[proxmark3-svn] / client / cmdhficlass.c

//-----------------------------------------------------------------------------
// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
// Copyright (C) 2011 Gerhard de Koning Gans
// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// High frequency iClass commands
//-----------------------------------------------------------------------------

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
#include "data.h"
#include "proxmark3.h"
#include "ui.h"
#include "cmdparser.h"
#include "cmdhficlass.h"
#include "../include/common.h"
#include "util.h"
#include "cmdmain.h"
#include "loclass/des.h"
#include "loclass/cipherutils.h"
#include "loclass/cipher.h"
#include "loclass/ikeys.h"
#include "loclass/elite_crack.h"
#include "loclass/fileutils.h"

static int CmdHelp(const char *Cmd);

int xorbits_8(uint8_t val)
{
	uint8_t res = val ^ (val >> 1); //1st pass
	res = res ^ (res >> 1); 		// 2nd pass
	res = res ^ (res >> 2); 		// 3rd pass
	res = res ^ (res >> 4); 			// 4th pass
	return res & 1;
}

int CmdHFiClassList(const char *Cmd)
{

	bool ShowWaitCycles = false;
	char param = param_getchar(Cmd, 0);

	if (param != 0) {
		PrintAndLog("List data in trace buffer.");
		PrintAndLog("Usage:  hf iclass list");
		PrintAndLog("h - help");
		PrintAndLog("sample: hf iclass list");
		return 0;
	}

	uint8_t got[1920];
	GetFromBigBuf(got,sizeof(got),0);
	WaitForResponse(CMD_ACK,NULL);

	PrintAndLog("Recorded Activity");
	PrintAndLog("");
	PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
	PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
	PrintAndLog("");
	PrintAndLog("     Start |       End | Src | Data");
	PrintAndLog("-----------|-----------|-----|--------");

	int i;
	uint32_t first_timestamp = 0;
	uint32_t timestamp;
	bool tagToReader;
	uint32_t parityBits;
	uint8_t len;
	uint8_t *frame;
	uint32_t EndOfTransmissionTimestamp = 0;


	for( i=0; i < 1900;)
	{
		//First 32 bits contain
		// isResponse (1 bit)
		// timestamp (remaining)
		//Then paritybits
		//Then length
		timestamp = *((uint32_t *)(got+i));
		parityBits = *((uint32_t *)(got+i+4));
		len = got[i+8];
		frame = (got+i+9);
		uint32_t next_timestamp = (*((uint32_t *)(got+i+9))) & 0x7fffffff;

		tagToReader = timestamp & 0x80000000;
		timestamp &= 0x7fffffff;

		if(i==0) {
			first_timestamp = timestamp;
		}

		// Break and stick with current result if buffer was not completely full
		if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;

		char line[1000] = "";

		if(len)//We have some data to display
		{
			int j,oddparity;

			for(j = 0; j < len ; j++)
			{
				oddparity = 0x01 ^ xorbits_8(frame[j] & 0xFF);

				if (tagToReader && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
					sprintf(line+(j*4), "%02x!  ", frame[j]);
				} else {
					sprintf(line+(j*4), "%02x   ", frame[j]);
				}
			}
		}else
		{
			if (ShowWaitCycles) {
				sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
			}
		}

		char *crc = "";

		if(len > 2)
		{
			uint8_t b1, b2;
			if(!tagToReader && len == 4) {
				// Rough guess that this is a command from the reader
				// For iClass the command byte is not part of the CRC
					ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
			}
			else {
				  // For other data.. CRC might not be applicable (UPDATE commands etc.)
				ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
			}

			if (b1 != frame[len-2] || b2 != frame[len-1]) {
				crc = (tagToReader & (len < 8)) ? "" : " !crc";
			}
		}

		i += (len + 9);
		EndOfTransmissionTimestamp = (*((uint32_t *)(got+i))) & 0x7fffffff;

		// Not implemented for iclass on the ARM-side
		//if (!ShowWaitCycles) i += 9;

		PrintAndLog(" %9d | %9d | %s | %s %s",
			(timestamp - first_timestamp),
			(EndOfTransmissionTimestamp - first_timestamp),
			(len?(tagToReader ? "Tag" : "Rdr"):"   "),
			line, crc);
	}
	return 0;
}

int CmdHFiClassListOld(const char *Cmd)
{
  uint8_t got[1920];
  GetFromBigBuf(got,sizeof(got),0);

  PrintAndLog("recorded activity:");
  PrintAndLog(" ETU     :rssi: who bytes");
  PrintAndLog("---------+----+----+-----------");

  int i = 0;
  int prev = -1;

  for (;;) {
    if(i >= 1900) {
      break;
    }

    bool isResponse;
    int timestamp = *((uint32_t *)(got+i));
    if (timestamp & 0x80000000) {
      timestamp &= 0x7fffffff;
      isResponse = 1;
    } else {
      isResponse = 0;
    }


    int metric = 0;

    int parityBits = *((uint32_t *)(got+i+4));
    // 4 bytes of additional information...
    // maximum of 32 additional parity bit information
    //
    // TODO:
    // at each quarter bit period we can send power level (16 levels)
    // or each half bit period in 256 levels.


