]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhficlass.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
CHG: syntax suger
[proxmark3-svn] / client / cmdhficlass.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3 // Copyright (C) 2011 Gerhard de Koning Gans
4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // High frequency iClass commands
11 //-----------------------------------------------------------------------------
12
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <sys/stat.h>
17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18 #include "data.h"
19 #include "proxmark3.h"
20 #include "ui.h"
21 #include "cmdparser.h"
22 #include "cmdhficlass.h"
23 #include "common.h"
24 #include "util.h"
25 #include "cmdmain.h"
26 #include "loclass/des.h"
27 #include "loclass/cipherutils.h"
28 #include "loclass/cipher.h"
29 #include "loclass/ikeys.h"
30 #include "loclass/elite_crack.h"
31 #include "loclass/fileutils.h"
32 #include "protocols.h"
33 #include "usb_cmd.h"
34 #include "cmdhfmfu.h"
35 #include "cmdhf.h"
36
37 #define llX PRIx64
38
39 static int CmdHelp(const char *Cmd);
40
41 #define ICLASS_KEYS_MAX 8
42 static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
49 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
50 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
51 };
52
53 typedef struct iclass_block {
54 uint8_t d[8];
55 } iclass_block_t;
56
57 int xorbits_8(uint8_t val) {
58 uint8_t res = val ^ (val >> 1); //1st pass
59 res = res ^ (res >> 1); // 2nd pass
60 res = res ^ (res >> 2); // 3rd pass
61 res = res ^ (res >> 4); // 4th pass
62 return res & 1;
63 }
64
65 int CmdHFiClassList(const char *Cmd) {
66 //PrintAndLog("Deprecated command, use 'hf list iclass' instead");
67 CmdHFList("iclass");
68 return 0;
69 }
70
71 int CmdHFiClassSnoop(const char *Cmd) {
72 UsbCommand c = {CMD_SNOOP_ICLASS};
73 SendCommand(&c);
74 return 0;
75 }
76
77 int usage_hf_iclass_sim(void) {
78 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
79 PrintAndLog(" options");
80 PrintAndLog(" 0 <CSN> simulate the given CSN");
81 PrintAndLog(" 1 simulate default CSN");
82 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
83 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
84 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
85 PrintAndLog(" example: hf iclass sim 2");
86 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
87 PrintAndLog(" hf iclass sim 3");
88 return 0;
89 }
90
91 #define NUM_CSNS 15
92 int CmdHFiClassSim(const char *Cmd) {
93 uint8_t simType = 0;
94 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
95
96 if (strlen(Cmd)<1) {
97 return usage_hf_iclass_sim();
98 }
99 simType = param_get8ex(Cmd, 0, 0, 10);
100
101 if(simType == 0)
102 {
103 if (param_gethex(Cmd, 1, CSN, 16)) {
104 PrintAndLog("A CSN should consist of 16 HEX symbols");
105 return usage_hf_iclass_sim();
106 }
107
108 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
109 }
110 if(simType > 3)
111 {
112 PrintAndLog("Undefined simptype %d", simType);
113 return usage_hf_iclass_sim();
114 }
115
116 uint8_t numberOfCSNs=0;
117 if(simType == 2)
118 {
119 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
120 UsbCommand resp = {0};
121
122 uint8_t csns[8*NUM_CSNS] = {
123 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
136 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
137 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
138
139 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
140
141 SendCommand(&c);
142 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
143 PrintAndLog("Command timed out");
144 return 0;
145 }
146
147 uint8_t num_mac_responses = resp.arg[1];
148 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
149
150 size_t datalen = NUM_CSNS*24;
151 /*
152 * Now, time to dump to file. We'll use this format:
153 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
154 * So, it should wind up as
155 * 8 * 24 bytes.
156 *
157 * The returndata from the pm3 is on the following format
158 * <4 byte NR><4 byte MAC>
159 * CC are all zeroes, CSN is the same as was sent in
160 **/
161 void* dump = malloc(datalen);
162 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
163 uint8_t i = 0;
164 for(i = 0 ; i < NUM_CSNS ; i++)
165 {
166 memcpy(dump+i*24, csns+i*8,8); //CSN
167 //8 zero bytes here...
