]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhficlass.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #168 from zhovner/master
[proxmark3-svn] / client / cmdhficlass.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3 // Copyright (C) 2011 Gerhard de Koning Gans
4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // High frequency iClass commands
11 //-----------------------------------------------------------------------------
12
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <sys/stat.h>
17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18 #include "data.h"
19 #include "proxmark3.h"
20 #include "ui.h"
21 #include "cmdparser.h"
22 #include "cmdhficlass.h"
23 #include "common.h"
24 #include "util.h"
25 #include "cmdmain.h"
26 #include "loclass/des.h"
27 #include "loclass/cipherutils.h"
28 #include "loclass/cipher.h"
29 #include "loclass/ikeys.h"
30 #include "loclass/elite_crack.h"
31 #include "loclass/fileutils.h"
32 #include "protocols.h"
33 #include "usb_cmd.h"
34 #include "cmdhfmfu.h"
35
36 static int CmdHelp(const char *Cmd);
37
38 #define ICLASS_KEYS_MAX 8
39 static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
40 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
41 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
48 };
49
50 typedef struct iclass_block {
51 uint8_t d[8];
52 } iclass_block_t;
53
54 int xorbits_8(uint8_t val) {
55 uint8_t res = val ^ (val >> 1); //1st pass
56 res = res ^ (res >> 1); // 2nd pass
57 res = res ^ (res >> 2); // 3rd pass
58 res = res ^ (res >> 4); // 4th pass
59 return res & 1;
60 }
61
62 int CmdHFiClassList(const char *Cmd) {
63 PrintAndLog("Deprecated command, use 'hf list iclass' instead");
64 return 0;
65 }
66
67 int CmdHFiClassSnoop(const char *Cmd) {
68 UsbCommand c = {CMD_SNOOP_ICLASS};
69 SendCommand(&c);
70 return 0;
71 }
72
73 int usage_hf_iclass_sim(void) {
74 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
75 PrintAndLog(" options");
76 PrintAndLog(" 0 <CSN> simulate the given CSN");
77 PrintAndLog(" 1 simulate default CSN");
78 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
79 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
80 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
81 PrintAndLog(" example: hf iclass sim 2");
82 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
83 PrintAndLog(" hf iclass sim 3");
84 return 0;
85 }
86
87 #define NUM_CSNS 15
88 int CmdHFiClassSim(const char *Cmd) {
89 uint8_t simType = 0;
90 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
91
92 if (strlen(Cmd)<1) {
93 return usage_hf_iclass_sim();
94 }
95 simType = param_get8ex(Cmd, 0, 0, 10);
96
97 if(simType == 0)
98 {
99 if (param_gethex(Cmd, 1, CSN, 16)) {
100 PrintAndLog("A CSN should consist of 16 HEX symbols");
101 return usage_hf_iclass_sim();
102 }
103
104 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
105 }
106 if(simType > 3)
107 {
108 PrintAndLog("Undefined simptype %d", simType);
109 return usage_hf_iclass_sim();
110 }
111
112 uint8_t numberOfCSNs=0;
113 if(simType == 2)
114 {
115 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
116 UsbCommand resp = {0};
117
118 uint8_t csns[8*NUM_CSNS] = {
119 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
120 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
121 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
134
135 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
136
137 SendCommand(&c);
138 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
139 PrintAndLog("Command timed out");
140 return 0;
141 }
142
143 uint8_t num_mac_responses = resp.arg[1];
144 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
145
146 size_t datalen = NUM_CSNS*24;
147 /*
148 * Now, time to dump to file. We'll use this format:
149 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
150 * So, it should wind up as
151 * 8 * 24 bytes.
152 *
153 * The returndata from the pm3 is on the following format
154 * <4 byte NR><4 byte MAC>
155 * CC are all zeroes, CSN is the same as was sent in
156 **/
157 void* dump = malloc(datalen);
158 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
159 uint8_t i = 0;
160 for(i = 0 ; i < NUM_CSNS ; i++)
161 {
162 memcpy(dump+i*24, csns+i*8,8); //CSN
163 //8 zero bytes here...
