git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhfmfu.c

   1 //-----------------------------------------------------------------------------
   2 // Ultralight Code (c) 2013,2014 Midnitesnake & Andy Davies of Pentura
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency MIFARE ULTRALIGHT (C) commands
   9 //-----------------------------------------------------------------------------
  10 #include "loclass/des.h"
  11 #include "cmdhfmfu.h"
  12 #include "cmdhfmf.h"
  13 #include "cmdhf14a.h"
  14
  15 #define MAX_ULTRA_BLOCKS   0x0f
  16 #define MAX_ULTRAC_BLOCKS  0x2f
  17 //#define MAX_ULTRAC_BLOCKS  0x2c
  18
  19 static int CmdHelp(const char *Cmd);
  20
  21 int CmdHF14AMfUInfo(const char *Cmd){
  22
  23         uint8_t datatemp[7] = {0x00};
  24         uint8_t isOK  = 0;
  25         uint8_t *data = NULL;
  26
  27         UsbCommand c = {CMD_MIFAREU_READCARD, {0, 4}};
  28         SendCommand(&c);
  29         UsbCommand resp;
  30
  31         if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
  32                 isOK  = resp.arg[0] & 0xff;
  33                 data  = resp.d.asBytes;
  34
  35                 if (!isOK) {
  36                         PrintAndLog("Error reading from tag");
  37                         return -1;
  38                 }
  39         } else {
  40                 PrintAndLog("Command execute timed out");
  41                 return -1;
  42         }
  43
  44         PrintAndLog("");
  45         PrintAndLog("-- Mifare Ultralight / Ultralight-C Tag Information ---------");
  46         PrintAndLog("-------------------------------------------------------------");
  47
  48         // UID
  49         memcpy( datatemp, data, 3);
  50         memcpy( datatemp+3, data+4, 4);
  51
  52         PrintAndLog("MANUFACTURER : %s", getTagInfo(datatemp[0]));
  53         PrintAndLog("         UID : %s ", sprint_hex(datatemp, 7));
  54         // BBC
  55         // CT (cascade tag byte) 0x88 xor SN0 xor SN1 xor SN2
  56         int crc0 = 0x88 ^ data[0] ^ data[1] ^data[2];
  57         if ( data[3] == crc0 )
  58                 PrintAndLog("        BCC0 : %02x - Ok", data[3]);
  59         else
  60                 PrintAndLog("        BCC0 : %02x - crc should be %02x", data[3], crc0);
  61
  62         int crc1 = data[4] ^ data[5] ^ data[6] ^data[7];
  63         if ( data[8] == crc1 )
  64                 PrintAndLog("        BCC1 : %02x - Ok", data[8]);
  65         else
  66                 PrintAndLog("        BCC1 : %02x - crc should be %02x", data[8], crc1 );
  67
  68         PrintAndLog("    Internal : %s ", sprint_hex(data + 9, 1));
  69
  70         memcpy(datatemp, data+10, 2);
  71         PrintAndLog("        Lock : %s - %s", sprint_hex(datatemp, 2),printBits( 2, &datatemp) );
  72         PrintAndLog("  OneTimePad : %s ", sprint_hex(data + 3*4, 4));
  73         PrintAndLog("");
  74
  75         int len = CmdHF14AMfucAuth("K 0");
  76 //      PrintAndLog("CODE: %d",len);
  77 // Fix reading UL-C 's password higher blocks.
  78
  79         PrintAndLog("Seems to be a Ultralight %s", (len==0) ? "-C" :"");
  80
  81
  82         return 0;
  83 }
  84
  85 //
  86 //  Mifare Ultralight Write Single Block
  87 //
  88 int CmdHF14AMfUWrBl(const char *Cmd){
  89         uint8_t blockNo    = -1;
  90         bool chinese_card  = FALSE;
  91         uint8_t bldata[16] = {0x00};
  92         UsbCommand resp;
  93
  94         char cmdp = param_getchar(Cmd, 0);
  95         if (strlen(Cmd) < 3 || cmdp == 'h' || cmdp == 'H') {
  96                 PrintAndLog("Usage:  hf mfu wrbl <block number> <block data (8 hex symbols)> [w]");
  97                 PrintAndLog("       [block number]");
  98                 PrintAndLog("       [block data] - (8 hex symbols)");
  99                 PrintAndLog("       [w] - Chinese magic ultralight tag");
 100                 PrintAndLog("");
 101                 PrintAndLog("        sample: hf mfu wrbl 0 01020304");
 102                 PrintAndLog("");
 103                 return 0;
 104         }
 105
 106         blockNo = param_get8(Cmd, 0);
 107
 108         if (blockNo > MAX_ULTRA_BLOCKS){
 109                 PrintAndLog("Error: Maximum number of blocks is 15 for Ultralight Cards!");
 110                 return 1;
 111         }
 112
 113         if (param_gethex(Cmd, 1, bldata, 8)) {
 114                 PrintAndLog("Block data must include 8 HEX symbols");
 115                 return 1;
 116         }
 117
 118         if (strchr(Cmd,'w') != 0  || strchr(Cmd,'W') != 0 ) {
 119                 chinese_card = TRUE;