168 //Then comes NR_MAC (eight bytes from the response)
169 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
170
171 }
172 /** Now, save to dumpfile **/
173 saveFile("iclass_mac_attack", "bin", dump,datalen);
174 free(dump);
175 }else
176 {
177 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
178 memcpy(c.d.asBytes, CSN, 8);
179 SendCommand(&c);
180 }
181
182 return 0;
183 }
184
185 int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
186 bool tagFound = false;
187 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
188 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
189 // loop in client not device - else on windows have a communication error
190 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
191 UsbCommand resp;
192 while(!ukbhit()){
193 SendCommand(&c);
194 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
195 uint8_t readStatus = resp.arg[0] & 0xff;
196 uint8_t *data = resp.d.asBytes;
197
198 if (verbose)
199 PrintAndLog("Readstatus:%02x", readStatus);
200 if( readStatus == 0){
201 //Aborted
202 if (verbose) PrintAndLog("Quitting...");
203 return 0;
204 }
205 if( readStatus & FLAG_ICLASS_READER_CSN){
206 PrintAndLog("CSN: %s",sprint_hex(data,8));
207 tagFound = true;
208 }
209 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
210 if( readStatus & FLAG_ICLASS_READER_CONF){
211 printIclassDumpInfo(data);
212 }
213 if (tagFound && !loop) return 1;
214 } else {
215 if (verbose) PrintAndLog("Command execute timeout");
216 }
217 if (!loop) break;
218 }
219 return 0;
220 }
221
222 int CmdHFiClassReader(const char *Cmd) {
223 return HFiClassReader(Cmd, true, true);
224 }
225
226 int CmdHFiClassReader_Replay(const char *Cmd) {
227 uint8_t readerType = 0;
228 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
229
230 if (strlen(Cmd)<1) {
231 PrintAndLog("Usage: hf iclass replay <MAC>");
232 PrintAndLog(" sample: hf iclass replay 00112233");
233 return 0;
234 }
235
236 if (param_gethex(Cmd, 0, MAC, 8)) {
237 PrintAndLog("MAC must include 8 HEX symbols");
238 return 1;
239 }
240
241 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
242 memcpy(c.d.asBytes, MAC, 4);
243 SendCommand(&c);
244
245 return 0;
246 }
247
248 int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
249 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
250 memcpy(c.d.asBytes, data, blocksCount * 16);
251 SendCommand(&c);
252 return 0;
253 }
254
255 int hf_iclass_eload_usage(void) {
256 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
257 PrintAndLog("Usage: hf iclass eload f <filename>");
258 PrintAndLog("");
259 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
260 return 0;
261 }
262
263 int CmdHFiClassELoad(const char *Cmd) {
264
265 char opt = param_getchar(Cmd, 0);
266 if (strlen(Cmd)<1 || opt == 'h')
267 return hf_iclass_eload_usage();
268
269 //File handling and reading
270 FILE *f;
271 char filename[FILE_PATH_SIZE];
272 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
273 {
274 f = fopen(filename, "rb");
275 }else{
276 return hf_iclass_eload_usage();
277 }
278
279 if(!f) {
280 PrintAndLog("Failed to read from file '%s'", filename);
281 return 1;
282 }
283
284 fseek(f, 0, SEEK_END);
285 long fsize = ftell(f);
286 fseek(f, 0, SEEK_SET);
287
288 uint8_t *dump = malloc(fsize);
289
290
291 size_t bytes_read = fread(dump, 1, fsize, f);
292 fclose(f);
293
294 printIclassDumpInfo(dump);
295 //Validate
296
297 if (bytes_read < fsize)
298 {
299 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
300 free(dump);
301 return 1;
302 }
303 //Send to device
304 uint32_t bytes_sent = 0;
305 uint32_t bytes_remaining = bytes_read;
306
307 while(bytes_remaining > 0){
308 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
309 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
310 memcpy(c.d.asBytes, dump, bytes_in_packet);
311 SendCommand(&c);
312 bytes_remaining -= bytes_in_packet;
313 bytes_sent += bytes_in_packet;
314 }
315 free(dump);
316 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
317 return 0;
318 }
319
320 static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
321 FILE *f = fopen(filename, "rb");
322 if(!f) {
323 PrintAndLog("Failed to read from file '%s'", filename);
324 return 1;
325 }
326 fseek(f, 0, SEEK_END);
327 long fsize = ftell(f);
328 fseek(f, 0, SEEK_SET);
329 size_t bytes_read = fread(buffer, 1, len, f);
330 fclose(f);
331 if(fsize != len)
332 {
333 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
334 return 1;
335 }
336 if(bytes_read != len)
337 {
338 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
339 return 1;
340 }
341 return 0;
342 }
343
344 int usage_hf_iclass_decrypt(void) {
345 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
346 PrintAndLog("");
347 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
348 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
349 PrintAndLog("");
350 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
351 PrintAndLog("");
352 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
353 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
354 PrintAndLog("which is defined by the configuration block.");
355 return 1;
356 }
357
358 int CmdHFiClassDecrypt(const char *Cmd) {
359 uint8_t key[16] = { 0 };
360 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
361 {
362 usage_hf_iclass_decrypt();
363 return 1;
364 }
365 PrintAndLog("Decryption file found... ");
366 char opt = param_getchar(Cmd, 0);
367 if (strlen(Cmd)<1 || opt == 'h')
368 return usage_hf_iclass_decrypt();
369
370 //Open the tagdump-file
371 FILE *f;
372 char filename[FILE_PATH_SIZE];
373 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
374 {
375 f = fopen(filename, "rb");
376 }else{
377 return usage_hf_iclass_decrypt();
378 }
379
380 fseek(f, 0, SEEK_END);
381 long fsize = ftell(f);
382 fseek(f, 0, SEEK_SET);
383 uint8_t enc_dump[8] = {0};
384 uint8_t *decrypted = malloc(fsize);
385 des3_context ctx = { DES_DECRYPT ,{ 0 } };
386 des3_set2key_dec( &ctx, key);
387 size_t bytes_read = fread(enc_dump, 1, 8, f);
388
389 //Use the first block (CSN) for filename
390 char outfilename[FILE_PATH_SIZE] = { 0 };
391 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
392 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
393 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
394
395 size_t blocknum =0;
396 while(bytes_read == 8)
397 {
398 if(blocknum < 7)
399 {
400 memcpy(decrypted+(blocknum*8), enc_dump, 8);
401 }else{
402 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
403 }
404 printvar("decrypted block", decrypted +(blocknum*8), 8);
405 bytes_read = fread(enc_dump, 1, 8, f);
406 blocknum++;
407 }
408 fclose(f);
409
410 saveFile(outfilename,"bin", decrypted, blocknum*8);
411
412 free(decrypted);
413 return 0;
414 }
415
416 int usage_hf_iclass_encrypt(void) {
417 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
418 PrintAndLog("");
419 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
420 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
421 PrintAndLog("");
422 PrintAndLog("example: hf iclass encrypt 0102030405060708");
423 PrintAndLog("");
424 return 0;
425 }
426
427 static int iClassEncryptBlkData(uint8_t *blkData) {
428 uint8_t key[16] = { 0 };
429 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
430 {
431 usage_hf_iclass_encrypt();
432 return 1;
433 }
434 PrintAndLog("Decryption file found... ");
435
436 uint8_t encryptedData[16];
437 uint8_t *encrypted = encryptedData;
438 des3_context ctx = { DES_DECRYPT ,{ 0 } };
