]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhfmfu.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge branch 'master' of https://github.com/Proxmark/proxmark3
[proxmark3-svn] / client / cmdhfmfu.c
CommitLineData
81740aa5 1//-----------------------------------------------------------------------------
2// Ultralight Code (c) 2013,2014 Midnitesnake & Andy Davies of Pentura
3//
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,
5// at your option, any later version. See the LICENSE.txt file for the text of
6// the license.
7//-----------------------------------------------------------------------------
8// High frequency MIFARE ULTRALIGHT (C) commands
9//-----------------------------------------------------------------------------
afceaf40 10#include "loclass/des.h"
81740aa5 11#include "cmdhfmfu.h"
12#include "cmdhfmf.h"
13#include "cmdhf14a.h"
14
15
16#define MAX_ULTRA_BLOCKS 0x0f
17#define MAX_ULTRAC_BLOCKS 0x2f
18//#define MAX_ULTRAC_BLOCKS 0x2c
afceaf40 19
81740aa5 20
21static int CmdHelp(const char *Cmd);
22
23int CmdHF14AMfUInfo(const char *Cmd){
24
afceaf40
MHS		 25 uint8_t datatemp[7] = {0x00};
26 uint8_t isOK = 0;
27 uint8_t *data = NULL;
81740aa5 28
afceaf40
MHS		 29 UsbCommand c = {CMD_MIFAREU_READCARD, {0, 4}};
30 SendCommand(&c);
31 UsbCommand resp;
81740aa5 32
afceaf40
MHS		 33 if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
34 isOK = resp.arg[0] & 0xff;
35 data = resp.d.asBytes;
81740aa5 36
afceaf40 37 if (!isOK) {
81740aa5 38 PrintAndLog("Error reading from tag");
39 return -1;
40 }
41 } else {
42 PrintAndLog("Command execute timed out");
43 return -1;
44 }
45
46 PrintAndLog("");
47 PrintAndLog("-- Mifare Ultralight / Ultralight-C Tag Information ---------");
48 PrintAndLog("-------------------------------------------------------------");
49
50 // UID
51 memcpy( datatemp, data, 3);
52 memcpy( datatemp+3, data+4, 4);
53
54 PrintAndLog("MANUFACTURER : %s", getTagInfo(datatemp[0]));
55 PrintAndLog(" UID : %s ", sprint_hex(datatemp, 7));
56 // BBC
57 // CT (cascade tag byte) 0x88 xor SN0 xor SN1 xor SN2
58 int crc0 = 0x88 ^ data[0] ^ data[1] ^data[2];
59 if ( data[3] == crc0 )
60 PrintAndLog(" BCC0 : %02x - Ok", data[3]);
61 else
62 PrintAndLog(" BCC0 : %02x - crc should be %02x", data[3], crc0);
63
64 int crc1 = data[4] ^ data[5] ^ data[6] ^data[7];
65 if ( data[8] == crc1 )
66 PrintAndLog(" BCC1 : %02x - Ok", data[8]);
67 else
68 PrintAndLog(" BCC1 : %02x - crc should be %02x", data[8], crc1 );
69
70 PrintAndLog(" Internal : %s ", sprint_hex(data + 9, 1));
71
72 memcpy(datatemp, data+10, 2);
73 PrintAndLog(" Lock : %s - %s", sprint_hex(datatemp, 2),printBits( 2, &datatemp) );
74 PrintAndLog(" OneTimePad : %s ", sprint_hex(data + 3*4, 4));
75 PrintAndLog("");
76
77 int len = CmdHF14AMfucAuth("K 0");
78// PrintAndLog("CODE: %d",len);
79
80 PrintAndLog("Seems to be a Ultralight %s", (len==0) ? "-C" :"");
81 return 0;
82}
83
84//
85// Mifare Ultralight Write Single Block
86//
87int CmdHF14AMfUWrBl(const char *Cmd){
afceaf40
MHS		 88 uint8_t blockNo = -1;
89 bool chinese_card = FALSE;
90 uint8_t bldata[16] = {0x00};
91 UsbCommand resp;
81740aa5 92
afceaf40 93 char cmdp = param_getchar(Cmd, 0);
