]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhficlass.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
fix: hf mf hardnested failed with new WUPA timing
[proxmark3-svn] / client / cmdhficlass.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3 // Copyright (C) 2011 Gerhard de Koning Gans
4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // High frequency iClass commands
11 //-----------------------------------------------------------------------------
12
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <sys/stat.h>
17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18 #include "data.h"
19 #include "proxmark3.h"
20 #include "ui.h"
21 #include "cmdparser.h"
22 #include "cmdhficlass.h"
23 #include "common.h"
24 #include "util.h"
25 #include "cmdmain.h"
26 #include "polarssl/des.h"
27 #include "loclass/cipherutils.h"
28 #include "loclass/cipher.h"
29 #include "loclass/ikeys.h"
30 #include "loclass/elite_crack.h"
31 #include "loclass/fileutils.h"
32 #include "protocols.h"
33 #include "usb_cmd.h"
34 #include "cmdhfmfu.h"
35
36 static int CmdHelp(const char *Cmd);
37
38 #define ICLASS_KEYS_MAX 8
39 static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
40 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
41 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
48 };
49
50 typedef struct iclass_block {
51 uint8_t d[8];
52 } iclass_block_t;
53
54 int xorbits_8(uint8_t val) {
55 uint8_t res = val ^ (val >> 1); //1st pass
56 res = res ^ (res >> 1); // 2nd pass
57 res = res ^ (res >> 2); // 3rd pass
58 res = res ^ (res >> 4); // 4th pass
59 return res & 1;
60 }
61
62 int CmdHFiClassList(const char *Cmd) {
63 PrintAndLog("Deprecated command, use 'hf list iclass' instead");
64 return 0;
65 }
66
67 int CmdHFiClassSnoop(const char *Cmd) {
68 UsbCommand c = {CMD_SNOOP_ICLASS};
69 SendCommand(&c);
70 return 0;
71 }
72
73 int usage_hf_iclass_sim(void) {
74 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
75 PrintAndLog(" options");
76 PrintAndLog(" 0 <CSN> simulate the given CSN");
77 PrintAndLog(" 1 simulate default CSN");
78 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
79 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
80 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
81 PrintAndLog(" example: hf iclass sim 2");
82 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
83 PrintAndLog(" hf iclass sim 3");
84 return 0;
85 }
86
87 #define NUM_CSNS 15
88 int CmdHFiClassSim(const char *Cmd) {
89 uint8_t simType = 0;
90 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
91
92 if (strlen(Cmd)<1) {
93 return usage_hf_iclass_sim();
94 }
95 simType = param_get8ex(Cmd, 0, 0, 10);
96
97 if(simType == 0)
98 {
99 if (param_gethex(Cmd, 1, CSN, 16)) {
100 PrintAndLog("A CSN should consist of 16 HEX symbols");
101 return usage_hf_iclass_sim();
102 }
103
104 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
105 }
106 if(simType > 3)
107 {
108 PrintAndLog("Undefined simptype %d", simType);
109 return usage_hf_iclass_sim();
110 }
111
112 uint8_t numberOfCSNs=0;
113 if(simType == 2)
114 {
115 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
116 UsbCommand resp = {0};
117
118 uint8_t csns[8*NUM_CSNS] = {
119 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
120 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
121 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
134
135 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
136
137 SendCommand(&c);
138 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
139 PrintAndLog("Command timed out");
140 return 0;
141 }
142
143 uint8_t num_mac_responses = resp.arg[1];
144 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
145
146 size_t datalen = NUM_CSNS*24;
147 /*
148 * Now, time to dump to file. We'll use this format:
149 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
150 * So, it should wind up as
151 * 8 * 24 bytes.
152 *
153 * The returndata from the pm3 is on the following format
154 * <4 byte NR><4 byte MAC>
155 * CC are all zeroes, CSN is the same as was sent in
156 **/
157 void* dump = malloc(datalen);
158 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
159 uint8_t i = 0;
160 for(i = 0 ; i < NUM_CSNS ; i++)
161 {
162 memcpy(dump+i*24, csns+i*8,8); //CSN
163 //8 zero bytes here...
164 //Then comes NR_MAC (eight bytes from the response)
165 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
166
167 }
168 /** Now, save to dumpfile **/
169 saveFile("iclass_mac_attack", "bin", dump,datalen);
170 free(dump);
171 }else
172 {
173 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
174 memcpy(c.d.asBytes, CSN, 8);
175 SendCommand(&c);
176 }
177
178 return 0;
179 }
180
181 int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
182 bool tagFound = false;
183 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
184 FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_AA |
185 FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY } };
186 // loop in client not device - else on windows have a communication error
187 UsbCommand resp;
188 while(!ukbhit()){
189 SendCommand(&c);
190 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
191 uint8_t readStatus = resp.arg[0] & 0xff;
192 uint8_t *data = resp.d.asBytes;
193
194 // no tag found or button pressed
195 if( (readStatus == 0 && !loop) || readStatus == 0xFF) {
196 // abort
197 if (verbose) PrintAndLog("Quitting...");
198 return 0;
199 }
200
201 if( readStatus & FLAG_ICLASS_READER_CSN) {
202 PrintAndLog(" CSN: %s",sprint_hex(data,8));
203 tagFound = true;
204 }
205 if( readStatus & FLAG_ICLASS_READER_CC) {
206 PrintAndLog(" CC: %s",sprint_hex(data+16,8));
207 }
208 if( readStatus & FLAG_ICLASS_READER_CONF) {
209 printIclassDumpInfo(data);
210 }
211 if (readStatus & FLAG_ICLASS_READER_AA) {
212 bool legacy = true;
213 PrintAndLog(" AppIA: %s",sprint_hex(data+8*5,8));
214 for (int i = 0; i<8; i++) {
215 if (data[8*5+i] != 0xFF) {
216 legacy = false;
217 }
218 }
219 PrintAndLog(" : Possible iClass %s",(legacy) ? "(legacy tag)" : "(NOT legacy tag)");
220 }
221
222 if (tagFound && !loop) return 1;
223 } else {
224 if (verbose) PrintAndLog("Command execute timeout");
225 }
226 if (!loop) break;
227 }
228 return 0;
229 }
230
231 int CmdHFiClassReader(const char *Cmd) {
232 return HFiClassReader(Cmd, true, true);
233 }
234
235 int CmdHFiClassReader_Replay(const char *Cmd) {
236 uint8_t readerType = 0;
237 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
238
239 if (strlen(Cmd)<1) {
240 PrintAndLog("Usage: hf iclass replay <MAC>");
241 PrintAndLog(" sample: hf iclass replay 00112233");
242 return 0;
243 }
244