439 des3_set2key_enc( &ctx, key);
440
441 des3_crypt_ecb(&ctx, blkData,encrypted);
442 //printvar("decrypted block", decrypted, 8);
443 memcpy(blkData,encrypted,8);
444
445 return 1;
446 }
447
448 int CmdHFiClassEncryptBlk(const char *Cmd) {
449 uint8_t blkData[8] = {0};
450 char opt = param_getchar(Cmd, 0);
451 if (strlen(Cmd)<1 || opt == 'h')
452 return usage_hf_iclass_encrypt();
453
454 //get the bytes to encrypt
455 if (param_gethex(Cmd, 0, blkData, 16))
456 {
457 PrintAndLog("BlockData must include 16 HEX symbols");
458 return 0;
459 }
460 if (!iClassEncryptBlkData(blkData)) return 0;
461
462 printvar("encrypted block", blkData, 8);
463 return 1;
464 }
465
466 void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
467 uint8_t WB[9];
468 WB[0] = blockno;
469 memcpy(WB + 1,data,8);
470 doMAC_N(WB,sizeof(WB),div_key,MAC);
471 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
472 }
473
474 static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
475 UsbCommand resp;
476
477 UsbCommand c = {CMD_READER_ICLASS, {0}};
478 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
479 if (use_credit_key)
480 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
481
482 clearCommandBuffer();
483 SendCommand(&c);
484 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
485 {
486 PrintAndLog("Command execute timeout");
487 return false;
488 }
489
490 uint8_t isOK = resp.arg[0] & 0xff;
491 uint8_t *data = resp.d.asBytes;
492
493 memcpy(CSN,data,8);
494 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
495 if(isOK > 0)
496 {
497 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
498 }
499 if(isOK <= 1){
500 PrintAndLog("Failed to obtain CC! Aborting");
501 return false;
502 }
503 return true;
504 }
505
506 static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
507 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
508 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
509
510 if (!select_only(CSN, CCNR, use_credit_key, verbose))
511 return false;
512
513 //get div_key
514 if(rawkey)
515 memcpy(div_key, KEY, 8);
516 else
517 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
518 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
519
520 doMAC(CCNR, div_key, MAC);
521 UsbCommand resp;
522 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
523 memcpy(d.d.asBytes, MAC, 4);
524 clearCommandBuffer();
525 SendCommand(&d);
526 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
527 {
528 PrintAndLog("Auth Command execute timeout");
529 return false;
530 }
531 uint8_t isOK = resp.arg[0] & 0xff;
532 if (!isOK) {
533 PrintAndLog("Authentication error");
534 return false;
535 }
536 return true;
537 }
538
539 int usage_hf_iclass_dump(void) {
540 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
541 PrintAndLog("Options:");
542 PrintAndLog(" f <filename> : specify a filename to save dump to");
543 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
544 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
545 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
546 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
547 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
548 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
549 PrintAndLog(" NOTE: * = required");
550 PrintAndLog("Samples:");
551 PrintAndLog(" hf iclass dump k 001122334455667B");
552 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
553 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
554 return 0;
555 }
556
557 int CmdHFiClassReader_Dump(const char *Cmd) {
558
559 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
560 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
561 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
562 uint8_t blockno = 0;
563 uint8_t numblks = 0;
564 uint8_t maxBlk = 31;
565 uint8_t app_areas = 1;
566 uint8_t kb = 2;
567 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
568 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
569 uint8_t keyNbr = 0;
570 uint8_t dataLen = 0;
571 uint8_t fileNameLen = 0;
572 char filename[FILE_PATH_SIZE]={0};
573 char tempStr[50] = {0};
574 bool have_debit_key = false;
575 bool have_credit_key = false;
576 bool use_credit_key = false;
577 bool elite = false;
578 bool rawkey = false;
579 bool errors = false;
580 uint8_t cmdp = 0;
581
582 while(param_getchar(Cmd, cmdp) != 0x00)
583 {
584 switch(param_getchar(Cmd, cmdp))
585 {
586 case 'h':
587 case 'H':
588 return usage_hf_iclass_dump();
589 case 'c':
590 case 'C':
591 have_credit_key = true;
592 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
593 if (dataLen == 16) {
594 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
595 } else if (dataLen == 1) {
596 keyNbr = param_get8(Cmd, cmdp+1);
597 if (keyNbr <= ICLASS_KEYS_MAX) {
598 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
599 } else {
600 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
601 errors = true;
602 }
603 } else {
604 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
605 errors = true;
606 }
607 cmdp += 2;
608 break;
609 case 'e':
610 case 'E':
611 elite = true;
612 cmdp++;
613 break;
614 case 'f':
615 case 'F':
616 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
617 if (fileNameLen < 1) {
618 PrintAndLog("No filename found after f");
619 errors = true;
620 }
621 cmdp += 2;
622 break;
623 case 'k':
624 case 'K':
625 have_debit_key = true;
626 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
627 if (dataLen == 16) {
628 errors = param_gethex(tempStr, 0, KEY, dataLen);
629 } else if (dataLen == 1) {
630 keyNbr = param_get8(Cmd, cmdp+1);
631 if (keyNbr <= ICLASS_KEYS_MAX) {
632 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
633 } else {
634 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
635 errors = true;
636 }
637 } else {
638 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
639 errors = true;
640 }
641 cmdp += 2;
642 break;
643 case 'r':
644 case 'R':
645 rawkey = true;
646 cmdp++;
647 break;
648 default:
649 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
650 errors = true;
651 break;
652 }
653 if(errors) return usage_hf_iclass_dump();
654 }
655
656 if (cmdp < 2) return usage_hf_iclass_dump();
657 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
658 if (!have_debit_key && have_credit_key) use_credit_key = true;
659
660 //get config and first 3 blocks
661 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
662 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
663 UsbCommand resp;
664 uint8_t tag_data[255*8];
665
666 clearCommandBuffer();
667 SendCommand(&c);
668 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
669 PrintAndLog("Command execute timeout");
670 ul_switch_off_field();
671 return 0;
672 }
673 uint8_t readStatus = resp.arg[0] & 0xff;
674 uint8_t * data = resp.d.asBytes;
675
676 if(readStatus == 0){
677 PrintAndLog("No tag found...");
678 ul_switch_off_field();
679 return 0;
680 }
681 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
682 memcpy(tag_data, data, 8*3);
683 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
684 numblks = data[8];
685 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
686 // large memory - not able to dump pages currently
687 if (numblks > maxBlk) numblks = maxBlk;
688 }
689 ul_switch_off_field();
690 // authenticate debit key and get div_key - later store in dump block 3
691 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
692 //try twice - for some reason it sometimes fails the first time...
