From cb29e00a12eb3f5da6ed326938cddd0b0d1cb097 Mon Sep 17 00:00:00 2001 From: Martin Holst Swende Date: Wed, 7 Jan 2015 09:57:18 +0100 Subject: [PATCH] Save iclass dumps to file, like mifare-dump functionality works --- armsrc/iclass.c | 42 +++++++++- client/cmdhficlass.c | 162 +++++++++++++++++++++---------------- client/loclass/fileutils.c | 2 +- 3 files changed, 133 insertions(+), 73 deletions(-) diff --git a/armsrc/iclass.c b/armsrc/iclass.c index 3844ab14..2b28b793 100644 --- a/armsrc/iclass.c +++ b/armsrc/iclass.c @@ -1594,7 +1594,7 @@ void ReaderIClass(uint8_t arg0) { void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) { - uint8_t card_data[24]={0}; + uint8_t card_data[USB_CMD_DATA_SIZE]={0}; uint16_t block_crc_LUT[255] = {0}; {//Generate a lookup table for block crc @@ -1667,7 +1667,10 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) { cardsize = memory.k16 ? 255 : 32; WDT_HIT(); - + //Set card_data to all zeroes, we'll fill it with data + memset(card_data,0x0,USB_CMD_DATA_SIZE); + uint8_t failedRead =0; + uint8_t stored_data_length =0; //then loop around remaining blocks for(int block=0; block < cardsize; block++){ @@ -1683,14 +1686,47 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) { resp[3], resp[4], resp[5], resp[6], resp[7]); + //Fill up the buffer + memcpy(card_data+stored_data_length,resp,8); + stored_data_length += 8; + + if(stored_data_length +8 > USB_CMD_DATA_SIZE) + {//Time to send this off and start afresh + cmd_send(CMD_ACK, + stored_data_length,//data length + failedRead,//Failed blocks? + 0,//Not used ATM + card_data, stored_data_length); + //reset + stored_data_length = 0; + failedRead = 0; + } + }else{ + failedRead = 1; + stored_data_length +=8;//Otherwise, data becomes misaligned Dbprintf("Failed to dump block %d", block); - } } + //Send off any remaining data + if(stored_data_length > 0) + { + cmd_send(CMD_ACK, + stored_data_length,//data length + failedRead,//Failed blocks? + 0,//Not used ATM + card_data, stored_data_length); + } //If we got here, let's break break; } + //Signal end of transmission + cmd_send(CMD_ACK, + 0,//data length + 0,//Failed blocks? + 0,//Not used ATM + card_data, 0); + LED_A_OFF(); } diff --git a/client/cmdhficlass.c b/client/cmdhficlass.c index dba4f113..ee7c0d6c 100644 --- a/client/cmdhficlass.c +++ b/client/cmdhficlass.c @@ -272,87 +272,111 @@ int CmdHFiClassReader_Dump(const char *Cmd) uint8_t key_sel[8] = {0}; uint8_t key_sel_p[8] = { 0 }; - //HACK -- Below is for testing without access to a tag - uint8_t fake_dummy_test = false; - if(fake_dummy_test) - { - uint8_t xdata[16] = {0x01,0x02,0x03,0x04,0xF7,0xFF,0x12,0xE0, //CSN from http://www.proxmark.org/forum/viewtopic.php?pid=11230#p11230 - 0xFE,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF}; // Just a random CC. Would be good to add a real testcase here - memcpy(resp.d.asBytes,xdata, 16); - resp.arg[0] = 2; - } - - //End hack - - UsbCommand c = {CMD_READER_ICLASS, {0}}; c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE| FLAG_ICLASS_READER_GET_CC; - if(!fake_dummy_test) - SendCommand(&c); + SendCommand(&c); - if (fake_dummy_test || WaitForResponseTimeout(CMD_ACK,&resp,4500)) { - uint8_t isOK = resp.arg[0] & 0xff; - uint8_t * data = resp.d.asBytes; + if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) + { + PrintAndLog("Command execute timeout"); + return 0; + } - memcpy(CSN,data,8); - memcpy(CCNR,data+8,8); + uint8_t isOK = resp.arg[0] & 0xff; + uint8_t * data = resp.d.asBytes; - PrintAndLog("isOk:%02x", isOK); + memcpy(CSN,data,8); + memcpy(CCNR,data+8,8); - if(isOK > 0) - { - PrintAndLog("CSN: %s",sprint_hex(CSN,8)); - } - if(isOK > 1) - { - if(elite) - { - //Get the key index (hash1) - uint8_t key_index[8] = {0}; - - hash1(CSN, key_index); - printvar("hash1", key_index,8); - for(i = 0; i < 8 ; i++) - key_sel[i] = keytable[key_index[i]] & 0xFF; - PrintAndLog("Pre-fortified 'permuted' HS key that would be needed by an iclass reader to talk to above