 120         }
 121
 122         if ( blockNo <= 3) {
 123                 if (!chinese_card){
 124                         PrintAndLog("Access Denied");
 125                 } else {
 126                         PrintAndLog("--specialblock no:%02x", blockNo);
 127                         PrintAndLog("--data: %s", sprint_hex(bldata, 4));
 128                         UsbCommand d = {CMD_MIFAREU_WRITEBL, {blockNo}};
 129                         memcpy(d.d.asBytes,bldata, 4);
 130                         SendCommand(&d);
 131                         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 132                                 uint8_t isOK  = resp.arg[0] & 0xff;
 133                                 PrintAndLog("isOk:%02x", isOK);
 134                         } else {
 135                                 PrintAndLog("Command execute timeout");
 136                         }
 137                 }
 138         } else {
 139                 PrintAndLog("--block no:%02x", blockNo);
 140                 PrintAndLog("--data: %s", sprint_hex(bldata, 4));
 141                 UsbCommand e = {CMD_MIFAREU_WRITEBL, {blockNo}};
 142                 memcpy(e.d.asBytes,bldata, 4);
 143                 SendCommand(&e);
 144                 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 145                         uint8_t isOK  = resp.arg[0] & 0xff;
 146                         PrintAndLog("isOk:%02x", isOK);
 147                 } else {
 148                         PrintAndLog("Command execute timeout");
 149                 }
 150         }
 151         return 0;
 152 }
 153
 154 //
 155 //  Mifare Ultralight Read Single Block
 156 //
 157 int CmdHF14AMfURdBl(const char *Cmd){
 158
 159         UsbCommand resp;
 160         uint8_t blockNo = -1;
 161         char cmdp = param_getchar(Cmd, 0);
 162
 163         if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
 164                 PrintAndLog("Usage:  hf mfu rdbl <block number>");
 165                 PrintAndLog("        sample: hfu mfu rdbl 0");
 166                 return 0;
 167         }
 168
 169         blockNo = param_get8(Cmd, 0);
 170
 171         if (blockNo > MAX_ULTRA_BLOCKS){
 172            PrintAndLog("Error: Maximum number of blocks is 15 for Ultralight");
 173            return 1;
 174         }
 175
 176         UsbCommand c = {CMD_MIFAREU_READBL, {blockNo}};
 177         SendCommand(&c);
 178
 179
 180         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 181                 uint8_t isOK = resp.arg[0] & 0xff;
 182                 if (isOK) {
 183                         uint8_t *data = resp.d.asBytes;
 184                         PrintAndLog("Block: %0d (0x%02X) [ %s]", (int)blockNo, blockNo, sprint_hex(data, 4));
 185                 }
 186                 else {
 187                         PrintAndLog("Failed reading block: (%02x)", isOK);
 188                 }
 189         } else {
 190                 PrintAndLog("Command execute time-out");
 191         }
 192
 193         return 0;
 194 }
 195
 196 //
 197 //  Mifare Ultralight / Ultralight-C;  Read and Dump Card Contents
 198 //
 199 int CmdHF14AMfUDump(const char *Cmd){
 200
 201         FILE *fout;
 202         char filename[FILE_PATH_SIZE] = {0x00};
 203         char * fnameptr = filename;
 204
 205         uint8_t *lockbytes_t = NULL;
 206         uint8_t lockbytes[2] = {0x00};
 207
 208         uint8_t *lockbytes_t2 = NULL;
 209         uint8_t lockbytes2[2] = {0x00};
 210
 211         bool bit[16]  = {0x00};
 212         bool bit2[16] = {0x00};
 213
 214         int i;
 215         uint8_t BlockNo      = 0;
 216         int Pages            = 16;
 217
 218         bool tmplockbit          = false;
 219         uint8_t isOK         = 0;
 220         uint8_t *data       = NULL;
 221
 222         char cmdp = param_getchar(Cmd, 0);
 223
 224         if (cmdp == 'h' || cmdp == 'H') {
 225                 PrintAndLog("Reads all pages from Mifare Ultralight or Ultralight-C tag.");
 226                 PrintAndLog("It saves binary dump into the file `filename.bin` or `cardUID.bin`");
 227                 PrintAndLog("Usage:  hf mfu dump <c> <filename w/o .bin>");
 228                 PrintAndLog("     <c>  optional cardtype c == Ultralight-C, Defaults to Ultralight");
 229                 PrintAndLog("     sample: hf mfu dump");
 230                 PrintAndLog("           : hf mfu dump myfile");
 231                 PrintAndLog("           : hf mfu dump c myfile");
 232                 return 0;
 233         }
 234
 235         // UL or UL-C?
