]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhficlass.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
fixed warning about size_t
[proxmark3-svn] / client / cmdhficlass.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3 // Copyright (C) 2011 Gerhard de Koning Gans
4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // High frequency iClass commands
11 //-----------------------------------------------------------------------------
12
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <sys/stat.h>
17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18 #include "data.h"
19 #include "proxmark3.h"
20 #include "ui.h"
21 #include "cmdparser.h"
22 #include "cmdhficlass.h"
23 #include "common.h"
24 #include "util.h"
25 #include "cmdmain.h"
26 #include "loclass/des.h"
27 #include "loclass/cipherutils.h"
28 #include "loclass/cipher.h"
29 #include "loclass/ikeys.h"
30 #include "loclass/elite_crack.h"
31 #include "loclass/fileutils.h"
32 #include "protocols.h"
33 #include "usb_cmd.h"
34 #include "cmdhfmfu.h"
35 #include "cmdhf.h"
36
37 static int CmdHelp(const char *Cmd);
38
39 #define ICLASS_KEYS_MAX 8
40 static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
41 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
49 };
50
51 typedef struct iclass_block {
52 uint8_t d[8];
53 } iclass_block_t;
54
55 int xorbits_8(uint8_t val) {
56 uint8_t res = val ^ (val >> 1); //1st pass
57 res = res ^ (res >> 1); // 2nd pass
58 res = res ^ (res >> 2); // 3rd pass
59 res = res ^ (res >> 4); // 4th pass
60 return res & 1;
61 }
62
63 int CmdHFiClassList(const char *Cmd) {
64 //PrintAndLog("Deprecated command, use 'hf list iclass' instead");
65 CmdHFList("iclass");
66 return 0;
67 }
68
69 int CmdHFiClassSnoop(const char *Cmd) {
70 UsbCommand c = {CMD_SNOOP_ICLASS};
71 SendCommand(&c);
72 return 0;
73 }
74
75 int usage_hf_iclass_sim(void) {
76 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
77 PrintAndLog(" options");
78 PrintAndLog(" 0 <CSN> simulate the given CSN");
79 PrintAndLog(" 1 simulate default CSN");
80 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
81 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
82 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
83 PrintAndLog(" example: hf iclass sim 2");
84 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
85 PrintAndLog(" hf iclass sim 3");
86 return 0;
87 }
88
89 #define NUM_CSNS 15
90 int CmdHFiClassSim(const char *Cmd) {
91 uint8_t simType = 0;
92 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
93
94 if (strlen(Cmd)<1) return usage_hf_iclass_sim();
95
96 simType = param_get8ex(Cmd, 0, 0, 10);
97
98 if(simType == 0)
99 {
100 if (param_gethex(Cmd, 1, CSN, 16)) {
101 PrintAndLog("A CSN should consist of 16 HEX symbols");
102 return usage_hf_iclass_sim();
103 }
104
105 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
106 }
107
108 if(simType > 3)
109 {
110 PrintAndLog("Undefined simptype %d", simType);
111 return usage_hf_iclass_sim();
112 }
113
114 uint8_t numberOfCSNs=0;
115 if(simType == 2)
116 {
117 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
118 UsbCommand resp = {0};
119
120 uint8_t csns[8*NUM_CSNS] = {
121 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
136
137 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
138 clearCommandBuffer();
139 SendCommand(&c);
140 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
141 PrintAndLog("Command timed out");
142 return 0;
143 }
144
145 uint8_t num_mac_responses = resp.arg[1];
146 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
147
148 size_t datalen = NUM_CSNS*24;
149 /*
150 * Now, time to dump to file. We'll use this format:
151 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
152 * So, it should wind up as
153 * 8 * 24 bytes.
154 *
155 * The returndata from the pm3 is on the following format
156 * <4 byte NR><4 byte MAC>
157 * CC are all zeroes, CSN is the same as was sent in
158 **/
159 void* dump = malloc(datalen);
160 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
161 uint8_t i = 0;
162 for(i = 0 ; i < NUM_CSNS ; i++) {
163 memcpy(dump+i*24, csns+i*8, 8); //CSN
164 //8 zero bytes here...
165 //Then comes NR_MAC (eight bytes from the response)
166 memcpy(dump+i*24+16, resp.d.asBytes+i*8, 8);
167 }
168 /** Now, save to dumpfile **/
169 saveFile("iclass_mac_attack", "bin", dump, datalen);
170 free(dump);
171 } else {
172 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
173 memcpy(c.d.asBytes, CSN, 8);
174 clearCommandBuffer();
175 SendCommand(&c);
176 }
177 return 0;
178 }
179
180 int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
181 bool tagFound = false;
182 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
183 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_AA}};
184 // loop in client not device - else on windows have a communication error
185 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
186 UsbCommand resp;
187 while(!ukbhit()){
188 clearCommandBuffer();
189 SendCommand(&c);
190 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
191 uint8_t readStatus = resp.arg[0] & 0xff;
192 uint8_t *data = resp.d.asBytes;
193
194 if (verbose) PrintAndLog("Readstatus:%02x", readStatus);
195 if( readStatus == 0){
196 //Aborted
197 if (verbose) PrintAndLog("Quitting...");
198 return 0;
199 }
200 if( readStatus & FLAG_ICLASS_READER_CSN){
201 PrintAndLog("CSN: %s",sprint_hex(data,8));
202 tagFound = true;
203 }
204 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s", sprint_hex(data+16, 8));
205 if( readStatus & FLAG_ICLASS_READER_CONF) printIclassDumpInfo(data);
206 if (tagFound && !loop) return 1;
207 } else {
208 if (verbose) PrintAndLog("Command execute timeout");
209 }
210 if (!loop) break;
211 }
212 return 0;
213 }
214
215 int CmdHFiClassReader(const char *Cmd) {
216 return HFiClassReader(Cmd, true, true);
217 }
218
219 int CmdHFiClassReader_Replay(const char *Cmd) {
220 uint8_t readerType = 0;
221 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
222
223 if (strlen(Cmd)<1) {
224 PrintAndLog("Usage: hf iclass replay <MAC>");
225 PrintAndLog(" sample: hf iclass replay 00112233");
226 return 0;
227 }
228
229 if (param_gethex(Cmd, 0, MAC, 8)) {
230 PrintAndLog("MAC must include 8 HEX symbols");
231 return 1;
232 }
233
234 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
235 memcpy(c.d.asBytes, MAC, 4);
