1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3 // Copyright (C) 2011 Gerhard de Koning Gans
4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
9 //-----------------------------------------------------------------------------
10 // High frequency iClass commands
11 //-----------------------------------------------------------------------------
17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
19 #include "proxmark3.h"
21 #include "cmdparser.h"
22 #include "cmdhficlass.h"
26 #include "loclass/des.h"
27 #include "loclass/cipherutils.h"
28 #include "loclass/cipher.h"
29 #include "loclass/ikeys.h"
30 #include "loclass/elite_crack.h"
31 #include "loclass/fileutils.h"
32 #include "protocols.h"
37 static int CmdHelp(const char *Cmd
);
39 #define ICLASS_KEYS_MAX 8
40 static uint8_t iClass_Key_Table
[ICLASS_KEYS_MAX
][8] = {
41 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
51 typedef struct iclass_block
{
55 int xorbits_8(uint8_t val
) {
56 uint8_t res
= val
^ (val
>> 1); //1st pass
57 res
= res
^ (res
>> 1); // 2nd pass
58 res
= res
^ (res
>> 2); // 3rd pass
59 res
= res
^ (res
>> 4); // 4th pass
63 int CmdHFiClassList(const char *Cmd
) {
64 //PrintAndLog("Deprecated command, use 'hf list iclass' instead");
69 int CmdHFiClassSnoop(const char *Cmd
) {
70 UsbCommand c
= {CMD_SNOOP_ICLASS
};
75 int usage_hf_iclass_sim(void) {
76 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
77 PrintAndLog(" options");
78 PrintAndLog(" 0 <CSN> simulate the given CSN");
79 PrintAndLog(" 1 simulate default CSN");
80 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
81 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
82 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
83 PrintAndLog(" example: hf iclass sim 2");
84 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
85 PrintAndLog(" hf iclass sim 3");
90 int CmdHFiClassSim(const char *Cmd
) {
92 uint8_t CSN
[8] = {0, 0, 0, 0, 0, 0, 0, 0};
94 if (strlen(Cmd
)<1) return usage_hf_iclass_sim();
96 simType
= param_get8ex(Cmd
, 0, 0, 10);
100 if (param_gethex(Cmd
, 1, CSN
, 16)) {
101 PrintAndLog("A CSN should consist of 16 HEX symbols");
102 return usage_hf_iclass_sim();
105 PrintAndLog("--simtype:%02x csn:%s", simType
, sprint_hex(CSN
, 8));
110 PrintAndLog("Undefined simptype %d", simType
);
111 return usage_hf_iclass_sim();
114 uint8_t numberOfCSNs
=0;
117 UsbCommand c
= {CMD_SIMULATE_TAG_ICLASS
, {simType
,NUM_CSNS
}};
118 UsbCommand resp
= {0};
120 uint8_t csns
[8*NUM_CSNS
] = {
121 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
137 memcpy(c
.d
.asBytes
, csns
, 8*NUM_CSNS
);
138 clearCommandBuffer();
140 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, -1)) {
141 PrintAndLog("Command timed out");
145 uint8_t num_mac_responses
= resp
.arg
[1];
146 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses
,NUM_CSNS
);
148 size_t datalen
= NUM_CSNS
*24;
150 * Now, time to dump to file. We'll use this format:
151 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
152 * So, it should wind up as
155 * The returndata from the pm3 is on the following format
156 * <4 byte NR><4 byte MAC>
157 * CC are all zeroes, CSN is the same as was sent in
159 void* dump
= malloc(datalen
);
160 memset(dump
,0,datalen
);//<-- Need zeroes for the CC-field
162 for(i
= 0 ; i
< NUM_CSNS
; i
++) {
163 memcpy(dump
+i
*24, csns
+i
*8, 8); //CSN
164 //8 zero bytes here...
165 //Then comes NR_MAC (eight bytes from the response)
166 memcpy(dump
+i
*24+16, resp
.d
.asBytes
+i
*8, 8);
168 /** Now, save to dumpfile **/
169 saveFile("iclass_mac_attack", "bin", dump
, datalen
);
172 UsbCommand c
= {CMD_SIMULATE_TAG_ICLASS
, {simType
,numberOfCSNs
}};
173 memcpy(c
.d
.asBytes
, CSN
, 8);
174 clearCommandBuffer();
180 int HFiClassReader(const char *Cmd
, bool loop
, bool verbose
) {
181 bool tagFound
= false;
182 UsbCommand c
= {CMD_READER_ICLASS
, {FLAG_ICLASS_READER_CSN
|
183 FLAG_ICLASS_READER_CONF
| FLAG_ICLASS_READER_AA
}};
184 // loop in client not device - else on windows have a communication error
185 c
.arg
[0] |= FLAG_ICLASS_READER_ONLY_ONCE
| FLAG_ICLASS_READER_ONE_TRY
;
188 clearCommandBuffer();
190 if (WaitForResponseTimeout(CMD_ACK
,&resp
, 4500)) {
191 uint8_t readStatus
= resp
.arg
[0] & 0xff;
192 uint8_t *data
= resp
.d
.asBytes
;
194 if (verbose
) PrintAndLog("Readstatus:%02x", readStatus
);
195 if( readStatus
== 0){
197 if (verbose
) PrintAndLog("Quitting...");
200 if( readStatus
& FLAG_ICLASS_READER_CSN
){
201 PrintAndLog("CSN: %s",sprint_hex(data
,8));
204 if( readStatus
& FLAG_ICLASS_READER_CC
) PrintAndLog("CC: %s", sprint_hex(data
+16, 8));
205 if( readStatus
& FLAG_ICLASS_READER_CONF
) printIclassDumpInfo(data
);
206 if (tagFound
&& !loop
) return 1;