 236         Pages = (cmdp == 'c' || cmdp == 'C') ? 44 : 16;
 237
 238         PrintAndLog("Dumping Ultralight%s Card Data...", (Pages ==16)?"":"-C");
 239
 240         UsbCommand c = {CMD_MIFAREU_READCARD, {BlockNo,Pages}};
 241         SendCommand(&c);
 242         UsbCommand resp;
 243
 244         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 245                 isOK  = resp.arg[0] & 0xff;
 246                 if (!isOK) {
 247                         PrintAndLog("Command error");
 248                         return 0;
 249                 }
 250                 data  = resp.d.asBytes;
 251         } else {
 252                 PrintAndLog("Command execute time-out");
 253                 return 0;
 254         }
 255
 256         // Load lock bytes.
 257         int j = 0;
 258
 259         lockbytes_t = data + 8;
 260         lockbytes[0] = lockbytes_t[2];
 261         lockbytes[1] = lockbytes_t[3];
 262         for(j = 0; j < 16; j++){
 263                 bit[j] = lockbytes[j/8] & ( 1 <<(7-j%8));
 264         }
 265
 266         // Load bottom lockbytes if available
 267         if ( Pages == 44 ) {
 268
 269                 lockbytes_t2 = data + (40*4);
 270                 lockbytes2[0] = lockbytes_t2[2];
 271                 lockbytes2[1] = lockbytes_t2[3];
 272                 for (j = 0; j < 16; j++) {
 273                         bit2[j] = lockbytes2[j/8] & ( 1 <<(7-j%8));
 274                 }
 275         }
 276
 277         for (i = 0; i < Pages; ++i) {
 278
 279                 if ( i < 3 ) {
 280                         PrintAndLog("Block %02x:%s ", i,sprint_hex(data + i * 4, 4));
 281                         continue;
 282                 }
 283
 284                 switch(i){
 285                         case 3: tmplockbit = bit[4]; break;
 286                         case 4: tmplockbit = bit[3]; break;
 287                         case 5: tmplockbit = bit[2]; break;
 288                         case 6: tmplockbit = bit[1]; break;
 289                         case 7: tmplockbit = bit[0]; break;
 290                         case 8: tmplockbit = bit[15]; break;
 291                         case 9: tmplockbit = bit[14]; break;
 292                         case 10: tmplockbit = bit[13]; break;
 293                         case 11: tmplockbit = bit[12]; break;
 294                         case 12: tmplockbit = bit[11]; break;
 295                         case 13: tmplockbit = bit[10]; break;
 296                         case 14: tmplockbit = bit[9]; break;
 297                         case 15: tmplockbit = bit[8]; break;
 298                         case 16:
 299                         case 17:
 300                         case 18:
 301                         case 19: tmplockbit = bit2[6]; break;
 302                         case 20:
 303                         case 21:
 304                         case 22:
 305                         case 23: tmplockbit = bit2[5]; break;
 306                         case 24:
 307                         case 25:
 308                         case 26:
 309                         case 27: tmplockbit = bit2[4]; break;
 310                         case 28:
 311                         case 29:
 312                         case 30:
 313                         case 31: tmplockbit = bit2[2]; break;
 314                         case 32:
 315                         case 33:
 316                         case 34:
 317                         case 35: tmplockbit = bit2[1]; break;
 318                         case 36:
 319                         case 37:
 320                         case 38:
 321                         case 39: tmplockbit = bit2[0]; break;
 322                         case 40: tmplockbit = bit2[12]; break;
 323                         case 41: tmplockbit = bit2[11]; break;
 324                         case 42: tmplockbit = bit2[10]; break; //auth0
 325                         case 43: tmplockbit = bit2[9]; break;  //auth1
 326                         default: break;
 327                 }
 328                 PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),tmplockbit);
 329         }
 330
 331         int len = 0;
 332         if ( Pages == 16 )
 333                 len = param_getstr(Cmd,0,filename);
 334         else
 335                 len = param_getstr(Cmd,1,filename);
 336
 337         if (len > FILE_PATH_SIZE-5) len = FILE_PATH_SIZE-5;
 338
 339         // user supplied filename?
