if (verbose)
197 PrintAndLog("Readstatus:%02x", readStatus);
198 if( readStatus == 0){
199 //Aborted
200 if (verbose) PrintAndLog("Quitting...");
201 return 0;
202 }
203 if( readStatus & FLAG_ICLASS_READER_CSN){
204 PrintAndLog("CSN: %s",sprint_hex(data,8));
205 tagFound = true;
206 }
207 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
208 if( readStatus & FLAG_ICLASS_READER_CONF){
209 printIclassDumpInfo(data);
210 }
211 if (tagFound && !loop) return 1;
212 } else {
213 if (verbose) PrintAndLog("Command execute timeout");
214 }
215 if (!loop) break;
216 }
217 return 0;
218 }
219
220 int CmdHFiClassReader(const char *Cmd) {
221 return HFiClassReader(Cmd, true, true);
222 }
223
224 int CmdHFiClassReader_Replay(const char *Cmd) {
225 uint8_t readerType = 0;
226 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
227
228 if (strlen(Cmd)<1) {
229 PrintAndLog("Usage: hf iclass replay <MAC>");
230 PrintAndLog(" sample: hf iclass replay 00112233");
231 return 0;
232 }
233
234 if (param_gethex(Cmd, 0, MAC, 8)) {
235 PrintAndLog("MAC must include 8 HEX symbols");
236 return 1;
237 }
238
239 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
240 memcpy(c.d.asBytes, MAC, 4);
241 SendCommand(&c);
242
243 return 0;
244 }
245
246 int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
247 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
248 memcpy(c.d.asBytes, data, blocksCount * 16);
249 SendCommand(&c);
250 return 0;
251 }
252
253 int hf_iclass_eload_usage(void) {
254 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
255 PrintAndLog("Usage: hf iclass eload f <filename>");
256 PrintAndLog("");
257 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
258 return 0;
259 }
260
261 int CmdHFiClassELoad(const char *Cmd) {
262
263 char opt = param_getchar(Cmd, 0);
264 if (strlen(Cmd)<1 || opt == 'h')
265 return hf_iclass_eload_usage();
266
267 //File handling and reading
268 FILE *f;
269 char filename[FILE_PATH_SIZE];
270 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
271 {
272 f = fopen(filename, "rb");
273 }else{
274 return hf_iclass_eload_usage();
275 }
276
277 if(!f) {
278 PrintAndLog("Failed to read from file '%s'", filename);
279 return 1;
280 }
281
282 fseek(f, 0, SEEK_END);
283 long fsize = ftell(f);
284 fseek(f, 0, SEEK_SET);
285
286 uint8_t *dump = malloc(fsize);
287
288
289 size_t bytes_read = fread(dump, 1, fsize, f);
290 fclose(f);
291
292 printIclassDumpInfo(dump);
293 //Validate
294
295 if (bytes_read < fsize)
296 {
297 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
298 free(dump);
299 return 1;
300 }
301 //Send to device
302 uint32_t bytes_sent = 0;
303 uint32_t bytes_remaining = bytes_read;
304
305 while(bytes_remaining > 0){
306 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
307 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
308 memcpy(c.d.asBytes, dump, bytes_in_packet);
309 SendCommand(&c);
310 bytes_remaining -= bytes_in_packet;
311 bytes_sent += bytes_in_packet;
312 }
313 free(dump);
314 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
315 return 0;
316 }
317
318 static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
319 FILE *f = fopen(filename, "rb");
320 if(!f) {
321 PrintAndLog("Failed to read from file '%s'", filename);
322 return 1;
323 }
324 fseek(f, 0, SEEK_END);
325 long fsize = ftell(f);
326 fseek(f, 0, SEEK_SET);
327 size_t bytes_read = fread(buffer, 1, len, f);
328 fclose(f);
329 if(fsize != len)
330 {
331 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
332 return 1;
333 }
334 if(bytes_read != len)
335 {
336 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
337 return 1;
338 }
339 return 0;
340 }
341
342 int usage_hf_iclass_decrypt(void) {
343 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
344 PrintAndLog("");
345 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
346 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
347 PrintAndLog("");
348 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
349 PrintAndLog("");
350 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
351 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
352 PrintAndLog("which is defined by the configuration block.");
353 return 1;
354 }
355
356 int CmdHFiClassDecrypt(const char *Cmd) {
357 uint8_t key[16] = { 0 };
358 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
359 {
360 usage_hf_iclass_decrypt();
361 return 1;
362 }
363 PrintAndLog("Decryption file found... ");
364 char opt = param_getchar(Cmd, 0);
365 if (strlen(Cmd)<1 || opt == 'h')
366 return usage_hf_iclass_decrypt();
367
368 //Open the tagdump-file
369 FILE *f;
370 char filename[FILE_PATH_SIZE];
371 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
372 {
373 f = fopen(filename, "rb");
374 }else{
375 return usage_hf_iclass_decrypt();
376 }
377
378 fseek(f, 0, SEEK_END);
379 long fsize = ftell(f);
380 fseek(f, 0, SEEK_SET);
381 uint8_t enc_dump[8] = {0};
382 uint8_t *decrypted = malloc(fsize);
383 des3_context ctx = { DES_DECRYPT ,{ 0 } };
384 des3_set2key_dec( &ctx, key);
385 size_t bytes_read = fread(enc_dump, 1, 8, f);
386
