]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhficlass.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
CHG: minor change initializing array.
[proxmark3-svn] / client / cmdhficlass.c
CommitLineData
cee5a30d 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833 4// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// High frequency iClass commands
11//-----------------------------------------------------------------------------
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <string.h>
9f6e9d15 16#include <sys/stat.h>
cee5a30d 17#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18#include "data.h"
902cb3c0 19#include "proxmark3.h"
cee5a30d 20#include "ui.h"
21#include "cmdparser.h"
22#include "cmdhficlass.h"
23#include "common.h"
14006804 24#include "util.h"
17cba269 25#include "cmdmain.h"
a66fca86
AD		 26#include "loclass/des.h"
27#include "loclass/cipherutils.h"
28#include "loclass/cipher.h"
29#include "loclass/ikeys.h"
3ad48540
MHS		 30#include "loclass/elite_crack.h"
31#include "loclass/fileutils.h"
1defcf60 32#include "protocols.h"
caaf9618 33#include "usb_cmd.h"
e98572a1 34#include "cmdhfmfu.h"
9332b857 35#include "cmdhf.h"
e98572a1 36
cee5a30d 37static int CmdHelp(const char *Cmd);
38
e98572a1 39#define ICLASS_KEYS_MAX 8
40static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
41 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
49};
50
51typedef struct iclass_block {
52 uint8_t d[8];
53} iclass_block_t;
54
55int xorbits_8(uint8_t val) {
53444513
MHS		 56 uint8_t res = val ^ (val >> 1); //1st pass
57 res = res ^ (res >> 1); // 2nd pass
58 res = res ^ (res >> 2); // 3rd pass
59 res = res ^ (res >> 4); // 4th pass
60 return res & 1;
17cba269
MHS		 61}
62
e98572a1 63int CmdHFiClassList(const char *Cmd) {
9332b857 64 //PrintAndLog("Deprecated command, use 'hf list iclass' instead");
65 CmdHFList("iclass");
17cba269
MHS		 66 return 0;
67}
68
e98572a1 69int CmdHFiClassSnoop(const char *Cmd) {
53444513
MHS		 70 UsbCommand c = {CMD_SNOOP_ICLASS};
71 SendCommand(&c);
72 return 0;
cee5a30d 73}
e98572a1 74
75int usage_hf_iclass_sim(void) {
41524d8a
MHS		 76 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
77 PrintAndLog(" options");
78 PrintAndLog(" 0 <CSN> simulate the given CSN");
79 PrintAndLog(" 1 simulate default CSN");
80 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
81 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
82 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
83 PrintAndLog(" example: hf iclass sim 2");
84 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
85 PrintAndLog(" hf iclass sim 3");
86 return 0;
87}
88
6116c796 89#define NUM_CSNS 15
e98572a1 90int CmdHFiClassSim(const char *Cmd) {
53444513
MHS		 91 uint8_t simType = 0;
92 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
93
94 if (strlen(Cmd)<1) {
1defcf60 95 return usage_hf_iclass_sim();
53444513 96 }
1defcf60 97 simType = param_get8ex(Cmd, 0, 0, 10);
53444513
MHS		 98
99 if(simType == 0)
100 {
101 if (param_gethex(Cmd, 1, CSN, 16)) {
102 PrintAndLog("A CSN should consist of 16 HEX symbols");
41524d8a 103 return usage_hf_iclass_sim();
53444513 104 }
53444513 105
41524d8a 106 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
53444513 107 }
41524d8a 108 if(simType > 3)
53444513
MHS		 109 {
110 PrintAndLog("Undefined simptype %d", simType);
41524d8a 111 return usage_hf_iclass_sim();
53444513 112 }
1e262141 113
41524d8a 114 uint8_t numberOfCSNs=0;
9f6e9d15
MHS		 115 if(simType == 2)
116 {
6116c796 117 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
9f6e9d15 118 UsbCommand resp = {0};
17cba269 119
53444513
MHS		 120 uint8_t csns[8*NUM_CSNS] = {
121 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
6116c796
MHS		 136
137 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
9f6e9d15
MHS		 138
139 SendCommand(&c);
140 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
141 PrintAndLog("Command timed out");
142 return 0;
143 }
1e262141 144
77abe781 145 uint8_t num_mac_responses = resp.arg[1];
6116c796 146 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
9f6e9d15 147
6116c796 148 size_t datalen = NUM_CSNS*24;
9f6e9d15
MHS		 149 /*
150 * Now, time to dump to file. We'll use this format:
77abe781 151 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15 152 * So, it should wind up as
77abe781
MHS		 153 * 8 * 24 bytes.
154 *
155 * The returndata from the pm3 is on the following format
156 * <4 byte NR><4 byte MAC>
157 * CC are all zeroes, CSN is the same as was sent in
9f6e9d15 158 **/
77abe781
MHS		 159 void* dump = malloc(datalen);
160 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15 161 uint8_t i = 0;
6116c796 162 for(i = 0 ; i < NUM_CSNS ; i++)
9f6e9d15 163 {
77abe781
MHS		 164 memcpy(dump+i*24, csns+i*8,8); //CSN
165 //8 zero bytes here...
