]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifaredesfire.c
First check in.
[proxmark3-svn] / armsrc / mifaredesfire.c
1 #include "mifaredesfire.h"
2
3 #define MAX_APPLICATION_COUNT 28
4 #define MAX_FILE_COUNT 16
5 #define MAX_FRAME_SIZE 60
6 #define NOT_YET_AUTHENTICATED 255
7 #define FRAME_PAYLOAD_SIZE (MAX_FRAME_SIZE - 5)
8
9 //static uint8_t __msg[MAX_FRAME_SIZE] = { 0x0A, 0x00, 0x00, /* ..., */ 0x00 };
10 /* PCB CID CMD PAYLOAD */
11 //static uint8_t __res[MAX_FRAME_SIZE];
12
13 void MifareDesfireGetInformation(){
14
15
16 uint8_t len = 0;
17 uint8_t resp[RECV_RES_SIZE];
18 uint8_t dataout[RECV_CMD_SIZE];
19 byte_t buf[RECV_RES_SIZE];
20
21 memset(resp,0,sizeof(resp));
22 memset(dataout,0, sizeof(dataout));
23 memset(buf,0,sizeof(buf));
24
25 /*
26 1 = PCB 1
27 2 = cid 2
28 3 = desfire command 3
29 4-5 = crc 4 key
30 5-6 crc
31
32 PCB == 0x0A because sending CID byte.
33 CID == 0x00 first card?
34
35 */
36 uint8_t cmd1[] = {0x0a,0x00,GET_VERSION, 0x00, 0x00 };
37 uint8_t cmd2[] = {0x0a,0x00,GET_KEY_VERSION, 0x00, 0x00, 0x00 };
38
39 iso14a_clear_trace();
40 iso14a_set_tracing(TRUE);
41 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
42
43 // card select - information
44 iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
45 byte_t isOK = iso14443a_select_card(NULL, card, NULL);
46 if (isOK != 1) {
47 if (MF_DBGLEVEL >= 1) {
48 Dbprintf("Can't select card");
49 }
50 OnError();
51 return;
52 }
53
54
55 memcpy(dataout,card->uid,7);
56
57 LED_A_ON();
58 LED_B_OFF();
59 LED_C_OFF();
60
61 // GET INFORMATION
62 AppendCrc14443a(cmd1, 3);
63 ReaderTransmit(cmd1, sizeof(cmd1), NULL);
64 len = ReaderReceive(resp);
65 if ( resp[2] != ADDITIONAL_FRAME) {
66 print_result("ERROR <--: ", resp, len);
67 OnError();
68 return;
69 }
70
71 memcpy(dataout+7,resp+3,7);
72
73 // ADDITION_FRAME 1
74 ++cmd1[0];
75 cmd1[2] = ADDITIONAL_FRAME;
76 AppendCrc14443a(cmd1, 3);
77 ReaderTransmit(cmd1, sizeof(cmd1), NULL);
78 len = ReaderReceive(resp);
79
80 if ( resp[2] != ADDITIONAL_FRAME) {
81 print_result("ERROR <--: ", resp, len);
82 OnError();
83 return;
84 }
85 memcpy(dataout+7+7,resp+3,7);
86
87 // ADDITION_FRAME 2
88 --cmd1[0];
89 AppendCrc14443a(cmd1, 3);
90 ReaderTransmit(cmd1, sizeof(cmd1), NULL);
91 len = ReaderReceive(resp);
92 if ( resp[2] != OPERATION_OK) {
93 print_result("ERROR <--: ", resp, len);
94 OnError();
95 return;
96 }
97
98 memcpy(dataout+7+7+7,resp+3,14);
99
100 // GET MASTER KEYSETTINGS
101 cmd1[2] = GET_KEY_SETTINGS;
102 AppendCrc14443a(cmd1, 3);
103 ReaderTransmit(cmd1, sizeof(cmd1), NULL);
104 len = ReaderReceive(resp);
105 if (len){
106 memcpy(dataout+7+7+7+14,resp+3,2);
107 }
108
109
110 // GET MASTER KEY VERSION
111 AppendCrc14443a(cmd2, 4);
112 ReaderTransmit(cmd2, sizeof(cmd2), NULL);
113 len = ReaderReceive(resp);
114 if (len){
115 memcpy(dataout+7+7+7+14+2,resp+3,1);
116 }
117
118 // GET FREE MEMORY
119 cmd1[2] = GET_FREE_MEMORY;
120 AppendCrc14443a(cmd1, 3);
121 ReaderTransmit(cmd1, sizeof(cmd1), NULL);
122 len = ReaderReceive(resp);
123 if (len){
124 memcpy(dataout+7+7+7+14+2+1,resp+3,3);
125 }