236 clearCommandBuffer();
237 SendCommand(&c);
238 return 0;
239 }
240
241 int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
242 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
243 memcpy(c.d.asBytes, data, blocksCount * 16);
244 clearCommandBuffer();
245 SendCommand(&c);
246 return 0;
247 }
248
249 int hf_iclass_eload_usage(void) {
250 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
251 PrintAndLog("Usage: hf iclass eload f <filename>");
252 PrintAndLog("");
253 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
254 return 0;
255 }
256
257 int CmdHFiClassELoad(const char *Cmd) {
258
259 char opt = param_getchar(Cmd, 0);
260 if (strlen(Cmd)<1 || opt == 'h' || opt == 'H') return hf_iclass_eload_usage();
261
262 //File handling and reading
263 FILE *f;
264 char filename[FILE_PATH_SIZE];
265 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
266 f = fopen(filename, "rb");
267 } else {
268 return hf_iclass_eload_usage();
269 }
270
271 if(!f) {
272 PrintAndLog("Failed to read from file '%s'", filename);
273 return 1;
274 }
275
276 fseek(f, 0, SEEK_END);
277 long fsize = ftell(f);
278 fseek(f, 0, SEEK_SET);
279
280 if (fsize < 0) {
281 prnlog("Error, when getting filesize");
282 fclose(f);
283 return 1;
284 }
285
286 uint8_t *dump = malloc(fsize);
287
288 size_t bytes_read = fread(dump, 1, fsize, f);
289 fclose(f);
290
291 printIclassDumpInfo(dump);
292 //Validate
293
294 if (bytes_read < fsize) {
295 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
296 free(dump);
297 return 1;
298 }
299 //Send to device
300 uint32_t bytes_sent = 0;
301 uint32_t bytes_remaining = bytes_read;
302
303 while(bytes_remaining > 0){
304 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
305 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
306 memcpy(c.d.asBytes, dump, bytes_in_packet);
307 clearCommandBuffer();
308 SendCommand(&c);
309 bytes_remaining -= bytes_in_packet;
310 bytes_sent += bytes_in_packet;
311 }
312 free(dump);
313 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
314 return 0;
315 }
316
317 static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
318 FILE *f = fopen(filename, "rb");
319 if(!f) {
320 PrintAndLog("Failed to read from file '%s'", filename);
321 return 1;
322 }
323 fseek(f, 0, SEEK_END);
324 long fsize = ftell(f);
325 fseek(f, 0, SEEK_SET);
326 size_t bytes_read = fread(buffer, 1, len, f);
327 fclose(f);
328
329 if(fsize != len) {
330 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
331 return 1;
332 }
333
334 if(bytes_read != len) {
335 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
336 return 1;
337 }
338 return 0;
339 }
340
341 int usage_hf_iclass_decrypt(void) {
342 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
343 PrintAndLog("");
344 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
345 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
346 PrintAndLog("");
347 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
348 PrintAndLog("");
349 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
350 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
351 PrintAndLog("which is defined by the configuration block.");
352 return 1;
353 }
354
355 int CmdHFiClassDecrypt(const char *Cmd) {
356 uint8_t key[16] = { 0 };
357 if(readKeyfile("iclass_decryptionkey.bin", 16, key)) {
358 usage_hf_iclass_decrypt();
359 return 1;
360 }
361 PrintAndLog("Decryption file found... ");
362 char opt = param_getchar(Cmd, 0);
363 if (strlen(Cmd)<1 || opt == 'h' || opt == 'H') return usage_hf_iclass_decrypt();
364
365 //Open the tagdump-file
366 FILE *f;
367 char filename[FILE_PATH_SIZE];
368 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
369 if ( (f = fopen(filename, "rb")) == NULL) {
370 PrintAndLog("Could not find file %s", filename);
371 return 1;
372 }
373 } else {
374 return usage_hf_iclass_decrypt();
375 }
376
377 fseek(f, 0, SEEK_END);
378 long fsize = ftell(f);
379 fseek(f, 0, SEEK_SET);
380 uint8_t enc_dump[8] = {0};
381 uint8_t *decrypted = malloc(fsize);
382 des3_context ctx = { DES_DECRYPT ,{ 0 } };
383 des3_set2key_dec( &ctx, key);
384 size_t bytes_read = fread(enc_dump, 1, 8, f);
385
386 //Use the first block (CSN) for filename
387 char outfilename[FILE_PATH_SIZE] = { 0 };
388 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
389 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
390 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
391
392 size_t blocknum =0;
393 while(bytes_read == 8)
394 {
395 if(blocknum < 7) {
396 memcpy(decrypted+(blocknum*8), enc_dump, 8);
397 } else {
398 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
399 }
400 printvar("decrypted block", decrypted +(blocknum*8), 8);
401 bytes_read = fread(enc_dump, 1, 8, f);
402 blocknum++;
403 }
404 fclose(f);
405 saveFile(outfilename,"bin", decrypted, blocknum*8);
406 free(decrypted);
407 return 0;
408 }
409
410 int usage_hf_iclass_encrypt(void) {
411 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
412 PrintAndLog("");
413 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
414 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
415 PrintAndLog("");
416 PrintAndLog("example: hf iclass encrypt 0102030405060708");
417 PrintAndLog("");
418 return 0;
419 }
420
421 static int iClassEncryptBlkData(uint8_t *blkData) {
422 uint8_t key[16] = { 0 };
423 if(readKeyfile("iclass_decryptionkey.bin", 16, key)) {
424 usage_hf_iclass_encrypt();
425 return 1;
426 }
427 PrintAndLog("Decryption file found... ");
428
429 uint8_t encryptedData[16];
430 uint8_t *encrypted = encryptedData;
431 des3_context ctx = { DES_DECRYPT ,{ 0 } };
432 des3_set2key_enc( &ctx, key);
433
434 des3_crypt_ecb(&ctx, blkData,encrypted);
435 //printvar("decrypted block", decrypted, 8);
436 memcpy(blkData,encrypted,8);
437
438 return 1;
439 }
440
441 int CmdHFiClassEncryptBlk(const char *Cmd) {
442 uint8_t blkData[8] = {0};
443 char opt = param_getchar(Cmd, 0);
444 if (strlen(Cmd)<1 || opt == 'h' || opt == 'H') return usage_hf_iclass_encrypt();
445
446 //get the bytes to encrypt
447 if (param_gethex(Cmd, 0, blkData, 16)) {
448 PrintAndLog("BlockData must include 16 HEX symbols");
449 return 0;
450 }
451 if (!iClassEncryptBlkData(blkData)) return 0;
452
453 printvar("encrypted block", blkData, 8);
454 return 1;
455 }
456
457 void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
458 uint8_t WB[9];
459 WB[0] = blockno;
