]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhficlass.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
FIX: Coverity, Dereference null return, CID #212329, filehandle could be NULL
[proxmark3-svn] / client / cmdhficlass.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3 // Copyright (C) 2011 Gerhard de Koning Gans
4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // High frequency iClass commands
11 //-----------------------------------------------------------------------------
12
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <sys/stat.h>
17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18 #include "data.h"
19 #include "proxmark3.h"
20 #include "ui.h"
21 #include "cmdparser.h"
22 #include "cmdhficlass.h"
23 #include "common.h"
24 #include "util.h"
25 #include "cmdmain.h"
26 #include "loclass/des.h"
27 #include "loclass/cipherutils.h"
28 #include "loclass/cipher.h"
29 #include "loclass/ikeys.h"
30 #include "loclass/elite_crack.h"
31 #include "loclass/fileutils.h"
32 #include "protocols.h"
33 #include "usb_cmd.h"
34 #include "cmdhfmfu.h"
35 #include "cmdhf.h"
36
37 #define llX PRIx64
38
39 static int CmdHelp(const char *Cmd);
40
41 #define ICLASS_KEYS_MAX 8
42 static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
49 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
50 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
51 };
52
53 typedef struct iclass_block {
54 uint8_t d[8];
55 } iclass_block_t;
56
57 int xorbits_8(uint8_t val) {
58 uint8_t res = val ^ (val >> 1); //1st pass
59 res = res ^ (res >> 1); // 2nd pass
60 res = res ^ (res >> 2); // 3rd pass
61 res = res ^ (res >> 4); // 4th pass
62 return res & 1;
63 }
64
65 int CmdHFiClassList(const char *Cmd) {
66 //PrintAndLog("Deprecated command, use 'hf list iclass' instead");
67 CmdHFList("iclass");
68 return 0;
69 }
70
71 int CmdHFiClassSnoop(const char *Cmd) {
72 UsbCommand c = {CMD_SNOOP_ICLASS};
73 SendCommand(&c);
74 return 0;
75 }
76
77 int usage_hf_iclass_sim(void) {
78 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
79 PrintAndLog(" options");
80 PrintAndLog(" 0 <CSN> simulate the given CSN");
81 PrintAndLog(" 1 simulate default CSN");
82 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
83 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
84 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
85 PrintAndLog(" example: hf iclass sim 2");
86 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
87 PrintAndLog(" hf iclass sim 3");
88 return 0;
89 }
90
91 #define NUM_CSNS 15
92 int CmdHFiClassSim(const char *Cmd) {
93 uint8_t simType = 0;
94 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
95
96 if (strlen(Cmd)<1) {
97 return usage_hf_iclass_sim();
98 }
99 simType = param_get8ex(Cmd, 0, 0, 10);
100
101 if(simType == 0)
102 {
103 if (param_gethex(Cmd, 1, CSN, 16)) {
104 PrintAndLog("A CSN should consist of 16 HEX symbols");
105 return usage_hf_iclass_sim();
106 }
107
108 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
109 }
110 if(simType > 3)
111 {
112 PrintAndLog("Undefined simptype %d", simType);
113 return usage_hf_iclass_sim();
114 }
115
116 uint8_t numberOfCSNs=0;
117 if(simType == 2)
118 {
119 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
120 UsbCommand resp = {0};
121
122 uint8_t csns[8*NUM_CSNS] = {
123 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
136 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
137 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
138
139 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
140
141 SendCommand(&c);
142 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
143 PrintAndLog("Command timed out");
144 return 0;
145 }
146
147 uint8_t num_mac_responses = resp.arg[1];
148 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
149
150 size_t datalen = NUM_CSNS*24;
151 /*
152 * Now, time to dump to file. We'll use this format:
153 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
154 * So, it should wind up as
155 * 8 * 24 bytes.
156 *
157 * The returndata from the pm3 is on the following format
158 * <4 byte NR><4 byte MAC>
159 * CC are all zeroes, CSN is the same as was sent in
160 **/
161 void* dump = malloc(datalen);
162 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
163 uint8_t i = 0;
164 for(i = 0 ; i < NUM_CSNS ; i++)
165 {
166 memcpy(dump+i*24, csns+i*8,8); //CSN
167 //8 zero bytes here...
