git.zerfleddert.de Git - proxmark3-svn/blob - client/mifare/mad.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2019 Merlok
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // MIFARE Application Directory (MAD) functions
   9 //-----------------------------------------------------------------------------
  10
  11 #include "mad.h"
  12 #include "ui.h"
  13 #include "crc.h"
  14 #include "util.h"
  15
  16 // https://www.nxp.com/docs/en/application-note/AN10787.pdf
  17 static madAIDDescr madKnownAIDs[] = {
  18     {0x0000, "free"},
  19     {0x0001, "defect, e.g. access keys are destroyed or unknown"},
  20     {0x0002, "reserved"},
  21     {0x0003, "contains additional directory info"},
  22     {0x0004, "contains card holder information in ASCII format."},
  23     {0x0005, "not applicable (above memory size)"},
  24
  25     {0x03e1, "NDEF"},
  26 };
  27
  28 static madAIDDescr madKnownClusterCodes[] = {
  29     {0x00, "cluster: card administration"},
  30     {0x01, "cluster: miscellaneous applications"},
  31     {0x02, "cluster: miscellaneous applications"},
  32     {0x03, "cluster: miscellaneous applications"},
  33     {0x04, "cluster: miscellaneous applications"},
  34     {0x05, "cluster: miscellaneous applications"},
  35     {0x06, "cluster: miscellaneous applications"},
  36     {0x07, "cluster: miscellaneous applications"},
  37     {0x08, "cluster: airlines"},
  38     {0x09, "cluster: ferry traffic"},
  39     {0x10, "cluster: railway services"},
  40     {0x11, "cluster: miscellaneous applications"},
  41     {0x12, "cluster: transport"},
  42     {0x14, "cluster: security solutions"},
  43     {0x18, "cluster: city traffic"},
  44     {0x19, "cluster: Czech Railways"},
  45     {0x20, "cluster: bus services"},
  46     {0x21, "cluster: multi modal transit"},
  47     {0x28, "cluster: taxi"},
  48     {0x30, "cluster: road toll"},
  49     {0x31, "cluster: generic transport"},
  50     {0x38, "cluster: company services"},
  51     {0x40, "cluster: city card services"},
  52     {0x47, "cluster: access control & security"},
  53     {0x48, "cluster: access control & security"},
  54     {0x49, "cluster: VIGIK"},
  55     {0x4A, "cluster: Ministry of Defence, Netherlands"},
  56     {0x4B, "cluster: Bosch Telecom, Germany"},
  57     {0x4C, "cluster: European Union Institutions"},
  58     {0x50, "cluster: ski ticketing"},
  59     {0x51, "cluster: access control & security"},
  60     {0x52, "cluster: access control & security"},
  61     {0x53, "cluster: access control & security"},
  62     {0x54, "cluster: access control & security"},
  63     {0x55, "cluster: SOAA standard for offline access standard"},
  64     {0x56, "cluster: access control & security"},
  65     {0x58, "cluster: academic services"},
  66     {0x60, "cluster: food"},
  67     {0x68, "cluster: non-food trade"},
  68     {0x70, "cluster: hotel"},
  69     {0x71, "cluster: loyalty"},
  70     {0x75, "cluster: airport services"},
  71     {0x78, "cluster: car rental"},
  72     {0x79, "cluster: Dutch government"},
  73     {0x80, "cluster: administration services"},
  74     {0x88, "cluster: electronic purse"},
  75     {0x90, "cluster: television"},
  76     {0x91, "cluster: cruise ship"},
  77     {0x95, "cluster: IOPTA"},
  78     {0x97, "cluster: metering"},
  79     {0x98, "cluster: telephone"},
  80     {0xA0, "cluster: health services"},
  81     {0xA8, "cluster: warehouse"},
  82     {0xB0, "cluster: electronic trade"},
  83     {0xB8, "cluster: banking"},
  84     {0xC0, "cluster: entertainment & sports"},
  85     {0xC8, "cluster: car parking"},
  86     {0xC9, "cluster: fleet management"},
  87     {0xD0, "cluster: fuel, gasoline"},
  88     {0xD8, "cluster: info services"},
  89     {0xE0, "cluster: press"},
  90     {0xE1, "cluster: NFC Forum"},
  91     {0xE8, "cluster: computer"},
  92     {0xF0, "cluster: mail"},
  93     {0xF8, "cluster: miscellaneous applications"},
  94 };
  95
  96 static const char unknownAID[] = "";
  97
  98 static const char *GetAIDDescription(uint16_t AID) {
  99     for (int i = 0; i < ARRAYLEN(madKnownAIDs); i++)
 100         if (madKnownAIDs[i].AID == AID)
 101             return madKnownAIDs[i].Description;
 102
 103     for (int i = 0; i < ARRAYLEN(madKnownClusterCodes); i++)
 104         if (madKnownClusterCodes[i].AID == (AID >> 8)) // high byte - cluster code
 105             return madKnownClusterCodes[i].Description;
 106
 107     return unknownAID;
 108 }
 109
 110 int madCRCCheck(uint8_t *sector, bool verbose, int MADver) {
 111     if (MADver == 1) {