387 //Use the first block (CSN) for filename
388 char outfilename[FILE_PATH_SIZE] = { 0 };
389 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
390 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
391 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
392
393 size_t blocknum =0;
394 while(bytes_read == 8)
395 {
396 if(blocknum < 7)
397 {
398 memcpy(decrypted+(blocknum*8), enc_dump, 8);
399 }else{
400 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
401 }
402 printvar("decrypted block", decrypted +(blocknum*8), 8);
403 bytes_read = fread(enc_dump, 1, 8, f);
404 blocknum++;
405 }
406 fclose(f);
407
408 saveFile(outfilename,"bin", decrypted, blocknum*8);
409
410 return 0;
411 }
412
413 int usage_hf_iclass_encrypt(void) {
414 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
415 PrintAndLog("");
416 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
417 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
418 PrintAndLog("");
419 PrintAndLog("example: hf iclass encrypt 0102030405060708");
420 PrintAndLog("");
421 return 0;
422 }
423
424 static int iClassEncryptBlkData(uint8_t *blkData) {
425 uint8_t key[16] = { 0 };
426 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
427 {
428 usage_hf_iclass_encrypt();
429 return 1;
430 }
431 PrintAndLog("Decryption file found... ");
432
433 uint8_t encryptedData[16];
434 uint8_t *encrypted = encryptedData;
435 des3_context ctx = { DES_DECRYPT ,{ 0 } };
436 des3_set2key_enc( &ctx, key);
437
438 des3_crypt_ecb(&ctx, blkData,encrypted);
439 //printvar("decrypted block", decrypted, 8);
440 memcpy(blkData,encrypted,8);
441
442 return 1;
443 }
444
445 int CmdHFiClassEncryptBlk(const char *Cmd) {
446 uint8_t blkData[8] = {0};
447 char opt = param_getchar(Cmd, 0);
448 if (strlen(Cmd)<1 || opt == 'h')
449 return usage_hf_iclass_encrypt();
450
451 //get the bytes to encrypt
452 if (param_gethex(Cmd, 0, blkData, 16))
453 {
454 PrintAndLog("BlockData must include 16 HEX symbols");
455 return 0;
456 }
457 if (!iClassEncryptBlkData(blkData)) return 0;
458
459 printvar("encrypted block", blkData, 8);
460 return 1;
461 }
462
463 void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
464 uint8_t WB[9];
465 WB[0] = blockno;
466 memcpy(WB + 1,data,8);
467 doMAC_N(WB,sizeof(WB),div_key,MAC);
468 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
469 }
470
471 static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
472 UsbCommand resp;
473
474 UsbCommand c = {CMD_READER_ICLASS, {0}};
475 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
476 if (use_credit_key)
477 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
478
479 clearCommandBuffer();
480 SendCommand(&c);
481 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
482 {
483 PrintAndLog("Command execute timeout");
484 return false;
485 }
486
487 uint8_t isOK = resp.arg[0] & 0xff;
488 uint8_t *data = resp.d.asBytes;
489
490 memcpy(CSN,data,8);
491 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
492 if(isOK > 0)
493 {
494 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
495 }
496 if(isOK <= 1){
497 PrintAndLog("Failed to obtain CC! Aborting");
498 return false;
499 }
500 return true;
501 }
502
503 static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool verbose) {
504 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
505 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
506
507 if (!select_only(CSN, CCNR, use_credit_key, verbose))
508 return false;
509
510 //get div_key
511 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
512
513 doMAC(CCNR, div_key, MAC);
514 UsbCommand resp;
515 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
516 memcpy(d.d.asBytes, MAC, 4);
517 clearCommandBuffer();
518 SendCommand(&d);
519 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
520 {
521 PrintAndLog("Auth Command execute timeout");
522 return false;
523 }
524 uint8_t isOK = resp.arg[0] & 0xff;
525 if (!isOK) {
526 PrintAndLog("Authentication error");
527 return false;
528 }
529 return true;
530 }
531
532 int usage_hf_iclass_dump(void) {
533 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e\n");
534 PrintAndLog("Options:");
535 PrintAndLog(" f <filename> : specify a filename to save dump to");
536 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
537 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
538 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
539 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
540 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
541 PrintAndLog(" NOTE: * = required");
542 PrintAndLog("Samples:");
543 PrintAndLog(" hf iclass dump k 001122334455667B");
544 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
545 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
546 return 0;
547 }
548
549 int CmdHFiClassReader_Dump(const char *Cmd) {
550
551 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
552 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
553 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
554 uint8_t blockno = 0;
555 uint8_t numblks = 0;
556 uint8_t maxBlk = 31;
