]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhficlass.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
FIX: Coverity, strlen(Cmd) can never be lesser than zero.. *douh*
[proxmark3-svn] / client / cmdhficlass.c
CommitLineData
cee5a30d 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833 4// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// High frequency iClass commands
11//-----------------------------------------------------------------------------
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <string.h>
9f6e9d15 16#include <sys/stat.h>
cee5a30d 17#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18#include "data.h"
902cb3c0 19#include "proxmark3.h"
cee5a30d 20#include "ui.h"
21#include "cmdparser.h"
22#include "cmdhficlass.h"
23#include "common.h"
14006804 24#include "util.h"
17cba269 25#include "cmdmain.h"
a66fca86
AD		 26#include "loclass/des.h"
27#include "loclass/cipherutils.h"
28#include "loclass/cipher.h"
29#include "loclass/ikeys.h"
3ad48540
MHS		 30#include "loclass/elite_crack.h"
31#include "loclass/fileutils.h"
1defcf60 32#include "protocols.h"
caaf9618 33#include "usb_cmd.h"
e98572a1 34#include "cmdhfmfu.h"
9332b857 35#include "cmdhf.h"
e98572a1 36
37#define llX PRIx64
cee5a30d 38
39static int CmdHelp(const char *Cmd);
40
e98572a1 41#define ICLASS_KEYS_MAX 8
42static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
49 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
50 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
51};
52
53typedef struct iclass_block {
54 uint8_t d[8];
55} iclass_block_t;
56
57int xorbits_8(uint8_t val) {
53444513
MHS		 58 uint8_t res = val ^ (val >> 1); //1st pass
59 res = res ^ (res >> 1); // 2nd pass
60 res = res ^ (res >> 2); // 3rd pass
61 res = res ^ (res >> 4); // 4th pass
62 return res & 1;
17cba269
MHS		 63}
64
e98572a1 65int CmdHFiClassList(const char *Cmd) {
9332b857 66 //PrintAndLog("Deprecated command, use 'hf list iclass' instead");
67 CmdHFList("iclass");
17cba269
MHS		 68 return 0;
69}
70
e98572a1 71int CmdHFiClassSnoop(const char *Cmd) {
53444513
MHS		 72 UsbCommand c = {CMD_SNOOP_ICLASS};
73 SendCommand(&c);
74 return 0;
cee5a30d 75}
e98572a1 76
77int usage_hf_iclass_sim(void) {
41524d8a
MHS		 78 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
79 PrintAndLog(" options");
80 PrintAndLog(" 0 <CSN> simulate the given CSN");
81 PrintAndLog(" 1 simulate default CSN");
82 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
83 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
84 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
85 PrintAndLog(" example: hf iclass sim 2");
86 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
87 PrintAndLog(" hf iclass sim 3");
88 return 0;
89}
90
6116c796 91#define NUM_CSNS 15
e98572a1 92int CmdHFiClassSim(const char *Cmd) {
53444513
MHS		 93 uint8_t simType = 0;
94 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
95
96 if (strlen(Cmd)<1) {
1defcf60 97 return usage_hf_iclass_sim();
53444513 98 }
1defcf60 99 simType = param_get8ex(Cmd, 0, 0, 10);
53444513
MHS		 100
101 if(simType == 0)
102 {
103 if (param_gethex(Cmd, 1, CSN, 16)) {
104 PrintAndLog("A CSN should consist of 16 HEX symbols");
41524d8a 105 return usage_hf_iclass_sim();
53444513 106 }
53444513 107
41524d8a 108 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
53444513 109 }
41524d8a 110 if(simType > 3)
53444513
MHS		 111 {
112 PrintAndLog("Undefined simptype %d", simType);
41524d8a 113 return usage_hf_iclass_sim();
53444513 114 }
1e262141 115
41524d8a 116 uint8_t numberOfCSNs=0;
9f6e9d15
MHS		 117 if(simType == 2)
118 {
6116c796 119 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
9f6e9d15 120 UsbCommand resp = {0};
17cba269 121
53444513
MHS		 122 uint8_t csns[8*NUM_CSNS] = {
123 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
136 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
137 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
6116c796
MHS		 138
139 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
9f6e9d15
MHS		 140
141 SendCommand(&c);
142 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
143 PrintAndLog("Command timed out");
144 return 0;
145 }
1e262141 146
77abe781 147 uint8_t num_mac_responses = resp.arg[1];
6116c796 148 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
9f6e9d15 149
6116c796 150 size_t datalen = NUM_CSNS*24;
9f6e9d15
MHS		 151 /*
152 * Now, time to dump to file. We'll use this format:
77abe781 153 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15 154 * So, it should wind up as
77abe781
MHS		 155 * 8 * 24 bytes.
156 *
157 * The returndata from the pm3 is on the following format
158 * <4 byte NR><4 byte MAC>
159 * CC are all zeroes, CSN is the same as was sent in
9f6e9d15 160 **/
77abe781
MHS		 161 void* dump = malloc(datalen);
162 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15 163 uint8_t i = 0;
6116c796 164 for(i = 0 ; i < NUM_CSNS ; i++)
9f6e9d15 165 {
77abe781
MHS		 166 memcpy(dump+i*24, csns+i*8,8); //CSN
167 //8 zero bytes here...