    int len = got[i+8];

    if (len > 100) {
      break;
    }
    if (i + len >= 1900) {
      break;
    }

    uint8_t *frame = (got+i+9);

    // Break and stick with current result if buffer was not completely full
    if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }

    char line[1000] = "";
    int j;
    for (j = 0; j < len; j++) {
      int oddparity = 0x01;
      int k;

      for (k=0;k<8;k++) {
        oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
      }

      //if((parityBits >> (len - j - 1)) & 0x01) {
      if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
        sprintf(line+(j*4), "%02x!  ", frame[j]);
      }
      else {
        sprintf(line+(j*4), "%02x   ", frame[j]);
      }
    }

    char *crc;
    crc = "";
    if (len > 2) {
      uint8_t b1, b2;
      for (j = 0; j < (len - 1); j++) {
        // gives problems... search for the reason..
        /*if(frame[j] == 0xAA) {
          switch(frame[j+1]) {
            case 0x01:
              crc = "[1] Two drops close after each other";
            break;
            case 0x02:
              crc = "[2] Potential SOC with a drop in second half of bitperiod";
              break;
            case 0x03:
              crc = "[3] Segment Z after segment X is not possible";
              break;
            case 0x04:
              crc = "[4] Parity bit of a fully received byte was wrong";
              break;
            default:
              crc = "[?] Unknown error";
              break;
          }
          break;
        }*/
      }

      if (strlen(crc)==0) {
	if(!isResponse && len == 4) {
		// Rough guess that this is a command from the reader
		// For iClass the command byte is not part of the CRC
	        ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
	}
	else {
		// For other data.. CRC might not be applicable (UPDATE commands etc.)
	        ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
	}
	//printf("%1x %1x",(unsigned)b1,(unsigned)b2);
        if (b1 != frame[len-2] || b2 != frame[len-1]) {
          crc = (isResponse & (len < 8)) ? "" : " !crc";
        } else {
          crc = "";
        }
      }
    } else {
      crc = ""; // SHORT
    }

    char metricString[100];
    if (isResponse) {
      sprintf(metricString, "%3d", metric);
    } else {
      strcpy(metricString, "   ");
    }

    PrintAndLog(" +%7d: %s: %s %s %s",
      (prev < 0 ? 0 : (timestamp - prev)),
      metricString,
      (isResponse ? "TAG" : "   "), line, crc);

    prev = timestamp;
    i += (len + 9);
  }
  return 0;
}

int CmdHFiClassSnoop(const char *Cmd)
{
  UsbCommand c = {CMD_SNOOP_ICLASS};
  SendCommand(&c);
  return 0;
}

int CmdHFiClassSim(const char *Cmd)
{
  uint8_t simType = 0;
  uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  if (strlen(Cmd)<1) {
	PrintAndLog("Usage:  hf iclass sim [0 <CSN>] | x");
	PrintAndLog("        options");
	PrintAndLog("                0 <CSN> simulate the given CSN");
	PrintAndLog("                1       simulate default CSN");
	PrintAndLog("                2       iterate CSNs, gather MACs");
	PrintAndLog("        sample: hf iclass sim 0 031FEC8AF7FF12E0");
	PrintAndLog("        sample: hf iclass sim 2");
	return 0;
  }	

  simType = param_get8(Cmd, 0);

  if(simType == 0)
  {
	  if (param_gethex(Cmd, 1, CSN, 16)) {
		  PrintAndLog("A CSN should consist of 16 HEX symbols");
		  return 1;
	  }
	  PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));

  }
  if(simType > 2)
  {
	  PrintAndLog("Undefined simptype %d", simType);
	  return 1;
  }
  uint8_t numberOfCSNs=0;

	if(simType == 2)
	{
		UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,63}};
		UsbCommand resp = {0};

		uint8_t csns[64] = {
			 0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,
			 0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,
			 0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,
			 0x17,0x12,0x01,0xfd,0xf7,0xff,0x12,0xe0 ,
			 0xcd,0x56,0x01,0x7c,0x6f,0xff,0x12,0xe0 ,
			 0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,
			 0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,
			 0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };

		memcpy(c.d.asBytes, csns, 64);

		SendCommand(&c);
		if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
			PrintAndLog("Command timed out");
			return 0;
		}

		uint8_t num_mac_responses  = resp.arg[1];
		PrintAndLog("Mac responses: %d MACs obtained (should be 8)", num_mac_responses);

		size_t datalen = 8*24;
		/*
		 * Now, time to dump to file. We'll use this format:
		 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
		 * So, it should wind up as
		 * 8 * 24 bytes.
		 *
		 * The returndata from the pm3 is on the following format
		 * <4 byte NR><4 byte MAC>
		 * CC are all zeroes, CSN is the same as was sent in
		 **/
		void* dump = malloc(datalen);
		memset(dump,0,datalen);//<-- Need zeroes for the CC-field
		uint8_t i = 0;
		for(i = 0 ; i < 8 ; i++)
		{
			memcpy(dump+i*24, csns+i*8,8); //CSN
			//8 zero bytes here...
			//Then comes NR_MAC (eight bytes from the response)
			memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);