 112         uint8_t crc = CRC8Mad(&sector[16 + 1], 15 + 16);
 113         if (crc != sector[16]) {
 114             PrintAndLogEx(WARNING, "Wrong MAD%d CRC. Calculated: 0x%02x, from card: 0x%02x", MADver, crc, sector[16]);
 115             return 3;
 116         };
 117     } else {
 118         uint8_t crc = CRC8Mad(&sector[1], 15 + 16 + 16);
 119         if (crc != sector[0]) {
 120             PrintAndLogEx(WARNING, "Wrong MAD%d CRC. Calculated: 0x%02x, from card: 0x%02x", MADver, crc, sector[16]);
 121             return 3;
 122         };
 123     }
 124
 125     return 0;
 126 }
 127
 128 uint16_t madGetAID(uint8_t *sector, int MADver, int sectorNo) {
 129     if (MADver == 1)
 130         return (sector[16 + 2 + (sectorNo - 1) * 2] << 8) + (sector[16 + 2 + (sectorNo - 1) * 2 + 1]);
 131     else
 132         return (sector[2 + (sectorNo - 1) * 2] << 8) + (sector[2 + (sectorNo - 1) * 2 + 1]);
 133 }
 134
 135 int MADCheck(uint8_t *sector0, uint8_t *sector10, bool verbose, bool *haveMAD2) {
 136     int res = 0;
 137
 138     if (!sector0)
 139         return 1;
 140
 141     uint8_t GPB = sector0[3 * 16 + 9];
 142     if (verbose)
 143         PrintAndLogEx(NORMAL, "GPB: 0x%02x", GPB);
 144
 145     // DA (MAD available)
 146     if (!(GPB & 0x80)) {
 147         PrintAndLogEx(ERR, "DA=0! MAD not available.");
 148         return 1;
 149     }
 150
 151     // MA (multi-application card)
 152     if (verbose) {
 153         if (GPB & 0x40)
 154             PrintAndLogEx(NORMAL, "Multi application card.");
 155         else
 156             PrintAndLogEx(NORMAL, "Single application card.");
 157     }
 158
 159     uint8_t MADVer = GPB & 0x03;
 160     if (verbose)
 161         PrintAndLogEx(NORMAL, "MAD version: %d", MADVer);
 162
 163     //  MAD version
 164     if ((MADVer != 0x01) && (MADVer != 0x02)) {
 165         PrintAndLogEx(ERR, "Wrong MAD version: 0x%02x", MADVer);
 166         return 2;
 167     };
 168
 169     if (haveMAD2)
 170         *haveMAD2 = (MADVer == 2);
 171
 172     res = madCRCCheck(sector0, true, 1);
 173
 174     if (verbose && !res)
 175         PrintAndLogEx(NORMAL, "CRC8-MAD1 OK.");
 176
 177     if (MADVer == 2 && sector10) {
 178         int res2 = madCRCCheck(sector10, true, 2);
 179         if (!res)
 180             res = res2;
 181
 182         if (verbose & !res2)
 183             PrintAndLogEx(NORMAL, "CRC8-MAD2 OK.");
 184     }
 185
 186     return res;
 187 }
 188
 189 int MADDecode(uint8_t *sector0, uint8_t *sector10, uint16_t *mad, size_t *madlen) {
 190     *madlen = 0;
 191     bool haveMAD2 = false;
 192     MADCheck(sector0, sector10, false, &haveMAD2);
 193
 194     for (int i = 1; i < 16; i++) {
 195         mad[*madlen] = madGetAID(sector0, 1, i);
 196         (*madlen)++;
 197     }
 198
 199     if (haveMAD2) {
 200         // mad2 sector (0x10 == 16dec) here
 201         mad[*madlen] = 0x0005;
 202         (*madlen)++;
 203
 204         for (int i = 1; i < 24; i++) {
 205             mad[*madlen] = madGetAID(sector10, 2, i);
 206             (*madlen)++;
 207         }
 208     }
 209
 210     return 0;
 211 }
 212
 213
 214 int MAD1DecodeAndPrint(uint8_t *sector, bool verbose, bool *haveMAD2) {
 215
 216     // check MAD1 only
 217     MADCheck(sector, NULL, verbose, haveMAD2);
 218
 219     // info byte
 220     uint8_t InfoByte = sector[16 + 1] & 0x3f;
 221     if (InfoByte) {
 222         PrintAndLogEx(NORMAL, "Card publisher sector: 0x%02x", InfoByte);
 223     } else {
 224         if (verbose)
 225             PrintAndLogEx(NORMAL, "Card publisher sector not present.");
 226     }
 227     if (InfoByte == 0x10 || InfoByte >= 0x28)
 228         PrintAndLogEx(WARNING, "Info byte error");
 229
 230     PrintAndLogEx(NORMAL, "00 MAD1");
 231     for (int i = 1; i < 16; i++) {
 232         uint16_t AID = madGetAID(sector, 1, i);
 233         PrintAndLogEx(NORMAL, "%02d [%04X] %s", i, AID, GetAIDDescription(AID));
 234     };
 235
 236     return 0;
 237 };
 238
 239 int MAD2DecodeAndPrint(uint8_t *sector, bool verbose) {
 240     PrintAndLogEx(NORMAL, "16 MAD2");
 241
 242     int res = madCRCCheck(sector, true, 2);
 243
 244     if (verbose && !res)
 245         PrintAndLogEx(NORMAL, "CRC8-MAD2 OK.");
 246
 247     uint8_t InfoByte = sector[1] & 0x3f;
 248     PrintAndLogEx(NORMAL, "MAD2 Card publisher sector: 0x%02x", InfoByte);
 249
 250     for (int i = 1; i < 8 + 8 + 7 + 1; i++) {
 251         uint16_t AID = madGetAID(sector, 2, i);
 252         PrintAndLogEx(NORMAL, "%02d [%04X] %s", i + 16, AID, GetAIDDescription(AID));
 253     };
 254
 255     return 0;
 256 };