168 //Then comes NR_MAC (eight bytes from the response)
169 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
1e262141 170
9f6e9d15
MHS		 171 }
172 /** Now, save to dumpfile **/
77abe781
MHS		 173 saveFile("iclass_mac_attack", "bin", dump,datalen);
174 free(dump);
9f6e9d15
MHS		 175 }else
176 {
177 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
178 memcpy(c.d.asBytes, CSN, 8);
179 SendCommand(&c);
180 }
1e262141 181
53444513 182 return 0;
1e262141 183}
184
e98572a1 185int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
8949bb5d 186 bool tagFound = false;
caaf9618
MHS		 187 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
188 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
e98572a1 189 // loop in client not device - else on windows have a communication error
190 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
53444513
MHS		 191 UsbCommand resp;
192 while(!ukbhit()){
e98572a1 193 SendCommand(&c);
6ce0e538 194 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
caaf9618 195 uint8_t readStatus = resp.arg[0] & 0xff;
6ce0e538 196 uint8_t *data = resp.d.asBytes;
53444513 197
8949bb5d 198 if (verbose)
caaf9618
MHS		 199 PrintAndLog("Readstatus:%02x", readStatus);
200 if( readStatus == 0){
53444513 201 //Aborted
8949bb5d 202 if (verbose) PrintAndLog("Quitting...");
53444513
MHS		 203 return 0;
204 }
8949bb5d 205 if( readStatus & FLAG_ICLASS_READER_CSN){
206 PrintAndLog("CSN: %s",sprint_hex(data,8));
207 tagFound = true;
208 }
caaf9618
MHS		 209 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
210 if( readStatus & FLAG_ICLASS_READER_CONF){
211 printIclassDumpInfo(data);
53444513 212 }
8949bb5d 213 if (tagFound && !loop) return 1;
53444513 214 } else {
8949bb5d 215 if (verbose) PrintAndLog("Command execute timeout");
53444513 216 }
8949bb5d 217 if (!loop) break;
53444513 218 }
53444513 219 return 0;
8949bb5d 220}
221
e98572a1 222int CmdHFiClassReader(const char *Cmd) {
8949bb5d 223 return HFiClassReader(Cmd, true, true);
c3963755 224}
225
e98572a1 226int CmdHFiClassReader_Replay(const char *Cmd) {
53444513
MHS		 227 uint8_t readerType = 0;
228 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
c3963755 229
53444513
MHS		 230 if (strlen(Cmd)<1) {
231 PrintAndLog("Usage: hf iclass replay <MAC>");
232 PrintAndLog(" sample: hf iclass replay 00112233");
233 return 0;
234 }
c3963755 235
53444513
MHS		 236 if (param_gethex(Cmd, 0, MAC, 8)) {
237 PrintAndLog("MAC must include 8 HEX symbols");
238 return 1;
239 }
c3963755 240
53444513
MHS		 241 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
242 memcpy(c.d.asBytes, MAC, 4);
243 SendCommand(&c);
1e262141 244
53444513 245 return 0;
1e262141 246}
247
e98572a1 248int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
249 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
250 memcpy(c.d.asBytes, data, blocksCount * 16);
53444513 251 SendCommand(&c);
53444513 252 return 0;
1e262141 253}
254
e98572a1 255int hf_iclass_eload_usage(void) {
7781a656
MHS		 256 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
257 PrintAndLog("Usage: hf iclass eload f <filename>");
258 PrintAndLog("");
259 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
260 return 0;
7781a656
MHS		 261}
262
e98572a1 263int CmdHFiClassELoad(const char *Cmd) {
7781a656
MHS		 264
265 char opt = param_getchar(Cmd, 0);
266 if (strlen(Cmd)<1 || opt == 'h')
267 return hf_iclass_eload_usage();
268
269 //File handling and reading
270 FILE *f;
271 char filename[FILE_PATH_SIZE];
9c4e28a4 272 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
7781a656 273 f = fopen(filename, "rb");
9c4e28a4 274 } else {
7781a656
MHS		 275 return hf_iclass_eload_usage();
276 }
277
278 if(!f) {
279 PrintAndLog("Failed to read from file '%s'", filename);
280 return 1;
281 }
282
283 fseek(f, 0, SEEK_END);
284 long fsize = ftell(f);
285 fseek(f, 0, SEEK_SET);
286
9c4e28a4 287 if (fsize < 0) {
288 prnlog("Error, when getting filesize");
4bb17c66 289 fclose(f);
9c4e28a4 290 return 1;
291 }
292
9c4e28a4 293 uint8_t *dump = malloc(fsize);
1defcf60 294
7781a656
MHS		 295 size_t bytes_read = fread(dump, 1, fsize, f);
296 fclose(f);
297
1defcf60 298 printIclassDumpInfo(dump);
7781a656
MHS		 299 //Validate
300
301 if (bytes_read < fsize)
302 {
303 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
304 free(dump);
305 return 1;
306 }
307 //Send to device
308 uint32_t bytes_sent = 0;
309 uint32_t bytes_remaining = bytes_read;
310
311 while(bytes_remaining > 0){
312 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
313 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
314 memcpy(c.d.asBytes, dump, bytes_in_packet);
315 SendCommand(&c);
316 bytes_remaining -= bytes_in_packet;
317 bytes_sent += bytes_in_packet;
318 }
319 free(dump);
320 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
321 return 0;
322}
323
e98572a1 324static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
41524d8a
MHS		 325 FILE *f = fopen(filename, "rb");
326 if(!f) {
327 PrintAndLog("Failed to read from file '%s'", filename);
328 return 1;
329 }
330 fseek(f, 0, SEEK_END);
331 long fsize = ftell(f);
332 fseek(f, 0, SEEK_SET);
333 size_t bytes_read = fread(buffer, 1, len, f);
334 fclose(f);
335 if(fsize != len)
336 {
337 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
338 return 1;
339 }
340 if(bytes_read != len)
341 {
342 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
343 return 1;
344 }
345 return 0;
346}
347
e98572a1 348int usage_hf_iclass_decrypt(void) {
349 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
350 PrintAndLog("");
351 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
352 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
353 PrintAndLog("");
354 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
355 PrintAndLog("");
356 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
357 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
358 PrintAndLog("which is defined by the configuration block.");
359 return 1;
360}
361
362int CmdHFiClassDecrypt(const char *Cmd) {
41524d8a
MHS		 363 uint8_t key[16] = { 0 };
364 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
365 {
366 usage_hf_iclass_decrypt();
367 return 1;
368 }
369 PrintAndLog("Decryption file found... ");
370 char opt = param_getchar(Cmd, 0);
371 if (strlen(Cmd)<1 || opt == 'h')
372 return usage_hf_iclass_decrypt();
373