245 if (param_gethex(Cmd, 0, MAC, 8)) {
246 PrintAndLog("MAC must include 8 HEX symbols");
247 return 1;
248 }
249
250 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
251 memcpy(c.d.asBytes, MAC, 4);
252 SendCommand(&c);
253
254 return 0;
255 }
256
257 int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
258 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
259 memcpy(c.d.asBytes, data, blocksCount * 16);
260 SendCommand(&c);
261 return 0;
262 }
263
264 int hf_iclass_eload_usage(void) {
265 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
266 PrintAndLog("Usage: hf iclass eload f <filename>");
267 PrintAndLog("");
268 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
269 return 0;
270 }
271
272 int CmdHFiClassELoad(const char *Cmd) {
273
274 char opt = param_getchar(Cmd, 0);
275 if (strlen(Cmd)<1 || opt == 'h')
276 return hf_iclass_eload_usage();
277
278 //File handling and reading
279 FILE *f;
280 char filename[FILE_PATH_SIZE];
281 if(opt == 'f' && param_getstr(Cmd, 1, filename, sizeof(filename)) > 0)
282 {
283 f = fopen(filename, "rb");
284 }else{
285 return hf_iclass_eload_usage();
286 }
287
288 if(!f) {
289 PrintAndLog("Failed to read from file '%s'", filename);
290 return 1;
291 }
292
293 fseek(f, 0, SEEK_END);
294 long fsize = ftell(f);
295 fseek(f, 0, SEEK_SET);
296
297 if (fsize < 0) {
298 PrintAndLog("Error, when getting filesize");
299 fclose(f);
300 return 1;
301 }
302
303 uint8_t *dump = malloc(fsize);
304
305 size_t bytes_read = fread(dump, 1, fsize, f);
306 fclose(f);
307
308 printIclassDumpInfo(dump);
309 //Validate
310
311 if (bytes_read < fsize)
312 {
313 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
314 free(dump);
315 return 1;
316 }
317 //Send to device
318 uint32_t bytes_sent = 0;
319 uint32_t bytes_remaining = bytes_read;
320
321 while(bytes_remaining > 0){
322 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
323 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
324 memcpy(c.d.asBytes, dump, bytes_in_packet);
325 SendCommand(&c);
326 bytes_remaining -= bytes_in_packet;
327 bytes_sent += bytes_in_packet;
328 }
329 free(dump);
330 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
331 return 0;
332 }
333
334 static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
335 FILE *f = fopen(filename, "rb");
336 if(!f) {
337 PrintAndLog("Failed to read from file '%s'", filename);
338 return 1;
339 }
340 fseek(f, 0, SEEK_END);
341 long fsize = ftell(f);
342 fseek(f, 0, SEEK_SET);
343 size_t bytes_read = fread(buffer, 1, len, f);
344 fclose(f);
345 if(fsize != len)
346 {
347 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
348 return 1;
349 }
350 if(bytes_read != len)
351 {
352 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
353 return 1;
354 }
355 return 0;
356 }
357
358 int usage_hf_iclass_decrypt(void) {
359 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
360 PrintAndLog("");
361 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
362 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
363 PrintAndLog("");
364 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
365 PrintAndLog("");
366 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
367 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
368 PrintAndLog("which is defined by the configuration block.");
369 return 1;
370 }
371
372 int CmdHFiClassDecrypt(const char *Cmd) {
373 uint8_t key[16] = { 0 };
374 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
375 {
376 usage_hf_iclass_decrypt();
377 return 1;
378 }
379 PrintAndLog("Decryption file found... ");
380 char opt = param_getchar(Cmd, 0);
381 if (strlen(Cmd)<1 || opt == 'h')
382 return usage_hf_iclass_decrypt();
383
384 //Open the tagdump-file
385 FILE *f;
386 char filename[FILE_PATH_SIZE];
387 if(opt == 'f' && param_getstr(Cmd, 1, filename, sizeof(filename)) > 0) {
388 f = fopen(filename, "rb");
389 if ( f == NULL ) {
390 PrintAndLog("Could not find file %s", filename);
391 return 1;
392 }
393 } else {
394 return usage_hf_iclass_decrypt();
395 }
396
397 fseek(f, 0, SEEK_END);
398 long fsize = ftell(f);
399 fseek(f, 0, SEEK_SET);
400 uint8_t enc_dump[8] = {0};
401 uint8_t *decrypted = malloc(fsize);
402 des3_context ctx = { DES_DECRYPT ,{ 0 } };
403 des3_set2key_dec( &ctx, key);
404 size_t bytes_read = fread(enc_dump, 1, 8, f);
405
406 //Use the first block (CSN) for filename
407 char outfilename[FILE_PATH_SIZE] = { 0 };
408 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
409 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
410 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
411
412 size_t blocknum =0;
413 while(bytes_read == 8)
414 {
415 if(blocknum < 7)
416 {
417 memcpy(decrypted+(blocknum*8), enc_dump, 8);
418 }else{
419 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
420 }
421 printvar("decrypted block", decrypted +(blocknum*8), 8);
422 bytes_read = fread(enc_dump, 1, 8, f);
423 blocknum++;
424 }
425 fclose(f);
426
427 saveFile(outfilename,"bin", decrypted, blocknum*8);
428 free(decrypted);
429 return 0;
430 }
431
432 int usage_hf_iclass_encrypt(void) {
433 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
434 PrintAndLog("");
435 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
436 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
437 PrintAndLog("");
438 PrintAndLog("example: hf iclass encrypt 0102030405060708");
439 PrintAndLog("");
440 return 0;
441 }
442
443 static int iClassEncryptBlkData(uint8_t *blkData) {
444 uint8_t key[16] = { 0 };
445 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
446 {
447 usage_hf_iclass_encrypt();
448 return 1;
449 }
450 PrintAndLog("Decryption file found... ");
451
452 uint8_t encryptedData[16];
453 uint8_t *encrypted = encryptedData;
454 des3_context ctx = { DES_DECRYPT ,{ 0 } };
455 des3_set2key_enc( &ctx, key);
456
457 des3_crypt_ecb(&ctx, blkData,encrypted);
458 //printvar("decrypted block", decrypted, 8);
459 memcpy(blkData,encrypted,8);
460
461 return 1;
462 }
463
464 int CmdHFiClassEncryptBlk(const char *Cmd) {
465 uint8_t blkData[8] = {0};
466 char opt = param_getchar(Cmd, 0);
467 if (strlen(Cmd)<1 || opt == 'h')
468 return usage_hf_iclass_encrypt();
469
470 //get the bytes to encrypt
471 if (param_gethex(Cmd, 0, blkData, 16))
472 {
473 PrintAndLog("BlockData must include 16 HEX symbols");
474 return 0;
475 }
476 if (!iClassEncryptBlkData(blkData)) return 0;
477
478 printvar("encrypted block", blkData, 8);
479 return 1;
480 }
481
482 void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
483 uint8_t WB[9];
484 WB[0] = blockno;
485 memcpy(WB + 1,data,8);
486 doMAC_N(WB,sizeof(WB),div_key,MAC);