168 //Then comes NR_MAC (eight bytes from the response)
169 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
170
171 }
172 /** Now, save to dumpfile **/
173 saveFile("iclass_mac_attack", "bin", dump,datalen);
174 free(dump);
175 }else
176 {
177 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
178 memcpy(c.d.asBytes, CSN, 8);
179 SendCommand(&c);
180 }
181
182 return 0;
183 }
184
185 int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
186 bool tagFound = false;
187 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
188 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
189 // loop in client not device - else on windows have a communication error
190 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
191 UsbCommand resp;
192 while(!ukbhit()){
193 SendCommand(&c);
194 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
195 uint8_t readStatus = resp.arg[0] & 0xff;
196 uint8_t *data = resp.d.asBytes;
197
198 if (verbose)
199 PrintAndLog("Readstatus:%02x", readStatus);
200 if( readStatus == 0){
201 //Aborted
202 if (verbose) PrintAndLog("Quitting...");
203 return 0;
204 }
205 if( readStatus & FLAG_ICLASS_READER_CSN){
206 PrintAndLog("CSN: %s",sprint_hex(data,8));
207 tagFound = true;
208 }
209 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
210 if( readStatus & FLAG_ICLASS_READER_CONF){
211 printIclassDumpInfo(data);
212 }
213 if (tagFound && !loop) return 1;
214 } else {
215 if (verbose) PrintAndLog("Command execute timeout");
216 }
217 if (!loop) break;
218 }
219 return 0;
220 }
221
222 int CmdHFiClassReader(const char *Cmd) {
223 return HFiClassReader(Cmd, true, true);
224 }
225
226 int CmdHFiClassReader_Replay(const char *Cmd) {
227 uint8_t readerType = 0;
228 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
229
230 if (strlen(Cmd)<1) {
231 PrintAndLog("Usage: hf iclass replay <MAC>");
232 PrintAndLog(" sample: hf iclass replay 00112233");
233 return 0;
234 }
235
236 if (param_gethex(Cmd, 0, MAC, 8)) {
237 PrintAndLog("MAC must include 8 HEX symbols");
238 return 1;
239 }
240
241 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
242 memcpy(c.d.asBytes, MAC, 4);
243 SendCommand(&c);
244
245 return 0;
246 }
247
248 int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
249 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
250 memcpy(c.d.asBytes, data, blocksCount * 16);
251 SendCommand(&c);
252 return 0;
253 }
254
255 int hf_iclass_eload_usage(void) {
256 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
257 PrintAndLog("Usage: hf iclass eload f <filename>");
258 PrintAndLog("");
259 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
260 return 0;
261 }
262
263 int CmdHFiClassELoad(const char *Cmd) {
264
265 char opt = param_getchar(Cmd, 0);
266 if (strlen(Cmd)<1 || opt == 'h')
267 return hf_iclass_eload_usage();
268
269 //File handling and reading
270 FILE *f;
271 char filename[FILE_PATH_SIZE];
272 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
273 f = fopen(filename, "rb");
274 } else {
275 return hf_iclass_eload_usage();
276 }
277
278 if(!f) {
279 PrintAndLog("Failed to read from file '%s'", filename);
280 return 1;
281 }
282
283 fseek(f, 0, SEEK_END);
284 long fsize = ftell(f);
285 fseek(f, 0, SEEK_SET);
286
287 if (fsize < 0) {
288 prnlog("Error, when getting filesize");
289 fclose(f);
290 return 1;
291 }
292
293 uint8_t *dump = malloc(fsize);
294
295 size_t bytes_read = fread(dump, 1, fsize, f);
296 fclose(f);
297
298 printIclassDumpInfo(dump);
299 //Validate
300
301 if (bytes_read < fsize)
302 {
303 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
304 free(dump);
305 return 1;
306 }
307 //Send to device
308 uint32_t bytes_sent = 0;
309 uint32_t bytes_remaining = bytes_read;
310
311 while(bytes_remaining > 0){
312 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
313 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
314 memcpy(c.d.asBytes, dump, bytes_in_packet);
315 SendCommand(&c);
316 bytes_remaining -= bytes_in_packet;
317 bytes_sent += bytes_in_packet;
318 }
319 free(dump);
320 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
321 return 0;
322 }
323
324 static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
325 FILE *f = fopen(filename, "rb");
326 if(!f) {
327 PrintAndLog("Failed to read from file '%s'", filename);
328 return 1;
329 }
330 fseek(f, 0, SEEK_END);
331 long fsize = ftell(f);
332 fseek(f, 0, SEEK_SET);
333 size_t bytes_read = fread(buffer, 1, len, f);
334 fclose(f);
335 if(fsize != len)
336 {
337 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
338 return 1;
339 }
340 if(bytes_read != len)
341 {
342 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
343 return 1;
344 }
345 return 0;
346 }
347
348 int usage_hf_iclass_decrypt(void) {
349 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
350 PrintAndLog("");
351 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
352 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
353 PrintAndLog("");
354 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
355 PrintAndLog("");
356 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
357 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
358 PrintAndLog("which is defined by the configuration block.");
359 return 1;
360 }
361
362 int CmdHFiClassDecrypt(const char *Cmd) {
363 uint8_t key[16] = { 0 };
364 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
365 {
366 usage_hf_iclass_decrypt();
367 return 1;
368 }
369 PrintAndLog("Decryption file found... ");
370 char opt = param_getchar(Cmd, 0);
371 if (strlen(Cmd)<1 || opt == 'h')
372 return usage_hf_iclass_decrypt();
373
374 //Open the tagdump-file
375 FILE *f;
376 char filename[FILE_PATH_SIZE];
377 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
378 if ( (f = fopen(filename, "rb")) == NULL) {
379 PrintAndLog("Could not find file %s", filename);
380 return 1;
381 }
382
383 } else {
384 return usage_hf_iclass_decrypt();
385 }
386
387 fseek(f, 0, SEEK_END);
388 long fsize = ftell(f);
389 fseek(f, 0, SEEK_SET);
390 uint8_t enc_dump[8] = {0};
391 uint8_t *decrypted = malloc(fsize);
392 des3_context ctx = { DES_DECRYPT ,{ 0 } };
393 des3_set2key_dec( &ctx, key);
394 size_t bytes_read = fread(enc_dump, 1, 8, f);
395
396 //Use the first block (CSN) for filename
397 char outfilename[FILE_PATH_SIZE] = { 0 };
398 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
399 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
400 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
401
402 size_t blocknum =0;
403 while(bytes_read == 8)
404 {
405 if(blocknum < 7)
406 {
407 memcpy(decrypted+(blocknum*8), enc_dump, 8);
408 }else{
409 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
410 }
411 printvar("decrypted block", decrypted +(blocknum*8), 8);
412 bytes_read = fread(enc_dump, 1, 8, f);
413 blocknum++;
414 }
415 fclose(f);
416
417 saveFile(outfilename,"bin", decrypted, blocknum*8);
418
419 free(decrypted);
420 return 0;
421 }
422
423 int usage_hf_iclass_encrypt(void) {
424 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
425 PrintAndLog("");
426 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
427 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
428 PrintAndLog("");
429 PrintAndLog("example: hf iclass encrypt 0102030405060708");
430 PrintAndLog("");
431 return 0;
432 }
433
434 static int iClassEncryptBlkData(uint8_t *blkData) {
435 uint8_t key[16] = { 0 };
436 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
437 {
438 usage_hf_iclass_encrypt();
439 return 1;
440 }
441 PrintAndLog("Decryption file found... ");
442
443 uint8_t encryptedData[16];
