]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhfmfdes.c
FIX: lf hitag : Mea culpa, simulation should not have reader_field on. thanks to...
[proxmark3-svn] / client / cmdhfmfdes.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2014 Iceman
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // High frequency MIFARE Desfire commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <stdlib.h>
13 #include <string.h>
14 #include <ctype.h>
15 #include "loclass/des.h"
16 #include "cmdmain.h"
17 #include "proxmark3.h"
18 #include "../include/common.h"
19 #include "../include/mifare.h"
20 #include "../common/iso14443crc.h"
21 #include "data.h"
22 #include "ui.h"
23 #include "cmdparser.h"
24 #include "util.h"
25 #include "cmdhfmfdes.h"
26 #include "cmdhf14a.h"
27
28
29 uint8_t CMDPOS = 0;
30 uint8_t LENPOS = 1;
31
32 uint8_t key_zero_data[16] = { 0x00 };
33 uint8_t key_ones_data[16] = { 0x01 };
34 uint8_t key_defa_data[16] = { 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f };
35 uint8_t key_picc_data[16] = { 0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47,0x48,0x49,0x4a,0x4b,0x4c,0x4d,0x4e,0x4f };
36
37 static int CmdHelp(const char *Cmd);
38
39 int CmdHF14ADesWb(const char *Cmd)
40 {
41 /* uint8_t blockNo = 0;
42 uint8_t keyType = 0;
43 uint8_t key[6] = {0, 0, 0, 0, 0, 0};
44 uint8_t bldata[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
45
46 char cmdp = 0x00;
47
48 if (strlen(Cmd)<3) {
49 PrintAndLog("Usage: hf mf wrbl <block number> <key A/B> <key (12 hex symbols)> <block data (32 hex symbols)>");
50 PrintAndLog(" sample: hf mf wrbl 0 A FFFFFFFFFFFF 000102030405060708090A0B0C0D0E0F");
51 return 0;
52 }
53
54 blockNo = param_get8(Cmd, 0);
55 cmdp = param_getchar(Cmd, 1);
56 if (cmdp == 0x00) {
57 PrintAndLog("Key type must be A or B");
58 return 1;
59 }
60 if (cmdp != 'A' && cmdp != 'a') keyType = 1;
61 if (param_gethex(Cmd, 2, key, 12)) {
62 PrintAndLog("Key must include 12 HEX symbols");
63 return 1;
64 }
65 if (param_gethex(Cmd, 3, bldata, 32)) {
66 PrintAndLog("Block data must include 32 HEX symbols");
67 return 1;
68 }
69 PrintAndLog("--block no:%02x key type:%02x key:%s", blockNo, keyType, sprint_hex(key, 6));
70 PrintAndLog("--data: %s", sprint_hex(bldata, 16));
71
72 UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};
73 memcpy(c.d.asBytes, key, 6);
74 memcpy(c.d.asBytes + 10, bldata, 16);
75 SendCommand(&c);
76
77 UsbCommand resp;
78 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
79 uint8_t isOK = resp.arg[0] & 0xff;
80 PrintAndLog("isOk:%02x", isOK);
81 } else {
82 PrintAndLog("Command execute timeout");
83 }
84 */
85 return 0;
86 }
87
88 int CmdHF14ADesRb(const char *Cmd)
89 {
90 // uint8_t blockNo = 0;
91 // uint8_t keyType = 0;
92 // uint8_t key[6] = {0, 0, 0, 0, 0, 0};
93
94 // char cmdp = 0x00;
95
96
97 // if (strlen(Cmd)<3) {
98 // PrintAndLog("Usage: hf mf rdbl <block number> <key A/B> <key (12 hex symbols)>");
99 // PrintAndLog(" sample: hf mf rdbl 0 A FFFFFFFFFFFF ");
100 // return 0;
101 // }
102
103 // blockNo = param_get8(Cmd, 0);
104 // cmdp = param_getchar(Cmd, 1);
105 // if (cmdp == 0x00) {
106 // PrintAndLog("Key type must be A or B");
107 // return 1;
108 // }
109 // if (cmdp != 'A' && cmdp != 'a') keyType = 1;
110 // if (param_gethex(Cmd, 2, key, 12)) {
111 // PrintAndLog("Key must include 12 HEX symbols");
112 // return 1;
113 // }
114 // PrintAndLog("--block no:%02x key type:%02x key:%s ", blockNo, keyType, sprint_hex(key, 6));
115
116 // UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};