 340         if (len < 1) {
 341
 342                 // UID = data 0-1-2 4-5-6-7  (skips a beat)
 343                 sprintf(fnameptr,"%02X%02X%02X%02X%02X%02X%02X.bin",
 344                         data[0],data[1], data[2], data[4],data[5],data[6], data[7]);
 345
 346         } else {
 347                 sprintf(fnameptr + len," .bin");
 348         }
 349
 350
 351         if ((fout = fopen(filename,"wb")) == NULL) {
 352                 PrintAndLog("Could not create file name %s", filename);
 353                 return 1;
 354         }
 355         fwrite( data, 1, Pages*4, fout );
 356         fclose(fout);
 357
 358         PrintAndLog("Dumped %d pages, wrote %d bytes to %s", Pages, Pages*4, filename);
 359         return 0;
 360 }
 361
 362 // Needed to Authenticate to Ultralight C tags
 363 void rol (uint8_t *data, const size_t len){
 364         uint8_t first = data[0];
 365         for (size_t i = 0; i < len-1; i++) {
 366                 data[i] = data[i+1];
 367         }
 368         data[len-1] = first;
 369 }
 370
 371 //-------------------------------------------------------------------------------
 372 // Ultralight C Methods
 373 //-------------------------------------------------------------------------------
 374
 375 //
 376 // Ultralight C Authentication Demo {currently uses hard-coded key}
 377 //
 378 int CmdHF14AMfucAuth(const char *Cmd){
 379
 380         uint8_t default_keys[7][16] = {
 381                 { 0x42,0x52,0x45,0x41,0x4b,0x4d,0x45,0x49,0x46,0x59,0x4f,0x55,0x43,0x41,0x4e,0x21 },// 3des std key
 382                 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },// all zeroes
 383                 { 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f },// 0x00-0x0F
 384                 { 0x49,0x45,0x4D,0x4B,0x41,0x45,0x52,0x42,0x21,0x4E,0x41,0x43,0x55,0x4F,0x59,0x46 },// NFC-key
 385                 { 0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01 },// all ones
 386                 { 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF },// all FF
 387                 { 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xDD,0xEE,0xFF }     // 11 22 33
 388         };
 389
 390         char cmdp = param_getchar(Cmd, 0);
 391
 392         uint8_t keyNo = 0;
 393         bool errors = false;
 394         //Change key to user defined one
 395         if (cmdp == 'k' || cmdp == 'K'){
 396                 keyNo = param_get8(Cmd, 1);
 397                 if(keyNo > 6) errors = true;
 398         }
 399
 400         if (cmdp == 'h' || cmdp == 'H') {
 401                 errors = true;
 402         }
 403
 404         if (errors) {
 405                 PrintAndLog("Usage:  hf mfu cauth k <key number>");
 406                 PrintAndLog("      0 (default): 3DES standard key");
 407                 PrintAndLog("      1 : all 0x00 key");
 408                 PrintAndLog("      2 : 0x00-0x0F key");
 409                 PrintAndLog("      3 : nfc key");
 410                 PrintAndLog("      4 : all 0x01 key");
 411                 PrintAndLog("      5 : all 0xff key");
 412                 PrintAndLog("      6 : 0x00-0xFF key");
 413                 PrintAndLog("\n      sample : hf mfu cauth k");
 414                 PrintAndLog("               : hf mfu cauth k 3");
 415                 return 0;
 416         }
 417
 418         uint8_t random_a[8]     = { 1,1,1,1,1,1,1,1 };
 419         //uint8_t enc_random_a[8] = { 0 };
 420         uint8_t random_b[8]     = { 0 };
 421         uint8_t enc_random_b[8] = { 0 };
 422         uint8_t random_a_and_b[16] = { 0 };
 423         des3_context ctx        = { 0 };
 424         uint8_t *key = default_keys[keyNo];
 425         uint8_t blockNo = 0;
 426         uint32_t cuid = 0;
 427
 428         //Auth1
 429         UsbCommand c = {CMD_MIFAREUC_AUTH1, {blockNo}};
 430         SendCommand(&c);
 431         UsbCommand resp;
 432         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 433                 uint8_t isOK  = resp.arg[0] & 0xff;
 434                 cuid  = resp.arg[1];
 435                 uint8_t * data= resp.d.asBytes;
 436
 437                 if (isOK){
 438                         memcpy(enc_random_b,data+1,8);
 439                 } else {
 440                         PrintAndLog("Auth failed");
 441                         return 2;
 442                 }
 443         } else {
 444                 PrintAndLog("Command execute timeout");
 445                 return 1;
 446         }
 447         uint8_t iv[8]           = { 0 };
 448
 449         PrintAndLog("     RndA  :%s",sprint_hex(random_a, 8));
 450         PrintAndLog("     enc(RndB):%s",sprint_hex(enc_random_b, 8));
 451
 452         des3_set2key_dec(&ctx, key);
 453
 454         des3_crypt_cbc(&ctx      // des3_context *ctx