460 memcpy(WB + 1,data,8);
461 doMAC_N(WB,sizeof(WB),div_key,MAC);
462 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
463 }
464
465 static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
466 UsbCommand resp;
467
468 UsbCommand c = {CMD_READER_ICLASS, {0}};
469 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
470 if (use_credit_key)
471 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
472
473 clearCommandBuffer();
474 SendCommand(&c);
475 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
476 PrintAndLog("Command execute timeout");
477 return false;
478 }
479
480 uint8_t isOK = resp.arg[0] & 0xff;
481 uint8_t *data = resp.d.asBytes;
482
483 memcpy(CSN,data,8);
484
485 if (CCNR!=NULL)
486 memcpy(CCNR,data+16,8);
487
488 if(isOK > 0) {
489 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
490 }
491
492 if(isOK <= 1){
493 PrintAndLog("Failed to obtain CC! Aborting");
494 return false;
495 }
496 return true;
497 }
498
499 static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
500 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
501 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
502
503 if (!select_only(CSN, CCNR, use_credit_key, verbose))
504 return false;
505
506 //get div_key
507 if(rawkey)
508 memcpy(div_key, KEY, 8);
509 else
510 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
511
512 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
513
514 doMAC(CCNR, div_key, MAC);
515 UsbCommand resp;
516 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
517 memcpy(d.d.asBytes, MAC, 4);
518 clearCommandBuffer();
519 SendCommand(&d);
520 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
521 PrintAndLog("Auth Command execute timeout");
522 return false;
523 }
524 uint8_t isOK = resp.arg[0] & 0xff;
525 if (!isOK) {
526 PrintAndLog("Authentication error");
527 return false;
528 }
529 return true;
530 }
531
532 int usage_hf_iclass_dump(void) {
533 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
534 PrintAndLog("Options:");
535 PrintAndLog(" f <filename> : specify a filename to save dump to");
536 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
537 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
538 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
539 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
540 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
541 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
542 PrintAndLog(" NOTE: * = required");
543 PrintAndLog("Samples:");
544 PrintAndLog(" hf iclass dump k 001122334455667B");
545 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
546 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
547 return 0;
548 }
549
550 int CmdHFiClassReader_Dump(const char *Cmd) {
551
552 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
553 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
554 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
555 uint8_t blockno = 0;
556 uint8_t numblks = 0;
557 uint8_t maxBlk = 31;
558 uint8_t app_areas = 1;
559 uint8_t kb = 2;
560 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
561 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
562 uint8_t keyNbr = 0;
563 uint8_t dataLen = 0;
564 uint8_t fileNameLen = 0;
565 char filename[FILE_PATH_SIZE]={0};
566 char tempStr[50] = {0};
567 bool have_debit_key = false;
568 bool have_credit_key = false;
569 bool use_credit_key = false;
570 bool elite = false;
571 bool rawkey = false;
572 bool errors = false;
573 uint8_t cmdp = 0;
574
575 while(param_getchar(Cmd, cmdp) != 0x00)
576 {
577 switch(param_getchar(Cmd, cmdp))
578 {
579 case 'h':
580 case 'H':
581 return usage_hf_iclass_dump();
582 case 'c':
583 case 'C':
584 have_credit_key = true;
585 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
586 if (dataLen == 16) {
587 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
588 } else if (dataLen == 1) {
589 keyNbr = param_get8(Cmd, cmdp+1);
590 if (keyNbr < ICLASS_KEYS_MAX) {
591 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
592 } else {
593 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
594 errors = true;
595 }
596 } else {
597 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
598 errors = true;
599 }
600 cmdp += 2;
601 break;
602 case 'e':
603 case 'E':
604 elite = true;
605 cmdp++;
606 break;
607 case 'f':
608 case 'F':
609 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
610 if (fileNameLen < 1) {
611 PrintAndLog("No filename found after f");
612 errors = true;
613 }
614 cmdp += 2;
615 break;
616 case 'k':
617 case 'K':
618 have_debit_key = true;
619 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
620 if (dataLen == 16) {
621 errors = param_gethex(tempStr, 0, KEY, dataLen);
622 } else if (dataLen == 1) {
623 keyNbr = param_get8(Cmd, cmdp+1);
624 if (keyNbr < ICLASS_KEYS_MAX) {
625 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
626 } else {
627 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
628 errors = true;
629 }
630 } else {
631 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
632 errors = true;
633 }
634 cmdp += 2;
635 break;
636 case 'r':
637 case 'R':
638 rawkey = true;
639 cmdp++;
640 break;
641 default:
642 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
643 errors = true;
644 break;
645 }
646 if(errors) return usage_hf_iclass_dump();
647 }
648
649 if (cmdp < 2) return usage_hf_iclass_dump();
650 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
651 if (!have_debit_key && have_credit_key) use_credit_key = true;
652
653 //get config and first 3 blocks
654 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
655 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
656 UsbCommand resp;
657 uint8_t tag_data[255*8];
658
659 clearCommandBuffer();
660 SendCommand(&c);
661 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
662 PrintAndLog("Command execute timeout");
663 ul_switch_off_field();
664 return 0;
665 }
666 uint8_t readStatus = resp.arg[0] & 0xff;
667 uint8_t * data = resp.d.asBytes;
668
669 if(readStatus == 0){
670 PrintAndLog("No tag found...");
671 ul_switch_off_field();
672 return 0;
673 }
674
675 if( readStatus & (FLAG_ICLASS_READER_CSN | FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_CC)){
676 memcpy(tag_data, data, 8*3);
677 blockno += 2; // 2 to force re-read of block 2 later. (seems to respond differently..)