374 //Open the tagdump-file
375 FILE *f;
376 char filename[FILE_PATH_SIZE];
3c406169 377 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
378 if ( (f = fopen(filename, "rb")) == NULL) {
379 PrintAndLog("Could not find file %s", filename);
380 return 1;
381 }
382
383 } else {
41524d8a 384 return usage_hf_iclass_decrypt();
3c406169 385 }
41524d8a
MHS		 386
387 fseek(f, 0, SEEK_END);
388 long fsize = ftell(f);
389 fseek(f, 0, SEEK_SET);
390 uint8_t enc_dump[8] = {0};
391 uint8_t *decrypted = malloc(fsize);
392 des3_context ctx = { DES_DECRYPT ,{ 0 } };
393 des3_set2key_dec( &ctx, key);
394 size_t bytes_read = fread(enc_dump, 1, 8, f);
395
396 //Use the first block (CSN) for filename
397 char outfilename[FILE_PATH_SIZE] = { 0 };
398 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
399 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
400 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
401
402 size_t blocknum =0;
403 while(bytes_read == 8)
404 {
9a9bcea8 405 if(blocknum < 7)
41524d8a
MHS		 406 {
407 memcpy(decrypted+(blocknum*8), enc_dump, 8);
408 }else{
409 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
410 }
411 printvar("decrypted block", decrypted +(blocknum*8), 8);
412 bytes_read = fread(enc_dump, 1, 8, f);
413 blocknum++;
414 }
415 fclose(f);
416
417 saveFile(outfilename,"bin", decrypted, blocknum*8);
418
ab7bb494 419 free(decrypted);
41524d8a
MHS		 420 return 0;
421}
7781a656 422
e98572a1 423int usage_hf_iclass_encrypt(void) {
424 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
425 PrintAndLog("");
426 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
427 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
428 PrintAndLog("");
429 PrintAndLog("example: hf iclass encrypt 0102030405060708");
430 PrintAndLog("");
431 return 0;
432}
433
434static int iClassEncryptBlkData(uint8_t *blkData) {
435 uint8_t key[16] = { 0 };
436 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
437 {
438 usage_hf_iclass_encrypt();
439 return 1;
440 }
441 PrintAndLog("Decryption file found... ");
53444513 442
e98572a1 443 uint8_t encryptedData[16];
444 uint8_t *encrypted = encryptedData;
445 des3_context ctx = { DES_DECRYPT ,{ 0 } };
446 des3_set2key_enc( &ctx, key);
447
448 des3_crypt_ecb(&ctx, blkData,encrypted);
449 //printvar("decrypted block", decrypted, 8);
450 memcpy(blkData,encrypted,8);
451
452 return 1;
453}
53444513 454
e98572a1 455int CmdHFiClassEncryptBlk(const char *Cmd) {
456 uint8_t blkData[8] = {0};
457 char opt = param_getchar(Cmd, 0);
458 if (strlen(Cmd)<1 || opt == 'h')
459 return usage_hf_iclass_encrypt();
460
461 //get the bytes to encrypt
462 if (param_gethex(Cmd, 0, blkData, 16))
53444513 463 {
e98572a1 464 PrintAndLog("BlockData must include 16 HEX symbols");
53444513
MHS		 465 return 0;
466 }
e98572a1 467 if (!iClassEncryptBlkData(blkData)) return 0;
53444513 468
e98572a1 469 printvar("encrypted block", blkData, 8);
470 return 1;
471}
472
473void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
474 uint8_t WB[9];
475 WB[0] = blockno;
476 memcpy(WB + 1,data,8);
477 doMAC_N(WB,sizeof(WB),div_key,MAC);
478 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
479}
480
481static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
482 UsbCommand resp;
483
484 UsbCommand c = {CMD_READER_ICLASS, {0}};
485 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
486 if (use_credit_key)
487 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
488
489 clearCommandBuffer();
490 SendCommand(&c);
491 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
53444513 492 {
e98572a1 493 PrintAndLog("Command execute timeout");
494 return false;
53444513
MHS		 495 }
496
e98572a1 497 uint8_t isOK = resp.arg[0] & 0xff;
498 uint8_t *data = resp.d.asBytes;
499
500 memcpy(CSN,data,8);
501 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
502 if(isOK > 0)
53444513 503 {
e98572a1 504 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
505 }
506 if(isOK <= 1){
507 PrintAndLog("Failed to obtain CC! Aborting");
508 return false;
53444513 509 }
e98572a1 510 return true;
511}
512
a7474bb3 513static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
e98572a1 514 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
515 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
516
517 if (!select_only(CSN, CCNR, use_credit_key, verbose))
518 return false;
519
520 //get div_key
a7474bb3 521 if(rawkey)
522 memcpy(div_key, KEY, 8);
523 else
e98572a1 524 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
a7474bb3 525 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
e98572a1 526
527 doMAC(CCNR, div_key, MAC);
528 UsbCommand resp;
529 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
530 memcpy(d.d.asBytes, MAC, 4);
531 clearCommandBuffer();
532 SendCommand(&d);
533 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
53444513 534 {
e98572a1 535 PrintAndLog("Auth Command execute timeout");
536 return false;
537 }
538 uint8_t isOK = resp.arg[0] & 0xff;
539 if (!isOK) {
540 PrintAndLog("Authentication error");
541 return false;
53444513 542 }
e98572a1 543 return true;
544}
53444513 545
e98572a1 546int usage_hf_iclass_dump(void) {
a7474bb3 547 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
e98572a1 548 PrintAndLog("Options:");
549 PrintAndLog(" f <filename> : specify a filename to save dump to");
550 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
551 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
552 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
553 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
554 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
a7474bb3 555 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
e98572a1 556 PrintAndLog(" NOTE: * = required");
557 PrintAndLog("Samples:");
558 PrintAndLog(" hf iclass dump k 001122334455667B");
559 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
560 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
561 return 0;
562}
563
564int CmdHFiClassReader_Dump(const char *Cmd) {
565
566 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
567 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
568 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
569 uint8_t blockno = 0;
570 uint8_t numblks = 0;
571 uint8_t maxBlk = 31;
572 uint8_t app_areas = 1;
573 uint8_t kb = 2;
574 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
