]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhficlass.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
CHG: Syntax suger, space -> tabs. etc.
[proxmark3-svn] / client / cmdhficlass.c
CommitLineData
cee5a30d 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833 4// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// High frequency iClass commands
11//-----------------------------------------------------------------------------
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <string.h>
9f6e9d15 16#include <sys/stat.h>
cee5a30d 17#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18#include "data.h"
902cb3c0 19#include "proxmark3.h"
cee5a30d 20#include "ui.h"
21#include "cmdparser.h"
22#include "cmdhficlass.h"
23#include "common.h"
14006804 24#include "util.h"
17cba269 25#include "cmdmain.h"
a66fca86
AD		 26#include "loclass/des.h"
27#include "loclass/cipherutils.h"
28#include "loclass/cipher.h"
29#include "loclass/ikeys.h"
3ad48540
MHS		 30#include "loclass/elite_crack.h"
31#include "loclass/fileutils.h"
1defcf60 32#include "protocols.h"
caaf9618 33#include "usb_cmd.h"
e98572a1 34#include "cmdhfmfu.h"
9332b857 35#include "cmdhf.h"
e98572a1 36
cee5a30d 37static int CmdHelp(const char *Cmd);
38
e98572a1 39#define ICLASS_KEYS_MAX 8
40static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
41 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
49};
50
51typedef struct iclass_block {
52 uint8_t d[8];
53} iclass_block_t;
54
55int xorbits_8(uint8_t val) {
53444513
MHS		 56 uint8_t res = val ^ (val >> 1); //1st pass
57 res = res ^ (res >> 1); // 2nd pass
58 res = res ^ (res >> 2); // 3rd pass
59 res = res ^ (res >> 4); // 4th pass
60 return res & 1;
17cba269
MHS		 61}
62
e98572a1 63int CmdHFiClassList(const char *Cmd) {
9332b857 64 //PrintAndLog("Deprecated command, use 'hf list iclass' instead");
65 CmdHFList("iclass");
17cba269
MHS		 66 return 0;
67}
68
e98572a1 69int CmdHFiClassSnoop(const char *Cmd) {
53444513
MHS		 70 UsbCommand c = {CMD_SNOOP_ICLASS};
71 SendCommand(&c);
72 return 0;
cee5a30d 73}
e98572a1 74
75int usage_hf_iclass_sim(void) {
41524d8a
MHS		 76 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
77 PrintAndLog(" options");
78 PrintAndLog(" 0 <CSN> simulate the given CSN");
79 PrintAndLog(" 1 simulate default CSN");
80 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
81 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
82 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
83 PrintAndLog(" example: hf iclass sim 2");
84 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
85 PrintAndLog(" hf iclass sim 3");
86 return 0;
87}
88
6116c796 89#define NUM_CSNS 15
e98572a1 90int CmdHFiClassSim(const char *Cmd) {
53444513
MHS		 91 uint8_t simType = 0;
92 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
93
67d78d0c 94 if (strlen(Cmd)<1) return usage_hf_iclass_sim();
95
1defcf60 96 simType = param_get8ex(Cmd, 0, 0, 10);
53444513
MHS		 97
98 if(simType == 0)
99 {
100 if (param_gethex(Cmd, 1, CSN, 16)) {
101 PrintAndLog("A CSN should consist of 16 HEX symbols");
41524d8a 102 return usage_hf_iclass_sim();
53444513 103 }
53444513 104
41524d8a 105 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
53444513 106 }
67d78d0c 107
41524d8a 108 if(simType > 3)
53444513
MHS		 109 {
110 PrintAndLog("Undefined simptype %d", simType);
41524d8a 111 return usage_hf_iclass_sim();
53444513 112 }
1e262141 113
41524d8a 114 uint8_t numberOfCSNs=0;
9f6e9d15
MHS		 115 if(simType == 2)
116 {
6116c796 117 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
9f6e9d15 118 UsbCommand resp = {0};
17cba269 119
53444513
MHS		 120 uint8_t csns[8*NUM_CSNS] = {
121 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
6116c796
MHS		 136
137 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
67d78d0c 138 clearCommandBuffer();
9f6e9d15
MHS		 139 SendCommand(&c);
140 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
141 PrintAndLog("Command timed out");
142 return 0;
143 }
1e262141 144
77abe781 145 uint8_t num_mac_responses = resp.arg[1];
6116c796 146 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
9f6e9d15 147
6116c796 148 size_t datalen = NUM_CSNS*24;
9f6e9d15
MHS		 149 /*
150 * Now, time to dump to file. We'll use this format:
77abe781 151 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15 152 * So, it should wind up as
77abe781
MHS		 153 * 8 * 24 bytes.
154 *
155 * The returndata from the pm3 is on the following format
156 * <4 byte NR><4 byte MAC>
157 * CC are all zeroes, CSN is the same as was sent in
9f6e9d15 158 **/
77abe781
MHS		 159 void* dump = malloc(datalen);
160 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15 161 uint8_t i = 0;
67d78d0c 162 for(i = 0 ; i < NUM_CSNS ; i++) {
163 memcpy(dump+i*24, csns+i*8, 8); //CSN
77abe781
MHS		 164 //8 zero bytes here...