208 if (verbose
) PrintAndLog("Command execute timeout");
215 int CmdHFiClassReader(const char *Cmd
) {
216 return HFiClassReader(Cmd
, true, true);
219 int CmdHFiClassReader_Replay(const char *Cmd
) {
220 uint8_t readerType
= 0;
221 uint8_t MAC
[4]={0x00, 0x00, 0x00, 0x00};
224 PrintAndLog("Usage: hf iclass replay <MAC>");
225 PrintAndLog(" sample: hf iclass replay 00112233");
229 if (param_gethex(Cmd
, 0, MAC
, 8)) {
230 PrintAndLog("MAC must include 8 HEX symbols");
234 UsbCommand c
= {CMD_READER_ICLASS_REPLAY
, {readerType
}};
235 memcpy(c
.d
.asBytes
, MAC
, 4);
236 clearCommandBuffer();
241 int iclassEmlSetMem(uint8_t *data
, int blockNum
, int blocksCount
) {
242 UsbCommand c
= {CMD_MIFARE_EML_MEMSET
, {blockNum
, blocksCount
, 0}};
243 memcpy(c
.d
.asBytes
, data
, blocksCount
* 16);
244 clearCommandBuffer();
249 int hf_iclass_eload_usage(void) {
250 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
251 PrintAndLog("Usage: hf iclass eload f <filename>");
253 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
257 int CmdHFiClassELoad(const char *Cmd
) {
259 char opt
= param_getchar(Cmd
, 0);
260 if (strlen(Cmd
)<1 || opt
== 'h' || opt
== 'H') return hf_iclass_eload_usage();
262 //File handling and reading
264 char filename
[FILE_PATH_SIZE
];
265 if(opt
== 'f' && param_getstr(Cmd
, 1, filename
) > 0) {
266 f
= fopen(filename
, "rb");
268 return hf_iclass_eload_usage();
272 PrintAndLog("Failed to read from file '%s'", filename
);
276 fseek(f
, 0, SEEK_END
);
277 long fsize
= ftell(f
);
278 fseek(f
, 0, SEEK_SET
);
281 prnlog("Error, when getting filesize");
286 uint8_t *dump
= malloc(fsize
);
288 size_t bytes_read
= fread(dump
, 1, fsize
, f
);
291 printIclassDumpInfo(dump
);
294 if (bytes_read
< fsize
) {
295 prnlog("Error, could only read %d bytes (should be %d)",bytes_read
, fsize
);
300 uint32_t bytes_sent
= 0;
301 uint32_t bytes_remaining
= bytes_read
;
303 while(bytes_remaining
> 0){
304 uint32_t bytes_in_packet
= MIN(USB_CMD_DATA_SIZE
, bytes_remaining
);
305 UsbCommand c
= {CMD_ICLASS_EML_MEMSET
, {bytes_sent
,bytes_in_packet
,0}};
306 memcpy(c
.d
.asBytes
, dump
, bytes_in_packet
);
307 clearCommandBuffer();
309 bytes_remaining
-= bytes_in_packet
;
310 bytes_sent
+= bytes_in_packet
;
313 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent
);
317 static int readKeyfile(const char *filename
, size_t len
, uint8_t* buffer
) {
318 FILE *f
= fopen(filename
, "rb");
320 PrintAndLog("Failed to read from file '%s'", filename
);
323 fseek(f
, 0, SEEK_END
);
324 long fsize
= ftell(f
);
325 fseek(f
, 0, SEEK_SET
);
326 size_t bytes_read
= fread(buffer
, 1, len
, f
);
330 PrintAndLog("Warning, file size is %d, expected %d", fsize
, len
);
334 if(bytes_read
!= len
) {
335 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read
, len
);
341 int usage_hf_iclass_decrypt(void) {
342 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
344 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
345 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
347 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
349 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
350 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
351 PrintAndLog("which is defined by the configuration block.");
355 int CmdHFiClassDecrypt(const char *Cmd
) {
356 uint8_t key
[16] = { 0 };
357 if(readKeyfile("iclass_decryptionkey.bin", 16, key
)) {
358 usage_hf_iclass_decrypt();
361 PrintAndLog("Decryption file found... ");
362 char opt
= param_getchar(Cmd
, 0);
363 if (strlen(Cmd
)<1 || opt
== 'h' || opt
== 'H') return usage_hf_iclass_decrypt();
365 //Open the tagdump-file
367 char filename
[FILE_PATH_SIZE
];
368 if(opt
== 'f' && param_getstr(Cmd
, 1, filename
) > 0) {
369 if ( (f
= fopen(filename
, "rb")) == NULL
) {
370 PrintAndLog("Could not find file %s", filename
);
374 return usage_hf_iclass_decrypt();
377 fseek(f
, 0, SEEK_END
);
378 long fsize
= ftell(f
);
379 fseek(f
, 0, SEEK_SET
);
380 uint8_t enc_dump
[8] = {0};
381 uint8_t *decrypted
= malloc(fsize
);
382 des3_context ctx
= { DES_DECRYPT
,{ 0 } };
383 des3_set2key_dec( &ctx
, key
);
384 size_t bytes_read
= fread(enc_dump
, 1, 8, f
);
386 //Use the first block (CSN) for filename
387 char outfilename
[FILE_PATH_SIZE
] = { 0 };
388 snprintf(outfilename
,FILE_PATH_SIZE
,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
389 enc_dump
[0],enc_dump
[1],enc_dump
[2],enc_dump
[3],
390 enc_dump
[4],enc_dump
[5],enc_dump
[6],enc_dump
[7]);
393 while(bytes_read
== 8)
396 memcpy(decrypted
+(blocknum
*8), enc_dump
, 8);
398 des3_crypt_ecb(&ctx
, enc_dump
,decrypted
+(blocknum
*8) );
400 printvar("decrypted block", decrypted
+(blocknum
*8), 8);
401 bytes_read
= fread(enc_dump
, 1, 8, f
);
