git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifaredesfire.c

   1 #include "mifaredesfire.h"
   2
   3 #define MAX_APPLICATION_COUNT 28
   4 #define MAX_FILE_COUNT 16
   5 #define MAX_FRAME_SIZE 60
   6 #define NOT_YET_AUTHENTICATED 255
   7 #define FRAME_PAYLOAD_SIZE (MAX_FRAME_SIZE - 5)
   8
   9 //static uint8_t __msg[MAX_FRAME_SIZE] = { 0x0A, 0x00, 0x00, /* ..., */ 0x00 };
  10 /*                                       PCB   CID   CMD    PAYLOAD    */
  11 //static uint8_t __res[MAX_FRAME_SIZE];
  12
  13 void MifareDesfireGetInformation(){
  14
  15
  16         uint8_t len = 0;
  17         uint8_t resp[RECV_RES_SIZE];
  18         uint8_t dataout[RECV_CMD_SIZE];
  19         byte_t buf[RECV_RES_SIZE];
  20
  21         memset(resp,0,sizeof(resp));
  22         memset(dataout,0, sizeof(dataout));
  23         memset(buf,0,sizeof(buf));
  24
  25         /*
  26                 1 = PCB                                 1
  27                 2 = cid                                 2
  28                 3 = desfire command             3
  29                 4-5 = crc                               4  key
  30                                                                 5-6 crc
  31
  32                 PCB == 0x0A because sending CID byte.
  33                 CID == 0x00 first card?
  34
  35         */
  36         uint8_t cmd1[] = {0x0a,0x00,GET_VERSION, 0x00, 0x00 };
  37         uint8_t cmd2[] = {0x0a,0x00,GET_KEY_VERSION, 0x00, 0x00, 0x00 };
  38
  39         iso14a_clear_trace();
  40         iso14a_set_tracing(TRUE);
  41         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  42
  43         // card select - information
  44         iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
  45         byte_t isOK = iso14443a_select_card(NULL, card, NULL);
  46         if (isOK != 1) {
  47                 if (MF_DBGLEVEL >= 1) {
  48                         Dbprintf("Can't select card");
  49                 }
  50                 OnError();
  51                 return;
  52         }
  53
  54
  55         memcpy(dataout,card->uid,7);
  56
  57         LED_A_ON();
  58         LED_B_OFF();
  59         LED_C_OFF();
  60
  61         // GET INFORMATION
  62         AppendCrc14443a(cmd1, 3);
  63         ReaderTransmit(cmd1, sizeof(cmd1), NULL);
  64         len = ReaderReceive(resp);
  65         if ( resp[2] != ADDITIONAL_FRAME) {
  66                 print_result("ERROR <--: ", resp, len);
  67                 OnError();
  68                 return;
  69         }
  70
  71         memcpy(dataout+7,resp+3,7);
  72
  73         // ADDITION_FRAME 1
  74         ++cmd1[0];
  75         cmd1[2] = ADDITIONAL_FRAME;
  76         AppendCrc14443a(cmd1, 3);
  77         ReaderTransmit(cmd1, sizeof(cmd1), NULL);
  78         len = ReaderReceive(resp);
  79
  80         if ( resp[2] != ADDITIONAL_FRAME) {
  81                 print_result("ERROR <--: ", resp, len);
  82                 OnError();
  83                 return;
  84         }
  85         memcpy(dataout+7+7,resp+3,7);
  86
  87         // ADDITION_FRAME 2
  88         --cmd1[0];
  89         AppendCrc14443a(cmd1, 3);
  90         ReaderTransmit(cmd1, sizeof(cmd1), NULL);
  91         len = ReaderReceive(resp);
  92         if ( resp[2] != OPERATION_OK) {
  93                 print_result("ERROR <--: ", resp, len);
  94                 OnError();
  95                 return;
  96         }
  97
  98         memcpy(dataout+7+7+7,resp+3,14);
  99
 100         // GET MASTER KEYSETTINGS
 101         cmd1[2] = GET_KEY_SETTINGS;
 102         AppendCrc14443a(cmd1, 3);
 103         ReaderTransmit(cmd1, sizeof(cmd1), NULL);
 104         len = ReaderReceive(resp);
 105         if (len){
 106                 memcpy(dataout+7+7+7+14,resp+3,2);
 107         }
 108
 109
 110         // GET MASTER KEY VERSION
 111         AppendCrc14443a(cmd2, 4);
 112         ReaderTransmit(cmd2, sizeof(cmd2), NULL);
 113         len = ReaderReceive(resp);
 114         if (len){
 115                 memcpy(dataout+7+7+7+14+2,resp+3,1);
 116         }
 117
 118         // GET FREE MEMORY
 119         cmd1[2] = GET_FREE_MEMORY;
 120         AppendCrc14443a(cmd1, 3);
 121         ReaderTransmit(cmd1, sizeof(cmd1), NULL);
 122         len = ReaderReceive(resp);
 123         if (len){
 124                 memcpy(dataout+7+7+7+14+2+1,resp+3,3);
 125         }
 126
 127         cmd_send(CMD_ACK,1,0,0,dataout,sizeof(dataout));
 128         OnSuccess();
 129 }
 130
 131 void MifareDES_Auth1(uint8_t mode, uint8_t algo, uint8_t keyno,  uint8_t *datain){