81740aa5 94 if (strlen(Cmd) < 3 || cmdp == 'h' || cmdp == 'H') {
afceaf40 95 PrintAndLog("Usage: hf mfu wrbl <block number> <block data (8 hex symbols)> [w]");
81740aa5 96 PrintAndLog(" [block number]");
97 PrintAndLog(" [block data] - (8 hex symbols)");
98 PrintAndLog(" [w] - Chinese magic ultralight tag");
99 PrintAndLog("");
afceaf40 100 PrintAndLog(" sample: hf mfu wrbl 0 01020304");
81740aa5 101 PrintAndLog("");
afceaf40
MHS		 102 return 0;
103 }
104
81740aa5 105 blockNo = param_get8(Cmd, 0);
106
afceaf40
MHS		 107 if (blockNo > MAX_ULTRA_BLOCKS){
108 PrintAndLog("Error: Maximum number of blocks is 15 for Ultralight Cards!");
109 return 1;
110 }
81740aa5 111
afceaf40
MHS		 112 if (param_gethex(Cmd, 1, bldata, 8)) {
113 PrintAndLog("Block data must include 8 HEX symbols");
114 return 1;
115 }
81740aa5 116
afceaf40
MHS		 117 if (strchr(Cmd,'w') != 0 || strchr(Cmd,'W') != 0 ) {
118 chinese_card = TRUE;
119 }
81740aa5 120
afceaf40 121 if ( blockNo <= 3) {
81740aa5 122 if (!chinese_card){
123 PrintAndLog("Access Denied");
124 } else {
125 PrintAndLog("--specialblock no:%02x", blockNo);
126 PrintAndLog("--data: %s", sprint_hex(bldata, 4));
127 UsbCommand d = {CMD_MIFAREU_WRITEBL, {blockNo}};
128 memcpy(d.d.asBytes,bldata, 4);
129 SendCommand(&d);
130 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
131 uint8_t isOK = resp.arg[0] & 0xff;
132 PrintAndLog("isOk:%02x", isOK);
133 } else {
134 PrintAndLog("Command execute timeout");
135 }
136 }
137 } else {
afceaf40
MHS		 138 PrintAndLog("--block no:%02x", blockNo);
139 PrintAndLog("--data: %s", sprint_hex(bldata, 4));
140 UsbCommand e = {CMD_MIFAREU_WRITEBL, {blockNo}};
81740aa5 141 memcpy(e.d.asBytes,bldata, 4);
142 SendCommand(&e);
afceaf40
MHS		 143 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
144 uint8_t isOK = resp.arg[0] & 0xff;
145 PrintAndLog("isOk:%02x", isOK);
146 } else {
147 PrintAndLog("Command execute timeout");
148 }
149 }
150 return 0;
81740aa5 151}
152
153//
154// Mifare Ultralight Read Single Block
155//
156int CmdHF14AMfURdBl(const char *Cmd){
157
afceaf40 158 uint8_t blockNo = -1;
81740aa5 159
afceaf40 160 char cmdp = param_getchar(Cmd, 0);
81740aa5 161
162 if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
afceaf40
MHS		 163 PrintAndLog("Usage: hf mfu rdbl <block number>");
164 PrintAndLog(" sample: hfu mfu rdbl 0");
165 return 0;
166 }
167
168 blockNo = param_get8(Cmd, 0);
169
170 if (blockNo > MAX_ULTRA_BLOCKS){
171 PrintAndLog("Error: Maximum number of blocks is 15 for Ultralight Cards!");
172 return 1;
173 }
174
175 PrintAndLog("--block no:0x%02X (%d)", (int)blockNo, blockNo);
176 UsbCommand c = {CMD_MIFAREU_READBL, {blockNo}};
177 SendCommand(&c);
178
179 UsbCommand resp;
180 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
181 uint8_t isOK = resp.arg[0] & 0xff;
182 uint8_t * data = resp.d.asBytes;
81740aa5 183
184 PrintAndLog("isOk: %02x", isOK);
185
afceaf40
MHS		 186 if (isOK)
187 PrintAndLog("Data: %s", sprint_hex(data, 4));
81740aa5 188 } else {
afceaf40
MHS		 189 PrintAndLog("Command execute timeout");
190 }
191 return 0;
81740aa5 192}
193
194//
195// Mifare Ultralight / Ultralight-C; Read and Dump Card Contents