557 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
558 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
559 uint8_t keyNbr = 0;
560 uint8_t dataLen = 0;
561 uint8_t fileNameLen = 0;
562 char filename[FILE_PATH_SIZE]={0};
563 char tempStr[50] = {0};
564 bool have_debit_key = false;
565 bool have_credit_key = false;
566 bool use_credit_key = false;
567 bool elite = false;
568 bool errors = false;
569 uint8_t cmdp = 0;
570
571 while(param_getchar(Cmd, cmdp) != 0x00)
572 {
573 switch(param_getchar(Cmd, cmdp))
574 {
575 case 'h':
576 case 'H':
577 return usage_hf_iclass_dump();
578 case 'c':
579 case 'C':
580 have_credit_key = true;
581 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
582 if (dataLen == 16) {
583 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
584 } else if (dataLen == 1) {
585 keyNbr = param_get8(Cmd, cmdp+1);
586 if (keyNbr <= ICLASS_KEYS_MAX) {
587 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
588 } else {
589 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
590 errors = true;
591 }
592 } else {
593 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
594 errors = true;
595 }
596 cmdp += 2;
597 break;
598 case 'e':
599 case 'E':
600 elite = true;
601 cmdp++;
602 break;
603 case 'f':
604 case 'F':
605 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
606 if (fileNameLen < 1) {
607 PrintAndLog("No filename found after f");
608 errors = true;
609 }
610 cmdp += 2;
611 break;
612 case 'k':
613 case 'K':
614 have_debit_key = true;
615 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
616 if (dataLen == 16) {
617 errors = param_gethex(tempStr, 0, KEY, dataLen);
618 } else if (dataLen == 1) {
619 keyNbr = param_get8(Cmd, cmdp+1);
620 if (keyNbr <= ICLASS_KEYS_MAX) {
621 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
622 } else {
623 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
624 errors = true;
625 }
626 } else {
627 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
628 errors = true;
629 }
630 cmdp += 2;
631 break;
632 default:
633 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
634 errors = true;
635 break;
636 }
637 if(errors) return usage_hf_iclass_dump();
638 }
639
640 if (cmdp < 2) return usage_hf_iclass_dump();
641 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
642 if (!have_debit_key && have_credit_key) use_credit_key = true;
643
644 //get config and first 3 blocks
645 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
646 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
647 UsbCommand resp;
648 uint8_t tag_data[255*8];
649
650 clearCommandBuffer();
651 SendCommand(&c);
652 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
653 PrintAndLog("Command execute timeout");
654 ul_switch_off_field();
655 return 0;
656 }
657 uint8_t readStatus = resp.arg[0] & 0xff;
658 uint8_t *data = resp.d.asBytes;
659
660 if(readStatus == 0){
661 PrintAndLog("No tag found...");
662 ul_switch_off_field();
663 return 0;
664 }
665 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
666 memcpy(tag_data, data, 8*3);
667 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
668 numblks = data[8];
669
670 if (data[13] & 0x80) {
671 // large memory - not able to dump pages currently
672 maxBlk = 255;
673 } else {
674 maxBlk = 31;
675 }
676 if (numblks > maxBlk) numblks = maxBlk;
677 }
678 ul_switch_off_field();
679 // authenticate debit key and get div_key - later store in dump block 3
680 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
681 //try twice - for some reason it sometimes fails the first time...
682 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
683 ul_switch_off_field();
684 return 0;
685 }
686 }
687
688 // begin dump
689 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
690 clearCommandBuffer();
691 SendCommand(&w);
692 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
693 PrintAndLog("Command execute time-out 1");
694 ul_switch_off_field();
695 return 1;
696 }
697 uint32_t blocksRead = resp.arg[1];
698 uint8_t isOK = resp.arg[0] & 0xff;
699 if (!isOK && !blocksRead) {
700 PrintAndLog("Read Block Failed");
701 ul_switch_off_field();
702 return 0;
703 }
704 uint32_t startindex = resp.arg[2];
705 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
706 PrintAndLog("Data exceeded Buffer size!");
707 blocksRead = (sizeof(tag_data)/8) - blockno;
708 }
709 // response ok - now get bigbuf content of the dump
710 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
711 WaitForResponse(CMD_ACK,NULL);
712 size_t gotBytes = blocksRead*8 + blockno*8;
713
714 // try AA2
715 if (have_credit_key) {
716 //turn off hf field before authenticating with different key
717 ul_switch_off_field();
718 memset(MAC,0,4);
719 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
720 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
721 //try twice - for some reason it sometimes fails the first time...
722 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
723 ul_switch_off_field();
724 return 0;
725 }
726 }
727 // do we still need to read more block? (aa2 enabled?)