166 //Then comes NR_MAC (eight bytes from the response)
167 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
1e262141 168
9f6e9d15
MHS		 169 }
170 /** Now, save to dumpfile **/
77abe781
MHS		 171 saveFile("iclass_mac_attack", "bin", dump,datalen);
172 free(dump);
9f6e9d15
MHS		 173 }else
174 {
175 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
176 memcpy(c.d.asBytes, CSN, 8);
177 SendCommand(&c);
178 }
1e262141 179
53444513 180 return 0;
1e262141 181}
182
e98572a1 183int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
8949bb5d 184 bool tagFound = false;
caaf9618
MHS		 185 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
186 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
e98572a1 187 // loop in client not device - else on windows have a communication error
188 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
53444513
MHS		 189 UsbCommand resp;
190 while(!ukbhit()){
e98572a1 191 SendCommand(&c);
6ce0e538 192 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
caaf9618 193 uint8_t readStatus = resp.arg[0] & 0xff;
6ce0e538 194 uint8_t *data = resp.d.asBytes;
53444513 195
8949bb5d 196 if (verbose)
caaf9618
MHS		 197 PrintAndLog("Readstatus:%02x", readStatus);
198 if( readStatus == 0){
53444513 199 //Aborted
8949bb5d 200 if (verbose) PrintAndLog("Quitting...");
53444513
MHS		 201 return 0;
202 }
8949bb5d 203 if( readStatus & FLAG_ICLASS_READER_CSN){
204 PrintAndLog("CSN: %s",sprint_hex(data,8));
205 tagFound = true;
206 }
caaf9618
MHS		 207 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
208 if( readStatus & FLAG_ICLASS_READER_CONF){
209 printIclassDumpInfo(data);
53444513 210 }
8949bb5d 211 if (tagFound && !loop) return 1;
53444513 212 } else {
8949bb5d 213 if (verbose) PrintAndLog("Command execute timeout");
53444513 214 }
8949bb5d 215 if (!loop) break;
53444513 216 }
53444513 217 return 0;
8949bb5d 218}
219
e98572a1 220int CmdHFiClassReader(const char *Cmd) {
8949bb5d 221 return HFiClassReader(Cmd, true, true);
c3963755 222}
223
e98572a1 224int CmdHFiClassReader_Replay(const char *Cmd) {
53444513
MHS		 225 uint8_t readerType = 0;
226 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
c3963755 227
53444513
MHS		 228 if (strlen(Cmd)<1) {
229 PrintAndLog("Usage: hf iclass replay <MAC>");
230 PrintAndLog(" sample: hf iclass replay 00112233");
231 return 0;
232 }
c3963755 233
53444513
MHS		 234 if (param_gethex(Cmd, 0, MAC, 8)) {
235 PrintAndLog("MAC must include 8 HEX symbols");
236 return 1;
237 }
c3963755 238
53444513
MHS		 239 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
240 memcpy(c.d.asBytes, MAC, 4);
241 SendCommand(&c);
1e262141 242
53444513 243 return 0;
1e262141 244}
245
e98572a1 246int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
247 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
248 memcpy(c.d.asBytes, data, blocksCount * 16);
53444513 249 SendCommand(&c);
53444513 250 return 0;
1e262141 251}
252
e98572a1 253int hf_iclass_eload_usage(void) {
7781a656
MHS		 254 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
255 PrintAndLog("Usage: hf iclass eload f <filename>");
256 PrintAndLog("");
257 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
258 return 0;
7781a656
MHS		 259}
260
e98572a1 261int CmdHFiClassELoad(const char *Cmd) {
7781a656
MHS		 262
263 char opt = param_getchar(Cmd, 0);
264 if (strlen(Cmd)<1 || opt == 'h')
265 return hf_iclass_eload_usage();
266
267 //File handling and reading
268 FILE *f;
269 char filename[FILE_PATH_SIZE];
9c4e28a4 270 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
7781a656 271 f = fopen(filename, "rb");
9c4e28a4 272 } else {
7781a656
MHS		 273 return hf_iclass_eload_usage();
274 }
275
276 if(!f) {
277 PrintAndLog("Failed to read from file '%s'", filename);
278 return 1;
279 }
280
281 fseek(f, 0, SEEK_END);
282 long fsize = ftell(f);
283 fseek(f, 0, SEEK_SET);
284
9c4e28a4 285 if (fsize < 0) {
286 prnlog("Error, when getting filesize");
4bb17c66 287 fclose(f);
9c4e28a4 288 return 1;
289 }
290
9c4e28a4 291 uint8_t *dump = malloc(fsize);
1defcf60 292
7781a656
MHS		 293 size_t bytes_read = fread(dump, 1, fsize, f);
294 fclose(f);
295
1defcf60 296 printIclassDumpInfo(dump);
7781a656
MHS		 297 //Validate
298
299 if (bytes_read < fsize)
300 {
301 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
302 free(dump);
303 return 1;
304 }
305 //Send to device
306 uint32_t bytes_sent = 0;
307 uint32_t bytes_remaining = bytes_read;
308
309 while(bytes_remaining > 0){
310 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
311 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
312 memcpy(c.d.asBytes, dump, bytes_in_packet);
313 SendCommand(&c);
314 bytes_remaining -= bytes_in_packet;
315 bytes_sent += bytes_in_packet;
316 }
317 free(dump);
318 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
319 return 0;
320}
321
e98572a1 322static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
41524d8a
MHS		 323 FILE *f = fopen(filename, "rb");
324 if(!f) {
325 PrintAndLog("Failed to read from file '%s'", filename);
326 return 1;
327 }
328 fseek(f, 0, SEEK_END);
329 long fsize = ftell(f);
330 fseek(f, 0, SEEK_SET);
331 size_t bytes_read = fread(buffer, 1, len, f);
332 fclose(f);
333 if(fsize != len)
334 {
335 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
336 return 1;
337 }
338 if(bytes_read != len)
339 {
340 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
341 return 1;
342 }
343 return 0;
344}
345
e98572a1 346int usage_hf_iclass_decrypt(void) {
347 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
348 PrintAndLog("");
349 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
350 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
351 PrintAndLog("");
352 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
353 PrintAndLog("");
354 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
355 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
356 PrintAndLog("which is defined by the configuration block.");
357 return 1;
358}
359
360int CmdHFiClassDecrypt(const char *Cmd) {
41524d8a
MHS		 361 uint8_t key[16] = { 0 };
362 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
363 {
364 usage_hf_iclass_decrypt();
365 return 1;
366 }
367 PrintAndLog("Decryption file found... ");
368 char opt = param_getchar(Cmd, 0);
369 if (strlen(Cmd)<1 || opt == 'h')
370 return usage_hf_iclass_decrypt();
371