 132
 133         uint8_t null_key_data[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 134         uint8_t new_key_data[8]  = { 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77 };
 135         int res;
 136
 137         MifareDESFireKey default_key = mifare_desfire_des_key_new_with_version (null_key_data);
 138
 139         res = mifare_desfire_select_application (tags[i], aid);
 140         if (res < 0) {
 141                 freefare_perror (tags[i], "mifare_desfire_select_application");
 142                 error = EXIT_FAILURE;
 143                 break;
 144         }
 145
 146         return;
 147         //                pcb  cid  cmd               key   crc1  cr2
 148         //uint8_t cmd2[] = {0x02,0x00,GET_KEY_VERSION, 0x00, 0x00, 0x00 };
 149
 150         //uint8_t* bigbuffer = mifare_get_bigbufptr();
 151         byte_t isOK = 1;
 152         uint8_t resp[256];
 153         uint8_t key[24];
 154         uint8_t IV[16];
 155
 156         // första byten håller keylength.
 157         uint8_t keylen = datain[0];
 158         memcpy(key, datain+1, keylen);
 159
 160         if (MF_DBGLEVEL >= 1) {
 161
 162                 Dbprintf("MODE: %d", mode);
 163                 Dbprintf("ALGO: %d", algo);
 164                 Dbprintf("KEYNO: %d", keyno);
 165                 Dbprintf("KEYLEN: %d", keylen);
 166
 167                 print_result("KEY", key, keylen);
 168         }
 169
 170         // card select - information
 171         byte_t buf[USB_CMD_DATA_SIZE];
 172         iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
 173
 174         // test of DES on ARM side.
 175         /*
 176         if ( mode == 1){
 177                 uint8_t IV[8];
 178                 uint8_t plain[16];
 179                 uint8_t encData[16];
 180
 181                 uint8_t tmpData[8];
 182                 uint8_t tmpPlain[8];
 183
 184                 memset(IV, 0, 8);
 185                 memset(tmpData, 0 ,8);
 186                 memset(tmpPlain,0 ,8);
 187                 memcpy(key, datain, 8);
 188                 memcpy(plain, datain+30, 16);
 189
 190                 for(uint8_t i=0; i< sizeof(plain); i=i+8 ){
 191
 192                         memcpy(tmpPlain, plain+i, 8);
 193                         des_enc( &tmpData, &tmpPlain, &key);
 194                         memcpy(encData+i, tmpData, 8);
 195                 }
 196         }
 197 */
 198
 199         iso14a_clear_trace();
 200
 201         iso14a_set_tracing(TRUE);
 202
 203         // power up the field
 204         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 205
 206         // select the card
 207         isOK = iso14443a_select_card(resp, card, NULL);
 208         if (isOK != 1) {
 209                 if (MF_DBGLEVEL >= 1) {
 210                         Dbprintf("CAN'T SELECT CARD, SOMETHING WENT WRONG BEFORE AUTH");
 211                 }
 212                 OnError();
 213                 return;
 214         }
 215
 216         LED_A_ON();
 217         LED_B_OFF();
 218         LED_C_OFF();
 219
 220         // 3 olika sätt att authenticera.   AUTH (CRC16) , AUTH_ISO (CRC32) , AUTH_AES (CRC32)
 221         // 4 olika crypto algo   DES, 3DES, 3K3DES, AES
 222         // 3 olika kommunikations sätt,   PLAIN,MAC,CRYPTO
 223
 224         // des, nyckel 0,
 225         switch (mode){
 226                 case 1:
 227                         // if ( SendDesfireCommand(AUTHENTICATE, &keyno, resp) > 0 ){
 228                                 // // fick nonce från kortet
 229                         // }
 230                         break;
 231                 case 2:
 232                         //SendDesfireCommand(AUTHENTICATE_ISO, &keyno, resp);
 233                         break;
 234                 case 3:{
 235                         AesCtx ctx;
 236                         if ( AesCtxIni(&ctx, IV, key, KEY128, CBC) < 0 ){
 237                                 if (MF_DBGLEVEL >= 1) {
 238                                         Dbprintf("AES context failed to init");
 239                                 }
 240                                 OnError();
 241                                 return;
 242                         }
 243                         uint8_t real_cmd[6];
 244                         real_cmd[0] = 0x90;
 245                         real_cmd[1] = 0x02;
 246                         real_cmd[2] = AUTHENTICATE_AES;
 247                         real_cmd[3] = keyno;
 248
 249                         AppendCrc14443a(real_cmd, 2);