405 saveFile(outfilename
,"bin", decrypted
, blocknum
*8);
410 int usage_hf_iclass_encrypt(void) {
411 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
413 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
414 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
416 PrintAndLog("example: hf iclass encrypt 0102030405060708");
421 static int iClassEncryptBlkData(uint8_t *blkData
) {
422 uint8_t key
[16] = { 0 };
423 if(readKeyfile("iclass_decryptionkey.bin", 16, key
)) {
424 usage_hf_iclass_encrypt();
427 PrintAndLog("Decryption file found... ");
429 uint8_t encryptedData
[16];
430 uint8_t *encrypted
= encryptedData
;
431 des3_context ctx
= { DES_DECRYPT
,{ 0 } };
432 des3_set2key_enc( &ctx
, key
);
434 des3_crypt_ecb(&ctx
, blkData
,encrypted
);
435 //printvar("decrypted block", decrypted, 8);
436 memcpy(blkData
,encrypted
,8);
441 int CmdHFiClassEncryptBlk(const char *Cmd
) {
442 uint8_t blkData
[8] = {0};
443 char opt
= param_getchar(Cmd
, 0);
444 if (strlen(Cmd
)<1 || opt
== 'h' || opt
== 'H') return usage_hf_iclass_encrypt();
446 //get the bytes to encrypt
447 if (param_gethex(Cmd
, 0, blkData
, 16)) {
448 PrintAndLog("BlockData must include 16 HEX symbols");
451 if (!iClassEncryptBlkData(blkData
)) return 0;
453 printvar("encrypted block", blkData
, 8);
457 void Calc_wb_mac(uint8_t blockno
, uint8_t *data
, uint8_t *div_key
, uint8_t MAC
[4]) {
460 memcpy(WB
+ 1,data
,8);
461 doMAC_N(WB
,sizeof(WB
),div_key
,MAC
);
462 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
465 static bool select_only(uint8_t *CSN
, uint8_t *CCNR
, bool use_credit_key
, bool verbose
) {
468 UsbCommand c
= {CMD_READER_ICLASS
, {0}};
469 c
.arg
[0] = FLAG_ICLASS_READER_ONLY_ONCE
| FLAG_ICLASS_READER_CC
| FLAG_ICLASS_READER_ONE_TRY
;
471 c
.arg
[0] |= FLAG_ICLASS_READER_CEDITKEY
;
473 clearCommandBuffer();
475 if (!WaitForResponseTimeout(CMD_ACK
,&resp
,4500)) {
476 PrintAndLog("Command execute timeout");
480 uint8_t isOK
= resp
.arg
[0] & 0xff;
481 uint8_t *data
= resp
.d
.asBytes
;
486 memcpy(CCNR
,data
+16,8);
489 if (verbose
) PrintAndLog("CSN: %s",sprint_hex(CSN
,8));
493 PrintAndLog("Failed to obtain CC! Aborting");
499 static bool select_and_auth(uint8_t *KEY
, uint8_t *MAC
, uint8_t *div_key
, bool use_credit_key
, bool elite
, bool rawkey
, bool verbose
) {
500 uint8_t CSN
[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
501 uint8_t CCNR
[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
503 if (!select_only(CSN
, CCNR
, use_credit_key
, verbose
))
508 memcpy(div_key
, KEY
, 8);
510 HFiClassCalcDivKey(CSN
, KEY
, div_key
, elite
);
512 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey
? "raw key" : "diversified key", div_key
[0],div_key
[1],div_key
[2],div_key
[3],div_key
[4],div_key
[5],div_key
[6],div_key
[7]);
514 doMAC(CCNR
, div_key
, MAC
);
516 UsbCommand d
= {CMD_ICLASS_AUTHENTICATION
, {0}};
517 memcpy(d
.d
.asBytes
, MAC
, 4);
518 clearCommandBuffer();
520 if (!WaitForResponseTimeout(CMD_ACK
,&resp
,4500)) {
521 PrintAndLog("Auth Command execute timeout");
524 uint8_t isOK
= resp
.arg
[0] & 0xff;
526 PrintAndLog("Authentication error");
532 int usage_hf_iclass_dump(void) {
533 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
534 PrintAndLog("Options:");
535 PrintAndLog(" f <filename> : specify a filename to save dump to");
536 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
537 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
538 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
539 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
540 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
541 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
542 PrintAndLog(" NOTE: * = required");
543 PrintAndLog("Samples:");
544 PrintAndLog(" hf iclass dump k 001122334455667B");
545 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
546 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
550 int CmdHFiClassReader_Dump(const char *Cmd
) {
552 uint8_t MAC
[4] = {0x00,0x00,0x00,0x00};
553 uint8_t div_key
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
554 uint8_t c_div_key
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
558 uint8_t app_areas
= 1;
560 uint8_t KEY
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
561 uint8_t CreditKEY
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
564 uint8_t fileNameLen
= 0;
565 char filename
[FILE_PATH_SIZE
]={0};
566 char tempStr
[50] = {0};
567 bool have_debit_key
= false;
568 bool have_credit_key
= false;
569 bool use_credit_key
= false;
575 while(param_getchar(Cmd
, cmdp
) != 0x00)
577 switch(param_getchar(Cmd
, cmdp
))
581 return usage_hf_iclass_dump();
584 have_credit_key
= true;
585 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