487 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
488 }
489
490 static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
491 UsbCommand resp;
492
493 UsbCommand c = {CMD_READER_ICLASS, {0}};
494 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
495 if (use_credit_key)
496 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
497
498 clearCommandBuffer();
499 SendCommand(&c);
500 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
501 {
502 PrintAndLog("Command execute timeout");
503 return false;
504 }
505
506 uint8_t isOK = resp.arg[0] & 0xff;
507 uint8_t *data = resp.d.asBytes;
508
509 memcpy(CSN,data,8);
510 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
511 if(isOK > 0)
512 {
513 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
514 }
515 if(isOK <= 1){
516 PrintAndLog("Failed to obtain CC! Aborting");
517 return false;
518 }
519 return true;
520 }
521
522 static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
523 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
524 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
525
526 if (!select_only(CSN, CCNR, use_credit_key, verbose))
527 return false;
528
529 //get div_key
530 if(rawkey)
531 memcpy(div_key, KEY, 8);
532 else
533 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
534 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
535
536 doMAC(CCNR, div_key, MAC);
537 UsbCommand resp;
538 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
539 memcpy(d.d.asBytes, MAC, 4);
540 clearCommandBuffer();
541 SendCommand(&d);
542 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
543 {
544 PrintAndLog("Auth Command execute timeout");
545 return false;
546 }
547 uint8_t isOK = resp.arg[0] & 0xff;
548 if (!isOK) {
549 PrintAndLog("Authentication error");
550 return false;
551 }
552 return true;
553 }
554
555 int usage_hf_iclass_dump(void) {
556 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
557 PrintAndLog("Options:");
558 PrintAndLog(" f <filename> : specify a filename to save dump to");
559 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
560 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
561 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
562 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
563 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
564 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
565 PrintAndLog(" NOTE: * = required");
566 PrintAndLog("Samples:");
567 PrintAndLog(" hf iclass dump k 001122334455667B");
568 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
569 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
570 return 0;
571 }
572
573 int CmdHFiClassReader_Dump(const char *Cmd) {
574
575 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
576 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
577 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
578 uint8_t blockno = 0;
579 uint8_t numblks = 0;
580 uint8_t maxBlk = 31;
581 uint8_t app_areas = 1;
582 uint8_t kb = 2;
583 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
584 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
585 uint8_t keyNbr = 0;
586 uint8_t dataLen = 0;
587 uint8_t fileNameLen = 0;
588 char filename[FILE_PATH_SIZE]={0};
589 char tempStr[50] = {0};
590 bool have_debit_key = false;
591 bool have_credit_key = false;
592 bool use_credit_key = false;
593 bool elite = false;
594 bool rawkey = false;
595 bool errors = false;
596 uint8_t cmdp = 0;
597
598 while(param_getchar(Cmd, cmdp) != 0x00)
599 {
600 switch(param_getchar(Cmd, cmdp))
601 {
602 case 'h':
603 case 'H':
604 return usage_hf_iclass_dump();
605 case 'c':
606 case 'C':
607 have_credit_key = true;
608 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
609 if (dataLen == 16) {
610 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
611 } else if (dataLen == 1) {
612 keyNbr = param_get8(Cmd, cmdp+1);
613 if (keyNbr < ICLASS_KEYS_MAX) {
614 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
615 } else {
616 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
617 errors = true;
618 }
619 } else {
620 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
621 errors = true;
622 }
623 cmdp += 2;
624 break;
625 case 'e':
626 case 'E':
627 elite = true;
628 cmdp++;
629 break;
630 case 'f':
631 case 'F':
632 fileNameLen = param_getstr(Cmd, cmdp+1, filename, sizeof(filename));
633 if (fileNameLen < 1) {
634 PrintAndLog("No filename found after f");
635 errors = true;
636 }
637 cmdp += 2;
638 break;
639 case 'k':
640 case 'K':
641 have_debit_key = true;
642 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
643 if (dataLen == 16) {
644 errors = param_gethex(tempStr, 0, KEY, dataLen);
645 } else if (dataLen == 1) {
646 keyNbr = param_get8(Cmd, cmdp+1);
647 if (keyNbr < ICLASS_KEYS_MAX) {
648 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
649 } else {
650 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
651 errors = true;
652 }
653 } else {
654 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
655 errors = true;
656 }
657 cmdp += 2;
658 break;
659 case 'r':
660 case 'R':
661 rawkey = true;
662 cmdp++;
663 break;
664 default:
665 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
666 errors = true;
667 break;
668 }
669 if(errors) return usage_hf_iclass_dump();
670 }
671
672 if (cmdp < 2) return usage_hf_iclass_dump();
673 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
674 if (!have_debit_key && have_credit_key) use_credit_key = true;
675
676 //get config and first 3 blocks
677 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
678 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
679 UsbCommand resp;
680 uint8_t tag_data[255*8];
681
682 clearCommandBuffer();
683 SendCommand(&c);
684 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
685 PrintAndLog("Command execute timeout");
686 DropField();
687 return 0;
688 }
689 uint8_t readStatus = resp.arg[0] & 0xff;
690 uint8_t *data = resp.d.asBytes;
691
692 if(readStatus == 0){
693 PrintAndLog("No tag found...");
694 DropField();
695 return 0;
696 }
697 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
698 memcpy(tag_data, data, 8*3);
699 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
700 numblks = data[8];
701 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
702 // large memory - not able to dump pages currently
703 if (numblks > maxBlk) numblks = maxBlk;
704 }
705 DropField();
706 // authenticate debit key and get div_key - later store in dump block 3
707 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
708 //try twice - for some reason it sometimes fails the first time...
