git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhfmfdes.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2014 Iceman
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency MIFARE Desfire commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <string.h>
  14 #include <ctype.h>
  15 #include <openssl/des.h>
  16 #include "cmdmain.h"
  17 #include "proxmark3.h"
  18 #include "../include/common.h"
  19 #include "../include/mifare.h"
  20 #include "../common/iso14443crc.h"
  21 #include "data.h"
  22 #include "ui.h"
  23 #include "cmdparser.h"
  24 #include "util.h"
  25 #include "cmdhfmfdes.h"
  26
  27
  28 uint8_t key_zero_data[16] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
  29 uint8_t key_defa_data[16] = { 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f };
  30 uint8_t key_ones_data[16] = { 0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01 };
  31
  32
  33 static int CmdHelp(const char *Cmd);
  34 static void xor(unsigned char * dst, unsigned char * src, size_t len);
  35 static int32_t le24toh (uint8_t data[3]);
  36
  37
  38 int CmdHF14ADesWb(const char *Cmd)
  39 {
  40 /*      uint8_t blockNo = 0;
  41         uint8_t keyType = 0;
  42         uint8_t key[6] = {0, 0, 0, 0, 0, 0};
  43         uint8_t bldata[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
  44
  45         char cmdp       = 0x00;
  46
  47         if (strlen(Cmd)<3) {
  48                 PrintAndLog("Usage:  hf mf wrbl    <block number> <key A/B> <key (12 hex symbols)> <block data (32 hex symbols)>");
  49                 PrintAndLog("        sample: hf mf wrbl 0 A FFFFFFFFFFFF 000102030405060708090A0B0C0D0E0F");
  50                 return 0;
  51         }
  52
  53         blockNo = param_get8(Cmd, 0);
  54         cmdp = param_getchar(Cmd, 1);
  55         if (cmdp == 0x00) {
  56                 PrintAndLog("Key type must be A or B");
  57                 return 1;
  58         }
  59         if (cmdp != 'A' && cmdp != 'a') keyType = 1;
  60         if (param_gethex(Cmd, 2, key, 12)) {
  61                 PrintAndLog("Key must include 12 HEX symbols");
  62                 return 1;
  63         }
  64         if (param_gethex(Cmd, 3, bldata, 32)) {
  65                 PrintAndLog("Block data must include 32 HEX symbols");
  66                 return 1;
  67         }
  68         PrintAndLog("--block no:%02x key type:%02x key:%s", blockNo, keyType, sprint_hex(key, 6));
  69         PrintAndLog("--data: %s", sprint_hex(bldata, 16));
  70
  71   UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};
  72         memcpy(c.d.asBytes, key, 6);
  73         memcpy(c.d.asBytes + 10, bldata, 16);
  74   SendCommand(&c);
  75
  76         UsbCommand resp;
  77         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
  78                 uint8_t isOK  = resp.arg[0] & 0xff;
  79                 PrintAndLog("isOk:%02x", isOK);
  80         } else {
  81                 PrintAndLog("Command execute timeout");
  82         }
  83  */
  84         return 0;
  85 }
  86
  87 int CmdHF14ADesRb(const char *Cmd)
  88 {
  89         // uint8_t blockNo = 0;
  90         // uint8_t keyType = 0;
  91         // uint8_t key[6] = {0, 0, 0, 0, 0, 0};
  92
  93         // char cmdp    = 0x00;
  94
  95
  96         // if (strlen(Cmd)<3) {
  97                 // PrintAndLog("Usage:  hf mf rdbl    <block number> <key A/B> <key (12 hex symbols)>");
  98                 // PrintAndLog("        sample: hf mf rdbl 0 A FFFFFFFFFFFF ");
  99                 // return 0;
 100         // }
 101
 102         // blockNo = param_get8(Cmd, 0);
 103         // cmdp = param_getchar(Cmd, 1);
 104         // if (cmdp == 0x00) {
 105                 // PrintAndLog("Key type must be A or B");
 106                 // return 1;
 107         // }
 108         // if (cmdp != 'A' && cmdp != 'a') keyType = 1;
 109         // if (param_gethex(Cmd, 2, key, 12)) {
 110                 // PrintAndLog("Key must include 12 HEX symbols");
 111                 // return 1;
 112         // }
 113         // PrintAndLog("--block no:%02x key type:%02x key:%s ", blockNo, keyType, sprint_hex(key, 6));
 114
 115   // UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};
 116         // memcpy(c.d.asBytes, key, 6);
 117   // SendCommand(&c);
 118
 119         // UsbCommand resp;