372 //Open the tagdump-file
373 FILE *f;
374 char filename[FILE_PATH_SIZE];
3c406169 375 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
376 if ( (f = fopen(filename, "rb")) == NULL) {
377 PrintAndLog("Could not find file %s", filename);
378 return 1;
379 }
380
381 } else {
41524d8a 382 return usage_hf_iclass_decrypt();
3c406169 383 }
41524d8a
MHS		 384
385 fseek(f, 0, SEEK_END);
386 long fsize = ftell(f);
387 fseek(f, 0, SEEK_SET);
388 uint8_t enc_dump[8] = {0};
389 uint8_t *decrypted = malloc(fsize);
390 des3_context ctx = { DES_DECRYPT ,{ 0 } };
391 des3_set2key_dec( &ctx, key);
392 size_t bytes_read = fread(enc_dump, 1, 8, f);
393
394 //Use the first block (CSN) for filename
395 char outfilename[FILE_PATH_SIZE] = { 0 };
396 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
397 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
398 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
399
400 size_t blocknum =0;
401 while(bytes_read == 8)
402 {
9a9bcea8 403 if(blocknum < 7)
41524d8a
MHS		 404 {
405 memcpy(decrypted+(blocknum*8), enc_dump, 8);
406 }else{
407 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
408 }
409 printvar("decrypted block", decrypted +(blocknum*8), 8);
410 bytes_read = fread(enc_dump, 1, 8, f);
411 blocknum++;
412 }
413 fclose(f);
414
415 saveFile(outfilename,"bin", decrypted, blocknum*8);
416
ab7bb494 417 free(decrypted);
41524d8a
MHS		 418 return 0;
419}
7781a656 420
e98572a1 421int usage_hf_iclass_encrypt(void) {
422 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
423 PrintAndLog("");
424 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
425 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
426 PrintAndLog("");
427 PrintAndLog("example: hf iclass encrypt 0102030405060708");
428 PrintAndLog("");
429 return 0;
430}
431
432static int iClassEncryptBlkData(uint8_t *blkData) {
433 uint8_t key[16] = { 0 };
434 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
435 {
436 usage_hf_iclass_encrypt();
437 return 1;
438 }
439 PrintAndLog("Decryption file found... ");
53444513 440
e98572a1 441 uint8_t encryptedData[16];
442 uint8_t *encrypted = encryptedData;
443 des3_context ctx = { DES_DECRYPT ,{ 0 } };
444 des3_set2key_enc( &ctx, key);
445
446 des3_crypt_ecb(&ctx, blkData,encrypted);
447 //printvar("decrypted block", decrypted, 8);
448 memcpy(blkData,encrypted,8);
449
450 return 1;
451}
53444513 452
e98572a1 453int CmdHFiClassEncryptBlk(const char *Cmd) {
454 uint8_t blkData[8] = {0};
455 char opt = param_getchar(Cmd, 0);
456 if (strlen(Cmd)<1 || opt == 'h')
457 return usage_hf_iclass_encrypt();
458
459 //get the bytes to encrypt
460 if (param_gethex(Cmd, 0, blkData, 16))
53444513 461 {
e98572a1 462 PrintAndLog("BlockData must include 16 HEX symbols");
53444513
MHS		 463 return 0;
464 }
e98572a1 465 if (!iClassEncryptBlkData(blkData)) return 0;
53444513 466
e98572a1 467 printvar("encrypted block", blkData, 8);
468 return 1;
469}
470
471void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
472 uint8_t WB[9];
473 WB[0] = blockno;
474 memcpy(WB + 1,data,8);
475 doMAC_N(WB,sizeof(WB),div_key,MAC);
476 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
477}
478
479static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
480 UsbCommand resp;
481
482 UsbCommand c = {CMD_READER_ICLASS, {0}};
483 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
484 if (use_credit_key)
485 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
486
487 clearCommandBuffer();
488 SendCommand(&c);
489 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
53444513 490 {
e98572a1 491 PrintAndLog("Command execute timeout");
492 return false;
53444513
MHS		 493 }
494
e98572a1 495 uint8_t isOK = resp.arg[0] & 0xff;
496 uint8_t *data = resp.d.asBytes;
497
498 memcpy(CSN,data,8);
499 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
500 if(isOK > 0)
53444513 501 {
e98572a1 502 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
503 }
504 if(isOK <= 1){
505 PrintAndLog("Failed to obtain CC! Aborting");
506 return false;
53444513 507 }
e98572a1 508 return true;
509}
510
a7474bb3 511static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
e98572a1 512 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
513 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
514
515 if (!select_only(CSN, CCNR, use_credit_key, verbose))
516 return false;
517
518 //get div_key
a7474bb3 519 if(rawkey)
520 memcpy(div_key, KEY, 8);
521 else
e98572a1 522 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
a7474bb3 523 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
e98572a1 524
525 doMAC(CCNR, div_key, MAC);
526 UsbCommand resp;
527 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
528 memcpy(d.d.asBytes, MAC, 4);
529 clearCommandBuffer();
530 SendCommand(&d);
531 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
53444513 532 {
e98572a1 533 PrintAndLog("Auth Command execute timeout");
534 return false;
535 }
536 uint8_t isOK = resp.arg[0] & 0xff;
537 if (!isOK) {
538 PrintAndLog("Authentication error");
539 return false;
53444513 540 }
e98572a1 541 return true;
542}
53444513 543
e98572a1 544int usage_hf_iclass_dump(void) {
a7474bb3 545 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
e98572a1 546 PrintAndLog("Options:");
547 PrintAndLog(" f <filename> : specify a filename to save dump to");
548 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
549 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
550 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
551 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
552 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
a7474bb3 553 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
e98572a1 554 PrintAndLog(" NOTE: * = required");
555 PrintAndLog("Samples:");
556 PrintAndLog(" hf iclass dump k 001122334455667B");
557 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
558 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
559 return 0;
560}
561
562int CmdHFiClassReader_Dump(const char *Cmd) {
563
564 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
565 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
566 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
567 uint8_t blockno = 0;
568 uint8_t numblks = 0;
569 uint8_t maxBlk = 31;
570 uint8_t app_areas = 1;
571 uint8_t kb = 2;
572 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