164 //Then comes NR_MAC (eight bytes from the response)
165 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
166
167 }
168 /** Now, save to dumpfile **/
169 saveFile("iclass_mac_attack", "bin", dump,datalen);
170 free(dump);
171 }else
172 {
173 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
174 memcpy(c.d.asBytes, CSN, 8);
175 SendCommand(&c);
176 }
177
178 return 0;
179 }
180
181 int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
182 bool tagFound = false;
183 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
184 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
185 // loop in client not device - else on windows have a communication error
186 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
187 UsbCommand resp;
188 while(!ukbhit()){
189 SendCommand(&c);
190 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
191 uint8_t readStatus = resp.arg[0] & 0xff;
192 uint8_t *data = resp.d.asBytes;
193
194 if (verbose)
195 PrintAndLog("Readstatus:%02x", readStatus);
196 if( readStatus == 0){
197 //Aborted
198 if (verbose) PrintAndLog("Quitting...");
199 return 0;
200 }
201 if( readStatus & FLAG_ICLASS_READER_CSN){
202 PrintAndLog("CSN: %s",sprint_hex(data,8));
203 tagFound = true;
204 }
205 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
206 if( readStatus & FLAG_ICLASS_READER_CONF){
207 printIclassDumpInfo(data);
208 }
209 if (tagFound && !loop) return 1;
210 } else {
211 if (verbose) PrintAndLog("Command execute timeout");
212 }
213 if (!loop) break;
214 }
215 return 0;
216 }
217
218 int CmdHFiClassReader(const char *Cmd) {
219 return HFiClassReader(Cmd, true, true);
220 }
221
222 int CmdHFiClassReader_Replay(const char *Cmd) {
223 uint8_t readerType = 0;
224 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
225
226 if (strlen(Cmd)<1) {
227 PrintAndLog("Usage: hf iclass replay <MAC>");
228 PrintAndLog(" sample: hf iclass replay 00112233");
229 return 0;
230 }
231
232 if (param_gethex(Cmd, 0, MAC, 8)) {
233 PrintAndLog("MAC must include 8 HEX symbols");
234 return 1;
235 }
236
237 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
238 memcpy(c.d.asBytes, MAC, 4);
239 SendCommand(&c);
240
241 return 0;
242 }
243
244 int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
245 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
246 memcpy(c.d.asBytes, data, blocksCount * 16);
247 SendCommand(&c);
248 return 0;
249 }
250
251 int hf_iclass_eload_usage(void) {
252 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
253 PrintAndLog("Usage: hf iclass eload f <filename>");
254 PrintAndLog("");
255 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
256 return 0;
257 }
258
259 int CmdHFiClassELoad(const char *Cmd) {
260
261 char opt = param_getchar(Cmd, 0);
262 if (strlen(Cmd)<1 || opt == 'h')
263 return hf_iclass_eload_usage();
264
265 //File handling and reading
266 FILE *f;
267 char filename[FILE_PATH_SIZE];
268 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
269 {
270 f = fopen(filename, "rb");
271 }else{
272 return hf_iclass_eload_usage();
273 }
274
275 if(!f) {
276 PrintAndLog("Failed to read from file '%s'", filename);
277 return 1;
278 }
279
280 fseek(f, 0, SEEK_END);
281 long fsize = ftell(f);
282 fseek(f, 0, SEEK_SET);
283
284 if (fsize < 0) {
285 PrintAndLog("Error, when getting filesize");
286 fclose(f);
287 return 1;
288 }
289
290 uint8_t *dump = malloc(fsize);
291
292 size_t bytes_read = fread(dump, 1, fsize, f);
293 fclose(f);
294
295 printIclassDumpInfo(dump);
296 //Validate
297
298 if (bytes_read < fsize)
299 {
300 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
301 free(dump);
302 return 1;
303 }
304 //Send to device
305 uint32_t bytes_sent = 0;
306 uint32_t bytes_remaining = bytes_read;
307
308 while(bytes_remaining > 0){
309 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
310 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
311 memcpy(c.d.asBytes, dump, bytes_in_packet);
312 SendCommand(&c);
313 bytes_remaining -= bytes_in_packet;
314 bytes_sent += bytes_in_packet;
315 }
316 free(dump);
317 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
318 return 0;
319 }
320
321 static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
322 FILE *f = fopen(filename, "rb");
323 if(!f) {
324 PrintAndLog("Failed to read from file '%s'", filename);
325 return 1;
326 }
327 fseek(f, 0, SEEK_END);
328 long fsize = ftell(f);
329 fseek(f, 0, SEEK_SET);
330 size_t bytes_read = fread(buffer, 1, len, f);
331 fclose(f);
332 if(fsize != len)
333 {
334 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
335 return 1;
336 }
337 if(bytes_read != len)
338 {
339 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
340 return 1;
341 }
342 return 0;
343 }
344
345 int usage_hf_iclass_decrypt(void) {
346 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
347 PrintAndLog("");
348 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
349 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
350 PrintAndLog("");
351 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
352 PrintAndLog("");
353 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
354 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
355 PrintAndLog("which is defined by the configuration block.");
356 return 1;
357 }
358
359 int CmdHFiClassDecrypt(const char *Cmd) {
360 uint8_t key[16] = { 0 };
361 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
362 {
363 usage_hf_iclass_decrypt();
364 return 1;
365 }
366 PrintAndLog("Decryption file found... ");
367 char opt = param_getchar(Cmd, 0);
368 if (strlen(Cmd)<1 || opt == 'h')
369 return usage_hf_iclass_decrypt();
370
371 //Open the tagdump-file
372 FILE *f;
373 char filename[FILE_PATH_SIZE];
374 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
375 f = fopen(filename, "rb");
376 if ( f == NULL ) {
377 PrintAndLog("Could not find file %s", filename);
378 return 1;
379 }
380 } else {
381 return usage_hf_iclass_decrypt();
382 }
383
384 fseek(f, 0, SEEK_END);
385 long fsize = ftell(f);
386 fseek(f, 0, SEEK_SET);
387 uint8_t enc_dump[8] = {0};
388 uint8_t *decrypted = malloc(fsize);
389 des3_context ctx = { DES_DECRYPT ,{ 0 } };
390 des3_set2key_dec( &ctx, key);
391 size_t bytes_read = fread(enc_dump, 1, 8, f);
392
393 //Use the first block (CSN) for filename
394 char outfilename[FILE_PATH_SIZE] = { 0 };
395 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
396 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
397 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
398
399 size_t blocknum =0;
400 while(bytes_read == 8)
401 {
402 if(blocknum < 7)
403 {
404 memcpy(decrypted+(blocknum*8), enc_dump, 8);
405 }else{
406 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
407 }
408 printvar("decrypted block", decrypted +(blocknum*8), 8);
409 bytes_read = fread(enc_dump, 1, 8, f);
410 blocknum++;
411 }
412 fclose(f);
413
414 saveFile(outfilename,"bin", decrypted, blocknum*8);
415 free(decrypted);
416 return 0;
417 }
418
419 int usage_hf_iclass_encrypt(void) {
420 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
421 PrintAndLog("");
422 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
423 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
424 PrintAndLog("");
425 PrintAndLog("example: hf iclass encrypt 0102030405060708");
426 PrintAndLog("");
427 return 0;
428 }
429
430 static int iClassEncryptBlkData(uint8_t *blkData) {
431 uint8_t key[16] = { 0 };
432 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
433 {
434 usage_hf_iclass_encrypt();
435 return 1;
436 }
437 PrintAndLog("Decryption file found... ");
438