 120         // if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 121                 // uint8_t                isOK  = resp.arg[0] & 0xff;
 122                 // uint8_t              * data  = resp.d.asBytes;
 123
 124                 // if (isOK)
 125                         // PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 16));
 126                 // else
 127                         // PrintAndLog("isOk:%02x", isOK);
 128         // } else {
 129                 // PrintAndLog("Command execute timeout");
 130         // }
 131
 132   return 0;
 133 }
 134
 135 int CmdHF14ADesInfo(const char *Cmd){
 136
 137         UsbCommand c = {CMD_MIFARE_DESFIRE_INFO, { 0x00 }};
 138
 139     SendCommand(&c);
 140         UsbCommand resp;
 141
 142         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 143                 uint8_t isOK  = resp.arg[0] & 0xff;
 144                 PrintAndLog("isOk:%02x", isOK);
 145         } else {
 146                 PrintAndLog("Command execute timeout");
 147                 return 0;
 148         }
 149
 150         PrintAndLog("---Desfire Information---------------------------------------");
 151         PrintAndLog("-------------------------------------------------------------");
 152         PrintAndLog("  UID                : %s",sprint_hex(resp.d.asBytes, 7));
 153         PrintAndLog("  Batch number       : %s",sprint_hex(resp.d.asBytes+28,5));
 154         PrintAndLog("  Production date    : week %02x, 20%02x",resp.d.asBytes[33], resp.d.asBytes[34]);
 155         PrintAndLog("-------------------------------------------------------------");
 156         PrintAndLog("  Hardware Information");
 157         PrintAndLog("      Vendor Id      : %s", GetVendorStr(resp.d.asBytes[7]));
 158         PrintAndLog("      Type           : 0x%02X",resp.d.asBytes[8]);
 159         PrintAndLog("      Subtype        : 0x%02X",resp.d.asBytes[9]);
 160         PrintAndLog("      Version        : %d.%d",resp.d.asBytes[10], resp.d.asBytes[11]);
 161         PrintAndLog("      Storage size   : %s",GetCardSizeStr(resp.d.asBytes[12]));
 162         PrintAndLog("      Protocol       : %s",GetProtocolStr(resp.d.asBytes[13]));
 163         PrintAndLog("-------------------------------------------------------------");
 164         PrintAndLog("  Software Information");
 165         PrintAndLog("      Vendor Id      : %s",GetVendorStr(resp.d.asBytes[14]));
 166         PrintAndLog("      Type           : 0x%02X",resp.d.asBytes[15]);
 167         PrintAndLog("      Subtype        : 0x%02X",resp.d.asBytes[16]);
 168         PrintAndLog("      Version        : %d.%d",resp.d.asBytes[17], resp.d.asBytes[18]);
 169         PrintAndLog("      storage size   : %s", GetCardSizeStr(resp.d.asBytes[19]));
 170         PrintAndLog("      Protocol       : %s", GetProtocolStr(resp.d.asBytes[20]));
 171         PrintAndLog("-------------------------------------------------------------");
 172
 173         PrintAndLog("  Master Key settings");
 174         if (  resp.d.asBytes[35] & (1 << 3 ) )
 175                 PrintAndLog("     0x08 Configuration changeable;");
 176         else
 177                 PrintAndLog("     0x08 Configuration NOT changeable;");
 178
 179         if (  resp.d.asBytes[35] & (1 << 2 ) )
 180                 PrintAndLog("     0x04 PICC Master Key not required for create / delete;");
 181         else
 182                 PrintAndLog("     0x04 PICC Master Key required for create / delete;");
 183
 184         if (  resp.d.asBytes[35] & (1 << 1 ) )
 185                 PrintAndLog("     0x02 Free directory list access without PICC Master Key;");
 186         else
 187                 PrintAndLog("     0x02 Directory list access with PICC Master Key;");
 188
 189         if (  resp.d.asBytes[35] & (1 << 0 ) )
 190                 PrintAndLog("     0x01 Allow changing the Master Key;");
 191         else
 192                 PrintAndLog("     0x01 Master Key is not changeable anymore;");
 193
 194                 PrintAndLog("");
 195                 PrintAndLog("     Max number of keys  : %d", resp.d.asBytes[36]);
 196                 PrintAndLog("     Master key Version  : %d (0x%02x)", resp.d.asBytes[37], resp.d.asBytes[37]);
 197         PrintAndLog("-------------------------------------------------------------");
 198
 199         uint8_t tmp[3];
 200         memcpy(tmp, resp.d.asBytes+38,3);