165 //Then comes NR_MAC (eight bytes from the response)
67d78d0c 166 memcpy(dump+i*24+16, resp.d.asBytes+i*8, 8);
9f6e9d15
MHS		 167 }
168 /** Now, save to dumpfile **/
67d78d0c 169 saveFile("iclass_mac_attack", "bin", dump, datalen);
77abe781 170 free(dump);
67d78d0c 171 } else {
9f6e9d15
MHS		 172 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
173 memcpy(c.d.asBytes, CSN, 8);
67d78d0c 174 clearCommandBuffer();
9f6e9d15
MHS		 175 SendCommand(&c);
176 }
53444513 177 return 0;
1e262141 178}
179
e98572a1 180int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
8949bb5d 181 bool tagFound = false;
67d78d0c 182 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
183 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_AA}};
e98572a1 184 // loop in client not device - else on windows have a communication error
185 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
53444513
MHS		 186 UsbCommand resp;
187 while(!ukbhit()){
67d78d0c 188 clearCommandBuffer();
e98572a1 189 SendCommand(&c);
6ce0e538 190 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
67d78d0c 191 uint8_t readStatus = resp.arg[0] & 0xff;
6ce0e538 192 uint8_t *data = resp.d.asBytes;
53444513 193
67d78d0c 194 if (verbose) PrintAndLog("Readstatus:%02x", readStatus);
caaf9618 195 if( readStatus == 0){
53444513 196 //Aborted
8949bb5d 197 if (verbose) PrintAndLog("Quitting...");
53444513
MHS		 198 return 0;
199 }
8949bb5d 200 if( readStatus & FLAG_ICLASS_READER_CSN){
201 PrintAndLog("CSN: %s",sprint_hex(data,8));
202 tagFound = true;
203 }
67d78d0c 204 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s", sprint_hex(data+16, 8));
205 if( readStatus & FLAG_ICLASS_READER_CONF) printIclassDumpInfo(data);
8949bb5d 206 if (tagFound && !loop) return 1;
53444513 207 } else {
8949bb5d 208 if (verbose) PrintAndLog("Command execute timeout");
53444513 209 }
8949bb5d 210 if (!loop) break;
53444513 211 }
53444513 212 return 0;
8949bb5d 213}
214
e98572a1 215int CmdHFiClassReader(const char *Cmd) {
8949bb5d 216 return HFiClassReader(Cmd, true, true);
c3963755 217}
218
e98572a1 219int CmdHFiClassReader_Replay(const char *Cmd) {
53444513
MHS		 220 uint8_t readerType = 0;
221 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
c3963755 222
53444513
MHS		 223 if (strlen(Cmd)<1) {
224 PrintAndLog("Usage: hf iclass replay <MAC>");
225 PrintAndLog(" sample: hf iclass replay 00112233");
226 return 0;
227 }
c3963755 228
53444513
MHS		 229 if (param_gethex(Cmd, 0, MAC, 8)) {
230 PrintAndLog("MAC must include 8 HEX symbols");
231 return 1;
232 }
c3963755 233
53444513
MHS		 234 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
235 memcpy(c.d.asBytes, MAC, 4);
67d78d0c 236 clearCommandBuffer();
53444513 237 SendCommand(&c);
53444513 238 return 0;
1e262141 239}
240
e98572a1 241int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
242 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
243 memcpy(c.d.asBytes, data, blocksCount * 16);
67d78d0c 244 clearCommandBuffer();
53444513 245 SendCommand(&c);
53444513 246 return 0;
1e262141 247}
248
e98572a1 249int hf_iclass_eload_usage(void) {
7781a656
MHS		 250 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
251 PrintAndLog("Usage: hf iclass eload f <filename>");
252 PrintAndLog("");
253 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
254 return 0;
7781a656
MHS		 255}
256
e98572a1 257int CmdHFiClassELoad(const char *Cmd) {
7781a656
MHS		 258
259 char opt = param_getchar(Cmd, 0);
67d78d0c 260 if (strlen(Cmd)<1 || opt == 'h' || opt == 'H') return hf_iclass_eload_usage();
7781a656
MHS		 261
262 //File handling and reading
263 FILE *f;
264 char filename[FILE_PATH_SIZE];
9c4e28a4 265 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
7781a656 266 f = fopen(filename, "rb");
9c4e28a4 267 } else {
7781a656
MHS		 268 return hf_iclass_eload_usage();
269 }
270
271 if(!f) {
272 PrintAndLog("Failed to read from file '%s'", filename);
273 return 1;
274 }
275
276 fseek(f, 0, SEEK_END);
277 long fsize = ftell(f);
278 fseek(f, 0, SEEK_SET);
279
9c4e28a4 280 if (fsize < 0) {
281 prnlog("Error, when getting filesize");
4bb17c66 282 fclose(f);
9c4e28a4 283 return 1;
284 }
285
9c4e28a4 286 uint8_t *dump = malloc(fsize);
1defcf60 287
7781a656
MHS		 288 size_t bytes_read = fread(dump, 1, fsize, f);
289 fclose(f);
290
1defcf60 291 printIclassDumpInfo(dump);
7781a656
MHS		 292 //Validate
293
67d78d0c 294 if (bytes_read < fsize) {
7781a656
MHS		 295 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
296 free(dump);
297 return 1;
298 }
299 //Send to device
300 uint32_t bytes_sent = 0;
301 uint32_t bytes_remaining = bytes_read;
302
303 while(bytes_remaining > 0){
304 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
305 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
306 memcpy(c.d.asBytes, dump, bytes_in_packet);
67d78d0c 307 clearCommandBuffer();
7781a656
MHS		 308 SendCommand(&c);
309 bytes_remaining -= bytes_in_packet;
310 bytes_sent += bytes_in_packet;
311 }
312 free(dump);
313 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
314 return 0;
315}
316
e98572a1 317static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
41524d8a
MHS		 318 FILE *f = fopen(filename, "rb");
319 if(!f) {
320 PrintAndLog("Failed to read from file '%s'", filename);
321 return 1;
322 }
323 fseek(f, 0, SEEK_END);
324 long fsize = ftell(f);
325 fseek(f, 0, SEEK_SET);
326 size_t bytes_read = fread(buffer, 1, len, f);
327 fclose(f);
67d78d0c 328
329 if(fsize != len) {
41524d8a
MHS		 330 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
331 return 1;
332 }
67d78d0c 333
334 if(bytes_read != len) {
41524d8a
MHS		 335 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
336 return 1;
337 }
338 return 0;
339}
340
e98572a1 341int usage_hf_iclass_decrypt(void) {
342 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
343 PrintAndLog("");
344 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
345 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
346 PrintAndLog("");
347 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
348 PrintAndLog("");
349 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
350 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
351 PrintAndLog("which is defined by the configuration block.");
352 return 1;
353}
354
355int CmdHFiClassDecrypt(const char *Cmd) {
41524d8a 356 uint8_t key[16] = { 0 };
67d78d0c 357 if(readKeyfile("iclass_decryptionkey.bin", 16, key)) {
41524d8a
MHS		 358 usage_hf_iclass_decrypt();
359 return 1;
360 }
361 PrintAndLog("Decryption file found... ");