126
127 cmd_send(CMD_ACK,1,0,0,dataout,sizeof(dataout));
128 OnSuccess();
129 }
130
131 void MifareDES_Auth1(uint8_t mode, uint8_t algo, uint8_t keyno, uint8_t *datain){
132
133 uint8_t null_key_data[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
134 uint8_t new_key_data[8] = { 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77 };
135 int res;
136
137 MifareDESFireKey default_key = mifare_desfire_des_key_new_with_version (null_key_data);
138
139 res = mifare_desfire_select_application (tags[i], aid);
140 if (res < 0) {
141 freefare_perror (tags[i], "mifare_desfire_select_application");
142 error = EXIT_FAILURE;
143 break;
144 }
145
146 return;
147 // pcb cid cmd key crc1 cr2
148 //uint8_t cmd2[] = {0x02,0x00,GET_KEY_VERSION, 0x00, 0x00, 0x00 };
149
150 //uint8_t* bigbuffer = mifare_get_bigbufptr();
151 byte_t isOK = 1;
152 uint8_t resp[256];
153 uint8_t key[24];
154 uint8_t IV[16];
155
156 // första byten håller keylength.
157 uint8_t keylen = datain[0];
158 memcpy(key, datain+1, keylen);
159
160 if (MF_DBGLEVEL >= 1) {
161
162 Dbprintf("MODE: %d", mode);
163 Dbprintf("ALGO: %d", algo);
164 Dbprintf("KEYNO: %d", keyno);
165 Dbprintf("KEYLEN: %d", keylen);
166
167 print_result("KEY", key, keylen);
168 }
169
170 // card select - information
171 byte_t buf[USB_CMD_DATA_SIZE];
172 iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
173
174 // test of DES on ARM side.
175 /*
176 if ( mode == 1){
177 uint8_t IV[8];
178 uint8_t plain[16];
179 uint8_t encData[16];
180
181 uint8_t tmpData[8];
182 uint8_t tmpPlain[8];
183
184 memset(IV, 0, 8);
185 memset(tmpData, 0 ,8);
186 memset(tmpPlain,0 ,8);
187 memcpy(key, datain, 8);
188 memcpy(plain, datain+30, 16);
189
190 for(uint8_t i=0; i< sizeof(plain); i=i+8 ){
191
192 memcpy(tmpPlain, plain+i, 8);
193 des_enc( &tmpData, &tmpPlain, &key);
194 memcpy(encData+i, tmpData, 8);
195 }
196 }
197 */
198
199 iso14a_clear_trace();
200
201 iso14a_set_tracing(TRUE);
202
203 // power up the field
204 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
205
206 // select the card
207 isOK = iso14443a_select_card(resp, card, NULL);
208 if (isOK != 1) {
209 if (MF_DBGLEVEL >= 1) {
210 Dbprintf("CAN'T SELECT CARD, SOMETHING WENT WRONG BEFORE AUTH");
211 }
212 OnError();
213 return;
214 }
215
216 LED_A_ON();
217 LED_B_OFF();
218 LED_C_OFF();
219
220 // 3 olika sätt att authenticera. AUTH (CRC16) , AUTH_ISO (CRC32) , AUTH_AES (CRC32)
221 // 4 olika crypto algo DES, 3DES, 3K3DES, AES
222 // 3 olika kommunikations sätt, PLAIN,MAC,CRYPTO
223
224 // des, nyckel 0,
225 switch (mode){
226 case 1:
227 // if ( SendDesfireCommand(AUTHENTICATE, &keyno, resp) > 0 ){
228 // // fick nonce från kortet
229 // }
230 break;
231 case 2:
232 //SendDesfireCommand(AUTHENTICATE_ISO, &keyno, resp);
233 break;
234 case 3:{
235 AesCtx ctx;
236 if ( AesCtxIni(&ctx, IV, key, KEY128, CBC) < 0 ){
237 if (MF_DBGLEVEL >= 1) {
238 Dbprintf("AES context failed to init");
239 }
240 OnError();
241 return;
242 }
243 uint8_t real_cmd[6];
244 real_cmd[0] = 0x90;
245 real_cmd[1] = 0x02;
246 real_cmd[2] = AUTHENTICATE_AES;