CSN:"); - printvar("k_sel", key_sel,8); - //Permute from iclass format to standard format - permutekey_rev(key_sel,key_sel_p); - used_key = key_sel_p; - }else{ - //Perhaps this should also be permuted to std format? - // Something like the code below? I have no std system - // to test this with /Martin + PrintAndLog("isOk:%02x", isOK); - //uint8_t key_sel_p[8] = { 0 }; - //permutekey_rev(KEY,key_sel_p); - //used_key = key_sel_p; + if(isOK > 0) + { + PrintAndLog("CSN: %s",sprint_hex(CSN,8)); + } + if(isOK <= 1){ + PrintAndLog("Failed to obtain CC! Aborting"); + return 0; + } + //Status 2 or higher - used_key = KEY; + if(elite) + { + //Get the key index (hash1) + uint8_t key_index[8] = {0}; + + hash1(CSN, key_index); + printvar("hash1", key_index,8); + for(i = 0; i < 8 ; i++) + key_sel[i] = keytable[key_index[i]] & 0xFF; + PrintAndLog("Pre-fortified 'permuted' HS key that would be needed by an iclass reader to talk to above CSN:"); + printvar("k_sel", key_sel,8); + //Permute from iclass format to standard format + permutekey_rev(key_sel,key_sel_p); + used_key = key_sel_p; + }else{ + used_key = KEY; + } - } + PrintAndLog("Pre-fortified key that would be needed by the OmniKey reader to talk to above CSN:"); + printvar("Used key",used_key,8); + diversifyKey(CSN,used_key, div_key); + PrintAndLog("Hash0, a.k.a diversified key, that is computed using Ksel and stored in the card (Block 3):"); + printvar("Div key", div_key, 8); + printvar("CC_NR:",CCNR,12); + doMAC(CCNR,12,div_key, MAC); + printvar("MAC", MAC, 4); + + uint8_t iclass_data[32000] = {0}; + uint8_t iclass_datalen = 0; + uint8_t iclass_blocksFailed = 0;//Set to 1 if dump was incomplete + + UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}}; + memcpy(d.d.asBytes, MAC, 4); + clearCommandBuffer(); + SendCommand(&d); + PrintAndLog("Waiting for device to dump data. Press button on device and key on keyboard to abort..."); + while (true) { + printf("."); + if (ukbhit()) { + getchar(); + printf("\naborted via keyboard!\n"); + break; + } + if(WaitForResponseTimeout(CMD_ACK,&resp,4500)) + { + uint64_t dataLength = resp.arg[0]; + iclass_blocksFailed |= resp.arg[1]; + + if(dataLength > 0) + { + memcpy(iclass_data, resp.d.asBytes,dataLength); + iclass_datalen += dataLength; + }else + {//Last transfer, datalength 0 means the dump is finished + PrintAndLog("Dumped %d bytes of data from tag. ", iclass_datalen); + if(iclass_blocksFailed) + { + PrintAndLog("OBS! Some blocks failed to be dumped correctly!"); + } + if(iclass_datalen > 0) + { + char filename[100] = {0}; + //create a preferred filename + snprintf(filename, 100,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x", + CSN[0],CSN[1],CSN[2],CSN[3], + CSN[4],CSN[5],CSN[6],CSN[7]); + saveFile(filename,"bin",iclass_data, iclass_datalen ); + + } + //Aaaand we're finished + return 0; + } + } + } - PrintAndLog("Pre-fortified key that would be needed by the OmniKey reader to talk to above CSN:"); - printvar("Used key",used_key,8); - diversifyKey(CSN,used_key, div_key); - PrintAndLog("Hash0, a.k.a diversified key, that is computed using Ksel and stored in the card (Block 3):"); - printvar("Div key", div_key, 8); - printvar("CC_NR:",CCNR,12); - doMAC(CCNR,12,div_key, MAC); - printvar("MAC", MAC, 4); - - UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}}; - memcpy(d.d.asBytes, MAC, 4); - if(!fake_dummy_test) SendCommand(&d); - - }else{ - PrintAndLog("Failed to obtain CC! Aborting"); - } - } else { - PrintAndLog("Command execute timeout"); - } return 0; } diff --git a/client/loclass/fileutils.c b/client/loclass/fileutils.c index 9ea9d145..e2ca5ce5 100644 --- a/client/loclass/fileutils.c +++ b/client/loclass/fileutils.c @@ -40,7 +40,7 @@ int saveFile(const char *preferredName, const char *suffix, const void* data, si } fwrite(data, 1, datalen, fileHandle); fclose(fileHandle); - PrintAndLog(">Saved data to '%s'", fileName); + PrintAndLog("Saved data to '%s'", fileName); free(fileName); -- 2.39.2