117 // memcpy(c.d.asBytes, key, 6);
118 // SendCommand(&c);
119
120 // UsbCommand resp;
121 // if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
122 // uint8_t isOK = resp.arg[0] & 0xff;
123 // uint8_t * data = resp.d.asBytes;
124
125 // if (isOK)
126 // PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 16));
127 // else
128 // PrintAndLog("isOk:%02x", isOK);
129 // } else {
130 // PrintAndLog("Command execute timeout");
131 // }
132
133 return 0;
134 }
135
136 int CmdHF14ADesInfo(const char *Cmd){
137
138 UsbCommand c = {CMD_MIFARE_DESFIRE_INFO};
139 SendCommand(&c);
140 UsbCommand resp;
141
142 if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500) ) {
143 PrintAndLog("Command execute timeout");
144 return 0;
145 }
146 uint8_t isOK = resp.arg[0] & 0xff;
147 if ( !isOK ){
148 PrintAndLog("Command unsuccessful");
149 return 0;
150 }
151 PrintAndLog("");
152 PrintAndLog("-- Desfire Information --------------------------------------");
153 PrintAndLog("-------------------------------------------------------------");
154 PrintAndLog(" UID : %s",sprint_hex(resp.d.asBytes, 7));
155 PrintAndLog(" Batch number : %s",sprint_hex(resp.d.asBytes+28,5));
156 PrintAndLog(" Production date : week %02x, 20%02x",resp.d.asBytes[33], resp.d.asBytes[34]);
157 PrintAndLog(" -----------------------------------------------------------");
158 PrintAndLog(" Hardware Information");
159 PrintAndLog(" Vendor Id : %s", getTagInfo(resp.d.asBytes[7]));
160 PrintAndLog(" Type : 0x%02X",resp.d.asBytes[8]);
161 PrintAndLog(" Subtype : 0x%02X",resp.d.asBytes[9]);
162 PrintAndLog(" Version : %s",GetVersionStr(resp.d.asBytes[10], resp.d.asBytes[11]) );
163 PrintAndLog(" Storage size : %s",GetCardSizeStr(resp.d.asBytes[12]));
164 PrintAndLog(" Protocol : %s",GetProtocolStr(resp.d.asBytes[13]));
165 PrintAndLog(" -----------------------------------------------------------");
166 PrintAndLog(" Software Information");
167 PrintAndLog(" Vendor Id : %s", getTagInfo(resp.d.asBytes[14]));
168 PrintAndLog(" Type : 0x%02X",resp.d.asBytes[15]);
169 PrintAndLog(" Subtype : 0x%02X",resp.d.asBytes[16]);
170 PrintAndLog(" Version : %d.%d",resp.d.asBytes[17], resp.d.asBytes[18]);
171 PrintAndLog(" storage size : %s", GetCardSizeStr(resp.d.asBytes[19]));
172 PrintAndLog(" Protocol : %s", GetProtocolStr(resp.d.asBytes[20]));
173 PrintAndLog("-------------------------------------------------------------");
174
175 // Master Key settings
176 GetKeySettings(NULL);
177
178 // Free memory on card
179 c.cmd = CMD_MIFARE_DESFIRE;
180 c.arg[0] = (INIT | DISCONNECT);
181 c.arg[1] = 0x01;
182 c.d.asBytes[0] = GET_FREE_MEMORY;
183 SendCommand(&c);
184 if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
185 return 0;
186 }
187
188 uint8_t tmp[3];
189 memcpy(tmp, resp.d.asBytes+3,3);
190
191 PrintAndLog(" Available free memory on card : %d bytes", le24toh( tmp ));
192 PrintAndLog("-------------------------------------------------------------");
193
194 /*
195 Card Master key (CMK) 0x00 AID = 00 00 00 (card level)
196 Application Master Key (AMK) 0x00 AID != 00 00 00
197 Application keys (APK) 0x01-0x0D
198 Application free 0x0E
199 Application never 0x0F
200
201 ACCESS RIGHTS:
202 keys 0,1,2,3 C
203 keys 4,5,6,7 RW
204 keys 8,9,10,11 W
205 keys 12,13,14,15 R
206
207 */
208
209 return 1;
210 }
211
212 /*
213 The 7 MSBits (= n) code the storage size itself based on 2^n,
214 the LSBit is set to '0' if the size is exactly 2^n
215 and set to '1' if the storage size is between 2^n and 2^(n+1).