439 uint8_t encryptedData[16];
440 uint8_t *encrypted = encryptedData;
441 des3_context ctx = { DES_DECRYPT ,{ 0 } };
442 des3_set2key_enc( &ctx, key);
443
444 des3_crypt_ecb(&ctx, blkData,encrypted);
445 //printvar("decrypted block", decrypted, 8);
446 memcpy(blkData,encrypted,8);
447
448 return 1;
449 }
450
451 int CmdHFiClassEncryptBlk(const char *Cmd) {
452 uint8_t blkData[8] = {0};
453 char opt = param_getchar(Cmd, 0);
454 if (strlen(Cmd)<1 || opt == 'h')
455 return usage_hf_iclass_encrypt();
456
457 //get the bytes to encrypt
458 if (param_gethex(Cmd, 0, blkData, 16))
459 {
460 PrintAndLog("BlockData must include 16 HEX symbols");
461 return 0;
462 }
463 if (!iClassEncryptBlkData(blkData)) return 0;
464
465 printvar("encrypted block", blkData, 8);
466 return 1;
467 }
468
469 void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
470 uint8_t WB[9];
471 WB[0] = blockno;
472 memcpy(WB + 1,data,8);
473 doMAC_N(WB,sizeof(WB),div_key,MAC);
474 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
475 }
476
477 static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
478 UsbCommand resp;
479
480 UsbCommand c = {CMD_READER_ICLASS, {0}};
481 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
482 if (use_credit_key)
483 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
484
485 clearCommandBuffer();
486 SendCommand(&c);
487 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
488 {
489 PrintAndLog("Command execute timeout");
490 return false;
491 }
492
493 uint8_t isOK = resp.arg[0] & 0xff;
494 uint8_t *data = resp.d.asBytes;
495
496 memcpy(CSN,data,8);
497 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
498 if(isOK > 0)
499 {
500 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
501 }
502 if(isOK <= 1){
503 PrintAndLog("Failed to obtain CC! Aborting");
504 return false;
505 }
506 return true;
507 }
508
509 static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
510 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
511 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
512
513 if (!select_only(CSN, CCNR, use_credit_key, verbose))
514 return false;
515
516 //get div_key
517 if(rawkey)
518 memcpy(div_key, KEY, 8);
519 else
520 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
521 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
522
523 doMAC(CCNR, div_key, MAC);
524 UsbCommand resp;
525 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
526 memcpy(d.d.asBytes, MAC, 4);
527 clearCommandBuffer();
528 SendCommand(&d);
529 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
530 {
531 PrintAndLog("Auth Command execute timeout");
532 return false;
533 }
534 uint8_t isOK = resp.arg[0] & 0xff;
535 if (!isOK) {
536 PrintAndLog("Authentication error");
537 return false;
538 }
539 return true;
540 }
541
542 int usage_hf_iclass_dump(void) {
543 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
544 PrintAndLog("Options:");
545 PrintAndLog(" f <filename> : specify a filename to save dump to");
546 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
547 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
548 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
549 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
550 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
551 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
552 PrintAndLog(" NOTE: * = required");
553 PrintAndLog("Samples:");
554 PrintAndLog(" hf iclass dump k 001122334455667B");
555 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
556 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
557 return 0;
558 }
559
560 int CmdHFiClassReader_Dump(const char *Cmd) {
561
562 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
563 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
564 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
565 uint8_t blockno = 0;
566 uint8_t numblks = 0;
567 uint8_t maxBlk = 31;
568 uint8_t app_areas = 1;
569 uint8_t kb = 2;
570 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
571 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
572 uint8_t keyNbr = 0;
573 uint8_t dataLen = 0;
574 uint8_t fileNameLen = 0;
575 char filename[FILE_PATH_SIZE]={0};
576 char tempStr[50] = {0};
577 bool have_debit_key = false;
578 bool have_credit_key = false;
579 bool use_credit_key = false;
580 bool elite = false;
581 bool rawkey = false;
582 bool errors = false;
583 uint8_t cmdp = 0;
584
585 while(param_getchar(Cmd, cmdp) != 0x00)
586 {
587 switch(param_getchar(Cmd, cmdp))
588 {
589 case 'h':
590 case 'H':
591 return usage_hf_iclass_dump();
592 case 'c':
593 case 'C':
594 have_credit_key = true;
595 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
596 if (dataLen == 16) {
597 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
598 } else if (dataLen == 1) {
599 keyNbr = param_get8(Cmd, cmdp+1);
600 if (keyNbr < ICLASS_KEYS_MAX) {
601 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
602 } else {
603 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
604 errors = true;
605 }
606 } else {
607 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
608 errors = true;
609 }
610 cmdp += 2;
611 break;
612 case 'e':
613 case 'E':
614 elite = true;
615 cmdp++;
616 break;
617 case 'f':
618 case 'F':
619 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
620 if (fileNameLen < 1) {
621 PrintAndLog("No filename found after f");
622 errors = true;
623 }
624 cmdp += 2;
625 break;
626 case 'k':
627 case 'K':
628 have_debit_key = true;
629 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
630 if (dataLen == 16) {
631 errors = param_gethex(tempStr, 0, KEY, dataLen);
632 } else if (dataLen == 1) {
633 keyNbr = param_get8(Cmd, cmdp+1);
634 if (keyNbr < ICLASS_KEYS_MAX) {
635 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
636 } else {
637 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
638 errors = true;
639 }
640 } else {
641 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
642 errors = true;
643 }
644 cmdp += 2;
645 break;
646 case 'r':
647 case 'R':
648 rawkey = true;
649 cmdp++;
650 break;
651 default:
652 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
653 errors = true;
654 break;
655 }
656 if(errors) return usage_hf_iclass_dump();
657 }
658
659 if (cmdp < 2) return usage_hf_iclass_dump();
660 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
661 if (!have_debit_key && have_credit_key) use_credit_key = true;
662
663 //get config and first 3 blocks
664 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
665 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
666 UsbCommand resp;
667 uint8_t tag_data[255*8];
668
669 clearCommandBuffer();
670 SendCommand(&c);
671 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
672 PrintAndLog("Command execute timeout");
673 ul_switch_off_field();
674 return 0;
675 }
676 uint8_t readStatus = resp.arg[0] & 0xff;
677 uint8_t *data = resp.d.asBytes;
678
679 if(readStatus == 0){
680 PrintAndLog("No tag found...");
681 ul_switch_off_field();
682 return 0;
683 }
684 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
685 memcpy(tag_data, data, 8*3);
686 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
687 numblks = data[8];
688 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
689 // large memory - not able to dump pages currently
690 if (numblks > maxBlk) numblks = maxBlk;
691 }
692 ul_switch_off_field();
693 // authenticate debit key and get div_key - later store in dump block 3
694 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
695 //try twice - for some reason it sometimes fails the first time...