709 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
710 DropField();
711 return 0;
712 }
713 }
714
715 // begin dump
716 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
717 clearCommandBuffer();
718 SendCommand(&w);
719 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
720 PrintAndLog("Command execute time-out 1");
721 DropField();
722 return 1;
723 }
724 uint32_t blocksRead = resp.arg[1];
725 uint8_t isOK = resp.arg[0] & 0xff;
726 if (!isOK && !blocksRead) {
727 PrintAndLog("Read Block Failed");
728 DropField();
729 return 0;
730 }
731 uint32_t startindex = resp.arg[2];
732 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
733 PrintAndLog("Data exceeded Buffer size!");
734 blocksRead = (sizeof(tag_data)/8) - blockno;
735 }
736 // response ok - now get bigbuf content of the dump
737 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
738 WaitForResponse(CMD_ACK,NULL);
739 size_t gotBytes = blocksRead*8 + blockno*8;
740
741 // try AA2
742 if (have_credit_key) {
743 //turn off hf field before authenticating with different key
744 DropField();
745 memset(MAC,0,4);
746 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
747 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
748 //try twice - for some reason it sometimes fails the first time...
749 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
750 DropField();
751 return 0;
752 }
753 }
754 // do we still need to read more block? (aa2 enabled?)
755 if (maxBlk > blockno+numblks+1) {
756 // setup dump and start
757 w.arg[0] = blockno + blocksRead;
758 w.arg[1] = maxBlk - (blockno + blocksRead);
759 clearCommandBuffer();
760 SendCommand(&w);
761 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
762 PrintAndLog("Command execute timeout 2");
763 DropField();
764 return 0;
765 }
766 uint8_t isOK = resp.arg[0] & 0xff;
767 blocksRead = resp.arg[1];
768 if (!isOK && !blocksRead) {
769 PrintAndLog("Read Block Failed 2");
770 DropField();
771 return 0;
772 }
773
774 startindex = resp.arg[2];
775 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
776 PrintAndLog("Data exceeded Buffer size!");
777 blocksRead = (sizeof(tag_data) - gotBytes)/8;
778 }
779 // get dumped data from bigbuf
780 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
781 WaitForResponse(CMD_ACK,NULL);
782
783 gotBytes += blocksRead*8;
784 } else { //field is still on - turn it off...
785 DropField();
786 }
787 }
788
789 // add diversified keys to dump
790 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
791 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
792 // print the dump
793 printf("------+--+-------------------------+\n");
794 printf("CSN |00| %s|\n",sprint_hex(tag_data, 8));
795 printIclassDumpContents(tag_data, 1, (gotBytes/8), gotBytes);
796
797 if (filename[0] == 0){
798 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
799 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
800 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
801 }
802
803 // save the dump to .bin file
804 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
805 saveFile(filename, "bin", tag_data, gotBytes);
806 return 1;
807 }
808
809 static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
810 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
811 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
812 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
813 return 0;
814
815 UsbCommand resp;
816
817 Calc_wb_mac(blockno,bldata,div_key,MAC);
818 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
819 memcpy(w.d.asBytes, bldata, 8);
820 memcpy(w.d.asBytes + 8, MAC, 4);
821
822 clearCommandBuffer();
823 SendCommand(&w);
824 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
825 {
826 PrintAndLog("Write Command execute timeout");
827 return 0;
828 }
829 uint8_t isOK = resp.arg[0] & 0xff;
830 if (!isOK) {
831 PrintAndLog("Write Block Failed");
832 return 0;
833 }
834 PrintAndLog("Write Block Successful");
835 return 1;
836 }
837
838 int usage_hf_iclass_writeblock(void) {
839 PrintAndLog("Options:");
840 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
841 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
842 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
843 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
844 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
845 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
846 PrintAndLog("Samples:");
847 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
848 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
849 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
850 return 0;
851 }
852
853 int CmdHFiClass_WriteBlock(const char *Cmd) {
854 uint8_t blockno=0;
855 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
856 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
857 uint8_t keyNbr = 0;
858 uint8_t dataLen = 0;
859 char tempStr[50] = {0};
860 bool use_credit_key = false;
861 bool elite = false;
862 bool rawkey= false;
863 bool errors = false;
864 uint8_t cmdp = 0;
865 while(param_getchar(Cmd, cmdp) != 0x00)
866 {
867 switch(param_getchar(Cmd, cmdp))
868 {
869 case 'h':
870 case 'H':
871 return usage_hf_iclass_writeblock();
872 case 'b':
873 case 'B':
874 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
875 PrintAndLog("Block No must include 2 HEX symbols\n");
876 errors = true;
877 }
878 cmdp += 2;
879 break;
880 case 'c':
881 case 'C':
882 use_credit_key = true;
883 cmdp++;
884 break;
885 case 'd':
886 case 'D':
887 if (param_gethex(Cmd, cmdp+1, bldata, 16))
888 {
889 PrintAndLog("KEY must include 16 HEX symbols\n");
890 errors = true;
891 }
892 cmdp += 2;
893 break;
894 case 'e':
895 case 'E':
896 elite = true;
897 cmdp++;
898 break;
899 case 'k':
900 case 'K':
901 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
902 if (dataLen == 16) {