		}
		/** Now, save to dumpfile **/
		saveFile("iclass_mac_attack", "bin", dump,datalen);
		free(dump);
	}else
	{
		UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
		memcpy(c.d.asBytes, CSN, 8);
		SendCommand(&c);
	}

  return 0;
}

int CmdHFiClassReader(const char *Cmd)
{
  UsbCommand c = {CMD_READER_ICLASS, {0}};
  SendCommand(&c);
    UsbCommand resp;
  while(!ukbhit()){
      if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
            uint8_t isOK    = resp.arg[0] & 0xff;
            uint8_t * data  = resp.d.asBytes;

            PrintAndLog("isOk:%02x", isOK);

            if(isOK > 0)
            {
                PrintAndLog("CSN: %s",sprint_hex(data,8));
            }
            if(isOK >= 1)
            {
                PrintAndLog("CC: %s",sprint_hex(data+8,8));
            }else{
                PrintAndLog("No CC obtained");
            }
        } else {
            PrintAndLog("Command execute timeout");
        }
    }

  return 0;
}

int CmdHFiClassReader_Replay(const char *Cmd)
{
  uint8_t readerType = 0;
  uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};

  if (strlen(Cmd)<1) {
    PrintAndLog("Usage:  hf iclass replay <MAC>");
    PrintAndLog("        sample: hf iclass replay 00112233");
	return 0;
  }	

  if (param_gethex(Cmd, 0, MAC, 8)) {
    PrintAndLog("MAC must include 8 HEX symbols");
    return 1;
  }

  UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
  memcpy(c.d.asBytes, MAC, 4);
  SendCommand(&c);

  return 0;
}

int CmdHFiClassReader_Dump(const char *Cmd)
{
  uint8_t readerType = 0;
  uint8_t MAC[4]={0x00,0x00,0x00,0x00};
  uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  //uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t keytable[128] = {0};
  int elite = 0;
  uint8_t *used_key;
  int i;
  if (strlen(Cmd)<1) 
  {
    PrintAndLog("Usage:  hf iclass dump <Key> [e]");
    PrintAndLog("        Key    - A 16 byte master key");
    PrintAndLog("        e      - If 'e' is specified, the key is interpreted as the 16 byte");
    PrintAndLog("                 Custom Key (KCus), which can be obtained via reader-attack");
    PrintAndLog("                 See 'hf iclass sim 2'. This key should be on iclass-format");
    PrintAndLog("        sample: hf iclass dump 0011223344556677");


    return 0;
  }

  if (param_gethex(Cmd, 0, KEY, 16)) {
    PrintAndLog("KEY must include 16 HEX symbols");
    return 1;
  }
  
  if (param_getchar(Cmd, 1) == 'e')
  {
    PrintAndLog("Elite switch on");
    elite = 1;

    //calc h2
    hash2(KEY, keytable);
    printarr_human_readable("keytable", keytable, 128);

  }


  UsbCommand c = {CMD_READER_ICLASS, {0}};
  c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE;

  SendCommand(&c);
  
  UsbCommand resp;

  if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
        uint8_t isOK    = resp.arg[0] & 0xff;
        uint8_t * data  = resp.d.asBytes;

        memcpy(CSN,data,8);
        memcpy(CCNR,data+8,8);

        PrintAndLog("isOk:%02x", isOK);

        if(isOK > 0)
        {
            PrintAndLog("CSN: %s",sprint_hex(CSN,8));
        }
        if(isOK > 1)
        {
            if(elite)
            {
                uint8_t key_sel[8] = {0};
                uint8_t key_sel_p[8] = { 0 };
                //Get the key index (hash1)
                uint8_t key_index[8] = {0};

                hash1(CSN, key_index);
                printvar("hash1", key_index,8);
                for(i = 0; i < 8 ; i++)
                    key_sel[i] = keytable[key_index[i]] & 0xFF;
                printvar("k_sel", key_sel,8);
                //Permute from iclass format to standard format
                permutekey_rev(key_sel,key_sel_p);
                used_key = key_sel_p;
            }else{
                //Perhaps this should also be permuted to std format?
                // Something like the code below? I have no std system
                // to test this with /Martin

                //uint8_t key_sel_p[8] = { 0 };
                //permutekey_rev(KEY,key_sel_p);
                //used_key = key_sel_p;

                used_key = KEY;

            }
            printvar("Used key",used_key,8);
            diversifyKey(CSN,used_key, div_key);
            printvar("Div key", div_key, 8);
            printvar("CC_NR:",CCNR,12);
            doMAC(CCNR,12,div_key, MAC);
            printvar("MAC", MAC, 4);

            UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
            memcpy(d.d.asBytes, MAC, 4);
            SendCommand(&d);