573 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
574 uint8_t keyNbr = 0;
575 uint8_t dataLen = 0;
576 uint8_t fileNameLen = 0;
577 char filename[FILE_PATH_SIZE]={0};
578 char tempStr[50] = {0};
579 bool have_debit_key = false;
580 bool have_credit_key = false;
581 bool use_credit_key = false;
582 bool elite = false;
a7474bb3 583 bool rawkey = false;
e98572a1 584 bool errors = false;
585 uint8_t cmdp = 0;
586
587 while(param_getchar(Cmd, cmdp) != 0x00)
588 {
589 switch(param_getchar(Cmd, cmdp))
590 {
591 case 'h':
592 case 'H':
593 return usage_hf_iclass_dump();
594 case 'c':
595 case 'C':
596 have_credit_key = true;
597 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
598 if (dataLen == 16) {
599 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
600 } else if (dataLen == 1) {
601 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 602 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 603 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
604 } else {
605 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
606 errors = true;
607 }
608 } else {
609 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
610 errors = true;
611 }
612 cmdp += 2;
613 break;
614 case 'e':
615 case 'E':
616 elite = true;
617 cmdp++;
618 break;
619 case 'f':
620 case 'F':
621 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
622 if (fileNameLen < 1) {
623 PrintAndLog("No filename found after f");
624 errors = true;
625 }
626 cmdp += 2;
627 break;
628 case 'k':
629 case 'K':
630 have_debit_key = true;
631 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
632 if (dataLen == 16) {
633 errors = param_gethex(tempStr, 0, KEY, dataLen);
634 } else if (dataLen == 1) {
635 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 636 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 637 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
638 } else {
639 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
640 errors = true;
641 }
642 } else {
643 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
644 errors = true;
645 }
646 cmdp += 2;
647 break;
a7474bb3 648 case 'r':
649 case 'R':
650 rawkey = true;
651 cmdp++;
652 break;
e98572a1 653 default:
654 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
655 errors = true;
656 break;
657 }
658 if(errors) return usage_hf_iclass_dump();
659 }
660
661 if (cmdp < 2) return usage_hf_iclass_dump();
662 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
663 if (!have_debit_key && have_credit_key) use_credit_key = true;
664
665 //get config and first 3 blocks
666 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
667 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
53444513 668 UsbCommand resp;
e98572a1 669 uint8_t tag_data[255*8];
53444513 670
e98572a1 671 clearCommandBuffer();
672 SendCommand(&c);
673 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
674 PrintAndLog("Command execute timeout");
675 ul_switch_off_field();
676 return 0;
677 }
678 uint8_t readStatus = resp.arg[0] & 0xff;
53444513
MHS		 679 uint8_t * data = resp.d.asBytes;
680
e98572a1 681 if(readStatus == 0){
682 PrintAndLog("No tag found...");
683 ul_switch_off_field();
684 return 0;
685}
686 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
687 memcpy(tag_data, data, 8*3);
688 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
689 numblks = data[8];
690 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
691 // large memory - not able to dump pages currently
692 if (numblks > maxBlk) numblks = maxBlk;
693 }
694 ul_switch_off_field();
695 // authenticate debit key and get div_key - later store in dump block 3
a7474bb3 696 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
e98572a1 697 //try twice - for some reason it sometimes fails the first time...
a7474bb3 698 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
e98572a1 699 ul_switch_off_field();
700 return 0;
701 }
53444513 702 }
e98572a1 703
704 // begin dump
705 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
706 clearCommandBuffer();
707 SendCommand(&w);
708 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
709 PrintAndLog("Command execute time-out 1");
710 ul_switch_off_field();
711 return 1;
712 }
713 uint32_t blocksRead = resp.arg[1];
714 uint8_t isOK = resp.arg[0] & 0xff;
715 if (!isOK && !blocksRead) {
716 PrintAndLog("Read Block Failed");
717 ul_switch_off_field();
718 return 0;
719 }
720 uint32_t startindex = resp.arg[2];
721 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
722 PrintAndLog("Data exceeded Buffer size!");
723 blocksRead = (sizeof(tag_data)/8) - blockno;
724 }
725 // response ok - now get bigbuf content of the dump
726 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
727 WaitForResponse(CMD_ACK,NULL);
728 size_t gotBytes = blocksRead*8 + blockno*8;
729
730 // try AA2
731 if (have_credit_key) {
732 //turn off hf field before authenticating with different key
733 ul_switch_off_field();
734 memset(MAC,0,4);
735 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
a7474bb3 736 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
e98572a1 737 //try twice - for some reason it sometimes fails the first time...
a7474bb3 738 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
e98572a1 739 ul_switch_off_field();
740 return 0;
741 }
742 }
743 // do we still need to read more block? (aa2 enabled?)
744 if (maxBlk > blockno+numblks+1) {
745 // setup dump and start
746 w.arg[0] = blockno + blocksRead;
747 w.arg[1] = maxBlk - (blockno + blocksRead);
748 clearCommandBuffer();
749 SendCommand(&w);
750 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
751 PrintAndLog("Command execute timeout 2");
752 ul_switch_off_field();
753 return 0;
754 }
755 uint8_t isOK = resp.arg[0] & 0xff;
756 blocksRead = resp.arg[1];
757 if (!isOK && !blocksRead) {
758 PrintAndLog("Read Block Failed 2");
759 ul_switch_off_field();
760 return 0;
761 }
53444513 762
e98572a1 763 startindex = resp.arg[2];
764 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
765 PrintAndLog("Data exceeded Buffer size!");
766 blocksRead = (sizeof(tag_data) - gotBytes)/8;
767 }
768 // get dumped data from bigbuf
769 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
770 WaitForResponse(CMD_ACK,NULL);
53444513 771
e98572a1 772 gotBytes += blocksRead*8;
773 } else { //field is still on - turn it off...
