From a4ff62be63ca2a81071e9aa2b882bd3ff57f13ad Mon Sep 17 00:00:00 2001 From: pwpiwi Date: Sat, 28 Dec 2019 17:03:20 +0100 Subject: [PATCH] fix 'hf iclass writebl' and 'hf iclass clone' (#896) * check for correct responses after block updates * reduce number of tries from 10 to 3 * Allow to override warning on attempt to clone blocks < 5 * add same warning and override option to 'hf iclass writebl' * some reformatting and minor refactoring * Drop field after dump and clone functions * If dumping AA1 with Credit Key, authenticate as Debit Key * Initialize reader when beginning to clone --- armsrc/iclass.c | 38 +++++++++---- client/cmdhficlass.c | 127 +++++++++++++++++++++++++------------------ 2 files changed, 102 insertions(+), 63 deletions(-) diff --git a/armsrc/iclass.c b/armsrc/iclass.c index 2a819855..28cfcaa6 100644 --- a/armsrc/iclass.c +++ b/armsrc/iclass.c @@ -848,6 +848,9 @@ void iClass_Dump(uint8_t startblock, uint8_t numblks) { } } + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + LED_D_OFF(); + cmd_send(CMD_ACK, isOK, blkCnt, 0, readblockdata, blkCnt*8); LED_A_OFF(); @@ -863,12 +866,27 @@ static bool iClass_WriteBlock_ext(uint8_t blockNo, uint8_t *data) { bool isOK = false; uint32_t eof_time = 0; - isOK = sendCmdGetResponseWithRetries(write, sizeof(write), resp, sizeof(resp), 10, 10, 0, ICLASS_READER_TIMEOUT_UPDATE, &eof_time); - if (isOK && blockNo != 3 && blockNo != 4 && memcmp(write+2, resp, 8)) { // check response - isOK = false; + isOK = sendCmdGetResponseWithRetries(write, sizeof(write), resp, sizeof(resp), 10, 3, 0, ICLASS_READER_TIMEOUT_UPDATE, &eof_time); + if (!isOK) { + return false; + } + + uint8_t all_ff[8] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; + if (blockNo == 2) { + if (memcmp(data+4, resp, 4) || memcmp(data, resp+4, 4)) { // check response. e-purse update swaps first and second half + return false; + } + } else if (blockNo == 3 || blockNo == 4) { + if (memcmp(all_ff, resp, 8)) { // check response. Key updates always return 0xffffffffffffffff + return false; + } + } else { + if (memcmp(data, resp, 8)) { // check response. All other updates return unchanged data + return false; + } } - return isOK; + return true; } @@ -895,17 +913,16 @@ void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) { LED_A_ON(); - int i; int written = 0; int total_blocks = (endblock - startblock) + 1; - for (i = 0; i < total_blocks; i++) { + for (uint8_t block = startblock; block <= endblock; block++) { // block number - if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){ - Dbprintf("Write block [%02x] successful", i + startblock); + if (iClass_WriteBlock_ext(block, data + (block-startblock)*12)) { + Dbprintf("Write block [%02x] successful", block); written++; } else { - Dbprintf("Write block [%02x] failed", i + startblock); + Dbprintf("Write block [%02x] failed", block); } } @@ -914,9 +931,10 @@ void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) { else Dbprintf("Clone incomplete"); - cmd_send(CMD_ACK, 1, 0, 0, 0, 0); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LED_D_OFF(); + cmd_send(CMD_ACK, 1, 0, 0, 0, 0); + LED_A_OFF(); } diff --git a/client/cmdhficlass.c b/client/cmdhficlass.c index 9d7e6af0..1400395a 100644 --- a/client/cmdhficlass.c +++ b/client/cmdhficlass.c @@ -51,11 +51,6 @@ static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = { }; -typedef struct iclass_block { - uint8_t d[8]; -} iclass_block_t; - - // iclass / picopass chip config structures and shared routines typedef struct { uint8_t app_limit; //[8] @@ -882,11 +877,11 @@ static int CmdHFiClassReader_Dump(const char *Cmd) { if (keyNbr < ICLASS_KEYS_MAX) { memcpy(KEY, iClass_Key_Table[keyNbr], 8); } else { - PrintAndLog("\nERROR: Credit KeyNbr is invalid\n"); + PrintAndLog("\nERROR: Debit KeyNbr is invalid\n"); errors = true; } } else { - PrintAndLog("\nERROR: Credit Key is incorrect length\n"); + PrintAndLog("\nERROR: Debit Key is incorrect length\n"); errors = true; } cmdp += 2; @@ -925,7 +920,6 @@ static int CmdHFiClassReader_Dump(const char *Cmd) { // if only credit key is given: try for AA1 as well (not for iclass but for some picopass this will work) if (!have_debit_key && have_credit_key) { - use_credit_key = true; memcpy(KEY, CreditKEY, 8); } @@ -959,7 +953,7 @@ static int CmdHFiClassReader_Dump(const char *Cmd) { } // authenticate with debit key (or credit key if we have no debit key) and get div_key - later store in dump block 3 - if (!iClass_authenticate(tag_data, KEY, MAC, div_key, use_credit_key, elite, rawkey, NRMAC_replay, verbose)){ + if (!iClass_authenticate(tag_data, KEY, MAC, div_key, false, elite, rawkey, NRMAC_replay, verbose)) { DropField(); return 0; } @@ -1098,23 +1092,25 @@ static void usage_hf_iclass_writeblock(void) { PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n"); PrintAndLog(" e : If 'e' is specified, elite computations applied to key"); PrintAndLog(" r : If 'r' is specified, no computations applied to key"); + PrintAndLog(" o : override protection and allow modification of blocks 0...4"); PrintAndLog("Samples:"); PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B"); PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c"); - PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0"); + PrintAndLog(" hf iclass writeblk b 03 d AAAAAAAAAAAAAAAA k 001122334455667B c o"); } static int CmdHFiClass_WriteBlock(const char *Cmd) { - uint8_t blockno=0; - uint8_t bldata[8]={0,0,0,0,0,0,0,0}; - uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}; + uint8_t blockno = 0; + uint8_t bldata[8] = {0}; + uint8_t KEY[8] = {0}; uint8_t keyNbr = 0; uint8_t dataLen = 0; char tempStr[50] = {0}; bool use_credit_key = false; bool elite = false; bool rawkey = false; + bool override_protection = false; bool errors = false; uint8_t cmdp = 0; @@ -1174,6 +1170,11 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) { rawkey = true; cmdp++; break; + case 'o': + case 'O': + override_protection = true; + cmdp++; + break; default: PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp)); errors = true; @@ -1194,14 +1195,26 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) { usage_hf_iclass_writeblock(); return 0; } + + if (blockno < 5) { + if (override_protection) { + PrintAndLog("Info: modifying keys, e-purse or configuration block."); + } else { + PrintAndLog("You are going to modify keys, e-purse or configuration block."); + PrintAndLog("You must add the 'o' (override) option to confirm that you know what you are doing"); + return 0; + } + } + int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, false, true); + DropField(); return ans; } static void usage_hf_iclass_clone(void) { - PrintAndLog("Usage: hf iclass clone f b l k c e|r"); + PrintAndLog("Usage: hf iclass clone f b l k c e|r o"); PrintAndLog("Options:"); PrintAndLog(" f : specify a filename to clone from"); PrintAndLog(" b : The first block to clone as 2 hex symbols"); @@ -1210,10 +1223,13 @@ static void usage_hf_iclass_clone(void) { PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n"); PrintAndLog(" e : If 'e' is specified, elite computations applied to key"); PrintAndLog(" r : If 'r' is specified, no computations applied to key"); + PrintAndLog(" o : override protection and allow modification of target blocks 0...4"); PrintAndLog("Samples:"); PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e"); PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0"); PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e"); + PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e"); + PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 03 l 19 k 0 e o"); } @@ -1229,6 +1245,7 @@ static int CmdHFiClassCloneTag(const char *Cmd) { bool use_credit_key = false; bool elite = false; bool rawkey = false; + bool override_protection = false; bool errors = false; uint8_t cmdp = 0; @@ -1297,6 +1314,11 @@ static int CmdHFiClassCloneTag(const char *Cmd) { rawkey = true; cmdp++; break; + case 'o': + case 'O': + override_protection = true; + cmdp++; + break; default: PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp)); errors = true; @@ -1313,75 +1335,74 @@ static int CmdHFiClassCloneTag(const char *Cmd) { return 0; } - FILE *f; - - iclass_block_t tag_data[USB_CMD_DATA_SIZE/12]; - - if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) { - PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8); + if (startblock < 5) { + if (override_protection) { + PrintAndLog("Info: modifying keys, e-purse or configuration block."); + } else { + PrintAndLog("You are going to modify keys, e-purse or configuration block."); + PrintAndLog("You must add the 'o' (override) option to confirm that you know what you are doing"); + return 0; + } + } + + if ((endblock - startblock + 1) * 12 > USB_CMD_DATA_SIZE) { + PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/12); } + // file handling and reading + FILE *f; f = fopen(filename,"rb"); if (!f) { PrintAndLog("Failed to read from file '%s'", filename); return 1; } - if (startblock<5) { - PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4"); - fclose(f); - return 0; - } - // now read data from the file from block 6 --- 19 - // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data - // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time, - // else we have to create a share memory - int i; + uint8_t tag_data[USB_CMD_DATA_SIZE/12][8]; fseek(f, startblock*8, SEEK_SET); - if (fread(tag_data, sizeof(iclass_block_t), endblock - startblock + 1, f) == 0 ) { - PrintAndLog("File reading error."); - fclose(f); - return 2; + for (int i = 0; i < endblock - startblock + 1; i++) { + if (fread(&tag_data[i], 1, 8, f) == 0 ) { + PrintAndLog("File reading error."); + fclose(f); + return 2; + } } - uint8_t MAC[4]={0x00,0x00,0x00,0x00}; - uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}; + uint8_t MAC[4] = {0x00, 0x00, 0x00, 0x00}; + uint8_t div_key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; uint8_t CSN[8]; - if (!iClass_select(CSN, true, false, false) || !iClass_authenticate(CSN, KEY, MAC, div_key, use_credit_key, elite, rawkey, false, true)) { + if (!iClass_select(CSN, true, true, true) || !iClass_authenticate(CSN, KEY, MAC, div_key, use_credit_key, elite, rawkey, false, true)) { DropField(); return 0; } UsbCommand w = {CMD_ICLASS_CLONE, {startblock, endblock}}; uint8_t *ptr; - // calculate all mac for every the block we will write - for (i = startblock; i <= endblock; i++) { - Calc_wb_mac(i, tag_data[i - startblock].d, div_key, MAC); - // usb command d start pointer = d + (i - 6) * 12 - // memcpy(pointer,tag_data[i - 6],8) 8 bytes - // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes; - // next one - ptr = w.d.asBytes + (i - startblock) * 12; - memcpy(ptr, &(tag_data[i - startblock].d[0]), 8); - memcpy(ptr + 8,MAC, 4); + // calculate MAC for every block we will write + for (int i = 0; i < endblock - startblock + 1; i++) { + Calc_wb_mac(startblock + i, tag_data[i], div_key, MAC); + ptr = w.d.asBytes + i * 12; + memcpy(ptr, tag_data[i], 8); + memcpy(ptr + 8, MAC, 4); } + uint8_t p[12]; - for (i = 0; i <= endblock - startblock;i++){ - memcpy(p,w.d.asBytes + (i * 12),12); - printf("Block |%02x|",i + startblock); - printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]); - printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]); + PrintAndLog("Cloning"); + for (int i = 0; i < endblock - startblock + 1; i++){ + memcpy(p, w.d.asBytes + (i * 12), 12); + PrintAndLog("Block |%02x| %02x%02x%02x%02x%02x%02x%02x%02x | MAC |%02x%02x%02x%02x|", + i + startblock, p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7], p[8], p[9], p[10], p[11]); } UsbCommand resp; SendCommand(&w); - if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) { + if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) { PrintAndLog("Command execute timeout"); DropField(); return 0; } + DropField(); return 1; } -- 2.39.2