444 uint8_t *encrypted = encryptedData;
445 des3_context ctx = { DES_DECRYPT ,{ 0 } };
446 des3_set2key_enc( &ctx, key);
447
448 des3_crypt_ecb(&ctx, blkData,encrypted);
449 //printvar("decrypted block", decrypted, 8);
450 memcpy(blkData,encrypted,8);
451
452 return 1;
453 }
454
455 int CmdHFiClassEncryptBlk(const char *Cmd) {
456 uint8_t blkData[8] = {0};
457 char opt = param_getchar(Cmd, 0);
458 if (strlen(Cmd)<1 || opt == 'h')
459 return usage_hf_iclass_encrypt();
460
461 //get the bytes to encrypt
462 if (param_gethex(Cmd, 0, blkData, 16))
463 {
464 PrintAndLog("BlockData must include 16 HEX symbols");
465 return 0;
466 }
467 if (!iClassEncryptBlkData(blkData)) return 0;
468
469 printvar("encrypted block", blkData, 8);
470 return 1;
471 }
472
473 void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
474 uint8_t WB[9];
475 WB[0] = blockno;
476 memcpy(WB + 1,data,8);
477 doMAC_N(WB,sizeof(WB),div_key,MAC);
478 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
479 }
480
481 static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
482 UsbCommand resp;
483
484 UsbCommand c = {CMD_READER_ICLASS, {0}};
485 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
486 if (use_credit_key)
487 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
488
489 clearCommandBuffer();
490 SendCommand(&c);
491 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
492 {
493 PrintAndLog("Command execute timeout");
494 return false;
495 }
496
497 uint8_t isOK = resp.arg[0] & 0xff;
498 uint8_t *data = resp.d.asBytes;
499
500 memcpy(CSN,data,8);
501 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
502 if(isOK > 0)
503 {
504 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
505 }
506 if(isOK <= 1){
507 PrintAndLog("Failed to obtain CC! Aborting");
508 return false;
509 }
510 return true;
511 }
512
513 static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
514 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
515 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
516
517 if (!select_only(CSN, CCNR, use_credit_key, verbose))
518 return false;
519
520 //get div_key
521 if(rawkey)
522 memcpy(div_key, KEY, 8);
523 else
524 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
525 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
526
527 doMAC(CCNR, div_key, MAC);
528 UsbCommand resp;
529 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
530 memcpy(d.d.asBytes, MAC, 4);
531 clearCommandBuffer();
532 SendCommand(&d);
533 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
534 {
535 PrintAndLog("Auth Command execute timeout");
536 return false;
537 }
538 uint8_t isOK = resp.arg[0] & 0xff;
539 if (!isOK) {
540 PrintAndLog("Authentication error");
541 return false;
542 }
543 return true;
544 }
545
546 int usage_hf_iclass_dump(void) {
547 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
548 PrintAndLog("Options:");
549 PrintAndLog(" f <filename> : specify a filename to save dump to");
550 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
551 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
552 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
553 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
554 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
555 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
556 PrintAndLog(" NOTE: * = required");
557 PrintAndLog("Samples:");
558 PrintAndLog(" hf iclass dump k 001122334455667B");
559 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
560 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
561 return 0;
562 }
563
564 int CmdHFiClassReader_Dump(const char *Cmd) {
565
566 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
567 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
568 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
569 uint8_t blockno = 0;
570 uint8_t numblks = 0;
571 uint8_t maxBlk = 31;
572 uint8_t app_areas = 1;
573 uint8_t kb = 2;
574 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
575 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
576 uint8_t keyNbr = 0;
577 uint8_t dataLen = 0;
578 uint8_t fileNameLen = 0;
579 char filename[FILE_PATH_SIZE]={0};
580 char tempStr[50] = {0};
581 bool have_debit_key = false;
582 bool have_credit_key = false;
583 bool use_credit_key = false;
584 bool elite = false;
585 bool rawkey = false;
586 bool errors = false;
587 uint8_t cmdp = 0;
588
589 while(param_getchar(Cmd, cmdp) != 0x00)
590 {
591 switch(param_getchar(Cmd, cmdp))
592 {
593 case 'h':
594 case 'H':
595 return usage_hf_iclass_dump();
596 case 'c':
597 case 'C':
598 have_credit_key = true;
599 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
600 if (dataLen == 16) {
601 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
602 } else if (dataLen == 1) {
603 keyNbr = param_get8(Cmd, cmdp+1);
604 if (keyNbr <= ICLASS_KEYS_MAX) {
605 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
606 } else {
607 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
608 errors = true;
609 }
610 } else {
611 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
612 errors = true;
613 }
614 cmdp += 2;
615 break;
616 case 'e':
617 case 'E':
618 elite = true;
619 cmdp++;
620 break;
621 case 'f':
622 case 'F':
623 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
624 if (fileNameLen < 1) {
625 PrintAndLog("No filename found after f");
626 errors = true;
627 }
628 cmdp += 2;
629 break;
630 case 'k':
631 case 'K':
632 have_debit_key = true;
633 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
634 if (dataLen == 16) {
635 errors = param_gethex(tempStr, 0, KEY, dataLen);
636 } else if (dataLen == 1) {
637 keyNbr = param_get8(Cmd, cmdp+1);
638 if (keyNbr <= ICLASS_KEYS_MAX) {
639 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
640 } else {
641 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
642 errors = true;
643 }
644 } else {
645 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
646 errors = true;
647 }
648 cmdp += 2;
649 break;
650 case 'r':
651 case 'R':
652 rawkey = true;
653 cmdp++;
654 break;
655 default:
656 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
657 errors = true;
658 break;
659 }
660 if(errors) return usage_hf_iclass_dump();
661 }
662
663 if (cmdp < 2) return usage_hf_iclass_dump();
664 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
665 if (!have_debit_key && have_credit_key) use_credit_key = true;
666
667 //get config and first 3 blocks
668 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
669 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
670 UsbCommand resp;
671 uint8_t tag_data[255*8];
672
673 clearCommandBuffer();
674 SendCommand(&c);
675 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
676 PrintAndLog("Command execute timeout");
677 ul_switch_off_field();
678 return 0;
679 }
680 uint8_t readStatus = resp.arg[0] & 0xff;
681 uint8_t * data = resp.d.asBytes;
682
683 if(readStatus == 0){
684 PrintAndLog("No tag found...");
685 ul_switch_off_field();
686 return 0;
687 }
688 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
689 memcpy(tag_data, data, 8*3);
690 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
691 numblks = data[8];
692 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
693 // large memory - not able to dump pages currently
694 if (numblks > maxBlk) numblks = maxBlk;
695 }
696 ul_switch_off_field();
697 // authenticate debit key and get div_key - later store in dump block 3
698 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
699 //try twice - for some reason it sometimes fails the first time...