903 errors = param_gethex(tempStr, 0, KEY, dataLen);
904 } else if (dataLen == 1) {
905 keyNbr = param_get8(Cmd, cmdp+1);
906 if (keyNbr < ICLASS_KEYS_MAX) {
907 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
908 } else {
909 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
910 errors = true;
911 }
912 } else {
913 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
914 errors = true;
915 }
916 cmdp += 2;
917 break;
918 case 'r':
919 case 'R':
920 rawkey = true;
921 cmdp++;
922 break;
923 default:
924 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
925 errors = true;
926 break;
927 }
928 if(errors) return usage_hf_iclass_writeblock();
929 }
930
931 if (cmdp < 6) return usage_hf_iclass_writeblock();
932 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
933 DropField();
934 return ans;
935 }
936
937 int usage_hf_iclass_clone(void) {
938 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
939 PrintAndLog("Options:");
940 PrintAndLog(" f <filename>: specify a filename to clone from");
941 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
942 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
943 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
944 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
945 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
946 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
947 PrintAndLog("Samples:");
948 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
949 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
950 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
951 return -1;
952 }
953
954 int CmdHFiClassCloneTag(const char *Cmd) {
955 char filename[FILE_PATH_SIZE] = {0};
956 char tempStr[50]={0};
957 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
958 uint8_t keyNbr = 0;
959 uint8_t fileNameLen = 0;
960 uint8_t startblock = 0;
961 uint8_t endblock = 0;
962 uint8_t dataLen = 0;
963 bool use_credit_key = false;
964 bool elite = false;
965 bool rawkey = false;
966 bool errors = false;
967 uint8_t cmdp = 0;
968 while(param_getchar(Cmd, cmdp) != 0x00)
969 {
970 switch(param_getchar(Cmd, cmdp))
971 {
972 case 'h':
973 case 'H':
974 return usage_hf_iclass_clone();
975 case 'b':
976 case 'B':
977 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
978 PrintAndLog("Start Block No must include 2 HEX symbols\n");
979 errors = true;
980 }
981 cmdp += 2;
982 break;
983 case 'c':
984 case 'C':
985 use_credit_key = true;
986 cmdp++;
987 break;
988 case 'e':
989 case 'E':
990 elite = true;
991 cmdp++;
992 break;
993 case 'f':
994 case 'F':
995 fileNameLen = param_getstr(Cmd, cmdp+1, filename, sizeof(filename));
996 if (fileNameLen < 1) {
997 PrintAndLog("No filename found after f");
998 errors = true;
999 }
1000 cmdp += 2;
1001 break;
1002 case 'k':
1003 case 'K':
1004 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
1005 if (dataLen == 16) {
1006 errors = param_gethex(tempStr, 0, KEY, dataLen);
1007 } else if (dataLen == 1) {
1008 keyNbr = param_get8(Cmd, cmdp+1);
1009 if (keyNbr < ICLASS_KEYS_MAX) {
1010 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1011 } else {
1012 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1013 errors = true;
1014 }
1015 } else {
1016 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1017 errors = true;
1018 }
1019 cmdp += 2;
1020 break;
1021 case 'l':
1022 case 'L':
1023 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1024 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1025 errors = true;
1026 }
1027 cmdp += 2;
1028 break;
1029 case 'r':
1030 case 'R':
1031 rawkey = true;
1032 cmdp++;
1033 break;
1034 default:
1035 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1036 errors = true;
1037 break;
1038 }
1039 if(errors) return usage_hf_iclass_clone();
1040 }
1041
1042 if (cmdp < 8) return usage_hf_iclass_clone();
1043
1044 FILE *f;
1045
1046 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1047
1048 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1049 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1050 }
1051 // file handling and reading
1052 f = fopen(filename,"rb");
1053 if(!f) {
1054 PrintAndLog("Failed to read from file '%s'", filename);
1055 return 1;
1056 }
1057
1058 if (startblock<5) {
1059 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1060 fclose(f);
1061 return 0;
1062 }
1063 // now read data from the file from block 6 --- 19
1064 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1065 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1066 // else we have to create a share memory
1067 int i;
1068 fseek(f,startblock*8,SEEK_SET);
1069 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0 ) {
1070 PrintAndLog("File reading error.");
1071 fclose(f);
1072 return 2;
1073 }
1074
1075 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1076 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1077
1078 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
1079 return 0;
1080
1081 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
1082 uint8_t *ptr;
1083 // calculate all mac for every the block we will write
1084 for (i = startblock; i <= endblock; i++){
1085 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1086 // usb command d start pointer = d + (i - 6) * 12
1087 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1088 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1089 // next one
1090 ptr = w.d.asBytes + (i - startblock) * 12;
1091 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1092 memcpy(ptr + 8,MAC, 4);
1093 }
1094 uint8_t p[12];
1095 for (i = 0; i <= endblock - startblock;i++){
1096 memcpy(p,w.d.asBytes + (i * 12),12);
1097 printf("Block |%02x|",i + startblock);
1098 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1099 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1100 }
