]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhficlass.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
FIX: Coverity , Argument can't be negative, CID #121323, ftell(f) can be negative...
[proxmark3-svn] / client / cmdhficlass.c
CommitLineData
cee5a30d 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833 4// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// High frequency iClass commands
11//-----------------------------------------------------------------------------
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <string.h>
9f6e9d15 16#include <sys/stat.h>
cee5a30d 17#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18#include "data.h"
902cb3c0 19#include "proxmark3.h"
cee5a30d 20#include "ui.h"
21#include "cmdparser.h"
22#include "cmdhficlass.h"
23#include "common.h"
14006804 24#include "util.h"
17cba269 25#include "cmdmain.h"
a66fca86
AD		 26#include "loclass/des.h"
27#include "loclass/cipherutils.h"
28#include "loclass/cipher.h"
29#include "loclass/ikeys.h"
3ad48540
MHS		 30#include "loclass/elite_crack.h"
31#include "loclass/fileutils.h"
1defcf60 32#include "protocols.h"
caaf9618 33#include "usb_cmd.h"
e98572a1 34#include "cmdhfmfu.h"
9332b857 35#include "cmdhf.h"
e98572a1 36
37#define llX PRIx64
cee5a30d 38
39static int CmdHelp(const char *Cmd);
40
e98572a1 41#define ICLASS_KEYS_MAX 8
42static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
49 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
50 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
51};
52
53typedef struct iclass_block {
54 uint8_t d[8];
55} iclass_block_t;
56
57int xorbits_8(uint8_t val) {
53444513
MHS		 58 uint8_t res = val ^ (val >> 1); //1st pass
59 res = res ^ (res >> 1); // 2nd pass
60 res = res ^ (res >> 2); // 3rd pass
61 res = res ^ (res >> 4); // 4th pass
62 return res & 1;
17cba269
MHS		 63}
64
e98572a1 65int CmdHFiClassList(const char *Cmd) {
9332b857 66 //PrintAndLog("Deprecated command, use 'hf list iclass' instead");
67 CmdHFList("iclass");
17cba269
MHS		 68 return 0;
69}
70
e98572a1 71int CmdHFiClassSnoop(const char *Cmd) {
53444513
MHS		 72 UsbCommand c = {CMD_SNOOP_ICLASS};
73 SendCommand(&c);
74 return 0;
cee5a30d 75}
e98572a1 76
77int usage_hf_iclass_sim(void) {
41524d8a
MHS		 78 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
79 PrintAndLog(" options");
80 PrintAndLog(" 0 <CSN> simulate the given CSN");
81 PrintAndLog(" 1 simulate default CSN");
82 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
83 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
84 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
85 PrintAndLog(" example: hf iclass sim 2");
86 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
87 PrintAndLog(" hf iclass sim 3");
88 return 0;
89}
90
6116c796 91#define NUM_CSNS 15
e98572a1 92int CmdHFiClassSim(const char *Cmd) {
53444513
MHS		 93 uint8_t simType = 0;
94 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
95
96 if (strlen(Cmd)<1) {
1defcf60 97 return usage_hf_iclass_sim();
53444513 98 }
1defcf60 99 simType = param_get8ex(Cmd, 0, 0, 10);
53444513
MHS		 100
101 if(simType == 0)
102 {
103 if (param_gethex(Cmd, 1, CSN, 16)) {
104 PrintAndLog("A CSN should consist of 16 HEX symbols");
41524d8a 105 return usage_hf_iclass_sim();
53444513 106 }
53444513 107
41524d8a 108 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
53444513 109 }
41524d8a 110 if(simType > 3)
53444513
MHS		 111 {
112 PrintAndLog("Undefined simptype %d", simType);
41524d8a 113 return usage_hf_iclass_sim();
53444513 114 }
1e262141 115
41524d8a 116 uint8_t numberOfCSNs=0;
9f6e9d15
MHS		 117 if(simType == 2)
118 {
6116c796 119 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
9f6e9d15 120 UsbCommand resp = {0};
17cba269 121
53444513
MHS		 122 uint8_t csns[8*NUM_CSNS] = {
123 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
136 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
137 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
6116c796
MHS		 138
139 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
9f6e9d15
MHS		 140
141 SendCommand(&c);
142 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
143 PrintAndLog("Command timed out");
144 return 0;
145 }
1e262141 146
77abe781 147 uint8_t num_mac_responses = resp.arg[1];
6116c796 148 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
9f6e9d15 149
6116c796 150 size_t datalen = NUM_CSNS*24;
9f6e9d15
MHS		 151 /*
152 * Now, time to dump to file. We'll use this format:
77abe781 153 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15 154 * So, it should wind up as
77abe781
MHS		 155 * 8 * 24 bytes.
156 *
157 * The returndata from the pm3 is on the following format
158 * <4 byte NR><4 byte MAC>
159 * CC are all zeroes, CSN is the same as was sent in
9f6e9d15 160 **/
77abe781
MHS		 161 void* dump = malloc(datalen);
162 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15 163 uint8_t i = 0;
6116c796 164 for(i = 0 ; i < NUM_CSNS ; i++)
9f6e9d15 165 {
77abe781
MHS		 166 memcpy(dump+i*24, csns+i*8,8); //CSN
167 //8 zero bytes here...
