]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhficlass.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
CHG: minor change initializing array.
[proxmark3-svn] / client / cmdhficlass.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3 // Copyright (C) 2011 Gerhard de Koning Gans
4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // High frequency iClass commands
11 //-----------------------------------------------------------------------------
12
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <sys/stat.h>
17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18 #include "data.h"
19 #include "proxmark3.h"
20 #include "ui.h"
21 #include "cmdparser.h"
22 #include "cmdhficlass.h"
23 #include "common.h"
24 #include "util.h"
25 #include "cmdmain.h"
26 #include "loclass/des.h"
27 #include "loclass/cipherutils.h"
28 #include "loclass/cipher.h"
29 #include "loclass/ikeys.h"
30 #include "loclass/elite_crack.h"
31 #include "loclass/fileutils.h"
32 #include "protocols.h"
33 #include "usb_cmd.h"
34 #include "cmdhfmfu.h"
35 #include "cmdhf.h"
36
37 static int CmdHelp(const char *Cmd);
38
39 #define ICLASS_KEYS_MAX 8
40 static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
41 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
49 };
50
51 typedef struct iclass_block {
52 uint8_t d[8];
53 } iclass_block_t;
54
55 int xorbits_8(uint8_t val) {
56 uint8_t res = val ^ (val >> 1); //1st pass
57 res = res ^ (res >> 1); // 2nd pass
58 res = res ^ (res >> 2); // 3rd pass
59 res = res ^ (res >> 4); // 4th pass
60 return res & 1;
61 }
62
63 int CmdHFiClassList(const char *Cmd) {
64 //PrintAndLog("Deprecated command, use 'hf list iclass' instead");
65 CmdHFList("iclass");
66 return 0;
67 }
68
69 int CmdHFiClassSnoop(const char *Cmd) {
70 UsbCommand c = {CMD_SNOOP_ICLASS};
71 SendCommand(&c);
72 return 0;
73 }
74
75 int usage_hf_iclass_sim(void) {
76 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
77 PrintAndLog(" options");
78 PrintAndLog(" 0 <CSN> simulate the given CSN");
79 PrintAndLog(" 1 simulate default CSN");
80 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
81 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
82 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
83 PrintAndLog(" example: hf iclass sim 2");
84 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
85 PrintAndLog(" hf iclass sim 3");
86 return 0;
87 }
88
89 #define NUM_CSNS 15
90 int CmdHFiClassSim(const char *Cmd) {
91 uint8_t simType = 0;
92 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
93
94 if (strlen(Cmd)<1) {
95 return usage_hf_iclass_sim();
96 }
97 simType = param_get8ex(Cmd, 0, 0, 10);
98
99 if(simType == 0)
100 {
101 if (param_gethex(Cmd, 1, CSN, 16)) {
102 PrintAndLog("A CSN should consist of 16 HEX symbols");
103 return usage_hf_iclass_sim();
104 }
105
106 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
107 }
108 if(simType > 3)
109 {
110 PrintAndLog("Undefined simptype %d", simType);
111 return usage_hf_iclass_sim();
112 }
113
114 uint8_t numberOfCSNs=0;
115 if(simType == 2)
116 {
117 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
118 UsbCommand resp = {0};
119
120 uint8_t csns[8*NUM_CSNS] = {
121 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
136
137 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
138
139 SendCommand(&c);
140 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
141 PrintAndLog("Command timed out");
142 return 0;
143 }
144
145 uint8_t num_mac_responses = resp.arg[1];
146 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
147
148 size_t datalen = NUM_CSNS*24;
149 /*
150 * Now, time to dump to file. We'll use this format:
151 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
152 * So, it should wind up as
153 * 8 * 24 bytes.
154 *
155 * The returndata from the pm3 is on the following format
156 * <4 byte NR><4 byte MAC>
157 * CC are all zeroes, CSN is the same as was sent in
158 **/
159 void* dump = malloc(datalen);
160 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
161 uint8_t i = 0;
162 for(i = 0 ; i < NUM_CSNS ; i++)
163 {
164 memcpy(dump+i*24, csns+i*8,8); //CSN
165 //8 zero bytes here...
