git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhficlass.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
   3 // Copyright (C) 2011 Gerhard de Koning Gans
   4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
   5 //
   6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   7 // at your option, any later version. See the LICENSE.txt file for the text of
   8 // the license.
   9 //-----------------------------------------------------------------------------
  10 // High frequency iClass commands
  11 //-----------------------------------------------------------------------------
  12
  13 #include <stdio.h>
  14 #include <stdlib.h>
  15 #include <string.h>
  16 #include <sys/stat.h>
  17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
  18 #include "data.h"
  19 //#include "proxusb.h"
  20 #include "proxmark3.h"
  21 #include "ui.h"
  22 #include "cmdparser.h"
  23 #include "cmdhficlass.h"
  24 #include "common.h"
  25 #include "util.h"
  26 #include "cmdmain.h"
  27 #include "loclass/des.h"
  28 #include "loclass/cipherutils.h"
  29 #include "loclass/cipher.h"
  30 #include "loclass/ikeys.h"
  31 #include "loclass/elite_crack.h"
  32 #include "loclass/fileutils.h"
  33
  34 static int CmdHelp(const char *Cmd);
  35
  36 int xorbits_8(uint8_t val)
  37 {
  38     uint8_t res = val ^ (val >> 1); //1st pass
  39     res = res ^ (res >> 1);             // 2nd pass
  40     res = res ^ (res >> 2);             // 3rd pass
  41     res = res ^ (res >> 4);                     // 4th pass
  42     return res & 1;
  43 }
  44
  45 int CmdHFiClassList(const char *Cmd)
  46 {
  47
  48         bool ShowWaitCycles = false;
  49         char param = param_getchar(Cmd, 0);
  50
  51         if (param != 0) {
  52                 PrintAndLog("List data in trace buffer.");
  53                 PrintAndLog("Usage:  hf iclass list");
  54                 PrintAndLog("h - help");
  55                 PrintAndLog("sample: hf iclass list");
  56                 return 0;
  57         }
  58
  59         uint8_t got[1920];
  60         GetFromBigBuf(got,sizeof(got),0);
  61         WaitForResponse(CMD_ACK,NULL);
  62
  63         PrintAndLog("Recorded Activity");
  64         PrintAndLog("");
  65         PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
  66         PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
  67         PrintAndLog("");
  68         PrintAndLog("     Start |       End | Src | Data");
  69         PrintAndLog("-----------|-----------|-----|--------");
  70
  71         int i;
  72         uint32_t first_timestamp = 0;
  73         uint32_t timestamp;
  74         bool tagToReader;
  75         uint32_t parityBits;
  76         uint8_t len;
  77         uint8_t *frame;
  78         uint32_t EndOfTransmissionTimestamp = 0;
  79
  80
  81         for( i=0; i < 1900;)
  82         {
  83                 //First 32 bits contain
  84                 // isResponse (1 bit)
  85                 // timestamp (remaining)
  86                 //Then paritybits
  87                 //Then length
  88                 timestamp = *((uint32_t *)(got+i));
  89                 parityBits = *((uint32_t *)(got+i+4));
  90                 len = got[i+8];
  91         frame = (got+i+9);
  92                 uint32_t next_timestamp = (*((uint32_t *)(got+i+9))) & 0x7fffffff;
  93
  94                 tagToReader = timestamp & 0x80000000;
  95                 timestamp &= 0x7fffffff;
  96
  97                 if(i==0) {
  98                         first_timestamp = timestamp;
  99                 }
 100
 101         // Break and stick with current result idf buffer was not completely full
 102                 if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;
 103
 104                 char line[1000] = "";
 105
 106                 if(len)//We have some data to display
 107                 {
 108                         int j,oddparity;
 109
 110                         for(j = 0; j < len ; j++)
 111                         {
 112                                 oddparity = 0x01 ^ xorbits_8(frame[j] & 0xFF);
 113
 114                                 if (tagToReader && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
 115                                         sprintf(line+(j*4), "%02x!  ", frame[j]);
 116                                 } else {
 117                                         sprintf(line+(j*4), "%02x   ", frame[j]);
 118                                 }
 119                         }
 120                 }else
 121                 {
 122                         if (ShowWaitCycles) {
 123                                 sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
 124                         }
 125                 }
 126
 127                 char *crc = "";
 128
 129                 if(len > 2)
 130                 {
 131                         uint8_t b1, b2;
 132                         if(!tagToReader && len == 4) {
 133                                 // Rough guess that this is a command from the reader
 134                                 // For iClass the command byte is not part of the CRC
 135                                         ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
 136                         }
 137                         else {
 138                                   // For other data.. CRC might not be applicable (UPDATE commands etc.)