728 if (maxBlk > blockno+numblks+1) {
729 // setup dump and start
730 w.arg[0] = blockno + blocksRead;
731 w.arg[1] = maxBlk - (blockno + blocksRead);
732 clearCommandBuffer();
733 SendCommand(&w);
734 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
735 PrintAndLog("Command execute timeout 2");
736 ul_switch_off_field();
737 return 0;
738 }
739 uint8_t isOK = resp.arg[0] & 0xff;
740 blocksRead = resp.arg[1];
741 if (!isOK && !blocksRead) {
742 PrintAndLog("Read Block Failed 2");
743 ul_switch_off_field();
744 return 0;
745 }
746
747 startindex = resp.arg[2];
748 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
749 PrintAndLog("Data exceeded Buffer size!");
750 blocksRead = (sizeof(tag_data) - gotBytes)/8;
751 }
752 // get dumped data from bigbuf
753 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
754 WaitForResponse(CMD_ACK,NULL);
755
756 gotBytes += blocksRead*8;
757 } else { //field is still on - turn it off...
758 ul_switch_off_field();
759 }
760 }
761
762 // add diversified keys to dump
763 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
764 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
765 // print the dump
766 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
767 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
768 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
769
770 if (filename[0] == 0){
771 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
772 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
773 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
774 }
775
776 // save the dump to .bin file
777 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
778 saveFile(filename, "bin", tag_data, gotBytes);
779 return 1;
780 }
781
782 static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool verbose) {
783 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
784 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
785 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, verbose))
786 return 0;
787
788 UsbCommand resp;
789
790 Calc_wb_mac(blockno,bldata,div_key,MAC);
791 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
792 memcpy(w.d.asBytes, bldata, 8);
793 memcpy(w.d.asBytes + 8, MAC, 4);
794
795 clearCommandBuffer();
796 SendCommand(&w);
797 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
798 {
799 PrintAndLog("Write Command execute timeout");
800 return 0;
801 }
802 uint8_t isOK = resp.arg[0] & 0xff;
803 if (!isOK) {
804 PrintAndLog("Write Block Failed");
805 return 0;
806 }
807 PrintAndLog("Write Block Successful");
808 return 1;
809 }
810
811 int usage_hf_iclass_writeblock(void) {
812 PrintAndLog("Options:");
813 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
814 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
815 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
816 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
817 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
818 PrintAndLog("Samples:");
819 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
820 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
821 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
822 return 0;
823 }
824
825 int CmdHFiClass_WriteBlock(const char *Cmd) {
826 uint8_t blockno=0;
827 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
828 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
829 uint8_t keyNbr = 0;
830 uint8_t dataLen = 0;
831 char tempStr[50] = {0};
832 bool use_credit_key = false;
833 bool elite = false;
834 bool errors = false;
835 uint8_t cmdp = 0;
836 while(param_getchar(Cmd, cmdp) != 0x00)
837 {
838 switch(param_getchar(Cmd, cmdp))
839 {
840 case 'h':
841 case 'H':
842 return usage_hf_iclass_writeblock();
843 case 'b':
844 case 'B':
845 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
846 PrintAndLog("Block No must include 2 HEX symbols\n");
847 errors = true;
848 }
849 cmdp += 2;
850 break;
851 case 'c':
852 case 'C':
853 use_credit_key = true;
854 cmdp++;
855 break;
856 case 'd':
857 case 'D':
858 if (param_gethex(Cmd, cmdp+1, bldata, 16))
859 {
860 PrintAndLog("KEY must include 16 HEX symbols\n");
861 errors = true;
862 }
863 cmdp += 2;
864 break;
865 case 'e':
866 case 'E':
867 elite = true;
868 cmdp++;
869 break;
870 case 'k':
871 case 'K':
872 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
873 if (dataLen == 16) {
874 errors = param_gethex(tempStr, 0, KEY, dataLen);
875 } else if (dataLen == 1) {
876 keyNbr = param_get8(Cmd, cmdp+1);
877 if (keyNbr <= ICLASS_KEYS_MAX) {
878 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
879 } else {
880 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
881 errors = true;
882 }
883 } else {
884 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
885 errors = true;
886 }
887 cmdp += 2;
888 break;
889 default:
890 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
891 errors = true;
892 break;
893 }
894 if(errors) return usage_hf_iclass_writeblock();
895 }
896
897 if (cmdp < 6) return usage_hf_iclass_writeblock();
898 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, true);
899 ul_switch_off_field();
900 return ans;
901 }
902
903 int usage_hf_iclass_clone(void) {
904 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> e c");
905 PrintAndLog("Options:");
906 PrintAndLog(" f <filename>: specify a filename to clone from");
907 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
908 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
909 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
910 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