168 //Then comes NR_MAC (eight bytes from the response)
169 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
1e262141 170
9f6e9d15
MHS		 171 }
172 /** Now, save to dumpfile **/
77abe781
MHS		 173 saveFile("iclass_mac_attack", "bin", dump,datalen);
174 free(dump);
9f6e9d15
MHS		 175 }else
176 {
177 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
178 memcpy(c.d.asBytes, CSN, 8);
179 SendCommand(&c);
180 }
1e262141 181
53444513 182 return 0;
1e262141 183}
184
e98572a1 185int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
8949bb5d 186 bool tagFound = false;
caaf9618
MHS		 187 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
188 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
e98572a1 189 // loop in client not device - else on windows have a communication error
190 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
53444513
MHS		 191 UsbCommand resp;
192 while(!ukbhit()){
e98572a1 193 SendCommand(&c);
6ce0e538 194 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
caaf9618 195 uint8_t readStatus = resp.arg[0] & 0xff;
6ce0e538 196 uint8_t *data = resp.d.asBytes;
53444513 197
8949bb5d 198 if (verbose)
caaf9618
MHS		 199 PrintAndLog("Readstatus:%02x", readStatus);
200 if( readStatus == 0){
53444513 201 //Aborted
8949bb5d 202 if (verbose) PrintAndLog("Quitting...");
53444513
MHS		 203 return 0;
204 }
8949bb5d 205 if( readStatus & FLAG_ICLASS_READER_CSN){
206 PrintAndLog("CSN: %s",sprint_hex(data,8));
207 tagFound = true;
208 }
caaf9618
MHS		 209 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
210 if( readStatus & FLAG_ICLASS_READER_CONF){
211 printIclassDumpInfo(data);
53444513 212 }
8949bb5d 213 if (tagFound && !loop) return 1;
53444513 214 } else {
8949bb5d 215 if (verbose) PrintAndLog("Command execute timeout");
53444513 216 }
8949bb5d 217 if (!loop) break;
53444513 218 }
53444513 219 return 0;
8949bb5d 220}
221
e98572a1 222int CmdHFiClassReader(const char *Cmd) {
8949bb5d 223 return HFiClassReader(Cmd, true, true);
c3963755 224}
225
e98572a1 226int CmdHFiClassReader_Replay(const char *Cmd) {
53444513
MHS		 227 uint8_t readerType = 0;
228 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
c3963755 229
53444513
MHS		 230 if (strlen(Cmd)<1) {
231 PrintAndLog("Usage: hf iclass replay <MAC>");
232 PrintAndLog(" sample: hf iclass replay 00112233");
233 return 0;
234 }
c3963755 235
53444513
MHS		 236 if (param_gethex(Cmd, 0, MAC, 8)) {
237 PrintAndLog("MAC must include 8 HEX symbols");
238 return 1;
239 }
c3963755 240
53444513
MHS		 241 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
242 memcpy(c.d.asBytes, MAC, 4);
243 SendCommand(&c);
1e262141 244
53444513 245 return 0;
1e262141 246}
247
e98572a1 248int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
249 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
250 memcpy(c.d.asBytes, data, blocksCount * 16);
53444513 251 SendCommand(&c);
53444513 252 return 0;
1e262141 253}
254
e98572a1 255int hf_iclass_eload_usage(void) {
7781a656
MHS		 256 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
257 PrintAndLog("Usage: hf iclass eload f <filename>");
258 PrintAndLog("");
259 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
260 return 0;
7781a656
MHS		 261}
262
e98572a1 263int CmdHFiClassELoad(const char *Cmd) {
7781a656
MHS		 264
265 char opt = param_getchar(Cmd, 0);
266 if (strlen(Cmd)<1 || opt == 'h')
267 return hf_iclass_eload_usage();
268
269 //File handling and reading
270 FILE *f;
271 char filename[FILE_PATH_SIZE];
9c4e28a4 272 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
7781a656 273 f = fopen(filename, "rb");
9c4e28a4 274 } else {
7781a656
MHS		 275 return hf_iclass_eload_usage();
276 }
277
278 if(!f) {
279 PrintAndLog("Failed to read from file '%s'", filename);
280 return 1;
281 }
282
283 fseek(f, 0, SEEK_END);
284 long fsize = ftell(f);
285 fseek(f, 0, SEEK_SET);
286
9c4e28a4 287 if (fsize < 0) {
288 prnlog("Error, when getting filesize");
4bb17c66 289 fclose(f);
9c4e28a4 290 return 1;
291 }
292
9c4e28a4 293 uint8_t *dump = malloc(fsize);
1defcf60 294
7781a656
MHS		 295 size_t bytes_read = fread(dump, 1, fsize, f);
296 fclose(f);
297
1defcf60 298 printIclassDumpInfo(dump);
7781a656
MHS		 299 //Validate
300
301 if (bytes_read < fsize)
302 {
303 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
304 free(dump);
305 return 1;
306 }
307 //Send to device
308 uint32_t bytes_sent = 0;
309 uint32_t bytes_remaining = bytes_read;
310
311 while(bytes_remaining > 0){
312 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
313 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
314 memcpy(c.d.asBytes, dump, bytes_in_packet);
315 SendCommand(&c);
316 bytes_remaining -= bytes_in_packet;
317 bytes_sent += bytes_in_packet;
318 }
319 free(dump);
320 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
321 return 0;
322}
323
e98572a1 324static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
41524d8a
MHS		 325 FILE *f = fopen(filename, "rb");
326 if(!f) {
327 PrintAndLog("Failed to read from file '%s'", filename);
328 return 1;
329 }
330 fseek(f, 0, SEEK_END);
331 long fsize = ftell(f);
332 fseek(f, 0, SEEK_SET);
333 size_t bytes_read = fread(buffer, 1, len, f);
334 fclose(f);
335 if(fsize != len)
336 {
337 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
338 return 1;
339 }
340 if(bytes_read != len)
341 {
342 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
343 return 1;
344 }
345 return 0;
346}
347
e98572a1 348int usage_hf_iclass_decrypt(void) {
349 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
350 PrintAndLog("");
351 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
352 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
353 PrintAndLog("");
354 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
355 PrintAndLog("");
356 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
357 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
358 PrintAndLog("which is defined by the configuration block.");
359 return 1;
360}
361
362int CmdHFiClassDecrypt(const char *Cmd) {
41524d8a
MHS		 363 uint8_t key[16] = { 0 };
364 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
365 {
366 usage_hf_iclass_decrypt();
367 return 1;
368 }
369 PrintAndLog("Decryption file found... ");
370 char opt = param_getchar(Cmd, 0);