362 char opt = param_getchar(Cmd, 0);
67d78d0c 363 if (strlen(Cmd)<1 || opt == 'h' || opt == 'H') return usage_hf_iclass_decrypt();
41524d8a
MHS		 364
365 //Open the tagdump-file
366 FILE *f;
367 char filename[FILE_PATH_SIZE];
3c406169 368 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
369 if ( (f = fopen(filename, "rb")) == NULL) {
370 PrintAndLog("Could not find file %s", filename);
371 return 1;
67d78d0c 372 }
3c406169 373 } else {
41524d8a 374 return usage_hf_iclass_decrypt();
3c406169 375 }
41524d8a
MHS		 376
377 fseek(f, 0, SEEK_END);
378 long fsize = ftell(f);
379 fseek(f, 0, SEEK_SET);
380 uint8_t enc_dump[8] = {0};
381 uint8_t *decrypted = malloc(fsize);
382 des3_context ctx = { DES_DECRYPT ,{ 0 } };
383 des3_set2key_dec( &ctx, key);
384 size_t bytes_read = fread(enc_dump, 1, 8, f);
385
386 //Use the first block (CSN) for filename
387 char outfilename[FILE_PATH_SIZE] = { 0 };
388 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
389 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
390 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
391
392 size_t blocknum =0;
393 while(bytes_read == 8)
394 {
67d78d0c 395 if(blocknum < 7) {
41524d8a 396 memcpy(decrypted+(blocknum*8), enc_dump, 8);
67d78d0c 397 } else {
41524d8a
MHS		 398 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
399 }
400 printvar("decrypted block", decrypted +(blocknum*8), 8);
401 bytes_read = fread(enc_dump, 1, 8, f);
402 blocknum++;
403 }
404 fclose(f);
41524d8a 405 saveFile(outfilename,"bin", decrypted, blocknum*8);
ab7bb494 406 free(decrypted);
41524d8a
MHS		 407 return 0;
408}
7781a656 409
e98572a1 410int usage_hf_iclass_encrypt(void) {
411 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
412 PrintAndLog("");
413 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
414 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
415 PrintAndLog("");
416 PrintAndLog("example: hf iclass encrypt 0102030405060708");
417 PrintAndLog("");
418 return 0;
419}
420
421static int iClassEncryptBlkData(uint8_t *blkData) {
422 uint8_t key[16] = { 0 };
67d78d0c 423 if(readKeyfile("iclass_decryptionkey.bin", 16, key)) {
e98572a1 424 usage_hf_iclass_encrypt();
425 return 1;
426 }
427 PrintAndLog("Decryption file found... ");
53444513 428
e98572a1 429 uint8_t encryptedData[16];
430 uint8_t *encrypted = encryptedData;
431 des3_context ctx = { DES_DECRYPT ,{ 0 } };
432 des3_set2key_enc( &ctx, key);
433
434 des3_crypt_ecb(&ctx, blkData,encrypted);
435 //printvar("decrypted block", decrypted, 8);
436 memcpy(blkData,encrypted,8);
437
438 return 1;
439}
53444513 440
e98572a1 441int CmdHFiClassEncryptBlk(const char *Cmd) {
442 uint8_t blkData[8] = {0};
443 char opt = param_getchar(Cmd, 0);
67d78d0c 444 if (strlen(Cmd)<1 || opt == 'h' || opt == 'H') return usage_hf_iclass_encrypt();
e98572a1 445
446 //get the bytes to encrypt
67d78d0c 447 if (param_gethex(Cmd, 0, blkData, 16)) {
e98572a1 448 PrintAndLog("BlockData must include 16 HEX symbols");
53444513
MHS		 449 return 0;
450 }
e98572a1 451 if (!iClassEncryptBlkData(blkData)) return 0;
53444513 452
e98572a1 453 printvar("encrypted block", blkData, 8);
454 return 1;
455}
456
457void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
458 uint8_t WB[9];
459 WB[0] = blockno;
460 memcpy(WB + 1,data,8);
461 doMAC_N(WB,sizeof(WB),div_key,MAC);
462 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
463}
464
465static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
466 UsbCommand resp;
467
468 UsbCommand c = {CMD_READER_ICLASS, {0}};
469 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
470 if (use_credit_key)
471 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
472
473 clearCommandBuffer();
474 SendCommand(&c);
67d78d0c 475 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
e98572a1 476 PrintAndLog("Command execute timeout");
477 return false;
53444513
MHS		 478 }
479
e98572a1 480 uint8_t isOK = resp.arg[0] & 0xff;
481 uint8_t *data = resp.d.asBytes;
482
483 memcpy(CSN,data,8);
67d78d0c 484
485 if (CCNR!=NULL)
486 memcpy(CCNR,data+16,8);
487
488 if(isOK > 0) {
e98572a1 489 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
490 }
67d78d0c 491
e98572a1 492 if(isOK <= 1){
493 PrintAndLog("Failed to obtain CC! Aborting");
494 return false;
53444513 495 }
e98572a1 496 return true;
497}
498
a7474bb3 499static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
e98572a1 500 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
501 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
502
503 if (!select_only(CSN, CCNR, use_credit_key, verbose))
504 return false;
505
506 //get div_key
a7474bb3 507 if(rawkey)
508 memcpy(div_key, KEY, 8);
509 else
67d78d0c 510 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
511
a7474bb3 512 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
e98572a1 513
514 doMAC(CCNR, div_key, MAC);
515 UsbCommand resp;
516 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
517 memcpy(d.d.asBytes, MAC, 4);
518 clearCommandBuffer();
519 SendCommand(&d);
67d78d0c 520 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
e98572a1 521 PrintAndLog("Auth Command execute timeout");
522 return false;
523 }
67d78d0c 524 uint8_t isOK = resp.arg[0] & 0xff;
e98572a1 525 if (!isOK) {
526 PrintAndLog("Authentication error");
527 return false;
53444513 528 }
e98572a1 529 return true;
530}
53444513 531
e98572a1 532int usage_hf_iclass_dump(void) {
a7474bb3 533 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
e98572a1 534 PrintAndLog("Options:");
535 PrintAndLog(" f <filename> : specify a filename to save dump to");
536 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
537 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
538 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
539 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
540 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
a7474bb3 541 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
e98572a1 542 PrintAndLog(" NOTE: * = required");
67d78d0c 543 PrintAndLog("Samples:");
e98572a1 544 PrintAndLog(" hf iclass dump k 001122334455667B");
545 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
546 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
547 return 0;
548}
549
550int CmdHFiClassReader_Dump(const char *Cmd) {
551
552 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
553 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
554 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
555 uint8_t blockno = 0;
556 uint8_t numblks = 0;