166 //Then comes NR_MAC (eight bytes from the response)
167 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
168
169 }
170 /** Now, save to dumpfile **/
171 saveFile("iclass_mac_attack", "bin", dump,datalen);
172 free(dump);
173 }else
174 {
175 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
176 memcpy(c.d.asBytes, CSN, 8);
177 SendCommand(&c);
178 }
179
180 return 0;
181 }
182
183 int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
184 bool tagFound = false;
185 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
186 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
187 // loop in client not device - else on windows have a communication error
188 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
189 UsbCommand resp;
190 while(!ukbhit()){
191 SendCommand(&c);
192 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
193 uint8_t readStatus = resp.arg[0] & 0xff;
194 uint8_t *data = resp.d.asBytes;
195
196 if (verbose)
197 PrintAndLog("Readstatus:%02x", readStatus);
198 if( readStatus == 0){
199 //Aborted
200 if (verbose) PrintAndLog("Quitting...");
201 return 0;
202 }
203 if( readStatus & FLAG_ICLASS_READER_CSN){
204 PrintAndLog("CSN: %s",sprint_hex(data,8));
205 tagFound = true;
206 }
207 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
208 if( readStatus & FLAG_ICLASS_READER_CONF){
209 printIclassDumpInfo(data);
210 }
211 if (tagFound && !loop) return 1;
212 } else {
213 if (verbose) PrintAndLog("Command execute timeout");
214 }
215 if (!loop) break;
216 }
217 return 0;
218 }
219
220 int CmdHFiClassReader(const char *Cmd) {
221 return HFiClassReader(Cmd, true, true);
222 }
223
224 int CmdHFiClassReader_Replay(const char *Cmd) {
225 uint8_t readerType = 0;
226 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
227
228 if (strlen(Cmd)<1) {
229 PrintAndLog("Usage: hf iclass replay <MAC>");
230 PrintAndLog(" sample: hf iclass replay 00112233");
231 return 0;
232 }
233
234 if (param_gethex(Cmd, 0, MAC, 8)) {
235 PrintAndLog("MAC must include 8 HEX symbols");
236 return 1;
237 }
238
239 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
240 memcpy(c.d.asBytes, MAC, 4);
241 SendCommand(&c);
242
243 return 0;
244 }
245
246 int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
247 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
248 memcpy(c.d.asBytes, data, blocksCount * 16);
249 SendCommand(&c);
250 return 0;
251 }
252
253 int hf_iclass_eload_usage(void) {
254 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
255 PrintAndLog("Usage: hf iclass eload f <filename>");
256 PrintAndLog("");
257 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
258 return 0;
259 }
260
261 int CmdHFiClassELoad(const char *Cmd) {
262
263 char opt = param_getchar(Cmd, 0);
264 if (strlen(Cmd)<1 || opt == 'h')
265 return hf_iclass_eload_usage();
266
267 //File handling and reading
268 FILE *f;
269 char filename[FILE_PATH_SIZE];
270 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
271 f = fopen(filename, "rb");
272 } else {
273 return hf_iclass_eload_usage();
274 }
275
276 if(!f) {
277 PrintAndLog("Failed to read from file '%s'", filename);
278 return 1;
279 }
280
281 fseek(f, 0, SEEK_END);
282 long fsize = ftell(f);
283 fseek(f, 0, SEEK_SET);
284
285 if (fsize < 0) {
286 prnlog("Error, when getting filesize");
287 fclose(f);
288 return 1;
289 }
290
291 uint8_t *dump = malloc(fsize);
292
293 size_t bytes_read = fread(dump, 1, fsize, f);
294 fclose(f);
295
296 printIclassDumpInfo(dump);
297 //Validate
298
299 if (bytes_read < fsize)
300 {
301 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
302 free(dump);
303 return 1;
304 }
305 //Send to device
306 uint32_t bytes_sent = 0;
307 uint32_t bytes_remaining = bytes_read;
308
309 while(bytes_remaining > 0){
310 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
311 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
312 memcpy(c.d.asBytes, dump, bytes_in_packet);
313 SendCommand(&c);
314 bytes_remaining -= bytes_in_packet;
315 bytes_sent += bytes_in_packet;
316 }
317 free(dump);
318 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
319 return 0;
320 }
321
322 static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
323 FILE *f = fopen(filename, "rb");
324 if(!f) {
325 PrintAndLog("Failed to read from file '%s'", filename);
326 return 1;
327 }
328 fseek(f, 0, SEEK_END);
329 long fsize = ftell(f);
330 fseek(f, 0, SEEK_SET);
331 size_t bytes_read = fread(buffer, 1, len, f);
332 fclose(f);
333 if(fsize != len)
334 {
335 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
336 return 1;
337 }
338 if(bytes_read != len)
339 {
340 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
341 return 1;
342 }
343 return 0;
344 }
345
346 int usage_hf_iclass_decrypt(void) {
347 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
348 PrintAndLog("");
349 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
350 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
351 PrintAndLog("");
352 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
353 PrintAndLog("");
354 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
355 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
356 PrintAndLog("which is defined by the configuration block.");
357 return 1;
358 }
359
360 int CmdHFiClassDecrypt(const char *Cmd) {
361 uint8_t key[16] = { 0 };
362 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
363 {
364 usage_hf_iclass_decrypt();
365 return 1;
366 }
367 PrintAndLog("Decryption file found... ");
368 char opt = param_getchar(Cmd, 0);
369 if (strlen(Cmd)<1 || opt == 'h')
370 return usage_hf_iclass_decrypt();
371
372 //Open the tagdump-file
373 FILE *f;
374 char filename[FILE_PATH_SIZE];
375 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
376 if ( (f = fopen(filename, "rb")) == NULL) {
377 PrintAndLog("Could not find file %s", filename);
378 return 1;
379 }
380
381 } else {
382 return usage_hf_iclass_decrypt();
383 }
384
385 fseek(f, 0, SEEK_END);
386 long fsize = ftell(f);
387 fseek(f, 0, SEEK_SET);
388 uint8_t enc_dump[8] = {0};
389 uint8_t *decrypted = malloc(fsize);
390 des3_context ctx = { DES_DECRYPT ,{ 0 } };
391 des3_set2key_dec( &ctx, key);
392 size_t bytes_read = fread(enc_dump, 1, 8, f);
393
394 //Use the first block (CSN) for filename
395 char outfilename[FILE_PATH_SIZE] = { 0 };
396 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
397 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
398 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
399
400 size_t blocknum =0;
401 while(bytes_read == 8)
402 {
403 if(blocknum < 7)
404 {
405 memcpy(decrypted+(blocknum*8), enc_dump, 8);
406 }else{
407 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
408 }
409 printvar("decrypted block", decrypted +(blocknum*8), 8);
410 bytes_read = fread(enc_dump, 1, 8, f);
411 blocknum++;
412 }
413 fclose(f);
414
415 saveFile(outfilename,"bin", decrypted, blocknum*8);
416
417 free(decrypted);
418 return 0;
419 }
420
421 int usage_hf_iclass_encrypt(void) {
422 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
423 PrintAndLog("");
424 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
425 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
426 PrintAndLog("");
427 PrintAndLog("example: hf iclass encrypt 0102030405060708");
428 PrintAndLog("");
429 return 0;
430 }
431
432 static int iClassEncryptBlkData(uint8_t *blkData) {
433 uint8_t key[16] = { 0 };
434 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
435 {
436 usage_hf_iclass_encrypt();
437 return 1;
438 }
439 PrintAndLog("Decryption file found... ");
440