1101 UsbCommand resp;
1102 SendCommand(&w);
1103 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1104 {
1105 PrintAndLog("Command execute timeout");
1106 return 0;
1107 }
1108 return 1;
1109 }
1110
1111 static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose, bool auth) {
1112 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1113 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1114
1115 if (auth) {
1116 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
1117 return 0;
1118 } else {
1119 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1120 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1121 if (!select_only(CSN, CCNR, (keyType==0x18), verbose))
1122 return 0;
1123 }
1124
1125 UsbCommand resp;
1126 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
1127 clearCommandBuffer();
1128 SendCommand(&w);
1129 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1130 {
1131 PrintAndLog("Command execute timeout");
1132 return 0;
1133 }
1134 uint8_t isOK = resp.arg[0] & 0xff;
1135 if (!isOK) {
1136 PrintAndLog("Read Block Failed");
1137 return 0;
1138 }
1139 //data read is stored in: resp.d.asBytes[0-15]
1140 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1141 return 1;
1142 }
1143
1144 int usage_hf_iclass_readblock(void) {
1145 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
1146 PrintAndLog("Options:");
1147 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1148 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1149 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1150 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1151 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
1152 PrintAndLog("Samples:");
1153 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1154 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1155 PrintAndLog(" hf iclass readblk b 0A k 0");
1156 return 0;
1157 }
1158
1159 int CmdHFiClass_ReadBlock(const char *Cmd) {
1160 uint8_t blockno=0;
1161 uint8_t keyType = 0x88; //debit key
1162 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1163 uint8_t keyNbr = 0;
1164 uint8_t dataLen = 0;
1165 char tempStr[50] = {0};
1166 bool elite = false;
1167 bool rawkey = false;
1168 bool errors = false;
1169 bool auth = false;
1170 uint8_t cmdp = 0;
1171 while(param_getchar(Cmd, cmdp) != 0x00)
1172 {
1173 switch(param_getchar(Cmd, cmdp))
1174 {
1175 case 'h':
1176 case 'H':
1177 return usage_hf_iclass_readblock();
1178 case 'b':
1179 case 'B':
1180 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1181 PrintAndLog("Block No must include 2 HEX symbols\n");
1182 errors = true;
1183 }
1184 cmdp += 2;
1185 break;
1186 case 'c':
1187 case 'C':
1188 keyType = 0x18;
1189 cmdp++;
1190 break;
1191 case 'e':
1192 case 'E':
1193 elite = true;
1194 cmdp++;
1195 break;
1196 case 'k':
1197 case 'K':
1198 auth = true;
1199 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
1200 if (dataLen == 16) {
1201 errors = param_gethex(tempStr, 0, KEY, dataLen);
1202 } else if (dataLen == 1) {
1203 keyNbr = param_get8(Cmd, cmdp+1);
1204 if (keyNbr < ICLASS_KEYS_MAX) {
1205 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1206 } else {
1207 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1208 errors = true;
1209 }
1210 } else {
1211 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1212 errors = true;
1213 }
1214 cmdp += 2;
1215 break;
1216 case 'r':
1217 case 'R':
1218 rawkey = true;
1219 cmdp++;
1220 break;
1221 default:
1222 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1223 errors = true;
1224 break;
1225 }
1226 if(errors) return usage_hf_iclass_readblock();
1227 }
1228
1229 if (cmdp < 2) return usage_hf_iclass_readblock();
1230 if (!auth)
1231 PrintAndLog("warning: no authentication used with read, only a few specific blocks can be read accurately without authentication.");
1232 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true, auth);
1233 }
1234
1235 int CmdHFiClass_loclass(const char *Cmd) {
1236 char opt = param_getchar(Cmd, 0);
1237
1238 if (strlen(Cmd)<1 || opt == 'h') {
1239 PrintAndLog("Usage: hf iclass loclass [options]");
1240 PrintAndLog("Options:");
1241 PrintAndLog("h Show this help");
1242 PrintAndLog("t Perform self-test");
1243 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1244 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1245 PrintAndLog(" malicious CSNs, and their protocol responses");
1246 PrintAndLog(" The binary format of the file is expected to be as follows: ");
1247 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1248 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1249 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1250 PrintAndLog(" ... totalling N*24 bytes");
1251 return 0;
1252 }
1253 char fileName[255] = {0};
1254 if(opt == 'f')
1255 {
1256 if(param_getstr(Cmd, 1, fileName, sizeof(fileName)) > 0)
1257 {
1258 return bruteforceFileNoKeys(fileName);
1259 }else
1260 {
1261 PrintAndLog("You must specify a filename");
1262 }
1263 }
1264 else if(opt == 't')
1265 {
1266 int errors = testCipherUtils();
1267 errors += testMAC();
1268 errors += doKeyTests(0);
1269 errors += testElite();
1270 if(errors)
1271 {
1272 prnlog("OBS! There were errors!!!");
1273 }
1274 return errors;
1275 }
1276
1277 return 0;
1278 }
1279
1280 void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1281 uint8_t mem_config;
1282 memcpy(&mem_config, iclass_dump + 13,1);
1283 uint8_t maxmemcount;
1284 uint8_t filemaxblock = filesize / 8;
1285 if (mem_config & 0x80)
1286 maxmemcount = 255;
1287 else
1288 maxmemcount = 31;
1289 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1290
1291 if (startblock == 0)
1292 startblock = 6;
1293 if ((endblock > maxmemcount) || (endblock == 0))
1294 endblock = maxmemcount;
1295
1296 // remember endblock need to relate to zero-index arrays.