 455                 , DES_DECRYPT        // int mode
 456                 , sizeof(random_b)   // size_t length
 457                 , iv                 // unsigned char iv[8]
 458                 , enc_random_b       // const unsigned char *input
 459                 , random_b           // unsigned char *output
 460                 );
 461
 462         PrintAndLog("     RndB:%s",sprint_hex(random_b, 8));
 463
 464         rol(random_b,8);
 465         memcpy(random_a_and_b  ,random_a,8);
 466         memcpy(random_a_and_b+8,random_b,8);
 467
 468         PrintAndLog("     A+B:%s",sprint_hex(random_a_and_b, 16));
 469
 470         des3_set2key_enc(&ctx, key);
 471
 472         des3_crypt_cbc(&ctx          // des3_context *ctx
 473                 , DES_ENCRYPT            // int mode
 474                 , sizeof(random_a_and_b)   // size_t length
 475                 , enc_random_b           // unsigned char iv[8]
 476                 , random_a_and_b         // const unsigned char *input
 477                 , random_a_and_b         // unsigned char *output
 478                 );
 479
 480         PrintAndLog("enc(A+B):%s",sprint_hex(random_a_and_b, 16));
 481
 482         //Auth2
 483         UsbCommand d = {CMD_MIFAREUC_AUTH2, {cuid}};
 484         memcpy(d.d.asBytes,random_a_and_b, 16);
 485         SendCommand(&d);
 486
 487         UsbCommand respb;
 488         if (WaitForResponseTimeout(CMD_ACK,&respb,1500)) {
 489                 uint8_t  isOK  = respb.arg[0] & 0xff;
 490                 uint8_t * data2= respb.d.asBytes;
 491
 492                 if (isOK){
 493                         PrintAndLog("enc(RndA'):%s", sprint_hex(data2+1, 8));
 494
 495                         uint8_t foo[8] = { 0 };
 496                         uint8_t bar[8] = { 0 };
 497                         memcpy(foo, data2+1, 8);
 498                         des3_set2key_dec(&ctx, key);
 499
 500                         des3_crypt_cbc(&ctx    // des3_context *ctx
 501                                 , DES_DECRYPT      // int mode
 502                                 , 8      // size_t length
 503                                 , enc_random_b     // unsigned char iv[8]
 504                                 , foo           // const unsigned char *input
 505                                 , bar   // unsigned char *output
 506                         );
 507
 508                         PrintAndLog("--> : %s  : <-- Should be equal to our RndA",sprint_hex(bar, 8));
 509
 510
 511                 } else {
 512                         return 2;
 513                 }
 514
 515         } else {
 516                 PrintAndLog("Command execute timeout");
 517                 return 1;
 518         }
 519         return 0;
 520 }
 521 /**
 522 A test function to validate that the polarssl-function works the same
 523 was as the openssl-implementation.
 524 Commented out, since it requires openssl
 525
 526 int CmdTestDES(const char * cmd)
 527 {
 528         uint8_t key[16] = {0x00};
 529
 530         memcpy(key,key3_3des_data,16);
 531         DES_cblock RndA, RndB;
 532
 533         PrintAndLog("----------OpenSSL DES implementation----------");
 534         {
 535                 uint8_t e_RndB[8] = {0x00};
 536                 unsigned char RndARndB[16] = {0x00};
 537
 538                 DES_cblock iv = { 0 };
 539                 DES_key_schedule ks1,ks2;
 540                 DES_cblock key1,key2;
 541
 542                 memcpy(key,key3_3des_data,16);
 543                 memcpy(key1,key,8);
 544                 memcpy(key2,key+8,8);
 545
 546
 547                 DES_set_key((DES_cblock *)key1,&ks1);
 548                 DES_set_key((DES_cblock *)key2,&ks2);
 549
 550                 DES_random_key(&RndA);
 551                 PrintAndLog("     RndA:%s",sprint_hex(RndA, 8));
 552                 PrintAndLog("     e_RndB:%s",sprint_hex(e_RndB, 8));
 553                 //void DES_ede2_cbc_encrypt(const unsigned char *input,
 554                 //    unsigned char *output, long length, DES_key_schedule *ks1,
 555                 //    DES_key_schedule *ks2, DES_cblock *ivec, int enc);
 556                 DES_ede2_cbc_encrypt(e_RndB,RndB,sizeof(e_RndB),&ks1,&ks2,&iv,0);
 557
 558                 PrintAndLog("     RndB:%s",sprint_hex(RndB, 8));
 559                 rol(RndB,8);
 560                 memcpy(RndARndB,RndA,8);
 561                 memcpy(RndARndB+8,RndB,8);
 562                 PrintAndLog("     RA+B:%s",sprint_hex(RndARndB, 16));
 563                 DES_ede2_cbc_encrypt(RndARndB,RndARndB,sizeof(RndARndB),&ks1,&ks2,&e_RndB,1);
 564                 PrintAndLog("enc(RA+B):%s",sprint_hex(RndARndB, 16));
 565
 566         }
 567         PrintAndLog("----------PolarSSL implementation----------");