587 errors
= param_gethex(tempStr
, 0, CreditKEY
, dataLen
);
588 } else if (dataLen
== 1) {
589 keyNbr
= param_get8(Cmd
, cmdp
+1);
590 if (keyNbr
< ICLASS_KEYS_MAX
) {
591 memcpy(CreditKEY
, iClass_Key_Table
[keyNbr
], 8);
593 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
597 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
609 fileNameLen
= param_getstr(Cmd
, cmdp
+1, filename
);
610 if (fileNameLen
< 1) {
611 PrintAndLog("No filename found after f");
618 have_debit_key
= true;
619 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
621 errors
= param_gethex(tempStr
, 0, KEY
, dataLen
);
622 } else if (dataLen
== 1) {
623 keyNbr
= param_get8(Cmd
, cmdp
+1);
624 if (keyNbr
< ICLASS_KEYS_MAX
) {
625 memcpy(KEY
, iClass_Key_Table
[keyNbr
], 8);
627 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
631 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
642 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd
, cmdp
));
646 if(errors
) return usage_hf_iclass_dump();
649 if (cmdp
< 2) return usage_hf_iclass_dump();
650 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
651 if (!have_debit_key
&& have_credit_key
) use_credit_key
= true;
653 //get config and first 3 blocks
654 UsbCommand c
= {CMD_READER_ICLASS
, {FLAG_ICLASS_READER_CSN
|
655 FLAG_ICLASS_READER_CONF
| FLAG_ICLASS_READER_ONLY_ONCE
| FLAG_ICLASS_READER_ONE_TRY
}};
657 uint8_t tag_data
[255*8];
659 clearCommandBuffer();
661 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, 4500)) {
662 PrintAndLog("Command execute timeout");
663 ul_switch_off_field();
666 uint8_t readStatus
= resp
.arg
[0] & 0xff;
667 uint8_t * data
= resp
.d
.asBytes
;
670 PrintAndLog("No tag found...");
671 ul_switch_off_field();
675 if( readStatus
& (FLAG_ICLASS_READER_CSN
|FLAG_ICLASS_READER_CONF
|FLAG_ICLASS_READER_CC
)){
676 memcpy(tag_data
, data
, 8*3);
677 blockno
+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
679 getMemConfig(data
[13], data
[12], &maxBlk
, &app_areas
, &kb
);
680 // large memory - not able to dump pages currently
681 if (numblks
> maxBlk
) numblks
= maxBlk
;
684 ul_switch_off_field();
685 // authenticate debit key and get div_key - later store in dump block 3
686 if (!select_and_auth(KEY
, MAC
, div_key
, use_credit_key
, elite
, rawkey
, false)){
687 //try twice - for some reason it sometimes fails the first time...
688 if (!select_and_auth(KEY
, MAC
, div_key
, use_credit_key
, elite
, rawkey
, false)){
689 ul_switch_off_field();
695 UsbCommand w
= {CMD_ICLASS_DUMP
, {blockno
, numblks
-blockno
+1}};
696 clearCommandBuffer();
698 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, 4500)) {
699 PrintAndLog("Command execute time-out 1");
700 ul_switch_off_field();
703 uint32_t blocksRead
= resp
.arg
[1];
704 uint8_t isOK
= resp
.arg
[0] & 0xff;
705 if (!isOK
&& !blocksRead
) {
706 PrintAndLog("Read Block Failed");
707 ul_switch_off_field();
710 uint32_t startindex
= resp
.arg
[2];
711 if (blocksRead
*8 > sizeof(tag_data
)-(blockno
*8)) {
712 PrintAndLog("Data exceeded Buffer size!");
713 blocksRead
= (sizeof(tag_data
)/8) - blockno
;
715 // response ok - now get bigbuf content of the dump
716 GetFromBigBuf(tag_data
+(blockno
*8), blocksRead
*8, startindex
);
717 WaitForResponse(CMD_ACK
,NULL
);
718 size_t gotBytes
= blocksRead
*8 + blockno
*8;
721 if (have_credit_key
) {
722 //turn off hf field before authenticating with different key
723 ul_switch_off_field();
725 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
726 if (!select_and_auth(CreditKEY
, MAC
, c_div_key
, true, false, false, false)){
727 //try twice - for some reason it sometimes fails the first time...
728 if (!select_and_auth(CreditKEY
, MAC
, c_div_key
, true, false, false, false)){
729 ul_switch_off_field();
733 // do we still need to read more block? (aa2 enabled?)
734 if (maxBlk
> blockno
+numblks
+1) {
735 // setup dump and start
736 w
.arg
[0] = blockno
+ blocksRead
;
737 w
.arg
[1] = maxBlk
- (blockno
+ blocksRead
);
738 clearCommandBuffer();
740 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, 4500)) {
741 PrintAndLog("Command execute timeout 2");
742 ul_switch_off_field();
745 uint8_t isOK
= resp
.arg
[0] & 0xff;
746 blocksRead
= resp
.arg
[1];
747 if (!isOK
&& !blocksRead
) {
748 PrintAndLog("Read Block Failed 2");
749 ul_switch_off_field();
753 startindex
= resp
.arg
[2];
754 if (blocksRead
*8 > sizeof(tag_data
)-gotBytes
) {
755 PrintAndLog("Data exceeded Buffer size!");
756 blocksRead
= (sizeof(tag_data
) - gotBytes
)/8;
758 // get dumped data from bigbuf
759 GetFromBigBuf(tag_data
+gotBytes
, blocksRead
*8, startindex
);
760 WaitForResponse(CMD_ACK
,NULL
);
762 gotBytes
+= blocksRead
*8;
763 } else { //field is still on - turn it off...