774 ul_switch_off_field();
775 }
776 }
53444513 777
e98572a1 778 // add diversified keys to dump
779 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
780 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
781 // print the dump
782 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
783 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
784 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
785
786 if (filename[0] == 0){
787 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
788 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
789 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
790 }
53444513 791
e98572a1 792 // save the dump to .bin file
793 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
794 saveFile(filename, "bin", tag_data, gotBytes);
795 return 1;
796}
53444513 797
a7474bb3 798static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
e98572a1 799 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
800 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
a7474bb3 801 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
e98572a1 802 return 0;
803
804 UsbCommand resp;
805
806 Calc_wb_mac(blockno,bldata,div_key,MAC);
807 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
808 memcpy(w.d.asBytes, bldata, 8);
809 memcpy(w.d.asBytes + 8, MAC, 4);
810
811 clearCommandBuffer();
812 SendCommand(&w);
813 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
814 {
815 PrintAndLog("Write Command execute timeout");
816 return 0;
817 }
818 uint8_t isOK = resp.arg[0] & 0xff;
819 if (!isOK) {
820 PrintAndLog("Write Block Failed");
821 return 0;
822 }
823 PrintAndLog("Write Block Successful");
824 return 1;
825}
826
827int usage_hf_iclass_writeblock(void) {
828 PrintAndLog("Options:");
829 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
830 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
831 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
832 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
833 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
a7474bb3 834 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
e98572a1 835 PrintAndLog("Samples:");
836 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
837 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
838 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
839 return 0;
840}
841
842int CmdHFiClass_WriteBlock(const char *Cmd) {
843 uint8_t blockno=0;
844 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
845 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
846 uint8_t keyNbr = 0;
847 uint8_t dataLen = 0;
848 char tempStr[50] = {0};
849 bool use_credit_key = false;
850 bool elite = false;
a7474bb3 851 bool rawkey= false;
e98572a1 852 bool errors = false;
853 uint8_t cmdp = 0;
854 while(param_getchar(Cmd, cmdp) != 0x00)
855 {
856 switch(param_getchar(Cmd, cmdp))
857 {
858 case 'h':
859 case 'H':
860 return usage_hf_iclass_writeblock();
861 case 'b':
862 case 'B':
863 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
864 PrintAndLog("Block No must include 2 HEX symbols\n");
865 errors = true;
866 }
867 cmdp += 2;
868 break;
869 case 'c':
870 case 'C':
871 use_credit_key = true;
872 cmdp++;
873 break;
874 case 'd':
875 case 'D':
876 if (param_gethex(Cmd, cmdp+1, bldata, 16))
877 {
878 PrintAndLog("KEY must include 16 HEX symbols\n");
879 errors = true;
880 }
881 cmdp += 2;
882 break;
883 case 'e':
884 case 'E':
885 elite = true;
886 cmdp++;
887 break;
888 case 'k':
889 case 'K':
890 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
891 if (dataLen == 16) {
892 errors = param_gethex(tempStr, 0, KEY, dataLen);
893 } else if (dataLen == 1) {
894 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 895 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 896 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
897 } else {
898 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
899 errors = true;
900 }
901 } else {
902 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
903 errors = true;
904 }
905 cmdp += 2;
906 break;
a7474bb3 907 case 'r':
908 case 'R':
909 rawkey = true;
910 cmdp++;
911 break;
e98572a1 912 default:
913 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
914 errors = true;
915 break;
916 }
917 if(errors) return usage_hf_iclass_writeblock();
918 }
919
920 if (cmdp < 6) return usage_hf_iclass_writeblock();
a7474bb3 921 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
e98572a1 922 ul_switch_off_field();
923 return ans;
924}
925
926int usage_hf_iclass_clone(void) {
a7474bb3 927 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
e98572a1 928 PrintAndLog("Options:");
929 PrintAndLog(" f <filename>: specify a filename to clone from");
930 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
931 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
932 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
933 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
934 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
a7474bb3 935 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
e98572a1 936 PrintAndLog("Samples:");
937 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
938 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
939 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
940 return -1;
941}
942
943int CmdHFiClassCloneTag(const char *Cmd) {
5cba4462 944 char filename[FILE_PATH_SIZE] = { 0x00 };
e98572a1 945 char tempStr[50]={0};
946 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
947 uint8_t keyNbr = 0;
948 uint8_t fileNameLen = 0;
949 uint8_t startblock = 0;
950 uint8_t endblock = 0;
951 uint8_t dataLen = 0;
952 bool use_credit_key = false;
953 bool elite = false;
a7474bb3 954 bool rawkey = false;
e98572a1 955 bool errors = false;
956 uint8_t cmdp = 0;
957 while(param_getchar(Cmd, cmdp) != 0x00)
958 {
959 switch(param_getchar(Cmd, cmdp))
960 {
961 case 'h':
962 case 'H':
963 return usage_hf_iclass_clone();
964 case 'b':
965 case 'B':
966 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
967 PrintAndLog("Start Block No must include 2 HEX symbols\n");
968 errors = true;
969 }
970 cmdp += 2;
971 break;
972 case 'c':
973 case 'C':
974 use_credit_key = true;
975 cmdp++;
976 break;
977 case 'e':
978 case 'E':
979 elite = true;
980 cmdp++;
981 break;
982 case 'f':
983 case 'F':
984 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
985 if (fileNameLen < 1) {
986 PrintAndLog("No filename found after f");
987 errors = true;
988 }
989 cmdp += 2;
990 break;
991 case 'k':
992 case 'K':
993 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
994 if (dataLen == 16) {
995 errors = param_gethex(tempStr, 0, KEY, dataLen);
996 } else if (dataLen == 1) {
997 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 998 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 999 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1000 } else {
1001 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1002 errors = true;
1003 }
1004 } else {
1005 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1006 errors = true;
1007 }
1008 cmdp += 2;
1009 break;
1010 case 'l':
1011 case 'L':