911 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
912 PrintAndLog("Samples:");
913 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
914 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
915 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
916 return -1;
917 }
918
919 int CmdHFiClassCloneTag(const char *Cmd) {
920 char filename[FILE_PATH_SIZE];
921 char tempStr[50]={0};
922 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
923 uint8_t keyNbr = 0;
924 uint8_t fileNameLen = 0;
925 uint8_t startblock = 0;
926 uint8_t endblock = 0;
927 uint8_t dataLen = 0;
928 bool use_credit_key = false;
929 bool elite = false;
930 bool errors = false;
931 uint8_t cmdp = 0;
932 while(param_getchar(Cmd, cmdp) != 0x00)
933 {
934 switch(param_getchar(Cmd, cmdp))
935 {
936 case 'h':
937 case 'H':
938 return usage_hf_iclass_clone();
939 case 'b':
940 case 'B':
941 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
942 PrintAndLog("Start Block No must include 2 HEX symbols\n");
943 errors = true;
944 }
945 cmdp += 2;
946 break;
947 case 'c':
948 case 'C':
949 use_credit_key = true;
950 cmdp++;
951 break;
952 case 'e':
953 case 'E':
954 elite = true;
955 cmdp++;
956 break;
957 case 'f':
958 case 'F':
959 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
960 if (fileNameLen < 1) {
961 PrintAndLog("No filename found after f");
962 errors = true;
963 }
964 cmdp += 2;
965 break;
966 case 'k':
967 case 'K':
968 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
969 if (dataLen == 16) {
970 errors = param_gethex(tempStr, 0, KEY, dataLen);
971 } else if (dataLen == 1) {
972 keyNbr = param_get8(Cmd, cmdp+1);
973 if (keyNbr <= ICLASS_KEYS_MAX) {
974 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
975 } else {
976 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
977 errors = true;
978 }
979 } else {
980 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
981 errors = true;
982 }
983 cmdp += 2;
984 break;
985 case 'l':
986 case 'L':
987 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
988 PrintAndLog("Start Block No must include 2 HEX symbols\n");
989 errors = true;
990 }
991 cmdp += 2;
992 break;
993 default:
994 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
995 errors = true;
996 break;
997 }
998 if(errors) return usage_hf_iclass_clone();
999 }
1000
1001 if (cmdp < 8) return usage_hf_iclass_clone();
1002
1003 FILE *f;
1004
1005 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1006
1007 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1008 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1009 }
1010 // file handling and reading
1011 f = fopen(filename,"rb");
1012 if(!f) {
1013 PrintAndLog("Failed to read from file '%s'", filename);
1014 return 1;
1015 }
1016
1017 if (startblock<5) {
1018 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1019 return 0;
1020 }
1021 // now read data from the file from block 6 --- 19
1022 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1023 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1024 // else we have to create a share memory
1025 int i;
1026 fseek(f,startblock*8,SEEK_SET);
1027 fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f);
1028
1029 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1030 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1031
1032 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, true))
1033 return 0;
1034
1035 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
1036 uint8_t *ptr;
1037 // calculate all mac for every the block we will write
1038 for (i = startblock; i <= endblock; i++){
1039 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1040 // usb command d start pointer = d + (i - 6) * 12
1041 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1042 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1043 // next one
1044 ptr = w.d.asBytes + (i - startblock) * 12;
1045 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1046 memcpy(ptr + 8,MAC, 4);
1047 }
1048 uint8_t p[12];
1049 for (i = 0; i <= endblock - startblock;i++){
1050 memcpy(p,w.d.asBytes + (i * 12),12);
1051 printf("Block |%02x|",i + startblock);
1052 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1053 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1054 }
1055 UsbCommand resp;
1056 SendCommand(&w);
1057 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1058 {
1059 PrintAndLog("Command execute timeout");
1060 return 0;
1061 }
1062 return 1;
1063 }
1064
1065 static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool verbose) {
1066 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1067 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1068
1069 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, verbose))
1070 return 0;
1071
1072 UsbCommand resp;
1073 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
1074 clearCommandBuffer();
1075 SendCommand(&w);
1076 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1077 {
1078 PrintAndLog("Command execute timeout");
1079 return 0;
1080 }
1081 uint8_t isOK = resp.arg[0] & 0xff;
1082 if (!isOK) {
1083 PrintAndLog("Read Block Failed");
1084 return 0;
1085 }
1086 //data read is stored in: resp.d.asBytes[0-15]
1087 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1088 return 1;
1089 }
1090
1091 int usage_hf_iclass_readblock(void) {
1092 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e\n");
1093 PrintAndLog("Options:");
1094 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1095 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1096 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1097 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1098 PrintAndLog("Samples:");