764 ul_switch_off_field();
768 // add diversified keys to dump
769 if (have_debit_key
) memcpy(tag_data
+(3*8),div_key
,8);
770 if (have_credit_key
) memcpy(tag_data
+(4*8),c_div_key
,8);
772 printf("CSN |00| %s |\n", sprint_hex(tag_data
, 8));
773 printf("CSN |00| %s |\n", sprint_hex(tag_data
, 8));
774 printIclassDumpContents(tag_data
, 1, (gotBytes
/8)-1, gotBytes
-8);
776 if (filename
[0] == 0){
777 snprintf(filename
, FILE_PATH_SIZE
,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
778 tag_data
[0],tag_data
[1],tag_data
[2],tag_data
[3],
779 tag_data
[4],tag_data
[5],tag_data
[6],tag_data
[7]);
782 // save the dump to .bin file
783 PrintAndLog("Saving dump file - %d blocks read", gotBytes
/8);
784 saveFile(filename
, "bin", tag_data
, gotBytes
);
788 static int WriteBlock(uint8_t blockno
, uint8_t *bldata
, uint8_t *KEY
, bool use_credit_key
, bool elite
, bool rawkey
, bool verbose
) {
789 uint8_t MAC
[4]={0x00,0x00,0x00,0x00};
790 uint8_t div_key
[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
791 if (!select_and_auth(KEY
, MAC
, div_key
, use_credit_key
, elite
, rawkey
, verbose
))
796 Calc_wb_mac(blockno
,bldata
,div_key
,MAC
);
797 UsbCommand w
= {CMD_ICLASS_WRITEBLOCK
, {blockno
}};
798 memcpy(w
.d
.asBytes
, bldata
, 8);
799 memcpy(w
.d
.asBytes
+ 8, MAC
, 4);
801 clearCommandBuffer();
803 if (!WaitForResponseTimeout(CMD_ACK
,&resp
,4500)) {
804 PrintAndLog("Write Command execute timeout");
807 uint8_t isOK
= resp
.arg
[0] & 0xff;
809 PrintAndLog("Write Block Failed");
812 PrintAndLog("Write Block Successful");
816 int usage_hf_iclass_writeblock(void) {
817 PrintAndLog("Options:");
818 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
819 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
820 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
821 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
822 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
823 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
824 PrintAndLog("Samples:");
825 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
826 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
827 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
831 int CmdHFiClass_WriteBlock(const char *Cmd
) {
833 uint8_t bldata
[8]={0,0,0,0,0,0,0,0};
834 uint8_t KEY
[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
837 char tempStr
[50] = {0};
838 bool use_credit_key
= false;
843 while(param_getchar(Cmd
, cmdp
) != 0x00)
845 switch(param_getchar(Cmd
, cmdp
))
849 return usage_hf_iclass_writeblock();
852 if (param_gethex(Cmd
, cmdp
+1, &blockno
, 2)) {
853 PrintAndLog("Block No must include 2 HEX symbols\n");
860 use_credit_key
= true;
865 if (param_gethex(Cmd
, cmdp
+1, bldata
, 16))
867 PrintAndLog("KEY must include 16 HEX symbols\n");
879 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
881 errors
= param_gethex(tempStr
, 0, KEY
, dataLen
);
882 } else if (dataLen
== 1) {
883 keyNbr
= param_get8(Cmd
, cmdp
+1);
884 if (keyNbr
< ICLASS_KEYS_MAX
) {
885 memcpy(KEY
, iClass_Key_Table
[keyNbr
], 8);
887 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
891 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
902 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd
, cmdp
));
906 if(errors
) return usage_hf_iclass_writeblock();
909 if (cmdp
< 6) return usage_hf_iclass_writeblock();
910 int ans
= WriteBlock(blockno
, bldata
, KEY
, use_credit_key
, elite
, rawkey
, true);
911 ul_switch_off_field();
915 int usage_hf_iclass_clone(void) {
916 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
917 PrintAndLog("Options:");
918 PrintAndLog(" f <filename>: specify a filename to clone from");
919 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
920 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
921 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
922 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
923 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
924 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
925 PrintAndLog("Samples:");
926 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
927 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
928 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
932 int CmdHFiClassCloneTag(const char *Cmd
) {
933 char filename
[FILE_PATH_SIZE
] = { 0x00 };
934 char tempStr
[50]={0};
935 uint8_t KEY
[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
937 uint8_t fileNameLen
= 0;
938 uint8_t startblock
= 0;
939 uint8_t endblock
= 0;
941 bool use_credit_key
= false;
946 while(param_getchar(Cmd
, cmdp
) != 0x00)
948 switch(param_getchar(Cmd
, cmdp
))
952 return usage_hf_iclass_clone();
955 if (param_gethex(Cmd
, cmdp
+1, &startblock
, 2)) {
956 PrintAndLog("Start Block No must include 2 HEX symbols\n");
963 use_credit_key
= true;
973 fileNameLen
= param_getstr(Cmd
, cmdp
+1, filename
);
974 if (fileNameLen
< 1) {
975 PrintAndLog("No filename found after f");
982 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
984 errors
= param_gethex(tempStr
, 0, KEY
, dataLen
);
985 } else if (dataLen
== 1) {
986 keyNbr
= param_get8(Cmd
, cmdp
+1);
987 if (keyNbr
< ICLASS_KEYS_MAX
) {
988 memcpy(KEY
, iClass_Key_Table
[keyNbr
], 8);
990 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
994 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1001 if (param_gethex(Cmd
, cmdp
+1, &endblock
, 2)) {
1002 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1013 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd
, cmdp
));
1017 if(errors
) return usage_hf_iclass_clone();
1020 if (cmdp
< 8) return usage_hf_iclass_clone();
1024 iclass_block_t tag_data
[USB_CMD_DATA_SIZE
/12];
1026 if ((endblock