216 For this version of DESFire the 7 MSBits are set to 0x0C (2^12 = 4096) and the LSBit is '0'.
217 */
218 char * GetCardSizeStr( uint8_t fsize ){
219
220 static char buf[30] = {0x00};
221 char *retStr = buf;
222
223 uint16_t usize = 1 << ((fsize >>1) + 1);
224 uint16_t lsize = 1 << (fsize >>1);
225
226 // is LSB set?
227 if ( fsize & 1 )
228 sprintf(retStr, "0x%02X (%d - %d bytes)",fsize, usize, lsize);
229 else
230 sprintf(retStr, "0x%02X (%d bytes)", fsize, lsize);
231 return buf;
232 }
233
234 char * GetProtocolStr(uint8_t id){
235
236 static char buf[30] = {0x00};
237 char *retStr = buf;
238
239 if ( id == 0x05)
240 sprintf(retStr,"0x%02X (ISO 14443-3, 14443-4)", id);
241 else
242 sprintf(retStr,"0x%02X (Unknown)", id);
243 return buf;
244 }
245
246 char * GetVersionStr(uint8_t major, uint8_t minor){
247
248 static char buf[30] = {0x00};
249 char *retStr = buf;
250
251 if ( major == 0x00)
252 sprintf(retStr,"%d.%d (Desfire MF3ICD40)", major, minor);
253 else if ( major == 0x01 && minor == 0x00)
254 sprintf(retStr,"%d.%d (Desfire EV1)", major, minor);
255 else if ( major == 0x12 && minor == 0x00)
256 sprintf(retStr,"%d.%d (Desfire EV2)", major, minor);
257 else
258 sprintf(retStr,"%d.%d (Unknown)", major, minor);
259 return buf;
260 }
261
262 void GetKeySettings( uint8_t *aid){
263
264 char messStr[512] = {0x00};
265 char *str = messStr;
266 uint8_t isOK = 0;
267 uint32_t options = NONE;
268 UsbCommand c;
269 UsbCommand resp;
270
271 //memset(messStr, 0x00, 512);
272
273 c.cmd = CMD_MIFARE_DESFIRE;
274
275 if ( aid == NULL ){
276 PrintAndLog(" CMK - PICC, Card Master Key settings ");
277 PrintAndLog("");
278 c.arg[CMDPOS] = (INIT | DISCONNECT);
279 c.arg[LENPOS] = 0x01;
280 c.d.asBytes[0] = GET_KEY_SETTINGS; // 0x45
281 SendCommand(&c);
282 if ( !WaitForResponseTimeout(CMD_ACK,&resp,1000) ) {return;}
283 isOK = resp.arg[0] & 0xff;
284 if ( !isOK ){
285 PrintAndLog(" Can't select master application");
286 return;
287 }
288
289 str = (resp.d.asBytes[3] & (1 << 3 )) ? "YES":"NO";
290 PrintAndLog(" [0x08] Configuration changeable : %s", str);
291 str = (resp.d.asBytes[3] & (1 << 2 )) ? "NO":"YES";
292 PrintAndLog(" [0x04] CMK required for create/delete : %s",str);
293 str = (resp.d.asBytes[3] & (1 << 1 )) ? "NO":"YES";
294 PrintAndLog(" [0x02] Directory list access with CMK : %s",str);
295 str = (resp.d.asBytes[3] & (1 << 0 )) ? "YES" : "NO";