693 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
694 ul_switch_off_field();
695 return 0;
696 }
697 }
698
699 // begin dump
700 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
701 clearCommandBuffer();
702 SendCommand(&w);
703 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
704 PrintAndLog("Command execute time-out 1");
705 ul_switch_off_field();
706 return 1;
707 }
708 uint32_t blocksRead = resp.arg[1];
709 uint8_t isOK = resp.arg[0] & 0xff;
710 if (!isOK && !blocksRead) {
711 PrintAndLog("Read Block Failed");
712 ul_switch_off_field();
713 return 0;
714 }
715 uint32_t startindex = resp.arg[2];
716 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
717 PrintAndLog("Data exceeded Buffer size!");
718 blocksRead = (sizeof(tag_data)/8) - blockno;
719 }
720 // response ok - now get bigbuf content of the dump
721 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
722 WaitForResponse(CMD_ACK,NULL);
723 size_t gotBytes = blocksRead*8 + blockno*8;
724
725 // try AA2
726 if (have_credit_key) {
727 //turn off hf field before authenticating with different key
728 ul_switch_off_field();
729 memset(MAC,0,4);
730 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
731 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
732 //try twice - for some reason it sometimes fails the first time...
733 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
734 ul_switch_off_field();
735 return 0;
736 }
737 }
738 // do we still need to read more block? (aa2 enabled?)
739 if (maxBlk > blockno+numblks+1) {
740 // setup dump and start
741 w.arg[0] = blockno + blocksRead;
742 w.arg[1] = maxBlk - (blockno + blocksRead);
743 clearCommandBuffer();
744 SendCommand(&w);
745 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
746 PrintAndLog("Command execute timeout 2");
747 ul_switch_off_field();
748 return 0;
749 }
750 uint8_t isOK = resp.arg[0] & 0xff;
751 blocksRead = resp.arg[1];
752 if (!isOK && !blocksRead) {
753 PrintAndLog("Read Block Failed 2");
754 ul_switch_off_field();
755 return 0;
756 }
757
758 startindex = resp.arg[2];
759 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
760 PrintAndLog("Data exceeded Buffer size!");
761 blocksRead = (sizeof(tag_data) - gotBytes)/8;
762 }
763 // get dumped data from bigbuf
764 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
765 WaitForResponse(CMD_ACK,NULL);
766
767 gotBytes += blocksRead*8;
768 } else { //field is still on - turn it off...
769 ul_switch_off_field();
770 }
771 }
772
773 // add diversified keys to dump
774 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
775 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
776 // print the dump
777 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
778 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
779 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
780
781 if (filename[0] == 0){
782 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
783 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
784 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
785 }
786
787 // save the dump to .bin file
788 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
789 saveFile(filename, "bin", tag_data, gotBytes);
790 return 1;
791 }
792
793 static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
794 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
795 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
796 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
797 return 0;
798
799 UsbCommand resp;
800
801 Calc_wb_mac(blockno,bldata,div_key,MAC);
802 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
803 memcpy(w.d.asBytes, bldata, 8);
804 memcpy(w.d.asBytes + 8, MAC, 4);
805
806 clearCommandBuffer();
807 SendCommand(&w);
808 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
809 {
810 PrintAndLog("Write Command execute timeout");
811 return 0;
812 }
813 uint8_t isOK = resp.arg[0] & 0xff;
814 if (!isOK) {
815 PrintAndLog("Write Block Failed");
816 return 0;
817 }
818 PrintAndLog("Write Block Successful");
819 return 1;
820 }
821
822 int usage_hf_iclass_writeblock(void) {
823 PrintAndLog("Options:");
824 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
825 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
826 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
827 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
828 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
829 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
830 PrintAndLog("Samples:");
831 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
832 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
833 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
834 return 0;
835 }
836
837 int CmdHFiClass_WriteBlock(const char *Cmd) {
838 uint8_t blockno=0;
839 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
840 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
841 uint8_t keyNbr = 0;
842 uint8_t dataLen = 0;
843 char tempStr[50] = {0};
844 bool use_credit_key = false;
845 bool elite = false;
846 bool rawkey= false;
847 bool errors = false;
848 uint8_t cmdp = 0;
849 while(param_getchar(Cmd, cmdp) != 0x00)
850 {
851 switch(param_getchar(Cmd, cmdp))
852 {
853 case 'h':
854 case 'H':
855 return usage_hf_iclass_writeblock();
856 case 'b':
857 case 'B':
858 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
859 PrintAndLog("Block No must include 2 HEX symbols\n");
860 errors = true;
861 }
862 cmdp += 2;
863 break;
864 case 'c':
865 case 'C':
866 use_credit_key = true;
867 cmdp++;
868 break;
869 case 'd':
870 case 'D':
871 if (param_gethex(Cmd, cmdp+1, bldata, 16))
872 {
873 PrintAndLog("KEY must include 16 HEX symbols\n");
874 errors = true;
875 }
876 cmdp += 2;
877 break;
878 case 'e':
879 case 'E':
880 elite = true;
881 cmdp++;
882 break;
883 case 'k':
884 case 'K':
885 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
886 if (dataLen == 16) {
887 errors = param_gethex(tempStr, 0, KEY, dataLen);