557 uint8_t maxBlk = 31;
558 uint8_t app_areas = 1;
559 uint8_t kb = 2;
560 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
561 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
562 uint8_t keyNbr = 0;
563 uint8_t dataLen = 0;
564 uint8_t fileNameLen = 0;
565 char filename[FILE_PATH_SIZE]={0};
566 char tempStr[50] = {0};
567 bool have_debit_key = false;
568 bool have_credit_key = false;
569 bool use_credit_key = false;
570 bool elite = false;
a7474bb3 571 bool rawkey = false;
e98572a1 572 bool errors = false;
573 uint8_t cmdp = 0;
574
575 while(param_getchar(Cmd, cmdp) != 0x00)
576 {
577 switch(param_getchar(Cmd, cmdp))
578 {
579 case 'h':
580 case 'H':
581 return usage_hf_iclass_dump();
582 case 'c':
583 case 'C':
584 have_credit_key = true;
585 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
586 if (dataLen == 16) {
587 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
588 } else if (dataLen == 1) {
589 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 590 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 591 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
592 } else {
593 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
594 errors = true;
595 }
596 } else {
597 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
598 errors = true;
599 }
600 cmdp += 2;
601 break;
602 case 'e':
603 case 'E':
604 elite = true;
605 cmdp++;
606 break;
607 case 'f':
608 case 'F':
609 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
610 if (fileNameLen < 1) {
611 PrintAndLog("No filename found after f");
612 errors = true;
613 }
614 cmdp += 2;
615 break;
616 case 'k':
617 case 'K':
618 have_debit_key = true;
619 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
620 if (dataLen == 16) {
621 errors = param_gethex(tempStr, 0, KEY, dataLen);
622 } else if (dataLen == 1) {
623 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 624 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 625 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
626 } else {
627 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
628 errors = true;
629 }
630 } else {
631 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
632 errors = true;
633 }
634 cmdp += 2;
635 break;
a7474bb3 636 case 'r':
637 case 'R':
638 rawkey = true;
639 cmdp++;
640 break;
e98572a1 641 default:
642 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
643 errors = true;
644 break;
645 }
646 if(errors) return usage_hf_iclass_dump();
647 }
648
649 if (cmdp < 2) return usage_hf_iclass_dump();
650 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
651 if (!have_debit_key && have_credit_key) use_credit_key = true;
652
653 //get config and first 3 blocks
654 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
655 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
53444513 656 UsbCommand resp;
e98572a1 657 uint8_t tag_data[255*8];
53444513 658
e98572a1 659 clearCommandBuffer();
660 SendCommand(&c);
661 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
662 PrintAndLog("Command execute timeout");
663 ul_switch_off_field();
664 return 0;
665 }
666 uint8_t readStatus = resp.arg[0] & 0xff;
67d78d0c 667 uint8_t * data = resp.d.asBytes;
53444513 668
e98572a1 669 if(readStatus == 0){
670 PrintAndLog("No tag found...");
671 ul_switch_off_field();
67d78d0c 672 return 0;
673 }
674
e98572a1 675 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
676 memcpy(tag_data, data, 8*3);
677 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
678 numblks = data[8];
679 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
680 // large memory - not able to dump pages currently
681 if (numblks > maxBlk) numblks = maxBlk;
682 }
67d78d0c 683
e98572a1 684 ul_switch_off_field();
685 // authenticate debit key and get div_key - later store in dump block 3
a7474bb3 686 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
e98572a1 687 //try twice - for some reason it sometimes fails the first time...
a7474bb3 688 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
e98572a1 689 ul_switch_off_field();
690 return 0;
691 }
53444513 692 }
e98572a1 693
694 // begin dump
695 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
696 clearCommandBuffer();
697 SendCommand(&w);
698 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
699 PrintAndLog("Command execute time-out 1");
700 ul_switch_off_field();
701 return 1;
702 }
703 uint32_t blocksRead = resp.arg[1];
704 uint8_t isOK = resp.arg[0] & 0xff;
705 if (!isOK && !blocksRead) {
706 PrintAndLog("Read Block Failed");
707 ul_switch_off_field();
708 return 0;
709 }
710 uint32_t startindex = resp.arg[2];
711 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
712 PrintAndLog("Data exceeded Buffer size!");
713 blocksRead = (sizeof(tag_data)/8) - blockno;
714 }
715 // response ok - now get bigbuf content of the dump
716 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
717 WaitForResponse(CMD_ACK,NULL);
718 size_t gotBytes = blocksRead*8 + blockno*8;
719
720 // try AA2
721 if (have_credit_key) {
722 //turn off hf field before authenticating with different key
723 ul_switch_off_field();
724 memset(MAC,0,4);
725 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
a7474bb3 726 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
e98572a1 727 //try twice - for some reason it sometimes fails the first time...
a7474bb3 728 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
e98572a1 729 ul_switch_off_field();
730 return 0;
731 }
732 }
733 // do we still need to read more block? (aa2 enabled?)
734 if (maxBlk > blockno+numblks+1) {
735 // setup dump and start
736 w.arg[0] = blockno + blocksRead;
737 w.arg[1] = maxBlk - (blockno + blocksRead);
738 clearCommandBuffer();
739 SendCommand(&w);
740 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
741 PrintAndLog("Command execute timeout 2");
742 ul_switch_off_field();
743 return 0;
744 }
745 uint8_t isOK = resp.arg[0] & 0xff;
746 blocksRead = resp.arg[1];
747 if (!isOK && !blocksRead) {
748 PrintAndLog("Read Block Failed 2");
749 ul_switch_off_field();
750 return 0;
751 }
53444513 752
e98572a1 753 startindex = resp.arg[2];
754 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
755 PrintAndLog("Data exceeded Buffer size!");
756 blocksRead = (sizeof(tag_data) - gotBytes)/8;
757 }
758 // get dumped data from bigbuf
759 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
760 WaitForResponse(CMD_ACK,NULL);
53444513 761
e98572a1 762 gotBytes += blocksRead*8;
763 } else { //field is still on - turn it off...