196//
197int CmdHF14AMfUDump(const char *Cmd){
198
afceaf40 199 FILE *fout;
81740aa5 200 char filename[FILE_PATH_SIZE] = {0x00};
201 char * fnameptr = filename;
202
afceaf40
MHS		 203 uint8_t *lockbytes_t = NULL;
204 uint8_t lockbytes[2] = {0x00};
81740aa5 205
afceaf40
MHS		 206 uint8_t *lockbytes_t2 = NULL;
207 uint8_t lockbytes2[2] = {0x00};
81740aa5 208
afceaf40 209 bool bit[16] = {0x00};
81740aa5 210 bool bit2[16] = {0x00};
211
afceaf40
MHS		 212 int i;
213 uint8_t BlockNo = 0;
214 int Pages = 16;
81740aa5 215
216 bool tmplockbit = false;
afceaf40
MHS		 217 uint8_t isOK = 0;
218 uint8_t *data = NULL;
81740aa5 219
afceaf40 220 char cmdp = param_getchar(Cmd, 0);
81740aa5 221
222 if (cmdp == 'h' || cmdp == 'H') {
223 PrintAndLog("Reads all pages from Mifare Ultralight or Ultralight-C tag.");
224 PrintAndLog("It saves binary dump into the file `filename.bin` or `cardUID.bin`");
225 PrintAndLog("Usage: hf mfu dump <c> <filename w/o .bin>");
226 PrintAndLog(" <c> optional cardtype c == Ultralight-C, if not defaults to Ultralight");
227 PrintAndLog(" sample: hf mfu dump");
228 PrintAndLog(" : hf mfu dump myfile");
229 PrintAndLog(" : hf mfu dump c myfile");
230 return 0;
231 }
232
233 // UL or UL-C?
234 Pages = (cmdp == 'c' || cmdp == 'C') ? 44 : 16;
235
236 PrintAndLog("Dumping Ultralight%s Card Data...", (Pages ==16)?"":"-C");
afceaf40
MHS		 237
238 UsbCommand c = {CMD_MIFAREU_READCARD, {BlockNo,Pages}};
239 SendCommand(&c);
240 UsbCommand resp;
81740aa5 241
afceaf40 242 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
81740aa5 243 isOK = resp.arg[0] & 0xff;
afceaf40 244 if (!isOK) {
81740aa5 245 PrintAndLog("Command error");
246 return 0;
247 }
248 data = resp.d.asBytes;
249 } else {
250 PrintAndLog("Command execute timeout");
251 return 0;
252 }
253
254 // Load lock bytes.
255 int j = 0;
256
257 lockbytes_t = data + 8;
258 lockbytes[0] = lockbytes_t[2];
259 lockbytes[1] = lockbytes_t[3];
260 for(j = 0; j < 16; j++){
261 bit[j] = lockbytes[j/8] & ( 1 <<(7-j%8));
262 }
263
264 // Load bottom lockbytes if available
265 if ( Pages == 44 ) {
266
267 lockbytes_t2 = data + (40*4);
268 lockbytes2[0] = lockbytes_t2[2];
269 lockbytes2[1] = lockbytes_t2[3];
270 for (j = 0; j < 16; j++) {
271 bit2[j] = lockbytes2[j/8] & ( 1 <<(7-j%8));
272 }
273 }
274
275 for (i = 0; i < Pages; ++i) {
276
277 if ( i < 3 ) {
278 PrintAndLog("Block %02x:%s ", i,sprint_hex(data + i * 4, 4));
279 continue;
280 }
afceaf40 281
81740aa5 282 switch(i){
283 case 3: tmplockbit = bit[4]; break;
284 case 4: tmplockbit = bit[3]; break;
285 case 5: tmplockbit = bit[2]; break;
286 case 6: tmplockbit = bit[1]; break;
287 case 7: tmplockbit = bit[0]; break;
288 case 8: tmplockbit = bit[15]; break;
289 case 9: tmplockbit = bit[14]; break;
290 case 10: tmplockbit = bit[13]; break;
291 case 11: tmplockbit = bit[12]; break;
292 case 12: tmplockbit = bit[11]; break;
293 case 13: tmplockbit = bit[10]; break;
294 case 14: tmplockbit = bit[9]; break;
295 case 15: tmplockbit = bit[8]; break;
296 case 16:
297 case 17:
298 case 18:
299 case 19: tmplockbit = bit2[6]; break;
300 case 20:
301 case 21:
302 case 22:
303 case 23: tmplockbit = bit2[5]; break;