296 PrintAndLog(" [0x01] CMK is changeable : %s", str);
297
298 c.arg[LENPOS] = 0x02; //LEN
299 c.d.asBytes[0] = GET_KEY_VERSION; //0x64
300 c.d.asBytes[1] = 0x00;
301 SendCommand(&c);
302 if ( !WaitForResponseTimeout(CMD_ACK,&resp,1000) ) {
303 return;
304 }
305 isOK = resp.arg[0] & 0xff;
306 if ( !isOK ){
307 PrintAndLog(" Can't read key-version");
308 return;
309 }
310 PrintAndLog("");
311 PrintAndLog(" Max number of keys : %d", resp.d.asBytes[4]);
312 PrintAndLog(" Master key Version : %d (0x%02x)", resp.d.asBytes[3], resp.d.asBytes[3]);
313 PrintAndLog(" ----------------------------------------------------------");
314
315 c.arg[LENPOS] = 0x02; //LEN
316 c.d.asBytes[0] = AUTHENTICATE; //0x0A
317 c.d.asBytes[1] = 0x00; // KEY 0
318 SendCommand(&c);
319 if ( !WaitForResponseTimeout(CMD_ACK,&resp,1000) ) {return;}
320 isOK = resp.d.asBytes[2] & 0xff;
321 PrintAndLog(" [0x0A] Authenticate : %s", ( isOK==0xAE ) ? "NO":"YES");
322
323 c.d.asBytes[0] = AUTHENTICATE_ISO; //0x1A
324 SendCommand(&c);
325 if ( !WaitForResponseTimeout(CMD_ACK,&resp,1000) ) {return;}
326 isOK = resp.d.asBytes[2] & 0xff;
327 PrintAndLog(" [0x1A] Authenticate ISO : %s", ( isOK==0xAE ) ? "NO":"YES");
328
329 c.d.asBytes[0] = AUTHENTICATE_AES; //0xAA
330 SendCommand(&c);
331 if ( !WaitForResponseTimeout(CMD_ACK,&resp,1000) ) {return;}
332 isOK = resp.d.asBytes[2] & 0xff;
333 PrintAndLog(" [0xAA] Authenticate AES : %s", ( isOK==0xAE ) ? "NO":"YES");
334 PrintAndLog("");
335 PrintAndLog(" ----------------------------------------------------------");
336
337 } else {
338 PrintAndLog(" AMK - Application Master Key settings");
339
340 // SELECT AID
341 c.arg[0] = (INIT | CLEARTRACE);
342 c.arg[LENPOS] = 0x04;
343 c.d.asBytes[0] = SELECT_APPLICATION; // 0x5a
344 memcpy(c.d.asBytes+1, aid, 3);
345 SendCommand(&c);
346
347 if (!WaitForResponseTimeout(CMD_ACK,&resp,1500) ) {
348 PrintAndLog(" Timed-out");
349 return;
350 }
351 isOK = resp.arg[0] & 0xff;
352 if ( !isOK ){
353 PrintAndLog(" Can't select AID: %s",sprint_hex(aid,3));
354 return;
355 }
356
357 // KEY SETTINGS
358 options = NONE;
359 c.arg[0] = options;
360 c.arg[LENPOS] = 0x01;
361 c.d.asBytes[0] = GET_KEY_SETTINGS; // 0x45
362 SendCommand(&c);
363 if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500) ) {
364 return;
365 }
366 isOK = resp.arg[0] & 0xff;
367 if ( !isOK ){
368 PrintAndLog(" Can't read Application Master key settings");
369 } else {
370 // Access rights.