-startblock
+1)*12 > USB_CMD_DATA_SIZE
) {
1027 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE
/8);
1029 // file handling and reading
1030 f
= fopen(filename
,"rb");
1032 PrintAndLog("Failed to read from file '%s'", filename
);
1037 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1041 // now read data from the file from block 6 --- 19
1042 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1043 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1044 // else we have to create a share memory
1046 fseek(f
,startblock
*8,SEEK_SET
);
1047 if ( fread(tag_data
,sizeof(iclass_block_t
),endblock
- startblock
+ 1,f
) == 0){
1048 PrintAndLog("File reading error.");
1053 uint8_t MAC
[4]={0x00,0x00,0x00,0x00};
1054 uint8_t div_key
[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1056 if (!select_and_auth(KEY
, MAC
, div_key
, use_credit_key
, elite
, rawkey
, true))
1059 UsbCommand w
= {CMD_ICLASS_CLONE
,{startblock
,endblock
}};
1061 // calculate all mac for every the block we will write
1062 for (i
= startblock
; i
<= endblock
; i
++){
1063 Calc_wb_mac(i
,tag_data
[i
- startblock
].d
,div_key
,MAC
);
1064 // usb command d start pointer = d + (i - 6) * 12
1065 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1066 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1068 ptr
= w
.d
.asBytes
+ (i
- startblock
) * 12;
1069 memcpy(ptr
, &(tag_data
[i
- startblock
].d
[0]), 8);
1070 memcpy(ptr
+ 8,MAC
, 4);
1073 for (i
= 0; i
<= endblock
- startblock
;i
++){
1074 memcpy(p
,w
.d
.asBytes
+ (i
* 12),12);
1075 printf("Block |%02x|",i
+ startblock
);
1076 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p
[0],p
[1],p
[2],p
[3],p
[4],p
[5],p
[6],p
[7]);
1077 printf(" MAC |%02x%02x%02x%02x|\n",p
[8],p
[9],p
[10],p
[11]);
1080 clearCommandBuffer();
1082 if (!WaitForResponseTimeout(CMD_ACK
,&resp
,4500)) {
1083 PrintAndLog("Command execute timeout");
1089 static int ReadBlock(uint8_t *KEY
, uint8_t blockno
, uint8_t keyType
, bool elite
, bool rawkey
, bool verbose
) {
1090 uint8_t MAC
[4]={0x00,0x00,0x00,0x00};
1091 uint8_t div_key
[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1093 if (!select_and_auth(KEY
, MAC
, div_key
, (keyType
==0x18), elite
, rawkey
, verbose
))
1097 UsbCommand w
= {CMD_ICLASS_READBLOCK
, {blockno
}};
1098 clearCommandBuffer();
1100 if (!WaitForResponseTimeout(CMD_ACK
,&resp
,4500)) {
1101 PrintAndLog("Command execute timeout");
1105 uint8_t isOK
= resp
.arg
[0] & 0xff;
1107 PrintAndLog("Read Block Failed");
1110 //data read is stored in: resp.d.asBytes[0-15]
1111 if (verbose
) PrintAndLog("Block %02X: %s\n",blockno
, sprint_hex(resp
.d
.asBytes
,8));
1115 int usage_hf_iclass_readblock(void) {
1116 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
1117 PrintAndLog("Options:");
1118 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1119 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1120 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1121 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1122 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
1123 PrintAndLog("Samples:");
1124 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1125 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1126 PrintAndLog(" hf iclass readblk b 0A k 0");
1130 int CmdHFiClass_ReadBlock(const char *Cmd
) {
1132 uint8_t keyType
= 0x88; //debit key
1133 uint8_t KEY
[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1135 uint8_t dataLen
= 0;
1136 char tempStr
[50] = {0};
1138 bool rawkey
= false;
1139 bool errors
= false;
1141 while(param_getchar(Cmd
, cmdp
) != 0x00)
1143 switch(param_getchar(Cmd
, cmdp
))
1147 return usage_hf_iclass_readblock();
1150 if (param_gethex(Cmd
, cmdp
+1, &blockno
, 2)) {
1151 PrintAndLog("Block No must include 2 HEX symbols\n");
1168 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
1169 if (dataLen
== 16) {
1170 errors
= param_gethex(tempStr
, 0, KEY
, dataLen
);
1171 } else if (dataLen
== 1) {
1172 keyNbr
= param_get8(Cmd
, cmdp
+1);
1173 if (keyNbr
< ICLASS_KEYS_MAX
) {
1174 memcpy(KEY
, iClass_Key_Table
[keyNbr
], 8);
1176 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1180 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1191 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd
, cmdp
));
1195 if(errors
) return usage_hf_iclass_readblock();
1198 if (cmdp
< 4) return usage_hf_iclass_readblock();
1200 return ReadBlock(KEY
, blockno
, keyType
, elite
, rawkey
, true);
1203 int CmdHFiClass_loclass(const char *Cmd
) {
1204 char opt
= param_getchar(Cmd
, 0);
1206 if (strlen(Cmd
)<1 || opt
== 'h') {
1207 PrintAndLog("Usage: hf iclass loclass [options]");
1208 PrintAndLog("Options:");
1209 PrintAndLog("h Show this help");
1210 PrintAndLog("t Perform self-test");
1211 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1212 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1213 PrintAndLog(" malicious CSNs, and their protocol responses");
1214 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1215 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1216 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1217 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1218 PrintAndLog(" ... totalling N*24 bytes");
1221 char fileName
[255] = {0};
1223 if(param_getstr(Cmd
, 1, fileName
) > 0) {
1224 return bruteforceFileNoKeys(fileName
);
1226 PrintAndLog("You must specify a filename");
1230 else if(opt
== 't') {
1231 int errors
= testCipherUtils();
1232 errors
+= testMAC();
1233 errors
+= doKeyTests(0);
1234 errors
+= testElite();
1235 if(errors
) prnlog("OBS! There were errors!!!");
1241 void printIclassDumpContents(uint8_t *iclass_dump
, uint8_t startblock