700 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
701 ul_switch_off_field();
702 return 0;
703 }
704 }
705
706 // begin dump
707 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
708 clearCommandBuffer();
709 SendCommand(&w);
710 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
711 PrintAndLog("Command execute time-out 1");
712 ul_switch_off_field();
713 return 1;
714 }
715 uint32_t blocksRead = resp.arg[1];
716 uint8_t isOK = resp.arg[0] & 0xff;
717 if (!isOK && !blocksRead) {
718 PrintAndLog("Read Block Failed");
719 ul_switch_off_field();
720 return 0;
721 }
722 uint32_t startindex = resp.arg[2];
723 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
724 PrintAndLog("Data exceeded Buffer size!");
725 blocksRead = (sizeof(tag_data)/8) - blockno;
726 }
727 // response ok - now get bigbuf content of the dump
728 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
729 WaitForResponse(CMD_ACK,NULL);
730 size_t gotBytes = blocksRead*8 + blockno*8;
731
732 // try AA2
733 if (have_credit_key) {
734 //turn off hf field before authenticating with different key
735 ul_switch_off_field();
736 memset(MAC,0,4);
737 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
738 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
739 //try twice - for some reason it sometimes fails the first time...
740 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
741 ul_switch_off_field();
742 return 0;
743 }
744 }
745 // do we still need to read more block? (aa2 enabled?)
746 if (maxBlk > blockno+numblks+1) {
747 // setup dump and start
748 w.arg[0] = blockno + blocksRead;
749 w.arg[1] = maxBlk - (blockno + blocksRead);
750 clearCommandBuffer();
751 SendCommand(&w);
752 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
753 PrintAndLog("Command execute timeout 2");
754 ul_switch_off_field();
755 return 0;
756 }
757 uint8_t isOK = resp.arg[0] & 0xff;
758 blocksRead = resp.arg[1];
759 if (!isOK && !blocksRead) {
760 PrintAndLog("Read Block Failed 2");
761 ul_switch_off_field();
762 return 0;
763 }
764
765 startindex = resp.arg[2];
766 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
767 PrintAndLog("Data exceeded Buffer size!");
768 blocksRead = (sizeof(tag_data) - gotBytes)/8;
769 }
770 // get dumped data from bigbuf
771 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
772 WaitForResponse(CMD_ACK,NULL);
773
774 gotBytes += blocksRead*8;
775 } else { //field is still on - turn it off...
776 ul_switch_off_field();
777 }
778 }
779
780 // add diversified keys to dump
781 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
782 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
783 // print the dump
784 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
785 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
786 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
787
788 if (filename[0] == 0){
789 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
790 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
791 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
792 }
793
794 // save the dump to .bin file
795 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
796 saveFile(filename, "bin", tag_data, gotBytes);
797 return 1;
798 }
799
800 static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
801 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
802 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
803 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
804 return 0;
805
806 UsbCommand resp;
807
808 Calc_wb_mac(blockno,bldata,div_key,MAC);
809 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
810 memcpy(w.d.asBytes, bldata, 8);
811 memcpy(w.d.asBytes + 8, MAC, 4);
812
813 clearCommandBuffer();
814 SendCommand(&w);
815 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
816 {
817 PrintAndLog("Write Command execute timeout");
818 return 0;
819 }
820 uint8_t isOK = resp.arg[0] & 0xff;
821 if (!isOK) {
822 PrintAndLog("Write Block Failed");
823 return 0;
824 }
825 PrintAndLog("Write Block Successful");
826 return 1;
827 }
828
829 int usage_hf_iclass_writeblock(void) {
830 PrintAndLog("Options:");
831 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
832 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
833 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
834 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
835 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
836 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
837 PrintAndLog("Samples:");
838 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
839 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
840 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
841 return 0;
842 }
843
844 int CmdHFiClass_WriteBlock(const char *Cmd) {
845 uint8_t blockno=0;
846 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
847 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
848 uint8_t keyNbr = 0;
849 uint8_t dataLen = 0;
850 char tempStr[50] = {0};
851 bool use_credit_key = false;
852 bool elite = false;
853 bool rawkey= false;
854 bool errors = false;
855 uint8_t cmdp = 0;
856 while(param_getchar(Cmd, cmdp) != 0x00)
857 {
858 switch(param_getchar(Cmd, cmdp))
859 {
860 case 'h':
861 case 'H':
862 return usage_hf_iclass_writeblock();
863 case 'b':
864 case 'B':
865 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
866 PrintAndLog("Block No must include 2 HEX symbols\n");
867 errors = true;
868 }
869 cmdp += 2;
870 break;
871 case 'c':
872 case 'C':
873 use_credit_key = true;
874 cmdp++;
875 break;
876 case 'd':
877 case 'D':
878 if (param_gethex(Cmd, cmdp+1, bldata, 16))
879 {
880 PrintAndLog("KEY must include 16 HEX symbols\n");
881 errors = true;
882 }
883 cmdp += 2;
884 break;
885 case 'e':
886 case 'E':
887 elite = true;
888 cmdp++;
889 break;
890 case 'k':
891 case 'K':
892 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
893 if (dataLen == 16) {
894 errors = param_gethex(tempStr, 0, KEY, dataLen);
895 } else if (dataLen == 1) {