1099 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1100 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1101 PrintAndLog(" hf iclass readblk b 0A k 0");
1102 return 0;
1103 }
1104
1105 int CmdHFiClass_ReadBlock(const char *Cmd) {
1106 uint8_t blockno=0;
1107 uint8_t keyType = 0x88; //debit key
1108 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1109 uint8_t keyNbr = 0;
1110 uint8_t dataLen = 0;
1111 char tempStr[50] = {0};
1112 bool elite = false;
1113 bool errors = false;
1114 uint8_t cmdp = 0;
1115 while(param_getchar(Cmd, cmdp) != 0x00)
1116 {
1117 switch(param_getchar(Cmd, cmdp))
1118 {
1119 case 'h':
1120 case 'H':
1121 return usage_hf_iclass_readblock();
1122 case 'b':
1123 case 'B':
1124 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1125 PrintAndLog("Block No must include 2 HEX symbols\n");
1126 errors = true;
1127 }
1128 cmdp += 2;
1129 break;
1130 case 'c':
1131 case 'C':
1132 keyType = 0x18;
1133 cmdp++;
1134 break;
1135 case 'e':
1136 case 'E':
1137 elite = true;
1138 cmdp++;
1139 break;
1140 case 'k':
1141 case 'K':
1142 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1143 if (dataLen == 16) {
1144 errors = param_gethex(tempStr, 0, KEY, dataLen);
1145 } else if (dataLen == 1) {
1146 keyNbr = param_get8(Cmd, cmdp+1);
1147 if (keyNbr <= ICLASS_KEYS_MAX) {
1148 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1149 } else {
1150 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1151 errors = true;
1152 }
1153 } else {
1154 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1155 errors = true;
1156 }
1157 cmdp += 2;
1158 break;
1159 default:
1160 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1161 errors = true;
1162 break;
1163 }
1164 if(errors) return usage_hf_iclass_readblock();
1165 }
1166
1167 if (cmdp < 4) return usage_hf_iclass_readblock();
1168
1169 return ReadBlock(KEY, blockno, keyType, elite, true);
1170 }
1171
1172 int CmdHFiClass_loclass(const char *Cmd) {
1173 char opt = param_getchar(Cmd, 0);
1174
1175 if (strlen(Cmd)<1 || opt == 'h') {
1176 PrintAndLog("Usage: hf iclass loclass [options]");
1177 PrintAndLog("Options:");
1178 PrintAndLog("h Show this help");
1179 PrintAndLog("t Perform self-test");
1180 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1181 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1182 PrintAndLog(" malicious CSNs, and their protocol responses");
1183 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1184 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1185 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1186 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1187 PrintAndLog(" ... totalling N*24 bytes");
1188 return 0;
1189 }
1190 char fileName[255] = {0};
1191 if(opt == 'f')
1192 {
1193 if(param_getstr(Cmd, 1, fileName) > 0)
1194 {
1195 return bruteforceFileNoKeys(fileName);
1196 }else
1197 {
1198 PrintAndLog("You must specify a filename");
1199 }
1200 }
1201 else if(opt == 't')
1202 {
1203 int errors = testCipherUtils();
1204 errors += testMAC();
1205 errors += doKeyTests(0);
1206 errors += testElite();
1207 if(errors)
1208 {
1209 prnlog("OBS! There were errors!!!");
1210 }
1211 return errors;
1212 }
1213
1214 return 0;
1215 }
1216
1217 void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1218 uint8_t blockdata[8];
1219 uint8_t mem_config;
1220 memcpy(&mem_config, iclass_dump + 13,1);
1221 uint8_t maxmemcount;
1222 uint8_t filemaxblock = filesize / 8;
1223 if (mem_config & 0x80)
1224 maxmemcount = 255;
1225 else
1226 maxmemcount = 31;
1227 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1228
1229 if (startblock == 0)
1230 startblock = 6;
1231 if ((endblock > maxmemcount) || (endblock == 0))
1232 endblock = maxmemcount;
1233 if (endblock > filemaxblock)
1234 endblock = filemaxblock;
1235 int i = startblock;
1236 int j;
1237 while (i <= endblock){
1238 printf("Block |%02X| ",i);
1239 memcpy(blockdata,iclass_dump + (i * 8),8);
1240 for (j = 0;j < 8;j++)
1241 printf("%02X ",blockdata[j]);
1242 printf("|\n");
1243 i++;
1244 }
1245 }
1246
1247 int usage_hf_iclass_readtagfile() {
1248 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1249 return 1;
1250 }
1251
1252 int CmdHFiClassReadTagFile(const char *Cmd) {
1253 int startblock = 0;
1254 int endblock = 0;
1255 char tempnum[5];
1256 FILE *f;
1257 char filename[FILE_PATH_SIZE];
1258 if (param_getstr(Cmd, 0, filename) < 1)
1259 return usage_hf_iclass_readtagfile();
1260 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1261 startblock = 0;
1262 else
1263 sscanf(tempnum,"%d",&startblock);
1264
1265 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1266 endblock = 0;
1267 else
1268 sscanf(tempnum,"%d",&endblock);
1269 // file handling and reading
1270 f = fopen(filename,"rb");
1271 if(!f) {
1272 PrintAndLog("Failed to read from file '%s'", filename);
1273 return 1;
1274 }
1275 fseek(f, 0, SEEK_END);
1276 long fsize = ftell(f);
1277 fseek(f, 0, SEEK_SET);
1278
1279 uint8_t *dump = malloc(fsize);
1280
1281
1282 size_t bytes_read = fread(dump, 1, fsize, f);
1283 fclose(f);
1284 uint8_t *csn = dump;
1285 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
1286 // printIclassDumpInfo(dump);
1287 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1288 free(dump);
1289 return 0;
1290 }
1291
1292 /*
1293 uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1294 uint64_t new_div = 0x00;
1295 new_div ^= sdiv;
1296 new_div ^= hdiv;