 201
 202         PrintAndLog("     Free memory on card : %d bytes", le24toh( tmp ));
 203         PrintAndLog("-------------------------------------------------------------");
 204         /*
 205                 Card Master key (CMK)  0x00 on AID = 00 00 00 (card level)
 206                 0x1
 207
 208                 Application Master Key (AMK) 0x00 on AID != 00 00 00
 209                 Application keys (APK) = 0x01-0x0D
 210                 Application free = 0x0E
 211                 Application never = 0x0F
 212
 213                 ACCESS RIGHTS:
 214                 keys 0,1,2,3     C
 215                 keys 4,5,6,7     RW
 216                 keys 8,9,10,11   W
 217                 keys 12,13,14,15 R
 218
 219                 KEY Versioning.
 220                         Se GetKeyVersion (samma nyckel kan ha olika versionen?)
 221
 222                 Session key:
 223                         16 : RndA(byte0-byte3) + RndB(byte0-byte3) + RndA(byte4-byte7) + RndB(byte4-byte7)
 224                         8  : RndA(byte0-byte3) + RndB(byte0-byte3)
 225
 226                         AES 16 : RndA(byte0-byte3) + RndB(byte0-byte3) + RndA(byte12-byte15) + RndB(byte12-byte15)
 227         */
 228
 229         PrintAndLog(" RX :%s",sprint_hex(resp.d.asBytes, 40));
 230     return 1;
 231 }
 232
 233 char * GetVendorStr( uint8_t id){
 234         static char buf[30];
 235         char *retStr = buf;
 236
 237         if ( id == 0x04 )
 238                 sprintf(retStr, "0x%02X (NXP)",id);
 239         else
 240                 sprintf(retStr,"0x%02X (Unknown)",id);
 241         return buf;
 242 }
 243
 244 /*
 245   The 7 MSBits (= n) code the storage size itself based on 2^n,
 246   the LSBit is set to '0' if the size is exactly 2^n
 247         and set to '1' if the storage size is between 2^n and 2^(n+1).
 248         For this version of DESFire the 7 MSBits are set to 0x0C (2^12 = 4096) and the LSBit is '0'.
 249 */
 250 char * GetCardSizeStr( uint8_t fsize ){
 251
 252         static char buf[30];
 253         char *retStr = buf;
 254
 255         uint16_t usize = 1 << ((fsize >>1) + 1);
 256         uint16_t lsize = 1 << (fsize >>1);
 257
 258         // is  LSB set?
 259         if (  fsize & (1 << 0 ) )
 260                 sprintf(retStr, "0x%02X (%d - %d bytes)",fsize, usize, lsize);
 261         else
 262                 sprintf(retStr, "0x%02X (%d bytes)", fsize, lsize);
 263         return buf;
 264 }
 265
 266 char * GetProtocolStr(uint8_t id){
 267
 268         static char buf[30];
 269         char *retStr = buf;
 270
 271         if ( id == 0x05)
 272                 sprintf(retStr,"0x%02X (ISO 14443-3, 14443-4)", id);
 273         else
 274                 sprintf(retStr,"0x%02X", id);
 275         return buf;
 276 }
 277
 278 int CmdHF14ADesEnumApplications(const char *Cmd){
 279         return 1;
 280 }
 281
 282 int CmdHF14ADesNonces(const char *Cmd){
 283         return 1;
 284 }
 285
 286 //
 287 // MIAFRE DesFire Authentication
 288 //
 289 #define BUFSIZE 64
 290 int CmdHF14ADesAuth(const char *Cmd){
 291
 292         // NR  DESC             KEYLENGHT
 293         // ------------------------
 294         // 1 = DES              8
 295         // 2 = 3DES             16
 296         // 3 = 3K 3DES  24
 297         // 4 = AES              16
 298
 299         // AUTHENTICTION MODES:
 300         // 1 Normal
 301         // 2 ISO
 302         // 3 AES
 303
 304         uint8_t keylength = 8;
 305         //unsigned char testinput[] = { 0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xdd,0xee,0xff,0x00};
 306         unsigned char key[24]; // =       { 0x75,0x28,0x78,0x39,0x74,0x93,0xCB,0x70};
 307
 308     if (strlen(Cmd)<3) {
 309         PrintAndLog("Usage:  hf mfdes auth <1|2|3> <1|2|3|4> <keyno> <key> ");
 310                 PrintAndLog("               AUTH modes 1 = normal, 2 = iso, 3 = aes");
 311                 PrintAndLog("               Crypto: 1 = DES 2 = 3DES 3 = 3K3DES 4 = AES");
 312                 PrintAndLog("               keynumber");
 313         PrintAndLog("        sample: hf mfdes auth 1 1 0 11223344");
 314         return 0;
 315     }
 316         uint8_t cmdAuthMode     = param_get8(Cmd,0);
 317         uint8_t cmdAuthAlgo     = param_get8(Cmd,1);
 318         uint8_t cmdKeyNo        = param_get8(Cmd,2);
 319
 320         switch (cmdAuthMode)
 321         {
 322                 case 1:
 323                         if ( cmdAuthAlgo != 1 && cmdAuthAlgo != 2) {
 324                                 PrintAndLog("Crypto algo not valid for the auth mode");