696 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
697 ul_switch_off_field();
698 return 0;
699 }
700 }
701
702 // begin dump
703 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
704 clearCommandBuffer();
705 SendCommand(&w);
706 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
707 PrintAndLog("Command execute time-out 1");
708 ul_switch_off_field();
709 return 1;
710 }
711 uint32_t blocksRead = resp.arg[1];
712 uint8_t isOK = resp.arg[0] & 0xff;
713 if (!isOK && !blocksRead) {
714 PrintAndLog("Read Block Failed");
715 ul_switch_off_field();
716 return 0;
717 }
718 uint32_t startindex = resp.arg[2];
719 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
720 PrintAndLog("Data exceeded Buffer size!");
721 blocksRead = (sizeof(tag_data)/8) - blockno;
722 }
723 // response ok - now get bigbuf content of the dump
724 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
725 WaitForResponse(CMD_ACK,NULL);
726 size_t gotBytes = blocksRead*8 + blockno*8;
727
728 // try AA2
729 if (have_credit_key) {
730 //turn off hf field before authenticating with different key
731 ul_switch_off_field();
732 memset(MAC,0,4);
733 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
734 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
735 //try twice - for some reason it sometimes fails the first time...
736 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
737 ul_switch_off_field();
738 return 0;
739 }
740 }
741 // do we still need to read more block? (aa2 enabled?)
742 if (maxBlk > blockno+numblks+1) {
743 // setup dump and start
744 w.arg[0] = blockno + blocksRead;
745 w.arg[1] = maxBlk - (blockno + blocksRead);
746 clearCommandBuffer();
747 SendCommand(&w);
748 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
749 PrintAndLog("Command execute timeout 2");
750 ul_switch_off_field();
751 return 0;
752 }
753 uint8_t isOK = resp.arg[0] & 0xff;
754 blocksRead = resp.arg[1];
755 if (!isOK && !blocksRead) {
756 PrintAndLog("Read Block Failed 2");
757 ul_switch_off_field();
758 return 0;
759 }
760
761 startindex = resp.arg[2];
762 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
763 PrintAndLog("Data exceeded Buffer size!");
764 blocksRead = (sizeof(tag_data) - gotBytes)/8;
765 }
766 // get dumped data from bigbuf
767 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
768 WaitForResponse(CMD_ACK,NULL);
769
770 gotBytes += blocksRead*8;
771 } else { //field is still on - turn it off...
772 ul_switch_off_field();
773 }
774 }
775
776 // add diversified keys to dump
777 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
778 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
779 // print the dump
780 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
781 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
782 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
783
784 if (filename[0] == 0){
785 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
786 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
787 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
788 }
789
790 // save the dump to .bin file
791 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
792 saveFile(filename, "bin", tag_data, gotBytes);
793 return 1;
794 }
795
796 static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
797 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
798 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
799 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
800 return 0;
801
802 UsbCommand resp;
803
804 Calc_wb_mac(blockno,bldata,div_key,MAC);
805 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
806 memcpy(w.d.asBytes, bldata, 8);
807 memcpy(w.d.asBytes + 8, MAC, 4);
808
809 clearCommandBuffer();
810 SendCommand(&w);
811 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
812 {
813 PrintAndLog("Write Command execute timeout");
814 return 0;
815 }
816 uint8_t isOK = resp.arg[0] & 0xff;
817 if (!isOK) {
818 PrintAndLog("Write Block Failed");
819 return 0;
820 }
821 PrintAndLog("Write Block Successful");
822 return 1;
823 }
824
825 int usage_hf_iclass_writeblock(void) {
826 PrintAndLog("Options:");
827 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
828 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
829 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
830 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
831 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
832 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
833 PrintAndLog("Samples:");
834 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
835 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
836 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
837 return 0;
838 }
839
840 int CmdHFiClass_WriteBlock(const char *Cmd) {
841 uint8_t blockno=0;
842 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
843 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
844 uint8_t keyNbr = 0;
845 uint8_t dataLen = 0;
846 char tempStr[50] = {0};
847 bool use_credit_key = false;
848 bool elite = false;
849 bool rawkey= false;
850 bool errors = false;
851 uint8_t cmdp = 0;
852 while(param_getchar(Cmd, cmdp) != 0x00)
853 {
854 switch(param_getchar(Cmd, cmdp))
855 {
856 case 'h':
857 case 'H':
858 return usage_hf_iclass_writeblock();
859 case 'b':
860 case 'B':
861 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
862 PrintAndLog("Block No must include 2 HEX symbols\n");
863 errors = true;
864 }
865 cmdp += 2;
866 break;
867 case 'c':
868 case 'C':
869 use_credit_key = true;
870 cmdp++;
871 break;
872 case 'd':
873 case 'D':
874 if (param_gethex(Cmd, cmdp+1, bldata, 16))
875 {
876 PrintAndLog("KEY must include 16 HEX symbols\n");
877 errors = true;
878 }
879 cmdp += 2;
880 break;
881 case 'e':
882 case 'E':
883 elite = true;
884 cmdp++;
885 break;
886 case 'k':
887 case 'K':
888 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
889 if (dataLen == 16) {
890 errors = param_gethex(tempStr, 0, KEY, dataLen);
891 } else if (dataLen == 1) {
892 keyNbr = param_get8(Cmd, cmdp+1);