        }else{
            PrintAndLog("Failed to obtain CC! Aborting");
        }
    } else {
        PrintAndLog("Command execute timeout");
    }

  return 0;
}

int CmdHFiClass_iso14443A_write(const char *Cmd)
{
  uint8_t readerType = 0;
  uint8_t MAC[4]={0x00,0x00,0x00,0x00};
  uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

  uint8_t blockNo=0;
  uint8_t bldata[8]={0};

  if (strlen(Cmd)<3) 
  {
    PrintAndLog("Usage:  hf iclass write <Key> <Block> <Data>");
    PrintAndLog("        sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
    return 0;
  }

  if (param_gethex(Cmd, 0, KEY, 16)) 
  {
    PrintAndLog("KEY must include 16 HEX symbols");
    return 1;
  }
  
  blockNo = param_get8(Cmd, 1);
  if (blockNo>32)
  {
        PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
    return 1;
  }
  if (param_gethex(Cmd, 2, bldata, 8)) 
  {
        PrintAndLog("Block data must include 8 HEX symbols");
        return 1;
  }
  
  UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};
  SendCommand(&c);
  UsbCommand resp;

  if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
    uint8_t isOK    = resp.arg[0] & 0xff;
    uint8_t * data  = resp.d.asBytes;
    
    memcpy(CSN,data,8);
    memcpy(CCNR,data+8,8);
    PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
    PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
	PrintAndLog("isOk:%02x", isOK);
  } else {
	PrintAndLog("Command execute timeout");
  }

  diversifyKey(CSN,KEY, div_key);

  PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
  doMAC(CCNR, 12,div_key, MAC);

  UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
  memcpy(c2.d.asBytes, bldata, 8);
  memcpy(c2.d.asBytes+8, MAC, 4);
  SendCommand(&c2);

  if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
    uint8_t isOK    = resp.arg[0] & 0xff;
    uint8_t * data  = resp.d.asBytes;

    if (isOK)
      PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
    else
      PrintAndLog("isOk:%02x", isOK);
  } else {
      PrintAndLog("Command execute timeout");
  }
  return 0;
}


static command_t CommandTable[] = 
{
  {"help",    CmdHelp,        1, "This help"},
  {"list",    CmdHFiClassList,   0, "List iClass history"},
  {"snoop",   CmdHFiClassSnoop,  0, "Eavesdrop iClass communication"},
  {"sim",     CmdHFiClassSim,    0, "Simulate iClass tag"},
  {"reader",  CmdHFiClassReader, 0, "Read an iClass tag"},
  {"replay",  CmdHFiClassReader_Replay, 0, "Read an iClass tag via Reply Attack"},
  {"dump",	  CmdHFiClassReader_Dump, 0, "Authenticate and Dump iClass tag"},
  {"write",	CmdHFiClass_iso14443A_write,	0,	"Authenticate and Write iClass block"},
  {NULL, NULL, 0, NULL}
};

