]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhficlass.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
add: added a noncedistance method
[proxmark3-svn] / client / cmdhficlass.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3 // Copyright (C) 2011 Gerhard de Koning Gans
4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // High frequency iClass commands
11 //-----------------------------------------------------------------------------
12
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <sys/stat.h>
17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18 #include "data.h"
19 #include "proxmark3.h"
20 #include "ui.h"
21 #include "cmdparser.h"
22 #include "cmdhficlass.h"
23 #include "common.h"
24 #include "util.h"
25 #include "cmdmain.h"
26 #include "loclass/des.h"
27 #include "loclass/cipherutils.h"
28 #include "loclass/cipher.h"
29 #include "loclass/ikeys.h"
30 #include "loclass/elite_crack.h"
31 #include "loclass/fileutils.h"
32 #include "protocols.h"
33 #include "usb_cmd.h"
34 #include "cmdhfmfu.h"
35 #include "cmdhf.h"
36
37 static int CmdHelp(const char *Cmd);
38
39 #define ICLASS_KEYS_MAX 8
40 static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
41 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
49 };
50
51 typedef struct iclass_block {
52 uint8_t d[8];
53 } iclass_block_t;
54
55 int xorbits_8(uint8_t val) {
56 uint8_t res = val ^ (val >> 1); //1st pass
57 res = res ^ (res >> 1); // 2nd pass
58 res = res ^ (res >> 2); // 3rd pass
59 res = res ^ (res >> 4); // 4th pass
60 return res & 1;
61 }
62
63 int CmdHFiClassList(const char *Cmd) {
64 //PrintAndLog("Deprecated command, use 'hf list iclass' instead");
65 CmdHFList("iclass");
66 return 0;
67 }
68
69 int CmdHFiClassSnoop(const char *Cmd) {
70 UsbCommand c = {CMD_SNOOP_ICLASS};
71 SendCommand(&c);
72 return 0;
73 }
74
75 int usage_hf_iclass_sim(void) {
76 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
77 PrintAndLog(" options");
78 PrintAndLog(" 0 <CSN> simulate the given CSN");
79 PrintAndLog(" 1 simulate default CSN");
80 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
81 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
82 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
83 PrintAndLog(" example: hf iclass sim 2");
84 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
85 PrintAndLog(" hf iclass sim 3");
86 return 0;
87 }
88
89 #define NUM_CSNS 15
90 int CmdHFiClassSim(const char *Cmd) {
91 uint8_t simType = 0;
92 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
93
94 if (strlen(Cmd)<1) return usage_hf_iclass_sim();
95
96 simType = param_get8ex(Cmd, 0, 0, 10);
97
98 if(simType == 0)
99 {
100 if (param_gethex(Cmd, 1, CSN, 16)) {
101 PrintAndLog("A CSN should consist of 16 HEX symbols");
102 return usage_hf_iclass_sim();
103 }
104
105 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
106 }
107
108 if(simType > 3)
109 {
110 PrintAndLog("Undefined simptype %d", simType);
111 return usage_hf_iclass_sim();
112 }
113
114 uint8_t numberOfCSNs=0;
115 if(simType == 2)
116 {
117 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
118 UsbCommand resp = {0};
119
120 uint8_t csns[8*NUM_CSNS] = {
121 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
136
137 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
138 clearCommandBuffer();
139 SendCommand(&c);
140 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
141 PrintAndLog("Command timed out");
142 return 0;
143 }
144
145 uint8_t num_mac_responses = resp.arg[1];
146 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
147
148 size_t datalen = NUM_CSNS*24;
149 /*
150 * Now, time to dump to file. We'll use this format:
151 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
152 * So, it should wind up as
153 * 8 * 24 bytes.
154 *
155 * The returndata from the pm3 is on the following format
156 * <4 byte NR><4 byte MAC>
157 * CC are all zeroes, CSN is the same as was sent in
158 **/
159 void* dump = malloc(datalen);
160 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
161 uint8_t i = 0;
162 for(i = 0 ; i < NUM_CSNS ; i++) {
163 memcpy(dump+i*24, csns+i*8, 8); //CSN
164 //8 zero bytes here...