304 case 24:
305 case 25:
306 case 26:
307 case 27: tmplockbit = bit2[4]; break;
308 case 28:
309 case 29:
310 case 30:
311 case 31: tmplockbit = bit2[2]; break;
312 case 32:
313 case 33:
314 case 34:
315 case 35: tmplockbit = bit2[1]; break;
316 case 36:
317 case 37:
318 case 38:
319 case 39: tmplockbit = bit2[0]; break;
320 case 40: tmplockbit = bit2[12]; break;
321 case 41: tmplockbit = bit2[11]; break;
322 case 42: tmplockbit = bit2[10]; break; //auth0
323 case 43: tmplockbit = bit2[9]; break; //auth1
324 default: break;
325 }
326 PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),tmplockbit);
327 }
328
329 int len = 0;
330 if ( Pages == 16 )
331 len = param_getstr(Cmd,0,filename);
332 else
333 len = param_getstr(Cmd,1,filename);
334
afceaf40 335 if (len > FILE_PATH_SIZE-5) len = FILE_PATH_SIZE-5;
81740aa5 336
337 // user supplied filename?
338 if (len < 1) {
339
340 // UID = data 0-1-2 4-5-6-7 (skips a beat)
afceaf40
MHS		 341 sprintf(fnameptr,"%02X%02X%02X%02X%02X%02X%02X.bin",
342 data[0],data[1], data[2], data[4],data[5],data[6], data[7]);
81740aa5 343
344 } else {
afceaf40 345 sprintf(fnameptr + len," .bin");
81740aa5 346 }
347
81740aa5 348
349 if ((fout = fopen(filename,"wb")) == NULL) {
350 PrintAndLog("Could not create file name %s", filename);
351 return 1;
352 }
353 fwrite( data, 1, Pages*4, fout );
354 fclose(fout);
355
356 PrintAndLog("Dumped %d pages, wrote %d bytes to %s", Pages, Pages*4, filename);
afceaf40 357 return 0;
81740aa5 358}
359
360// Needed to Authenticate to Ultralight C tags
361void rol (uint8_t *data, const size_t len){
afceaf40
MHS		 362 uint8_t first = data[0];
363 for (size_t i = 0; i < len-1; i++) {
364 data[i] = data[i+1];
365 }
366 data[len-1] = first;
81740aa5 367}
368
369//-------------------------------------------------------------------------------
370// Ultralight C Methods
371//-------------------------------------------------------------------------------
372
373//
374// Ultralight C Authentication Demo {currently uses hard-coded key}
375//
376int CmdHF14AMfucAuth(const char *Cmd){
afceaf40
MHS		 377
378 uint8_t default_keys[5][16] = {
379 { 0x42,0x52,0x45,0x41,0x4b,0x4d,0x45,0x49,0x46,0x59,0x4f,0x55,0x43,0x41,0x4e,0x21 },// 3des std key
380 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },// all zeroes
381 { 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f },// 0x00-0x0F
382 { 0x49,0x45,0x4D,0x4B,0x41,0x45,0x52,0x42,0x21,0x4E,0x41,0x43,0x55,0x4F,0x59,0x46 },// NFC-key
383 { 0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01 } // all ones
384 };
81740aa5 385
386 char cmdp = param_getchar(Cmd, 0);
afceaf40
MHS		 387
388 uint8_t keyNo = 0;
389 bool errors = false;
390 //Change key to user defined one
391 if (cmdp == 'k' || cmdp == 'K'){
392 keyNo = param_get8(Cmd, 1);
0ec548dc 393 if(keyNo > 4) errors = true;
afceaf40
MHS		 394 }
395
396 if (cmdp == 'h' || cmdp == 'H') {
397 errors = true;
398 }
399
400 if (errors) {
401 PrintAndLog("Usage: hf mfu cauth k <key number>");
402 PrintAndLog(" 0 (default): 3DES standard key");
403 PrintAndLog(" 1 : all zeros key");
404 PrintAndLog(" 2 : 0x00-0x0F key");
405 PrintAndLog(" 3 : nfc key");