371 uint8_t rights = (resp.d.asBytes[3] >> 4 & 0xff);
372 switch (rights){
373 case 0x00:
374 str = "AMK authentication is necessary to change any key (default)";
375 break;
376 case 0x0e:
377 str = "Authentication with the key to be changed (same KeyNo) is necessary to change a key";
378 break;
379 case 0x0f:
380 str = "All keys (except AMK,see Bit0) within this application are frozen";
381 break;
382 default:
383 str = "Authentication with the specified key is necessary to change any ley. A change key and a PICC master key (CMK) can only be changed after authentication with the master key. For keys other then the master or change key, an authentication with the same key is needed.";
384 break;
385 }
386 PrintAndLog("Changekey Access rights");
387 PrintAndLog("-- %s",str);
388 PrintAndLog("");
389 // same as CMK
390 str = (resp.d.asBytes[3] & (1 << 3 )) ? "YES":"NO";
391 PrintAndLog(" 0x08 Configuration changeable : %s", str);
392 str = (resp.d.asBytes[3] & (1 << 2 )) ? "NO":"YES";
393 PrintAndLog(" 0x04 AMK required for create/delete : %s",str);
394 str = (resp.d.asBytes[3] & (1 << 1 )) ? "NO":"YES";
395 PrintAndLog(" 0x02 Directory list access with AMK : %s",str);
396 str = (resp.d.asBytes[3] & (1 << 0 )) ? "YES" : "NO";
397 PrintAndLog(" 0x01 AMK is changeable : %s", str);
398 }
399
400 // KEY VERSION - AMK
401 c.arg[0] = NONE;
402 c.arg[LENPOS] = 0x02;
403 c.d.asBytes[0] = GET_KEY_VERSION; //0x64
404 c.d.asBytes[1] = 0x00;
405 SendCommand(&c);
406 if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500) ) {
407 PrintAndLog(" Timed-out");
408 return;
409 }
410
411 int numOfKeys;
412
413 isOK = resp.arg[0] & 0xff;
414 if ( !isOK ){
415 PrintAndLog(" Can't read Application Master key version. Trying all keys");
416 numOfKeys = MAX_NUM_KEYS;
417 }
418 else{
419 numOfKeys = resp.d.asBytes[4];
420 PrintAndLog("");
421 PrintAndLog(" Max number of keys : %d", numOfKeys );
422 PrintAndLog(" Application Master key Version : %d (0x%02x)", resp.d.asBytes[3], resp.d.asBytes[3]);
423 PrintAndLog("-------------------------------------------------------------");
424 }
425
426 // LOOP over numOfKeys that we got before.
427 // From 0x01 to numOfKeys. We already got 0x00. (AMK)
428 for(int i=0x01; i<=0x0f; ++i){
429
430 }
431
432
433 }
434 }
435
436 int CmdHF14ADesEnumApplications(const char *Cmd){
437
438 uint8_t isOK = 0x00;
439 uint8_t aid[3];
440 uint32_t options = (INIT | DISCONNECT);
441
442 UsbCommand c = {CMD_MIFARE_DESFIRE, {options , 0x01 }};
443 c.d.asBytes[0] = GET_APPLICATION_IDS; //0x6a
444
445 SendCommand(&c);
446 UsbCommand resp;
447
448 if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500) ) {
449 return 0;
450 }
451 isOK = resp.arg[0] & 0xff;
452 if ( !isOK ){
453 PrintAndLog("Command unsuccessful");
454 return 0;
455 }
456 PrintAndLog("");
457 PrintAndLog("-- Desfire Enumerate Applications ---------------------------");