int CmdHFiClass(const char *Cmd)
{
  CmdsParse(CommandTable, Cmd);
  return 0;
}

int CmdHelp(const char *Cmd)
{
  CmdsHelp(CommandTable);
	return 0;
}
Commit	Line	Data
cee5a30d	1	//-----------------------------------------------------------------------------
	2	// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
	3	// Copyright (C) 2011 Gerhard de Koning Gans
f38a1528	4	// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d	5	//
	6	// This code is licensed to you under the terms of the GNU GPL, version 2 or,
	7	// at your option, any later version. See the LICENSE.txt file for the text of
	8	// the license.
	9	//-----------------------------------------------------------------------------
	10	// High frequency iClass commands
	11	//-----------------------------------------------------------------------------
	12
	13	#include <stdio.h>
	14	#include <stdlib.h>
	15	#include <string.h>
9f6e9d15	16	#include <sys/stat.h>
cee5a30d	17	#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
cee5a30d	18	#include "data.h"
902cb3c0	19	#include "proxmark3.h"
cee5a30d	20	#include "ui.h"
	21	#include "cmdparser.h"
	22	#include "cmdhficlass.h"
f38a1528	23	#include "../include/common.h"
14006804	24	#include "util.h"
17cba269	25	#include "cmdmain.h"
f38a1528	26	#include "loclass/des.h"
	27	#include "loclass/cipherutils.h"
	28	#include "loclass/cipher.h"
	29	#include "loclass/ikeys.h"
	30	#include "loclass/elite_crack.h"
	31	#include "loclass/fileutils.h"
cee5a30d	32
	33	static int CmdHelp(const char *Cmd);
	34
17cba269 MHS	35	int xorbits_8(uint8_t val)
	36	{
	37	uint8_t res = val ^ (val >> 1); //1st pass
	38	res = res ^ (res >> 1); // 2nd pass
	39	res = res ^ (res >> 2); // 3rd pass
	40	res = res ^ (res >> 4); // 4th pass
	41	return res & 1;
	42	}
	43
cee5a30d	44	int CmdHFiClassList(const char *Cmd)
17cba269 MHS	45	{
	46
	47	bool ShowWaitCycles = false;
	48	char param = param_getchar(Cmd, 0);
	49
	50	if (param != 0) {
	51	PrintAndLog("List data in trace buffer.");
	52	PrintAndLog("Usage: hf iclass list");
	53	PrintAndLog("h - help");
	54	PrintAndLog("sample: hf iclass list");
	55	return 0;
	56	}
	57
	58	uint8_t got[1920];
	59	GetFromBigBuf(got,sizeof(got),0);
	60	WaitForResponse(CMD_ACK,NULL);
	61
	62	PrintAndLog("Recorded Activity");
	63	PrintAndLog("");
	64	PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
	65	PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
	66	PrintAndLog("");
	67	PrintAndLog(" Start \| End \| Src \| Data");
	68	PrintAndLog("-----------\|-----------\|-----\|--------");
	69
	70	int i;
	71	uint32_t first_timestamp = 0;
	72	uint32_t timestamp;
	73	bool tagToReader;
	74	uint32_t parityBits;
	75	uint8_t len;
	76	uint8_t *frame;
	77	uint32_t EndOfTransmissionTimestamp = 0;
	78
17cba269 MHS	79
	80	for( i=0; i < 1900;)
	81	{
	82	//First 32 bits contain
	83	// isResponse (1 bit)
	84	// timestamp (remaining)
	85	//Then paritybits
	86	//Then length
	87	timestamp = ((uint32_t )(got+i));
	88	parityBits = ((uint32_t )(got+i+4));
	89	len = got[i+8];
	90	frame = (got+i+9);
	91	uint32_t next_timestamp = (((uint32_t )(got+i+9))) & 0x7fffffff;
	92
	93	tagToReader = timestamp & 0x80000000;
	94	timestamp &= 0x7fffffff;
	95
	96	if(i==0) {
	97	first_timestamp = timestamp;
	98	}
	99
f83cc126 MHS	100	// Break and stick with current result if buffer was not completely full
f83cc126 MHS	101	if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;
17cba269 MHS	102
	103	char line[1000] = "";
	104
	105	if(len)//We have some data to display
	106	{
	107	int j,oddparity;
	108
	109	for(j = 0; j < len ; j++)
	110	{
	111	oddparity = 0x01 ^ xorbits_8(frame[j] & 0xFF);
	112
	113	if (tagToReader && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
	114	sprintf(line+(j*4), "%02x! ", frame[j]);
	115	} else {
	116	sprintf(line+(j*4), "%02x ", frame[j]);
	117	}
	118	}
	119	}else
	120	{
	121	if (ShowWaitCycles) {
	122	sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
	123	}
	124	}
	125
	126	char *crc = "";
	127
	128	if(len > 2)
	129	{
	130	uint8_t b1, b2;
	131	if(!tagToReader && len == 4) {
	132	// Rough guess that this is a command from the reader
	133	// For iClass the command byte is not part of the CRC
	134	ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
	135	}
	136	else {
	137	// For other data.. CRC might not be applicable (UPDATE commands etc.)
	138	ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
	139	}
	140
	141	if (b1 != frame[len-2] \|\| b2 != frame[len-1]) {
	142	crc = (tagToReader & (len < 8)) ? "" : " !crc";
	143	}
	144	}
	145
	146	i += (len + 9);
	147	EndOfTransmissionTimestamp = (((uint32_t )(got+i))) & 0x7fffffff;
	148
	149	// Not implemented for iclass on the ARM-side
	150	//if (!ShowWaitCycles) i += 9;
	151
	152	PrintAndLog(" %9d \| %9d \| %s \| %s %s",
	153	(timestamp - first_timestamp),
	154	(EndOfTransmissionTimestamp - first_timestamp),