 139                                 ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
 140                         }
 141
 142                         if (b1 != frame[len-2] || b2 != frame[len-1]) {
 143                                 crc = (tagToReader & (len < 8)) ? "" : " !crc";
 144                         }
 145                 }
 146
 147                 i += (len + 9);
 148                 EndOfTransmissionTimestamp = (*((uint32_t *)(got+i))) & 0x7fffffff;
 149
 150                 // Not implemented for iclass on the ARM-side
 151                 //if (!ShowWaitCycles) i += 9;
 152
 153                 PrintAndLog(" %9d | %9d | %s | %s %s",
 154                         (timestamp - first_timestamp),
 155                         (EndOfTransmissionTimestamp - first_timestamp),
 156                         (len?(tagToReader ? "Tag" : "Rdr"):"   "),
 157                         line, crc);
 158         }
 159         return 0;
 160 }
 161
 162 int CmdHFiClassListOld(const char *Cmd)
 163 {
 164   uint8_t got[1920];
 165   GetFromBigBuf(got,sizeof(got),0);
 166
 167   PrintAndLog("recorded activity:");
 168   PrintAndLog(" ETU     :rssi: who bytes");
 169   PrintAndLog("---------+----+----+-----------");
 170
 171   int i = 0;
 172   int prev = -1;
 173
 174   for (;;) {
 175     if(i >= 1900) {
 176       break;
 177     }
 178
 179     bool isResponse;
 180     int timestamp = *((uint32_t *)(got+i));
 181     if (timestamp & 0x80000000) {
 182       timestamp &= 0x7fffffff;
 183       isResponse = 1;
 184     } else {
 185       isResponse = 0;
 186     }
 187
 188
 189     int metric = 0;
 190
 191     int parityBits = *((uint32_t *)(got+i+4));
 192     // 4 bytes of additional information...
 193     // maximum of 32 additional parity bit information
 194     //
 195     // TODO:
 196     // at each quarter bit period we can send power level (16 levels)
 197     // or each half bit period in 256 levels.
 198
 199
 200     int len = got[i+8];
 201
 202     if (len > 100) {
 203       break;
 204     }
 205     if (i + len >= 1900) {
 206       break;
 207     }
 208
 209     uint8_t *frame = (got+i+9);
 210
 211     // Break and stick with current result if buffer was not completely full
 212     if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }
 213
 214     char line[1000] = "";
 215     int j;
 216     for (j = 0; j < len; j++) {
 217       int oddparity = 0x01;
 218       int k;
 219
 220       for (k=0;k<8;k++) {
 221         oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
 222       }
 223
 224       //if((parityBits >> (len - j - 1)) & 0x01) {
 225       if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
 226         sprintf(line+(j*4), "%02x!  ", frame[j]);
 227       }
 228       else {
 229         sprintf(line+(j*4), "%02x   ", frame[j]);
 230       }
 231     }
 232
 233     char *crc;
 234     crc = "";
 235     if (len > 2) {
 236       uint8_t b1, b2;
 237       for (j = 0; j < (len - 1); j++) {
 238         // gives problems... search for the reason..