575 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
576 uint8_t keyNbr = 0;
577 uint8_t dataLen = 0;
578 uint8_t fileNameLen = 0;
579 char filename[FILE_PATH_SIZE]={0};
580 char tempStr[50] = {0};
581 bool have_debit_key = false;
582 bool have_credit_key = false;
583 bool use_credit_key = false;
584 bool elite = false;
a7474bb3 585 bool rawkey = false;
e98572a1 586 bool errors = false;
587 uint8_t cmdp = 0;
588
589 while(param_getchar(Cmd, cmdp) != 0x00)
590 {
591 switch(param_getchar(Cmd, cmdp))
592 {
593 case 'h':
594 case 'H':
595 return usage_hf_iclass_dump();
596 case 'c':
597 case 'C':
598 have_credit_key = true;
599 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
600 if (dataLen == 16) {
601 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
602 } else if (dataLen == 1) {
603 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 604 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 605 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
606 } else {
607 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
608 errors = true;
609 }
610 } else {
611 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
612 errors = true;
613 }
614 cmdp += 2;
615 break;
616 case 'e':
617 case 'E':
618 elite = true;
619 cmdp++;
620 break;
621 case 'f':
622 case 'F':
623 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
624 if (fileNameLen < 1) {
625 PrintAndLog("No filename found after f");
626 errors = true;
627 }
628 cmdp += 2;
629 break;
630 case 'k':
631 case 'K':
632 have_debit_key = true;
633 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
634 if (dataLen == 16) {
635 errors = param_gethex(tempStr, 0, KEY, dataLen);
636 } else if (dataLen == 1) {
637 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 638 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 639 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
640 } else {
641 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
642 errors = true;
643 }
644 } else {
645 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
646 errors = true;
647 }
648 cmdp += 2;
649 break;
a7474bb3 650 case 'r':
651 case 'R':
652 rawkey = true;
653 cmdp++;
654 break;
e98572a1 655 default:
656 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
657 errors = true;
658 break;
659 }
660 if(errors) return usage_hf_iclass_dump();
661 }
662
663 if (cmdp < 2) return usage_hf_iclass_dump();
664 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
665 if (!have_debit_key && have_credit_key) use_credit_key = true;
666
667 //get config and first 3 blocks
668 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
669 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
53444513 670 UsbCommand resp;
e98572a1 671 uint8_t tag_data[255*8];
53444513 672
e98572a1 673 clearCommandBuffer();
674 SendCommand(&c);
675 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
676 PrintAndLog("Command execute timeout");
677 ul_switch_off_field();
678 return 0;
679 }
680 uint8_t readStatus = resp.arg[0] & 0xff;
53444513
MHS		 681 uint8_t * data = resp.d.asBytes;
682
e98572a1 683 if(readStatus == 0){
684 PrintAndLog("No tag found...");
685 ul_switch_off_field();
686 return 0;
687}
688 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
689 memcpy(tag_data, data, 8*3);
690 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
691 numblks = data[8];
692 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
693 // large memory - not able to dump pages currently
694 if (numblks > maxBlk) numblks = maxBlk;
695 }
696 ul_switch_off_field();
697 // authenticate debit key and get div_key - later store in dump block 3
a7474bb3 698 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
e98572a1 699 //try twice - for some reason it sometimes fails the first time...
a7474bb3 700 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
e98572a1 701 ul_switch_off_field();
702 return 0;
703 }
53444513 704 }
e98572a1 705
706 // begin dump
707 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
708 clearCommandBuffer();
709 SendCommand(&w);
710 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
711 PrintAndLog("Command execute time-out 1");
712 ul_switch_off_field();
713 return 1;
714 }
715 uint32_t blocksRead = resp.arg[1];
716 uint8_t isOK = resp.arg[0] & 0xff;
717 if (!isOK && !blocksRead) {
718 PrintAndLog("Read Block Failed");
719 ul_switch_off_field();
720 return 0;
721 }
722 uint32_t startindex = resp.arg[2];
723 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
724 PrintAndLog("Data exceeded Buffer size!");
725 blocksRead = (sizeof(tag_data)/8) - blockno;
726 }
727 // response ok - now get bigbuf content of the dump
728 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
729 WaitForResponse(CMD_ACK,NULL);
730 size_t gotBytes = blocksRead*8 + blockno*8;
731
732 // try AA2
733 if (have_credit_key) {
734 //turn off hf field before authenticating with different key
735 ul_switch_off_field();
736 memset(MAC,0,4);
737 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
a7474bb3 738 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
e98572a1 739 //try twice - for some reason it sometimes fails the first time...
a7474bb3 740 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
e98572a1 741 ul_switch_off_field();
742 return 0;
743 }
744 }
745 // do we still need to read more block? (aa2 enabled?)
746 if (maxBlk > blockno+numblks+1) {
747 // setup dump and start
748 w.arg[0] = blockno + blocksRead;
749 w.arg[1] = maxBlk - (blockno + blocksRead);
750 clearCommandBuffer();
751 SendCommand(&w);
752 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
753 PrintAndLog("Command execute timeout 2");
754 ul_switch_off_field();
755 return 0;
756 }
757 uint8_t isOK = resp.arg[0] & 0xff;
758 blocksRead = resp.arg[1];
759 if (!isOK && !blocksRead) {
760 PrintAndLog("Read Block Failed 2");
761 ul_switch_off_field();
762 return 0;
763 }
53444513 764
e98572a1 765 startindex = resp.arg[2];
766 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
767 PrintAndLog("Data exceeded Buffer size!");
768 blocksRead = (sizeof(tag_data) - gotBytes)/8;
769 }
770 // get dumped data from bigbuf
771 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
772 WaitForResponse(CMD_ACK,NULL);
53444513 773
e98572a1 774 gotBytes += blocksRead*8;
775 } else { //field is still on - turn it off...