1012 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1013 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1014 errors = true;
1015 }
1016 cmdp += 2;
1017 break;
a7474bb3 1018 case 'r':
1019 case 'R':
1020 rawkey = true;
1021 cmdp++;
1022 break;
e98572a1 1023 default:
1024 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1025 errors = true;
1026 break;
1027 }
1028 if(errors) return usage_hf_iclass_clone();
1029 }
1030
1031 if (cmdp < 8) return usage_hf_iclass_clone();
1032
1033 FILE *f;
1034
1035 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1036
1037 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1038 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1039 }
1040 // file handling and reading
1041 f = fopen(filename,"rb");
1042 if(!f) {
1043 PrintAndLog("Failed to read from file '%s'", filename);
1044 return 1;
1045 }
1046
1047 if (startblock<5) {
1048 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
628d1cb0 1049 fclose(f);
e98572a1 1050 return 0;
1051 }
1052 // now read data from the file from block 6 --- 19
1053 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1054 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1055 // else we have to create a share memory
1056 int i;
1057 fseek(f,startblock*8,SEEK_SET);
2b9006bd 1058 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0){
1059 PrintAndLog("File reading error.");
1060 fclose(f);
1061 return 2;
1062 }
e98572a1 1063
1064 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1065 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1066
a7474bb3 1067 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
e98572a1 1068 return 0;
1069
1070 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
1071 uint8_t *ptr;
1072 // calculate all mac for every the block we will write
1073 for (i = startblock; i <= endblock; i++){
1074 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1075 // usb command d start pointer = d + (i - 6) * 12
1076 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1077 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1078 // next one
1079 ptr = w.d.asBytes + (i - startblock) * 12;
1080 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1081 memcpy(ptr + 8,MAC, 4);
1082 }
1083 uint8_t p[12];
1084 for (i = 0; i <= endblock - startblock;i++){
1085 memcpy(p,w.d.asBytes + (i * 12),12);
1086 printf("Block |%02x|",i + startblock);
1087 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1088 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1089 }
1090 UsbCommand resp;
1091 SendCommand(&w);
1092 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1093 {
1094 PrintAndLog("Command execute timeout");
1095 return 0;
1096 }
1097 return 1;
1098}
1099
a7474bb3 1100static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose) {
e98572a1 1101 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1102 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1103
a7474bb3 1104 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
e98572a1 1105 return 0;
1106
1107 UsbCommand resp;
1108 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
1109 clearCommandBuffer();
1110 SendCommand(&w);
1111 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1112 {
53444513 1113 PrintAndLog("Command execute timeout");
e98572a1 1114 return 0;
53444513 1115 }
e98572a1 1116 uint8_t isOK = resp.arg[0] & 0xff;
1117 if (!isOK) {
1118 PrintAndLog("Read Block Failed");
1119 return 0;
1120 }
1121 //data read is stored in: resp.d.asBytes[0-15]
1122 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1123 return 1;
1124}
1125
1126int usage_hf_iclass_readblock(void) {
a7474bb3 1127 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
e98572a1 1128 PrintAndLog("Options:");
1129 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1130 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1131 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1132 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
a7474bb3 1133 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
e98572a1 1134 PrintAndLog("Samples:");
1135 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1136 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1137 PrintAndLog(" hf iclass readblk b 0A k 0");
53444513 1138 return 0;
a66fca86 1139}
e98572a1 1140
1141int CmdHFiClass_ReadBlock(const char *Cmd) {
1142 uint8_t blockno=0;
1143 uint8_t keyType = 0x88; //debit key
1144 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1145 uint8_t keyNbr = 0;
1146 uint8_t dataLen = 0;
1147 char tempStr[50] = {0};
1148 bool elite = false;
a7474bb3 1149 bool rawkey = false;
e98572a1 1150 bool errors = false;
1151 uint8_t cmdp = 0;
1152 while(param_getchar(Cmd, cmdp) != 0x00)
1153 {
1154 switch(param_getchar(Cmd, cmdp))
1155 {
1156 case 'h':
1157 case 'H':
1158 return usage_hf_iclass_readblock();
1159 case 'b':
1160 case 'B':
1161 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1162 PrintAndLog("Block No must include 2 HEX symbols\n");
1163 errors = true;
1164 }
1165 cmdp += 2;
1166 break;
1167 case 'c':
1168 case 'C':
1169 keyType = 0x18;
1170 cmdp++;
1171 break;
1172 case 'e':
1173 case 'E':
1174 elite = true;
1175 cmdp++;
1176 break;
1177 case 'k':
1178 case 'K':
1179 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1180 if (dataLen == 16) {
1181 errors = param_gethex(tempStr, 0, KEY, dataLen);
1182 } else if (dataLen == 1) {
1183 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 1184 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 1185 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1186 } else {
1187 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1188 errors = true;
1189 }
1190 } else {
1191 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1192 errors = true;
1193 }
1194 cmdp += 2;
1195 break;
a7474bb3 1196 case 'r':
1197 case 'R':
1198 rawkey = true;
1199 cmdp++;
1200 break;
e98572a1 1201 default:
1202 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1203 errors = true;
1204 break;
1205 }
1206 if(errors) return usage_hf_iclass_readblock();
1207 }
1208
1209 if (cmdp < 4) return usage_hf_iclass_readblock();
1210
a7474bb3 1211 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true);
e98572a1 1212}
1213
1214int CmdHFiClass_loclass(const char *Cmd) {
6f101995
MHS		 1215 char opt = param_getchar(Cmd, 0);
1216
1217 if (strlen(Cmd)<1 || opt == 'h') {
1218 PrintAndLog("Usage: hf iclass loclass [options]");
1219 PrintAndLog("Options:");
1220 PrintAndLog("h Show this help");
1221 PrintAndLog("t Perform self-test");
1222 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1223 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1224 PrintAndLog(" malicious CSNs, and their protocol responses");
1225 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1226 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1227 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1228 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1229 PrintAndLog(" ... totalling N*24 bytes");
1230 return 0;
1231 }
1232 char fileName[255] = {0};
1233 if(opt == 'f')
1234 {
53444513
MHS		 1235 if(param_getstr(Cmd, 1, fileName) > 0)