165 //Then comes NR_MAC (eight bytes from the response)
166 memcpy(dump+i*24+16, resp.d.asBytes+i*8, 8);
167 }
168 /** Now, save to dumpfile **/
169 saveFile("iclass_mac_attack", "bin", dump, datalen);
170 free(dump);
171 } else {
172 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
173 memcpy(c.d.asBytes, CSN, 8);
174 clearCommandBuffer();
175 SendCommand(&c);
176 }
177 return 0;
178 }
179
180 int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
181 bool tagFound = false;
182 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
183 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_AA}};
184 // loop in client not device - else on windows have a communication error
185 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
186 UsbCommand resp;
187 while(!ukbhit()){
188 clearCommandBuffer();
189 SendCommand(&c);
190 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
191 uint8_t readStatus = resp.arg[0] & 0xff;
192 uint8_t *data = resp.d.asBytes;
193
194 if (verbose) PrintAndLog("Readstatus:%02x", readStatus);
195 if( readStatus == 0){
196 //Aborted
197 if (verbose) PrintAndLog("Quitting...");
198 return 0;
199 }
200 if( readStatus & FLAG_ICLASS_READER_CSN){
201 PrintAndLog("CSN: %s",sprint_hex(data,8));
202 tagFound = true;
203 }
204 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s", sprint_hex(data+16, 8));
205 if( readStatus & FLAG_ICLASS_READER_CONF) printIclassDumpInfo(data);
206 if (tagFound && !loop) return 1;
207 } else {
208 if (verbose) PrintAndLog("Command execute timeout");
209 }
210 if (!loop) break;
211 }
212 return 0;
213 }
214
215 int CmdHFiClassReader(const char *Cmd) {
216 return HFiClassReader(Cmd, true, true);
217 }
218
219 int CmdHFiClassReader_Replay(const char *Cmd) {
220 uint8_t readerType = 0;
221 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
222
223 if (strlen(Cmd)<1) {
224 PrintAndLog("Usage: hf iclass replay <MAC>");
225 PrintAndLog(" sample: hf iclass replay 00112233");
226 return 0;
227 }
228
229 if (param_gethex(Cmd, 0, MAC, 8)) {
230 PrintAndLog("MAC must include 8 HEX symbols");
231 return 1;
232 }
233
234 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
235 memcpy(c.d.asBytes, MAC, 4);
236 clearCommandBuffer();
237 SendCommand(&c);
238 return 0;
239 }
240
241 int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
242 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
243 memcpy(c.d.asBytes, data, blocksCount * 16);
244 clearCommandBuffer();
245 SendCommand(&c);
246 return 0;
247 }
248
249 int hf_iclass_eload_usage(void) {
250 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
251 PrintAndLog("Usage: hf iclass eload f <filename>");
252 PrintAndLog("");
253 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
254 return 0;
255 }
256
257 int CmdHFiClassELoad(const char *Cmd) {
258
259 char opt = param_getchar(Cmd, 0);
260 if (strlen(Cmd)<1 || opt == 'h' || opt == 'H') return hf_iclass_eload_usage();
261
262 //File handling and reading
263 FILE *f;
264 char filename[FILE_PATH_SIZE];
265 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
266 f = fopen(filename, "rb");
267 } else {
268 return hf_iclass_eload_usage();
269 }
270
271 if(!f) {
272 PrintAndLog("Failed to read from file '%s'", filename);
273 return 1;
274 }
275
276 fseek(f, 0, SEEK_END);
277 long fsize = ftell(f);
278 fseek(f, 0, SEEK_SET);
279
280 if (fsize < 0) {
281 prnlog("Error, when getting filesize");
282 fclose(f);
283 return 1;
284 }
285
286 uint8_t *dump = malloc(fsize);
287
288 size_t bytes_read = fread(dump, 1, fsize, f);
289 fclose(f);
290
291 printIclassDumpInfo(dump);
292 //Validate
293
294 if (bytes_read < fsize) {
295 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
296 free(dump);
297 return 1;
298 }
299 //Send to device
300 uint32_t bytes_sent = 0;
301 uint32_t bytes_remaining = bytes_read;
302
303 while(bytes_remaining > 0){
304 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
305 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
306 memcpy(c.d.asBytes, dump, bytes_in_packet);
307 clearCommandBuffer();
308 SendCommand(&c);
309 bytes_remaining -= bytes_in_packet;
310 bytes_sent += bytes_in_packet;
311 }
312 free(dump);
313 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
314 return 0;
315 }
316
317 static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
318 FILE *f = fopen(filename, "rb");
319 if(!f) {
320 PrintAndLog("Failed to read from file '%s'", filename);
321 return 1;
322 }
323 fseek(f, 0, SEEK_END);
324 long fsize = ftell(f);
325 fseek(f, 0, SEEK_SET);
326 size_t bytes_read = fread(buffer, 1, len, f);
327 fclose(f);
328
329 if(fsize != len) {
330 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
331 return 1;
332 }
333
334 if(bytes_read != len) {
335 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
336 return 1;
337 }
338 return 0;
339 }
340
341 int usage_hf_iclass_decrypt(void) {
342 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
343 PrintAndLog("");
344 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
345 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
346 PrintAndLog("");