 250                         ReaderTransmit(real_cmd, sizeof(real_cmd), NULL);
 251
 252                         int len = ReaderReceive(resp);
 253                         if(!len) {
 254                                 OnError();
 255                                 return;
 256                         }
 257
 258                         print_result("RX:", resp, len);
 259
 260                         enum DESFIRE_STATUS status = resp[1];
 261                         if ( status != ADDITIONAL_FRAME) {
 262                                 OnError();
 263                                 return;
 264                         }
 265
 266                         // tags enc nonce
 267                         uint8_t encRndB[16];
 268                         uint8_t decRndB[16];
 269                         uint8_t nonce[16];
 270                         uint8_t both[32];
 271                         uint8_t encBoth[32];
 272
 273                         memset(nonce, 0, 16);
 274                         memcpy( encRndB, resp+2, 16);
 275
 276                         // dekryptera tagnonce.
 277                         AesDecrypt(&ctx, encRndB, decRndB, 16);
 278
 279                         rol(decRndB,16);
 280
 281                         memcpy(both, nonce,16);
 282                         memcpy(both+16, decRndB ,16 );
 283
 284                         AesEncrypt(&ctx, both, encBoth, 32 );
 285
 286                         uint8_t real_cmd_A[36];
 287                         real_cmd_A[0] = 0x03;
 288                         real_cmd_A[1] = ADDITIONAL_FRAME;
 289
 290                         memcpy(real_cmd_A+2, encBoth, sizeof(encBoth) );
 291                         AppendCrc14443a(real_cmd_A, sizeof(real_cmd_A));
 292                         ReaderTransmit(real_cmd_A, sizeof(real_cmd_A), NULL);
 293
 294                         len = ReaderReceive(resp);
 295
 296                         print_result("Auth1a ", resp, 36);
 297
 298                         status = resp[1];
 299                         if ( status != OPERATION_OK)    {
 300                                 Dbprintf("Cmd Error: %02x  Len: %d", status,len);
 301                                 OnError();
 302                                 return;
 303                         }
 304
 305                                 break;
 306                         }
 307
 308         }
 309
 310         OnSuccess(resp);
 311 }
 312
 313
 314 // desfire_cmd  =  enum DESFIRE_CMD in desfire.h
 315 // cmd = pointer to
 316 // dataout = point to array for response data.
 317 int SendDesfireCommand(enum DESFIRE_CMD desfire_cmd,uint8_t *dataout, uint8_t fromscratch){
 318
 319    uint8_t resp[80];
 320    uint8_t len;
 321
 322    if ( fromscratch){
 323
 324                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 325
 326                 // power up the field
 327                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 328                 // select the card
 329                 iso14443a_select_card(NULL, NULL, NULL);
 330    }
 331
 332    // 3 olika ISO sätt att skicka data till DESFIRE (direkt, inkapslat, inkapslat ISO)
 333    uint8_t real_cmd[4];
 334    real_cmd[0] = 0x02;
 335    real_cmd[1] = desfire_cmd;
 336    AppendCrc14443a(real_cmd, 2);
 337    ReaderTransmit(real_cmd, sizeof(real_cmd), NULL);
 338    len = ReaderReceive(resp);
 339    if(!len)
 340        return -1; //DATA LINK ERROR
 341
 342         if ( fromscratch){
 343                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 344         }
 345
 346    enum DESFIRE_STATUS status = resp[1];
 347    //1 bytes iso, 1 byte status,  in the end: 2 bytes crc
 348    if ( status == OPERATION_OK  || status == ADDITIONAL_FRAME) {
 349        memcpy(dataout, resp+2, 2);
 350        return len;
 351         }
 352         else {
 353            Dbprintf("unexpected desfire response: %X (to %X)", status, desfire_cmd);
 354        return -status;
 355    }
 356 }
 357
 358                         // crc_update(&desfire_crc32, 0, 1); /* CMD_WRITE */
 359                         // crc_update(&desfire_crc32, addr, addr_sz);
 360                         // crc_update(&desfire_crc32, byte, 8);
 361                         // uint32_t crc = crc_finish(&desfire_crc32);
 362
 363
 364         /* Version
 365
 366         //uint8_t versionCmd1[] = {0x02, 0x60};
 367         //uint8_t versionCmd2[] = {0x03, 0xaf};
 368         //uint8_t versionCmd3[] = {0x02, 0xaf};
 369
 370     // AUTH 1  -  CMD: 0x02, 0x0A, 0x00  = Auth
 371         // 0x02 = status byte för simpla svar?!?