, uint8_t endblock
, size_t filesize
) {
1242 uint8_t blockdata
[8];
1244 memcpy(&mem_config
, iclass_dump
+ 13,1);
1245 uint8_t maxmemcount
;
1246 uint8_t filemaxblock
= filesize
/ 8;
1248 if (mem_config
& 0x80)
1252 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1254 if (startblock
== 0)
1257 if ((endblock
> maxmemcount
) || (endblock
== 0))
1258 endblock
= maxmemcount
;
1260 if (endblock
> filemaxblock
)
1261 endblock
= filemaxblock
;
1265 while (i
<= endblock
){
1266 printf("Block |%02X| ",i
);
1267 memcpy(blockdata
, iclass_dump
+ (i
* 8), 8);
1268 for (j
= 0;j
< 8;j
++)
1269 printf("%02X ", blockdata
[j
]);
1275 int usage_hf_iclass_readtagfile() {
1276 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1280 int CmdHFiClassReadTagFile(const char *Cmd
) {
1285 char filename
[FILE_PATH_SIZE
];
1286 if (param_getstr(Cmd
, 0, filename
) < 1)
1287 return usage_hf_iclass_readtagfile();
1289 if (param_getstr(Cmd
,1,(char *)&tempnum
) < 1)
1292 sscanf(tempnum
,"%d",&startblock
);
1294 if (param_getstr(Cmd
,2,(char *)&tempnum
) < 1)
1297 sscanf(tempnum
,"%d",&endblock
);
1299 // file handling and reading
1300 f
= fopen(filename
,"rb");
1302 PrintAndLog("Failed to read from file '%s'", filename
);
1305 fseek(f
, 0, SEEK_END
);
1306 long fsize
= ftell(f
);
1307 fseek(f
, 0, SEEK_SET
);
1310 PrintAndLog("Error, when getting filesize");
1315 uint8_t *dump
= malloc(fsize
);
1316 size_t bytes_read
= fread(dump
, 1, fsize
, f
);
1319 uint8_t *csn
= dump
;
1320 printf("CSN [00] | %s |\n", sprint_hex(csn
, 8) );
1321 printIclassDumpContents(dump
,startblock
,endblock
,bytes_read
);
1327 uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1328 uint64_t new_div = 0x00;
1334 uint64_t hexarray_to_uint64(uint8_t *key) {
1337 for (int i = 0;i < 8;i++)
1338 sprintf(&temp[(i *2)],"%02X",key[i]);
1340 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1345 void HFiClassCalcDivKey(uint8_t *CSN
, uint8_t *KEY
, uint8_t *div_key
, bool elite
){
1346 uint8_t keytable
[128] = {0};
1347 uint8_t key_index
[8] = {0};
1349 uint8_t key_sel
[8] = { 0 };
1350 uint8_t key_sel_p
[8] = { 0 };
1351 hash2(KEY
, keytable
);
1352 hash1(CSN
, key_index
);
1353 for(uint8_t i
= 0; i
< 8 ; i
++)
1354 key_sel
[i
] = keytable
[key_index
[i
]] & 0xFF;
1356 //Permute from iclass format to standard format
1357 permutekey_rev(key_sel
, key_sel_p
);
1358 diversifyKey(CSN
, key_sel_p
, div_key
);
1360 diversifyKey(CSN
, KEY
, div_key
);
1364 //when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1365 //calculate and return xor_div_key (ready for a key write command)
1366 //print all div_keys if verbose
1367 static void HFiClassCalcNewKey(uint8_t *CSN
, uint8_t *OLDKEY
, uint8_t *NEWKEY
, uint8_t *xor_div_key
, bool elite
, bool oldElite
, bool verbose
){
1368 uint8_t old_div_key
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1369 uint8_t new_div_key
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1371 HFiClassCalcDivKey(CSN
, OLDKEY
, old_div_key
, oldElite
);
1373 HFiClassCalcDivKey(CSN
, NEWKEY
, new_div_key
, elite
);
1375 for (uint8_t i
= 0; i
< sizeof(old_div_key
); i
++){
1376 xor_div_key
[i
] = old_div_key
[i
] ^ new_div_key
[i
];
1379 printf("Old Div Key : %s\n",sprint_hex(old_div_key
,8));
1380 printf("New Div Key : %s\n",sprint_hex(new_div_key
,8));
1381 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key
,8));
1385 int usage_hf_iclass_calc_newkey(void) {
1386 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1387 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1388 PrintAndLog(" Options:");
1389 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1390 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1391 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1392 PrintAndLog(" e : specify new key as elite calc");
1393 PrintAndLog(" ee : specify old and new key as elite calc");
1394 PrintAndLog("Samples:");
1395 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1396 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1397 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1398 PrintAndLog("NOTE: * = required\n");
1403 int CmdHFiClassCalcNewKey(const char *Cmd
) {
1404 uint8_t OLDKEY
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1405 uint8_t NEWKEY
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1406 uint8_t xor_div_key
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1407 uint8_t CSN
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1408 uint8_t CCNR
[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1410 uint8_t dataLen
= 0;
1411 char tempStr
[50] = {0};
1412 bool givenCSN
= false;
1413 bool oldElite
= false;
1415 bool errors
= false;
1417 while(param_getchar(Cmd
, cmdp
) != 0x00)
1419 switch(param_getchar(Cmd
, cmdp
))
1423 return usage_hf_iclass_calc_newkey();
1426 dataLen
= param_getstr(Cmd
, cmdp
, tempStr
);
1434 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
1435 if (dataLen
== 16) {
1436 errors
= param_gethex(tempStr
, 0, NEWKEY
, dataLen
);
1437 } else if (dataLen
== 1) {
1438 keyNbr
= param_get8(Cmd
, cmdp
+1);
1439 if (keyNbr
< ICLASS_KEYS_MAX
) {
1440 memcpy(NEWKEY
, iClass_Key_Table
[keyNbr
], 8);
1442 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1446 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1453 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
1454 if (dataLen
== 16) {
1455 errors
= param_gethex(tempStr
, 0, OLDKEY
, dataLen
);
1456 } else if (dataLen
== 1) {
1457 keyNbr
= param_get8(Cmd
, cmdp
+1);
1458 if (keyNbr
< ICLASS_KEYS_MAX
) {
1459 memcpy(OLDKEY
, iClass_Key_Table
[keyNbr
], 8);
1461 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1465 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1473 if (param_gethex(Cmd