1236 {
1237 return bruteforceFileNoKeys(fileName);
1238 }else
1239 {
1240 PrintAndLog("You must specify a filename");
1241 }
6f101995
MHS		 1242 }
1243 else if(opt == 't')
1244 {
1245 int errors = testCipherUtils();
1246 errors += testMAC();
1247 errors += doKeyTests(0);
1248 errors += testElite();
1249 if(errors)
1250 {
1251 prnlog("OBS! There were errors!!!");
1252 }
1253 return errors;
1254 }
a66fca86 1255
6f101995
MHS		 1256 return 0;
1257}
c3963755 1258
e98572a1 1259void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1260 uint8_t blockdata[8];
1261 uint8_t mem_config;
1262 memcpy(&mem_config, iclass_dump + 13,1);
1263 uint8_t maxmemcount;
1264 uint8_t filemaxblock = filesize / 8;
1265 if (mem_config & 0x80)
1266 maxmemcount = 255;
1267 else
1268 maxmemcount = 31;
1269 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1270
1271 if (startblock == 0)
1272 startblock = 6;
1273 if ((endblock > maxmemcount) || (endblock == 0))
1274 endblock = maxmemcount;
1275 if (endblock > filemaxblock)
1276 endblock = filemaxblock;
1277 int i = startblock;
1278 int j;
1279 while (i <= endblock){
1280 printf("Block |%02X| ",i);
1281 memcpy(blockdata,iclass_dump + (i * 8),8);
1282 for (j = 0;j < 8;j++)
1283 printf("%02X ",blockdata[j]);
1284 printf("|\n");
1285 i++;
1286 }
1287}
1288
1289int usage_hf_iclass_readtagfile() {
1290 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1291 return 1;
1292}
1293
1294int CmdHFiClassReadTagFile(const char *Cmd) {
1295 int startblock = 0;
1296 int endblock = 0;
1297 char tempnum[5];
1298 FILE *f;
1299 char filename[FILE_PATH_SIZE];
1300 if (param_getstr(Cmd, 0, filename) < 1)
1301 return usage_hf_iclass_readtagfile();
1302 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1303 startblock = 0;
1304 else
1305 sscanf(tempnum,"%d",&startblock);
1306
1307 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1308 endblock = 0;
1309 else
1310 sscanf(tempnum,"%d",&endblock);
1311 // file handling and reading
1312 f = fopen(filename,"rb");
1313 if(!f) {
1314 PrintAndLog("Failed to read from file '%s'", filename);
1315 return 1;
1316 }
1317 fseek(f, 0, SEEK_END);
1318 long fsize = ftell(f);
1319 fseek(f, 0, SEEK_SET);
1320
ddb748a9 1321 if ( fsize < 0 ) {
1322 PrintAndLog("Error, when getting filesize");
1323 fclose(f);
1324 return 1;
1325 }
e98572a1 1326
ddb748a9 1327 uint8_t *dump = malloc(fsize);
e98572a1 1328
1329 size_t bytes_read = fread(dump, 1, fsize, f);
1330 fclose(f);
1331 uint8_t *csn = dump;
1332 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
1333 // printIclassDumpInfo(dump);
1334 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1335 free(dump);
1336 return 0;
1337}
1338
1339/*
1340uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1341 uint64_t new_div = 0x00;
1342 new_div ^= sdiv;
1343 new_div ^= hdiv;
1344 return new_div;
1345}
1346
1347uint64_t hexarray_to_uint64(uint8_t *key) {
1348 char temp[17];
1349 uint64_t uint_key;
1350 for (int i = 0;i < 8;i++)
1351 sprintf(&temp[(i *2)],"%02X",key[i]);
1352 temp[16] = '\0';
1353 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1354 return 0;
1355 return uint_key;
1356}
1357*/
1358void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1359 uint8_t keytable[128] = {0};
1360 uint8_t key_index[8] = {0};
1361 if (elite) {
1362 uint8_t key_sel[8] = { 0 };
1363 uint8_t key_sel_p[8] = { 0 };
1364 hash2(KEY, keytable);
1365 hash1(CSN, key_index);
1366 for(uint8_t i = 0; i < 8 ; i++)
1367 key_sel[i] = keytable[key_index[i]] & 0xFF;
1368
1369 //Permute from iclass format to standard format
1370 permutekey_rev(key_sel, key_sel_p);
1371 diversifyKey(CSN, key_sel_p, div_key);
1372 } else {
1373 diversifyKey(CSN, KEY, div_key);
1374 }
1375}
1376
1377//when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1378//calculate and return xor_div_key (ready for a key write command)
1379//print all div_keys if verbose
1380static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1381 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1382 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1383 //get old div key
1384 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1385 //get new div key
1386 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1387
1388 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1389 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1390 }
1391 if (verbose) {
1392 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1393 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1394 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1395 }
1396}
1397
1398int usage_hf_iclass_calc_newkey(void) {
1399 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1400 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1401 PrintAndLog(" Options:");
1402 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1403 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1404 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1405 PrintAndLog(" e : specify new key as elite calc");
1406 PrintAndLog(" ee : specify old and new key as elite calc");
1407 PrintAndLog("Samples:");
1408 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1409 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1410 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1411 PrintAndLog("NOTE: * = required\n");
1412
1413 return 1;
1414}
1415
1416int CmdHFiClassCalcNewKey(const char *Cmd) {
1417 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1418 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1419 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1420 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1421 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1422 uint8_t keyNbr = 0;
1423 uint8_t dataLen = 0;
1424 char tempStr[50] = {0};
1425 bool givenCSN = false;
1426 bool oldElite = false;
1427 bool elite = false;
1428 bool errors = false;
1429 uint8_t cmdp = 0;
1430 while(param_getchar(Cmd, cmdp) != 0x00)
1431 {
1432 switch(param_getchar(Cmd, cmdp))
1433 {
1434 case 'h':
1435 case 'H':
1436 return usage_hf_iclass_calc_newkey();
1437 case 'e':
1438 case 'E':
1439 dataLen = param_getstr(Cmd, cmdp, tempStr);
1440 if (dataLen==2)
1441 oldElite = true;
1442 elite = true;
1443 cmdp++;
1444 break;
1445 case 'n':
1446 case 'N':
1447 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1448 if (dataLen == 16) {
1449 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1450 } else if (dataLen == 1) {
1451 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 1452 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 1453 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1454 } else {
1455 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1456 errors = true;
1457 }
1458 } else {
1459 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1460 errors = true;
1461 }
1462 cmdp += 2;
1463 break;
1464 case 'o':
1465 case 'O':
1466 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1467 if (dataLen == 16) {
1468 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1469 } else if (dataLen == 1) {
1470 keyNbr = param_get8(Cmd, cmdp+1);