	155	(len?(tagToReader ? "Tag" : "Rdr"):" "),
	156	line, crc);
	157	}
	158	return 0;
	159	}
	160
	161	int CmdHFiClassListOld(const char *Cmd)
cee5a30d	162	{
cee5a30d	163	uint8_t got[1920];
db09cb3a	164	GetFromBigBuf(got,sizeof(got),0);
cee5a30d	165
	166	PrintAndLog("recorded activity:");
	167	PrintAndLog(" ETU :rssi: who bytes");
	168	PrintAndLog("---------+----+----+-----------");
	169
	170	int i = 0;
	171	int prev = -1;
	172
	173	for (;;) {
	174	if(i >= 1900) {
	175	break;
	176	}
	177
	178	bool isResponse;
	179	int timestamp = ((uint32_t )(got+i));
	180	if (timestamp & 0x80000000) {
	181	timestamp &= 0x7fffffff;
	182	isResponse = 1;
	183	} else {
	184	isResponse = 0;
	185	}
	186
17cba269	187
cee5a30d	188	int metric = 0;
17cba269	189
cee5a30d	190	int parityBits = ((uint32_t )(got+i+4));
	191	// 4 bytes of additional information...
	192	// maximum of 32 additional parity bit information
	193	//
	194	// TODO:
	195	// at each quarter bit period we can send power level (16 levels)
	196	// or each half bit period in 256 levels.
	197
	198
	199	int len = got[i+8];
	200
	201	if (len > 100) {
	202	break;
	203	}
	204	if (i + len >= 1900) {
	205	break;
	206	}
	207
	208	uint8_t *frame = (got+i+9);
	209
	210	// Break and stick with current result if buffer was not completely full
	211	if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }
	212
	213	char line[1000] = "";
	214	int j;
	215	for (j = 0; j < len; j++) {
	216	int oddparity = 0x01;
	217	int k;
	218
	219	for (k=0;k<8;k++) {
	220	oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
	221	}
	222
	223	//if((parityBits >> (len - j - 1)) & 0x01) {
	224	if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
	225	sprintf(line+(j*4), "%02x! ", frame[j]);
	226	}
	227	else {
	228	sprintf(line+(j*4), "%02x ", frame[j]);
	229	}
	230	}
	231
	232	char *crc;
	233	crc = "";
	234	if (len > 2) {
	235	uint8_t b1, b2;
	236	for (j = 0; j < (len - 1); j++) {
	237	// gives problems... search for the reason..
	238	/*if(frame[j] == 0xAA) {
	239	switch(frame[j+1]) {
	240	case 0x01:
	241	crc = "[1] Two drops close after each other";
	242	break;
	243	case 0x02:
	244	crc = "[2] Potential SOC with a drop in second half of bitperiod";
	245	break;
	246	case 0x03:
	247	crc = "[3] Segment Z after segment X is not possible";
	248	break;
	249	case 0x04:
	250	crc = "[4] Parity bit of a fully received byte was wrong";
	251	break;
	252	default:
	253	crc = "[?] Unknown error";
254	break;
255	}
256	break;
257	}*/
258	}
259
260	if (strlen(crc)==0) {
261	if(!isResponse && len == 4) {
262	// Rough guess that this is a command from the reader
263	// For iClass the command byte is not part of the CRC
264	ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
265	}
266	else {
267	// For other data.. CRC might not be applicable (UPDATE commands etc.)
268	ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
269	}
270	//printf("%1x %1x",(unsigned)b1,(unsigned)b2);
271	if (b1 != frame[len-2] \|\| b2 != frame[len-1]) {
272	crc = (isResponse & (len < 8)) ? "" : " !crc";
273	} else {
274	crc = "";
275	}
276	}
277	} else {
278	crc = ""; // SHORT
279	}
280
281	char metricString[100];
282	if (isResponse) {
283	sprintf(metricString, "%3d", metric);
284	} else {
285	strcpy(metricString, " ");
286	}
287
288	PrintAndLog(" +%7d: %s: %s %s %s",
289	(prev < 0 ? 0 : (timestamp - prev)),
290	metricString,
291	(isResponse ? "TAG" : " "), line, crc);
292
293	prev = timestamp;
294	i += (len + 9);
295	}
296	return 0;
297	}
298
cee5a30d	299	int CmdHFiClassSnoop(const char *Cmd)
	300	{
	301	UsbCommand c = {CMD_SNOOP_ICLASS};
	302	SendCommand(&c);
	303	return 0;
	304	}
	305
1e262141	306	int CmdHFiClassSim(const char *Cmd)
	307	{
	308	uint8_t simType = 0;
	309	uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
	310
17cba269 MHS	311	if (strlen(Cmd)<1) {
	312	PrintAndLog("Usage: hf iclass sim [0 <CSN>] \| x");
	313	PrintAndLog(" options");
	314	PrintAndLog(" 0 <CSN> simulate the given CSN");
	315	PrintAndLog(" 1 simulate default CSN");
	316	PrintAndLog(" 2 iterate CSNs, gather MACs");
1e262141	317	PrintAndLog(" sample: hf iclass sim 0 031FEC8AF7FF12E0");
17cba269	318	PrintAndLog(" sample: hf iclass sim 2");
1e262141	319	return 0;
	320	}
	321
	322	simType = param_get8(Cmd, 0);
17cba269 MHS	323
	324	if(simType == 0)
	325	{
	326	if (param_gethex(Cmd, 1, CSN, 16)) {
	327	PrintAndLog("A CSN should consist of 16 HEX symbols");
	328	return 1;
	329	}
	330	PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
	331
	332	}
77abe781	333	if(simType > 2)
17cba269 MHS	334	{
	335	PrintAndLog("Undefined simptype %d", simType);
	336	return 1;
1e262141	337	}
17cba269	338	uint8_t numberOfCSNs=0;
1e262141	339
9f6e9d15 MHS	340	if(simType == 2)
	341	{
	342	UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,63}};
	343	UsbCommand resp = {0};
17cba269	344
77abe781 MHS	345	uint8_t csns[64] = {