 372         // 0x0a = krypto typ
 373         // 0x00 = key nr
 374         //uint8_t initAuthCmdDES[]  = {0x02, 0x0a, 0x00};  // DES
 375         //uint8_t initAuthCmd3DES[] = {0x02, 0x1a, 0x00};  // 3DES
 376         //uint8_t initAuthCmdAES[]  = {0x02, 0xaa, 0x00};  // AES
 377         // auth 1 - answer command
 378         // 0x03 = status byte för komplexa typer?
 379         // 0xaf = additional frame
 380         // LEN = 1+1+32+2 = 36
 381         //uint8_t answerAuthCmd[34] = {0x03, 0xaf};
 382
 383         // Lägg till CRC
 384         //AppendCrc14443a(versionCmd1,sizeof(versionCmd1));
 385 */
 386
 387         // Sending commands
 388         /*ReaderTransmit(versionCmd1,sizeof(versionCmd1)+2, NULL);
 389         len = ReaderReceive(buffer);
 390         print_result("Get Version 3", buffer, 9);
 391         */
 392
 393         // for( int i = 0; i < 8; i++){
 394                 // // Auth 1 - Request authentication
 395                 // ReaderTransmit(initAuthCmdAES,sizeof(initAuthCmdAES)+2, NULL);
 396                 // //len = ReaderReceive(buffer);
 397
 398                 // // 0xAE =  authentication error
 399                 // if (buffer[1] == 0xae)       {
 400                                 // Dbprintf("Cmd Error: %02x", buffer[1]);
 401                                 // OnError();
 402                                 // return;
 403                 // }
 404
 405                 // // tags enc nonce
 406                 // memcpy(encRndB, buffer+2, 16);
 407
 408                 // // dekryptera svaret från tag.
 409                 // AesDecrypt(&ctx, encRndB, decRndB, 16);
 410
 411                 // rol8(decRndB,16);
 412                 // memcpy(RndARndB, RndA,16);
 413                 // memcpy(RndARndB+16, decRndB ,16 );
 414
 415                 // AesEncrypt(&ctx, RndARndB, encRndARndB, 32 );
 416
 417                 // memcpy(answerAuthCmd+2, encRndARndB, 32);
 418                 // AppendCrc14443a(answerAuthCmd,sizeof(answerAuthCmd));
 419
 420                 // ReaderTransmit(answerAuthCmd,sizeof(answerAuthCmd)+2, NULL);
 421
 422                 // len = ReaderReceive(buffer);
 423
 424                 // print_result("Auth1a ", buffer, 8);
 425                 // Dbprintf("Rx len: %02x", len);
 426
 427                 // if (buffer[1] == 0xCA)       {
 428                                 // Dbprintf("Cmd Error: %02x  Len: %d", buffer[1],len);
 429                                 // cmd_send(CMD_ACK,0,0,0,0,0);
 430                                 // key[1] = i;
 431                                 // AesCtxIni(&ctx, iv, key, KEY128, CBC);
 432                 // }
 433         // }
 434
 435         //des_dec(decRndB, encRndB, key);
 436
 437     //Do crypto magic
 438         /*
 439     DES_ede2_cbc_encrypt(e_RndB,RndB,sizeof(e_RndB),&ks1,&ks2,&iv,0);
 440     memcpy(RndARndB,RndA,8);
 441     memcpy(RndARndB+8,RndB,8);
 442     PrintAndLog("     RA+B:%s",sprint_hex(RndARndB, 16));
 443     DES_ede2_cbc_encrypt(RndARndB,RndARndB,sizeof(RndARndB),&ks1,&ks2,&e_RndB,1);
 444     PrintAndLog("enc(RA+B):%s",sprint_hex(RndARndB, 16));
 445     */
 446
 447
 448 int mifare_des_auth2(uint32_t uid, uint8_t *key, uint8_t *blockData){
 449
 450         uint8_t* buffer = mifare_get_bigbufptr();
 451         uint8_t dcmd[19];
 452
 453         dcmd[0] = 0xAF;
 454     memcpy(dcmd+1,key,16);
 455         AppendCrc14443a(dcmd, 17);
 456
 457
 458         ReaderTransmit(dcmd, sizeof(dcmd), NULL);
 459         int len = ReaderReceive(buffer);