764 ul_switch_off_field();
765 }
766 }
53444513 767
e98572a1 768 // add diversified keys to dump
769 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
770 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
771 // print the dump
67d78d0c 772 printf("CSN |00| %s |\n", sprint_hex(tag_data, 8));
773 printf("CSN |00| %s |\n", sprint_hex(tag_data, 8));
e98572a1 774 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
775
776 if (filename[0] == 0){
777 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
778 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
779 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
780 }
53444513 781
e98572a1 782 // save the dump to .bin file
783 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
784 saveFile(filename, "bin", tag_data, gotBytes);
785 return 1;
786}
53444513 787
a7474bb3 788static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
e98572a1 789 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
790 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
a7474bb3 791 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
e98572a1 792 return 0;
793
794 UsbCommand resp;
795
796 Calc_wb_mac(blockno,bldata,div_key,MAC);
797 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
798 memcpy(w.d.asBytes, bldata, 8);
799 memcpy(w.d.asBytes + 8, MAC, 4);
800
801 clearCommandBuffer();
802 SendCommand(&w);
67d78d0c 803 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
e98572a1 804 PrintAndLog("Write Command execute timeout");
805 return 0;
806 }
807 uint8_t isOK = resp.arg[0] & 0xff;
808 if (!isOK) {
809 PrintAndLog("Write Block Failed");
810 return 0;
811 }
812 PrintAndLog("Write Block Successful");
813 return 1;
814}
815
816int usage_hf_iclass_writeblock(void) {
817 PrintAndLog("Options:");
67d78d0c 818 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
819 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
e98572a1 820 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
67d78d0c 821 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
822 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
823 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
824 PrintAndLog("Samples:");
e98572a1 825 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
826 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
827 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
828 return 0;
829}
830
831int CmdHFiClass_WriteBlock(const char *Cmd) {
832 uint8_t blockno=0;
833 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
834 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
835 uint8_t keyNbr = 0;
836 uint8_t dataLen = 0;
837 char tempStr[50] = {0};
838 bool use_credit_key = false;
839 bool elite = false;
a7474bb3 840 bool rawkey= false;
e98572a1 841 bool errors = false;
842 uint8_t cmdp = 0;
843 while(param_getchar(Cmd, cmdp) != 0x00)
844 {
845 switch(param_getchar(Cmd, cmdp))
846 {
847 case 'h':
848 case 'H':
849 return usage_hf_iclass_writeblock();
850 case 'b':
851 case 'B':
852 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
853 PrintAndLog("Block No must include 2 HEX symbols\n");
854 errors = true;
855 }
856 cmdp += 2;
857 break;
858 case 'c':
859 case 'C':
860 use_credit_key = true;
861 cmdp++;
862 break;
863 case 'd':
864 case 'D':
865 if (param_gethex(Cmd, cmdp+1, bldata, 16))
866 {
867 PrintAndLog("KEY must include 16 HEX symbols\n");
868 errors = true;
869 }
870 cmdp += 2;
871 break;
872 case 'e':
873 case 'E':
874 elite = true;
875 cmdp++;
876 break;
877 case 'k':
878 case 'K':
879 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
880 if (dataLen == 16) {
881 errors = param_gethex(tempStr, 0, KEY, dataLen);
882 } else if (dataLen == 1) {
883 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 884 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 885 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
886 } else {
887 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
888 errors = true;
889 }
890 } else {
891 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
892 errors = true;
893 }
894 cmdp += 2;
895 break;
a7474bb3 896 case 'r':
897 case 'R':
898 rawkey = true;
899 cmdp++;
900 break;
e98572a1 901 default:
902 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
903 errors = true;
904 break;
905 }
906 if(errors) return usage_hf_iclass_writeblock();
907 }
908
909 if (cmdp < 6) return usage_hf_iclass_writeblock();
a7474bb3 910 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
e98572a1 911 ul_switch_off_field();
912 return ans;
913}
914
915int usage_hf_iclass_clone(void) {
a7474bb3 916 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
e98572a1 917 PrintAndLog("Options:");
918 PrintAndLog(" f <filename>: specify a filename to clone from");
919 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
920 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
921 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
922 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
923 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
a7474bb3 924 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
e98572a1 925 PrintAndLog("Samples:");
926 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
927 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
928 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
929 return -1;
930}
931
932int CmdHFiClassCloneTag(const char *Cmd) {
5cba4462 933 char filename[FILE_PATH_SIZE] = { 0x00 };
e98572a1 934 char tempStr[50]={0};
935 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
936 uint8_t keyNbr = 0;
937 uint8_t fileNameLen = 0;
938 uint8_t startblock = 0;
939 uint8_t endblock = 0;
940 uint8_t dataLen = 0;
941 bool use_credit_key = false;
942 bool elite = false;
a7474bb3 943 bool rawkey = false;
e98572a1 944 bool errors = false;
945 uint8_t cmdp = 0;
946 while(param_getchar(Cmd, cmdp) != 0x00)
947 {
948 switch(param_getchar(Cmd, cmdp))
949 {
950 case 'h':
951 case 'H':
952 return usage_hf_iclass_clone();
953 case 'b':
954 case 'B':
955 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
956 PrintAndLog("Start Block No must include 2 HEX symbols\n");
957 errors = true;
958 }
959 cmdp += 2;
960 break;
961 case 'c':
962 case 'C':
963 use_credit_key = true;
964 cmdp++;
965 break;
966 case 'e':
967 case 'E':
968 elite = true;
969 cmdp++;
970 break;
971 case 'f':
972 case 'F':
973 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
974 if (fileNameLen < 1) {
975 PrintAndLog("No filename found after f");
976 errors = true;
977 }
978 cmdp += 2;
979 break;
980 case 'k':
981 case 'K':
982 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
983 if (dataLen == 16) {
984 errors = param_gethex(tempStr, 0, KEY, dataLen);
985 } else if (dataLen == 1) {
986 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 987 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 988 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
989 } else {
990 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
991 errors = true;
992 }
993 } else {
994 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
995 errors = true;
996 }
997 cmdp += 2;
998 break;
999 case 'l':
1000 case 'L':
1001 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1002 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1003 errors = true;