888 } else if (dataLen == 1) {
889 keyNbr = param_get8(Cmd, cmdp+1);
890 if (keyNbr <= ICLASS_KEYS_MAX) {
891 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
892 } else {
893 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
894 errors = true;
895 }
896 } else {
897 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
898 errors = true;
899 }
900 cmdp += 2;
901 break;
902 case 'r':
903 case 'R':
904 rawkey = true;
905 cmdp++;
906 break;
907 default:
908 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
909 errors = true;
910 break;
911 }
912 if(errors) return usage_hf_iclass_writeblock();
913 }
914
915 if (cmdp < 6) return usage_hf_iclass_writeblock();
916 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
917 ul_switch_off_field();
918 return ans;
919 }
920
921 int usage_hf_iclass_clone(void) {
922 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
923 PrintAndLog("Options:");
924 PrintAndLog(" f <filename>: specify a filename to clone from");
925 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
926 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
927 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
928 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
929 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
930 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
931 PrintAndLog("Samples:");
932 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
933 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
934 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
935 return -1;
936 }
937
938 int CmdHFiClassCloneTag(const char *Cmd) {
939 char filename[FILE_PATH_SIZE];
940 char tempStr[50]={0};
941 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
942 uint8_t keyNbr = 0;
943 uint8_t fileNameLen = 0;
944 uint8_t startblock = 0;
945 uint8_t endblock = 0;
946 uint8_t dataLen = 0;
947 bool use_credit_key = false;
948 bool elite = false;
949 bool rawkey = false;
950 bool errors = false;
951 uint8_t cmdp = 0;
952 while(param_getchar(Cmd, cmdp) != 0x00)
953 {
954 switch(param_getchar(Cmd, cmdp))
955 {
956 case 'h':
957 case 'H':
958 return usage_hf_iclass_clone();
959 case 'b':
960 case 'B':
961 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
962 PrintAndLog("Start Block No must include 2 HEX symbols\n");
963 errors = true;
964 }
965 cmdp += 2;
966 break;
967 case 'c':
968 case 'C':
969 use_credit_key = true;
970 cmdp++;
971 break;
972 case 'e':
973 case 'E':
974 elite = true;
975 cmdp++;
976 break;
977 case 'f':
978 case 'F':
979 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
980 if (fileNameLen < 1) {
981 PrintAndLog("No filename found after f");
982 errors = true;
983 }
984 cmdp += 2;
985 break;
986 case 'k':
987 case 'K':
988 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
989 if (dataLen == 16) {
990 errors = param_gethex(tempStr, 0, KEY, dataLen);
991 } else if (dataLen == 1) {
992 keyNbr = param_get8(Cmd, cmdp+1);
993 if (keyNbr <= ICLASS_KEYS_MAX) {
994 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
995 } else {
996 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
997 errors = true;
998 }
999 } else {
1000 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1001 errors = true;
1002 }
1003 cmdp += 2;
1004 break;
1005 case 'l':
1006 case 'L':
1007 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1008 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1009 errors = true;
1010 }
1011 cmdp += 2;
1012 break;
1013 case 'r':
1014 case 'R':
1015 rawkey = true;
1016 cmdp++;
1017 break;
1018 default:
1019 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1020 errors = true;
1021 break;
1022 }
1023 if(errors) return usage_hf_iclass_clone();
1024 }
1025
1026 if (cmdp < 8) return usage_hf_iclass_clone();
1027
1028 FILE *f;
1029
1030 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1031
1032 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1033 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1034 }
1035 // file handling and reading
1036 f = fopen(filename,"rb");
1037 if(!f) {
1038 PrintAndLog("Failed to read from file '%s'", filename);
1039 return 1;
1040 }
1041
1042 if (startblock<5) {
1043 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1044 return 0;
1045 }
1046 // now read data from the file from block 6 --- 19
1047 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1048 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1049 // else we have to create a share memory
1050 int i;
1051 fseek(f,startblock*8,SEEK_SET);
1052 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0){
1053 PrintAndLog("File reading error.");
1054 fclose(f);
1055 return 2;
1056 }
1057
1058 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1059 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1060
1061 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
1062 return 0;
1063
1064 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
1065 uint8_t *ptr;
1066 // calculate all mac for every the block we will write
1067 for (i = startblock; i <= endblock; i++){
1068 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1069 // usb command d start pointer = d + (i - 6) * 12
1070 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1071 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1072 // next one
1073 ptr = w.d.asBytes + (i - startblock) * 12;
1074 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1075 memcpy(ptr + 8,MAC, 4);
1076 }
1077 uint8_t p[12];
1078 for (i = 0; i <= endblock - startblock;i++){
1079 memcpy(p,w.d.asBytes + (i * 12),12);
1080 printf("Block |%02x|",i + startblock);
1081 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1082 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1083 }
1084 UsbCommand resp;
1085 SendCommand(&w);
1086 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1087 {
1088 PrintAndLog("Command execute timeout");
1089 return 0;
1090 }
1091 return 1;
1092 }
1093