 568         {
 569                 uint8_t random_a[8]     = { 0 };
 570                 uint8_t enc_random_a[8] = { 0 };
 571                 uint8_t random_b[8]     = { 0 };
 572                 uint8_t enc_random_b[8] = { 0 };
 573                 uint8_t random_a_and_b[16] = { 0 };
 574                 des3_context ctx        = { 0 };
 575
 576                 memcpy(random_a, RndA,8);
 577
 578                 uint8_t output[8]       = { 0 };
 579                 uint8_t iv[8]           = { 0 };
 580
 581                 PrintAndLog("     RndA  :%s",sprint_hex(random_a, 8));
 582                 PrintAndLog("     e_RndB:%s",sprint_hex(enc_random_b, 8));
 583
 584                 des3_set2key_dec(&ctx, key);
 585
 586                 des3_crypt_cbc(&ctx      // des3_context *ctx
 587                         , DES_DECRYPT        // int mode
 588                         , sizeof(random_b)   // size_t length
 589                         , iv                 // unsigned char iv[8]
 590                         , enc_random_b       // const unsigned char *input
 591                         , random_b           // unsigned char *output
 592                         );
 593
 594                 PrintAndLog("     RndB:%s",sprint_hex(random_b, 8));
 595
 596                 rol(random_b,8);
 597                 memcpy(random_a_and_b  ,random_a,8);
 598                 memcpy(random_a_and_b+8,random_b,8);
 599
 600                 PrintAndLog("     RA+B:%s",sprint_hex(random_a_and_b, 16));
 601
 602                 des3_set2key_enc(&ctx, key);
 603
 604                 des3_crypt_cbc(&ctx          // des3_context *ctx
 605                         , DES_ENCRYPT            // int mode
 606                         , sizeof(random_a_and_b)   // size_t length
 607                         , enc_random_b           // unsigned char iv[8]
 608                         , random_a_and_b         // const unsigned char *input
 609                         , random_a_and_b         // unsigned char *output
 610                         );
 611
 612                 PrintAndLog("enc(RA+B):%s",sprint_hex(random_a_and_b, 16));
 613         }
 614         return 0;
 615 }
 616 **/
 617 //
 618 // Ultralight C Read Single Block
 619 //
 620 int CmdHF14AMfUCRdBl(const char *Cmd)
 621 {
 622         UsbCommand resp;
 623         bool hasPwd = FALSE;
 624         uint8_t blockNo = -1;
 625         unsigned char key[16];
 626         char cmdp = param_getchar(Cmd, 0);
 627
 628         if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
 629                 PrintAndLog("Usage:  hf mfu crdbl  <block number> <password>");
 630                 PrintAndLog("");
 631                 PrintAndLog("sample: hf mfu crdbl 0");
 632                 PrintAndLog("        hf mfu crdbl 0 112233445566778899AABBCCDDEEFF");
 633                 return 0;
 634         }
 635
 636         blockNo = param_get8(Cmd, 0);
 637         if (blockNo < 0) {
 638                 PrintAndLog("Wrong block number");
 639                 return 1;
 640         }
 641
 642         if (blockNo > MAX_ULTRAC_BLOCKS ){
 643                 PrintAndLog("Error: Maximum number of blocks is 47 for Ultralight-C");
 644                 return 1;
 645         }
 646
 647         // key
 648         if ( strlen(Cmd) > 3){
 649                 if (param_gethex(Cmd, 1, key, 32)) {
 650                         PrintAndLog("Key must include %d HEX symbols", 32);
 651                         return 1;
 652                 } else {
 653                         hasPwd = TRUE;
 654                 }
 655         }
 656
 657         //Read Block
 658         UsbCommand c = {CMD_MIFAREU_READBL, {blockNo}};
 659         if ( hasPwd ) {
 660                 c.arg[1] = 1;
 661                 memcpy(c.d.asBytes,key,16);
 662         }
 663         SendCommand(&c);
 664
 665         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 666                 uint8_t isOK = resp.arg[0] & 0xff;
 667                 if (isOK) {
 668                         uint8_t *data = resp.d.asBytes;
 669                         PrintAndLog("Block: %0d (0x%02X) [ %s]", (int)blockNo, blockNo, sprint_hex(data, 4));
 670                 }
 671                 else {
 672                         PrintAndLog("Failed reading block: (%02x)", isOK);
 673                 }
 674         } else {
 675                 PrintAndLog("Command execute time-out");
 676         }
 677         return 0;
 678 }
 679
 680 //
 681 //  Mifare Ultralight C Write Single Block
 682 //
 683 int CmdHF14AMfUCWrBl(const char *Cmd){
 684
 685         uint8_t blockNo = -1;
 686         bool chinese_card = FALSE;
 687         uint8_t bldata[16] = {0x00};
 688         UsbCommand resp;