441 uint8_t encryptedData[16];
442 uint8_t *encrypted = encryptedData;
443 des3_context ctx = { DES_DECRYPT ,{ 0 } };
444 des3_set2key_enc( &ctx, key);
445
446 des3_crypt_ecb(&ctx, blkData,encrypted);
447 //printvar("decrypted block", decrypted, 8);
448 memcpy(blkData,encrypted,8);
449
450 return 1;
451 }
452
453 int CmdHFiClassEncryptBlk(const char *Cmd) {
454 uint8_t blkData[8] = {0};
455 char opt = param_getchar(Cmd, 0);
456 if (strlen(Cmd)<1 || opt == 'h')
457 return usage_hf_iclass_encrypt();
458
459 //get the bytes to encrypt
460 if (param_gethex(Cmd, 0, blkData, 16))
461 {
462 PrintAndLog("BlockData must include 16 HEX symbols");
463 return 0;
464 }
465 if (!iClassEncryptBlkData(blkData)) return 0;
466
467 printvar("encrypted block", blkData, 8);
468 return 1;
469 }
470
471 void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
472 uint8_t WB[9];
473 WB[0] = blockno;
474 memcpy(WB + 1,data,8);
475 doMAC_N(WB,sizeof(WB),div_key,MAC);
476 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
477 }
478
479 static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
480 UsbCommand resp;
481
482 UsbCommand c = {CMD_READER_ICLASS, {0}};
483 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
484 if (use_credit_key)
485 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
486
487 clearCommandBuffer();
488 SendCommand(&c);
489 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
490 {
491 PrintAndLog("Command execute timeout");
492 return false;
493 }
494
495 uint8_t isOK = resp.arg[0] & 0xff;
496 uint8_t *data = resp.d.asBytes;
497
498 memcpy(CSN,data,8);
499 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
500 if(isOK > 0)
501 {
502 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
503 }
504 if(isOK <= 1){
505 PrintAndLog("Failed to obtain CC! Aborting");
506 return false;
507 }
508 return true;
509 }
510
511 static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
512 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
513 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
514
515 if (!select_only(CSN, CCNR, use_credit_key, verbose))
516 return false;
517
518 //get div_key
519 if(rawkey)
520 memcpy(div_key, KEY, 8);
521 else
522 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
523 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
524
525 doMAC(CCNR, div_key, MAC);
526 UsbCommand resp;
527 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
528 memcpy(d.d.asBytes, MAC, 4);
529 clearCommandBuffer();
530 SendCommand(&d);
531 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
532 {
533 PrintAndLog("Auth Command execute timeout");
534 return false;
535 }
536 uint8_t isOK = resp.arg[0] & 0xff;
537 if (!isOK) {
538 PrintAndLog("Authentication error");
539 return false;
540 }
541 return true;
542 }
543
544 int usage_hf_iclass_dump(void) {
545 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
546 PrintAndLog("Options:");
547 PrintAndLog(" f <filename> : specify a filename to save dump to");
548 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
549 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
550 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
551 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
552 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
553 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
554 PrintAndLog(" NOTE: * = required");
555 PrintAndLog("Samples:");
556 PrintAndLog(" hf iclass dump k 001122334455667B");
557 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
558 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
559 return 0;
560 }
561
562 int CmdHFiClassReader_Dump(const char *Cmd) {
563
564 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
565 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
566 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
567 uint8_t blockno = 0;
568 uint8_t numblks = 0;
569 uint8_t maxBlk = 31;
570 uint8_t app_areas = 1;
571 uint8_t kb = 2;
572 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
573 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
574 uint8_t keyNbr = 0;
575 uint8_t dataLen = 0;
576 uint8_t fileNameLen = 0;
577 char filename[FILE_PATH_SIZE]={0};
578 char tempStr[50] = {0};
579 bool have_debit_key = false;
580 bool have_credit_key = false;
581 bool use_credit_key = false;
582 bool elite = false;
583 bool rawkey = false;
584 bool errors = false;
585 uint8_t cmdp = 0;
586
587 while(param_getchar(Cmd, cmdp) != 0x00)
588 {
589 switch(param_getchar(Cmd, cmdp))
590 {
591 case 'h':
592 case 'H':
593 return usage_hf_iclass_dump();
594 case 'c':
595 case 'C':
596 have_credit_key = true;
597 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
598 if (dataLen == 16) {
599 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
600 } else if (dataLen == 1) {
601 keyNbr = param_get8(Cmd, cmdp+1);
602 if (keyNbr < ICLASS_KEYS_MAX) {
603 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
604 } else {
605 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
606 errors = true;
607 }
608 } else {
609 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
610 errors = true;
611 }
612 cmdp += 2;
613 break;
614 case 'e':
615 case 'E':
616 elite = true;
617 cmdp++;
618 break;
619 case 'f':
620 case 'F':
621 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
622 if (fileNameLen < 1) {
623 PrintAndLog("No filename found after f");
624 errors = true;
625 }
626 cmdp += 2;
627 break;
628 case 'k':
629 case 'K':
630 have_debit_key = true;
631 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
632 if (dataLen == 16) {
633 errors = param_gethex(tempStr, 0, KEY, dataLen);
634 } else if (dataLen == 1) {
635 keyNbr = param_get8(Cmd, cmdp+1);
636 if (keyNbr < ICLASS_KEYS_MAX) {
637 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
638 } else {
639 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
640 errors = true;
641 }
642 } else {
643 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
644 errors = true;
645 }
646 cmdp += 2;
647 break;
648 case 'r':
649 case 'R':
650 rawkey = true;
651 cmdp++;
652 break;
653 default:
654 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
655 errors = true;
656 break;
657 }
658 if(errors) return usage_hf_iclass_dump();
659 }
660
661 if (cmdp < 2) return usage_hf_iclass_dump();
662 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
663 if (!have_debit_key && have_credit_key) use_credit_key = true;
664
665 //get config and first 3 blocks
666 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
667 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
668 UsbCommand resp;
669 uint8_t tag_data[255*8];
670
671 clearCommandBuffer();
672 SendCommand(&c);
673 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
674 PrintAndLog("Command execute timeout");
675 ul_switch_off_field();
676 return 0;
677 }
678 uint8_t readStatus = resp.arg[0] & 0xff;
679 uint8_t * data = resp.d.asBytes;
680
681 if(readStatus == 0){
682 PrintAndLog("No tag found...");
683 ul_switch_off_field();
684 return 0;
685 }
686 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
687 memcpy(tag_data, data, 8*3);
688 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
689 numblks = data[8];
690 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
691 // large memory - not able to dump pages currently
692 if (numblks > maxBlk) numblks = maxBlk;
693 }
694 ul_switch_off_field();
695 // authenticate debit key and get div_key - later store in dump block 3
696 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
697 //try twice - for some reason it sometimes fails the first time...