247 real_cmd[3] = keyno;
248
249 AppendCrc14443a(real_cmd, 2);
250 ReaderTransmit(real_cmd, sizeof(real_cmd), NULL);
251
252 int len = ReaderReceive(resp);
253 if(!len) {
254 OnError();
255 return;
256 }
257
258 print_result("RX:", resp, len);
259
260 enum DESFIRE_STATUS status = resp[1];
261 if ( status != ADDITIONAL_FRAME) {
262 OnError();
263 return;
264 }
265
266 // tags enc nonce
267 uint8_t encRndB[16];
268 uint8_t decRndB[16];
269 uint8_t nonce[16];
270 uint8_t both[32];
271 uint8_t encBoth[32];
272
273 memset(nonce, 0, 16);
274 memcpy( encRndB, resp+2, 16);
275
276 // dekryptera tagnonce.
277 AesDecrypt(&ctx, encRndB, decRndB, 16);
278
279 rol(decRndB,16);
280
281 memcpy(both, nonce,16);
282 memcpy(both+16, decRndB ,16 );
283
284 AesEncrypt(&ctx, both, encBoth, 32 );
285
286 uint8_t real_cmd_A[36];
287 real_cmd_A[0] = 0x03;
288 real_cmd_A[1] = ADDITIONAL_FRAME;
289
290 memcpy(real_cmd_A+2, encBoth, sizeof(encBoth) );
291 AppendCrc14443a(real_cmd_A, sizeof(real_cmd_A));
292 ReaderTransmit(real_cmd_A, sizeof(real_cmd_A), NULL);
293
294 len = ReaderReceive(resp);
295
296 print_result("Auth1a ", resp, 36);
297
298 status = resp[1];
299 if ( status != OPERATION_OK) {
300 Dbprintf("Cmd Error: %02x Len: %d", status,len);
301 OnError();
302 return;
303 }
304
305 break;
306 }
307
308 }
309
310 OnSuccess(resp);
311 }
312
313
314 // desfire_cmd = enum DESFIRE_CMD in desfire.h
315 // cmd = pointer to
316 // dataout = point to array for response data.
317 int SendDesfireCommand(enum DESFIRE_CMD desfire_cmd,uint8_t *dataout, uint8_t fromscratch){
318
319 uint8_t resp[80];
320 uint8_t len;
321
322 if ( fromscratch){
323
324 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
325
326 // power up the field
327 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
328 // select the card
329 iso14443a_select_card(NULL, NULL, NULL);
330 }
331
332 // 3 olika ISO sätt att skicka data till DESFIRE (direkt, inkapslat, inkapslat ISO)
333 uint8_t real_cmd[4];
334 real_cmd[0] = 0x02;
335 real_cmd[1] = desfire_cmd;
336 AppendCrc14443a(real_cmd, 2);
337 ReaderTransmit(real_cmd, sizeof(real_cmd), NULL);
338 len = ReaderReceive(resp);
339 if(!len)
340 return -1; //DATA LINK ERROR
341
342 if ( fromscratch){
343 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
344 }
345
346 enum DESFIRE_STATUS status = resp[1];
347 //1 bytes iso, 1 byte status, in the end: 2 bytes crc
348 if ( status == OPERATION_OK || status == ADDITIONAL_FRAME) {
349 memcpy(dataout, resp+2, 2);
350 return len;
351 }
352 else {
353 Dbprintf("unexpected desfire response: %X (to %X)", status, desfire_cmd);
354 return -status;
355 }
356 }
357
358 // crc_update(&desfire_crc32, 0, 1); /* CMD_WRITE */
359 // crc_update(&desfire_crc32, addr, addr_sz);
360 // crc_update(&desfire_crc32, byte, 8);
361 // uint32_t crc = crc_finish(&desfire_crc32);
362
363
364 /* Version
365
366 //uint8_t versionCmd1[] = {0x02, 0x60};
367 //uint8_t versionCmd2[] = {0x03, 0xaf};
368 //uint8_t versionCmd3[] = {0x02, 0xaf};
369
370 // AUTH 1 - CMD: 0x02, 0x0A, 0x00 = Auth
371 // 0x02 = status byte för simpla svar?!?