893 if (keyNbr < ICLASS_KEYS_MAX) {
894 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
895 } else {
896 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
897 errors = true;
898 }
899 } else {
900 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
901 errors = true;
902 }
903 cmdp += 2;
904 break;
905 case 'r':
906 case 'R':
907 rawkey = true;
908 cmdp++;
909 break;
910 default:
911 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
912 errors = true;
913 break;
914 }
915 if(errors) return usage_hf_iclass_writeblock();
916 }
917
918 if (cmdp < 6) return usage_hf_iclass_writeblock();
919 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
920 ul_switch_off_field();
921 return ans;
922 }
923
924 int usage_hf_iclass_clone(void) {
925 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
926 PrintAndLog("Options:");
927 PrintAndLog(" f <filename>: specify a filename to clone from");
928 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
929 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
930 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
931 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
932 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
933 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
934 PrintAndLog("Samples:");
935 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
936 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
937 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
938 return -1;
939 }
940
941 int CmdHFiClassCloneTag(const char *Cmd) {
942 char filename[FILE_PATH_SIZE] = {0};
943 char tempStr[50]={0};
944 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
945 uint8_t keyNbr = 0;
946 uint8_t fileNameLen = 0;
947 uint8_t startblock = 0;
948 uint8_t endblock = 0;
949 uint8_t dataLen = 0;
950 bool use_credit_key = false;
951 bool elite = false;
952 bool rawkey = false;
953 bool errors = false;
954 uint8_t cmdp = 0;
955 while(param_getchar(Cmd, cmdp) != 0x00)
956 {
957 switch(param_getchar(Cmd, cmdp))
958 {
959 case 'h':
960 case 'H':
961 return usage_hf_iclass_clone();
962 case 'b':
963 case 'B':
964 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
965 PrintAndLog("Start Block No must include 2 HEX symbols\n");
966 errors = true;
967 }
968 cmdp += 2;
969 break;
970 case 'c':
971 case 'C':
972 use_credit_key = true;
973 cmdp++;
974 break;
975 case 'e':
976 case 'E':
977 elite = true;
978 cmdp++;
979 break;
980 case 'f':
981 case 'F':
982 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
983 if (fileNameLen < 1) {
984 PrintAndLog("No filename found after f");
985 errors = true;
986 }
987 cmdp += 2;
988 break;
989 case 'k':
990 case 'K':
991 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
992 if (dataLen == 16) {
993 errors = param_gethex(tempStr, 0, KEY, dataLen);
994 } else if (dataLen == 1) {
995 keyNbr = param_get8(Cmd, cmdp+1);
996 if (keyNbr < ICLASS_KEYS_MAX) {
997 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
998 } else {
999 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1000 errors = true;
1001 }
1002 } else {
1003 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1004 errors = true;
1005 }
1006 cmdp += 2;
1007 break;
1008 case 'l':
1009 case 'L':
1010 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1011 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1012 errors = true;
1013 }
1014 cmdp += 2;
1015 break;
1016 case 'r':
1017 case 'R':
1018 rawkey = true;
1019 cmdp++;
1020 break;
1021 default:
1022 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1023 errors = true;
1024 break;
1025 }
1026 if(errors) return usage_hf_iclass_clone();
1027 }
1028
1029 if (cmdp < 8) return usage_hf_iclass_clone();
1030
1031 FILE *f;
1032
1033 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1034
1035 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1036 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1037 }
1038 // file handling and reading
1039 f = fopen(filename,"rb");
1040 if(!f) {
1041 PrintAndLog("Failed to read from file '%s'", filename);
1042 return 1;
1043 }
1044
1045 if (startblock<5) {
1046 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1047 fclose(f);
1048 return 0;
1049 }
1050 // now read data from the file from block 6 --- 19
1051 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1052 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1053 // else we have to create a share memory
1054 int i;
1055 fseek(f,startblock*8,SEEK_SET);
1056 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0 ) {
1057 PrintAndLog("File reading error.");
1058 fclose(f);
1059 return 2;
1060 }
1061
1062 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1063 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1064
1065 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
1066 return 0;
1067
1068 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
1069 uint8_t *ptr;
1070 // calculate all mac for every the block we will write
1071 for (i = startblock; i <= endblock; i++){
1072 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1073 // usb command d start pointer = d + (i - 6) * 12
1074 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1075 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1076 // next one
1077 ptr = w.d.asBytes + (i - startblock) * 12;
1078 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1079 memcpy(ptr + 8,MAC, 4);
1080 }
1081 uint8_t p[12];
1082 for (i = 0; i <= endblock - startblock;i++){
1083 memcpy(p,w.d.asBytes + (i * 12),12);
1084 printf("Block |%02x|",i + startblock);
1085 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1086 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1087 }
1088 UsbCommand resp;
1089 SendCommand(&w);
1090 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1091 {
1092 PrintAndLog("Command execute timeout");
1093 return 0;
1094 }
1095 return 1;
1096 }
1097
1098 static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose) {