678 numblks = data[8];
679 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
680 // large memory - not able to dump pages currently
681 if (numblks > maxBlk) numblks = maxBlk;
682 }
683
684 ul_switch_off_field();
685 // authenticate debit key and get div_key - later store in dump block 3
686 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
687 //try twice - for some reason it sometimes fails the first time...
688 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
689 ul_switch_off_field();
690 return 0;
691 }
692 }
693
694 // begin dump
695 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
696 clearCommandBuffer();
697 SendCommand(&w);
698 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
699 PrintAndLog("Command execute time-out 1");
700 ul_switch_off_field();
701 return 1;
702 }
703 uint32_t blocksRead = resp.arg[1];
704 uint8_t isOK = resp.arg[0] & 0xff;
705 if (!isOK && !blocksRead) {
706 PrintAndLog("Read Block Failed");
707 ul_switch_off_field();
708 return 0;
709 }
710 uint32_t startindex = resp.arg[2];
711 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
712 PrintAndLog("Data exceeded Buffer size!");
713 blocksRead = (sizeof(tag_data)/8) - blockno;
714 }
715 // response ok - now get bigbuf content of the dump
716 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
717 WaitForResponse(CMD_ACK,NULL);
718 size_t gotBytes = blocksRead*8 + blockno*8;
719
720 // try AA2
721 if (have_credit_key) {
722 //turn off hf field before authenticating with different key
723 ul_switch_off_field();
724 memset(MAC,0,4);
725 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
726 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
727 //try twice - for some reason it sometimes fails the first time...
728 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
729 ul_switch_off_field();
730 return 0;
731 }
732 }
733 // do we still need to read more block? (aa2 enabled?)
734 if (maxBlk > blockno+numblks+1) {
735 // setup dump and start
736 w.arg[0] = blockno + blocksRead;
737 w.arg[1] = maxBlk - (blockno + blocksRead);
738 clearCommandBuffer();
739 SendCommand(&w);
740 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
741 PrintAndLog("Command execute timeout 2");
742 ul_switch_off_field();
743 return 0;
744 }
745 uint8_t isOK = resp.arg[0] & 0xff;
746 blocksRead = resp.arg[1];
747 if (!isOK && !blocksRead) {
748 PrintAndLog("Read Block Failed 2");
749 ul_switch_off_field();
750 return 0;
751 }
752
753 startindex = resp.arg[2];
754 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
755 PrintAndLog("Data exceeded Buffer size!");
756 blocksRead = (sizeof(tag_data) - gotBytes)/8;
757 }
758 // get dumped data from bigbuf
759 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
760 WaitForResponse(CMD_ACK,NULL);
761
762 gotBytes += blocksRead*8;
763 } else { //field is still on - turn it off...
764 ul_switch_off_field();
765 }
766 }
767
768 // add diversified keys to dump
769 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
770 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
771
772 printf("Num of bytes: %lu\n", gotBytes);
773
774 // print the dump
775 printf("------+--+-------------------------+\n");
776 printf("CSN |00| %s|\n", sprint_hex(tag_data, 8));
777 //printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
778 printIclassDumpContents(tag_data, 1, (gotBytes/8), gotBytes);
779
780 if (filename[0] == 0){
781 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
782 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
783 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
784 }
785
786 // save the dump to .bin file
787 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
788 saveFile(filename, "bin", tag_data, gotBytes);
789 return 1;
790 }
791
792 static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
793 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
794 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
795 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
796 return 0;
797
798 UsbCommand resp;
799
800 Calc_wb_mac(blockno,bldata,div_key,MAC);
801 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
802 memcpy(w.d.asBytes, bldata, 8);
803 memcpy(w.d.asBytes + 8, MAC, 4);
804
805 clearCommandBuffer();
806 SendCommand(&w);
807 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
808 PrintAndLog("Write Command execute timeout");
809 return 0;
810 }
811 uint8_t isOK = resp.arg[0] & 0xff;
812 if (!isOK) {
813 PrintAndLog("Write Block Failed");
814 return 0;
815 }
816 PrintAndLog("Write Block Successful");
817 return 1;
818 }
819
820 int usage_hf_iclass_writeblock(void) {
821 PrintAndLog("Options:");
822 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
823 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
824 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
825 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
826 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
827 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
828 PrintAndLog("Samples:");
829 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
830 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
831 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
832 return 0;
833 }
834
835 int CmdHFiClass_WriteBlock(const char *Cmd) {
836 uint8_t blockno=0;
837 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
838 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
839 uint8_t keyNbr = 0;
840 uint8_t dataLen = 0;
841 char tempStr[50] = {0};
842 bool use_credit_key = false;
843 bool elite = false;
844 bool rawkey= false;
845 bool errors = false;
846 uint8_t cmdp = 0;
847 while(param_getchar(Cmd, cmdp) != 0x00)
848 {
849 switch(param_getchar(Cmd, cmdp))
850 {
851 case 'h':
852 case 'H':
853 return usage_hf_iclass_writeblock();
854 case 'b':
855 case 'B':
856 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