 325                                 return 1;
 326                         }
 327                         break;
 328                 case 2:
 329                         if ( cmdAuthAlgo != 1 && cmdAuthAlgo != 2 && cmdAuthAlgo != 3) {
 330                                 PrintAndLog("Crypto algo not valid for the auth mode");
 331                                 return 1;
 332                         }
 333                         break;
 334                 case 3:
 335                         if ( cmdAuthAlgo != 4) {
 336                                 PrintAndLog("Crypto algo not valid for the auth mode");
 337                                 return 1;
 338                         }
 339                         break;
 340                 default:
 341                         PrintAndLog("Wrong Auth mode");
 342                         return 1;
 343                         break;
 344         }
 345
 346         switch (cmdAuthAlgo){
 347                 case 2:
 348                         keylength = 16;
 349                         PrintAndLog("3DES selected");
 350                         break;
 351                 case 3:
 352                         keylength = 24;
 353                         PrintAndLog("3 key 3DES selected");
 354                         break;
 355                 case 4:
 356                         keylength = 16;
 357                         PrintAndLog("AES selected");
 358                         break;
 359                 default:
 360                         cmdAuthAlgo = 1;
 361                         keylength = 8;
 362                         PrintAndLog("DES selected");
 363                         break;
 364         }
 365
 366         // key
 367         if (param_gethex(Cmd, 3, key, keylength*2)) {
 368                 PrintAndLog("Key must include %d HEX symbols", keylength);
 369                 return 1;
 370         }
 371         // algo, nyckellängd,
 372         UsbCommand c = {CMD_MIFARE_DESFIRE_AUTH1, { cmdAuthMode, cmdAuthAlgo, cmdKeyNo }};
 373
 374         c.d.asBytes[0] = keylength;
 375         memcpy(c.d.asBytes+1, key, keylength);
 376         //memcpy(c.d.asBytes + 30, testinput, keylength);
 377
 378     SendCommand(&c);
 379         UsbCommand resp;
 380
 381         if (WaitForResponseTimeout(CMD_ACK,&resp,3000)) {
 382                 uint8_t isOK  = resp.arg[0] & 0xff;
 383                 PrintAndLog("isOk:%02x", isOK);
 384
 385         } else {
 386                 PrintAndLog("Command execute timeout");
 387                 return 0;
 388         }
 389
 390         uint8_t * data= resp.d.asBytes;
 391
 392         // PrintAndLog("-------------------------------------------------------------");
 393          PrintAndLog("  Key        :%s",sprint_hex(key, keylength));
 394         // PrintAndLog("  Plain      :%s",sprint_hex(testinput, keylength));
 395         PrintAndLog("  Encoded    :%s",sprint_hex(data, keylength));
 396         PrintAndLog("-------------------------------------------------------------");
 397         //PrintAndLog("  Expected   :B5 21 9E E8 1A A7 49 9D 21 96 68 7E 13 97 38 56");
 398
 399     return 1;
 400 }
 401
 402
 403 static void xor(unsigned char * dst, unsigned char * src, size_t len) {
 404    for( ; len > 0; len--,dst++,src++)
 405        *dst ^= *src;
 406 }
 407
 408 static int32_t le24toh (uint8_t data[3]) {
 409     return (data[2] << 16) | (data[1] << 8) | data[0];
 410 }
 411
 412 static command_t CommandTable[] =
 413 {
 414   {"help",              CmdHelp,                                        1, "This help"},
 415   {"auth",              CmdHF14ADesAuth,                        0, "Tries a MIFARE DesFire Authentication"},
 416   {"rb",                CmdHF14ADesRb,                          0, "Read MIFARE DesFire block"},
 417   {"wb",                CmdHF14ADesWb,                          0, "write MIFARE DesFire block"},
 418   {"info",              CmdHF14ADesInfo,                        0, "Get MIFARE DesFire information"},
 419   {"enum",              CmdHF14ADesEnumApplications,0, "Tries enumerate all applications"},
 420   {"nonce",             CmdHF14ADesNonces,                      0, "<n> Collect n>0 nonces"},
 421   {NULL, NULL, 0, NULL}
 422 };
 423
 424 int CmdHFMFDes(const char *Cmd)
 425 {
 426    // flush
 427    WaitForResponseTimeout(CMD_ACK,NULL,100);
 428    CmdsParse(CommandTable, Cmd);
 429   return 0;
 430 }
 431
 432 int CmdHelp(const char *Cmd)
 433 {
 434   CmdsHelp(CommandTable);
 435   return 0;
 436 }