896 keyNbr = param_get8(Cmd, cmdp+1);
897 if (keyNbr <= ICLASS_KEYS_MAX) {
898 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
899 } else {
900 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
901 errors = true;
902 }
903 } else {
904 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
905 errors = true;
906 }
907 cmdp += 2;
908 break;
909 case 'r':
910 case 'R':
911 rawkey = true;
912 cmdp++;
913 break;
914 default:
915 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
916 errors = true;
917 break;
918 }
919 if(errors) return usage_hf_iclass_writeblock();
920 }
921
922 if (cmdp < 6) return usage_hf_iclass_writeblock();
923 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
924 ul_switch_off_field();
925 return ans;
926 }
927
928 int usage_hf_iclass_clone(void) {
929 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
930 PrintAndLog("Options:");
931 PrintAndLog(" f <filename>: specify a filename to clone from");
932 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
933 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
934 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
935 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
936 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
937 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
938 PrintAndLog("Samples:");
939 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
940 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
941 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
942 return -1;
943 }
944
945 int CmdHFiClassCloneTag(const char *Cmd) {
946 char filename[FILE_PATH_SIZE];
947 char tempStr[50]={0};
948 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
949 uint8_t keyNbr = 0;
950 uint8_t fileNameLen = 0;
951 uint8_t startblock = 0;
952 uint8_t endblock = 0;
953 uint8_t dataLen = 0;
954 bool use_credit_key = false;
955 bool elite = false;
956 bool rawkey = false;
957 bool errors = false;
958 uint8_t cmdp = 0;
959 while(param_getchar(Cmd, cmdp) != 0x00)
960 {
961 switch(param_getchar(Cmd, cmdp))
962 {
963 case 'h':
964 case 'H':
965 return usage_hf_iclass_clone();
966 case 'b':
967 case 'B':
968 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
969 PrintAndLog("Start Block No must include 2 HEX symbols\n");
970 errors = true;
971 }
972 cmdp += 2;
973 break;
974 case 'c':
975 case 'C':
976 use_credit_key = true;
977 cmdp++;
978 break;
979 case 'e':
980 case 'E':
981 elite = true;
982 cmdp++;
983 break;
984 case 'f':
985 case 'F':
986 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
987 if (fileNameLen < 1) {
988 PrintAndLog("No filename found after f");
989 errors = true;
990 }
991 cmdp += 2;
992 break;
993 case 'k':
994 case 'K':
995 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
996 if (dataLen == 16) {
997 errors = param_gethex(tempStr, 0, KEY, dataLen);
998 } else if (dataLen == 1) {
999 keyNbr = param_get8(Cmd, cmdp+1);
1000 if (keyNbr <= ICLASS_KEYS_MAX) {
1001 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1002 } else {
1003 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1004 errors = true;
1005 }
1006 } else {
1007 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1008 errors = true;
1009 }
1010 cmdp += 2;
1011 break;
1012 case 'l':
1013 case 'L':
1014 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1015 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1016 errors = true;
1017 }
1018 cmdp += 2;
1019 break;
1020 case 'r':
1021 case 'R':
1022 rawkey = true;
1023 cmdp++;
1024 break;
1025 default:
1026 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1027 errors = true;
1028 break;
1029 }
1030 if(errors) return usage_hf_iclass_clone();
1031 }
1032
1033 if (cmdp < 8) return usage_hf_iclass_clone();
1034
1035 FILE *f;
1036
1037 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1038
1039 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1040 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1041 }
1042 // file handling and reading
1043 f = fopen(filename,"rb");
1044 if(!f) {
1045 PrintAndLog("Failed to read from file '%s'", filename);
1046 return 1;
1047 }
1048
1049 if (startblock<5) {
1050 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1051 return 0;
1052 }
1053 // now read data from the file from block 6 --- 19
1054 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1055 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1056 // else we have to create a share memory
1057 int i;
1058 fseek(f,startblock*8,SEEK_SET);
1059 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0){
1060 PrintAndLog("File reading error.");
1061 fclose(f);
1062 return 2;
1063 }
1064
1065 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1066 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1067
1068 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
1069 return 0;
1070
1071 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
1072 uint8_t *ptr;
1073 // calculate all mac for every the block we will write
1074 for (i = startblock; i <= endblock; i++){
1075 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1076 // usb command d start pointer = d + (i - 6) * 12
1077 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1078 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1079 // next one
1080 ptr = w.d.asBytes + (i - startblock) * 12;
1081 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1082 memcpy(ptr + 8,MAC, 4);
1083 }
1084 uint8_t p[12];
1085 for (i = 0; i <= endblock - startblock;i++){
1086 memcpy(p,w.d.asBytes + (i * 12),12);
1087 printf("Block |%02x|",i + startblock);
1088 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1089 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1090 }
1091 UsbCommand resp;
1092 SendCommand(&w);
1093 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1094 {
1095 PrintAndLog("Command execute timeout");
1096 return 0;
1097 }
1098 return 1;
1099 }
1100
1101 static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose) {