406 PrintAndLog(" 4 : all ones key");
407 PrintAndLog(" sample : hf mfu cauth k");
81740aa5 408 PrintAndLog(" : hf mfu cauth k 3");
afceaf40
MHS		 409 return 0;
410 }
411
412 uint8_t random_a[8] = { 1,1,1,1,1,1,1,1 };
413 //uint8_t enc_random_a[8] = { 0 };
414 uint8_t random_b[8] = { 0 };
415 uint8_t enc_random_b[8] = { 0 };
416 uint8_t random_a_and_b[16] = { 0 };
417 des3_context ctx = { 0 };
418 uint8_t *key = default_keys[keyNo];
419 uint8_t blockNo = 0;
420 uint32_t cuid = 0;
81740aa5 421
81740aa5 422 //Auth1
423 UsbCommand c = {CMD_MIFAREUC_AUTH1, {blockNo}};
424 SendCommand(&c);
425 UsbCommand resp;
426 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
427 uint8_t isOK = resp.arg[0] & 0xff;
428 cuid = resp.arg[1];
429 uint8_t * data= resp.d.asBytes;
430
431 if (isOK){
afceaf40 432 memcpy(enc_random_b,data+1,8);
81740aa5 433 } else {
afceaf40 434 PrintAndLog("Auth failed");
81740aa5 435 return 2; // auth failed.
436 }
437 } else {
438 PrintAndLog("Command execute timeout");
439 return 1;
440 }
afceaf40 441 uint8_t iv[8] = { 0 };
afceaf40
MHS		 442
443 PrintAndLog(" RndA :%s",sprint_hex(random_a, 8));
444 PrintAndLog(" e_RndB:%s",sprint_hex(enc_random_b, 8));
445
446 des3_set2key_dec(&ctx, key);
447
448 des3_crypt_cbc(&ctx // des3_context *ctx
449 , DES_DECRYPT // int mode
450 , sizeof(random_b) // size_t length
451 , iv // unsigned char iv[8]
452 , enc_random_b // const unsigned char *input
453 , random_b // unsigned char *output
454 );
455
456 PrintAndLog(" RndB:%s",sprint_hex(random_b, 8));
457
458 rol(random_b,8);
459 memcpy(random_a_and_b ,random_a,8);
460 memcpy(random_a_and_b+8,random_b,8);
461
462 PrintAndLog(" RA+B:%s",sprint_hex(random_a_and_b, 16));
463
464 des3_set2key_enc(&ctx, key);
465
466 des3_crypt_cbc(&ctx // des3_context *ctx
467 , DES_ENCRYPT // int mode
468 , sizeof(random_a_and_b) // size_t length
469 , enc_random_b // unsigned char iv[8]
470 , random_a_and_b // const unsigned char *input
471 , random_a_and_b // unsigned char *output
472 );
473
474 PrintAndLog("enc(RA+B):%s",sprint_hex(random_a_and_b, 16));
475
476 //Auth2
477 UsbCommand d = {CMD_MIFAREUC_AUTH2, {cuid}};
478 memcpy(d.d.asBytes,random_a_and_b, 16);
479 SendCommand(&d);
81740aa5 480
481 UsbCommand respb;
482 if (WaitForResponseTimeout(CMD_ACK,&respb,1500)) {
483 uint8_t isOK = respb.arg[0] & 0xff;
484 uint8_t * data2= respb.d.asBytes;
485
486 if (isOK){
487 PrintAndLog("enc(RndA'):%s", sprint_hex(data2+1, 8));
0ec548dc 488
489 uint8_t foo[8] = { 0 };
490 uint8_t bar[8] = { 0 };
491 memcpy(foo, data2+1, 8);
492 des3_set2key_enc(&ctx, key);
493
494 des3_crypt_cbc(&ctx // des3_context *ctx
495 , DES_DECRYPT // int mode
496 , 8 // size_t length
497 , enc_random_b // unsigned char iv[8]
498 , foo // const unsigned char *input
499 , bar // unsigned char *output
500 );
501
502 PrintAndLog("BAR:%s",sprint_hex(bar, 8));
503
504
81740aa5 505 } else {
506 return 2;
507 }
508
509 } else {
510 PrintAndLog("Command execute timeout");
511 return 1;
512 }
afceaf40 513 return 0;
81740aa5 514}
afceaf40
MHS		 515/**
516A test function to validate that the polarssl-function works the same
517was as the openssl-implementation.