 689
 690         char cmdp = param_getchar(Cmd, 0);
 691
 692         if (strlen(Cmd) < 3 || cmdp == 'h' || cmdp == 'H') {
 693                 PrintAndLog("Usage:  hf mfu cwrbl <block number> <block data (8 hex symbols)> [w]");
 694                 PrintAndLog("       [block number]");
 695                 PrintAndLog("       [block data] - (8 hex symbols)");
 696                 PrintAndLog("       [w] - Chinese magic ultralight tag");
 697                 PrintAndLog("");
 698                 PrintAndLog("        sample: hf mfu cwrbl 0 01020304");
 699                 PrintAndLog("");
 700                 return 0;
 701         }
 702
 703         blockNo = param_get8(Cmd, 0);
 704         if (blockNo > MAX_ULTRAC_BLOCKS ){
 705                 PrintAndLog("Error: Maximum number of blocks is 47 for Ultralight-C Cards!");
 706                 return 1;
 707         }
 708
 709         if (param_gethex(Cmd, 1, bldata, 8)) {
 710                 PrintAndLog("Block data must include 8 HEX symbols");
 711                 return 1;
 712         }
 713
 714         if (strchr(Cmd,'w') != 0  || strchr(Cmd,'W') != 0 ) {
 715                 chinese_card = TRUE;
 716         }
 717
 718         if ( blockNo <= 3 ) {
 719                 if (!chinese_card){
 720                          PrintAndLog("Access Denied");
 721                 } else {
 722                         PrintAndLog("--Special block no: 0x%02x", blockNo);
 723                         PrintAndLog("--Data: %s", sprint_hex(bldata, 4));
 724                         UsbCommand d = {CMD_MIFAREU_WRITEBL, {blockNo}};
 725                         memcpy(d.d.asBytes,bldata, 4);
 726                         SendCommand(&d);
 727                         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 728                                 uint8_t isOK  = resp.arg[0] & 0xff;
 729                                 PrintAndLog("isOk:%02x", isOK);
 730                         } else {
 731                                 PrintAndLog("Command execute timeout");
 732                         }
 733                 }
 734         } else {
 735                         PrintAndLog("--Block no : 0x%02x", blockNo);
 736                         PrintAndLog("--Data: %s", sprint_hex(bldata, 4));
 737                         UsbCommand e = {CMD_MIFAREU_WRITEBL, {blockNo}};
 738                         memcpy(e.d.asBytes,bldata, 4);
 739                         SendCommand(&e);
 740                         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 741                                 uint8_t isOK  = resp.arg[0] & 0xff;
 742                                 PrintAndLog("isOk : %02x", isOK);
 743                         } else {
 744                                 PrintAndLog("Command execute timeout");
 745                         }
 746         }
 747         return 0;
 748 }
 749
 750 //
 751 // Mifare Ultralight C - Set password
 752 //
 753 int CmdHF14AMfucSetPwd(const char *Cmd){
 754
 755         uint8_t pwd[16] = {0x00};
 756
 757         char cmdp = param_getchar(Cmd, 0);
 758
 759         if (strlen(Cmd) == 0  || cmdp == 'h' || cmdp == 'H') {
 760                 PrintAndLog("Usage:  hf mfu setpwd <password (32 hex symbols)>");
 761                 PrintAndLog("       [password] - (32 hex symbols)");
 762                 PrintAndLog("");
 763                 PrintAndLog("sample: hf mfu setpwd 000102030405060708090a0b0c0d0e0f");
 764                 PrintAndLog("");
 765                 return 0;
 766         }
 767
 768         if (param_gethex(Cmd, 0, pwd, 32)) {
 769                 PrintAndLog("Password must include 32 HEX symbols");
 770                 return 1;
 771         }
 772
 773         UsbCommand c = {CMD_MIFAREUC_SETPWD};
 774         memcpy( c.d.asBytes, pwd, 16);
 775         SendCommand(&c);
 776
 777         UsbCommand resp;
 778
 779         if (WaitForResponseTimeout(CMD_ACK,&resp,1500) ) {
 780                 if ( (resp.arg[0] & 0xff) == 1)
 781                         PrintAndLog("Ultralight-C new password: %s", sprint_hex(pwd,16));
 782                 else{
 783                         PrintAndLog("Failed writing at block %d", resp.arg[1] & 0xff);
 784                         return 1;
 785                 }
 786         }
 787         else {
 788                 PrintAndLog("command execution time out");
 789                 return 1;
 790         }
 791
 792         return 0;
 793 }
 794
 795 //
 796 // Mifare Ultraligh - Set UID
 797 //
 798 int CmdHF14AMfucSetUid(const char *Cmd){
 799
 800         uint8_t uid[7] = {0x00};
 801         char cmdp = param_getchar(Cmd, 0);
 802
 803         if (strlen(Cmd) == 0  || cmdp == 'h' || cmdp == 'H') {
 804                 PrintAndLog("Usage:  hf mfu setuid <uid (14 hex symbols)>");