698 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
699 ul_switch_off_field();
700 return 0;
701 }
702 }
703
704 // begin dump
705 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
706 clearCommandBuffer();
707 SendCommand(&w);
708 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
709 PrintAndLog("Command execute time-out 1");
710 ul_switch_off_field();
711 return 1;
712 }
713 uint32_t blocksRead = resp.arg[1];
714 uint8_t isOK = resp.arg[0] & 0xff;
715 if (!isOK && !blocksRead) {
716 PrintAndLog("Read Block Failed");
717 ul_switch_off_field();
718 return 0;
719 }
720 uint32_t startindex = resp.arg[2];
721 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
722 PrintAndLog("Data exceeded Buffer size!");
723 blocksRead = (sizeof(tag_data)/8) - blockno;
724 }
725 // response ok - now get bigbuf content of the dump
726 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
727 WaitForResponse(CMD_ACK,NULL);
728 size_t gotBytes = blocksRead*8 + blockno*8;
729
730 // try AA2
731 if (have_credit_key) {
732 //turn off hf field before authenticating with different key
733 ul_switch_off_field();
734 memset(MAC,0,4);
735 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
736 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
737 //try twice - for some reason it sometimes fails the first time...
738 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
739 ul_switch_off_field();
740 return 0;
741 }
742 }
743 // do we still need to read more block? (aa2 enabled?)
744 if (maxBlk > blockno+numblks+1) {
745 // setup dump and start
746 w.arg[0] = blockno + blocksRead;
747 w.arg[1] = maxBlk - (blockno + blocksRead);
748 clearCommandBuffer();
749 SendCommand(&w);
750 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
751 PrintAndLog("Command execute timeout 2");
752 ul_switch_off_field();
753 return 0;
754 }
755 uint8_t isOK = resp.arg[0] & 0xff;
756 blocksRead = resp.arg[1];
757 if (!isOK && !blocksRead) {
758 PrintAndLog("Read Block Failed 2");
759 ul_switch_off_field();
760 return 0;
761 }
762
763 startindex = resp.arg[2];
764 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
765 PrintAndLog("Data exceeded Buffer size!");
766 blocksRead = (sizeof(tag_data) - gotBytes)/8;
767 }
768 // get dumped data from bigbuf
769 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
770 WaitForResponse(CMD_ACK,NULL);
771
772 gotBytes += blocksRead*8;
773 } else { //field is still on - turn it off...
774 ul_switch_off_field();
775 }
776 }
777
778 // add diversified keys to dump
779 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
780 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
781 // print the dump
782 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
783 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
784 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
785
786 if (filename[0] == 0){
787 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
788 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
789 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
790 }
791
792 // save the dump to .bin file
793 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
794 saveFile(filename, "bin", tag_data, gotBytes);
795 return 1;
796 }
797
798 static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
799 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
800 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
801 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
802 return 0;
803
804 UsbCommand resp;
805
806 Calc_wb_mac(blockno,bldata,div_key,MAC);
807 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
808 memcpy(w.d.asBytes, bldata, 8);
809 memcpy(w.d.asBytes + 8, MAC, 4);
810
811 clearCommandBuffer();
812 SendCommand(&w);
813 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
814 {
815 PrintAndLog("Write Command execute timeout");
816 return 0;
817 }
818 uint8_t isOK = resp.arg[0] & 0xff;
819 if (!isOK) {
820 PrintAndLog("Write Block Failed");
821 return 0;
822 }
823 PrintAndLog("Write Block Successful");
824 return 1;
825 }
826
827 int usage_hf_iclass_writeblock(void) {
828 PrintAndLog("Options:");
829 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
830 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
831 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
832 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
833 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
834 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
835 PrintAndLog("Samples:");
836 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
837 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
838 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
839 return 0;
840 }
841
842 int CmdHFiClass_WriteBlock(const char *Cmd) {
843 uint8_t blockno=0;
844 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
845 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
846 uint8_t keyNbr = 0;
847 uint8_t dataLen = 0;
848 char tempStr[50] = {0};
849 bool use_credit_key = false;
850 bool elite = false;
851 bool rawkey= false;
852 bool errors = false;
853 uint8_t cmdp = 0;
854 while(param_getchar(Cmd, cmdp) != 0x00)
855 {
856 switch(param_getchar(Cmd, cmdp))
857 {
858 case 'h':
859 case 'H':
860 return usage_hf_iclass_writeblock();
861 case 'b':
862 case 'B':
863 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
864 PrintAndLog("Block No must include 2 HEX symbols\n");
865 errors = true;
866 }
867 cmdp += 2;
868 break;
869 case 'c':
870 case 'C':
871 use_credit_key = true;
872 cmdp++;
873 break;
874 case 'd':
875 case 'D':
876 if (param_gethex(Cmd, cmdp+1, bldata, 16))
877 {
878 PrintAndLog("KEY must include 16 HEX symbols\n");
879 errors = true;
880 }
881 cmdp += 2;
882 break;
883 case 'e':
884 case 'E':
885 elite = true;
886 cmdp++;
887 break;
888 case 'k':
889 case 'K':
890 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
891 if (dataLen == 16) {
892 errors = param_gethex(tempStr, 0, KEY, dataLen);
893 } else if (dataLen == 1) {