1099 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1100 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1101
1102 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
1103 return 0;
1104
1105 UsbCommand resp;
1106 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
1107 clearCommandBuffer();
1108 SendCommand(&w);
1109 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1110 {
1111 PrintAndLog("Command execute timeout");
1112 return 0;
1113 }
1114 uint8_t isOK = resp.arg[0] & 0xff;
1115 if (!isOK) {
1116 PrintAndLog("Read Block Failed");
1117 return 0;
1118 }
1119 //data read is stored in: resp.d.asBytes[0-15]
1120 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1121 return 1;
1122 }
1123
1124 int usage_hf_iclass_readblock(void) {
1125 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
1126 PrintAndLog("Options:");
1127 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1128 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1129 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1130 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1131 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
1132 PrintAndLog("Samples:");
1133 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1134 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1135 PrintAndLog(" hf iclass readblk b 0A k 0");
1136 return 0;
1137 }
1138
1139 int CmdHFiClass_ReadBlock(const char *Cmd) {
1140 uint8_t blockno=0;
1141 uint8_t keyType = 0x88; //debit key
1142 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1143 uint8_t keyNbr = 0;
1144 uint8_t dataLen = 0;
1145 char tempStr[50] = {0};
1146 bool elite = false;
1147 bool rawkey = false;
1148 bool errors = false;
1149 uint8_t cmdp = 0;
1150 while(param_getchar(Cmd, cmdp) != 0x00)
1151 {
1152 switch(param_getchar(Cmd, cmdp))
1153 {
1154 case 'h':
1155 case 'H':
1156 return usage_hf_iclass_readblock();
1157 case 'b':
1158 case 'B':
1159 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1160 PrintAndLog("Block No must include 2 HEX symbols\n");
1161 errors = true;
1162 }
1163 cmdp += 2;
1164 break;
1165 case 'c':
1166 case 'C':
1167 keyType = 0x18;
1168 cmdp++;
1169 break;
1170 case 'e':
1171 case 'E':
1172 elite = true;
1173 cmdp++;
1174 break;
1175 case 'k':
1176 case 'K':
1177 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1178 if (dataLen == 16) {
1179 errors = param_gethex(tempStr, 0, KEY, dataLen);
1180 } else if (dataLen == 1) {
1181 keyNbr = param_get8(Cmd, cmdp+1);
1182 if (keyNbr < ICLASS_KEYS_MAX) {
1183 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1184 } else {
1185 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1186 errors = true;
1187 }
1188 } else {
1189 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1190 errors = true;
1191 }
1192 cmdp += 2;
1193 break;
1194 case 'r':
1195 case 'R':
1196 rawkey = true;
1197 cmdp++;
1198 break;
1199 default:
1200 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1201 errors = true;
1202 break;
1203 }
1204 if(errors) return usage_hf_iclass_readblock();
1205 }
1206
1207 if (cmdp < 4) return usage_hf_iclass_readblock();
1208
1209 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true);
1210 }
1211
1212 int CmdHFiClass_loclass(const char *Cmd) {
1213 char opt = param_getchar(Cmd, 0);
1214
1215 if (strlen(Cmd)<1 || opt == 'h') {
1216 PrintAndLog("Usage: hf iclass loclass [options]");
1217 PrintAndLog("Options:");
1218 PrintAndLog("h Show this help");
1219 PrintAndLog("t Perform self-test");
1220 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1221 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1222 PrintAndLog(" malicious CSNs, and their protocol responses");
1223 PrintAndLog(" The binary format of the file is expected to be as follows: ");
1224 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1225 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1226 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1227 PrintAndLog(" ... totalling N*24 bytes");
1228 return 0;
1229 }
1230 char fileName[255] = {0};
1231 if(opt == 'f')
1232 {
1233 if(param_getstr(Cmd, 1, fileName) > 0)
1234 {
1235 return bruteforceFileNoKeys(fileName);
1236 }else
1237 {
1238 PrintAndLog("You must specify a filename");
1239 }
1240 }
1241 else if(opt == 't')
1242 {
1243 int errors = testCipherUtils();
1244 errors += testMAC();
1245 errors += doKeyTests(0);
1246 errors += testElite();
1247 if(errors)
1248 {
1249 prnlog("OBS! There were errors!!!");
1250 }
1251 return errors;
1252 }
1253
1254 return 0;
1255 }
1256
1257 void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1258 uint8_t blockdata[8];
1259 uint8_t mem_config;
1260 memcpy(&mem_config, iclass_dump + 13,1);
1261 uint8_t maxmemcount;
1262 uint8_t filemaxblock = filesize / 8;
1263 if (mem_config & 0x80)
1264 maxmemcount = 255;
1265 else
1266 maxmemcount = 31;
1267 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1268
1269 if (startblock == 0)
1270 startblock = 6;
1271 if ((endblock > maxmemcount) || (endblock == 0))
1272 endblock = maxmemcount;
1273 if (endblock > filemaxblock)
1274 endblock = filemaxblock;
1275 int i = startblock;
1276 int j;
1277 while (i <= endblock){
1278 printf("Block |%02X| ",i);
1279 memcpy(blockdata,iclass_dump + (i * 8),8);
1280 for (j = 0;j < 8;j++)
1281 printf("%02X ",blockdata[j]);
1282 printf("|\n");
1283 i++;
1284 }
1285 }
1286
1287 int usage_hf_iclass_readtagfile() {
1288 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1289 return 1;
1290 }
1291
1292 int CmdHFiClassReadTagFile(const char *Cmd) {
1293 int startblock = 0;
1294 int endblock = 0;
1295 char tempnum[5];
1296 FILE *f;
1297 char filename[FILE_PATH_SIZE];
1298 if (param_getstr(Cmd, 0, filename) < 1)
1299 return usage_hf_iclass_readtagfile();
1300 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1301 startblock = 0;
1302 else
1303 sscanf(tempnum,"%d",&startblock);
1304
1305 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1306 endblock = 0;
1307 else
1308 sscanf(tempnum,"%d",&endblock);
1309 // file handling and reading
1310 f = fopen(filename,"rb");