 805                 PrintAndLog("       [uid] - (14 hex symbols)");
 806                 PrintAndLog("");
 807                 PrintAndLog("sample: hf mfu setuid 11223344556677");
 808                 PrintAndLog("");
 809                 return 0;
 810         }
 811
 812         if (param_gethex(Cmd, 0, uid, 14)) {
 813                 PrintAndLog("Password must include 14 HEX symbols");
 814                 return 1;
 815         }
 816
 817         UsbCommand c = {CMD_MIFAREU_SETUID};
 818         memcpy( c.d.asBytes, uid, 14);
 819         SendCommand(&c);
 820
 821         UsbCommand resp;
 822         if (WaitForResponseTimeout(CMD_ACK,&resp,1500) ) {
 823                 if ( (resp.arg[0] & 0xff) == 1)
 824                         PrintAndLog("New UID: %s", sprint_hex(uid,14));
 825                 else{
 826                         PrintAndLog("Failed writing new uid");
 827                         return 1;
 828                 }
 829         }
 830         else {
 831                 PrintAndLog("command execution time out");
 832                 return 1;
 833         }
 834         return 0;
 835 }
 836
 837 int CmdHF14AMfuGenDiverseKeys(const char *Cmd){
 838
 839         uint8_t iv[8] = { 0x00 };
 840         uint8_t block = 0x07;
 841
 842         uint8_t uid[] = { 0xF4,0xEA, 0x54, 0x8E };
 843         uint8_t mifarekey[] = { 0xA0,0xA1,0xA2,0xA3,0xA4,0xA5 };
 844         uint8_t masterkey[] = { 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xdd,0xee,0xff };
 845
 846         uint8_t mix[8] = { 0x00 };
 847         uint8_t divkey[8] = { 0x00 };
 848
 849         memcpy(mix, mifarekey, 4);
 850
 851         mix[4] = mifarekey[4] ^ uid[0];
 852         mix[5] = mifarekey[5] ^ uid[1];
 853         mix[6] = block ^ uid[2];
 854         mix[7] = uid[3];
 855
 856         des3_context ctx = { 0x00 };
 857         des3_set2key_enc(&ctx, masterkey);
 858
 859         des3_crypt_cbc(&ctx  // des3_context
 860                 , DES_ENCRYPT    // int mode
 861                 , sizeof(mix)    // length
 862                 , iv             // iv[8]
 863                 , mix            // input
 864                 , divkey         // output
 865                 );
 866
 867         PrintAndLog("3DES version");
 868         PrintAndLog("Masterkey    :\t %s", sprint_hex(masterkey,sizeof(masterkey)));
 869         PrintAndLog("UID          :\t %s", sprint_hex(uid, sizeof(uid)));
 870         PrintAndLog("Sector       :\t %0d", block);
 871         PrintAndLog("Mifare key   :\t %s", sprint_hex(mifarekey, sizeof(mifarekey)));
 872         PrintAndLog("Message      :\t %s", sprint_hex(mix, sizeof(mix)));
 873         PrintAndLog("Diversified key: %s", sprint_hex(divkey+1, 6));
 874
 875         return 0;
 876 }
 877
 878 // uint8_t * diversify_key(uint8_t * key){
 879  // for(int i=0; i<16; i++){
 880    // if(i<=6) key[i]^=cuid[i];
 881    // if(i>6) key[i]^=cuid[i%7];
 882  // }
 883  // return key;
 884 // }
 885
 886 // static void GenerateUIDe( uint8_t *uid, uint8_t len){
 887         // for (int i=0; i<len; ++i){
 888
 889         // }
 890         // return;
 891 // }
 892
 893 //------------------------------------
 894 // Menu Stuff
 895 //------------------------------------
 896 static command_t CommandTable[] =
 897 {
 898         {"help",        CmdHelp,                        1,"This help"},
 899         {"dbg",         CmdHF14AMfDbg,          0,"Set default debug mode"},
 900         {"info",        CmdHF14AMfUInfo,        0,"Taginfo"},
 901         {"dump",        CmdHF14AMfUDump,        0,"Dump MIFARE Ultralight / Ultralight-C tag to binary file"},
 902         {"rdbl",        CmdHF14AMfURdBl,        0,"Read block  - MIFARE Ultralight"},
 903         {"wrbl",        CmdHF14AMfUWrBl,        0,"Write block - MIFARE Ultralight"},
 904         {"crdbl",       CmdHF14AMfUCRdBl,       0,"Read block  - MIFARE Ultralight C"},
 905         {"cwrbl",       CmdHF14AMfUCWrBl,       0,"Write block - MIFARE Ultralight C"},
 906         {"cauth",       CmdHF14AMfucAuth,       0,"Ultralight C Authentication"},
 907         //{"testdes", CmdTestDES ,        1, "Test DES"},
 908         {"setpwd", CmdHF14AMfucSetPwd , 1, "Set 3des password [Ultralight-C only]"},
 909         {"setuid", CmdHF14AMfucSetUid , 1, "Set UID"},
 910         {"gen", CmdHF14AMfuGenDiverseKeys , 1, "Generate 3des mifare diversified keys"},
 911         {NULL, NULL, 0, NULL}
 912 };
 913
 914 int CmdHFMFUltra(const char *Cmd){
 915         WaitForResponseTimeout(CMD_ACK,NULL,100);
 916         CmdsParse(CommandTable, Cmd);
 917         return 0;
 918 }
 919
 920 int CmdHelp(const char *Cmd){
 921         CmdsHelp(CommandTable);
 922         return 0;
 923 }