894 keyNbr = param_get8(Cmd, cmdp+1);
895 if (keyNbr < ICLASS_KEYS_MAX) {
896 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
897 } else {
898 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
899 errors = true;
900 }
901 } else {
902 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
903 errors = true;
904 }
905 cmdp += 2;
906 break;
907 case 'r':
908 case 'R':
909 rawkey = true;
910 cmdp++;
911 break;
912 default:
913 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
914 errors = true;
915 break;
916 }
917 if(errors) return usage_hf_iclass_writeblock();
918 }
919
920 if (cmdp < 6) return usage_hf_iclass_writeblock();
921 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
922 ul_switch_off_field();
923 return ans;
924 }
925
926 int usage_hf_iclass_clone(void) {
927 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
928 PrintAndLog("Options:");
929 PrintAndLog(" f <filename>: specify a filename to clone from");
930 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
931 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
932 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
933 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
934 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
935 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
936 PrintAndLog("Samples:");
937 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
938 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
939 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
940 return -1;
941 }
942
943 int CmdHFiClassCloneTag(const char *Cmd) {
944 char filename[FILE_PATH_SIZE] = { 0x00 };
945 char tempStr[50]={0};
946 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
947 uint8_t keyNbr = 0;
948 uint8_t fileNameLen = 0;
949 uint8_t startblock = 0;
950 uint8_t endblock = 0;
951 uint8_t dataLen = 0;
952 bool use_credit_key = false;
953 bool elite = false;
954 bool rawkey = false;
955 bool errors = false;
956 uint8_t cmdp = 0;
957 while(param_getchar(Cmd, cmdp) != 0x00)
958 {
959 switch(param_getchar(Cmd, cmdp))
960 {
961 case 'h':
962 case 'H':
963 return usage_hf_iclass_clone();
964 case 'b':
965 case 'B':
966 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
967 PrintAndLog("Start Block No must include 2 HEX symbols\n");
968 errors = true;
969 }
970 cmdp += 2;
971 break;
972 case 'c':
973 case 'C':
974 use_credit_key = true;
975 cmdp++;
976 break;
977 case 'e':
978 case 'E':
979 elite = true;
980 cmdp++;
981 break;
982 case 'f':
983 case 'F':
984 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
985 if (fileNameLen < 1) {
986 PrintAndLog("No filename found after f");
987 errors = true;
988 }
989 cmdp += 2;
990 break;
991 case 'k':
992 case 'K':
993 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
994 if (dataLen == 16) {
995 errors = param_gethex(tempStr, 0, KEY, dataLen);
996 } else if (dataLen == 1) {
997 keyNbr = param_get8(Cmd, cmdp+1);
998 if (keyNbr < ICLASS_KEYS_MAX) {
999 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1000 } else {
1001 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1002 errors = true;
1003 }
1004 } else {
1005 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1006 errors = true;
1007 }
1008 cmdp += 2;
1009 break;
1010 case 'l':
1011 case 'L':
1012 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1013 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1014 errors = true;
1015 }
1016 cmdp += 2;
1017 break;
1018 case 'r':
1019 case 'R':
1020 rawkey = true;
1021 cmdp++;
1022 break;
1023 default:
1024 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1025 errors = true;
1026 break;
1027 }
1028 if(errors) return usage_hf_iclass_clone();
1029 }
1030
1031 if (cmdp < 8) return usage_hf_iclass_clone();
1032
1033 FILE *f;
1034
1035 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1036
1037 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1038 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1039 }
1040 // file handling and reading
1041 f = fopen(filename,"rb");
1042 if(!f) {
1043 PrintAndLog("Failed to read from file '%s'", filename);
1044 return 1;
1045 }
1046
1047 if (startblock<5) {
1048 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1049 fclose(f);
1050 return 0;
1051 }
1052 // now read data from the file from block 6 --- 19
1053 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1054 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1055 // else we have to create a share memory
1056 int i;
1057 fseek(f,startblock*8,SEEK_SET);
1058 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0){
1059 PrintAndLog("File reading error.");
1060 fclose(f);
1061 return 2;
1062 }
1063
1064 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1065 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1066
1067 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
1068 return 0;
1069
1070 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
1071 uint8_t *ptr;
1072 // calculate all mac for every the block we will write
1073 for (i = startblock; i <= endblock; i++){
1074 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1075 // usb command d start pointer = d + (i - 6) * 12
1076 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1077 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1078 // next one
1079 ptr = w.d.asBytes + (i - startblock) * 12;
1080 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1081 memcpy(ptr + 8,MAC, 4);
1082 }
1083 uint8_t p[12];
1084 for (i = 0; i <= endblock - startblock;i++){
1085 memcpy(p,w.d.asBytes + (i * 12),12);
1086 printf("Block |%02x|",i + startblock);
1087 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1088 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1089 }
1090 UsbCommand resp;
1091 SendCommand(&w);
1092 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1093 {
1094 PrintAndLog("Command execute timeout");
1095 return 0;
1096 }
1097 return 1;
1098 }
1099
1100 static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose) {