	346	0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,
	347	0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,
	348	0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,
	349	0x17,0x12,0x01,0xfd,0xf7,0xff,0x12,0xe0 ,
	350	0xcd,0x56,0x01,0x7c,0x6f,0xff,0x12,0xe0 ,
	351	0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,
	352	0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,
	353	0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };
	354
	355	memcpy(c.d.asBytes, csns, 64);
9f6e9d15 MHS	356
	357	SendCommand(&c);
	358	if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
	359	PrintAndLog("Command timed out");
	360	return 0;
	361	}
1e262141	362
77abe781 MHS	363	uint8_t num_mac_responses = resp.arg[1];
77abe781 MHS	364	PrintAndLog("Mac responses: %d MACs obtained (should be 8)", num_mac_responses);
9f6e9d15	365
77abe781	366	size_t datalen = 8*24;
9f6e9d15 MHS	367	/*
9f6e9d15 MHS	368	* Now, time to dump to file. We'll use this format:
77abe781	369	* <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15	370	* So, it should wind up as
77abe781 MHS	371	* 8 * 24 bytes.
	372	*
	373	* The returndata from the pm3 is on the following format
	374	* <4 byte NR><4 byte MAC>
	375	* CC are all zeroes, CSN is the same as was sent in
9f6e9d15	376	**/
77abe781 MHS	377	void* dump = malloc(datalen);
77abe781 MHS	378	memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15	379	uint8_t i = 0;
77abe781	380	for(i = 0 ; i < 8 ; i++)
9f6e9d15	381	{
77abe781 MHS	382	memcpy(dump+i24, csns+i8,8); //CSN
	383	//8 zero bytes here...
	384	//Then comes NR_MAC (eight bytes from the response)
	385	memcpy(dump+i24+16,resp.d.asBytes+i8,8);
1e262141	386
9f6e9d15 MHS	387	}
9f6e9d15 MHS	388	/ Now, save to dumpfile /
77abe781 MHS	389	saveFile("iclass_mac_attack", "bin", dump,datalen);
77abe781 MHS	390	free(dump);
9f6e9d15 MHS	391	}else
	392	{
	393	UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
	394	memcpy(c.d.asBytes, CSN, 8);
	395	SendCommand(&c);
	396	}
f38a1528	397
1e262141	398	return 0;
	399	}
	400
	401	int CmdHFiClassReader(const char *Cmd)
f38a1528	402	{
	403	UsbCommand c = {CMD_READER_ICLASS, {0}};
	404	SendCommand(&c);
	405	UsbCommand resp;
	406	while(!ukbhit()){
	407	if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
	408	uint8_t isOK = resp.arg[0] & 0xff;
	409	uint8_t * data = resp.d.asBytes;
	410
	411	PrintAndLog("isOk:%02x", isOK);
	412
	413	if(isOK > 0)
	414	{
	415	PrintAndLog("CSN: %s",sprint_hex(data,8));
	416	}
	417	if(isOK >= 1)
	418	{
	419	PrintAndLog("CC: %s",sprint_hex(data+8,8));
	420	}else{
	421	PrintAndLog("No CC obtained");
	422	}
	423	} else {
	424	PrintAndLog("Command execute timeout");
	425	}
	426	}
	427
	428	return 0;
	429	}
	430
	431	int CmdHFiClassReader_Replay(const char *Cmd)
1e262141	432	{
1e262141	433	uint8_t readerType = 0;
f38a1528	434	uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
1e262141	435
1e262141	436	if (strlen(Cmd)<1) {
f38a1528	437	PrintAndLog("Usage: hf iclass replay <MAC>");
f38a1528	438	PrintAndLog(" sample: hf iclass replay 00112233");
1e262141	439	return 0;
	440	}
	441
f38a1528	442	if (param_gethex(Cmd, 0, MAC, 8)) {
	443	PrintAndLog("MAC must include 8 HEX symbols");
	444	return 1;
	445	}
	446
	447	UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
	448	memcpy(c.d.asBytes, MAC, 4);
	449	SendCommand(&c);
	450
	451	return 0;
	452	}
	453
	454	int CmdHFiClassReader_Dump(const char *Cmd)
	455	{
	456	uint8_t readerType = 0;
	457	uint8_t MAC[4]={0x00,0x00,0x00,0x00};
	458	uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	459	uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	460	uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	461	//uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	462	uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	463	uint8_t keytable[128] = {0};
	464	int elite = 0;
	465	uint8_t *used_key;
	466	int i;
	467	if (strlen(Cmd)<1)
	468	{
	469	PrintAndLog("Usage: hf iclass dump <Key> [e]");
	470	PrintAndLog(" Key - A 16 byte master key");
	471	PrintAndLog(" e - If 'e' is specified, the key is interpreted as the 16 byte");
	472	PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
	473	PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
	474	PrintAndLog(" sample: hf iclass dump 0011223344556677");
	475
	476
	477	return 0;
	478	}
	479
	480	if (param_gethex(Cmd, 0, KEY, 16)) {
	481	PrintAndLog("KEY must include 16 HEX symbols");
	482	return 1;
	483	}
	484
	485	if (param_getchar(Cmd, 1) == 'e')
	486	{
	487	PrintAndLog("Elite switch on");
	488	elite = 1;
	489
	490	//calc h2
	491	hash2(KEY, keytable);
	492	printarr_human_readable("keytable", keytable, 128);
	493
	494	}
	495
	496
	497	UsbCommand c = {CMD_READER_ICLASS, {0}};
	498	c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE;
1e262141	499
1e262141	500	SendCommand(&c);
f38a1528	501