776 ul_switch_off_field();
777 }
778 }
53444513 779
e98572a1 780 // add diversified keys to dump
781 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
782 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
783 // print the dump
784 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
785 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
786 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
787
788 if (filename[0] == 0){
789 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
790 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
791 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
792 }
53444513 793
e98572a1 794 // save the dump to .bin file
795 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
796 saveFile(filename, "bin", tag_data, gotBytes);
797 return 1;
798}
53444513 799
a7474bb3 800static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
e98572a1 801 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
802 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
a7474bb3 803 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
e98572a1 804 return 0;
805
806 UsbCommand resp;
807
808 Calc_wb_mac(blockno,bldata,div_key,MAC);
809 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
810 memcpy(w.d.asBytes, bldata, 8);
811 memcpy(w.d.asBytes + 8, MAC, 4);
812
813 clearCommandBuffer();
814 SendCommand(&w);
815 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
816 {
817 PrintAndLog("Write Command execute timeout");
818 return 0;
819 }
820 uint8_t isOK = resp.arg[0] & 0xff;
821 if (!isOK) {
822 PrintAndLog("Write Block Failed");
823 return 0;
824 }
825 PrintAndLog("Write Block Successful");
826 return 1;
827}
828
829int usage_hf_iclass_writeblock(void) {
830 PrintAndLog("Options:");
831 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
832 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
833 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
834 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
835 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
a7474bb3 836 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
e98572a1 837 PrintAndLog("Samples:");
838 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
839 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
840 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
841 return 0;
842}
843
844int CmdHFiClass_WriteBlock(const char *Cmd) {
845 uint8_t blockno=0;
846 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
847 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
848 uint8_t keyNbr = 0;
849 uint8_t dataLen = 0;
850 char tempStr[50] = {0};
851 bool use_credit_key = false;
852 bool elite = false;
a7474bb3 853 bool rawkey= false;
e98572a1 854 bool errors = false;
855 uint8_t cmdp = 0;
856 while(param_getchar(Cmd, cmdp) != 0x00)
857 {
858 switch(param_getchar(Cmd, cmdp))
859 {
860 case 'h':
861 case 'H':
862 return usage_hf_iclass_writeblock();
863 case 'b':
864 case 'B':
865 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
866 PrintAndLog("Block No must include 2 HEX symbols\n");
867 errors = true;
868 }
869 cmdp += 2;
870 break;
871 case 'c':
872 case 'C':
873 use_credit_key = true;
874 cmdp++;
875 break;
876 case 'd':
877 case 'D':
878 if (param_gethex(Cmd, cmdp+1, bldata, 16))
879 {
880 PrintAndLog("KEY must include 16 HEX symbols\n");
881 errors = true;
882 }
883 cmdp += 2;
884 break;
885 case 'e':
886 case 'E':
887 elite = true;
888 cmdp++;
889 break;
890 case 'k':
891 case 'K':
892 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
893 if (dataLen == 16) {
894 errors = param_gethex(tempStr, 0, KEY, dataLen);
895 } else if (dataLen == 1) {
896 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 897 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 898 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
899 } else {
900 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
901 errors = true;
902 }
903 } else {
904 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
905 errors = true;
906 }
907 cmdp += 2;
908 break;
a7474bb3 909 case 'r':
910 case 'R':
911 rawkey = true;
912 cmdp++;
913 break;
e98572a1 914 default:
915 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
916 errors = true;
917 break;
918 }
919 if(errors) return usage_hf_iclass_writeblock();
920 }
921
922 if (cmdp < 6) return usage_hf_iclass_writeblock();
a7474bb3 923 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
e98572a1 924 ul_switch_off_field();
925 return ans;
926}
927
928int usage_hf_iclass_clone(void) {
a7474bb3 929 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
e98572a1 930 PrintAndLog("Options:");
931 PrintAndLog(" f <filename>: specify a filename to clone from");
932 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
933 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
934 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
935 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
936 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
a7474bb3 937 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
e98572a1 938 PrintAndLog("Samples:");
939 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
940 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
941 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
942 return -1;
943}
944
945int CmdHFiClassCloneTag(const char *Cmd) {
5cba4462 946 char filename[FILE_PATH_SIZE] = { 0x00 };
e98572a1 947 char tempStr[50]={0};
948 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
949 uint8_t keyNbr = 0;
950 uint8_t fileNameLen = 0;
951 uint8_t startblock = 0;
952 uint8_t endblock = 0;
953 uint8_t dataLen = 0;
954 bool use_credit_key = false;
955 bool elite = false;
a7474bb3 956 bool rawkey = false;
e98572a1 957 bool errors = false;
958 uint8_t cmdp = 0;
959 while(param_getchar(Cmd, cmdp) != 0x00)
960 {
961 switch(param_getchar(Cmd, cmdp))
962 {
963 case 'h':
964 case 'H':
965 return usage_hf_iclass_clone();
966 case 'b':
967 case 'B':
968 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
969 PrintAndLog("Start Block No must include 2 HEX symbols\n");
970 errors = true;
971 }
972 cmdp += 2;
973 break;
974 case 'c':
975 case 'C':
976 use_credit_key = true;
977 cmdp++;
978 break;
979 case 'e':
980 case 'E':
981 elite = true;
982 cmdp++;
983 break;
984 case 'f':
985 case 'F':
986 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
987 if (fileNameLen < 1) {
988 PrintAndLog("No filename found after f");
989 errors = true;
990 }
991 cmdp += 2;
992 break;
993 case 'k':
994 case 'K':
995 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
996 if (dataLen == 16) {
997 errors = param_gethex(tempStr, 0, KEY, dataLen);
998 } else if (dataLen == 1) {
999 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 1000 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 1001 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1002 } else {
1003 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1004 errors = true;
1005 }
1006 } else {
1007 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1008 errors = true;
1009 }
1010 cmdp += 2;
1011 break;
1012 case 'l':
1013 case 'L':