1311 if(!f) {
1312 PrintAndLog("Failed to read from file '%s'", filename);
1313 return 1;
1314 }
1315 fseek(f, 0, SEEK_END);
1316 long fsize = ftell(f);
1317 fseek(f, 0, SEEK_SET);
1318
1319 if ( fsize < 0 ) {
1320 PrintAndLog("Error, when getting filesize");
1321 fclose(f);
1322 return 1;
1323 }
1324
1325 uint8_t *dump = malloc(fsize);
1326
1327 size_t bytes_read = fread(dump, 1, fsize, f);
1328 fclose(f);
1329 uint8_t *csn = dump;
1330 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
1331 // printIclassDumpInfo(dump);
1332 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1333 free(dump);
1334 return 0;
1335 }
1336
1337 /*
1338 uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1339 uint64_t new_div = 0x00;
1340 new_div ^= sdiv;
1341 new_div ^= hdiv;
1342 return new_div;
1343 }
1344
1345 uint64_t hexarray_to_uint64(uint8_t *key) {
1346 char temp[17];
1347 uint64_t uint_key;
1348 for (int i = 0;i < 8;i++)
1349 sprintf(&temp[(i *2)],"%02X",key[i]);
1350 temp[16] = '\0';
1351 if (sscanf(temp,"%016"llx,&uint_key) < 1)
1352 return 0;
1353 return uint_key;
1354 }
1355 */
1356 void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1357 uint8_t keytable[128] = {0};
1358 uint8_t key_index[8] = {0};
1359 if (elite) {
1360 uint8_t key_sel[8] = { 0 };
1361 uint8_t key_sel_p[8] = { 0 };
1362 hash2(KEY, keytable);
1363 hash1(CSN, key_index);
1364 for(uint8_t i = 0; i < 8 ; i++)
1365 key_sel[i] = keytable[key_index[i]] & 0xFF;
1366
1367 //Permute from iclass format to standard format
1368 permutekey_rev(key_sel, key_sel_p);
1369 diversifyKey(CSN, key_sel_p, div_key);
1370 } else {
1371 diversifyKey(CSN, KEY, div_key);
1372 }
1373 }
1374
1375 //when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1376 //calculate and return xor_div_key (ready for a key write command)
1377 //print all div_keys if verbose
1378 static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1379 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1380 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1381 //get old div key
1382 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1383 //get new div key
1384 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1385
1386 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1387 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1388 }
1389 if (verbose) {
1390 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1391 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1392 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1393 }
1394 }
1395
1396 int usage_hf_iclass_calc_newkey(void) {
1397 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1398 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1399 PrintAndLog(" Options:");
1400 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1401 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1402 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1403 PrintAndLog(" e : specify new key as elite calc");
1404 PrintAndLog(" ee : specify old and new key as elite calc");
1405 PrintAndLog("Samples:");
1406 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1407 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1408 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1409 PrintAndLog("NOTE: * = required\n");
1410
1411 return 1;
1412 }
1413
1414 int CmdHFiClassCalcNewKey(const char *Cmd) {
1415 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1416 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1417 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1418 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1419 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1420 uint8_t keyNbr = 0;
1421 uint8_t dataLen = 0;
1422 char tempStr[50] = {0};
1423 bool givenCSN = false;
1424 bool oldElite = false;
1425 bool elite = false;
1426 bool errors = false;
1427 uint8_t cmdp = 0;
1428 while(param_getchar(Cmd, cmdp) != 0x00)
1429 {
1430 switch(param_getchar(Cmd, cmdp))
1431 {
1432 case 'h':
1433 case 'H':
1434 return usage_hf_iclass_calc_newkey();
1435 case 'e':
1436 case 'E':
1437 dataLen = param_getstr(Cmd, cmdp, tempStr);
1438 if (dataLen==2)
1439 oldElite = true;
1440 elite = true;
1441 cmdp++;
1442 break;
1443 case 'n':
1444 case 'N':
1445 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1446 if (dataLen == 16) {
1447 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1448 } else if (dataLen == 1) {
1449 keyNbr = param_get8(Cmd, cmdp+1);
1450 if (keyNbr < ICLASS_KEYS_MAX) {
1451 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1452 } else {
1453 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1454 errors = true;
1455 }
1456 } else {
1457 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1458 errors = true;
1459 }
1460 cmdp += 2;
1461 break;
1462 case 'o':
1463 case 'O':
1464 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1465 if (dataLen == 16) {
1466 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1467 } else if (dataLen == 1) {
1468 keyNbr = param_get8(Cmd, cmdp+1);
1469 if (keyNbr < ICLASS_KEYS_MAX) {
1470 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1471 } else {
1472 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1473 errors = true;
1474 }
1475 } else {
1476 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1477 errors = true;
1478 }
1479 cmdp += 2;
1480 break;
1481 case 's':
1482 case 'S':
1483 givenCSN = true;
1484 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1485 return usage_hf_iclass_calc_newkey();
1486 cmdp += 2;
1487 break;
1488 default:
1489 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1490 errors = true;
1491 break;
1492 }
1493 if(errors) return usage_hf_iclass_calc_newkey();
1494 }
1495
1496 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1497
1498 if (!givenCSN)
1499 if (!select_only(CSN, CCNR, false, true))
1500 return 0;
1501
1502 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1503 return 0;
1504 }
1505
1506 static int loadKeys(char *filename) {
1507 FILE *f;
1508 f = fopen(filename,"rb");