371 if (strlen(Cmd)<1 || opt == 'h')
372 return usage_hf_iclass_decrypt();
373
374 //Open the tagdump-file
375 FILE *f;
376 char filename[FILE_PATH_SIZE];
377 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
378 {
379 f = fopen(filename, "rb");
380 }else{
381 return usage_hf_iclass_decrypt();
382 }
383
384 fseek(f, 0, SEEK_END);
385 long fsize = ftell(f);
386 fseek(f, 0, SEEK_SET);
387 uint8_t enc_dump[8] = {0};
388 uint8_t *decrypted = malloc(fsize);
389 des3_context ctx = { DES_DECRYPT ,{ 0 } };
390 des3_set2key_dec( &ctx, key);
391 size_t bytes_read = fread(enc_dump, 1, 8, f);
392
393 //Use the first block (CSN) for filename
394 char outfilename[FILE_PATH_SIZE] = { 0 };
395 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
396 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
397 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
398
399 size_t blocknum =0;
400 while(bytes_read == 8)
401 {
9a9bcea8 402 if(blocknum < 7)
41524d8a
MHS		 403 {
404 memcpy(decrypted+(blocknum*8), enc_dump, 8);
405 }else{
406 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
407 }
408 printvar("decrypted block", decrypted +(blocknum*8), 8);
409 bytes_read = fread(enc_dump, 1, 8, f);
410 blocknum++;
411 }
412 fclose(f);
413
414 saveFile(outfilename,"bin", decrypted, blocknum*8);
415
ab7bb494 416 free(decrypted);
41524d8a
MHS		 417 return 0;
418}
7781a656 419
e98572a1 420int usage_hf_iclass_encrypt(void) {
421 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
422 PrintAndLog("");
423 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
424 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
425 PrintAndLog("");
426 PrintAndLog("example: hf iclass encrypt 0102030405060708");
427 PrintAndLog("");
428 return 0;
429}
430
431static int iClassEncryptBlkData(uint8_t *blkData) {
432 uint8_t key[16] = { 0 };
433 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
434 {
435 usage_hf_iclass_encrypt();
436 return 1;
437 }
438 PrintAndLog("Decryption file found... ");
53444513 439
e98572a1 440 uint8_t encryptedData[16];
441 uint8_t *encrypted = encryptedData;
442 des3_context ctx = { DES_DECRYPT ,{ 0 } };
443 des3_set2key_enc( &ctx, key);
444
445 des3_crypt_ecb(&ctx, blkData,encrypted);
446 //printvar("decrypted block", decrypted, 8);
447 memcpy(blkData,encrypted,8);
448
449 return 1;
450}
53444513 451
e98572a1 452int CmdHFiClassEncryptBlk(const char *Cmd) {
453 uint8_t blkData[8] = {0};
454 char opt = param_getchar(Cmd, 0);
455 if (strlen(Cmd)<1 || opt == 'h')
456 return usage_hf_iclass_encrypt();
457
458 //get the bytes to encrypt
459 if (param_gethex(Cmd, 0, blkData, 16))
53444513 460 {
e98572a1 461 PrintAndLog("BlockData must include 16 HEX symbols");
53444513
MHS		 462 return 0;
463 }
e98572a1 464 if (!iClassEncryptBlkData(blkData)) return 0;
53444513 465
e98572a1 466 printvar("encrypted block", blkData, 8);
467 return 1;
468}
469
470void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
471 uint8_t WB[9];
472 WB[0] = blockno;
473 memcpy(WB + 1,data,8);
474 doMAC_N(WB,sizeof(WB),div_key,MAC);
475 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
476}
477
478static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
479 UsbCommand resp;
480
481 UsbCommand c = {CMD_READER_ICLASS, {0}};
482 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
483 if (use_credit_key)
484 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
485
486 clearCommandBuffer();
487 SendCommand(&c);
488 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
53444513 489 {
e98572a1 490 PrintAndLog("Command execute timeout");
491 return false;
53444513
MHS		 492 }
493
e98572a1 494 uint8_t isOK = resp.arg[0] & 0xff;
495 uint8_t *data = resp.d.asBytes;
496
497 memcpy(CSN,data,8);
498 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
499 if(isOK > 0)
53444513 500 {
e98572a1 501 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
502 }
503 if(isOK <= 1){
504 PrintAndLog("Failed to obtain CC! Aborting");
505 return false;
53444513 506 }
e98572a1 507 return true;
508}
509
a7474bb3 510static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
e98572a1 511 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
512 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
513
514 if (!select_only(CSN, CCNR, use_credit_key, verbose))
515 return false;
516
517 //get div_key
a7474bb3 518 if(rawkey)
519 memcpy(div_key, KEY, 8);
520 else
e98572a1 521 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
a7474bb3 522 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
e98572a1 523
524 doMAC(CCNR, div_key, MAC);
525 UsbCommand resp;
526 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
527 memcpy(d.d.asBytes, MAC, 4);
528 clearCommandBuffer();
529 SendCommand(&d);
530 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
53444513 531 {
e98572a1 532 PrintAndLog("Auth Command execute timeout");
533 return false;
534 }
535 uint8_t isOK = resp.arg[0] & 0xff;
536 if (!isOK) {
537 PrintAndLog("Authentication error");
538 return false;
53444513 539 }
e98572a1 540 return true;
541}
53444513 542
e98572a1 543int usage_hf_iclass_dump(void) {
a7474bb3 544 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
e98572a1 545 PrintAndLog("Options:");
546 PrintAndLog(" f <filename> : specify a filename to save dump to");
547 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
548 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
549 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
550 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
551 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
a7474bb3 552 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
e98572a1 553 PrintAndLog(" NOTE: * = required");
554 PrintAndLog("Samples:");
555 PrintAndLog(" hf iclass dump k 001122334455667B");
556 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
557 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
558 return 0;
559}
560
561int CmdHFiClassReader_Dump(const char *Cmd) {
562
563 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
564 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
565 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
566 uint8_t blockno = 0;
567 uint8_t numblks = 0;
568 uint8_t maxBlk = 31;
569 uint8_t app_areas = 1;
570 uint8_t kb = 2;