 239         /*if(frame[j] == 0xAA) {
 240           switch(frame[j+1]) {
 241             case 0x01:
 242               crc = "[1] Two drops close after each other";
 243             break;
 244             case 0x02:
 245               crc = "[2] Potential SOC with a drop in second half of bitperiod";
 246               break;
 247             case 0x03:
 248               crc = "[3] Segment Z after segment X is not possible";
 249               break;
 250             case 0x04:
 251               crc = "[4] Parity bit of a fully received byte was wrong";
 252               break;
 253             default:
 254               crc = "[?] Unknown error";
 255               break;
 256           }
 257           break;
 258         }*/
 259       }
 260
 261       if (strlen(crc)==0) {
 262         if(!isResponse && len == 4) {
 263                 // Rough guess that this is a command from the reader
 264                 // For iClass the command byte is not part of the CRC
 265                 ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
 266         }
 267         else {
 268                 // For other data.. CRC might not be applicable (UPDATE commands etc.)
 269                 ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
 270         }
 271         //printf("%1x %1x",(unsigned)b1,(unsigned)b2);
 272         if (b1 != frame[len-2] || b2 != frame[len-1]) {
 273           crc = (isResponse & (len < 8)) ? "" : " !crc";
 274         } else {
 275           crc = "";
 276         }
 277       }
 278     } else {
 279       crc = ""; // SHORT
 280     }
 281
 282     char metricString[100];
 283     if (isResponse) {
 284       sprintf(metricString, "%3d", metric);
 285     } else {
 286       strcpy(metricString, "   ");
 287     }
 288
 289     PrintAndLog(" +%7d: %s: %s %s %s",
 290       (prev < 0 ? 0 : (timestamp - prev)),
 291       metricString,
 292       (isResponse ? "TAG" : "   "), line, crc);
 293
 294     prev = timestamp;
 295     i += (len + 9);
 296   }
 297   return 0;
 298 }
 299
 300 int CmdHFiClassSnoop(const char *Cmd)
 301 {
 302   UsbCommand c = {CMD_SNOOP_ICLASS};
 303   SendCommand(&c);
 304   return 0;
 305 }
 306
 307 int CmdHFiClassSim(const char *Cmd)
 308 {
 309   uint8_t simType = 0;
 310   uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
 311
 312   if (strlen(Cmd)<1) {
 313         PrintAndLog("Usage:  hf iclass sim [0 <CSN>] | x");
 314         PrintAndLog("        options");
 315         PrintAndLog("                0 <CSN> simulate the given CSN");
 316         PrintAndLog("                1       simulate default CSN");
 317         PrintAndLog("                2       iterate CSNs, gather MACs");
 318         PrintAndLog("        sample: hf iclass sim 0 031FEC8AF7FF12E0");
 319         PrintAndLog("        sample: hf iclass sim 2");
 320         return 0;
 321   }
 322
 323   simType = param_get8(Cmd, 0);
 324
 325   if(simType == 0)
 326   {
 327           if (param_gethex(Cmd, 1, CSN, 16)) {
 328                   PrintAndLog("A CSN should consist of 16 HEX symbols");
 329                   return 1;
 330           }
 331           PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
 332
 333   }
 334   if(simType > 2)
 335   {
 336           PrintAndLog("Undefined simptype %d", simType);
 337           return 1;
 338   }
 339   uint8_t numberOfCSNs=0;
 340
 341         if(simType == 2)
 342         {
 343                 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,63}};
 344                 UsbCommand resp = {0};
 345
 346                 uint8_t csns[64] = {
 347                          0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,
 348                          0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,
 349                          0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,
 350                          0x17,0x12,0x01,0xfd,0xf7,0xff,0x12,0xe0 ,
 351                          0xcd,0x56,0x01,0x7c,0x6f,0xff,0x12,0xe0 ,
 352                          0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,
 353                          0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,
 354                          0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };
 355
 356                 memcpy(c.d.asBytes, csns, 64);
 357
 358                 SendCommand(&c);
 359                 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
 360                         PrintAndLog("Command timed out");
 361                         return 0;
 362                 }
 363
 364                 uint8_t num_mac_responses  = resp.arg[1];
 365                 PrintAndLog("Mac responses: %d MACs obtained (should be 8)", num_mac_responses);
 366
 367                 size_t datalen = 8*24;
 368                 /*
 369                  * Now, time to dump to file. We'll use this format:
 370                  * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
 371                  * So, it should wind up as
 372                  * 8 * 24 bytes.