857 PrintAndLog("Block No must include 2 HEX symbols\n");
858 errors = true;
859 }
860 cmdp += 2;
861 break;
862 case 'c':
863 case 'C':
864 use_credit_key = true;
865 cmdp++;
866 break;
867 case 'd':
868 case 'D':
869 if (param_gethex(Cmd, cmdp+1, bldata, 16))
870 {
871 PrintAndLog("KEY must include 16 HEX symbols\n");
872 errors = true;
873 }
874 cmdp += 2;
875 break;
876 case 'e':
877 case 'E':
878 elite = true;
879 cmdp++;
880 break;
881 case 'k':
882 case 'K':
883 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
884 if (dataLen == 16) {
885 errors = param_gethex(tempStr, 0, KEY, dataLen);
886 } else if (dataLen == 1) {
887 keyNbr = param_get8(Cmd, cmdp+1);
888 if (keyNbr < ICLASS_KEYS_MAX) {
889 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
890 } else {
891 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
892 errors = true;
893 }
894 } else {
895 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
896 errors = true;
897 }
898 cmdp += 2;
899 break;
900 case 'r':
901 case 'R':
902 rawkey = true;
903 cmdp++;
904 break;
905 default:
906 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
907 errors = true;
908 break;
909 }
910 if(errors) return usage_hf_iclass_writeblock();
911 }
912
913 if (cmdp < 6) return usage_hf_iclass_writeblock();
914 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
915 ul_switch_off_field();
916 return ans;
917 }
918
919 int usage_hf_iclass_clone(void) {
920 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
921 PrintAndLog("Options:");
922 PrintAndLog(" f <filename>: specify a filename to clone from");
923 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
924 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
925 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
926 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
927 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
928 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
929 PrintAndLog("Samples:");
930 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
931 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
932 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
933 return -1;
934 }
935
936 int CmdHFiClassCloneTag(const char *Cmd) {
937 char filename[FILE_PATH_SIZE] = { 0x00 };
938 char tempStr[50]={0};
939 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
940 uint8_t keyNbr = 0;
941 uint8_t fileNameLen = 0;
942 uint8_t startblock = 0;
943 uint8_t endblock = 0;
944 uint8_t dataLen = 0;
945 bool use_credit_key = false;
946 bool elite = false;
947 bool rawkey = false;
948 bool errors = false;
949 uint8_t cmdp = 0;
950 while(param_getchar(Cmd, cmdp) != 0x00)
951 {
952 switch(param_getchar(Cmd, cmdp))
953 {
954 case 'h':
955 case 'H':
956 return usage_hf_iclass_clone();
957 case 'b':
958 case 'B':
959 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
960 PrintAndLog("Start Block No must include 2 HEX symbols\n");
961 errors = true;
962 }
963 cmdp += 2;
964 break;
965 case 'c':
966 case 'C':
967 use_credit_key = true;
968 cmdp++;
969 break;
970 case 'e':
971 case 'E':
972 elite = true;
973 cmdp++;
974 break;
975 case 'f':
976 case 'F':
977 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
978 if (fileNameLen < 1) {
979 PrintAndLog("No filename found after f");
980 errors = true;
981 }
982 cmdp += 2;
983 break;
984 case 'k':
985 case 'K':
986 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
987 if (dataLen == 16) {
988 errors = param_gethex(tempStr, 0, KEY, dataLen);
989 } else if (dataLen == 1) {
990 keyNbr = param_get8(Cmd, cmdp+1);
991 if (keyNbr < ICLASS_KEYS_MAX) {
992 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
993 } else {
994 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
995 errors = true;
996 }
997 } else {
998 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
999 errors = true;
1000 }
1001 cmdp += 2;
1002 break;
1003 case 'l':
1004 case 'L':
1005 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1006 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1007 errors = true;
1008 }
1009 cmdp += 2;
1010 break;
1011 case 'r':
1012 case 'R':
1013 rawkey = true;
1014 cmdp++;
1015 break;
1016 default:
1017 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1018 errors = true;
1019 break;
1020 }
1021 if(errors) return usage_hf_iclass_clone();
1022 }
1023
1024 if (cmdp < 8) return usage_hf_iclass_clone();
1025
1026 FILE *f;
1027
1028 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1029
1030 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1031 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1032 }
1033 // file handling and reading
1034 f = fopen(filename,"rb");
1035 if(!f) {
1036 PrintAndLog("Failed to read from file '%s'", filename);
1037 return 1;
1038 }
1039
1040 if (startblock<5) {
1041 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1042 fclose(f);
1043 return 0;
1044 }
1045 // now read data from the file from block 6 --- 19
1046 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1047 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1048 // else we have to create a share memory
1049 int i;
1050 fseek(f,startblock*8,SEEK_SET);
1051 size_t bytes_read = fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f);
1052 if ( bytes_read == 0){
1053 PrintAndLog("File reading error.");
1054 fclose(f);
1055 return 2;
1056 }
1057
1058 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1059 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1060
1061 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
1062 return 0;
1063
1064 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
1065 uint8_t *ptr;
1066 // calculate all mac for every the block we will write
1067 for (i = startblock; i <= endblock; i++){
1068 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1069 // usb command d start pointer = d + (i - 6) * 12