1014 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1015 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1016 errors = true;
1017 }
1018 cmdp += 2;
1019 break;
a7474bb3 1020 case 'r':
1021 case 'R':
1022 rawkey = true;
1023 cmdp++;
1024 break;
e98572a1 1025 default:
1026 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1027 errors = true;
1028 break;
1029 }
1030 if(errors) return usage_hf_iclass_clone();
1031 }
1032
1033 if (cmdp < 8) return usage_hf_iclass_clone();
1034
1035 FILE *f;
1036
1037 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1038
1039 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1040 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1041 }
1042 // file handling and reading
1043 f = fopen(filename,"rb");
1044 if(!f) {
1045 PrintAndLog("Failed to read from file '%s'", filename);
1046 return 1;
1047 }
1048
1049 if (startblock<5) {
1050 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
628d1cb0 1051 fclose(f);
e98572a1 1052 return 0;
1053 }
1054 // now read data from the file from block 6 --- 19
1055 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1056 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1057 // else we have to create a share memory
1058 int i;
1059 fseek(f,startblock*8,SEEK_SET);
2b9006bd 1060 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0){
1061 PrintAndLog("File reading error.");
1062 fclose(f);
1063 return 2;
1064 }
e98572a1 1065
1066 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1067 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1068
a7474bb3 1069 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
e98572a1 1070 return 0;
1071
1072 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
1073 uint8_t *ptr;
1074 // calculate all mac for every the block we will write
1075 for (i = startblock; i <= endblock; i++){
1076 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1077 // usb command d start pointer = d + (i - 6) * 12
1078 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1079 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1080 // next one
1081 ptr = w.d.asBytes + (i - startblock) * 12;
1082 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1083 memcpy(ptr + 8,MAC, 4);
1084 }
1085 uint8_t p[12];
1086 for (i = 0; i <= endblock - startblock;i++){
1087 memcpy(p,w.d.asBytes + (i * 12),12);
1088 printf("Block |%02x|",i + startblock);
1089 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1090 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1091 }
1092 UsbCommand resp;
1093 SendCommand(&w);
1094 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1095 {
1096 PrintAndLog("Command execute timeout");
1097 return 0;
1098 }
1099 return 1;
1100}
1101
a7474bb3 1102static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose) {
e98572a1 1103 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1104 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1105
a7474bb3 1106 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
e98572a1 1107 return 0;
1108
1109 UsbCommand resp;
1110 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
1111 clearCommandBuffer();
1112 SendCommand(&w);
1113 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1114 {
53444513 1115 PrintAndLog("Command execute timeout");
e98572a1 1116 return 0;
53444513 1117 }
e98572a1 1118 uint8_t isOK = resp.arg[0] & 0xff;
1119 if (!isOK) {
1120 PrintAndLog("Read Block Failed");
1121 return 0;
1122 }
1123 //data read is stored in: resp.d.asBytes[0-15]
1124 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1125 return 1;
1126}
1127
1128int usage_hf_iclass_readblock(void) {
a7474bb3 1129 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
e98572a1 1130 PrintAndLog("Options:");
1131 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1132 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1133 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1134 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
a7474bb3 1135 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
e98572a1 1136 PrintAndLog("Samples:");
1137 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1138 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1139 PrintAndLog(" hf iclass readblk b 0A k 0");
53444513 1140 return 0;
a66fca86 1141}
e98572a1 1142
1143int CmdHFiClass_ReadBlock(const char *Cmd) {
1144 uint8_t blockno=0;
1145 uint8_t keyType = 0x88; //debit key
1146 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1147 uint8_t keyNbr = 0;
1148 uint8_t dataLen = 0;
1149 char tempStr[50] = {0};
1150 bool elite = false;
a7474bb3 1151 bool rawkey = false;
e98572a1 1152 bool errors = false;
1153 uint8_t cmdp = 0;
1154 while(param_getchar(Cmd, cmdp) != 0x00)
1155 {
1156 switch(param_getchar(Cmd, cmdp))
1157 {
1158 case 'h':
1159 case 'H':
1160 return usage_hf_iclass_readblock();
1161 case 'b':
1162 case 'B':
1163 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1164 PrintAndLog("Block No must include 2 HEX symbols\n");
1165 errors = true;
1166 }
1167 cmdp += 2;
1168 break;
1169 case 'c':
1170 case 'C':
1171 keyType = 0x18;
1172 cmdp++;
1173 break;
1174 case 'e':
1175 case 'E':
1176 elite = true;
1177 cmdp++;
1178 break;
1179 case 'k':
1180 case 'K':
1181 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1182 if (dataLen == 16) {
1183 errors = param_gethex(tempStr, 0, KEY, dataLen);
1184 } else if (dataLen == 1) {
1185 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 1186 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 1187 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1188 } else {
1189 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1190 errors = true;
1191 }
1192 } else {
1193 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1194 errors = true;
1195 }
1196 cmdp += 2;
1197 break;
a7474bb3 1198 case 'r':
1199 case 'R':
1200 rawkey = true;
1201 cmdp++;
1202 break;
e98572a1 1203 default:
1204 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1205 errors = true;
1206 break;
1207 }
1208 if(errors) return usage_hf_iclass_readblock();
1209 }
1210
1211 if (cmdp < 4) return usage_hf_iclass_readblock();
1212
a7474bb3 1213 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true);
e98572a1 1214}
1215
1216int CmdHFiClass_loclass(const char *Cmd) {
6f101995
MHS		 1217 char opt = param_getchar(Cmd, 0);
1218
1219 if (strlen(Cmd)<1 || opt == 'h') {
1220 PrintAndLog("Usage: hf iclass loclass [options]");
1221 PrintAndLog("Options:");
1222 PrintAndLog("h Show this help");
1223 PrintAndLog("t Perform self-test");
1224 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1225 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1226 PrintAndLog(" malicious CSNs, and their protocol responses");
1227 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1228 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1229 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1230 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1231 PrintAndLog(" ... totalling N*24 bytes");
1232 return 0;
1233 }
1234 char fileName[255] = {0};
1235 if(opt == 'f')
1236 {
53444513
MHS		 1237 if(param_getstr(Cmd, 1, fileName) > 0)