347 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
348 PrintAndLog("");
349 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
350 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
351 PrintAndLog("which is defined by the configuration block.");
352 return 1;
353 }
354
355 int CmdHFiClassDecrypt(const char *Cmd) {
356 uint8_t key[16] = { 0 };
357 if(readKeyfile("iclass_decryptionkey.bin", 16, key)) {
358 usage_hf_iclass_decrypt();
359 return 1;
360 }
361 PrintAndLog("Decryption file found... ");
362 char opt = param_getchar(Cmd, 0);
363 if (strlen(Cmd)<1 || opt == 'h' || opt == 'H') return usage_hf_iclass_decrypt();
364
365 //Open the tagdump-file
366 FILE *f;
367 char filename[FILE_PATH_SIZE];
368 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
369 if ( (f = fopen(filename, "rb")) == NULL) {
370 PrintAndLog("Could not find file %s", filename);
371 return 1;
372 }
373 } else {
374 return usage_hf_iclass_decrypt();
375 }
376
377 fseek(f, 0, SEEK_END);
378 long fsize = ftell(f);
379 fseek(f, 0, SEEK_SET);
380 uint8_t enc_dump[8] = {0};
381 uint8_t *decrypted = malloc(fsize);
382 des3_context ctx = { DES_DECRYPT ,{ 0 } };
383 des3_set2key_dec( &ctx, key);
384 size_t bytes_read = fread(enc_dump, 1, 8, f);
385
386 //Use the first block (CSN) for filename
387 char outfilename[FILE_PATH_SIZE] = { 0 };
388 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
389 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
390 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
391
392 size_t blocknum =0;
393 while(bytes_read == 8)
394 {
395 if(blocknum < 7) {
396 memcpy(decrypted+(blocknum*8), enc_dump, 8);
397 } else {
398 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
399 }
400 printvar("decrypted block", decrypted +(blocknum*8), 8);
401 bytes_read = fread(enc_dump, 1, 8, f);
402 blocknum++;
403 }
404 fclose(f);
405 saveFile(outfilename,"bin", decrypted, blocknum*8);
406 free(decrypted);
407 return 0;
408 }
409
410 int usage_hf_iclass_encrypt(void) {
411 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
412 PrintAndLog("");
413 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
414 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
415 PrintAndLog("");
416 PrintAndLog("example: hf iclass encrypt 0102030405060708");
417 PrintAndLog("");
418 return 0;
419 }
420
421 static int iClassEncryptBlkData(uint8_t *blkData) {
422 uint8_t key[16] = { 0 };
423 if(readKeyfile("iclass_decryptionkey.bin", 16, key)) {
424 usage_hf_iclass_encrypt();
425 return 1;
426 }
427 PrintAndLog("Decryption file found... ");
428
429 uint8_t encryptedData[16];
430 uint8_t *encrypted = encryptedData;
431 des3_context ctx = { DES_DECRYPT ,{ 0 } };
432 des3_set2key_enc( &ctx, key);
433
434 des3_crypt_ecb(&ctx, blkData,encrypted);
435 //printvar("decrypted block", decrypted, 8);
436 memcpy(blkData,encrypted,8);
437
438 return 1;
439 }
440
441 int CmdHFiClassEncryptBlk(const char *Cmd) {
442 uint8_t blkData[8] = {0};
443 char opt = param_getchar(Cmd, 0);
444 if (strlen(Cmd)<1 || opt == 'h' || opt == 'H') return usage_hf_iclass_encrypt();
445
446 //get the bytes to encrypt
447 if (param_gethex(Cmd, 0, blkData, 16)) {
448 PrintAndLog("BlockData must include 16 HEX symbols");
449 return 0;
450 }
451 if (!iClassEncryptBlkData(blkData)) return 0;
452
453 printvar("encrypted block", blkData, 8);
454 return 1;
455 }
456
457 void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
458 uint8_t WB[9];
459 WB[0] = blockno;
460 memcpy(WB + 1,data,8);
461 doMAC_N(WB,sizeof(WB),div_key,MAC);
462 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
463 }
464
465 static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
466 UsbCommand resp;
467
468 UsbCommand c = {CMD_READER_ICLASS, {0}};
469 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
470 if (use_credit_key)
471 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
472
473 clearCommandBuffer();
474 SendCommand(&c);
475 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
476 PrintAndLog("Command execute timeout");
477 return false;
478 }
479
480 uint8_t isOK = resp.arg[0] & 0xff;
481 uint8_t *data = resp.d.asBytes;
482
483 memcpy(CSN,data,8);
484
485 if (CCNR!=NULL)
486 memcpy(CCNR,data+16,8);
487
488 if(isOK > 0) {
489 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
490 }
491
492 if(isOK <= 1){
493 PrintAndLog("Failed to obtain CC! Aborting");
494 return false;
495 }
496 return true;
497 }
498
499 static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
500 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
501 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
502
503 if (!select_only(CSN, CCNR, use_credit_key, verbose))
504 return false;
505
506 //get div_key
507 if(rawkey)
508 memcpy(div_key, KEY, 8);
509 else
510 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
511
512 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
513
514 doMAC(CCNR, div_key, MAC);
515 UsbCommand resp;
516 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
517 memcpy(d.d.asBytes, MAC, 4);
518 clearCommandBuffer();
519 SendCommand(&d);