571 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
572 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
573 uint8_t keyNbr = 0;
574 uint8_t dataLen = 0;
575 uint8_t fileNameLen = 0;
576 char filename[FILE_PATH_SIZE]={0};
577 char tempStr[50] = {0};
578 bool have_debit_key = false;
579 bool have_credit_key = false;
580 bool use_credit_key = false;
581 bool elite = false;
a7474bb3 582 bool rawkey = false;
e98572a1 583 bool errors = false;
584 uint8_t cmdp = 0;
585
586 while(param_getchar(Cmd, cmdp) != 0x00)
587 {
588 switch(param_getchar(Cmd, cmdp))
589 {
590 case 'h':
591 case 'H':
592 return usage_hf_iclass_dump();
593 case 'c':
594 case 'C':
595 have_credit_key = true;
596 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
597 if (dataLen == 16) {
598 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
599 } else if (dataLen == 1) {
600 keyNbr = param_get8(Cmd, cmdp+1);
601 if (keyNbr <= ICLASS_KEYS_MAX) {
602 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
603 } else {
604 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
605 errors = true;
606 }
607 } else {
608 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
609 errors = true;
610 }
611 cmdp += 2;
612 break;
613 case 'e':
614 case 'E':
615 elite = true;
616 cmdp++;
617 break;
618 case 'f':
619 case 'F':
620 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
621 if (fileNameLen < 1) {
622 PrintAndLog("No filename found after f");
623 errors = true;
624 }
625 cmdp += 2;
626 break;
627 case 'k':
628 case 'K':
629 have_debit_key = true;
630 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
631 if (dataLen == 16) {
632 errors = param_gethex(tempStr, 0, KEY, dataLen);
633 } else if (dataLen == 1) {
634 keyNbr = param_get8(Cmd, cmdp+1);
635 if (keyNbr <= ICLASS_KEYS_MAX) {
636 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
637 } else {
638 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
639 errors = true;
640 }
641 } else {
642 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
643 errors = true;
644 }
645 cmdp += 2;
646 break;
a7474bb3 647 case 'r':
648 case 'R':
649 rawkey = true;
650 cmdp++;
651 break;
e98572a1 652 default:
653 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
654 errors = true;
655 break;
656 }
657 if(errors) return usage_hf_iclass_dump();
658 }
659
660 if (cmdp < 2) return usage_hf_iclass_dump();
661 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
662 if (!have_debit_key && have_credit_key) use_credit_key = true;
663
664 //get config and first 3 blocks
665 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
666 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
53444513 667 UsbCommand resp;
e98572a1 668 uint8_t tag_data[255*8];
53444513 669
e98572a1 670 clearCommandBuffer();
671 SendCommand(&c);
672 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
673 PrintAndLog("Command execute timeout");
674 ul_switch_off_field();
675 return 0;
676 }
677 uint8_t readStatus = resp.arg[0] & 0xff;
53444513
MHS		 678 uint8_t * data = resp.d.asBytes;
679
e98572a1 680 if(readStatus == 0){
681 PrintAndLog("No tag found...");
682 ul_switch_off_field();
683 return 0;
684}
685 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
686 memcpy(tag_data, data, 8*3);
687 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
688 numblks = data[8];
689 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
690 // large memory - not able to dump pages currently
691 if (numblks > maxBlk) numblks = maxBlk;
692 }
693 ul_switch_off_field();
694 // authenticate debit key and get div_key - later store in dump block 3
a7474bb3 695 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
e98572a1 696 //try twice - for some reason it sometimes fails the first time...
a7474bb3 697 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
e98572a1 698 ul_switch_off_field();
699 return 0;
700 }
53444513 701 }
e98572a1 702
703 // begin dump
704 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
705 clearCommandBuffer();
706 SendCommand(&w);
707 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
708 PrintAndLog("Command execute time-out 1");
709 ul_switch_off_field();
710 return 1;
711 }
712 uint32_t blocksRead = resp.arg[1];
713 uint8_t isOK = resp.arg[0] & 0xff;
714 if (!isOK && !blocksRead) {
715 PrintAndLog("Read Block Failed");
716 ul_switch_off_field();
717 return 0;
718 }
719 uint32_t startindex = resp.arg[2];
720 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
721 PrintAndLog("Data exceeded Buffer size!");
722 blocksRead = (sizeof(tag_data)/8) - blockno;
723 }
724 // response ok - now get bigbuf content of the dump
725 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
726 WaitForResponse(CMD_ACK,NULL);
727 size_t gotBytes = blocksRead*8 + blockno*8;
728
729 // try AA2
730 if (have_credit_key) {
731 //turn off hf field before authenticating with different key
732 ul_switch_off_field();
733 memset(MAC,0,4);
734 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
a7474bb3 735 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
e98572a1 736 //try twice - for some reason it sometimes fails the first time...
a7474bb3 737 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
e98572a1 738 ul_switch_off_field();
739 return 0;
740 }
741 }
742 // do we still need to read more block? (aa2 enabled?)
743 if (maxBlk > blockno+numblks+1) {
744 // setup dump and start
745 w.arg[0] = blockno + blocksRead;
746 w.arg[1] = maxBlk - (blockno + blocksRead);
747 clearCommandBuffer();
748 SendCommand(&w);
749 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
750 PrintAndLog("Command execute timeout 2");
751 ul_switch_off_field();
752 return 0;
753 }
754 uint8_t isOK = resp.arg[0] & 0xff;
755 blocksRead = resp.arg[1];
756 if (!isOK && !blocksRead) {
757 PrintAndLog("Read Block Failed 2");
758 ul_switch_off_field();
759 return 0;
760 }
53444513 761
e98572a1 762 startindex = resp.arg[2];
763 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
764 PrintAndLog("Data exceeded Buffer size!");
765 blocksRead = (sizeof(tag_data) - gotBytes)/8;
766 }
767 // get dumped data from bigbuf
768 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
769 WaitForResponse(CMD_ACK,NULL);
53444513 770
e98572a1 771 gotBytes += blocksRead*8;
772 } else { //field is still on - turn it off...