1070 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1071 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1072 // next one
1073 ptr = w.d.asBytes + (i - startblock) * 12;
1074 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1075 memcpy(ptr + 8,MAC, 4);
1076 }
1077 uint8_t p[12];
1078 for (i = 0; i <= endblock - startblock;i++){
1079 memcpy(p,w.d.asBytes + (i * 12),12);
1080 printf("Block |%02x|",i + startblock);
1081 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1082 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1083 }
1084 UsbCommand resp;
1085 clearCommandBuffer();
1086 SendCommand(&w);
1087 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
1088 PrintAndLog("Command execute timeout");
1089 return 0;
1090 }
1091 return 1;
1092 }
1093
1094 static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose) {
1095 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1096 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1097
1098 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
1099 return 0;
1100
1101 UsbCommand resp;
1102 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
1103 clearCommandBuffer();
1104 SendCommand(&w);
1105 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
1106 PrintAndLog("Command execute timeout");
1107 return 0;
1108 }
1109
1110 uint8_t isOK = resp.arg[0] & 0xff;
1111 if (!isOK) {
1112 PrintAndLog("Read Block Failed");
1113 return 0;
1114 }
1115 //data read is stored in: resp.d.asBytes[0-15]
1116 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1117 return 1;
1118 }
1119
1120 int usage_hf_iclass_readblock(void) {
1121 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
1122 PrintAndLog("Options:");
1123 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1124 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1125 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1126 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1127 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
1128 PrintAndLog("Samples:");
1129 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1130 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1131 PrintAndLog(" hf iclass readblk b 0A k 0");
1132 return 0;
1133 }
1134
1135 int CmdHFiClass_ReadBlock(const char *Cmd) {
1136 uint8_t blockno=0;
1137 uint8_t keyType = 0x88; //debit key
1138 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1139 uint8_t keyNbr = 0;
1140 uint8_t dataLen = 0;
1141 char tempStr[50] = {0};
1142 bool elite = false;
1143 bool rawkey = false;
1144 bool errors = false;
1145 uint8_t cmdp = 0;
1146 while(param_getchar(Cmd, cmdp) != 0x00)
1147 {
1148 switch(param_getchar(Cmd, cmdp))
1149 {
1150 case 'h':
1151 case 'H':
1152 return usage_hf_iclass_readblock();
1153 case 'b':
1154 case 'B':
1155 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1156 PrintAndLog("Block No must include 2 HEX symbols\n");
1157 errors = true;
1158 }
1159 cmdp += 2;
1160 break;
1161 case 'c':
1162 case 'C':
1163 keyType = 0x18;
1164 cmdp++;
1165 break;
1166 case 'e':
1167 case 'E':
1168 elite = true;
1169 cmdp++;
1170 break;
1171 case 'k':
1172 case 'K':
1173 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1174 if (dataLen == 16) {
1175 errors = param_gethex(tempStr, 0, KEY, dataLen);
1176 } else if (dataLen == 1) {
1177 keyNbr = param_get8(Cmd, cmdp+1);
1178 if (keyNbr < ICLASS_KEYS_MAX) {
1179 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1180 } else {
1181 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1182 errors = true;
1183 }
1184 } else {
1185 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1186 errors = true;
1187 }
1188 cmdp += 2;
1189 break;
1190 case 'r':
1191 case 'R':
1192 rawkey = true;
1193 cmdp++;
1194 break;
1195 default:
1196 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1197 errors = true;
1198 break;
1199 }
1200 if(errors) return usage_hf_iclass_readblock();
1201 }
1202
1203 if (cmdp < 4) return usage_hf_iclass_readblock();
1204
1205 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true);
1206 }
1207
1208 int CmdHFiClass_loclass(const char *Cmd) {
1209 char opt = param_getchar(Cmd, 0);
1210
1211 if (strlen(Cmd)<1 || opt == 'h') {
1212 PrintAndLog("Usage: hf iclass loclass [options]");
1213 PrintAndLog("Options:");
1214 PrintAndLog("h Show this help");
1215 PrintAndLog("t Perform self-test");
1216 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1217 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1218 PrintAndLog(" malicious CSNs, and their protocol responses");
1219 PrintAndLog(" The binary format of the file is expected to be as follows: ");
1220 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1221 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1222 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1223 PrintAndLog(" ... totalling N*24 bytes");
1224 return 0;
1225 }
1226 char fileName[255] = {0};
1227 if(opt == 'f') {
1228 if(param_getstr(Cmd, 1, fileName) > 0) {
1229 return bruteforceFileNoKeys(fileName);
1230 } else {
1231 PrintAndLog("You must specify a filename");
1232 // no return?
1233 }
1234 }
1235 else if(opt == 't') {
1236 int errors = testCipherUtils();
1237 errors += testMAC();
1238 errors += doKeyTests(0);
1239 errors += testElite();
1240 if(errors) prnlog("OBS! There were errors!!!");
1241 return errors;
1242 }
1243 return 0;
1244 }
1245
1246 void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1247 uint8_t mem_config;
1248 memcpy(&mem_config, iclass_dump + 13,1);
1249 uint8_t maxmemcount;
1250
1251 uint8_t filemaxblock = filesize / 8;
1252
1253 if (mem_config & 0x80)
1254 maxmemcount = 255;
1255 else
1256 maxmemcount = 31;
1257
1258 if (startblock == 0)
1259 startblock = 6;
1260
1261 if ((endblock > maxmemcount) || (endblock == 0))
1262 endblock = maxmemcount;
1263
1264 // remember endblock needs to relate to zero-index arrays.