1297 if (endblock > filemaxblock-1)
1298 endblock = filemaxblock;
1299
1300 int i = startblock;
1301 printf("------+--+-------------------------+\n");
1302 while (i <= endblock) {
1303 uint8_t *blk = iclass_dump + (i * 8);
1304 printf("Block |%02X| %s|\n", i, sprint_hex(blk, 8) );
1305 i++;
1306 }
1307 printf("------+--+-------------------------+\n");
1308 }
1309
1310 int usage_hf_iclass_readtagfile() {
1311 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1312 return 1;
1313 }
1314
1315 int CmdHFiClassReadTagFile(const char *Cmd) {
1316 int startblock = 0;
1317 int endblock = 0;
1318 char tempnum[5];
1319 FILE *f;
1320 char filename[FILE_PATH_SIZE];
1321 if (param_getstr(Cmd, 0, filename, sizeof(filename)) < 1)
1322 return usage_hf_iclass_readtagfile();
1323 if (param_getstr(Cmd, 1, tempnum, sizeof(tempnum)) < 1)
1324 startblock = 0;
1325 else
1326 sscanf(tempnum,"%d",&startblock);
1327
1328 if (param_getstr(Cmd,2, tempnum, sizeof(tempnum)) < 1)
1329 endblock = 0;
1330 else
1331 sscanf(tempnum,"%d",&endblock);
1332 // file handling and reading
1333 f = fopen(filename,"rb");
1334 if(!f) {
1335 PrintAndLog("Failed to read from file '%s'", filename);
1336 return 1;
1337 }
1338 fseek(f, 0, SEEK_END);
1339 long fsize = ftell(f);
1340 fseek(f, 0, SEEK_SET);
1341
1342 if ( fsize < 0 ) {
1343 PrintAndLog("Error, when getting filesize");
1344 fclose(f);
1345 return 1;
1346 }
1347
1348 uint8_t *dump = malloc(fsize);
1349
1350 size_t bytes_read = fread(dump, 1, fsize, f);
1351 fclose(f);
1352 uint8_t *csn = dump;
1353 printf("------+--+-------------------------+\n");
1354 printf("CSN |00| %s|\n", sprint_hex(csn, 8) );
1355 // printIclassDumpInfo(dump);
1356 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1357 free(dump);
1358 return 0;
1359 }
1360
1361 /*
1362 uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1363 uint64_t new_div = 0x00;
1364 new_div ^= sdiv;
1365 new_div ^= hdiv;
1366 return new_div;
1367 }
1368
1369 uint64_t hexarray_to_uint64(uint8_t *key) {
1370 char temp[17];
1371 uint64_t uint_key;
1372 for (int i = 0;i < 8;i++)
1373 sprintf(&temp[(i *2)],"%02X",key[i]);
1374 temp[16] = '\0';
1375 if (sscanf(temp,"%016" SCNx64,&uint_key) < 1)
1376 return 0;
1377 return uint_key;
1378 }
1379 */
1380 void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1381 uint8_t keytable[128] = {0};
1382 uint8_t key_index[8] = {0};
1383 if (elite) {
1384 uint8_t key_sel[8] = { 0 };
1385 uint8_t key_sel_p[8] = { 0 };
1386 hash2(KEY, keytable);
1387 hash1(CSN, key_index);
1388 for(uint8_t i = 0; i < 8 ; i++)
1389 key_sel[i] = keytable[key_index[i]] & 0xFF;
1390
1391 //Permute from iclass format to standard format
1392 permutekey_rev(key_sel, key_sel_p);
1393 diversifyKey(CSN, key_sel_p, div_key);
1394 } else {
1395 diversifyKey(CSN, KEY, div_key);
1396 }
1397 }
1398
1399 //when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1400 //calculate and return xor_div_key (ready for a key write command)
1401 //print all div_keys if verbose
1402 static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1403 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1404 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1405 //get old div key
1406 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1407 //get new div key
1408 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1409
1410 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1411 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1412 }
1413 if (verbose) {
1414 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1415 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1416 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1417 }
1418 }
1419
1420 int usage_hf_iclass_calc_newkey(void) {
1421 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1422 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1423 PrintAndLog(" Options:");
1424 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1425 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1426 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1427 PrintAndLog(" e : specify new key as elite calc");
1428 PrintAndLog(" ee : specify old and new key as elite calc");
1429 PrintAndLog("Samples:");
1430 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1431 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1432 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1433 PrintAndLog("NOTE: * = required\n");
1434
1435 return 1;
1436 }
1437
1438 int CmdHFiClassCalcNewKey(const char *Cmd) {
1439 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1440 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1441 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1442 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1443 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1444 uint8_t keyNbr = 0;
1445 uint8_t dataLen = 0;
1446 char tempStr[50] = {0};
1447 bool givenCSN = false;
1448 bool oldElite = false;
1449 bool elite = false;
1450 bool errors = false;
1451 uint8_t cmdp = 0;
1452 while(param_getchar(Cmd, cmdp) != 0x00)
1453 {
1454 switch(param_getchar(Cmd, cmdp))
1455 {
1456 case 'h':
1457 case 'H':
1458 return usage_hf_iclass_calc_newkey();
1459 case 'e':
1460 case 'E':
1461 dataLen = param_getstr(Cmd, cmdp, tempStr, sizeof(tempStr));
1462 if (dataLen==2)
1463 oldElite = true;
1464 elite = true;
1465 cmdp++;
1466 break;
1467 case 'n':
1468 case 'N':
1469 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
1470 if (dataLen == 16) {
1471 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1472 } else if (dataLen == 1) {
1473 keyNbr = param_get8(Cmd, cmdp+1);
1474 if (keyNbr < ICLASS_KEYS_MAX) {
1475 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1476 } else {
1477 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1478 errors = true;
1479 }
1480 } else {
1481 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1482 errors = true;
1483 }
1484 cmdp += 2;
1485 break;
1486 case 'o':
1487 case 'O':
1488 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
1489 if (dataLen == 16) {
1490 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1491 } else if (dataLen == 1) {
1492 keyNbr = param_get8(Cmd, cmdp+1);
1493 if (keyNbr < ICLASS_KEYS_MAX) {
1494 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1495 } else {
1496 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1497 errors = true;
1498 }
1499 } else {
1500 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1501 errors = true;
1502 }
1503 cmdp += 2;
1504 break;
1505 case 's':
1506 case 'S':
1507 givenCSN = true;
1508 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1509 return usage_hf_iclass_calc_newkey();