773 ul_switch_off_field();
774 }
775 }
53444513 776
e98572a1 777 // add diversified keys to dump
778 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
779 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
780 // print the dump
781 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
782 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
783 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
784
785 if (filename[0] == 0){
786 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
787 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
788 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
789 }
53444513 790
e98572a1 791 // save the dump to .bin file
792 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
793 saveFile(filename, "bin", tag_data, gotBytes);
794 return 1;
795}
53444513 796
a7474bb3 797static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
e98572a1 798 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
799 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
a7474bb3 800 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
e98572a1 801 return 0;
802
803 UsbCommand resp;
804
805 Calc_wb_mac(blockno,bldata,div_key,MAC);
806 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
807 memcpy(w.d.asBytes, bldata, 8);
808 memcpy(w.d.asBytes + 8, MAC, 4);
809
810 clearCommandBuffer();
811 SendCommand(&w);
812 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
813 {
814 PrintAndLog("Write Command execute timeout");
815 return 0;
816 }
817 uint8_t isOK = resp.arg[0] & 0xff;
818 if (!isOK) {
819 PrintAndLog("Write Block Failed");
820 return 0;
821 }
822 PrintAndLog("Write Block Successful");
823 return 1;
824}
825
826int usage_hf_iclass_writeblock(void) {
827 PrintAndLog("Options:");
828 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
829 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
830 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
831 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
832 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
a7474bb3 833 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
e98572a1 834 PrintAndLog("Samples:");
835 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
836 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
837 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
838 return 0;
839}
840
841int CmdHFiClass_WriteBlock(const char *Cmd) {
842 uint8_t blockno=0;
843 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
844 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
845 uint8_t keyNbr = 0;
846 uint8_t dataLen = 0;
847 char tempStr[50] = {0};
848 bool use_credit_key = false;
849 bool elite = false;
a7474bb3 850 bool rawkey= false;
e98572a1 851 bool errors = false;
852 uint8_t cmdp = 0;
853 while(param_getchar(Cmd, cmdp) != 0x00)
854 {
855 switch(param_getchar(Cmd, cmdp))
856 {
857 case 'h':
858 case 'H':
859 return usage_hf_iclass_writeblock();
860 case 'b':
861 case 'B':
862 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
863 PrintAndLog("Block No must include 2 HEX symbols\n");
864 errors = true;
865 }
866 cmdp += 2;
867 break;
868 case 'c':
869 case 'C':
870 use_credit_key = true;
871 cmdp++;
872 break;
873 case 'd':
874 case 'D':
875 if (param_gethex(Cmd, cmdp+1, bldata, 16))
876 {
877 PrintAndLog("KEY must include 16 HEX symbols\n");
878 errors = true;
879 }
880 cmdp += 2;
881 break;
882 case 'e':
883 case 'E':
884 elite = true;
885 cmdp++;
886 break;
887 case 'k':
888 case 'K':
889 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
890 if (dataLen == 16) {
891 errors = param_gethex(tempStr, 0, KEY, dataLen);
892 } else if (dataLen == 1) {
893 keyNbr = param_get8(Cmd, cmdp+1);
894 if (keyNbr <= ICLASS_KEYS_MAX) {
895 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
896 } else {
897 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
898 errors = true;
899 }
900 } else {
901 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
902 errors = true;
903 }
904 cmdp += 2;
905 break;
a7474bb3 906 case 'r':
907 case 'R':
908 rawkey = true;
909 cmdp++;
910 break;
e98572a1 911 default:
912 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
913 errors = true;
914 break;
915 }
916 if(errors) return usage_hf_iclass_writeblock();
917 }
918
919 if (cmdp < 6) return usage_hf_iclass_writeblock();
a7474bb3 920 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
e98572a1 921 ul_switch_off_field();
922 return ans;
923}
924
925int usage_hf_iclass_clone(void) {
a7474bb3 926 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
e98572a1 927 PrintAndLog("Options:");
928 PrintAndLog(" f <filename>: specify a filename to clone from");
929 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
930 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
931 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
932 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
933 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
a7474bb3 934 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
e98572a1 935 PrintAndLog("Samples:");
936 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
937 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
938 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
939 return -1;
940}
941
942int CmdHFiClassCloneTag(const char *Cmd) {
943 char filename[FILE_PATH_SIZE];
944 char tempStr[50]={0};
945 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
946 uint8_t keyNbr = 0;
947 uint8_t fileNameLen = 0;
948 uint8_t startblock = 0;
949 uint8_t endblock = 0;
950 uint8_t dataLen = 0;
951 bool use_credit_key = false;
952 bool elite = false;
a7474bb3 953 bool rawkey = false;
e98572a1 954 bool errors = false;
955 uint8_t cmdp = 0;
956 while(param_getchar(Cmd, cmdp) != 0x00)
957 {
958 switch(param_getchar(Cmd, cmdp))
959 {
960 case 'h':
961 case 'H':
962 return usage_hf_iclass_clone();
963 case 'b':
964 case 'B':
965 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
966 PrintAndLog("Start Block No must include 2 HEX symbols\n");
967 errors = true;
968 }
969 cmdp += 2;
970 break;
971 case 'c':
972 case 'C':
973 use_credit_key = true;
974 cmdp++;
975 break;
976 case 'e':
977 case 'E':
978 elite = true;
979 cmdp++;
980 break;
981 case 'f':
982 case 'F':
983 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
984 if (fileNameLen < 1) {
985 PrintAndLog("No filename found after f");
986 errors = true;
987 }
988 cmdp += 2;
989 break;
990 case 'k':
991 case 'K':
992 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
993 if (dataLen == 16) {
994 errors = param_gethex(tempStr, 0, KEY, dataLen);
995 } else if (dataLen == 1) {
996 keyNbr = param_get8(Cmd, cmdp+1);
997 if (keyNbr <= ICLASS_KEYS_MAX) {
998 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
999 } else {
1000 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1001 errors = true;
1002 }
1003 } else {
1004 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1005 errors = true;
1006 }
1007 cmdp += 2;
1008 break;
1009 case 'l':
1010 case 'L':