1094 static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose) {
1095 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1096 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1097
1098 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
1099 return 0;
1100
1101 UsbCommand resp;
1102 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
1103 clearCommandBuffer();
1104 SendCommand(&w);
1105 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1106 {
1107 PrintAndLog("Command execute timeout");
1108 return 0;
1109 }
1110 uint8_t isOK = resp.arg[0] & 0xff;
1111 if (!isOK) {
1112 PrintAndLog("Read Block Failed");
1113 return 0;
1114 }
1115 //data read is stored in: resp.d.asBytes[0-15]
1116 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1117 return 1;
1118 }
1119
1120 int usage_hf_iclass_readblock(void) {
1121 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
1122 PrintAndLog("Options:");
1123 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1124 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1125 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1126 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1127 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
1128 PrintAndLog("Samples:");
1129 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1130 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1131 PrintAndLog(" hf iclass readblk b 0A k 0");
1132 return 0;
1133 }
1134
1135 int CmdHFiClass_ReadBlock(const char *Cmd) {
1136 uint8_t blockno=0;
1137 uint8_t keyType = 0x88; //debit key
1138 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1139 uint8_t keyNbr = 0;
1140 uint8_t dataLen = 0;
1141 char tempStr[50] = {0};
1142 bool elite = false;
1143 bool rawkey = false;
1144 bool errors = false;
1145 uint8_t cmdp = 0;
1146 while(param_getchar(Cmd, cmdp) != 0x00)
1147 {
1148 switch(param_getchar(Cmd, cmdp))
1149 {
1150 case 'h':
1151 case 'H':
1152 return usage_hf_iclass_readblock();
1153 case 'b':
1154 case 'B':
1155 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1156 PrintAndLog("Block No must include 2 HEX symbols\n");
1157 errors = true;
1158 }
1159 cmdp += 2;
1160 break;
1161 case 'c':
1162 case 'C':
1163 keyType = 0x18;
1164 cmdp++;
1165 break;
1166 case 'e':
1167 case 'E':
1168 elite = true;
1169 cmdp++;
1170 break;
1171 case 'k':
1172 case 'K':
1173 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1174 if (dataLen == 16) {
1175 errors = param_gethex(tempStr, 0, KEY, dataLen);
1176 } else if (dataLen == 1) {
1177 keyNbr = param_get8(Cmd, cmdp+1);
1178 if (keyNbr <= ICLASS_KEYS_MAX) {
1179 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1180 } else {
1181 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1182 errors = true;
1183 }
1184 } else {
1185 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1186 errors = true;
1187 }
1188 cmdp += 2;
1189 break;
1190 case 'r':
1191 case 'R':
1192 rawkey = true;
1193 cmdp++;
1194 break;
1195 default:
1196 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1197 errors = true;
1198 break;
1199 }
1200 if(errors) return usage_hf_iclass_readblock();
1201 }
1202
1203 if (cmdp < 4) return usage_hf_iclass_readblock();
1204
1205 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true);
1206 }
1207
1208 int CmdHFiClass_loclass(const char *Cmd) {
1209 char opt = param_getchar(Cmd, 0);
1210
1211 if (strlen(Cmd)<1 || opt == 'h') {
1212 PrintAndLog("Usage: hf iclass loclass [options]");
1213 PrintAndLog("Options:");
1214 PrintAndLog("h Show this help");
1215 PrintAndLog("t Perform self-test");
1216 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1217 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1218 PrintAndLog(" malicious CSNs, and their protocol responses");
1219 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1220 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1221 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1222 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1223 PrintAndLog(" ... totalling N*24 bytes");
1224 return 0;
1225 }
1226 char fileName[255] = {0};
1227 if(opt == 'f')
1228 {
1229 if(param_getstr(Cmd, 1, fileName) > 0)
1230 {
1231 return bruteforceFileNoKeys(fileName);
1232 }else
1233 {
1234 PrintAndLog("You must specify a filename");
1235 }
1236 }
1237 else if(opt == 't')
1238 {
1239 int errors = testCipherUtils();
1240 errors += testMAC();
1241 errors += doKeyTests(0);
1242 errors += testElite();
1243 if(errors)
1244 {
1245 prnlog("OBS! There were errors!!!");
1246 }
1247 return errors;
1248 }
1249
1250 return 0;
1251 }
1252
1253 void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1254 uint8_t blockdata[8];
1255 uint8_t mem_config;
1256 memcpy(&mem_config, iclass_dump + 13,1);
1257 uint8_t maxmemcount;
1258 uint8_t filemaxblock = filesize / 8;
1259 if (mem_config & 0x80)
1260 maxmemcount = 255;
1261 else
1262 maxmemcount = 31;
1263 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1264
1265 if (startblock == 0)
1266 startblock = 6;
1267 if ((endblock > maxmemcount) || (endblock == 0))
1268 endblock = maxmemcount;
1269 if (endblock > filemaxblock)
1270 endblock = filemaxblock;
1271 int i = startblock;
1272 int j;
1273 while (i <= endblock){
1274 printf("Block |%02X| ",i);
1275 memcpy(blockdata,iclass_dump + (i * 8),8);
1276 for (j = 0;j < 8;j++)
1277 printf("%02X ",blockdata[j]);
1278 printf("|\n");
1279 i++;
1280 }
1281 }
1282
1283 int usage_hf_iclass_readtagfile() {
1284 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1285 return 1;
1286 }
1287
1288 int CmdHFiClassReadTagFile(const char *Cmd) {
1289 int startblock = 0;
1290 int endblock = 0;
1291 char tempnum[5];
1292 FILE *f;
1293 char filename[FILE_PATH_SIZE];
1294 if (param_getstr(Cmd, 0, filename) < 1)
1295 return usage_hf_iclass_readtagfile();
1296 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1297 startblock = 0;
1298 else
1299 sscanf(tempnum,"%d",&startblock);
1300
1301 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1302 endblock = 0;