1004 }
1005 cmdp += 2;
1006 break;
a7474bb3 1007 case 'r':
1008 case 'R':
1009 rawkey = true;
1010 cmdp++;
1011 break;
e98572a1 1012 default:
1013 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1014 errors = true;
1015 break;
1016 }
1017 if(errors) return usage_hf_iclass_clone();
1018 }
1019
1020 if (cmdp < 8) return usage_hf_iclass_clone();
1021
1022 FILE *f;
1023
1024 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1025
1026 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1027 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1028 }
1029 // file handling and reading
1030 f = fopen(filename,"rb");
1031 if(!f) {
1032 PrintAndLog("Failed to read from file '%s'", filename);
1033 return 1;
1034 }
1035
1036 if (startblock<5) {
1037 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
628d1cb0 1038 fclose(f);
e98572a1 1039 return 0;
1040 }
1041 // now read data from the file from block 6 --- 19
1042 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1043 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1044 // else we have to create a share memory
1045 int i;
1046 fseek(f,startblock*8,SEEK_SET);
2b9006bd 1047 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0){
1048 PrintAndLog("File reading error.");
1049 fclose(f);
1050 return 2;
1051 }
e98572a1 1052
1053 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1054 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1055
a7474bb3 1056 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
e98572a1 1057 return 0;
1058
1059 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
1060 uint8_t *ptr;
1061 // calculate all mac for every the block we will write
1062 for (i = startblock; i <= endblock; i++){
1063 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1064 // usb command d start pointer = d + (i - 6) * 12
1065 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1066 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1067 // next one
1068 ptr = w.d.asBytes + (i - startblock) * 12;
1069 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1070 memcpy(ptr + 8,MAC, 4);
1071 }
1072 uint8_t p[12];
1073 for (i = 0; i <= endblock - startblock;i++){
1074 memcpy(p,w.d.asBytes + (i * 12),12);
1075 printf("Block |%02x|",i + startblock);
1076 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1077 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1078 }
1079 UsbCommand resp;
67d78d0c 1080 clearCommandBuffer();
e98572a1 1081 SendCommand(&w);
67d78d0c 1082 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
e98572a1 1083 PrintAndLog("Command execute timeout");
1084 return 0;
1085 }
1086 return 1;
1087}
1088
a7474bb3 1089static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose) {
e98572a1 1090 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1091 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1092
a7474bb3 1093 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
e98572a1 1094 return 0;
1095
1096 UsbCommand resp;
1097 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
1098 clearCommandBuffer();
1099 SendCommand(&w);
67d78d0c 1100 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
53444513 1101 PrintAndLog("Command execute timeout");
e98572a1 1102 return 0;
53444513 1103 }
67d78d0c 1104
e98572a1 1105 uint8_t isOK = resp.arg[0] & 0xff;
1106 if (!isOK) {
1107 PrintAndLog("Read Block Failed");
1108 return 0;
1109 }
1110 //data read is stored in: resp.d.asBytes[0-15]
1111 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1112 return 1;
1113}
1114
1115int usage_hf_iclass_readblock(void) {
a7474bb3 1116 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
e98572a1 1117 PrintAndLog("Options:");
67d78d0c 1118 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
e98572a1 1119 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
67d78d0c 1120 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1121 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1122 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
1123 PrintAndLog("Samples:");
e98572a1 1124 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1125 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1126 PrintAndLog(" hf iclass readblk b 0A k 0");
53444513 1127 return 0;
a66fca86 1128}
e98572a1 1129
1130int CmdHFiClass_ReadBlock(const char *Cmd) {
1131 uint8_t blockno=0;
1132 uint8_t keyType = 0x88; //debit key
1133 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1134 uint8_t keyNbr = 0;
1135 uint8_t dataLen = 0;
1136 char tempStr[50] = {0};
1137 bool elite = false;
a7474bb3 1138 bool rawkey = false;
e98572a1 1139 bool errors = false;
1140 uint8_t cmdp = 0;
1141 while(param_getchar(Cmd, cmdp) != 0x00)
1142 {
1143 switch(param_getchar(Cmd, cmdp))
1144 {
1145 case 'h':
1146 case 'H':
1147 return usage_hf_iclass_readblock();
1148 case 'b':
1149 case 'B':
1150 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1151 PrintAndLog("Block No must include 2 HEX symbols\n");
1152 errors = true;
1153 }
1154 cmdp += 2;
1155 break;
1156 case 'c':
1157 case 'C':
1158 keyType = 0x18;
1159 cmdp++;
1160 break;
1161 case 'e':
1162 case 'E':
1163 elite = true;
1164 cmdp++;
1165 break;
1166 case 'k':
1167 case 'K':
1168 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1169 if (dataLen == 16) {
1170 errors = param_gethex(tempStr, 0, KEY, dataLen);
1171 } else if (dataLen == 1) {
1172 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 1173 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 1174 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1175 } else {
1176 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1177 errors = true;
1178 }
1179 } else {
1180 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1181 errors = true;
1182 }
1183 cmdp += 2;
1184 break;
a7474bb3 1185 case 'r':
1186 case 'R':
1187 rawkey = true;
1188 cmdp++;
1189 break;
e98572a1 1190 default:
1191 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1192 errors = true;
1193 break;
1194 }
1195 if(errors) return usage_hf_iclass_readblock();
1196 }
1197
1198 if (cmdp < 4) return usage_hf_iclass_readblock();
1199
a7474bb3 1200 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true);
e98572a1 1201}
1202
1203int CmdHFiClass_loclass(const char *Cmd) {
6f101995
MHS		 1204 char opt = param_getchar(Cmd, 0);
1205
1206 if (strlen(Cmd)<1 || opt == 'h') {
1207 PrintAndLog("Usage: hf iclass loclass [options]");
1208 PrintAndLog("Options:");
1209 PrintAndLog("h Show this help");
1210 PrintAndLog("t Perform self-test");
1211 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1212 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1213 PrintAndLog(" malicious CSNs, and their protocol responses");
1214 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1215 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1216 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1217 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1218 PrintAndLog(" ... totalling N*24 bytes");
1219 return 0;
1220 }
1221 char fileName[255] = {0};
67d78d0c 1222 if(opt == 'f') {
1223 if(param_getstr(Cmd, 1, fileName) > 0) {
53444513 1224 return bruteforceFileNoKeys(fileName);
67d78d0c 1225 } else {
53444513 1226 PrintAndLog("You must specify a filename");
67d78d0c 1227 // no return?