1011 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1012 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1013 errors = true;
1014 }
1015 cmdp += 2;
1016 break;
a7474bb3 1017 case 'r':
1018 case 'R':
1019 rawkey = true;
1020 cmdp++;
1021 break;
e98572a1 1022 default:
1023 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1024 errors = true;
1025 break;
1026 }
1027 if(errors) return usage_hf_iclass_clone();
1028 }
1029
1030 if (cmdp < 8) return usage_hf_iclass_clone();
1031
1032 FILE *f;
1033
1034 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1035
1036 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1037 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1038 }
1039 // file handling and reading
1040 f = fopen(filename,"rb");
1041 if(!f) {
1042 PrintAndLog("Failed to read from file '%s'", filename);
1043 return 1;
1044 }
1045
1046 if (startblock<5) {
1047 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1048 return 0;
1049 }
1050 // now read data from the file from block 6 --- 19
1051 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1052 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1053 // else we have to create a share memory
1054 int i;
1055 fseek(f,startblock*8,SEEK_SET);
2b9006bd 1056 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0){
1057 PrintAndLog("File reading error.");
1058 fclose(f);
1059 return 2;
1060 }
e98572a1 1061
1062 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1063 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1064
a7474bb3 1065 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
e98572a1 1066 return 0;
1067
1068 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
1069 uint8_t *ptr;
1070 // calculate all mac for every the block we will write
1071 for (i = startblock; i <= endblock; i++){
1072 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1073 // usb command d start pointer = d + (i - 6) * 12
1074 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1075 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1076 // next one
1077 ptr = w.d.asBytes + (i - startblock) * 12;
1078 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1079 memcpy(ptr + 8,MAC, 4);
1080 }
1081 uint8_t p[12];
1082 for (i = 0; i <= endblock - startblock;i++){
1083 memcpy(p,w.d.asBytes + (i * 12),12);
1084 printf("Block |%02x|",i + startblock);
1085 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1086 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1087 }
1088 UsbCommand resp;
1089 SendCommand(&w);
1090 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1091 {
1092 PrintAndLog("Command execute timeout");
1093 return 0;
1094 }
1095 return 1;
1096}
1097
a7474bb3 1098static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose) {
e98572a1 1099 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1100 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1101
a7474bb3 1102 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
e98572a1 1103 return 0;
1104
1105 UsbCommand resp;
1106 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
1107 clearCommandBuffer();
1108 SendCommand(&w);
1109 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1110 {
53444513 1111 PrintAndLog("Command execute timeout");
e98572a1 1112 return 0;
53444513 1113 }
e98572a1 1114 uint8_t isOK = resp.arg[0] & 0xff;
1115 if (!isOK) {
1116 PrintAndLog("Read Block Failed");
1117 return 0;
1118 }
1119 //data read is stored in: resp.d.asBytes[0-15]
1120 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1121 return 1;
1122}
1123
1124int usage_hf_iclass_readblock(void) {
a7474bb3 1125 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
e98572a1 1126 PrintAndLog("Options:");
1127 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1128 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1129 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1130 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
a7474bb3 1131 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
e98572a1 1132 PrintAndLog("Samples:");
1133 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1134 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1135 PrintAndLog(" hf iclass readblk b 0A k 0");
53444513 1136 return 0;
a66fca86 1137}
e98572a1 1138
1139int CmdHFiClass_ReadBlock(const char *Cmd) {
1140 uint8_t blockno=0;
1141 uint8_t keyType = 0x88; //debit key
1142 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1143 uint8_t keyNbr = 0;
1144 uint8_t dataLen = 0;
1145 char tempStr[50] = {0};
1146 bool elite = false;
a7474bb3 1147 bool rawkey = false;
e98572a1 1148 bool errors = false;
1149 uint8_t cmdp = 0;
1150 while(param_getchar(Cmd, cmdp) != 0x00)
1151 {
1152 switch(param_getchar(Cmd, cmdp))
1153 {
1154 case 'h':
1155 case 'H':
1156 return usage_hf_iclass_readblock();
1157 case 'b':
1158 case 'B':
1159 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1160 PrintAndLog("Block No must include 2 HEX symbols\n");
1161 errors = true;
1162 }
1163 cmdp += 2;
1164 break;
1165 case 'c':
1166 case 'C':
1167 keyType = 0x18;
1168 cmdp++;
1169 break;
1170 case 'e':
1171 case 'E':
1172 elite = true;
1173 cmdp++;
1174 break;
1175 case 'k':
1176 case 'K':
1177 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1178 if (dataLen == 16) {
1179 errors = param_gethex(tempStr, 0, KEY, dataLen);
1180 } else if (dataLen == 1) {
1181 keyNbr = param_get8(Cmd, cmdp+1);
1182 if (keyNbr <= ICLASS_KEYS_MAX) {
1183 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1184 } else {
1185 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1186 errors = true;
1187 }
1188 } else {
1189 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1190 errors = true;
1191 }
1192 cmdp += 2;
1193 break;
a7474bb3 1194 case 'r':
1195 case 'R':
1196 rawkey = true;
1197 cmdp++;
1198 break;
e98572a1 1199 default:
1200 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1201 errors = true;
1202 break;
1203 }
1204 if(errors) return usage_hf_iclass_readblock();
1205 }
1206
1207 if (cmdp < 4) return usage_hf_iclass_readblock();
1208
a7474bb3 1209 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true);
e98572a1 1210}
1211
1212int CmdHFiClass_loclass(const char *Cmd) {
6f101995
MHS		 1213 char opt = param_getchar(Cmd, 0);
1214
1215 if (strlen(Cmd)<1 || opt == 'h') {
1216 PrintAndLog("Usage: hf iclass loclass [options]");
1217 PrintAndLog("Options:");
1218 PrintAndLog("h Show this help");
1219 PrintAndLog("t Perform self-test");
1220 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1221 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1222 PrintAndLog(" malicious CSNs, and their protocol responses");
1223 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1224 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1225 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1226 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1227 PrintAndLog(" ... totalling N*24 bytes");
1228 return 0;
1229 }
1230 char fileName[255] = {0};
1231 if(opt == 'f')
1232 {
53444513