1509 if(!f) {
1510 PrintAndLog("Failed to read from file '%s'", filename);
1511 return 0;
1512 }
1513 fseek(f, 0, SEEK_END);
1514 long fsize = ftell(f);
1515 fseek(f, 0, SEEK_SET);
1516
1517 if ( fsize < 0 ) {
1518 PrintAndLog("Error, when getting filesize");
1519 fclose(f);
1520 return 1;
1521 }
1522
1523 uint8_t *dump = malloc(fsize);
1524
1525 size_t bytes_read = fread(dump, 1, fsize, f);
1526 fclose(f);
1527 if (bytes_read > ICLASS_KEYS_MAX * 8){
1528 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1529 free(dump);
1530 return 0;
1531 }
1532 uint8_t i = 0;
1533 for (; i < bytes_read/8; i++){
1534 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1535 }
1536 free(dump);
1537 PrintAndLog("%u keys loaded", i);
1538 return 1;
1539 }
1540
1541 static int saveKeys(char *filename) {
1542 FILE *f;
1543 f = fopen(filename,"wb");
1544 if (f == NULL) {
1545 printf("error opening file %s\n",filename);
1546 return 0;
1547 }
1548 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1549 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1550 PrintAndLog("save key failed to write to file: %s", filename);
1551 break;
1552 }
1553 }
1554 fclose(f);
1555 return 0;
1556 }
1557
1558 static int printKeys(void) {
1559 PrintAndLog("");
1560 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1561 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1562 }
1563 PrintAndLog("");
1564 return 0;
1565 }
1566
1567 int usage_hf_iclass_managekeys(void) {
1568 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1569 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1570 PrintAndLog(" Options:");
1571 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1572 PrintAndLog(" k <key> : set a key in memory");
1573 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1574 PrintAndLog(" s : save keys in memory to file specified by filename");
1575 PrintAndLog(" l : load keys to memory from file specified by filename");
1576 PrintAndLog(" p : print keys loaded into memory\n");
1577 PrintAndLog("Samples:");
1578 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1579 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1580 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1581 PrintAndLog(" print keys : hf iclass managekeys p\n");
1582 return 0;
1583 }
1584
1585 int CmdHFiClassManageKeys(const char *Cmd) {
1586 uint8_t keyNbr = 0;
1587 uint8_t dataLen = 0;
1588 uint8_t KEY[8] = {0};
1589 char filename[FILE_PATH_SIZE];
1590 uint8_t fileNameLen = 0;
1591 bool errors = false;
1592 uint8_t operation = 0;
1593 char tempStr[20];
1594 uint8_t cmdp = 0;
1595
1596 while(param_getchar(Cmd, cmdp) != 0x00)
1597 {
1598 switch(param_getchar(Cmd, cmdp))
1599 {
1600 case 'h':
1601 case 'H':
1602 return usage_hf_iclass_managekeys();
1603 case 'f':
1604 case 'F':
1605 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1606 if (fileNameLen < 1) {
1607 PrintAndLog("No filename found after f");
1608 errors = true;
1609 }
1610 cmdp += 2;
1611 break;
1612 case 'n':
1613 case 'N':
1614 keyNbr = param_get8(Cmd, cmdp+1);
1615 if (keyNbr >= ICLASS_KEYS_MAX) {
1616 PrintAndLog("Invalid block number");
1617 errors = true;
1618 }
1619 cmdp += 2;
1620 break;
1621 case 'k':
1622 case 'K':
1623 operation += 3; //set key
1624 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1625 if (dataLen == 16) { //ul-c or ev1/ntag key length
1626 errors = param_gethex(tempStr, 0, KEY, dataLen);
1627 } else {
1628 PrintAndLog("\nERROR: Key is incorrect length\n");
1629 errors = true;
1630 }
1631 cmdp += 2;
1632 break;
1633 case 'p':
1634 case 'P':
1635 operation += 4; //print keys in memory
1636 cmdp++;
1637 break;
1638 case 'l':
1639 case 'L':
1640 operation += 5; //load keys from file
1641 cmdp++;
1642 break;
1643 case 's':
1644 case 'S':
1645 operation += 6; //save keys to file
1646 cmdp++;
1647 break;
1648 default:
1649 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1650 errors = true;
1651 break;
1652 }
1653 if(errors) return usage_hf_iclass_managekeys();
1654 }
1655 if (operation == 0){
1656 PrintAndLog("no operation specified (load, save, or print)\n");
1657 return usage_hf_iclass_managekeys();
1658 }
1659 if (operation > 6){
1660 PrintAndLog("Too many operations specified\n");
1661 return usage_hf_iclass_managekeys();
1662 }
1663 if (operation > 4 && fileNameLen == 0){
1664 PrintAndLog("You must enter a filename when loading or saving\n");
1665 return usage_hf_iclass_managekeys();
1666 }
1667
1668 switch (operation){
1669 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1670 case 4: return printKeys();
1671 case 5: return loadKeys(filename);
1672 case 6: return saveKeys(filename);
1673 break;
1674 }
1675 return 0;
1676 }
1677
1678 static command_t CommandTable[] =
1679 {
1680 {"help", CmdHelp, 1, "This help"},
1681 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1682 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1683 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1684 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1685 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1686 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1687 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1688 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1689 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1690 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1691 {"reader", CmdHFiClassReader, 0, " Read an iClass tag"},
1692 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1693 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1694 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1695 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1696 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
1697 {NULL, NULL, 0, NULL}
1698 };
1699
1700 int CmdHFiClass(const char *Cmd)
1701 {
1702 CmdsParse(CommandTable, Cmd);
1703 return 0;
1704 }
1705
1706 int CmdHelp(const char *Cmd)
1707 {
1708 CmdsHelp(CommandTable);
1709 return 0;
1710 }
Proxmark3 GIT tracking
Impressum, Datenschutz