	502	UsbCommand resp;
	503
	504	if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
	505	uint8_t isOK = resp.arg[0] & 0xff;
	506	uint8_t * data = resp.d.asBytes;
	507
	508	memcpy(CSN,data,8);
	509	memcpy(CCNR,data+8,8);
	510
	511	PrintAndLog("isOk:%02x", isOK);
	512
	513	if(isOK > 0)
	514	{
	515	PrintAndLog("CSN: %s",sprint_hex(CSN,8));
	516	}
	517	if(isOK > 1)
	518	{
	519	if(elite)
	520	{
	521	uint8_t key_sel[8] = {0};
	522	uint8_t key_sel_p[8] = { 0 };
	523	//Get the key index (hash1)
	524	uint8_t key_index[8] = {0};
	525
	526	hash1(CSN, key_index);
	527	printvar("hash1", key_index,8);
	528	for(i = 0; i < 8 ; i++)
	529	key_sel[i] = keytable[key_index[i]] & 0xFF;
	530	printvar("k_sel", key_sel,8);
	531	//Permute from iclass format to standard format
	532	permutekey_rev(key_sel,key_sel_p);
	533	used_key = key_sel_p;
	534	}else{
	535	//Perhaps this should also be permuted to std format?
	536	// Something like the code below? I have no std system
	537	// to test this with /Martin
	538
	539	//uint8_t key_sel_p[8] = { 0 };
	540	//permutekey_rev(KEY,key_sel_p);
	541	//used_key = key_sel_p;
	542
	543	used_key = KEY;
	544
	545	}
	546	printvar("Used key",used_key,8);
	547	diversifyKey(CSN,used_key, div_key);
	548	printvar("Div key", div_key, 8);
	549	printvar("CC_NR:",CCNR,12);
	550	doMAC(CCNR,12,div_key, MAC);
	551	printvar("MAC", MAC, 4);
	552
	553	UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
	554	memcpy(d.d.asBytes, MAC, 4);
	555	SendCommand(&d);
	556
	557	}else{
	558	PrintAndLog("Failed to obtain CC! Aborting");
	559	}
	560	} else {
	561	PrintAndLog("Command execute timeout");
	562	}
	563
	564	return 0;
565	}
1e262141	566
f38a1528	567	int CmdHFiClass_iso14443A_write(const char *Cmd)
	568	{
	569	uint8_t readerType = 0;
	570	uint8_t MAC[4]={0x00,0x00,0x00,0x00};
	571	uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	572	uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	573	uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	574	uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	575
	576	uint8_t blockNo=0;
	577	uint8_t bldata[8]={0};
	578
	579	if (strlen(Cmd)<3)
	580	{
	581	PrintAndLog("Usage: hf iclass write <Key> <Block> <Data>");
	582	PrintAndLog(" sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
	583	return 0;
	584	}
	585
	586	if (param_gethex(Cmd, 0, KEY, 16))
	587	{
	588	PrintAndLog("KEY must include 16 HEX symbols");
	589	return 1;
	590	}
	591
	592	blockNo = param_get8(Cmd, 1);
	593	if (blockNo>32)
	594	{
	595	PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
	596	return 1;
	597	}
	598	if (param_gethex(Cmd, 2, bldata, 8))
	599	{
	600	PrintAndLog("Block data must include 8 HEX symbols");
	601	return 1;
	602	}
	603
	604	UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};
	605	SendCommand(&c);
	606	UsbCommand resp;
	607
	608	if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
	609	uint8_t isOK = resp.arg[0] & 0xff;
	610	uint8_t * data = resp.d.asBytes;
	611
	612	memcpy(CSN,data,8);
	613	memcpy(CCNR,data+8,8);
	614	PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
	615	PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
1e262141	616	PrintAndLog("isOk:%02x", isOK);
	617	} else {
	618	PrintAndLog("Command execute timeout");
f38a1528	619	}
	620
	621	diversifyKey(CSN,KEY, div_key);
	622
	623	PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
	624	doMAC(CCNR, 12,div_key, MAC);
	625
	626	UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
	627	memcpy(c2.d.asBytes, bldata, 8);
	628	memcpy(c2.d.asBytes+8, MAC, 4);
	629	SendCommand(&c2);
	630
	631	if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
	632	uint8_t isOK = resp.arg[0] & 0xff;
	633	uint8_t * data = resp.d.asBytes;
1e262141	634
f38a1528	635	if (isOK)
	636	PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
	637	else
	638	PrintAndLog("isOk:%02x", isOK);
	639	} else {
	640	PrintAndLog("Command execute timeout");
	641	}
1e262141	642	return 0;
	643	}
	644
f38a1528	645
cee5a30d	646	static command_t CommandTable[] =
	647	{
	648	{"help", CmdHelp, 1, "This help"},
	649	{"list", CmdHFiClassList, 0, "List iClass history"},
	650	{"snoop", CmdHFiClassSnoop, 0, "Eavesdrop iClass communication"},
1e262141	651	{"sim", CmdHFiClassSim, 0, "Simulate iClass tag"},
1e262141	652	{"reader", CmdHFiClassReader, 0, "Read an iClass tag"},
f38a1528	653	{"replay", CmdHFiClassReader_Replay, 0, "Read an iClass tag via Reply Attack"},
	654	{"dump", CmdHFiClassReader_Dump, 0, "Authenticate and Dump iClass tag"},
	655	{"write", CmdHFiClass_iso14443A_write, 0, "Authenticate and Write iClass block"},
cee5a30d	656	{NULL, NULL, 0, NULL}
	657	};
	658
	659	int CmdHFiClass(const char *Cmd)
	660	{
	661	CmdsParse(CommandTable, Cmd);
	662	return 0;
	663	}
	664
	665	int CmdHelp(const char *Cmd)
	666	{
	667	CmdsHelp(CommandTable);
9f6e9d15 MHS	668	return 0;
9f6e9d15 MHS	669	}