1297 return new_div;
1298 }
1299
1300 uint64_t hexarray_to_uint64(uint8_t *key) {
1301 char temp[17];
1302 uint64_t uint_key;
1303 for (int i = 0;i < 8;i++)
1304 sprintf(&temp[(i *2)],"%02X",key[i]);
1305 temp[16] = '\0';
1306 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1307 return 0;
1308 return uint_key;
1309 }
1310 */
1311 void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1312 uint8_t keytable[128] = {0};
1313 uint8_t key_index[8] = {0};
1314 if (elite) {
1315 uint8_t key_sel[8] = { 0 };
1316 uint8_t key_sel_p[8] = { 0 };
1317 hash2(KEY, keytable);
1318 hash1(CSN, key_index);
1319 for(uint8_t i = 0; i < 8 ; i++)
1320 key_sel[i] = keytable[key_index[i]] & 0xFF;
1321
1322 //Permute from iclass format to standard format
1323 permutekey_rev(key_sel, key_sel_p);
1324 diversifyKey(CSN, key_sel_p, div_key);
1325 } else {
1326 diversifyKey(CSN, KEY, div_key);
1327 }
1328 }
1329
1330 //when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1331 //calculate and return xor_div_key (ready for a key write command)
1332 //print all div_keys if verbose
1333 static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1334 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1335 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1336 //get old div key
1337 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1338 //get new div key
1339 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1340
1341 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1342 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1343 }
1344 if (verbose) {
1345 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1346 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1347 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1348 }
1349 }
1350
1351 int usage_hf_iclass_calc_newkey(void) {
1352 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1353 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1354 PrintAndLog(" Options:");
1355 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1356 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1357 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1358 PrintAndLog(" e : specify new key as elite calc");
1359 PrintAndLog(" ee : specify old and new key as elite calc");
1360 PrintAndLog("Samples:");
1361 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1362 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1363 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1364 PrintAndLog("NOTE: * = required\n");
1365
1366 return 1;
1367 }
1368
1369 int CmdHFiClassCalcNewKey(const char *Cmd) {
1370 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1371 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1372 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1373 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1374 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1375 uint8_t keyNbr = 0;
1376 uint8_t dataLen = 0;
1377 char tempStr[50] = {0};
1378 bool givenCSN = false;
1379 bool oldElite = false;
1380 bool elite = false;
1381 bool errors = false;
1382 uint8_t cmdp = 0;
1383 while(param_getchar(Cmd, cmdp) != 0x00)
1384 {
1385 switch(param_getchar(Cmd, cmdp))
1386 {
1387 case 'h':
1388 case 'H':
1389 return usage_hf_iclass_calc_newkey();
1390 case 'e':
1391 case 'E':
1392 dataLen = param_getstr(Cmd, cmdp, tempStr);
1393 if (dataLen==2)
1394 oldElite = true;
1395 elite = true;
1396 cmdp++;
1397 break;
1398 case 'n':
1399 case 'N':
1400 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1401 if (dataLen == 16) {
1402 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1403 } else if (dataLen == 1) {
1404 keyNbr = param_get8(Cmd, cmdp+1);
1405 if (keyNbr <= ICLASS_KEYS_MAX) {
1406 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1407 } else {
1408 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1409 errors = true;
1410 }
1411 } else {
1412 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1413 errors = true;
1414 }
1415 cmdp += 2;
1416 break;
1417 case 'o':
1418 case 'O':
1419 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1420 if (dataLen == 16) {
1421 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1422 } else if (dataLen == 1) {
1423 keyNbr = param_get8(Cmd, cmdp+1);
1424 if (keyNbr <= ICLASS_KEYS_MAX) {
1425 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1426 } else {
1427 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1428 errors = true;
1429 }
1430 } else {
1431 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1432 errors = true;
1433 }
1434 cmdp += 2;
1435 break;
1436 case 's':
1437 case 'S':
1438 givenCSN = true;
1439 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1440 return usage_hf_iclass_calc_newkey();
1441 cmdp += 2;
1442 break;
1443 default:
1444 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1445 errors = true;
1446 break;
1447 }
1448 if(errors) return usage_hf_iclass_calc_newkey();
1449 }
1450
1451 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1452
1453 if (!givenCSN)
1454 if (!select_only(CSN, CCNR, false, true))
1455 return 0;
1456
1457 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1458 return 0;
1459 }
1460
1461 static int loadKeys(char *filename) {
1462 FILE *f;
1463 f = fopen(filename,"rb");
1464 if(!f) {
1465 PrintAndLog("Failed to read from file '%s'", filename);
1466 return 0;
1467 }
1468 fseek(f, 0, SEEK_END);
1469 long fsize = ftell(f);
1470 fseek(f, 0, SEEK_SET);
1471
1472 uint8_t *dump = malloc(fsize);
1473
1474 size_t bytes_read = fread(dump, 1, fsize, f);
1475 fclose(f);