1238 {
1239 return bruteforceFileNoKeys(fileName);
1240 }else
1241 {
1242 PrintAndLog("You must specify a filename");
1243 }
6f101995
MHS		 1244 }
1245 else if(opt == 't')
1246 {
1247 int errors = testCipherUtils();
1248 errors += testMAC();
1249 errors += doKeyTests(0);
1250 errors += testElite();
1251 if(errors)
1252 {
1253 prnlog("OBS! There were errors!!!");
1254 }
1255 return errors;
1256 }
a66fca86 1257
6f101995
MHS		 1258 return 0;
1259}
c3963755 1260
e98572a1 1261void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1262 uint8_t blockdata[8];
1263 uint8_t mem_config;
1264 memcpy(&mem_config, iclass_dump + 13,1);
1265 uint8_t maxmemcount;
1266 uint8_t filemaxblock = filesize / 8;
1267 if (mem_config & 0x80)
1268 maxmemcount = 255;
1269 else
1270 maxmemcount = 31;
1271 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1272
1273 if (startblock == 0)
1274 startblock = 6;
1275 if ((endblock > maxmemcount) || (endblock == 0))
1276 endblock = maxmemcount;
1277 if (endblock > filemaxblock)
1278 endblock = filemaxblock;
1279 int i = startblock;
1280 int j;
1281 while (i <= endblock){
1282 printf("Block |%02X| ",i);
1283 memcpy(blockdata,iclass_dump + (i * 8),8);
1284 for (j = 0;j < 8;j++)
1285 printf("%02X ",blockdata[j]);
1286 printf("|\n");
1287 i++;
1288 }
1289}
1290
1291int usage_hf_iclass_readtagfile() {
1292 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1293 return 1;
1294}
1295
1296int CmdHFiClassReadTagFile(const char *Cmd) {
1297 int startblock = 0;
1298 int endblock = 0;
1299 char tempnum[5];
1300 FILE *f;
1301 char filename[FILE_PATH_SIZE];
1302 if (param_getstr(Cmd, 0, filename) < 1)
1303 return usage_hf_iclass_readtagfile();
1304 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1305 startblock = 0;
1306 else
1307 sscanf(tempnum,"%d",&startblock);
1308
1309 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1310 endblock = 0;
1311 else
1312 sscanf(tempnum,"%d",&endblock);
1313 // file handling and reading
1314 f = fopen(filename,"rb");
1315 if(!f) {
1316 PrintAndLog("Failed to read from file '%s'", filename);
1317 return 1;
1318 }
1319 fseek(f, 0, SEEK_END);
1320 long fsize = ftell(f);
1321 fseek(f, 0, SEEK_SET);
1322
ddb748a9 1323 if ( fsize < 0 ) {
1324 PrintAndLog("Error, when getting filesize");
1325 fclose(f);
1326 return 1;
1327 }
e98572a1 1328
ddb748a9 1329 uint8_t *dump = malloc(fsize);
e98572a1 1330
1331 size_t bytes_read = fread(dump, 1, fsize, f);
1332 fclose(f);
1333 uint8_t *csn = dump;
1334 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
1335 // printIclassDumpInfo(dump);
1336 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1337 free(dump);
1338 return 0;
1339}
1340
1341/*
1342uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1343 uint64_t new_div = 0x00;
1344 new_div ^= sdiv;
1345 new_div ^= hdiv;
1346 return new_div;
1347}
1348
1349uint64_t hexarray_to_uint64(uint8_t *key) {
1350 char temp[17];
1351 uint64_t uint_key;
1352 for (int i = 0;i < 8;i++)
1353 sprintf(&temp[(i *2)],"%02X",key[i]);
1354 temp[16] = '\0';
1355 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1356 return 0;
1357 return uint_key;
1358}
1359*/
1360void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1361 uint8_t keytable[128] = {0};
1362 uint8_t key_index[8] = {0};
1363 if (elite) {
1364 uint8_t key_sel[8] = { 0 };
1365 uint8_t key_sel_p[8] = { 0 };
1366 hash2(KEY, keytable);
1367 hash1(CSN, key_index);
1368 for(uint8_t i = 0; i < 8 ; i++)
1369 key_sel[i] = keytable[key_index[i]] & 0xFF;
1370
1371 //Permute from iclass format to standard format
1372 permutekey_rev(key_sel, key_sel_p);
1373 diversifyKey(CSN, key_sel_p, div_key);
1374 } else {
1375 diversifyKey(CSN, KEY, div_key);
1376 }
1377}
1378
1379//when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1380//calculate and return xor_div_key (ready for a key write command)
1381//print all div_keys if verbose
1382static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1383 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1384 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1385 //get old div key
1386 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1387 //get new div key
1388 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1389
1390 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1391 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1392 }
1393 if (verbose) {
1394 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1395 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1396 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1397 }
1398}
1399
1400int usage_hf_iclass_calc_newkey(void) {
1401 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1402 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1403 PrintAndLog(" Options:");
1404 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1405 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1406 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1407 PrintAndLog(" e : specify new key as elite calc");
1408 PrintAndLog(" ee : specify old and new key as elite calc");
1409 PrintAndLog("Samples:");
1410 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1411 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1412 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1413 PrintAndLog("NOTE: * = required\n");
1414
1415 return 1;
1416}
1417
1418int CmdHFiClassCalcNewKey(const char *Cmd) {
1419 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1420 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1421 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1422 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1423 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1424 uint8_t keyNbr = 0;
1425 uint8_t dataLen = 0;
1426 char tempStr[50] = {0};
1427 bool givenCSN = false;
1428 bool oldElite = false;
1429 bool elite = false;
1430 bool errors = false;
1431 uint8_t cmdp = 0;
1432 while(param_getchar(Cmd, cmdp) != 0x00)
1433 {
1434 switch(param_getchar(Cmd, cmdp))
1435 {
1436 case 'h':
1437 case 'H':
1438 return usage_hf_iclass_calc_newkey();
1439 case 'e':
1440 case 'E':
1441 dataLen = param_getstr(Cmd, cmdp, tempStr);
1442 if (dataLen==2)
1443 oldElite = true;
1444 elite = true;
1445 cmdp++;
1446 break;
1447 case 'n':
1448 case 'N':
1449 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1450 if (dataLen == 16) {
1451 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1452 } else if (dataLen == 1) {
1453 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 1454 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 1455 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1456 } else {
1457 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1458 errors = true;
1459 }
1460 } else {
1461 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1462 errors = true;
1463 }
1464 cmdp += 2;
1465 break;
1466 case 'o':
1467 case 'O':
1468 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1469 if (dataLen == 16) {
1470 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1471 } else if (dataLen == 1) {