53444513 1228 }
6f101995 1229 }
67d78d0c 1230 else if(opt == 't') {
6f101995
MHS		 1231 int errors = testCipherUtils();
1232 errors += testMAC();
1233 errors += doKeyTests(0);
1234 errors += testElite();
67d78d0c 1235 if(errors) prnlog("OBS! There were errors!!!");
6f101995
MHS		 1236 return errors;
1237 }
6f101995
MHS		 1238 return 0;
1239}
c3963755 1240
e98572a1 1241void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1242 uint8_t blockdata[8];
1243 uint8_t mem_config;
1244 memcpy(&mem_config, iclass_dump + 13,1);
1245 uint8_t maxmemcount;
1246 uint8_t filemaxblock = filesize / 8;
67d78d0c 1247
e98572a1 1248 if (mem_config & 0x80)
1249 maxmemcount = 255;
1250 else
1251 maxmemcount = 31;
1252 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1253
1254 if (startblock == 0)
1255 startblock = 6;
67d78d0c 1256
e98572a1 1257 if ((endblock > maxmemcount) || (endblock == 0))
1258 endblock = maxmemcount;
67d78d0c 1259
e98572a1 1260 if (endblock > filemaxblock)
1261 endblock = filemaxblock;
67d78d0c 1262
e98572a1 1263 int i = startblock;
1264 int j;
1265 while (i <= endblock){
1266 printf("Block |%02X| ",i);
67d78d0c 1267 memcpy(blockdata, iclass_dump + (i * 8), 8);
e98572a1 1268 for (j = 0;j < 8;j++)
67d78d0c 1269 printf("%02X ", blockdata[j]);
e98572a1 1270 printf("|\n");
1271 i++;
1272 }
1273}
1274
1275int usage_hf_iclass_readtagfile() {
1276 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1277 return 1;
1278}
1279
1280int CmdHFiClassReadTagFile(const char *Cmd) {
1281 int startblock = 0;
1282 int endblock = 0;
1283 char tempnum[5];
1284 FILE *f;
1285 char filename[FILE_PATH_SIZE];
1286 if (param_getstr(Cmd, 0, filename) < 1)
1287 return usage_hf_iclass_readtagfile();
67d78d0c 1288
e98572a1 1289 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1290 startblock = 0;
1291 else
1292 sscanf(tempnum,"%d",&startblock);
1293
1294 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1295 endblock = 0;
1296 else
1297 sscanf(tempnum,"%d",&endblock);
67d78d0c 1298
e98572a1 1299 // file handling and reading
1300 f = fopen(filename,"rb");
1301 if(!f) {
1302 PrintAndLog("Failed to read from file '%s'", filename);
1303 return 1;
1304 }
1305 fseek(f, 0, SEEK_END);
1306 long fsize = ftell(f);
1307 fseek(f, 0, SEEK_SET);
1308
ddb748a9 1309 if ( fsize < 0 ) {
1310 PrintAndLog("Error, when getting filesize");
1311 fclose(f);
1312 return 1;
1313 }
e98572a1 1314
ddb748a9 1315 uint8_t *dump = malloc(fsize);
e98572a1 1316 size_t bytes_read = fread(dump, 1, fsize, f);
1317 fclose(f);
67d78d0c 1318
e98572a1 1319 uint8_t *csn = dump;
67d78d0c 1320 printf("CSN [00] | %s |\n", sprint_hex(csn, 8) );
e98572a1 1321 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1322 free(dump);
1323 return 0;
1324}
1325
1326/*
1327uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1328 uint64_t new_div = 0x00;
1329 new_div ^= sdiv;
1330 new_div ^= hdiv;
1331 return new_div;
1332}
1333
1334uint64_t hexarray_to_uint64(uint8_t *key) {
1335 char temp[17];
1336 uint64_t uint_key;
1337 for (int i = 0;i < 8;i++)
1338 sprintf(&temp[(i *2)],"%02X",key[i]);
1339 temp[16] = '\0';
1340 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1341 return 0;
1342 return uint_key;
1343}
1344*/
1345void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1346 uint8_t keytable[128] = {0};
1347 uint8_t key_index[8] = {0};
1348 if (elite) {
1349 uint8_t key_sel[8] = { 0 };
1350 uint8_t key_sel_p[8] = { 0 };
1351 hash2(KEY, keytable);
1352 hash1(CSN, key_index);
1353 for(uint8_t i = 0; i < 8 ; i++)
1354 key_sel[i] = keytable[key_index[i]] & 0xFF;
1355
1356 //Permute from iclass format to standard format
1357 permutekey_rev(key_sel, key_sel_p);
1358 diversifyKey(CSN, key_sel_p, div_key);
1359 } else {
1360 diversifyKey(CSN, KEY, div_key);
1361 }
1362}
1363
1364//when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1365//calculate and return xor_div_key (ready for a key write command)
1366//print all div_keys if verbose
1367static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1368 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1369 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1370 //get old div key
1371 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1372 //get new div key
1373 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1374
1375 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1376 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1377 }
1378 if (verbose) {
1379 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1380 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1381 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1382 }
1383}
1384
1385int usage_hf_iclass_calc_newkey(void) {
1386 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1387 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1388 PrintAndLog(" Options:");
1389 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1390 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1391 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1392 PrintAndLog(" e : specify new key as elite calc");
1393 PrintAndLog(" ee : specify old and new key as elite calc");
1394 PrintAndLog("Samples:");
1395 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1396 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1397 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1398 PrintAndLog("NOTE: * = required\n");
1399
1400 return 1;
1401}
1402
1403int CmdHFiClassCalcNewKey(const char *Cmd) {
1404 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1405 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1406 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1407 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1408 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1409 uint8_t keyNbr = 0;
1410 uint8_t dataLen = 0;
1411 char tempStr[50] = {0};
1412 bool givenCSN = false;
1413 bool oldElite = false;
1414 bool elite = false;
1415 bool errors = false;
1416 uint8_t cmdp = 0;
1417 while(param_getchar(Cmd, cmdp) != 0x00)
1418 {
1419 switch(param_getchar(Cmd, cmdp))
1420 {
1421 case 'h':
1422 case 'H':
1423 return usage_hf_iclass_calc_newkey();
1424 case 'e':
1425 case 'E':
1426 dataLen = param_getstr(Cmd, cmdp, tempStr);
1427 if (dataLen==2)
1428 oldElite = true;
1429 elite = true;
1430 cmdp++;
1431 break;
1432 case 'n':
1433 case 'N':
1434 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1435 if (dataLen == 16) {
1436 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1437 } else if (dataLen == 1) {
1438 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 1439 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 1440 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1441 } else {
1442 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1443 errors = true;
1444 }
1445 } else {
1446 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1447 errors = true;
1448 }
1449 cmdp += 2;
1450 break;
1451 case 'o':
1452 case 'O':
1453 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1454 if (dataLen == 16) {
1455 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1456 } else if (dataLen == 1) {