372 // 0x0a = krypto typ
373 // 0x00 = key nr
374 //uint8_t initAuthCmdDES[] = {0x02, 0x0a, 0x00}; // DES
375 //uint8_t initAuthCmd3DES[] = {0x02, 0x1a, 0x00}; // 3DES
376 //uint8_t initAuthCmdAES[] = {0x02, 0xaa, 0x00}; // AES
377 // auth 1 - answer command
378 // 0x03 = status byte för komplexa typer?
379 // 0xaf = additional frame
380 // LEN = 1+1+32+2 = 36
381 //uint8_t answerAuthCmd[34] = {0x03, 0xaf};
382
383 // Lägg till CRC
384 //AppendCrc14443a(versionCmd1,sizeof(versionCmd1));
385 */
386
387 // Sending commands
388 /*ReaderTransmit(versionCmd1,sizeof(versionCmd1)+2, NULL);
389 len = ReaderReceive(buffer);
390 print_result("Get Version 3", buffer, 9);
391 */
392
393 // for( int i = 0; i < 8; i++){
394 // // Auth 1 - Request authentication
395 // ReaderTransmit(initAuthCmdAES,sizeof(initAuthCmdAES)+2, NULL);
396 // //len = ReaderReceive(buffer);
397
398 // // 0xAE = authentication error
399 // if (buffer[1] == 0xae) {
400 // Dbprintf("Cmd Error: %02x", buffer[1]);
401 // OnError();
402 // return;
403 // }
404
405 // // tags enc nonce
406 // memcpy(encRndB, buffer+2, 16);
407
408 // // dekryptera svaret från tag.
409 // AesDecrypt(&ctx, encRndB, decRndB, 16);
410
411 // rol8(decRndB,16);
412 // memcpy(RndARndB, RndA,16);
413 // memcpy(RndARndB+16, decRndB ,16 );
414
415 // AesEncrypt(&ctx, RndARndB, encRndARndB, 32 );
416
417 // memcpy(answerAuthCmd+2, encRndARndB, 32);
418 // AppendCrc14443a(answerAuthCmd,sizeof(answerAuthCmd));
419
420 // ReaderTransmit(answerAuthCmd,sizeof(answerAuthCmd)+2, NULL);
421
422 // len = ReaderReceive(buffer);
423
424 // print_result("Auth1a ", buffer, 8);
425 // Dbprintf("Rx len: %02x", len);
426
427 // if (buffer[1] == 0xCA) {
428 // Dbprintf("Cmd Error: %02x Len: %d", buffer[1],len);
429 // cmd_send(CMD_ACK,0,0,0,0,0);
430 // key[1] = i;
431 // AesCtxIni(&ctx, iv, key, KEY128, CBC);
432 // }
433 // }
434
435 //des_dec(decRndB, encRndB, key);
436
437 //Do crypto magic
438 /*
439 DES_ede2_cbc_encrypt(e_RndB,RndB,sizeof(e_RndB),&ks1,&ks2,&iv,0);
440 memcpy(RndARndB,RndA,8);
441 memcpy(RndARndB+8,RndB,8);
442 PrintAndLog(" RA+B:%s",sprint_hex(RndARndB, 16));
443 DES_ede2_cbc_encrypt(RndARndB,RndARndB,sizeof(RndARndB),&ks1,&ks2,&e_RndB,1);
444 PrintAndLog("enc(RA+B):%s",sprint_hex(RndARndB, 16));
445 */
446
447
448 int mifare_des_auth2(uint32_t uid, uint8_t *key, uint8_t *blockData){
449
450 uint8_t* buffer = mifare_get_bigbufptr();
451 uint8_t dcmd[19];
452
453 dcmd[0] = 0xAF;
454 memcpy(dcmd+1,key,16);
455 AppendCrc14443a(dcmd, 17);
456
457
458 ReaderTransmit(dcmd, sizeof(dcmd), NULL);
459 int len = ReaderReceive(buffer);