520 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
521 PrintAndLog("Auth Command execute timeout");
522 return false;
523 }
524 uint8_t isOK = resp.arg[0] & 0xff;
525 if (!isOK) {
526 PrintAndLog("Authentication error");
527 return false;
528 }
529 return true;
530 }
531
532 int usage_hf_iclass_dump(void) {
533 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
534 PrintAndLog("Options:");
535 PrintAndLog(" f <filename> : specify a filename to save dump to");
536 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
537 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
538 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
539 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
540 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
541 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
542 PrintAndLog(" NOTE: * = required");
543 PrintAndLog("Samples:");
544 PrintAndLog(" hf iclass dump k 001122334455667B");
545 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
546 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
547 return 0;
548 }
549
550 int CmdHFiClassReader_Dump(const char *Cmd) {
551
552 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
553 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
554 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
555 uint8_t blockno = 0;
556 uint8_t numblks = 0;
557 uint8_t maxBlk = 31;
558 uint8_t app_areas = 1;
559 uint8_t kb = 2;
560 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
561 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
562 uint8_t keyNbr = 0;
563 uint8_t dataLen = 0;
564 uint8_t fileNameLen = 0;
565 char filename[FILE_PATH_SIZE]={0};
566 char tempStr[50] = {0};
567 bool have_debit_key = false;
568 bool have_credit_key = false;
569 bool use_credit_key = false;
570 bool elite = false;
571 bool rawkey = false;
572 bool errors = false;
573 uint8_t cmdp = 0;
574
575 while(param_getchar(Cmd, cmdp) != 0x00)
576 {
577 switch(param_getchar(Cmd, cmdp))
578 {
579 case 'h':
580 case 'H':
581 return usage_hf_iclass_dump();
582 case 'c':
583 case 'C':
584 have_credit_key = true;
585 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
586 if (dataLen == 16) {
587 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
588 } else if (dataLen == 1) {
589 keyNbr = param_get8(Cmd, cmdp+1);
590 if (keyNbr < ICLASS_KEYS_MAX) {
591 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
592 } else {
593 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
594 errors = true;
595 }
596 } else {
597 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
598 errors = true;
599 }
600 cmdp += 2;
601 break;
602 case 'e':
603 case 'E':
604 elite = true;
605 cmdp++;
606 break;
607 case 'f':
608 case 'F':
609 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
610 if (fileNameLen < 1) {
611 PrintAndLog("No filename found after f");
612 errors = true;
613 }
614 cmdp += 2;
615 break;
616 case 'k':
617 case 'K':
618 have_debit_key = true;
619 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
620 if (dataLen == 16) {
621 errors = param_gethex(tempStr, 0, KEY, dataLen);
622 } else if (dataLen == 1) {
623 keyNbr = param_get8(Cmd, cmdp+1);
624 if (keyNbr < ICLASS_KEYS_MAX) {
625 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
626 } else {
627 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
628 errors = true;
629 }
630 } else {
631 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
632 errors = true;
633 }
634 cmdp += 2;
635 break;
636 case 'r':
637 case 'R':
638 rawkey = true;
639 cmdp++;
640 break;
641 default:
642 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
643 errors = true;
644 break;
645 }
646 if(errors) return usage_hf_iclass_dump();
647 }
648
649 if (cmdp < 2) return usage_hf_iclass_dump();
650 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
651 if (!have_debit_key && have_credit_key) use_credit_key = true;
652
653 //get config and first 3 blocks
654 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
655 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
656 UsbCommand resp;
657 uint8_t tag_data[255*8];
658
659 clearCommandBuffer();
660 SendCommand(&c);
661 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
662 PrintAndLog("Command execute timeout");
663 ul_switch_off_field();
664 return 0;
665 }
666 uint8_t readStatus = resp.arg[0] & 0xff;
667 uint8_t * data = resp.d.asBytes;
668
669 if(readStatus == 0){
670 PrintAndLog("No tag found...");
671 ul_switch_off_field();
672 return 0;
673 }
674
675 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
676 memcpy(tag_data, data, 8*3);
677 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
678 numblks = data[8];
679 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
680 // large memory - not able to dump pages currently
681 if (numblks > maxBlk) numblks = maxBlk;
682 }
683
684 ul_switch_off_field();
685 // authenticate debit key and get div_key - later store in dump block 3
686 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
687 //try twice - for some reason it sometimes fails the first time...