1510 cmdp += 2;
1511 break;
1512 default:
1513 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1514 errors = true;
1515 break;
1516 }
1517 if(errors) return usage_hf_iclass_calc_newkey();
1518 }
1519
1520 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1521
1522 if (!givenCSN)
1523 if (!select_only(CSN, CCNR, false, true))
1524 return 0;
1525
1526 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1527 return 0;
1528 }
1529
1530 static int loadKeys(char *filename) {
1531 FILE *f;
1532 f = fopen(filename,"rb");
1533 if(!f) {
1534 PrintAndLog("Failed to read from file '%s'", filename);
1535 return 0;
1536 }
1537 fseek(f, 0, SEEK_END);
1538 long fsize = ftell(f);
1539 fseek(f, 0, SEEK_SET);
1540
1541 if ( fsize < 0 ) {
1542 PrintAndLog("Error, when getting filesize");
1543 fclose(f);
1544 return 1;
1545 }
1546
1547 uint8_t *dump = malloc(fsize);
1548
1549 size_t bytes_read = fread(dump, 1, fsize, f);
1550 fclose(f);
1551 if (bytes_read > ICLASS_KEYS_MAX * 8){
1552 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1553 free(dump);
1554 return 0;
1555 }
1556 uint8_t i = 0;
1557 for (; i < bytes_read/8; i++){
1558 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1559 }
1560 free(dump);
1561 PrintAndLog("%u keys loaded", i);
1562 return 1;
1563 }
1564
1565 static int saveKeys(char *filename) {
1566 FILE *f;
1567 f = fopen(filename,"wb");
1568 if (f == NULL) {
1569 printf("error opening file %s\n",filename);
1570 return 0;
1571 }
1572 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1573 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1574 PrintAndLog("save key failed to write to file: %s", filename);
1575 break;
1576 }
1577 }
1578 fclose(f);
1579 return 0;
1580 }
1581
1582 static int printKeys(void) {
1583 PrintAndLog("");
1584 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1585 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1586 }
1587 PrintAndLog("");
1588 return 0;
1589 }
1590
1591 int usage_hf_iclass_managekeys(void) {
1592 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1593 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1594 PrintAndLog(" Options:");
1595 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1596 PrintAndLog(" k <key> : set a key in memory");
1597 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1598 PrintAndLog(" s : save keys in memory to file specified by filename");
1599 PrintAndLog(" l : load keys to memory from file specified by filename");
1600 PrintAndLog(" p : print keys loaded into memory\n");
1601 PrintAndLog("Samples:");
1602 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1603 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1604 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1605 PrintAndLog(" print keys : hf iclass managekeys p\n");
1606 return 0;
1607 }
1608
1609 int CmdHFiClassManageKeys(const char *Cmd) {
1610 uint8_t keyNbr = 0;
1611 uint8_t dataLen = 0;
1612 uint8_t KEY[8] = {0};
1613 char filename[FILE_PATH_SIZE];
1614 uint8_t fileNameLen = 0;
1615 bool errors = false;
1616 uint8_t operation = 0;
1617 char tempStr[20];
1618 uint8_t cmdp = 0;
1619
1620 while(param_getchar(Cmd, cmdp) != 0x00)
1621 {
1622 switch(param_getchar(Cmd, cmdp))
1623 {
1624 case 'h':
1625 case 'H':
1626 return usage_hf_iclass_managekeys();
1627 case 'f':
1628 case 'F':
1629 fileNameLen = param_getstr(Cmd, cmdp+1, filename, sizeof(filename));
1630 if (fileNameLen < 1) {
1631 PrintAndLog("No filename found after f");
1632 errors = true;
1633 }
1634 cmdp += 2;
1635 break;
1636 case 'n':
1637 case 'N':
1638 keyNbr = param_get8(Cmd, cmdp+1);
1639 if (keyNbr >= ICLASS_KEYS_MAX) {
1640 PrintAndLog("Invalid block number");
1641 errors = true;
1642 }
1643 cmdp += 2;
1644 break;
1645 case 'k':
1646 case 'K':
1647 operation += 3; //set key
1648 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
1649 if (dataLen == 16) { //ul-c or ev1/ntag key length
1650 errors = param_gethex(tempStr, 0, KEY, dataLen);
1651 } else {
1652 PrintAndLog("\nERROR: Key is incorrect length\n");
1653 errors = true;
1654 }
1655 cmdp += 2;
1656 break;
1657 case 'p':
1658 case 'P':
1659 operation += 4; //print keys in memory
1660 cmdp++;
1661 break;
1662 case 'l':
1663 case 'L':
1664 operation += 5; //load keys from file
1665 cmdp++;
1666 break;
1667 case 's':
1668 case 'S':
1669 operation += 6; //save keys to file
1670 cmdp++;
1671 break;
1672 default:
1673 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1674 errors = true;
1675 break;
1676 }
1677 if(errors) return usage_hf_iclass_managekeys();
1678 }
1679 if (operation == 0){
1680 PrintAndLog("no operation specified (load, save, or print)\n");
1681 return usage_hf_iclass_managekeys();
1682 }
1683 if (operation > 6){
1684 PrintAndLog("Too many operations specified\n");
1685 return usage_hf_iclass_managekeys();
1686 }
1687 if (operation > 4 && fileNameLen == 0){
1688 PrintAndLog("You must enter a filename when loading or saving\n");
1689 return usage_hf_iclass_managekeys();
1690 }
1691
1692 switch (operation){
1693 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1694 case 4: return printKeys();
1695 case 5: return loadKeys(filename);
1696 case 6: return saveKeys(filename);
1697 break;
1698 }
1699 return 0;
1700 }
1701
1702 static command_t CommandTable[] =
1703 {
1704 {"help", CmdHelp, 1, "This help"},
1705 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1706 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1707 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1708 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1709 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1710 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1711 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1712 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1713 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1714 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1715 {"reader", CmdHFiClassReader, 0, " Look for iClass tags until a key or the pm3 button is pressed"},
1716 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1717 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1718 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1719 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1720 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
1721 {NULL, NULL, 0, NULL}
1722 };
1723
1724 int CmdHFiClass(const char *Cmd)
1725 {
1726 CmdsParse(CommandTable, Cmd);
1727 return 0;
1728 }
1729
1730 int CmdHelp(const char *Cmd)
1731 {
1732 CmdsHelp(CommandTable);
1733 return 0;
1734 }
Proxmark3 GIT tracking
Impressum, Datenschutz