1476 if (bytes_read > ICLASS_KEYS_MAX * 8){
1477 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1478 free(dump);
1479 return 0;
1480 }
1481 uint8_t i = 0;
1482 for (; i < bytes_read/8; i++){
1483 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1484 }
1485 free(dump);
1486 PrintAndLog("%u keys loaded", i);
1487 return 1;
1488 }
1489
1490 static int saveKeys(char *filename) {
1491 FILE *f;
1492 f = fopen(filename,"wb");
1493 if (f == NULL) {
1494 printf("error opening file %s\n",filename);
1495 return 0;
1496 }
1497 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1498 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1499 PrintAndLog("save key failed to write to file: %s", filename);
1500 break;
1501 }
1502 }
1503 fclose(f);
1504 return 0;
1505 }
1506
1507 static int printKeys(void) {
1508 PrintAndLog("");
1509 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1510 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1511 }
1512 PrintAndLog("");
1513 return 0;
1514 }
1515
1516 int usage_hf_iclass_managekeys(void) {
1517 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1518 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1519 PrintAndLog(" Options:");
1520 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1521 PrintAndLog(" k <key> : set a key in memory");
1522 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1523 PrintAndLog(" s : save keys in memory to file specified by filename");
1524 PrintAndLog(" l : load keys to memory from file specified by filename");
1525 PrintAndLog(" p : print keys loaded into memory\n");
1526 PrintAndLog("Samples:");
1527 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1528 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1529 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1530 PrintAndLog(" print keys : hf iclass managekeys p\n");
1531 return 0;
1532 }
1533
1534 int CmdHFiClassManageKeys(const char *Cmd) {
1535 uint8_t keyNbr = 0;
1536 uint8_t dataLen = 0;
1537 uint8_t KEY[8] = {0};
1538 char filename[FILE_PATH_SIZE];
1539 uint8_t fileNameLen = 0;
1540 bool errors = false;
1541 uint8_t operation = 0;
1542 char tempStr[20];
1543 uint8_t cmdp = 0;
1544
1545 while(param_getchar(Cmd, cmdp) != 0x00)
1546 {
1547 switch(param_getchar(Cmd, cmdp))
1548 {
1549 case 'h':
1550 case 'H':
1551 return usage_hf_iclass_managekeys();
1552 case 'f':
1553 case 'F':
1554 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1555 if (fileNameLen < 1) {
1556 PrintAndLog("No filename found after f");
1557 errors = true;
1558 }
1559 cmdp += 2;
1560 break;
1561 case 'n':
1562 case 'N':
1563 keyNbr = param_get8(Cmd, cmdp+1);
1564 if (keyNbr < 0) {
1565 PrintAndLog("Wrong block number");
1566 errors = true;
1567 }
1568 cmdp += 2;
1569 break;
1570 case 'k':
1571 case 'K':
1572 operation += 3; //set key
1573 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1574 if (dataLen == 16) { //ul-c or ev1/ntag key length
1575 errors = param_gethex(tempStr, 0, KEY, dataLen);
1576 } else {
1577 PrintAndLog("\nERROR: Key is incorrect length\n");
1578 errors = true;
1579 }
1580 cmdp += 2;
1581 break;
1582 case 'p':
1583 case 'P':
1584 operation += 4; //print keys in memory
1585 cmdp++;
1586 break;
1587 case 'l':
1588 case 'L':
1589 operation += 5; //load keys from file
1590 cmdp++;
1591 break;
1592 case 's':
1593 case 'S':
1594 operation += 6; //save keys to file
1595 cmdp++;
1596 break;
1597 default:
1598 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1599 errors = true;
1600 break;
1601 }
1602 if(errors) return usage_hf_iclass_managekeys();
1603 }
1604 if (operation == 0){
1605 PrintAndLog("no operation specified (load, save, or print)\n");
1606 return usage_hf_iclass_managekeys();
1607 }
1608 if (operation > 6){
1609 PrintAndLog("Too many operations specified\n");
1610 return usage_hf_iclass_managekeys();
1611 }
1612 if (operation > 4 && fileNameLen == 0){
1613 PrintAndLog("You must enter a filename when loading or saving\n");
1614 return usage_hf_iclass_managekeys();
1615 }
1616
1617 switch (operation){
1618 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1619 case 4: return printKeys();
1620 case 5: return loadKeys(filename);
1621 case 6: return saveKeys(filename);
1622 break;
1623 }
1624 return 0;
1625 }
1626
1627 static command_t CommandTable[] =
1628 {
1629 {"help", CmdHelp, 1, "This help"},
1630 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1631 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1632 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1633 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1634 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1635 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1636 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1637 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1638 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1639 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1640 {"reader", CmdHFiClassReader, 0, " Read an iClass tag"},
1641 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1642 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1643 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1644 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1645 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
1646 {NULL, NULL, 0, NULL}
1647 };
1648
1649 int CmdHFiClass(const char *Cmd)
1650 {
1651 CmdsParse(CommandTable, Cmd);
1652 return 0;
1653 }
1654
1655 int CmdHelp(const char *Cmd)
1656 {
1657 CmdsHelp(CommandTable);
1658 return 0;
1659 }
Proxmark3 GIT tracking
Impressum, Datenschutz