MHS		 1233 if(param_getstr(Cmd, 1, fileName) > 0)
1234 {
1235 return bruteforceFileNoKeys(fileName);
1236 }else
1237 {
1238 PrintAndLog("You must specify a filename");
1239 }
6f101995
MHS		 1240 }
1241 else if(opt == 't')
1242 {
1243 int errors = testCipherUtils();
1244 errors += testMAC();
1245 errors += doKeyTests(0);
1246 errors += testElite();
1247 if(errors)
1248 {
1249 prnlog("OBS! There were errors!!!");
1250 }
1251 return errors;
1252 }
a66fca86 1253
6f101995
MHS		 1254 return 0;
1255}
c3963755 1256
e98572a1 1257void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1258 uint8_t blockdata[8];
1259 uint8_t mem_config;
1260 memcpy(&mem_config, iclass_dump + 13,1);
1261 uint8_t maxmemcount;
1262 uint8_t filemaxblock = filesize / 8;
1263 if (mem_config & 0x80)
1264 maxmemcount = 255;
1265 else
1266 maxmemcount = 31;
1267 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1268
1269 if (startblock == 0)
1270 startblock = 6;
1271 if ((endblock > maxmemcount) || (endblock == 0))
1272 endblock = maxmemcount;
1273 if (endblock > filemaxblock)
1274 endblock = filemaxblock;
1275 int i = startblock;
1276 int j;
1277 while (i <= endblock){
1278 printf("Block |%02X| ",i);
1279 memcpy(blockdata,iclass_dump + (i * 8),8);
1280 for (j = 0;j < 8;j++)
1281 printf("%02X ",blockdata[j]);
1282 printf("|\n");
1283 i++;
1284 }
1285}
1286
1287int usage_hf_iclass_readtagfile() {
1288 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1289 return 1;
1290}
1291
1292int CmdHFiClassReadTagFile(const char *Cmd) {
1293 int startblock = 0;
1294 int endblock = 0;
1295 char tempnum[5];
1296 FILE *f;
1297 char filename[FILE_PATH_SIZE];
1298 if (param_getstr(Cmd, 0, filename) < 1)
1299 return usage_hf_iclass_readtagfile();
1300 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1301 startblock = 0;
1302 else
1303 sscanf(tempnum,"%d",&startblock);
1304
1305 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1306 endblock = 0;
1307 else
1308 sscanf(tempnum,"%d",&endblock);
1309 // file handling and reading
1310 f = fopen(filename,"rb");
1311 if(!f) {
1312 PrintAndLog("Failed to read from file '%s'", filename);
1313 return 1;
1314 }
1315 fseek(f, 0, SEEK_END);
1316 long fsize = ftell(f);
1317 fseek(f, 0, SEEK_SET);
1318
1319 uint8_t *dump = malloc(fsize);
1320
1321
1322 size_t bytes_read = fread(dump, 1, fsize, f);
1323 fclose(f);
1324 uint8_t *csn = dump;
1325 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
1326 // printIclassDumpInfo(dump);
1327 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1328 free(dump);
1329 return 0;
1330}
1331
1332/*
1333uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1334 uint64_t new_div = 0x00;
1335 new_div ^= sdiv;
1336 new_div ^= hdiv;
1337 return new_div;
1338}
1339
1340uint64_t hexarray_to_uint64(uint8_t *key) {
1341 char temp[17];
1342 uint64_t uint_key;
1343 for (int i = 0;i < 8;i++)
1344 sprintf(&temp[(i *2)],"%02X",key[i]);
1345 temp[16] = '\0';
1346 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1347 return 0;
1348 return uint_key;
1349}
1350*/
1351void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1352 uint8_t keytable[128] = {0};
1353 uint8_t key_index[8] = {0};
1354 if (elite) {
1355 uint8_t key_sel[8] = { 0 };
1356 uint8_t key_sel_p[8] = { 0 };
1357 hash2(KEY, keytable);
1358 hash1(CSN, key_index);
1359 for(uint8_t i = 0; i < 8 ; i++)
1360 key_sel[i] = keytable[key_index[i]] & 0xFF;
1361
1362 //Permute from iclass format to standard format
1363 permutekey_rev(key_sel, key_sel_p);
1364 diversifyKey(CSN, key_sel_p, div_key);
1365 } else {
1366 diversifyKey(CSN, KEY, div_key);
1367 }
1368}
1369
1370//when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1371//calculate and return xor_div_key (ready for a key write command)
1372//print all div_keys if verbose
1373static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1374 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1375 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1376 //get old div key
1377 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1378 //get new div key
1379 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1380
1381 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1382 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1383 }
1384 if (verbose) {
1385 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1386 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1387 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1388 }
1389}
1390
1391int usage_hf_iclass_calc_newkey(void) {
1392 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1393 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1394 PrintAndLog(" Options:");
1395 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1396 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1397 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1398 PrintAndLog(" e : specify new key as elite calc");
1399 PrintAndLog(" ee : specify old and new key as elite calc");
1400 PrintAndLog("Samples:");
1401 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1402 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1403 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1404 PrintAndLog("NOTE: * = required\n");
1405
1406 return 1;
1407}
1408
1409int CmdHFiClassCalcNewKey(const char *Cmd) {
1410 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1411 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1412 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1413 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1414 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1415 uint8_t keyNbr = 0;
1416 uint8_t dataLen = 0;
1417 char tempStr[50] = {0};
1418 bool givenCSN = false;
1419 bool oldElite = false;
1420 bool elite = false;
1421 bool errors = false;
1422 uint8_t cmdp = 0;
1423 while(param_getchar(Cmd, cmdp) != 0x00)
1424 {
1425 switch(param_getchar(Cmd, cmdp))
1426 {
1427 case 'h':
1428 case 'H':
1429 return usage_hf_iclass_calc_newkey();
1430 case 'e':
1431 case 'E':
1432 dataLen = param_getstr(Cmd, cmdp, tempStr);
1433 if (dataLen==2)
1434 oldElite = true;
1435 elite = true;
1436 cmdp++;
1437 break;
1438 case 'n':
1439 case 'N':
1440 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1441 if (dataLen == 16) {
1442 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1443 } else if (dataLen == 1) {
1444 keyNbr = param_get8(Cmd, cmdp+1);
1445 if (keyNbr <= ICLASS_KEYS_MAX) {
1446 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1447 } else {
1448 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1449 errors = true;
1450 }
1451 } else {
1452 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1453 errors = true;
1454 }
1455 cmdp += 2;
1456 break;
1457 case 'o':
1458 case 'O':
1459 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1460 if (dataLen == 16) {
1461 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1462 } else if (dataLen == 1) {
1463 keyNbr = param_get8(Cmd, cmdp+1);
1464 if (keyNbr <= ICLASS_KEYS_MAX) {
1465 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1466 } else {