1102 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1103 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1104
1105 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
1106 return 0;
1107
1108 UsbCommand resp;
1109 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
1110 clearCommandBuffer();
1111 SendCommand(&w);
1112 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1113 {
1114 PrintAndLog("Command execute timeout");
1115 return 0;
1116 }
1117 uint8_t isOK = resp.arg[0] & 0xff;
1118 if (!isOK) {
1119 PrintAndLog("Read Block Failed");
1120 return 0;
1121 }
1122 //data read is stored in: resp.d.asBytes[0-15]
1123 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1124 return 1;
1125 }
1126
1127 int usage_hf_iclass_readblock(void) {
1128 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
1129 PrintAndLog("Options:");
1130 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1131 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1132 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1133 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1134 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
1135 PrintAndLog("Samples:");
1136 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1137 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1138 PrintAndLog(" hf iclass readblk b 0A k 0");
1139 return 0;
1140 }
1141
1142 int CmdHFiClass_ReadBlock(const char *Cmd) {
1143 uint8_t blockno=0;
1144 uint8_t keyType = 0x88; //debit key
1145 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1146 uint8_t keyNbr = 0;
1147 uint8_t dataLen = 0;
1148 char tempStr[50] = {0};
1149 bool elite = false;
1150 bool rawkey = false;
1151 bool errors = false;
1152 uint8_t cmdp = 0;
1153 while(param_getchar(Cmd, cmdp) != 0x00)
1154 {
1155 switch(param_getchar(Cmd, cmdp))
1156 {
1157 case 'h':
1158 case 'H':
1159 return usage_hf_iclass_readblock();
1160 case 'b':
1161 case 'B':
1162 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1163 PrintAndLog("Block No must include 2 HEX symbols\n");
1164 errors = true;
1165 }
1166 cmdp += 2;
1167 break;
1168 case 'c':
1169 case 'C':
1170 keyType = 0x18;
1171 cmdp++;
1172 break;
1173 case 'e':
1174 case 'E':
1175 elite = true;
1176 cmdp++;
1177 break;
1178 case 'k':
1179 case 'K':
1180 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1181 if (dataLen == 16) {
1182 errors = param_gethex(tempStr, 0, KEY, dataLen);
1183 } else if (dataLen == 1) {
1184 keyNbr = param_get8(Cmd, cmdp+1);
1185 if (keyNbr <= ICLASS_KEYS_MAX) {
1186 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1187 } else {
1188 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1189 errors = true;
1190 }
1191 } else {
1192 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1193 errors = true;
1194 }
1195 cmdp += 2;
1196 break;
1197 case 'r':
1198 case 'R':
1199 rawkey = true;
1200 cmdp++;
1201 break;
1202 default:
1203 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1204 errors = true;
1205 break;
1206 }
1207 if(errors) return usage_hf_iclass_readblock();
1208 }
1209
1210 if (cmdp < 4) return usage_hf_iclass_readblock();
1211
1212 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true);
1213 }
1214
1215 int CmdHFiClass_loclass(const char *Cmd) {
1216 char opt = param_getchar(Cmd, 0);
1217
1218 if (strlen(Cmd)<1 || opt == 'h') {
1219 PrintAndLog("Usage: hf iclass loclass [options]");
1220 PrintAndLog("Options:");
1221 PrintAndLog("h Show this help");
1222 PrintAndLog("t Perform self-test");
1223 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1224 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1225 PrintAndLog(" malicious CSNs, and their protocol responses");
1226 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1227 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1228 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1229 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1230 PrintAndLog(" ... totalling N*24 bytes");
1231 return 0;
1232 }
1233 char fileName[255] = {0};
1234 if(opt == 'f')
1235 {
1236 if(param_getstr(Cmd, 1, fileName) > 0)
1237 {
1238 return bruteforceFileNoKeys(fileName);
1239 }else
1240 {
1241 PrintAndLog("You must specify a filename");
1242 }
1243 }
1244 else if(opt == 't')
1245 {
1246 int errors = testCipherUtils();
1247 errors += testMAC();
1248 errors += doKeyTests(0);
1249 errors += testElite();
1250 if(errors)
1251 {
1252 prnlog("OBS! There were errors!!!");
1253 }
1254 return errors;
1255 }
1256
1257 return 0;
1258 }
1259
1260 void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1261 uint8_t blockdata[8];
1262 uint8_t mem_config;
1263 memcpy(&mem_config, iclass_dump + 13,1);
1264 uint8_t maxmemcount;
1265 uint8_t filemaxblock = filesize / 8;
1266 if (mem_config & 0x80)
1267 maxmemcount = 255;
1268 else
1269 maxmemcount = 31;
1270 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1271
1272 if (startblock == 0)
1273 startblock = 6;
1274 if ((endblock > maxmemcount) || (endblock == 0))
1275 endblock = maxmemcount;
1276 if (endblock > filemaxblock)
1277 endblock = filemaxblock;
1278 int i = startblock;
1279 int j;
1280 while (i <= endblock){
1281 printf("Block |%02X| ",i);
1282 memcpy(blockdata,iclass_dump + (i * 8),8);
1283 for (j = 0;j < 8;j++)
1284 printf("%02X ",blockdata[j]);
1285 printf("|\n");
1286 i++;
1287 }
1288 }
1289
1290 int usage_hf_iclass_readtagfile() {
1291 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1292 return 1;
1293 }
1294
1295 int CmdHFiClassReadTagFile(const char *Cmd) {
1296 int startblock = 0;
1297 int endblock = 0;
1298 char tempnum[5];
1299 FILE *f;
1300 char filename[FILE_PATH_SIZE];
1301 if (param_getstr(Cmd, 0, filename) < 1)
1302 return usage_hf_iclass_readtagfile();
1303 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1304 startblock = 0;
1305 else
1306 sscanf(tempnum,"%d",&startblock);
1307
1308 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1309 endblock = 0;
1310 else
1311 sscanf(tempnum,"%d",&endblock);
1312 // file handling and reading
1313 f = fopen(filename,"rb");