518Commented out, since it requires openssl
519
520int CmdTestDES(const char * cmd)
521{
522 uint8_t key[16] = {0x00};
523
524 memcpy(key,key3_3des_data,16);
525 DES_cblock RndA, RndB;
526
527 PrintAndLog("----------OpenSSL DES implementation----------");
528 {
529 uint8_t e_RndB[8] = {0x00};
530 unsigned char RndARndB[16] = {0x00};
531
532 DES_cblock iv = { 0 };
533 DES_key_schedule ks1,ks2;
534 DES_cblock key1,key2;
535
536 memcpy(key,key3_3des_data,16);
537 memcpy(key1,key,8);
538 memcpy(key2,key+8,8);
539
540
541 DES_set_key((DES_cblock *)key1,&ks1);
542 DES_set_key((DES_cblock *)key2,&ks2);
543
544 DES_random_key(&RndA);
545 PrintAndLog(" RndA:%s",sprint_hex(RndA, 8));
546 PrintAndLog(" e_RndB:%s",sprint_hex(e_RndB, 8));
547 //void DES_ede2_cbc_encrypt(const unsigned char *input,
548 // unsigned char *output, long length, DES_key_schedule *ks1,
549 // DES_key_schedule *ks2, DES_cblock *ivec, int enc);
550 DES_ede2_cbc_encrypt(e_RndB,RndB,sizeof(e_RndB),&ks1,&ks2,&iv,0);
551
552 PrintAndLog(" RndB:%s",sprint_hex(RndB, 8));
553 rol(RndB,8);
554 memcpy(RndARndB,RndA,8);
555 memcpy(RndARndB+8,RndB,8);
556 PrintAndLog(" RA+B:%s",sprint_hex(RndARndB, 16));
557 DES_ede2_cbc_encrypt(RndARndB,RndARndB,sizeof(RndARndB),&ks1,&ks2,&e_RndB,1);
558 PrintAndLog("enc(RA+B):%s",sprint_hex(RndARndB, 16));
559
560 }
561 PrintAndLog("----------PolarSSL implementation----------");
562 {
563 uint8_t random_a[8] = { 0 };
564 uint8_t enc_random_a[8] = { 0 };
565 uint8_t random_b[8] = { 0 };
566 uint8_t enc_random_b[8] = { 0 };
567 uint8_t random_a_and_b[16] = { 0 };
568 des3_context ctx = { 0 };
569
570 memcpy(random_a, RndA,8);
571
572 uint8_t output[8] = { 0 };
573 uint8_t iv[8] = { 0 };
574
575 PrintAndLog(" RndA :%s",sprint_hex(random_a, 8));
576 PrintAndLog(" e_RndB:%s",sprint_hex(enc_random_b, 8));
577
578 des3_set2key_dec(&ctx, key);
579
580 des3_crypt_cbc(&ctx // des3_context *ctx
581 , DES_DECRYPT // int mode
582 , sizeof(random_b) // size_t length
583 , iv // unsigned char iv[8]
584 , enc_random_b // const unsigned char *input
585 , random_b // unsigned char *output
586 );
587
588 PrintAndLog(" RndB:%s",sprint_hex(random_b, 8));
589
590 rol(random_b,8);
591 memcpy(random_a_and_b ,random_a,8);
592 memcpy(random_a_and_b+8,random_b,8);
593
594 PrintAndLog(" RA+B:%s",sprint_hex(random_a_and_b, 16));
595
596 des3_set2key_enc(&ctx, key);
81740aa5 597
afceaf40
MHS		 598 des3_crypt_cbc(&ctx // des3_context *ctx
599 , DES_ENCRYPT // int mode
600 , sizeof(random_a_and_b) // size_t length
601 , enc_random_b // unsigned char iv[8]
602 , random_a_and_b // const unsigned char *input
603 , random_a_and_b // unsigned char *output
604 );
605