1303 else
1304 sscanf(tempnum,"%d",&endblock);
1305 // file handling and reading
1306 f = fopen(filename,"rb");
1307 if(!f) {
1308 PrintAndLog("Failed to read from file '%s'", filename);
1309 return 1;
1310 }
1311 fseek(f, 0, SEEK_END);
1312 long fsize = ftell(f);
1313 fseek(f, 0, SEEK_SET);
1314
1315 uint8_t *dump = malloc(fsize);
1316
1317
1318 size_t bytes_read = fread(dump, 1, fsize, f);
1319 fclose(f);
1320 uint8_t *csn = dump;
1321 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
1322 // printIclassDumpInfo(dump);
1323 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1324 free(dump);
1325 return 0;
1326 }
1327
1328 /*
1329 uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1330 uint64_t new_div = 0x00;
1331 new_div ^= sdiv;
1332 new_div ^= hdiv;
1333 return new_div;
1334 }
1335
1336 uint64_t hexarray_to_uint64(uint8_t *key) {
1337 char temp[17];
1338 uint64_t uint_key;
1339 for (int i = 0;i < 8;i++)
1340 sprintf(&temp[(i *2)],"%02X",key[i]);
1341 temp[16] = '\0';
1342 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1343 return 0;
1344 return uint_key;
1345 }
1346 */
1347 void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1348 uint8_t keytable[128] = {0};
1349 uint8_t key_index[8] = {0};
1350 if (elite) {
1351 uint8_t key_sel[8] = { 0 };
1352 uint8_t key_sel_p[8] = { 0 };
1353 hash2(KEY, keytable);
1354 hash1(CSN, key_index);
1355 for(uint8_t i = 0; i < 8 ; i++)
1356 key_sel[i] = keytable[key_index[i]] & 0xFF;
1357
1358 //Permute from iclass format to standard format
1359 permutekey_rev(key_sel, key_sel_p);
1360 diversifyKey(CSN, key_sel_p, div_key);
1361 } else {
1362 diversifyKey(CSN, KEY, div_key);
1363 }
1364 }
1365
1366 //when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1367 //calculate and return xor_div_key (ready for a key write command)
1368 //print all div_keys if verbose
1369 static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1370 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1371 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1372 //get old div key
1373 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1374 //get new div key
1375 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1376
1377 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1378 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1379 }
1380 if (verbose) {
1381 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1382 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1383 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1384 }
1385 }
1386
1387 int usage_hf_iclass_calc_newkey(void) {
1388 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1389 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1390 PrintAndLog(" Options:");
1391 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1392 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1393 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1394 PrintAndLog(" e : specify new key as elite calc");
1395 PrintAndLog(" ee : specify old and new key as elite calc");
1396 PrintAndLog("Samples:");
1397 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1398 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1399 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1400 PrintAndLog("NOTE: * = required\n");
1401
1402 return 1;
1403 }
1404
1405 int CmdHFiClassCalcNewKey(const char *Cmd) {
1406 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1407 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1408 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1409 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1410 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1411 uint8_t keyNbr = 0;
1412 uint8_t dataLen = 0;
1413 char tempStr[50] = {0};
1414 bool givenCSN = false;
1415 bool oldElite = false;
1416 bool elite = false;
1417 bool errors = false;
1418 uint8_t cmdp = 0;
1419 while(param_getchar(Cmd, cmdp) != 0x00)
1420 {
1421 switch(param_getchar(Cmd, cmdp))
1422 {
1423 case 'h':
1424 case 'H':
1425 return usage_hf_iclass_calc_newkey();
1426 case 'e':
1427 case 'E':
1428 dataLen = param_getstr(Cmd, cmdp, tempStr);
1429 if (dataLen==2)
1430 oldElite = true;
1431 elite = true;
1432 cmdp++;
1433 break;
1434 case 'n':
1435 case 'N':
1436 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1437 if (dataLen == 16) {
1438 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1439 } else if (dataLen == 1) {
1440 keyNbr = param_get8(Cmd, cmdp+1);
1441 if (keyNbr <= ICLASS_KEYS_MAX) {
1442 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1443 } else {
1444 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1445 errors = true;
1446 }
1447 } else {
1448 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1449 errors = true;
1450 }
1451 cmdp += 2;
1452 break;
1453 case 'o':
1454 case 'O':
1455 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1456 if (dataLen == 16) {
1457 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1458 } else if (dataLen == 1) {
1459 keyNbr = param_get8(Cmd, cmdp+1);
1460 if (keyNbr <= ICLASS_KEYS_MAX) {
1461 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1462 } else {
1463 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1464 errors = true;
1465 }
1466 } else {
1467 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1468 errors = true;
1469 }
1470 cmdp += 2;
1471 break;
1472 case 's':
1473 case 'S':
1474 givenCSN = true;
1475 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1476 return usage_hf_iclass_calc_newkey();
1477 cmdp += 2;
1478 break;
1479 default:
1480 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1481 errors = true;
1482 break;
1483 }
1484 if(errors) return usage_hf_iclass_calc_newkey();
1485 }
1486
1487 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1488
1489 if (!givenCSN)
1490 if (!select_only(CSN, CCNR, false, true))
1491 return 0;
1492
1493 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1494 return 0;
1495 }
1496