460 if(!len) {
461 if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Card timeout.");
462 len = ReaderReceive(buffer);
463 }
464
465 if(len==1) {
466 if (MF_DBGLEVEL >= 1) {
467 Dbprintf("NAK - Authentication failed.");
468 Dbprintf("Cmd Error: %02x", buffer[0]);
469 }
470 return 1;
471 }
472
473 if (len == 11){
474 if (MF_DBGLEVEL >= 1) {
475 Dbprintf("Auth2 Resp: %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
476 buffer[0],buffer[1],buffer[2],buffer[3],buffer[4],
477 buffer[5],buffer[6],buffer[7],buffer[8],buffer[9],
478 buffer[10]);
479 }
480 return 0;
481 }
482 return 1;
483 }
484
485 void MifareDES_Auth2(uint32_t arg0, uint8_t *datain){
486
487 return;
488 uint32_t cuid = arg0;
489 uint8_t key[16];
490
491 byte_t isOK = 0;
492 byte_t dataoutbuf[16];
493
494 memset(key, 0, 16);
495 memcpy(key, datain, 16);
496
497 LED_A_ON();
498 LED_B_OFF();
499 LED_C_OFF();
500
501 if(mifare_des_auth2(cuid, key, dataoutbuf)){
502 if (MF_DBGLEVEL >= 1) Dbprintf("Authentication part2: Fail...");
503 }
504 isOK=1;
505 if (MF_DBGLEVEL >= 2) DbpString("AUTH 2 FINISHED");
506
507 LED_B_ON();
508 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,11);
509 LED_B_OFF();
510
511 // Thats it...
512 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
513 LEDsoff();
514 }
515
516 // CreateAPDU
517 uint8_t* CreateAPDU( uint8_t *datain, size_t len){
518
519 len = MIN(len, USB_CMD_DATA_SIZE);
520
521 uint8_t tmpcmd[len];
522 uint8_t *cmd = tmpcmd;
523 memset(cmd, 0, len);
524 cmd[0] = 0x0a;
525 cmd[1] = 0x00;
526
527 memcpy(cmd, datain,len);
528 AppendCrc14443a(cmd, len+2);
529 return cmd;
530 }
531
532 void SelectCard(){
533
534 uint8_t resp[RECV_RES_SIZE];
535 byte_t buf[RECV_RES_SIZE];
536
537 memset(resp,0,sizeof(resp));
538 memset(buf,0,sizeof(buf));
539
540 iso14a_clear_trace();
541 iso14a_set_tracing(TRUE);
542 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
543
544 // card select - information
545 iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
546 byte_t isOK = iso14443a_select_card(NULL, card, NULL);
547 if (isOK != 1) {
548 if (MF_DBGLEVEL >= 1) {
549 Dbprintf("Can't select card");
550 }
551 OnError();
552 return;
553 }
554 }
555
556 void OnSuccess(){
557 // Deselect card by sending a s-block. the crc is precalced for speed
558 uint8_t cmd[] = {0xc2,0xe0,0xb4};
559 ReaderTransmit(cmd, sizeof(cmd), NULL);
560 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
561 LEDsoff();
562 }
563
564 void OnError(){
565 cmd_send(CMD_ACK,0,0,0,0,0);
566 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
567 LEDsoff();
568 }
Impressum, Datenschutz