1314 if(!f) {
1315 PrintAndLog("Failed to read from file '%s'", filename);
1316 return 1;
1317 }
1318 fseek(f, 0, SEEK_END);
1319 long fsize = ftell(f);
1320 fseek(f, 0, SEEK_SET);
1321
1322 if ( fsize < 0 ) {
1323 PrintAndLog("Error, when getting filesize");
1324 fclose(f);
1325 return 1;
1326 }
1327
1328 uint8_t *dump = malloc(fsize);
1329
1330 size_t bytes_read = fread(dump, 1, fsize, f);
1331 fclose(f);
1332 uint8_t *csn = dump;
1333 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
1334 // printIclassDumpInfo(dump);
1335 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1336 free(dump);
1337 return 0;
1338 }
1339
1340 /*
1341 uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1342 uint64_t new_div = 0x00;
1343 new_div ^= sdiv;
1344 new_div ^= hdiv;
1345 return new_div;
1346 }
1347
1348 uint64_t hexarray_to_uint64(uint8_t *key) {
1349 char temp[17];
1350 uint64_t uint_key;
1351 for (int i = 0;i < 8;i++)
1352 sprintf(&temp[(i *2)],"%02X",key[i]);
1353 temp[16] = '\0';
1354 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1355 return 0;
1356 return uint_key;
1357 }
1358 */
1359 void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1360 uint8_t keytable[128] = {0};
1361 uint8_t key_index[8] = {0};
1362 if (elite) {
1363 uint8_t key_sel[8] = { 0 };
1364 uint8_t key_sel_p[8] = { 0 };
1365 hash2(KEY, keytable);
1366 hash1(CSN, key_index);
1367 for(uint8_t i = 0; i < 8 ; i++)
1368 key_sel[i] = keytable[key_index[i]] & 0xFF;
1369
1370 //Permute from iclass format to standard format
1371 permutekey_rev(key_sel, key_sel_p);
1372 diversifyKey(CSN, key_sel_p, div_key);
1373 } else {
1374 diversifyKey(CSN, KEY, div_key);
1375 }
1376 }
1377
1378 //when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1379 //calculate and return xor_div_key (ready for a key write command)
1380 //print all div_keys if verbose
1381 static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1382 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1383 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1384 //get old div key
1385 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1386 //get new div key
1387 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1388
1389 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1390 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1391 }
1392 if (verbose) {
1393 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1394 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1395 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1396 }
1397 }
1398
1399 int usage_hf_iclass_calc_newkey(void) {
1400 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1401 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1402 PrintAndLog(" Options:");
1403 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1404 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1405 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1406 PrintAndLog(" e : specify new key as elite calc");
1407 PrintAndLog(" ee : specify old and new key as elite calc");
1408 PrintAndLog("Samples:");
1409 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1410 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1411 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1412 PrintAndLog("NOTE: * = required\n");
1413
1414 return 1;
1415 }
1416
1417 int CmdHFiClassCalcNewKey(const char *Cmd) {
1418 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1419 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1420 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1421 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1422 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1423 uint8_t keyNbr = 0;
1424 uint8_t dataLen = 0;
1425 char tempStr[50] = {0};
1426 bool givenCSN = false;
1427 bool oldElite = false;
1428 bool elite = false;
1429 bool errors = false;
1430 uint8_t cmdp = 0;
1431 while(param_getchar(Cmd, cmdp) != 0x00)
1432 {
1433 switch(param_getchar(Cmd, cmdp))
1434 {
1435 case 'h':
1436 case 'H':
1437 return usage_hf_iclass_calc_newkey();
1438 case 'e':
1439 case 'E':
1440 dataLen = param_getstr(Cmd, cmdp, tempStr);
1441 if (dataLen==2)
1442 oldElite = true;
1443 elite = true;
1444 cmdp++;
1445 break;
1446 case 'n':
1447 case 'N':
1448 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1449 if (dataLen == 16) {
1450 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1451 } else if (dataLen == 1) {
1452 keyNbr = param_get8(Cmd, cmdp+1);
1453 if (keyNbr <= ICLASS_KEYS_MAX) {
1454 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1455 } else {
1456 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1457 errors = true;
1458 }
1459 } else {
1460 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1461 errors = true;
1462 }
1463 cmdp += 2;
1464 break;
1465 case 'o':
1466 case 'O':
1467 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1468 if (dataLen == 16) {
1469 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1470 } else if (dataLen == 1) {
1471 keyNbr = param_get8(Cmd, cmdp+1);
1472 if (keyNbr <= ICLASS_KEYS_MAX) {
1473 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1474 } else {
1475 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1476 errors = true;
1477 }
1478 } else {
1479 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1480 errors = true;
1481 }
1482 cmdp += 2;
1483 break;
1484 case 's':
1485 case 'S':
1486 givenCSN = true;
1487 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1488 return usage_hf_iclass_calc_newkey();
1489 cmdp += 2;
1490 break;
1491 default:
1492 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1493 errors = true;
1494 break;
1495 }
1496 if(errors) return usage_hf_iclass_calc_newkey();
1497 }
1498
1499 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1500
1501 if (!givenCSN)
1502 if (!select_only(CSN, CCNR, false, true))
1503 return 0;
1504
1505 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1506 return 0;
1507 }
1508
1509 static int loadKeys(char *filename) {
1510 FILE *f;