1497 static int loadKeys(char *filename) {
1498 FILE *f;
1499 f = fopen(filename,"rb");
1500 if(!f) {
1501 PrintAndLog("Failed to read from file '%s'", filename);
1502 return 0;
1503 }
1504 fseek(f, 0, SEEK_END);
1505 long fsize = ftell(f);
1506 fseek(f, 0, SEEK_SET);
1507
1508 uint8_t *dump = malloc(fsize);
1509
1510 size_t bytes_read = fread(dump, 1, fsize, f);
1511 fclose(f);
1512 if (bytes_read > ICLASS_KEYS_MAX * 8){
1513 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1514 free(dump);
1515 return 0;
1516 }
1517 uint8_t i = 0;
1518 for (; i < bytes_read/8; i++){
1519 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1520 }
1521 free(dump);
1522 PrintAndLog("%u keys loaded", i);
1523 return 1;
1524 }
1525
1526 static int saveKeys(char *filename) {
1527 FILE *f;
1528 f = fopen(filename,"wb");
1529 if (f == NULL) {
1530 printf("error opening file %s\n",filename);
1531 return 0;
1532 }
1533 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1534 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1535 PrintAndLog("save key failed to write to file: %s", filename);
1536 break;
1537 }
1538 }
1539 fclose(f);
1540 return 0;
1541 }
1542
1543 static int printKeys(void) {
1544 PrintAndLog("");
1545 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1546 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1547 }
1548 PrintAndLog("");
1549 return 0;
1550 }
1551
1552 int usage_hf_iclass_managekeys(void) {
1553 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1554 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1555 PrintAndLog(" Options:");
1556 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1557 PrintAndLog(" k <key> : set a key in memory");
1558 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1559 PrintAndLog(" s : save keys in memory to file specified by filename");
1560 PrintAndLog(" l : load keys to memory from file specified by filename");
1561 PrintAndLog(" p : print keys loaded into memory\n");
1562 PrintAndLog("Samples:");
1563 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1564 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1565 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1566 PrintAndLog(" print keys : hf iclass managekeys p\n");
1567 return 0;
1568 }
1569
1570 int CmdHFiClassManageKeys(const char *Cmd) {
1571 uint8_t keyNbr = 0;
1572 uint8_t dataLen = 0;
1573 uint8_t KEY[8] = {0};
1574 char filename[FILE_PATH_SIZE];
1575 uint8_t fileNameLen = 0;
1576 bool errors = false;
1577 uint8_t operation = 0;
1578 char tempStr[20];
1579 uint8_t cmdp = 0;
1580
1581 while(param_getchar(Cmd, cmdp) != 0x00)
1582 {
1583 switch(param_getchar(Cmd, cmdp))
1584 {
1585 case 'h':
1586 case 'H':
1587 return usage_hf_iclass_managekeys();
1588 case 'f':
1589 case 'F':
1590 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1591 if (fileNameLen < 1) {
1592 PrintAndLog("No filename found after f");
1593 errors = true;
1594 }
1595 cmdp += 2;
1596 break;
1597 case 'n':
1598 case 'N':
1599 keyNbr = param_get8(Cmd, cmdp+1);
1600 if (keyNbr < 0) {
1601 PrintAndLog("Wrong block number");
1602 errors = true;
1603 }
1604 cmdp += 2;
1605 break;
1606 case 'k':
1607 case 'K':
1608 operation += 3; //set key
1609 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1610 if (dataLen == 16) { //ul-c or ev1/ntag key length
1611 errors = param_gethex(tempStr, 0, KEY, dataLen);
1612 } else {
1613 PrintAndLog("\nERROR: Key is incorrect length\n");
1614 errors = true;
1615 }
1616 cmdp += 2;
1617 break;
1618 case 'p':
1619 case 'P':
1620 operation += 4; //print keys in memory
1621 cmdp++;
1622 break;
1623 case 'l':
1624 case 'L':
1625 operation += 5; //load keys from file
1626 cmdp++;
1627 break;
1628 case 's':
1629 case 'S':
1630 operation += 6; //save keys to file
1631 cmdp++;
1632 break;
1633 default:
1634 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1635 errors = true;
1636 break;
1637 }
1638 if(errors) return usage_hf_iclass_managekeys();
1639 }
1640 if (operation == 0){
1641 PrintAndLog("no operation specified (load, save, or print)\n");
1642 return usage_hf_iclass_managekeys();
1643 }
1644 if (operation > 6){
1645 PrintAndLog("Too many operations specified\n");
1646 return usage_hf_iclass_managekeys();
1647 }
1648 if (operation > 4 && fileNameLen == 0){
1649 PrintAndLog("You must enter a filename when loading or saving\n");
1650 return usage_hf_iclass_managekeys();
1651 }
1652
1653 switch (operation){
1654 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1655 case 4: return printKeys();
1656 case 5: return loadKeys(filename);
1657 case 6: return saveKeys(filename);
1658 break;
1659 }
1660 return 0;
1661 }
1662
1663 static command_t CommandTable[] =
1664 {
1665 {"help", CmdHelp, 1, "This help"},
1666 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1667 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1668 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1669 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1670 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1671 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1672 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1673 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1674 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1675 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1676 {"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
1677 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1678 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1679 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1680 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1681 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
1682 {NULL, NULL, 0, NULL}
1683 };
1684
1685 int CmdHFiClass(const char *Cmd)
1686 {
1687 CmdsParse(CommandTable, Cmd);
1688 return 0;
1689 }
1690
1691 int CmdHelp(const char *Cmd)
1692 {
1693 CmdsHelp(CommandTable);
1694 return 0;
1695 }
Proxmark3 GIT tracking
Impressum, Datenschutz