606 PrintAndLog("enc(RA+B):%s",sprint_hex(random_a_and_b, 16));
607 }
608 return 0;
609}
610**/
81740aa5 611//
612// Ultralight C Read Single Block
613//
614int CmdHF14AMfUCRdBl(const char *Cmd)
615{
f1170fa7 616 bool hasPwd = FALSE;
afceaf40 617 uint8_t blockNo = -1;
f1170fa7 618 unsigned char key[16];
afceaf40 619 char cmdp = param_getchar(Cmd, 0);
81740aa5 620
621 if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
f1170fa7 622 PrintAndLog("Usage: hf mfu crdbl <block number> <password>");
623 PrintAndLog("");
624 PrintAndLog("sample: hf mfu crdbl 0");
625 PrintAndLog(" hf mfu crdbl 0 1122334455667788");
afceaf40
MHS		 626 return 0;
627 }
628
629 blockNo = param_get8(Cmd, 0);
81740aa5 630 if (blockNo < 0) {
631 PrintAndLog("Wrong block number");
632 return 1;
633 }
634
afceaf40
MHS		 635 if (blockNo > MAX_ULTRAC_BLOCKS ){
636 PrintAndLog("Error: Maximum number of readable blocks is 47 for Ultralight-C Cards!");
637 return 1;
638 }
81740aa5 639
f1170fa7 640 // key
641 if ( strlen(Cmd) > 3){
642 if (param_gethex(Cmd, 1, key, 16)) {
643 PrintAndLog("Key must include %d HEX symbols", 16);
644 return 1;
645 } else {
646 hasPwd = TRUE;
647 }
648 }
649
650 if ( hasPwd )
651 PrintAndLog("--block no: 0x%02X (%d) PWD: %s", (int)blockNo, blockNo, key);
652 else
653 PrintAndLog("--block no: 0x%02X (%d)", (int)blockNo, blockNo);
afceaf40
MHS		 654
655 //Read Block
f1170fa7 656 UsbCommand c = {CMD_MIFAREU_READBL, {blockNo}};
657 if ( hasPwd ) {
658 c.arg[1] = 1;
659 memcpy(c.d.asBytes,key,16);
660 }
661 SendCommand(&c);
662 UsbCommand resp;
663 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
664 uint8_t isOK = resp.arg[0] & 0xff;
665 uint8_t *data = resp.d.asBytes;
81740aa5 666
667 PrintAndLog("isOk: %02x", isOK);
afceaf40
MHS		 668 if (isOK)
669 PrintAndLog("Data: %s", sprint_hex(data, 4));
81740aa5 670
671 } else {
672 PrintAndLog("Command execute timeout");
673 }
afceaf40 674 return 0;
81740aa5 675}
676
677//
678// Mifare Ultralight C Write Single Block
679//
680int CmdHF14AMfUCWrBl(const char *Cmd){
afceaf40
MHS		 681
682 uint8_t blockNo = -1;
683 bool chinese_card = FALSE;
684 uint8_t bldata[16] = {0x00};
685 UsbCommand resp;
81740aa5 686
afceaf40 687 char cmdp = param_getchar(Cmd, 0);
81740aa5 688
689 if (strlen(Cmd) < 3 || cmdp == 'h' || cmdp == 'H') {
afceaf40 690 PrintAndLog("Usage: hf mfu cwrbl <block number> <block data (8 hex symbols)> [w]");
81740aa5 691 PrintAndLog(" [block number]");
692 PrintAndLog(" [block data] - (8 hex symbols)");
693 PrintAndLog(" [w] - Chinese magic ultralight tag");
694 PrintAndLog("");
afceaf40 695 PrintAndLog(" sample: hf mfu cwrbl 0 01020304");
81740aa5 696 PrintAndLog("");
afceaf40
MHS		 697 return 0;