688 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
689 ul_switch_off_field();
690 return 0;
691 }
692 }
693
694 // begin dump
695 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
696 clearCommandBuffer();
697 SendCommand(&w);
698 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
699 PrintAndLog("Command execute time-out 1");
700 ul_switch_off_field();
701 return 1;
702 }
703 uint32_t blocksRead = resp.arg[1];
704 uint8_t isOK = resp.arg[0] & 0xff;
705 if (!isOK && !blocksRead) {
706 PrintAndLog("Read Block Failed");
707 ul_switch_off_field();
708 return 0;
709 }
710 uint32_t startindex = resp.arg[2];
711 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
712 PrintAndLog("Data exceeded Buffer size!");
713 blocksRead = (sizeof(tag_data)/8) - blockno;
714 }
715 // response ok - now get bigbuf content of the dump
716 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
717 WaitForResponse(CMD_ACK,NULL);
718 size_t gotBytes = blocksRead*8 + blockno*8;
719
720 // try AA2
721 if (have_credit_key) {
722 //turn off hf field before authenticating with different key
723 ul_switch_off_field();
724 memset(MAC,0,4);
725 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
726 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
727 //try twice - for some reason it sometimes fails the first time...
728 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
729 ul_switch_off_field();
730 return 0;
731 }
732 }
733 // do we still need to read more block? (aa2 enabled?)
734 if (maxBlk > blockno+numblks+1) {
735 // setup dump and start
736 w.arg[0] = blockno + blocksRead;
737 w.arg[1] = maxBlk - (blockno + blocksRead);
738 clearCommandBuffer();
739 SendCommand(&w);
740 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
741 PrintAndLog("Command execute timeout 2");
742 ul_switch_off_field();
743 return 0;
744 }
745 uint8_t isOK = resp.arg[0] & 0xff;
746 blocksRead = resp.arg[1];
747 if (!isOK && !blocksRead) {
748 PrintAndLog("Read Block Failed 2");
749 ul_switch_off_field();
750 return 0;
751 }
752
753 startindex = resp.arg[2];
754 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
755 PrintAndLog("Data exceeded Buffer size!");
756 blocksRead = (sizeof(tag_data) - gotBytes)/8;
757 }
758 // get dumped data from bigbuf
759 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
760 WaitForResponse(CMD_ACK,NULL);
761
762 gotBytes += blocksRead*8;
763 } else { //field is still on - turn it off...
764 ul_switch_off_field();
765 }
766 }
767
768 // add diversified keys to dump
769 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
770 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
771 // print the dump
772 printf("CSN |00| %s |\n", sprint_hex(tag_data, 8));
773 printf("CSN |00| %s |\n", sprint_hex(tag_data, 8));
774 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
775
776 if (filename[0] == 0){
777 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
778 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
779 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
780 }
781
782 // save the dump to .bin file
783 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
784 saveFile(filename, "bin", tag_data, gotBytes);
785 return 1;
786 }
787
788 static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
789 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
790 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
791 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
792 return 0;
793
794 UsbCommand resp;
795
796 Calc_wb_mac(blockno,bldata,div_key,MAC);
797 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
798 memcpy(w.d.asBytes, bldata, 8);
799 memcpy(w.d.asBytes + 8, MAC, 4);
800
801 clearCommandBuffer();
802 SendCommand(&w);
803 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
804 PrintAndLog("Write Command execute timeout");
805 return 0;
806 }
807 uint8_t isOK = resp.arg[0] & 0xff;
808 if (!isOK) {
809 PrintAndLog("Write Block Failed");
810 return 0;
811 }
812 PrintAndLog("Write Block Successful");
813 return 1;
814 }
815
816 int usage_hf_iclass_writeblock(void) {
817 PrintAndLog("Options:");
818 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
819 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
820 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
821 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
822 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
823 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
824 PrintAndLog("Samples:");
825 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
826 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
827 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
828 return 0;
829 }
830
831 int CmdHFiClass_WriteBlock(const char *Cmd) {
832 uint8_t blockno=0;
833 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
834 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
835 uint8_t keyNbr = 0;
836 uint8_t dataLen = 0;
837 char tempStr[50] = {0};
838 bool use_credit_key = false;
839 bool elite = false;
840 bool rawkey= false;
841 bool errors = false;
842 uint8_t cmdp = 0;
843 while(param_getchar(Cmd, cmdp) != 0x00)
844 {
845 switch(param_getchar(Cmd, cmdp))
846 {
847 case 'h':
848 case 'H':
849 return usage_hf_iclass_writeblock();
850 case 'b':
851 case 'B':
852 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
853 PrintAndLog("Block No must include 2 HEX symbols\n");
854 errors = true;
855 }
856 cmdp += 2;
857 break;
858 case 'c':
859 case 'C':
860 use_credit_key = true;
861 cmdp++;
862 break;
863 case 'd':
864 case 'D':
865 if (param_gethex(Cmd, cmdp+1, bldata, 16))
866 {
867 PrintAndLog("KEY must include 16 HEX symbols\n");
868 errors = true;
869 }
870 cmdp += 2;
871 break;
872 case 'e':
873 case 'E':
874 elite = true;
875 cmdp++;
876 break;
877 case 'k':
878 case 'K':
879 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
880 if (dataLen == 16) {
881 errors = param_gethex(tempStr, 0, KEY, dataLen);
882 } else if (dataLen == 1) {
883 keyNbr = param_get8(Cmd, cmdp+1);
884 if (keyNbr < ICLASS_KEYS_MAX) {
885 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
886 } else {
887 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
888 errors = true;
889 }
890 } else {
891 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
892 errors = true;
893 }
894 cmdp += 2;
895 break;
896 case 'r':
897 case 'R':
898 rawkey = true;
899 cmdp++;
900 break;
901 default:
902 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
903 errors = true;
904 break;
905 }
906 if(errors) return usage_hf_iclass_writeblock();
907 }
908
909 if (cmdp < 6) return usage_hf_iclass_writeblock();
910 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
911 ul_switch_off_field();
912 return ans;
913 }
914
915 int usage_hf_iclass_clone(void) {
916 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
917 PrintAndLog("Options:");
918 PrintAndLog(" f <filename>: specify a filename to clone from");
919 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
920 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
921 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
922 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
923 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
924 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
925 PrintAndLog("Samples:");
926 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
927 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
928 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
929 return -1;
930 }
931
932 int CmdHFiClassCloneTag(const char *Cmd) {
933 char filename[FILE_PATH_SIZE] = { 0x00 };
934 char tempStr[50]={0};
935 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
936 uint8_t keyNbr = 0;
937 uint8_t fileNameLen = 0;
938 uint8_t startblock = 0;
939 uint8_t endblock = 0;
940 uint8_t dataLen = 0;
941 bool use_credit_key = false;
942 bool elite = false;
943 bool rawkey = false;
944 bool errors = false;
945 uint8_t cmdp = 0;
946 while(param_getchar(Cmd, cmdp) != 0x00)
947 {
948 switch(param_getchar(Cmd, cmdp))
949 {
950 case 'h':
951 case 'H':
952 return usage_hf_iclass_clone();
953 case 'b':
954 case 'B':