1467 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1468 errors = true;
1469 }
1470 } else {
1471 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1472 errors = true;
1473 }
1474 cmdp += 2;
1475 break;
1476 case 's':
1477 case 'S':
1478 givenCSN = true;
1479 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1480 return usage_hf_iclass_calc_newkey();
1481 cmdp += 2;
1482 break;
1483 default:
1484 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1485 errors = true;
1486 break;
1487 }
1488 if(errors) return usage_hf_iclass_calc_newkey();
1489 }
1490
1491 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1492
1493 if (!givenCSN)
1494 if (!select_only(CSN, CCNR, false, true))
1495 return 0;
1496
1497 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1498 return 0;
1499}
1500
1501static int loadKeys(char *filename) {
1502 FILE *f;
1503 f = fopen(filename,"rb");
1504 if(!f) {
1505 PrintAndLog("Failed to read from file '%s'", filename);
1506 return 0;
1507 }
1508 fseek(f, 0, SEEK_END);
1509 long fsize = ftell(f);
1510 fseek(f, 0, SEEK_SET);
1511
4bb17c66 1512 if ( fsize < 0 ) {
1513 PrintAndLog("Error, when getting filesize");
1514 fclose(f);
1515 return 1;
1516 }
1517
e98572a1 1518 uint8_t *dump = malloc(fsize);
1519
1520 size_t bytes_read = fread(dump, 1, fsize, f);
1521 fclose(f);
1522 if (bytes_read > ICLASS_KEYS_MAX * 8){
1523 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1524 free(dump);
1525 return 0;
1526 }
1527 uint8_t i = 0;
1528 for (; i < bytes_read/8; i++){
1529 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1530 }
1531 free(dump);
1532 PrintAndLog("%u keys loaded", i);
1533 return 1;
1534}
1535
1536static int saveKeys(char *filename) {
1537 FILE *f;
1538 f = fopen(filename,"wb");
1539 if (f == NULL) {
1540 printf("error opening file %s\n",filename);
1541 return 0;
1542 }
1543 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1544 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1545 PrintAndLog("save key failed to write to file: %s", filename);
1546 break;
1547 }
1548 }
1549 fclose(f);
1550 return 0;
1551}
1552
1553static int printKeys(void) {
1554 PrintAndLog("");
1555 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1556 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1557 }
1558 PrintAndLog("");
1559 return 0;
1560}
1561
1562int usage_hf_iclass_managekeys(void) {
1563 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1564 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1565 PrintAndLog(" Options:");
1566 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1567 PrintAndLog(" k <key> : set a key in memory");
1568 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1569 PrintAndLog(" s : save keys in memory to file specified by filename");
1570 PrintAndLog(" l : load keys to memory from file specified by filename");
1571 PrintAndLog(" p : print keys loaded into memory\n");
1572 PrintAndLog("Samples:");
1573 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1574 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1575 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1576 PrintAndLog(" print keys : hf iclass managekeys p\n");
1577 return 0;
1578}
1579
1580int CmdHFiClassManageKeys(const char *Cmd) {
1581 uint8_t keyNbr = 0;
1582 uint8_t dataLen = 0;
1583 uint8_t KEY[8] = {0};
1584 char filename[FILE_PATH_SIZE];
1585 uint8_t fileNameLen = 0;
1586 bool errors = false;
1587 uint8_t operation = 0;
1588 char tempStr[20];
1589 uint8_t cmdp = 0;
1590
1591 while(param_getchar(Cmd, cmdp) != 0x00)
1592 {
1593 switch(param_getchar(Cmd, cmdp))
1594 {
1595 case 'h':
1596 case 'H':
1597 return usage_hf_iclass_managekeys();
1598 case 'f':
1599 case 'F':
1600 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1601 if (fileNameLen < 1) {
1602 PrintAndLog("No filename found after f");
1603 errors = true;
1604 }
1605 cmdp += 2;
1606 break;
1607 case 'n':
1608 case 'N':
1609 keyNbr = param_get8(Cmd, cmdp+1);
1610 if (keyNbr < 0) {
1611 PrintAndLog("Wrong block number");
1612 errors = true;
1613 }
1614 cmdp += 2;
1615 break;
1616 case 'k':
1617 case 'K':
1618 operation += 3; //set key
1619 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1620 if (dataLen == 16) { //ul-c or ev1/ntag key length
1621 errors = param_gethex(tempStr, 0, KEY, dataLen);
1622 } else {
1623 PrintAndLog("\nERROR: Key is incorrect length\n");
1624 errors = true;
1625 }
1626 cmdp += 2;
1627 break;
1628 case 'p':
1629 case 'P':
1630 operation += 4; //print keys in memory
1631 cmdp++;
1632 break;
1633 case 'l':
1634 case 'L':
1635 operation += 5; //load keys from file
1636 cmdp++;
1637 break;
1638 case 's':
1639 case 'S':
1640 operation += 6; //save keys to file
1641 cmdp++;
1642 break;
1643 default:
1644 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1645 errors = true;
1646 break;
1647 }
1648 if(errors) return usage_hf_iclass_managekeys();
1649 }
1650 if (operation == 0){
1651 PrintAndLog("no operation specified (load, save, or print)\n");
1652 return usage_hf_iclass_managekeys();
1653 }
1654 if (operation > 6){
1655 PrintAndLog("Too many operations specified\n");
1656 return usage_hf_iclass_managekeys();
1657 }
1658 if (operation > 4 && fileNameLen == 0){
1659 PrintAndLog("You must enter a filename when loading or saving\n");
1660 return usage_hf_iclass_managekeys();
1661 }
1662
1663 switch (operation){
1664 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1665 case 4: return printKeys();
1666 case 5: return loadKeys(filename);
1667 case 6: return saveKeys(filename);
1668 break;
1669 }
1670 return 0;
1671}
1672
cee5a30d 1673static command_t CommandTable[] =
1674{
6f101995 1675 {"help", CmdHelp, 1, "This help"},
e98572a1 1676 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1677 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1678 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1679 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1680 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1681 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1682 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1683 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1684 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1685 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
6f101995 1686 {"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
e98572a1 1687 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1688 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1689 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1690 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1691 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
6f101995 1692 {NULL, NULL, 0, NULL}
cee5a30d 1693};
1694
1695int CmdHFiClass(const char *Cmd)
1696{
53444513
MHS		 1697 CmdsParse(CommandTable, Cmd);
1698 return 0;
cee5a30d 1699}
1700
1701int CmdHelp(const char *Cmd)
1702{
53444513
MHS		 1703 CmdsHelp(CommandTable);
1704 return 0;
cee5a30d 1705}
Proxmark3 GIT tracking
Impressum, Datenschutz