1265 if (endblock > filemaxblock-1)
1266 endblock = filemaxblock-1;
1267
1268 //PrintAndLog ("startblock: %d, endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d",startblock, endblock,filesize, maxmemcount, filemaxblock);
1269
1270 int i = startblock;
1271 printf("------+--+-------------------------+\n");
1272 while (i <= endblock){
1273 uint8_t *blk = iclass_dump + (i * 8);
1274 printf("Block |%02X| %s|\n", i, sprint_hex(blk, 8) );
1275 i++;
1276 }
1277 printf("------+--+-------------------------+\n");
1278 }
1279
1280 int usage_hf_iclass_readtagfile() {
1281 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1282 return 1;
1283 }
1284
1285 int CmdHFiClassReadTagFile(const char *Cmd) {
1286 int startblock = 0;
1287 int endblock = 0;
1288 char tempnum[5];
1289 FILE *f;
1290 char filename[FILE_PATH_SIZE];
1291 if (param_getstr(Cmd, 0, filename) < 1)
1292 return usage_hf_iclass_readtagfile();
1293
1294 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1295 startblock = 0;
1296 else
1297 sscanf(tempnum,"%d",&startblock);
1298
1299 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1300 endblock = 0;
1301 else
1302 sscanf(tempnum,"%d",&endblock);
1303
1304 // file handling and reading
1305 f = fopen(filename,"rb");
1306 if(!f) {
1307 PrintAndLog("Failed to read from file '%s'", filename);
1308 return 1;
1309 }
1310 fseek(f, 0, SEEK_END);
1311 long fsize = ftell(f);
1312 fseek(f, 0, SEEK_SET);
1313
1314 if ( fsize < 0 ) {
1315 PrintAndLog("Error, when getting filesize");
1316 fclose(f);
1317 return 1;
1318 }
1319
1320 uint8_t *dump = malloc(fsize);
1321 size_t bytes_read = fread(dump, 1, fsize, f);
1322 fclose(f);
1323
1324 uint8_t *csn = dump;
1325 printf("------+--+-------------------------+\n");
1326 printf("CSN |00| %s|\n", sprint_hex(csn, 8) );
1327 printIclassDumpContents(dump, startblock, endblock, bytes_read);
1328 free(dump);
1329 return 0;
1330 }
1331
1332 /*
1333 uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1334 uint64_t new_div = 0x00;
1335 new_div ^= sdiv;
1336 new_div ^= hdiv;
1337 return new_div;
1338 }
1339
1340 uint64_t hexarray_to_uint64(uint8_t *key) {
1341 char temp[17];
1342 uint64_t uint_key;
1343 for (int i = 0;i < 8;i++)
1344 sprintf(&temp[(i *2)],"%02X",key[i]);
1345 temp[16] = '\0';
1346 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1347 return 0;
1348 return uint_key;
1349 }
1350 */
1351 void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1352 uint8_t keytable[128] = {0};
1353 uint8_t key_index[8] = {0};
1354 if (elite) {
1355 uint8_t key_sel[8] = { 0 };
1356 uint8_t key_sel_p[8] = { 0 };
1357 hash2(KEY, keytable);
1358 hash1(CSN, key_index);
1359 for(uint8_t i = 0; i < 8 ; i++)
1360 key_sel[i] = keytable[key_index[i]] & 0xFF;
1361
1362 //Permute from iclass format to standard format
1363 permutekey_rev(key_sel, key_sel_p);
1364 diversifyKey(CSN, key_sel_p, div_key);
1365 } else {
1366 diversifyKey(CSN, KEY, div_key);
1367 }
1368 }
1369
1370 //when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1371 //calculate and return xor_div_key (ready for a key write command)
1372 //print all div_keys if verbose
1373 static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1374 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1375 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1376 //get old div key
1377 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1378 //get new div key
1379 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1380
1381 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1382 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1383 }
1384 if (verbose) {
1385 printf("Old div key : %s\n",sprint_hex(old_div_key,8));
1386 printf("New div key : %s\n",sprint_hex(new_div_key,8));
1387 printf("Xor div key : %s\n",sprint_hex(xor_div_key,8));
1388 }
1389 }
1390
1391 int usage_hf_iclass_calc_newkey(void) {
1392 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1393 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1394 PrintAndLog(" Options:");
1395 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1396 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1397 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1398 PrintAndLog(" e : specify new key as elite calc");
1399 PrintAndLog(" ee : specify old and new key as elite calc");
1400 PrintAndLog("Samples:");
1401 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1402 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1403 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1404 PrintAndLog("NOTE: * = required\n");
1405 return 1;
1406 }
1407
1408 int CmdHFiClassCalcNewKey(const char *Cmd) {
1409 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1410 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1411 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1412 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1413 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1414 uint8_t keyNbr = 0;
1415 uint8_t dataLen = 0;
1416 char tempStr[50] = {0};
1417 bool givenCSN = false;
1418 bool oldElite = false;
1419 bool elite = false;
1420 bool errors = false;
1421 uint8_t cmdp = 0;
1422 while(param_getchar(Cmd, cmdp) != 0x00)
1423 {
1424 switch(param_getchar(Cmd, cmdp))
1425 {
1426 case 'h':
1427 case 'H':
1428 return usage_hf_iclass_calc_newkey();
1429 case 'e':
1430 case 'E':
1431 dataLen = param_getstr(Cmd, cmdp, tempStr);
1432 if (dataLen==2)
1433 oldElite = true;
1434 elite = true;
1435 cmdp++;
1436 break;
1437 case 'n':
1438 case 'N':
1439 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1440 if (dataLen == 16) {
1441 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1442 } else if (dataLen == 1) {
1443 keyNbr = param_get8(Cmd, cmdp+1);
1444 if (keyNbr < ICLASS_KEYS_MAX) {
1445 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1446 } else {
1447 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1448 errors = true;
1449 }
1450 } else {
1451 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1452 errors = true;
1453 }
1454 cmdp += 2;
1455 break;
1456 case 'o':
1457 case 'O':
1458 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1459 if (dataLen == 16) {
1460 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1461 } else if (dataLen == 1) {
1462 keyNbr = param_get8(Cmd, cmdp+1);
1463 if (keyNbr < ICLASS_KEYS_MAX) {
1464 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1465 } else {
1466 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1467 errors = true;
1468 }
1469 } else {
1470 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1471 errors = true;
1472 }
1473 cmdp += 2;
1474 break;
1475 case 's':
1476 case 'S':