1472 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 1473 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 1474 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1475 } else {
1476 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1477 errors = true;
1478 }
1479 } else {
1480 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1481 errors = true;
1482 }
1483 cmdp += 2;
1484 break;
1485 case 's':
1486 case 'S':
1487 givenCSN = true;
1488 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1489 return usage_hf_iclass_calc_newkey();
1490 cmdp += 2;
1491 break;
1492 default:
1493 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1494 errors = true;
1495 break;
1496 }
1497 if(errors) return usage_hf_iclass_calc_newkey();
1498 }
1499
1500 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1501
1502 if (!givenCSN)
1503 if (!select_only(CSN, CCNR, false, true))
1504 return 0;
1505
1506 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1507 return 0;
1508}
1509
1510static int loadKeys(char *filename) {
1511 FILE *f;
1512 f = fopen(filename,"rb");
1513 if(!f) {
1514 PrintAndLog("Failed to read from file '%s'", filename);
1515 return 0;
1516 }
1517 fseek(f, 0, SEEK_END);
1518 long fsize = ftell(f);
1519 fseek(f, 0, SEEK_SET);
1520
4bb17c66 1521 if ( fsize < 0 ) {
1522 PrintAndLog("Error, when getting filesize");
1523 fclose(f);
1524 return 1;
1525 }
1526
e98572a1 1527 uint8_t *dump = malloc(fsize);
1528
1529 size_t bytes_read = fread(dump, 1, fsize, f);
1530 fclose(f);
1531 if (bytes_read > ICLASS_KEYS_MAX * 8){
1532 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1533 free(dump);
1534 return 0;
1535 }
1536 uint8_t i = 0;
1537 for (; i < bytes_read/8; i++){
1538 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1539 }
1540 free(dump);
1541 PrintAndLog("%u keys loaded", i);
1542 return 1;
1543}
1544
1545static int saveKeys(char *filename) {
1546 FILE *f;
1547 f = fopen(filename,"wb");
1548 if (f == NULL) {
1549 printf("error opening file %s\n",filename);
1550 return 0;
1551 }
1552 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1553 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1554 PrintAndLog("save key failed to write to file: %s", filename);
1555 break;
1556 }
1557 }
1558 fclose(f);
1559 return 0;
1560}
1561
1562static int printKeys(void) {
1563 PrintAndLog("");
1564 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1565 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1566 }
1567 PrintAndLog("");
1568 return 0;
1569}
1570
1571int usage_hf_iclass_managekeys(void) {
1572 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1573 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1574 PrintAndLog(" Options:");
1575 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1576 PrintAndLog(" k <key> : set a key in memory");
1577 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1578 PrintAndLog(" s : save keys in memory to file specified by filename");
1579 PrintAndLog(" l : load keys to memory from file specified by filename");
1580 PrintAndLog(" p : print keys loaded into memory\n");
1581 PrintAndLog("Samples:");
1582 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1583 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1584 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1585 PrintAndLog(" print keys : hf iclass managekeys p\n");
1586 return 0;
1587}
1588
1589int CmdHFiClassManageKeys(const char *Cmd) {
1590 uint8_t keyNbr = 0;
1591 uint8_t dataLen = 0;
1592 uint8_t KEY[8] = {0};
1593 char filename[FILE_PATH_SIZE];
1594 uint8_t fileNameLen = 0;
1595 bool errors = false;
1596 uint8_t operation = 0;
1597 char tempStr[20];
1598 uint8_t cmdp = 0;
1599
1600 while(param_getchar(Cmd, cmdp) != 0x00)
1601 {
1602 switch(param_getchar(Cmd, cmdp))
1603 {
1604 case 'h':
1605 case 'H':
1606 return usage_hf_iclass_managekeys();
1607 case 'f':
1608 case 'F':
1609 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1610 if (fileNameLen < 1) {
1611 PrintAndLog("No filename found after f");
1612 errors = true;
1613 }
1614 cmdp += 2;
1615 break;
1616 case 'n':
1617 case 'N':
1618 keyNbr = param_get8(Cmd, cmdp+1);
8b15860e 1619 if (keyNbr == 0) {
e98572a1 1620 PrintAndLog("Wrong block number");
1621 errors = true;
1622 }
1623 cmdp += 2;
1624 break;
1625 case 'k':
1626 case 'K':
1627 operation += 3; //set key
1628 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1629 if (dataLen == 16) { //ul-c or ev1/ntag key length
1630 errors = param_gethex(tempStr, 0, KEY, dataLen);
1631 } else {
1632 PrintAndLog("\nERROR: Key is incorrect length\n");
1633 errors = true;
1634 }
1635 cmdp += 2;
1636 break;
1637 case 'p':
1638 case 'P':
1639 operation += 4; //print keys in memory
1640 cmdp++;
1641 break;
1642 case 'l':
1643 case 'L':
1644 operation += 5; //load keys from file
1645 cmdp++;
1646 break;
1647 case 's':
1648 case 'S':
1649 operation += 6; //save keys to file
1650 cmdp++;
1651 break;
1652 default:
1653 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1654 errors = true;
1655 break;
1656 }
1657 if(errors) return usage_hf_iclass_managekeys();
1658 }
1659 if (operation == 0){
1660 PrintAndLog("no operation specified (load, save, or print)\n");
1661 return usage_hf_iclass_managekeys();
1662 }
1663 if (operation > 6){
1664 PrintAndLog("Too many operations specified\n");
1665 return usage_hf_iclass_managekeys();
1666 }
1667 if (operation > 4 && fileNameLen == 0){
1668 PrintAndLog("You must enter a filename when loading or saving\n");
1669 return usage_hf_iclass_managekeys();
1670 }
1671
1672 switch (operation){
1673 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1674 case 4: return printKeys();
1675 case 5: return loadKeys(filename);
1676 case 6: return saveKeys(filename);
1677 break;
1678 }
1679 return 0;
1680}
1681
cee5a30d 1682static command_t CommandTable[] =
1683{
6f101995 1684 {"help", CmdHelp, 1, "This help"},
e98572a1 1685 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1686 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1687 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1688 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1689 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1690 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1691 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1692 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1693 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1694 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
6f101995 1695 {"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
e98572a1 1696 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1697 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1698 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1699 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1700 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
6f101995 1701 {NULL, NULL, 0, NULL}
cee5a30d 1702};
1703
1704int CmdHFiClass(const char *Cmd)
1705{
53444513
MHS		 1706 CmdsParse(CommandTable, Cmd);
1707 return 0;
cee5a30d 1708}
1709
1710int CmdHelp(const char *Cmd)
1711{
53444513
MHS		 1712 CmdsHelp(CommandTable);
1713 return 0;
cee5a30d 1714}
Proxmark3 GIT tracking
Impressum, Datenschutz