955 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
956 PrintAndLog("Start Block No must include 2 HEX symbols\n");
957 errors = true;
958 }
959 cmdp += 2;
960 break;
961 case 'c':
962 case 'C':
963 use_credit_key = true;
964 cmdp++;
965 break;
966 case 'e':
967 case 'E':
968 elite = true;
969 cmdp++;
970 break;
971 case 'f':
972 case 'F':
973 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
974 if (fileNameLen < 1) {
975 PrintAndLog("No filename found after f");
976 errors = true;
977 }
978 cmdp += 2;
979 break;
980 case 'k':
981 case 'K':
982 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
983 if (dataLen == 16) {
984 errors = param_gethex(tempStr, 0, KEY, dataLen);
985 } else if (dataLen == 1) {
986 keyNbr = param_get8(Cmd, cmdp+1);
987 if (keyNbr < ICLASS_KEYS_MAX) {
988 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
989 } else {
990 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
991 errors = true;
992 }
993 } else {
994 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
995 errors = true;
996 }
997 cmdp += 2;
998 break;
999 case 'l':
1000 case 'L':
1001 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1002 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1003 errors = true;
1004 }
1005 cmdp += 2;
1006 break;
1007 case 'r':
1008 case 'R':
1009 rawkey = true;
1010 cmdp++;
1011 break;
1012 default:
1013 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1014 errors = true;
1015 break;
1016 }
1017 if(errors) return usage_hf_iclass_clone();
1018 }
1019
1020 if (cmdp < 8) return usage_hf_iclass_clone();
1021
1022 FILE *f;
1023
1024 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1025
1026 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1027 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1028 }
1029 // file handling and reading
1030 f = fopen(filename,"rb");
1031 if(!f) {
1032 PrintAndLog("Failed to read from file '%s'", filename);
1033 return 1;
1034 }
1035
1036 if (startblock<5) {
1037 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1038 fclose(f);
1039 return 0;
1040 }
1041 // now read data from the file from block 6 --- 19
1042 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1043 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1044 // else we have to create a share memory
1045 int i;
1046 fseek(f,startblock*8,SEEK_SET);
1047 size_t bytes_read = fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f);
1048 if ( bytes_read == 0){
1049 PrintAndLog("File reading error.");
1050 fclose(f);
1051 return 2;
1052 }
1053
1054 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1055 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1056
1057 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
1058 return 0;
1059
1060 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
1061 uint8_t *ptr;
1062 // calculate all mac for every the block we will write
1063 for (i = startblock; i <= endblock; i++){
1064 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1065 // usb command d start pointer = d + (i - 6) * 12
1066 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1067 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1068 // next one
1069 ptr = w.d.asBytes + (i - startblock) * 12;
1070 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1071 memcpy(ptr + 8,MAC, 4);
1072 }
1073 uint8_t p[12];
1074 for (i = 0; i <= endblock - startblock;i++){
1075 memcpy(p,w.d.asBytes + (i * 12),12);
1076 printf("Block |%02x|",i + startblock);
1077 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1078 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1079 }
1080 UsbCommand resp;
1081 clearCommandBuffer();
1082 SendCommand(&w);
1083 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
1084 PrintAndLog("Command execute timeout");
1085 return 0;
1086 }
1087 return 1;
1088 }
1089
1090 static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose) {
1091 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1092 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1093
1094 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
1095 return 0;
1096
1097 UsbCommand resp;
1098 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
1099 clearCommandBuffer();
1100 SendCommand(&w);
1101 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
1102 PrintAndLog("Command execute timeout");
1103 return 0;
1104 }
1105
1106 uint8_t isOK = resp.arg[0] & 0xff;
1107 if (!isOK) {
1108 PrintAndLog("Read Block Failed");
1109 return 0;
1110 }
1111 //data read is stored in: resp.d.asBytes[0-15]
1112 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1113 return 1;
1114 }
1115
1116 int usage_hf_iclass_readblock(void) {
1117 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
1118 PrintAndLog("Options:");
1119 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1120 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1121 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1122 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1123 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
1124 PrintAndLog("Samples:");
1125 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1126 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1127 PrintAndLog(" hf iclass readblk b 0A k 0");
1128 return 0;
1129 }
1130
1131 int CmdHFiClass_ReadBlock(const char *Cmd) {
1132 uint8_t blockno=0;
1133 uint8_t keyType = 0x88; //debit key
1134 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1135 uint8_t keyNbr = 0;
1136 uint8_t dataLen = 0;
1137 char tempStr[50] = {0};
1138 bool elite = false;
1139 bool rawkey = false;
1140 bool errors = false;
1141 uint8_t cmdp = 0;
1142 while(param_getchar(Cmd, cmdp) != 0x00)
1143 {
1144 switch(param_getchar(Cmd, cmdp))
1145 {
1146 case 'h':
1147 case 'H':
1148 return usage_hf_iclass_readblock();
1149 case 'b':
1150 case 'B':
1151 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1152 PrintAndLog("Block No must include 2 HEX symbols\n");
1153 errors = true;
1154 }
1155 cmdp += 2;
1156 break;
1157 case 'c':
1158 case 'C':
1159 keyType = 0x18;
1160 cmdp++;
1161 break;
1162 case 'e':
1163 case 'E':
1164 elite = true;
1165 cmdp++;
1166 break;
1167 case 'k':
1168 case 'K':
1169 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1170 if (dataLen == 16) {
1171 errors = param_gethex(tempStr, 0, KEY, dataLen);
1172 } else if (dataLen == 1) {
1173 keyNbr = param_get8(Cmd, cmdp+1);
1174 if (keyNbr < ICLASS_KEYS_MAX) {
1175 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1176 } else {
1177 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1178 errors = true;
1179 }
1180 } else {
1181 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1182 errors = true;
1183 }
1184 cmdp += 2;
1185 break;
1186 case 'r':
1187 case 'R':
1188 rawkey = true;
1189 cmdp++;
1190 break;
1191 default:
1192 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1193 errors = true;
1194 break;
1195 }
1196 if(errors) return usage_hf_iclass_readblock();
1197 }
1198
1199 if (cmdp < 4) return usage_hf_iclass_readblock();
1200
1201 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true);
1202 }
1203
1204 int CmdHFiClass_loclass(const char *Cmd) {
1205 char opt = param_getchar(Cmd, 0);
1206
1207 if (strlen(Cmd)<1 || opt == 'h') {
1208 PrintAndLog("Usage: hf iclass loclass [options]");
1209 PrintAndLog("Options:");
1210 PrintAndLog("h Show this help");
1211 PrintAndLog("t Perform self-test");
1212 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1213 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1214 PrintAndLog(" malicious CSNs, and their protocol responses");
1215 PrintAndLog(" The binary format of the file is expected to be as follows: ");
1216 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1217 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1218 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1219 PrintAndLog(" ... totalling N*24 bytes");
1220 return 0;
1221 }
1222 char fileName[255] = {0};
1223 if(opt == 'f') {
1224 if(param_getstr(Cmd, 1, fileName) > 0) {
1225 return bruteforceFileNoKeys(fileName);
1226 } else {
1227 PrintAndLog("You must specify a filename");
1228 // no return?