1457 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 1458 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 1459 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1460 } else {
1461 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1462 errors = true;
1463 }
1464 } else {
1465 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1466 errors = true;
1467 }
1468 cmdp += 2;
1469 break;
1470 case 's':
1471 case 'S':
1472 givenCSN = true;
1473 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1474 return usage_hf_iclass_calc_newkey();
1475 cmdp += 2;
1476 break;
1477 default:
1478 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1479 errors = true;
1480 break;
1481 }
1482 if(errors) return usage_hf_iclass_calc_newkey();
1483 }
1484
1485 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1486
1487 if (!givenCSN)
1488 if (!select_only(CSN, CCNR, false, true))
1489 return 0;
1490
1491 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1492 return 0;
1493}
1494
1495static int loadKeys(char *filename) {
1496 FILE *f;
1497 f = fopen(filename,"rb");
1498 if(!f) {
1499 PrintAndLog("Failed to read from file '%s'", filename);
1500 return 0;
1501 }
1502 fseek(f, 0, SEEK_END);
1503 long fsize = ftell(f);
1504 fseek(f, 0, SEEK_SET);
1505
4bb17c66 1506 if ( fsize < 0 ) {
1507 PrintAndLog("Error, when getting filesize");
1508 fclose(f);
1509 return 1;
1510 }
1511
e98572a1 1512 uint8_t *dump = malloc(fsize);
1513
1514 size_t bytes_read = fread(dump, 1, fsize, f);
1515 fclose(f);
1516 if (bytes_read > ICLASS_KEYS_MAX * 8){
1517 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1518 free(dump);
1519 return 0;
1520 }
1521 uint8_t i = 0;
1522 for (; i < bytes_read/8; i++){
1523 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1524 }
1525 free(dump);
1526 PrintAndLog("%u keys loaded", i);
1527 return 1;
1528}
1529
1530static int saveKeys(char *filename) {
1531 FILE *f;
1532 f = fopen(filename,"wb");
1533 if (f == NULL) {
1534 printf("error opening file %s\n",filename);
1535 return 0;
1536 }
1537 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1538 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1539 PrintAndLog("save key failed to write to file: %s", filename);
1540 break;
1541 }
1542 }
1543 fclose(f);
1544 return 0;
1545}
1546
1547static int printKeys(void) {
1548 PrintAndLog("");
1549 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
67d78d0c 1550 PrintAndLog("%u: %s", i, sprint_hex(iClass_Key_Table[i],8));
e98572a1 1551 }
1552 PrintAndLog("");
1553 return 0;
1554}
1555
1556int usage_hf_iclass_managekeys(void) {
1557 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1558 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1559 PrintAndLog(" Options:");
1560 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1561 PrintAndLog(" k <key> : set a key in memory");
1562 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1563 PrintAndLog(" s : save keys in memory to file specified by filename");
1564 PrintAndLog(" l : load keys to memory from file specified by filename");
1565 PrintAndLog(" p : print keys loaded into memory\n");
1566 PrintAndLog("Samples:");
1567 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1568 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1569 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1570 PrintAndLog(" print keys : hf iclass managekeys p\n");
1571 return 0;
1572}
1573
1574int CmdHFiClassManageKeys(const char *Cmd) {
1575 uint8_t keyNbr = 0;
1576 uint8_t dataLen = 0;
1577 uint8_t KEY[8] = {0};
1578 char filename[FILE_PATH_SIZE];
1579 uint8_t fileNameLen = 0;
1580 bool errors = false;
1581 uint8_t operation = 0;
1582 char tempStr[20];
1583 uint8_t cmdp = 0;
1584
1585 while(param_getchar(Cmd, cmdp) != 0x00)
1586 {
1587 switch(param_getchar(Cmd, cmdp))
1588 {
1589 case 'h':
1590 case 'H':
1591 return usage_hf_iclass_managekeys();
1592 case 'f':
1593 case 'F':
1594 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1595 if (fileNameLen < 1) {
1596 PrintAndLog("No filename found after f");
1597 errors = true;
1598 }
1599 cmdp += 2;
1600 break;
1601 case 'n':
1602 case 'N':
1603 keyNbr = param_get8(Cmd, cmdp+1);
8b15860e 1604 if (keyNbr == 0) {
e98572a1 1605 PrintAndLog("Wrong block number");
1606 errors = true;
1607 }
1608 cmdp += 2;
1609 break;
1610 case 'k':
1611 case 'K':
1612 operation += 3; //set key
1613 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1614 if (dataLen == 16) { //ul-c or ev1/ntag key length
1615 errors = param_gethex(tempStr, 0, KEY, dataLen);
1616 } else {
1617 PrintAndLog("\nERROR: Key is incorrect length\n");
1618 errors = true;
1619 }
1620 cmdp += 2;
1621 break;
1622 case 'p':
1623 case 'P':
1624 operation += 4; //print keys in memory
1625 cmdp++;
1626 break;
1627 case 'l':
1628 case 'L':
1629 operation += 5; //load keys from file
1630 cmdp++;
1631 break;
1632 case 's':
1633 case 'S':
1634 operation += 6; //save keys to file
1635 cmdp++;
1636 break;
1637 default:
1638 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1639 errors = true;
1640 break;
1641 }
1642 if(errors) return usage_hf_iclass_managekeys();
1643 }
1644 if (operation == 0){
1645 PrintAndLog("no operation specified (load, save, or print)\n");
1646 return usage_hf_iclass_managekeys();
1647 }
1648 if (operation > 6){
1649 PrintAndLog("Too many operations specified\n");
1650 return usage_hf_iclass_managekeys();
1651 }
1652 if (operation > 4 && fileNameLen == 0){
1653 PrintAndLog("You must enter a filename when loading or saving\n");
1654 return usage_hf_iclass_managekeys();
1655 }
1656
1657 switch (operation){
1658 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1659 case 4: return printKeys();
1660 case 5: return loadKeys(filename);
1661 case 6: return saveKeys(filename);
1662 break;
1663 }
1664 return 0;
1665}
1666
67d78d0c 1667static command_t CommandTable[] = {
6f101995 1668 {"help", CmdHelp, 1, "This help"},
e98572a1 1669 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1670 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1671 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1672 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1673 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1674 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1675 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1676 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1677 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1678 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
6f101995 1679 {"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
e98572a1 1680 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1681 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1682 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1683 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1684 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
6f101995 1685 {NULL, NULL, 0, NULL}
cee5a30d 1686};
1687
67d78d0c 1688int CmdHFiClass(const char *Cmd) {
1689 clearCommandBuffer();
53444513
MHS		 1690 CmdsParse(CommandTable, Cmd);
1691 return 0;
cee5a30d 1692}
1693
67d78d0c 1694int CmdHelp(const char *Cmd) {
53444513
MHS		 1695 CmdsHelp(CommandTable);
1696 return 0;
cee5a30d 1697}
Proxmark3 GIT tracking
Impressum, Datenschutz