458 PrintAndLog("-------------------------------------------------------------");
459
460 UsbCommand respAid;
461 UsbCommand respFiles;
462
463 uint8_t num = 0;
464 int max = resp.arg[1] -3 -2;
465
466 for(int i=3; i<=max; i+=3){
467 PrintAndLog(" Aid %d : %02X %02X %02X ",num ,resp.d.asBytes[i],resp.d.asBytes[i+1],resp.d.asBytes[i+2]);
468 num++;
469
470 aid[0] = resp.d.asBytes[i];
471 aid[1] = resp.d.asBytes[i+1];
472 aid[2] = resp.d.asBytes[i+2];
473 GetKeySettings(aid);
474
475 // Select Application
476 c.arg[CMDPOS] = INIT;
477 c.arg[LENPOS] = 0x04;
478 c.d.asBytes[0] = SELECT_APPLICATION; // 0x5a
479 c.d.asBytes[1] = resp.d.asBytes[i];
480 c.d.asBytes[2] = resp.d.asBytes[i+1];
481 c.d.asBytes[3] = resp.d.asBytes[i+2];
482 SendCommand(&c);
483
484 if (!WaitForResponseTimeout(CMD_ACK,&respAid,1500) ) {
485 PrintAndLog(" Timed-out");
486 continue;
487 }
488 isOK = respAid.d.asBytes[2] & 0xff;
489 if ( isOK != 0x00 ){
490 PrintAndLog(" Can't select AID: %s",sprint_hex(resp.d.asBytes+i,3));
491 continue;
492 }
493
494 // Get File IDs
495 c.arg[CMDPOS] = NONE;
496 c.arg[LENPOS] = 0x01;
497 c.d.asBytes[0] = GET_FILE_IDS; // 0x6f
498 SendCommand(&c);
499
500 if ( !WaitForResponseTimeout(CMD_ACK,&respFiles,1500) ) {
501 PrintAndLog(" Timed-out");
502 continue;
503 } else {
504 isOK = respFiles.d.asBytes[2] & 0xff;
505 if ( !isOK ){
506 PrintAndLog(" Can't get file ids ");
507 } else {
508 int respfileLen = resp.arg[1]-3-2;
509 for (int j=0; j< respfileLen; ++j){
510 PrintAndLog(" Fileid %d :", resp.d.asBytes[j+3]);
511 }
512 }
513 }
514
515 // Get ISO File IDs
516 c.arg[CMDPOS] = DISCONNECT;
517 c.arg[LENPOS] = 0x01;
518 c.d.asBytes[0] = GET_ISOFILE_IDS; // 0x61
519 SendCommand(&c);
520
521 if ( !WaitForResponseTimeout(CMD_ACK,&respFiles,1500) ) {
522 PrintAndLog(" Timed-out");
523 continue;
524 } else {
525 isOK = respFiles.d.asBytes[2] & 0xff;
526 if ( !isOK ){
527 PrintAndLog(" Can't get ISO file ids ");
528 } else {
529 int respfileLen = resp.arg[1]-3-2;
530 for (int j=0; j< respfileLen; ++j){
531 PrintAndLog(" ISO Fileid %d :", resp.d.asBytes[j+3]);
532 }
533 }
534 }
535
536
537 }
538 PrintAndLog("-------------------------------------------------------------");
539
540
541 return 1;
542 }
543
544 // MIAFRE DesFire Authentication
545 //
546 #define BUFSIZE 256
547 int CmdHF14ADesAuth(const char *Cmd){
548
549 // NR DESC KEYLENGHT
550 // ------------------------
551 // 1 = DES 8
552 // 2 = 3DES 16
553 // 3 = 3K 3DES 24
554 // 4 = AES 16
555
556 uint8_t keylength = 8;
557 unsigned char key[24];
558
559 if (strlen(Cmd)<3) {
560 PrintAndLog("Usage: hf mfdes auth <1|2|3> <1|2|3|4> <keyno> <key> ");
561 PrintAndLog(" Auth modes");
562 PrintAndLog(" 1 = normal, 2 = iso, 3 = aes");
563 PrintAndLog(" Crypto");
564 PrintAndLog(" 1 = DES 2 = 3DES 3 = 3K3DES 4 = AES");
565 PrintAndLog("");
566 PrintAndLog(" sample: hf mfdes auth 1 1 0 11223344");
567 PrintAndLog(" sample: hf mfdes auth 3 4 0 404142434445464748494a4b4c4d4e4f");