1511 f = fopen(filename,"rb");
1512 if(!f) {
1513 PrintAndLog("Failed to read from file '%s'", filename);
1514 return 0;
1515 }
1516 fseek(f, 0, SEEK_END);
1517 long fsize = ftell(f);
1518 fseek(f, 0, SEEK_SET);
1519
1520 if ( fsize < 0 ) {
1521 PrintAndLog("Error, when getting filesize");
1522 fclose(f);
1523 return 1;
1524 }
1525
1526 uint8_t *dump = malloc(fsize);
1527
1528 size_t bytes_read = fread(dump, 1, fsize, f);
1529 fclose(f);
1530 if (bytes_read > ICLASS_KEYS_MAX * 8){
1531 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1532 free(dump);
1533 return 0;
1534 }
1535 uint8_t i = 0;
1536 for (; i < bytes_read/8; i++){
1537 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1538 }
1539 free(dump);
1540 PrintAndLog("%u keys loaded", i);
1541 return 1;
1542 }
1543
1544 static int saveKeys(char *filename) {
1545 FILE *f;
1546 f = fopen(filename,"wb");
1547 if (f == NULL) {
1548 printf("error opening file %s\n",filename);
1549 return 0;
1550 }
1551 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1552 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1553 PrintAndLog("save key failed to write to file: %s", filename);
1554 break;
1555 }
1556 }
1557 fclose(f);
1558 return 0;
1559 }
1560
1561 static int printKeys(void) {
1562 PrintAndLog("");
1563 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1564 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1565 }
1566 PrintAndLog("");
1567 return 0;
1568 }
1569
1570 int usage_hf_iclass_managekeys(void) {
1571 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1572 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1573 PrintAndLog(" Options:");
1574 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1575 PrintAndLog(" k <key> : set a key in memory");
1576 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1577 PrintAndLog(" s : save keys in memory to file specified by filename");
1578 PrintAndLog(" l : load keys to memory from file specified by filename");
1579 PrintAndLog(" p : print keys loaded into memory\n");
1580 PrintAndLog("Samples:");
1581 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1582 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1583 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1584 PrintAndLog(" print keys : hf iclass managekeys p\n");
1585 return 0;
1586 }
1587
1588 int CmdHFiClassManageKeys(const char *Cmd) {
1589 uint8_t keyNbr = 0;
1590 uint8_t dataLen = 0;
1591 uint8_t KEY[8] = {0};
1592 char filename[FILE_PATH_SIZE];
1593 uint8_t fileNameLen = 0;
1594 bool errors = false;
1595 uint8_t operation = 0;
1596 char tempStr[20];
1597 uint8_t cmdp = 0;
1598
1599 while(param_getchar(Cmd, cmdp) != 0x00)
1600 {
1601 switch(param_getchar(Cmd, cmdp))
1602 {
1603 case 'h':
1604 case 'H':
1605 return usage_hf_iclass_managekeys();
1606 case 'f':
1607 case 'F':
1608 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1609 if (fileNameLen < 1) {
1610 PrintAndLog("No filename found after f");
1611 errors = true;
1612 }
1613 cmdp += 2;
1614 break;
1615 case 'n':
1616 case 'N':
1617 keyNbr = param_get8(Cmd, cmdp+1);
1618 if (keyNbr == 0) {
1619 PrintAndLog("Wrong block number");
1620 errors = true;
1621 }
1622 cmdp += 2;
1623 break;
1624 case 'k':
1625 case 'K':
1626 operation += 3; //set key
1627 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1628 if (dataLen == 16) { //ul-c or ev1/ntag key length
1629 errors = param_gethex(tempStr, 0, KEY, dataLen);
1630 } else {
1631 PrintAndLog("\nERROR: Key is incorrect length\n");
1632 errors = true;
1633 }
1634 cmdp += 2;
1635 break;
1636 case 'p':
1637 case 'P':
1638 operation += 4; //print keys in memory
1639 cmdp++;
1640 break;
1641 case 'l':
1642 case 'L':
1643 operation += 5; //load keys from file
1644 cmdp++;
1645 break;
1646 case 's':
1647 case 'S':
1648 operation += 6; //save keys to file
1649 cmdp++;
1650 break;
1651 default:
1652 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1653 errors = true;
1654 break;
1655 }
1656 if(errors) return usage_hf_iclass_managekeys();
1657 }
1658 if (operation == 0){
1659 PrintAndLog("no operation specified (load, save, or print)\n");
1660 return usage_hf_iclass_managekeys();
1661 }
1662 if (operation > 6){
1663 PrintAndLog("Too many operations specified\n");
1664 return usage_hf_iclass_managekeys();
1665 }
1666 if (operation > 4 && fileNameLen == 0){
1667 PrintAndLog("You must enter a filename when loading or saving\n");
1668 return usage_hf_iclass_managekeys();
1669 }
1670
1671 switch (operation){
1672 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1673 case 4: return printKeys();
1674 case 5: return loadKeys(filename);
1675 case 6: return saveKeys(filename);
1676 break;
1677 }
1678 return 0;
1679 }
1680
1681 static command_t CommandTable[] =
1682 {
1683 {"help", CmdHelp, 1, "This help"},
1684 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1685 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1686 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1687 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1688 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1689 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1690 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1691 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1692 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1693 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1694 {"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
1695 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1696 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1697 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1698 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1699 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
1700 {NULL, NULL, 0, NULL}
1701 };
1702
1703 int CmdHFiClass(const char *Cmd)
1704 {
1705 CmdsParse(CommandTable, Cmd);
1706 return 0;
1707 }
1708
1709 int CmdHelp(const char *Cmd)
1710 {
1711 CmdsHelp(CommandTable);
1712 return 0;
1713 }
Proxmark3 GIT tracking
Impressum, Datenschutz