1101 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1102 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1103
1104 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
1105 return 0;
1106
1107 UsbCommand resp;
1108 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
1109 clearCommandBuffer();
1110 SendCommand(&w);
1111 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1112 {
1113 PrintAndLog("Command execute timeout");
1114 return 0;
1115 }
1116 uint8_t isOK = resp.arg[0] & 0xff;
1117 if (!isOK) {
1118 PrintAndLog("Read Block Failed");
1119 return 0;
1120 }
1121 //data read is stored in: resp.d.asBytes[0-15]
1122 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1123 return 1;
1124 }
1125
1126 int usage_hf_iclass_readblock(void) {
1127 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
1128 PrintAndLog("Options:");
1129 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1130 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1131 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1132 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1133 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
1134 PrintAndLog("Samples:");
1135 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1136 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1137 PrintAndLog(" hf iclass readblk b 0A k 0");
1138 return 0;
1139 }
1140
1141 int CmdHFiClass_ReadBlock(const char *Cmd) {
1142 uint8_t blockno=0;
1143 uint8_t keyType = 0x88; //debit key
1144 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1145 uint8_t keyNbr = 0;
1146 uint8_t dataLen = 0;
1147 char tempStr[50] = {0};
1148 bool elite = false;
1149 bool rawkey = false;
1150 bool errors = false;
1151 uint8_t cmdp = 0;
1152 while(param_getchar(Cmd, cmdp) != 0x00)
1153 {
1154 switch(param_getchar(Cmd, cmdp))
1155 {
1156 case 'h':
1157 case 'H':
1158 return usage_hf_iclass_readblock();
1159 case 'b':
1160 case 'B':
1161 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1162 PrintAndLog("Block No must include 2 HEX symbols\n");
1163 errors = true;
1164 }
1165 cmdp += 2;
1166 break;
1167 case 'c':
1168 case 'C':
1169 keyType = 0x18;
1170 cmdp++;
1171 break;
1172 case 'e':
1173 case 'E':
1174 elite = true;
1175 cmdp++;
1176 break;
1177 case 'k':
1178 case 'K':
1179 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1180 if (dataLen == 16) {
1181 errors = param_gethex(tempStr, 0, KEY, dataLen);
1182 } else if (dataLen == 1) {
1183 keyNbr = param_get8(Cmd, cmdp+1);
1184 if (keyNbr < ICLASS_KEYS_MAX) {
1185 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1186 } else {
1187 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1188 errors = true;
1189 }
1190 } else {
1191 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1192 errors = true;
1193 }
1194 cmdp += 2;
1195 break;
1196 case 'r':
1197 case 'R':
1198 rawkey = true;
1199 cmdp++;
1200 break;
1201 default:
1202 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1203 errors = true;
1204 break;
1205 }
1206 if(errors) return usage_hf_iclass_readblock();
1207 }
1208
1209 if (cmdp < 4) return usage_hf_iclass_readblock();
1210
1211 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true);
1212 }
1213
1214 int CmdHFiClass_loclass(const char *Cmd) {
1215 char opt = param_getchar(Cmd, 0);
1216
1217 if (strlen(Cmd)<1 || opt == 'h') {
1218 PrintAndLog("Usage: hf iclass loclass [options]");
1219 PrintAndLog("Options:");
1220 PrintAndLog("h Show this help");
1221 PrintAndLog("t Perform self-test");
1222 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1223 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1224 PrintAndLog(" malicious CSNs, and their protocol responses");
1225 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1226 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1227 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1228 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1229 PrintAndLog(" ... totalling N*24 bytes");
1230 return 0;
1231 }
1232 char fileName[255] = {0};
1233 if(opt == 'f')
1234 {
1235 if(param_getstr(Cmd, 1, fileName) > 0)
1236 {
1237 return bruteforceFileNoKeys(fileName);
1238 }else
1239 {
1240 PrintAndLog("You must specify a filename");
1241 }
1242 }
1243 else if(opt == 't')
1244 {
1245 int errors = testCipherUtils();
1246 errors += testMAC();
1247 errors += doKeyTests(0);
1248 errors += testElite();
1249 if(errors)
1250 {
1251 prnlog("OBS! There were errors!!!");
1252 }
1253 return errors;
1254 }
1255
1256 return 0;
1257 }
1258
1259 void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1260 uint8_t blockdata[8];
1261 uint8_t mem_config;
1262 memcpy(&mem_config, iclass_dump + 13,1);
1263 uint8_t maxmemcount;
1264 uint8_t filemaxblock = filesize / 8;
1265 if (mem_config & 0x80)
1266 maxmemcount = 255;
1267 else
1268 maxmemcount = 31;
1269 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1270
1271 if (startblock == 0)
1272 startblock = 6;
1273 if ((endblock > maxmemcount) || (endblock == 0))
1274 endblock = maxmemcount;
1275 if (endblock > filemaxblock)
1276 endblock = filemaxblock;
1277 int i = startblock;
1278 int j;
1279 while (i <= endblock){
1280 printf("Block |%02X| ",i);
1281 memcpy(blockdata,iclass_dump + (i * 8),8);
1282 for (j = 0;j < 8;j++)
1283 printf("%02X ",blockdata[j]);
1284 printf("|\n");
1285 i++;
1286 }
1287 }
1288
1289 int usage_hf_iclass_readtagfile() {
1290 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1291 return 1;
1292 }
1293
1294 int CmdHFiClassReadTagFile(const char *Cmd) {
1295 int startblock = 0;
1296 int endblock = 0;
1297 char tempnum[5];
1298 FILE *f;
1299 char filename[FILE_PATH_SIZE];
1300 if (param_getstr(Cmd, 0, filename) < 1)
1301 return usage_hf_iclass_readtagfile();
1302 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1303 startblock = 0;
1304 else
1305 sscanf(tempnum,"%d",&startblock);
1306
1307 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1308 endblock = 0;
1309 else
1310 sscanf(tempnum,"%d",&endblock);
1311 // file handling and reading
1312 f = fopen(filename,"rb");