f7c30d80 1471 if (keyNbr < ICLASS_KEYS_MAX) {
e98572a1 1472 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1473 } else {
1474 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1475 errors = true;
1476 }
1477 } else {
1478 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1479 errors = true;
1480 }
1481 cmdp += 2;
1482 break;
1483 case 's':
1484 case 'S':
1485 givenCSN = true;
1486 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1487 return usage_hf_iclass_calc_newkey();
1488 cmdp += 2;
1489 break;
1490 default:
1491 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1492 errors = true;
1493 break;
1494 }
1495 if(errors) return usage_hf_iclass_calc_newkey();
1496 }
1497
1498 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1499
1500 if (!givenCSN)
1501 if (!select_only(CSN, CCNR, false, true))
1502 return 0;
1503
1504 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1505 return 0;
1506}
1507
1508static int loadKeys(char *filename) {
1509 FILE *f;
1510 f = fopen(filename,"rb");
1511 if(!f) {
1512 PrintAndLog("Failed to read from file '%s'", filename);
1513 return 0;
1514 }
1515 fseek(f, 0, SEEK_END);
1516 long fsize = ftell(f);
1517 fseek(f, 0, SEEK_SET);
1518
4bb17c66 1519 if ( fsize < 0 ) {
1520 PrintAndLog("Error, when getting filesize");
1521 fclose(f);
1522 return 1;
1523 }
1524
e98572a1 1525 uint8_t *dump = malloc(fsize);
1526
1527 size_t bytes_read = fread(dump, 1, fsize, f);
1528 fclose(f);
1529 if (bytes_read > ICLASS_KEYS_MAX * 8){
1530 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1531 free(dump);
1532 return 0;
1533 }
1534 uint8_t i = 0;
1535 for (; i < bytes_read/8; i++){
1536 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1537 }
1538 free(dump);
1539 PrintAndLog("%u keys loaded", i);
1540 return 1;
1541}
1542
1543static int saveKeys(char *filename) {
1544 FILE *f;
1545 f = fopen(filename,"wb");
1546 if (f == NULL) {
1547 printf("error opening file %s\n",filename);
1548 return 0;
1549 }
1550 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1551 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1552 PrintAndLog("save key failed to write to file: %s", filename);
1553 break;
1554 }
1555 }
1556 fclose(f);
1557 return 0;
1558}
1559
1560static int printKeys(void) {
1561 PrintAndLog("");
1562 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1563 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1564 }
1565 PrintAndLog("");
1566 return 0;
1567}
1568
1569int usage_hf_iclass_managekeys(void) {
1570 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1571 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1572 PrintAndLog(" Options:");
1573 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1574 PrintAndLog(" k <key> : set a key in memory");
1575 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1576 PrintAndLog(" s : save keys in memory to file specified by filename");
1577 PrintAndLog(" l : load keys to memory from file specified by filename");
1578 PrintAndLog(" p : print keys loaded into memory\n");
1579 PrintAndLog("Samples:");
1580 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1581 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1582 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1583 PrintAndLog(" print keys : hf iclass managekeys p\n");
1584 return 0;
1585}
1586
1587int CmdHFiClassManageKeys(const char *Cmd) {
1588 uint8_t keyNbr = 0;
1589 uint8_t dataLen = 0;
1590 uint8_t KEY[8] = {0};
1591 char filename[FILE_PATH_SIZE];
1592 uint8_t fileNameLen = 0;
1593 bool errors = false;
1594 uint8_t operation = 0;
1595 char tempStr[20];
1596 uint8_t cmdp = 0;
1597
1598 while(param_getchar(Cmd, cmdp) != 0x00)
1599 {
1600 switch(param_getchar(Cmd, cmdp))
1601 {
1602 case 'h':
1603 case 'H':
1604 return usage_hf_iclass_managekeys();
1605 case 'f':
1606 case 'F':
1607 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1608 if (fileNameLen < 1) {
1609 PrintAndLog("No filename found after f");
1610 errors = true;
1611 }
1612 cmdp += 2;
1613 break;
1614 case 'n':
1615 case 'N':
1616 keyNbr = param_get8(Cmd, cmdp+1);
8b15860e 1617 if (keyNbr == 0) {
e98572a1 1618 PrintAndLog("Wrong block number");
1619 errors = true;
1620 }
1621 cmdp += 2;
1622 break;
1623 case 'k':
1624 case 'K':
1625 operation += 3; //set key
1626 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1627 if (dataLen == 16) { //ul-c or ev1/ntag key length
1628 errors = param_gethex(tempStr, 0, KEY, dataLen);
1629 } else {
1630 PrintAndLog("\nERROR: Key is incorrect length\n");
1631 errors = true;
1632 }
1633 cmdp += 2;
1634 break;
1635 case 'p':
1636 case 'P':
1637 operation += 4; //print keys in memory
1638 cmdp++;
1639 break;
1640 case 'l':
1641 case 'L':
1642 operation += 5; //load keys from file
1643 cmdp++;
1644 break;
1645 case 's':
1646 case 'S':
1647 operation += 6; //save keys to file
1648 cmdp++;
1649 break;
1650 default:
1651 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1652 errors = true;
1653 break;
1654 }
1655 if(errors) return usage_hf_iclass_managekeys();
1656 }
1657 if (operation == 0){
1658 PrintAndLog("no operation specified (load, save, or print)\n");
1659 return usage_hf_iclass_managekeys();
1660 }
1661 if (operation > 6){
1662 PrintAndLog("Too many operations specified\n");
1663 return usage_hf_iclass_managekeys();
1664 }
1665 if (operation > 4 && fileNameLen == 0){
1666 PrintAndLog("You must enter a filename when loading or saving\n");
1667 return usage_hf_iclass_managekeys();
1668 }
1669
1670 switch (operation){
1671 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1672 case 4: return printKeys();
1673 case 5: return loadKeys(filename);
1674 case 6: return saveKeys(filename);
1675 break;
1676 }
1677 return 0;
1678}
1679
cee5a30d 1680static command_t CommandTable[] =
1681{
6f101995 1682 {"help", CmdHelp, 1, "This help"},
e98572a1 1683 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1684 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1685 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1686 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1687 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1688 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1689 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1690 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1691 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1692 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
6f101995 1693 {"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
e98572a1 1694 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1695 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1696 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1697 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1698 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
6f101995 1699 {NULL, NULL, 0, NULL}
cee5a30d 1700};
1701
1702int CmdHFiClass(const char *Cmd)
1703{
53444513
MHS		 1704 CmdsParse(CommandTable, Cmd);
1705 return 0;
cee5a30d 1706}
1707
1708int CmdHelp(const char *Cmd)
1709{
53444513
MHS		 1710 CmdsHelp(CommandTable);
1711 return 0;
cee5a30d 1712}
Proxmark3 GIT tracking
Impressum, Datenschutz