, cmdp
+1, CSN
, 16))
1474 return usage_hf_iclass_calc_newkey();
1478 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd
, cmdp
));
1482 if(errors
) return usage_hf_iclass_calc_newkey();
1485 if (cmdp
< 4) return usage_hf_iclass_calc_newkey();
1488 if (!select_only(CSN
, CCNR
, false, true))
1491 HFiClassCalcNewKey(CSN
, OLDKEY
, NEWKEY
, xor_div_key
, elite
, oldElite
, true);
1495 static int loadKeys(char *filename
) {
1497 f
= fopen(filename
,"rb");
1499 PrintAndLog("Failed to read from file '%s'", filename
);
1502 fseek(f
, 0, SEEK_END
);
1503 long fsize
= ftell(f
);
1504 fseek(f
, 0, SEEK_SET
);
1507 PrintAndLog("Error, when getting filesize");
1512 uint8_t *dump
= malloc(fsize
);
1514 size_t bytes_read
= fread(dump
, 1, fsize
, f
);
1516 if (bytes_read
> ICLASS_KEYS_MAX
* 8){
1517 PrintAndLog("File is too long to load - bytes: %u", bytes_read
);
1522 for (; i
< bytes_read
/8; i
++){
1523 memcpy(iClass_Key_Table
[i
],dump
+(i
*8),8);
1526 PrintAndLog("%u keys loaded", i
);
1530 static int saveKeys(char *filename
) {
1532 f
= fopen(filename
,"wb");
1534 printf("error opening file %s\n",filename
);
1537 for (uint8_t i
= 0; i
< ICLASS_KEYS_MAX
; i
++){
1538 if (fwrite(iClass_Key_Table
[i
],8,1,f
) != 1){
1539 PrintAndLog("save key failed to write to file: %s", filename
);
1547 static int printKeys(void) {
1549 for (uint8_t i
= 0; i
< ICLASS_KEYS_MAX
; i
++){
1550 PrintAndLog("%u: %s", i
, sprint_hex(iClass_Key_Table
[i
],8));
1556 int usage_hf_iclass_managekeys(void) {
1557 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1558 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1559 PrintAndLog(" Options:");
1560 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1561 PrintAndLog(" k <key> : set a key in memory");
1562 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1563 PrintAndLog(" s : save keys in memory to file specified by filename");
1564 PrintAndLog(" l : load keys to memory from file specified by filename");
1565 PrintAndLog(" p : print keys loaded into memory\n");
1566 PrintAndLog("Samples:");
1567 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1568 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1569 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1570 PrintAndLog(" print keys : hf iclass managekeys p\n");
1574 int CmdHFiClassManageKeys(const char *Cmd
) {
1576 uint8_t dataLen
= 0;
1577 uint8_t KEY
[8] = {0};
1578 char filename
[FILE_PATH_SIZE
];
1579 uint8_t fileNameLen
= 0;
1580 bool errors
= false;
1581 uint8_t operation
= 0;
1585 while(param_getchar(Cmd
, cmdp
) != 0x00)
1587 switch(param_getchar(Cmd
, cmdp
))
1591 return usage_hf_iclass_managekeys();
1594 fileNameLen
= param_getstr(Cmd
, cmdp
+1, filename
);
1595 if (fileNameLen
< 1) {
1596 PrintAndLog("No filename found after f");
1603 keyNbr
= param_get8(Cmd
, cmdp
+1);
1605 PrintAndLog("Wrong block number");
1612 operation
+= 3; //set key
1613 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
1614 if (dataLen
== 16) { //ul-c or ev1/ntag key length
1615 errors
= param_gethex(tempStr
, 0, KEY
, dataLen
);
1617 PrintAndLog("\nERROR: Key is incorrect length\n");
1624 operation
+= 4; //print keys in memory
1629 operation
+= 5; //load keys from file
1634 operation
+= 6; //save keys to file
1638 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd
, cmdp
));
1642 if(errors
) return usage_hf_iclass_managekeys();
1644 if (operation
== 0){
1645 PrintAndLog("no operation specified (load, save, or print)\n");
1646 return usage_hf_iclass_managekeys();
1649 PrintAndLog("Too many operations specified\n");
1650 return usage_hf_iclass_managekeys();
1652 if (operation
> 4 && fileNameLen
== 0){
1653 PrintAndLog("You must enter a filename when loading or saving\n");
1654 return usage_hf_iclass_managekeys();
1658 case 3: memcpy(iClass_Key_Table
[keyNbr
], KEY
, 8); return 1;
1659 case 4: return printKeys();
1660 case 5: return loadKeys(filename
);
1661 case 6: return saveKeys(filename
);
1667 static command_t CommandTable
[] = {
1668 {"help", CmdHelp
, 1, "This help"},
1669 {"calcnewkey", CmdHFiClassCalcNewKey
, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1670 {"clone", CmdHFiClassCloneTag
, 0, "[options..] Authenticate and Clone from iClass bin file"},
1671 {"decrypt", CmdHFiClassDecrypt
, 1, "[f <fname>] Decrypt tagdump" },
1672 {"dump", CmdHFiClassReader_Dump
, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1673 {"eload", CmdHFiClassELoad
, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1674 {"encryptblk", CmdHFiClassEncryptBlk
, 1, "<BlockData> Encrypt given block data"},
1675 {"list", CmdHFiClassList
, 0, " (Deprecated) List iClass history"},
1676 {"loclass", CmdHFiClass_loclass
, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1677 {"managekeys", CmdHFiClassManageKeys
, 1, "[options..] Manage the keys to use with iClass"},
1678 {"readblk", CmdHFiClass_ReadBlock
, 0, "[options..] Authenticate and Read iClass block"},
1679 {"reader",CmdHFiClassReader
, 0, "Read an iClass tag"},
1680 {"readtagfile", CmdHFiClassReadTagFile
, 1, "[options..] Display Content from tagfile"},
1681 {"replay", CmdHFiClassReader_Replay
, 0, "<mac> Read an iClass tag via Reply Attack"},
1682 {"sim", CmdHFiClassSim
, 0, "[options..] Simulate iClass tag"},
1683 {"snoop", CmdHFiClassSnoop
, 0, " Eavesdrop iClass communication"},
1684 {"writeblk", CmdHFiClass_WriteBlock
, 0, "[options..] Authenticate and Write iClass block"},
1685 {NULL
, NULL
, 0, NULL
}
1688 int CmdHFiClass(const char *Cmd
) {
1689 clearCommandBuffer();
1690 CmdsParse(CommandTable
, Cmd
);
1694 int CmdHelp(const char *Cmd
) {
1695 CmdsHelp(CommandTable
);