1313 if(!f) {
1314 PrintAndLog("Failed to read from file '%s'", filename);
1315 return 1;
1316 }
1317 fseek(f, 0, SEEK_END);
1318 long fsize = ftell(f);
1319 fseek(f, 0, SEEK_SET);
1320
1321 if ( fsize < 0 ) {
1322 PrintAndLog("Error, when getting filesize");
1323 fclose(f);
1324 return 1;
1325 }
1326
1327 uint8_t *dump = malloc(fsize);
1328
1329 size_t bytes_read = fread(dump, 1, fsize, f);
1330 fclose(f);
1331 uint8_t *csn = dump;
1332 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
1333 // printIclassDumpInfo(dump);
1334 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1335 free(dump);
1336 return 0;
1337 }
1338
1339 /*
1340 uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1341 uint64_t new_div = 0x00;
1342 new_div ^= sdiv;
1343 new_div ^= hdiv;
1344 return new_div;
1345 }
1346
1347 uint64_t hexarray_to_uint64(uint8_t *key) {
1348 char temp[17];
1349 uint64_t uint_key;
1350 for (int i = 0;i < 8;i++)
1351 sprintf(&temp[(i *2)],"%02X",key[i]);
1352 temp[16] = '\0';
1353 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1354 return 0;
1355 return uint_key;
1356 }
1357 */
1358 void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1359 uint8_t keytable[128] = {0};
1360 uint8_t key_index[8] = {0};
1361 if (elite) {
1362 uint8_t key_sel[8] = { 0 };
1363 uint8_t key_sel_p[8] = { 0 };
1364 hash2(KEY, keytable);
1365 hash1(CSN, key_index);
1366 for(uint8_t i = 0; i < 8 ; i++)
1367 key_sel[i] = keytable[key_index[i]] & 0xFF;
1368
1369 //Permute from iclass format to standard format
1370 permutekey_rev(key_sel, key_sel_p);
1371 diversifyKey(CSN, key_sel_p, div_key);
1372 } else {
1373 diversifyKey(CSN, KEY, div_key);
1374 }
1375 }
1376
1377 //when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1378 //calculate and return xor_div_key (ready for a key write command)
1379 //print all div_keys if verbose
1380 static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1381 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1382 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1383 //get old div key
1384 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1385 //get new div key
1386 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1387
1388 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1389 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1390 }
1391 if (verbose) {
1392 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1393 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1394 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1395 }
1396 }
1397
1398 int usage_hf_iclass_calc_newkey(void) {
1399 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1400 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1401 PrintAndLog(" Options:");
1402 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1403 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1404 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1405 PrintAndLog(" e : specify new key as elite calc");
1406 PrintAndLog(" ee : specify old and new key as elite calc");
1407 PrintAndLog("Samples:");
1408 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1409 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1410 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1411 PrintAndLog("NOTE: * = required\n");
1412
1413 return 1;
1414 }
1415
1416 int CmdHFiClassCalcNewKey(const char *Cmd) {
1417 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1418 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1419 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1420 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1421 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1422 uint8_t keyNbr = 0;
1423 uint8_t dataLen = 0;
1424 char tempStr[50] = {0};
1425 bool givenCSN = false;
1426 bool oldElite = false;
1427 bool elite = false;
1428 bool errors = false;
1429 uint8_t cmdp = 0;
1430 while(param_getchar(Cmd, cmdp) != 0x00)
1431 {
1432 switch(param_getchar(Cmd, cmdp))
1433 {
1434 case 'h':
1435 case 'H':
1436 return usage_hf_iclass_calc_newkey();
1437 case 'e':
1438 case 'E':
1439 dataLen = param_getstr(Cmd, cmdp, tempStr);
1440 if (dataLen==2)
1441 oldElite = true;
1442 elite = true;
1443 cmdp++;
1444 break;
1445 case 'n':
1446 case 'N':
1447 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1448 if (dataLen == 16) {
1449 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1450 } else if (dataLen == 1) {
1451 keyNbr = param_get8(Cmd, cmdp+1);
1452 if (keyNbr < ICLASS_KEYS_MAX) {
1453 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1454 } else {
1455 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1456 errors = true;
1457 }
1458 } else {
1459 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1460 errors = true;
1461 }
1462 cmdp += 2;
1463 break;
1464 case 'o':
1465 case 'O':
1466 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1467 if (dataLen == 16) {
1468 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1469 } else if (dataLen == 1) {
1470 keyNbr = param_get8(Cmd, cmdp+1);
1471 if (keyNbr < ICLASS_KEYS_MAX) {
1472 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1473 } else {
1474 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1475 errors = true;
1476 }
1477 } else {
1478 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1479 errors = true;
1480 }
1481 cmdp += 2;
1482 break;
1483 case 's':
1484 case 'S':
1485 givenCSN = true;
1486 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1487 return usage_hf_iclass_calc_newkey();
1488 cmdp += 2;
1489 break;
1490 default:
1491 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1492 errors = true;
1493 break;
1494 }
1495 if(errors) return usage_hf_iclass_calc_newkey();
1496 }
1497
1498 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1499
1500 if (!givenCSN)
1501 if (!select_only(CSN, CCNR, false, true))
1502 return 0;
1503
1504 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1505 return 0;
1506 }
1507
1508 static int loadKeys(char *filename) {
1509 FILE *f;