 373                  *
 374                  * The returndata from the pm3 is on the following format
 375                  * <4 byte NR><4 byte MAC>
 376                  * CC are all zeroes, CSN is the same as was sent in
 377                  **/
 378                 void* dump = malloc(datalen);
 379                 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
 380                 uint8_t i = 0;
 381                 for(i = 0 ; i < 8 ; i++)
 382                 {
 383                         memcpy(dump+i*24, csns+i*8,8); //CSN
 384                         //8 zero bytes here...
 385                         //Then comes NR_MAC (eight bytes from the response)
 386                         memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
 387
 388                 }
 389                 /** Now, save to dumpfile **/
 390                 saveFile("iclass_mac_attack", "bin", dump,datalen);
 391                 free(dump);
 392         }else
 393         {
 394                 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
 395                 memcpy(c.d.asBytes, CSN, 8);
 396                 SendCommand(&c);
 397         }
 398
 399   return 0;
 400 }
 401
 402 int CmdHFiClassReader(const char *Cmd)
 403 {
 404   UsbCommand c = {CMD_READER_ICLASS, {0}};
 405   SendCommand(&c);
 406     UsbCommand resp;
 407   while(!ukbhit()){
 408       if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
 409             uint8_t isOK    = resp.arg[0] & 0xff;
 410             uint8_t * data  = resp.d.asBytes;
 411
 412             PrintAndLog("isOk:%02x", isOK);
 413
 414             if(isOK > 0)
 415             {
 416                 PrintAndLog("CSN: %s",sprint_hex(data,8));
 417             }
 418             if(isOK >= 1)
 419             {
 420                 PrintAndLog("CC: %s",sprint_hex(data+8,8));
 421             }else{
 422                 PrintAndLog("No CC obtained");
 423             }
 424         } else {
 425             PrintAndLog("Command execute timeout");
 426         }
 427     }
 428
 429   return 0;
 430 }
 431
 432 int CmdHFiClassReader_Replay(const char *Cmd)
 433 {
 434   uint8_t readerType = 0;
 435   uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
 436
 437   if (strlen(Cmd)<1) {
 438     PrintAndLog("Usage:  hf iclass replay <MAC>");
 439     PrintAndLog("        sample: hf iclass replay 00112233");
 440     return 0;
 441   }
 442
 443   if (param_gethex(Cmd, 0, MAC, 8)) {
 444     PrintAndLog("MAC must include 8 HEX symbols");
 445     return 1;
 446   }
 447
 448   UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
 449   memcpy(c.d.asBytes, MAC, 4);
 450   SendCommand(&c);
 451
 452   return 0;
 453 }
 454
 455 int CmdHFiClassReader_Dump(const char *Cmd)
 456 {
 457   uint8_t readerType = 0;
 458   uint8_t MAC[4]={0x00,0x00,0x00,0x00};
 459   uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 460   uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 461   uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 462   //uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 463   uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 464
 465   if (strlen(Cmd)<1)
 466   {
 467     PrintAndLog("Usage:  hf iclass dump <Key>");
 468     PrintAndLog("        sample: hf iclass dump 0011223344556677");
 469     return 0;
 470   }
 471
 472   if (param_gethex(Cmd, 0, KEY, 16))
 473   {
 474     PrintAndLog("KEY must include 16 HEX symbols");
 475     return 1;
 476   }
 477
 478   UsbCommand c = {CMD_READER_ICLASS, {0}};
 479   c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE;
 480
 481   SendCommand(&c);
 482
 483   UsbCommand resp;
 484
 485   if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
 486         uint8_t isOK    = resp.arg[0] & 0xff;
 487         uint8_t * data  = resp.d.asBytes;
 488
 489         memcpy(CSN,data,8);
 490         memcpy(CCNR,data+8,8);
 491
 492         PrintAndLog("isOk:%02x", isOK);
 493
 494         if(isOK > 0)
 495         {
 496             PrintAndLog("CSN: %s",sprint_hex(CSN,8));
 497         }