 460         if(!len) {
 461           if (MF_DBGLEVEL >= 1)   Dbprintf("Authentication failed. Card timeout.");
 462           len = ReaderReceive(buffer);
 463     }
 464
 465         if(len==1)      {
 466         if (MF_DBGLEVEL >= 1) {
 467                         Dbprintf("NAK - Authentication failed.");
 468                         Dbprintf("Cmd Error: %02x", buffer[0]);
 469                 }
 470                 return 1;
 471         }
 472
 473         if (len == 11){
 474                 if (MF_DBGLEVEL >= 1) {
 475                         Dbprintf("Auth2 Resp: %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
 476                                           buffer[0],buffer[1],buffer[2],buffer[3],buffer[4],
 477                                           buffer[5],buffer[6],buffer[7],buffer[8],buffer[9],
 478                                           buffer[10]);
 479                 }
 480                 return 0;
 481         }
 482         return 1;
 483 }
 484
 485 void MifareDES_Auth2(uint32_t arg0, uint8_t *datain){
 486
 487         return;
 488         uint32_t cuid = arg0;
 489         uint8_t key[16];
 490
 491         byte_t isOK = 0;
 492         byte_t dataoutbuf[16];
 493
 494     memset(key, 0, 16);
 495         memcpy(key, datain, 16);
 496
 497         LED_A_ON();
 498         LED_B_OFF();
 499         LED_C_OFF();
 500
 501         if(mifare_des_auth2(cuid, key, dataoutbuf)){
 502             if (MF_DBGLEVEL >= 1) Dbprintf("Authentication part2: Fail...");
 503         }
 504         isOK=1;
 505         if (MF_DBGLEVEL >= 2)   DbpString("AUTH 2 FINISHED");
 506
 507         LED_B_ON();
 508     cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,11);
 509         LED_B_OFF();
 510
 511     // Thats it...
 512         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 513         LEDsoff();
 514 }
 515
 516 // CreateAPDU
 517 uint8_t* CreateAPDU( uint8_t *datain, size_t len){
 518
 519         len = MIN(len, USB_CMD_DATA_SIZE);
 520
 521         uint8_t tmpcmd[len];
 522         uint8_t *cmd = tmpcmd;
 523         memset(cmd, 0, len);
 524         cmd[0] = 0x0a;
 525         cmd[1] = 0x00;
 526
 527         memcpy(cmd, datain,len);
 528         AppendCrc14443a(cmd, len+2);
 529         return cmd;
 530 }
 531
 532 void SelectCard(){
 533
 534         uint8_t resp[RECV_RES_SIZE];
 535         byte_t buf[RECV_RES_SIZE];
 536
 537         memset(resp,0,sizeof(resp));
 538         memset(buf,0,sizeof(buf));
 539
 540         iso14a_clear_trace();
 541         iso14a_set_tracing(TRUE);
 542         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 543
 544         // card select - information
 545         iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
 546         byte_t isOK = iso14443a_select_card(NULL, card, NULL);
 547         if (isOK != 1) {
 548                 if (MF_DBGLEVEL >= 1) {
 549                         Dbprintf("Can't select card");
 550                 }
 551                 OnError();
 552                 return;
 553         }
 554 }
 555
 556 void OnSuccess(){
 557         // Deselect card by sending a s-block. the crc is precalced for speed
 558         uint8_t cmd[] = {0xc2,0xe0,0xb4};
 559         ReaderTransmit(cmd, sizeof(cmd), NULL);
 560         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 561         LEDsoff();
 562 }
 563
 564 void OnError(){
 565         cmd_send(CMD_ACK,0,0,0,0,0);
 566         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 567         LEDsoff();
 568 }