1510 f = fopen(filename,"rb");
1511 if(!f) {
1512 PrintAndLog("Failed to read from file '%s'", filename);
1513 return 0;
1514 }
1515 fseek(f, 0, SEEK_END);
1516 long fsize = ftell(f);
1517 fseek(f, 0, SEEK_SET);
1518
1519 if ( fsize < 0 ) {
1520 PrintAndLog("Error, when getting filesize");
1521 fclose(f);
1522 return 1;
1523 }
1524
1525 uint8_t *dump = malloc(fsize);
1526
1527 size_t bytes_read = fread(dump, 1, fsize, f);
1528 fclose(f);
1529 if (bytes_read > ICLASS_KEYS_MAX * 8){
1530 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1531 free(dump);
1532 return 0;
1533 }
1534 uint8_t i = 0;
1535 for (; i < bytes_read/8; i++){
1536 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1537 }
1538 free(dump);
1539 PrintAndLog("%u keys loaded", i);
1540 return 1;
1541 }
1542
1543 static int saveKeys(char *filename) {
1544 FILE *f;
1545 f = fopen(filename,"wb");
1546 if (f == NULL) {
1547 printf("error opening file %s\n",filename);
1548 return 0;
1549 }
1550 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1551 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1552 PrintAndLog("save key failed to write to file: %s", filename);
1553 break;
1554 }
1555 }
1556 fclose(f);
1557 return 0;
1558 }
1559
1560 static int printKeys(void) {
1561 PrintAndLog("");
1562 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1563 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1564 }
1565 PrintAndLog("");
1566 return 0;
1567 }
1568
1569 int usage_hf_iclass_managekeys(void) {
1570 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1571 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1572 PrintAndLog(" Options:");
1573 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1574 PrintAndLog(" k <key> : set a key in memory");
1575 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1576 PrintAndLog(" s : save keys in memory to file specified by filename");
1577 PrintAndLog(" l : load keys to memory from file specified by filename");
1578 PrintAndLog(" p : print keys loaded into memory\n");
1579 PrintAndLog("Samples:");
1580 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1581 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1582 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1583 PrintAndLog(" print keys : hf iclass managekeys p\n");
1584 return 0;
1585 }
1586
1587 int CmdHFiClassManageKeys(const char *Cmd) {
1588 uint8_t keyNbr = 0;
1589 uint8_t dataLen = 0;
1590 uint8_t KEY[8] = {0};
1591 char filename[FILE_PATH_SIZE];
1592 uint8_t fileNameLen = 0;
1593 bool errors = false;
1594 uint8_t operation = 0;
1595 char tempStr[20];
1596 uint8_t cmdp = 0;
1597
1598 while(param_getchar(Cmd, cmdp) != 0x00)
1599 {
1600 switch(param_getchar(Cmd, cmdp))
1601 {
1602 case 'h':
1603 case 'H':
1604 return usage_hf_iclass_managekeys();
1605 case 'f':
1606 case 'F':
1607 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1608 if (fileNameLen < 1) {
1609 PrintAndLog("No filename found after f");
1610 errors = true;
1611 }
1612 cmdp += 2;
1613 break;
1614 case 'n':
1615 case 'N':
1616 keyNbr = param_get8(Cmd, cmdp+1);
1617 if (keyNbr == 0) {
1618 PrintAndLog("Wrong block number");
1619 errors = true;
1620 }
1621 cmdp += 2;
1622 break;
1623 case 'k':
1624 case 'K':
1625 operation += 3; //set key
1626 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1627 if (dataLen == 16) { //ul-c or ev1/ntag key length
1628 errors = param_gethex(tempStr, 0, KEY, dataLen);
1629 } else {
1630 PrintAndLog("\nERROR: Key is incorrect length\n");
1631 errors = true;
1632 }
1633 cmdp += 2;
1634 break;
1635 case 'p':
1636 case 'P':
1637 operation += 4; //print keys in memory
1638 cmdp++;
1639 break;
1640 case 'l':
1641 case 'L':
1642 operation += 5; //load keys from file
1643 cmdp++;
1644 break;
1645 case 's':
1646 case 'S':
1647 operation += 6; //save keys to file
1648 cmdp++;
1649 break;
1650 default:
1651 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1652 errors = true;
1653 break;
1654 }
1655 if(errors) return usage_hf_iclass_managekeys();
1656 }
1657 if (operation == 0){
1658 PrintAndLog("no operation specified (load, save, or print)\n");
1659 return usage_hf_iclass_managekeys();
1660 }
1661 if (operation > 6){
1662 PrintAndLog("Too many operations specified\n");
1663 return usage_hf_iclass_managekeys();
1664 }
1665 if (operation > 4 && fileNameLen == 0){
1666 PrintAndLog("You must enter a filename when loading or saving\n");
1667 return usage_hf_iclass_managekeys();
1668 }
1669
1670 switch (operation){
1671 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1672 case 4: return printKeys();
1673 case 5: return loadKeys(filename);
1674 case 6: return saveKeys(filename);
1675 break;
1676 }
1677 return 0;
1678 }
1679
1680 static command_t CommandTable[] =
1681 {
1682 {"help", CmdHelp, 1, "This help"},
1683 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1684 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1685 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1686 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1687 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1688 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1689 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1690 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1691 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1692 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1693 {"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
1694 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1695 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1696 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1697 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1698 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
1699 {NULL, NULL, 0, NULL}
1700 };
1701
1702 int CmdHFiClass(const char *Cmd)
1703 {
1704 CmdsParse(CommandTable, Cmd);
1705 return 0;
1706 }
1707
1708 int CmdHelp(const char *Cmd)
1709 {
1710 CmdsHelp(CommandTable);
1711 return 0;
1712 }
Proxmark3 GIT tracking
Impressum, Datenschutz