1477 givenCSN = true;
1478 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1479 return usage_hf_iclass_calc_newkey();
1480 cmdp += 2;
1481 break;
1482 default:
1483 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1484 errors = true;
1485 break;
1486 }
1487 if(errors) return usage_hf_iclass_calc_newkey();
1488 }
1489
1490 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1491
1492 if (!givenCSN)
1493 if (!select_only(CSN, CCNR, false, true))
1494 return 0;
1495
1496 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1497 return 0;
1498 }
1499
1500 static int loadKeys(char *filename) {
1501 FILE *f;
1502 f = fopen(filename,"rb");
1503 if(!f) {
1504 PrintAndLog("Failed to read from file '%s'", filename);
1505 return 0;
1506 }
1507 fseek(f, 0, SEEK_END);
1508 long fsize = ftell(f);
1509 fseek(f, 0, SEEK_SET);
1510
1511 if ( fsize < 0 ) {
1512 PrintAndLog("Error, when getting filesize");
1513 fclose(f);
1514 return 1;
1515 }
1516
1517 uint8_t *dump = malloc(fsize);
1518
1519 size_t bytes_read = fread(dump, 1, fsize, f);
1520 fclose(f);
1521 if (bytes_read > ICLASS_KEYS_MAX * 8){
1522 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1523 free(dump);
1524 return 0;
1525 }
1526 uint8_t i = 0;
1527 for (; i < bytes_read/8; i++)
1528 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1529
1530 free(dump);
1531 PrintAndLog("%u keys loaded", i);
1532 return 1;
1533 }
1534
1535 static int saveKeys(char *filename) {
1536 FILE *f;
1537 f = fopen(filename,"wb");
1538 if (f == NULL) {
1539 printf("error opening file %s\n",filename);
1540 return 0;
1541 }
1542 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1543 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1544 PrintAndLog("save key failed to write to file: %s", filename);
1545 break;
1546 }
1547 }
1548 fclose(f);
1549 return 0;
1550 }
1551
1552 static int printKeys(void) {
1553 PrintAndLog("");
1554 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++)
1555 PrintAndLog("%u: %s", i, sprint_hex(iClass_Key_Table[i],8));
1556 PrintAndLog("");
1557 return 0;
1558 }
1559
1560 int usage_hf_iclass_managekeys(void) {
1561 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1562 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1563 PrintAndLog(" Options:");
1564 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1565 PrintAndLog(" k <key> : set a key in memory");
1566 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1567 PrintAndLog(" s : save keys in memory to file specified by filename");
1568 PrintAndLog(" l : load keys to memory from file specified by filename");
1569 PrintAndLog(" p : print keys loaded into memory\n");
1570 PrintAndLog("Samples:");
1571 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1572 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1573 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1574 PrintAndLog(" print keys : hf iclass managekeys p\n");
1575 return 0;
1576 }
1577
1578 int CmdHFiClassManageKeys(const char *Cmd) {
1579 uint8_t keyNbr = 0;
1580 uint8_t dataLen = 0;
1581 uint8_t KEY[8] = {0};
1582 char filename[FILE_PATH_SIZE];
1583 uint8_t fileNameLen = 0;
1584 bool errors = false;
1585 uint8_t operation = 0;
1586 char tempStr[20];
1587 uint8_t cmdp = 0;
1588
1589 while(param_getchar(Cmd, cmdp) != 0x00)
1590 {
1591 switch(param_getchar(Cmd, cmdp))
1592 {
1593 case 'h':
1594 case 'H':
1595 return usage_hf_iclass_managekeys();
1596 case 'f':
1597 case 'F':
1598 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1599 if (fileNameLen < 1) {
1600 PrintAndLog("No filename found after f");
1601 errors = true;
1602 }
1603 cmdp += 2;
1604 break;
1605 case 'n':
1606 case 'N':
1607 keyNbr = param_get8(Cmd, cmdp+1);
1608 if (keyNbr == 0) {
1609 PrintAndLog("Wrong block number");
1610 errors = true;
1611 }
1612 cmdp += 2;
1613 break;
1614 case 'k':
1615 case 'K':
1616 operation += 3; //set key
1617 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1618 if (dataLen == 16) { //ul-c or ev1/ntag key length
1619 errors = param_gethex(tempStr, 0, KEY, dataLen);
1620 } else {
1621 PrintAndLog("\nERROR: Key is incorrect length\n");
1622 errors = true;
1623 }
1624 cmdp += 2;
1625 break;
1626 case 'p':
1627 case 'P':
1628 operation += 4; //print keys in memory
1629 cmdp++;
1630 break;
1631 case 'l':
1632 case 'L':
1633 operation += 5; //load keys from file
1634 cmdp++;
1635 break;
1636 case 's':
1637 case 'S':
1638 operation += 6; //save keys to file
1639 cmdp++;
1640 break;
1641 default:
1642 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1643 errors = true;
1644 break;
1645 }
1646 if(errors) return usage_hf_iclass_managekeys();
1647 }
1648 if (operation == 0){
1649 PrintAndLog("no operation specified (load, save, or print)\n");
1650 return usage_hf_iclass_managekeys();
1651 }
1652 if (operation > 6){
1653 PrintAndLog("Too many operations specified\n");
1654 return usage_hf_iclass_managekeys();
1655 }
1656 if (operation > 4 && fileNameLen == 0){
1657 PrintAndLog("You must enter a filename when loading or saving\n");
1658 return usage_hf_iclass_managekeys();
1659 }
1660
1661 switch (operation){
1662 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1663 case 4: return printKeys();
1664 case 5: return loadKeys(filename);
1665 case 6: return saveKeys(filename);
1666 break;
1667 }
1668 return 0;
1669 }
1670
1671 static command_t CommandTable[] = {
1672 {"help", CmdHelp, 1, "This help"},
1673 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1674 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1675 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1676 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1677 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1678 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1679 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1680 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1681 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1682 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1683 {"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
1684 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1685 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1686 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1687 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1688 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
1689 {NULL, NULL, 0, NULL}
1690 };
1691
1692 int CmdHFiClass(const char *Cmd) {
1693 clearCommandBuffer();
1694 CmdsParse(CommandTable, Cmd);
1695 return 0;
1696 }
1697
1698 int CmdHelp(const char *Cmd) {
1699 CmdsHelp(CommandTable);
1700 return 0;
1701 }
Proxmark3 GIT tracking
Impressum, Datenschutz