1229 }
1230 }
1231 else if(opt == 't') {
1232 int errors = testCipherUtils();
1233 errors += testMAC();
1234 errors += doKeyTests(0);
1235 errors += testElite();
1236 if(errors) prnlog("OBS! There were errors!!!");
1237 return errors;
1238 }
1239 return 0;
1240 }
1241
1242 void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1243 uint8_t blockdata[8];
1244 uint8_t mem_config;
1245 memcpy(&mem_config, iclass_dump + 13,1);
1246 uint8_t maxmemcount;
1247 uint8_t filemaxblock = filesize / 8;
1248
1249 if (mem_config & 0x80)
1250 maxmemcount = 255;
1251 else
1252 maxmemcount = 31;
1253 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1254
1255 if (startblock == 0)
1256 startblock = 6;
1257
1258 if ((endblock > maxmemcount) || (endblock == 0))
1259 endblock = maxmemcount;
1260
1261 if (endblock > filemaxblock)
1262 endblock = filemaxblock;
1263
1264 int i = startblock;
1265 int j;
1266 while (i <= endblock){
1267 printf("Block |%02X| ",i);
1268 memcpy(blockdata, iclass_dump + (i * 8), 8);
1269 for (j = 0;j < 8;j++)
1270 printf("%02X ", blockdata[j]);
1271 printf("|\n");
1272 i++;
1273 }
1274 }
1275
1276 int usage_hf_iclass_readtagfile() {
1277 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1278 return 1;
1279 }
1280
1281 int CmdHFiClassReadTagFile(const char *Cmd) {
1282 int startblock = 0;
1283 int endblock = 0;
1284 char tempnum[5];
1285 FILE *f;
1286 char filename[FILE_PATH_SIZE];
1287 if (param_getstr(Cmd, 0, filename) < 1)
1288 return usage_hf_iclass_readtagfile();
1289
1290 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1291 startblock = 0;
1292 else
1293 sscanf(tempnum,"%d",&startblock);
1294
1295 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1296 endblock = 0;
1297 else
1298 sscanf(tempnum,"%d",&endblock);
1299
1300 // file handling and reading
1301 f = fopen(filename,"rb");
1302 if(!f) {
1303 PrintAndLog("Failed to read from file '%s'", filename);
1304 return 1;
1305 }
1306 fseek(f, 0, SEEK_END);
1307 long fsize = ftell(f);
1308 fseek(f, 0, SEEK_SET);
1309
1310 if ( fsize < 0 ) {
1311 PrintAndLog("Error, when getting filesize");
1312 fclose(f);
1313 return 1;
1314 }
1315
1316 uint8_t *dump = malloc(fsize);
1317 size_t bytes_read = fread(dump, 1, fsize, f);
1318 fclose(f);
1319
1320 uint8_t *csn = dump;
1321 printf("CSN [00] | %s |\n", sprint_hex(csn, 8) );
1322 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1323 free(dump);
1324 return 0;
1325 }
1326
1327 /*
1328 uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1329 uint64_t new_div = 0x00;
1330 new_div ^= sdiv;
1331 new_div ^= hdiv;
1332 return new_div;
1333 }
1334
1335 uint64_t hexarray_to_uint64(uint8_t *key) {
1336 char temp[17];
1337 uint64_t uint_key;
1338 for (int i = 0;i < 8;i++)
1339 sprintf(&temp[(i *2)],"%02X",key[i]);
1340 temp[16] = '\0';
1341 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1342 return 0;
1343 return uint_key;
1344 }
1345 */
1346 void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1347 uint8_t keytable[128] = {0};
1348 uint8_t key_index[8] = {0};
1349 if (elite) {
1350 uint8_t key_sel[8] = { 0 };
1351 uint8_t key_sel_p[8] = { 0 };
1352 hash2(KEY, keytable);
1353 hash1(CSN, key_index);
1354 for(uint8_t i = 0; i < 8 ; i++)
1355 key_sel[i] = keytable[key_index[i]] & 0xFF;
1356
1357 //Permute from iclass format to standard format
1358 permutekey_rev(key_sel, key_sel_p);
1359 diversifyKey(CSN, key_sel_p, div_key);
1360 } else {
1361 diversifyKey(CSN, KEY, div_key);
1362 }
1363 }
1364
1365 //when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1366 //calculate and return xor_div_key (ready for a key write command)
1367 //print all div_keys if verbose
1368 static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1369 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1370 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1371 //get old div key
1372 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1373 //get new div key
1374 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1375
1376 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1377 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1378 }
1379 if (verbose) {
1380 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1381 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1382 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1383 }
1384 }
1385
1386 int usage_hf_iclass_calc_newkey(void) {
1387 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1388 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1389 PrintAndLog(" Options:");
1390 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1391 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1392 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1393 PrintAndLog(" e : specify new key as elite calc");
1394 PrintAndLog(" ee : specify old and new key as elite calc");
1395 PrintAndLog("Samples:");
1396 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1397 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1398 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1399 PrintAndLog("NOTE: * = required\n");
1400
1401 return 1;
1402 }
1403
1404 int CmdHFiClassCalcNewKey(const char *Cmd) {
1405 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1406 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1407 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1408 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1409 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1410 uint8_t keyNbr = 0;
1411 uint8_t dataLen = 0;
1412 char tempStr[50] = {0};
1413 bool givenCSN = false;
1414 bool oldElite = false;
1415 bool elite = false;
1416 bool errors = false;
1417 uint8_t cmdp = 0;
1418 while(param_getchar(Cmd, cmdp) != 0x00)
1419 {
1420 switch(param_getchar(Cmd, cmdp))
1421 {
1422 case 'h':
1423 case 'H':
1424 return usage_hf_iclass_calc_newkey();
1425 case 'e':
1426 case 'E':
1427 dataLen = param_getstr(Cmd, cmdp, tempStr);
1428 if (dataLen==2)
1429 oldElite = true;
1430 elite = true;
1431 cmdp++;
1432 break;
1433 case 'n':
1434 case 'N':
1435 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1436 if (dataLen == 16) {
1437 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1438 } else if (dataLen == 1) {
1439 keyNbr = param_get8(Cmd, cmdp+1);
1440 if (keyNbr < ICLASS_KEYS_MAX) {
1441 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1442 } else {
1443 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1444 errors = true;
1445 }
1446 } else {
1447 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1448 errors = true;
1449 }
1450 cmdp += 2;
1451 break;
1452 case 'o':
1453 case 'O':
1454 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1455 if (dataLen == 16) {
1456 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1457 } else if (dataLen == 1) {
1458 keyNbr = param_get8(Cmd, cmdp+1);
1459 if (keyNbr < ICLASS_KEYS_MAX) {
1460 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1461 } else {