698 }
81740aa5 699
afceaf40
MHS		 700 blockNo = param_get8(Cmd, 0);
701 if (blockNo > MAX_ULTRAC_BLOCKS ){
702 PrintAndLog("Error: Maximum number of blocks is 47 for Ultralight-C Cards!");
703 return 1;
704 }
81740aa5 705
afceaf40
MHS		 706 if (param_gethex(Cmd, 1, bldata, 8)) {
707 PrintAndLog("Block data must include 8 HEX symbols");
708 return 1;
709 }
81740aa5 710
afceaf40
MHS		 711 if (strchr(Cmd,'w') != 0 || strchr(Cmd,'W') != 0 ) {
712 chinese_card = TRUE;
713 }
81740aa5 714
715 if ( blockNo <= 3 ) {
716 if (!chinese_card){
717 PrintAndLog("Access Denied");
718 } else {
719 PrintAndLog("--Special block no: 0x%02x", blockNo);
720 PrintAndLog("--Data: %s", sprint_hex(bldata, 4));
721 UsbCommand d = {CMD_MIFAREU_WRITEBL, {blockNo}};
722 memcpy(d.d.asBytes,bldata, 4);
723 SendCommand(&d);
724 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
725 uint8_t isOK = resp.arg[0] & 0xff;
726 PrintAndLog("isOk:%02x", isOK);
727 } else {
728 PrintAndLog("Command execute timeout");
729 }
730 }
731 } else {
afceaf40
MHS		 732 PrintAndLog("--Block no : 0x%02x", blockNo);
733 PrintAndLog("--Data: %s", sprint_hex(bldata, 4));
734 UsbCommand e = {CMD_MIFAREU_WRITEBL, {blockNo}};
735 memcpy(e.d.asBytes,bldata, 4);
736 SendCommand(&e);
737 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
738 uint8_t isOK = resp.arg[0] & 0xff;
739 PrintAndLog("isOk : %02x", isOK);
740 } else {
741 PrintAndLog("Command execute timeout");
742 }
81740aa5 743 }
744 return 0;
745}
746
747//------------------------------------
748// Menu Stuff
749//------------------------------------
750static command_t CommandTable[] =
751{
afceaf40
MHS		 752 {"help", CmdHelp, 1,"This help"},
753 {"dbg", CmdHF14AMfDbg, 0,"Set default debug mode"},
81740aa5 754 {"info", CmdHF14AMfUInfo, 0,"Taginfo"},
755 {"dump", CmdHF14AMfUDump, 0,"Dump MIFARE Ultralight / Ultralight-C tag to binary file"},
afceaf40
MHS		 756 {"rdbl", CmdHF14AMfURdBl, 0,"Read block - MIFARE Ultralight"},
757 {"wrbl", CmdHF14AMfUWrBl, 0,"Write block - MIFARE Ultralight"},
758 {"crdbl", CmdHF14AMfUCRdBl, 0,"Read block - MIFARE Ultralight C"},
759 {"cwrbl", CmdHF14AMfUCWrBl, 0,"Write MIFARE Ultralight C block"},
81740aa5 760 {"cauth", CmdHF14AMfucAuth, 0,"try a Ultralight C Authentication"},
afceaf40
MHS		 761 //{"testdes", CmdTestDES , 1, "Test DES"},
762 {NULL, NULL, 0, NULL}
81740aa5 763};
764
765int CmdHFMFUltra(const char *Cmd){
afceaf40
MHS		 766 WaitForResponseTimeout(CMD_ACK,NULL,100);
767 CmdsParse(CommandTable, Cmd);
768 return 0;
81740aa5 769}
770
771int CmdHelp(const char *Cmd){
afceaf40
MHS		 772 CmdsHelp(CommandTable);
773 return 0;
81740aa5 774}
Proxmark3 GIT tracking
Impressum, Datenschutz