568 return 0;
569 }
570 uint8_t cmdAuthMode = param_get8(Cmd,0);
571 uint8_t cmdAuthAlgo = param_get8(Cmd,1);
572 uint8_t cmdKeyNo = param_get8(Cmd,2);
573
574 switch (cmdAuthMode)
575 {
576 case 1:
577 if ( cmdAuthAlgo != 1 && cmdAuthAlgo != 2) {
578 PrintAndLog("Crypto algo not valid for the auth mode");
579 return 1;
580 }
581 break;
582 case 2:
583 if ( cmdAuthAlgo != 1 && cmdAuthAlgo != 2 && cmdAuthAlgo != 3) {
584 PrintAndLog("Crypto algo not valid for the auth mode");
585 return 1;
586 }
587 break;
588 case 3:
589 if ( cmdAuthAlgo != 4) {
590 PrintAndLog("Crypto algo not valid for the auth mode");
591 return 1;
592 }
593 break;
594 default:
595 PrintAndLog("Wrong Auth mode");
596 return 1;
597 break;
598 }
599
600 switch (cmdAuthAlgo){
601 case 2:
602 keylength = 16;
603 PrintAndLog("3DES selected");
604 break;
605 case 3:
606 keylength = 24;
607 PrintAndLog("3 key 3DES selected");
608 break;
609 case 4:
610 keylength = 16;
611 PrintAndLog("AES selected");
612 break;
613 default:
614 cmdAuthAlgo = 1;
615 keylength = 8;
616 PrintAndLog("DES selected");
617 break;
618 }
619
620 // key
621 if (param_gethex(Cmd, 3, key, keylength*2)) {
622 PrintAndLog("Key must include %d HEX symbols", keylength);
623 return 1;
624 }
625 // algo, nyckellängd,
626 UsbCommand c = {CMD_MIFARE_DESFIRE_AUTH1, { cmdAuthMode, cmdAuthAlgo, cmdKeyNo }};
627
628 c.d.asBytes[0] = keylength;
629 memcpy(c.d.asBytes+1, key, keylength);
630 clearCommandBuffer();
631 SendCommand(&c);
632 UsbCommand resp;
633
634 if (!WaitForResponseTimeout(CMD_ACK,&resp,3000)) {
635 PrintAndLog("Client command execute timeout");
636 return 0;
637 }
638
639 uint8_t isOK = resp.arg[0] & 0xff;
640 if ( isOK) {
641 uint8_t * data= resp.d.asBytes;
642
643 PrintAndLog(" Key :%s",sprint_hex(key, keylength));
644 PrintAndLog(" SESSION :%s",sprint_hex(data, keylength));
645 PrintAndLog("-------------------------------------------------------------");
646 //PrintAndLog(" Expected :B5 21 9E E8 1A A7 49 9D 21 96 68 7E 13 97 38 56");
647 } else{
648 PrintAndLog("Client command failed.");
649 }
650 PrintAndLog("-------------------------------------------------------------");
651 return 1;
652 }
653
654
655 static command_t CommandTable[] = {
656 {"help", CmdHelp, 1, "This help"},
657 {"info", CmdHF14ADesInfo, 0, "Get MIFARE DesFire information"},
658 {"enum", CmdHF14ADesEnumApplications,0, "Tries enumerate all applications"},
659 {"auth", CmdHF14ADesAuth, 0, "Tries a MIFARE DesFire Authentication"},
660 {"rdbl", CmdHF14ADesRb, 0, "Read MIFARE DesFire block"},
661 {"wrbl", CmdHF14ADesWb, 0, "write MIFARE DesFire block"},
662 {NULL, NULL, 0, NULL}
663 };
664
665 int CmdHFMFDes(const char *Cmd) {
666 // flush
667 clearCommandBuffer();
668 CmdsParse(CommandTable, Cmd);
669 return 0;
670 }
671
672 int CmdHelp(const char *Cmd) {
673 CmdsHelp(CommandTable);
674 return 0;
675 }
676
677
Impressum, Datenschutz