1462 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1463 errors = true;
1464 }
1465 } else {
1466 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1467 errors = true;
1468 }
1469 cmdp += 2;
1470 break;
1471 case 's':
1472 case 'S':
1473 givenCSN = true;
1474 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1475 return usage_hf_iclass_calc_newkey();
1476 cmdp += 2;
1477 break;
1478 default:
1479 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1480 errors = true;
1481 break;
1482 }
1483 if(errors) return usage_hf_iclass_calc_newkey();
1484 }
1485
1486 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1487
1488 if (!givenCSN)
1489 if (!select_only(CSN, CCNR, false, true))
1490 return 0;
1491
1492 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1493 return 0;
1494 }
1495
1496 static int loadKeys(char *filename) {
1497 FILE *f;
1498 f = fopen(filename,"rb");
1499 if(!f) {
1500 PrintAndLog("Failed to read from file '%s'", filename);
1501 return 0;
1502 }
1503 fseek(f, 0, SEEK_END);
1504 long fsize = ftell(f);
1505 fseek(f, 0, SEEK_SET);
1506
1507 if ( fsize < 0 ) {
1508 PrintAndLog("Error, when getting filesize");
1509 fclose(f);
1510 return 1;
1511 }
1512
1513 uint8_t *dump = malloc(fsize);
1514
1515 size_t bytes_read = fread(dump, 1, fsize, f);
1516 fclose(f);
1517 if (bytes_read > ICLASS_KEYS_MAX * 8){
1518 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1519 free(dump);
1520 return 0;
1521 }
1522 uint8_t i = 0;
1523 for (; i < bytes_read/8; i++){
1524 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1525 }
1526 free(dump);
1527 PrintAndLog("%u keys loaded", i);
1528 return 1;
1529 }
1530
1531 static int saveKeys(char *filename) {
1532 FILE *f;
1533 f = fopen(filename,"wb");
1534 if (f == NULL) {
1535 printf("error opening file %s\n",filename);
1536 return 0;
1537 }
1538 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1539 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1540 PrintAndLog("save key failed to write to file: %s", filename);
1541 break;
1542 }
1543 }
1544 fclose(f);
1545 return 0;
1546 }
1547
1548 static int printKeys(void) {
1549 PrintAndLog("");
1550 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1551 PrintAndLog("%u: %s", i, sprint_hex(iClass_Key_Table[i],8));
1552 }
1553 PrintAndLog("");
1554 return 0;
1555 }
1556
1557 int usage_hf_iclass_managekeys(void) {
1558 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1559 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1560 PrintAndLog(" Options:");
1561 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1562 PrintAndLog(" k <key> : set a key in memory");
1563 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1564 PrintAndLog(" s : save keys in memory to file specified by filename");
1565 PrintAndLog(" l : load keys to memory from file specified by filename");
1566 PrintAndLog(" p : print keys loaded into memory\n");
1567 PrintAndLog("Samples:");
1568 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1569 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1570 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1571 PrintAndLog(" print keys : hf iclass managekeys p\n");
1572 return 0;
1573 }
1574
1575 int CmdHFiClassManageKeys(const char *Cmd) {
1576 uint8_t keyNbr = 0;
1577 uint8_t dataLen = 0;
1578 uint8_t KEY[8] = {0};
1579 char filename[FILE_PATH_SIZE];
1580 uint8_t fileNameLen = 0;
1581 bool errors = false;
1582 uint8_t operation = 0;
1583 char tempStr[20];
1584 uint8_t cmdp = 0;
1585
1586 while(param_getchar(Cmd, cmdp) != 0x00)
1587 {
1588 switch(param_getchar(Cmd, cmdp))
1589 {
1590 case 'h':
1591 case 'H':
1592 return usage_hf_iclass_managekeys();
1593 case 'f':
1594 case 'F':
1595 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1596 if (fileNameLen < 1) {
1597 PrintAndLog("No filename found after f");
1598 errors = true;
1599 }
1600 cmdp += 2;
1601 break;
1602 case 'n':
1603 case 'N':
1604 keyNbr = param_get8(Cmd, cmdp+1);
1605 if (keyNbr == 0) {
1606 PrintAndLog("Wrong block number");
1607 errors = true;
1608 }
1609 cmdp += 2;
1610 break;
1611 case 'k':
1612 case 'K':
1613 operation += 3; //set key
1614 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1615 if (dataLen == 16) { //ul-c or ev1/ntag key length
1616 errors = param_gethex(tempStr, 0, KEY, dataLen);
1617 } else {
1618 PrintAndLog("\nERROR: Key is incorrect length\n");
1619 errors = true;
1620 }
1621 cmdp += 2;
1622 break;
1623 case 'p':
1624 case 'P':
1625 operation += 4; //print keys in memory
1626 cmdp++;
1627 break;
1628 case 'l':
1629 case 'L':
1630 operation += 5; //load keys from file
1631 cmdp++;
1632 break;
1633 case 's':
1634 case 'S':
1635 operation += 6; //save keys to file
1636 cmdp++;
1637 break;
1638 default:
1639 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1640 errors = true;
1641 break;
1642 }
1643 if(errors) return usage_hf_iclass_managekeys();
1644 }
1645 if (operation == 0){
1646 PrintAndLog("no operation specified (load, save, or print)\n");
1647 return usage_hf_iclass_managekeys();
1648 }
1649 if (operation > 6){
1650 PrintAndLog("Too many operations specified\n");
1651 return usage_hf_iclass_managekeys();
1652 }
1653 if (operation > 4 && fileNameLen == 0){
1654 PrintAndLog("You must enter a filename when loading or saving\n");
1655 return usage_hf_iclass_managekeys();
1656 }
1657
1658 switch (operation){
1659 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1660 case 4: return printKeys();
1661 case 5: return loadKeys(filename);
1662 case 6: return saveKeys(filename);
1663 break;
1664 }
1665 return 0;
1666 }
1667
1668 static command_t CommandTable[] = {
1669 {"help", CmdHelp, 1, "This help"},
1670 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1671 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1672 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1673 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1674 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1675 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1676 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1677 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1678 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1679 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1680 {"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
1681 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1682 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1683 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1684 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1685 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
1686 {NULL, NULL, 0, NULL}
1687 };
1688
1689 int CmdHFiClass(const char *Cmd) {
1690 clearCommandBuffer();
1691 CmdsParse(CommandTable, Cmd);
1692 return 0;
1693 }
1694
1695 int CmdHelp(const char *Cmd) {
1696 CmdsHelp(CommandTable);
1697 return 0;
1698 }
Proxmark3 GIT tracking
Impressum, Datenschutz