 498         if(isOK >= 1)
 499         {
 500             //PrintAndLog("CC: %s",sprint_hex(CCNR,8));
 501             diversifyKey(CSN,KEY, div_key);
 502             doMAC(CCNR,12,div_key, MAC);
 503             PrintAndLog("MAC:  %s",sprint_hex(MAC,sizeof(MAC)));
 504             UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
 505             memcpy(d.d.asBytes, MAC, 4);
 506             SendCommand(&d);
 507
 508         }else{
 509             PrintAndLog("Failed to obtain CC! Aborting");
 510         }
 511     } else {
 512         PrintAndLog("Command execute timeout");
 513     }
 514
 515   return 0;
 516 }
 517
 518 int CmdHFiClass_iso14443A_write(const char *Cmd)
 519 {
 520   uint8_t readerType = 0;
 521   uint8_t MAC[4]={0x00,0x00,0x00,0x00};
 522   uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 523   uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 524   uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 525   uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 526
 527   uint8_t blockNo=0;
 528   uint8_t bldata[8]={0};
 529
 530   if (strlen(Cmd)<3)
 531   {
 532     PrintAndLog("Usage:  hf iclass write <Key> <Block> <Data>");
 533     PrintAndLog("        sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
 534     return 0;
 535   }
 536
 537   if (param_gethex(Cmd, 0, KEY, 16))
 538   {
 539     PrintAndLog("KEY must include 16 HEX symbols");
 540     return 1;
 541   }
 542
 543   blockNo = param_get8(Cmd, 1);
 544   if (blockNo>32)
 545   {
 546         PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
 547         return 1;
 548   }
 549   if (param_gethex(Cmd, 2, bldata, 8))
 550   {
 551         PrintAndLog("Block data must include 8 HEX symbols");
 552         return 1;
 553   }
 554
 555   UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};
 556   SendCommand(&c);
 557   UsbCommand resp;
 558
 559   if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
 560     uint8_t isOK    = resp.arg[0] & 0xff;
 561     uint8_t * data  = resp.d.asBytes;
 562
 563     memcpy(CSN,data,8);
 564     memcpy(CCNR,data+8,8);
 565     PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
 566     PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
 567         PrintAndLog("isOk:%02x", isOK);
 568   } else {
 569         PrintAndLog("Command execute timeout");
 570   }
 571
 572   diversifyKey(CSN,KEY, div_key);
 573
 574   PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
 575   doMAC(CCNR, 12,div_key, MAC);
 576
 577   UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
 578   memcpy(c2.d.asBytes, bldata, 8);
 579   memcpy(c2.d.asBytes+8, MAC, 4);
 580   SendCommand(&c2);
 581
 582   if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 583     uint8_t isOK    = resp.arg[0] & 0xff;
 584     uint8_t * data  = resp.d.asBytes;
 585
 586     if (isOK)
 587       PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
 588     else
 589       PrintAndLog("isOk:%02x", isOK);
 590   } else {
 591       PrintAndLog("Command execute timeout");
 592   }
 593   return 0;
 594 }
 595
 596
 597 static command_t CommandTable[] =
 598 {
 599   {"help",      CmdHelp,                        1,      "This help"},
 600   {"list",      CmdHFiClassList,        0,      "List iClass history"},
 601   {"snoop",     CmdHFiClassSnoop,       0,      "Eavesdrop iClass communication"},
 602   {"sim",       CmdHFiClassSim,         0,      "Simulate iClass tag"},
 603   {"reader",CmdHFiClassReader,  0,      "Read an iClass tag"},
 604   {"replay",CmdHFiClassReader_Replay,   0,      "Read an iClass tag via Reply Attack"},
 605   {"dump",      CmdHFiClassReader_Dump, 0,              "Authenticate and Dump iClass tag"},
 606   {"write",     CmdHFiClass_iso14443A_write,    0,      "Authenticate and Write iClass block"},
 607   {NULL, NULL, 0, NULL}
 608 };
 609
 610 int CmdHFiClass(const char *Cmd)
 611 {
 612   CmdsParse(CommandTable, Cmd);
 613   return 0;
 614 }
 615
 616 int CmdHelp(const char *Cmd)
 617 {
 618   CmdsHelp(CommandTable);
 619   return 0;
 620 }