git.zerfleddert.de Git - proxmark3-svn/blob

1 //-----------------------------------------------------------------------------

5 //

6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,

7 // at your option, any later version. See the LICENSE.txt file for the text of

8 // the license.

9 //-----------------------------------------------------------------------------

10 // High frequency iClass commands

11 //-----------------------------------------------------------------------------

13 #include <stdio.h>

14 #include <stdlib.h>

15 #include <string.h>

16 #include <sys/stat.h>

17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type

18 #include "data.h"

19 #include "proxmark3.h"

20 #include "ui.h"

21 #include "cmdparser.h"

22 #include "cmdhficlass.h"

23 #include "common.h"

24 #include "util.h"

25 #include "cmdmain.h"

26 #include "loclass/des.h"

27 #include "loclass/cipherutils.h"

28 #include "loclass/cipher.h"

29 #include "loclass/ikeys.h"

30 #include "loclass/elite_crack.h"

31 #include "loclass/fileutils.h"

 static int CmdHelp(const char *Cmd);

 int xorbits_8(uint8_t val)

36 {

     uint8_t res = val ^ (val >> 1); //1st pass

     res = res ^ (res >> 1);             // 2nd pass

     res = res ^ (res >> 2);             // 3rd pass

     res = res ^ (res >> 4);                     // 4th pass

41 return res & 1;

42 }

 int CmdHFiClassList(const char *Cmd)

45 {

46 PrintAndLog("Deprecated command, use 'hf list iclass' instead");

47 return 0;

48 }

 int CmdHFiClassSnoop(const char *Cmd)

51 {

52 UsbCommand c = {CMD_SNOOP_ICLASS};

53 SendCommand(&c);

54 return 0;

55 }

56 #define NUM_CSNS 15

 int CmdHFiClassSim(const char *Cmd)

58 {

59 uint8_t simType = 0;

   uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};

   if (strlen(Cmd)<1) {

63 PrintAndLog("Usage: hf iclass sim [0 <CSN>] | x");

64 PrintAndLog(" options");

65 PrintAndLog(" 0 <CSN> simulate the given CSN");

66 PrintAndLog(" 1 simulate default CSN");

67 PrintAndLog(" 2 iterate CSNs, gather MACs");

68 PrintAndLog(" sample: hf iclass sim 0 031FEC8AF7FF12E0");

69 PrintAndLog(" sample: hf iclass sim 2");

70 return 0;

71 }

   simType = param_get8(Cmd, 0);

   if(simType == 0)

76 {

           if (param_gethex(Cmd, 1, CSN, 16)) {

78 PrintAndLog("A CSN should consist of 16 HEX symbols");

79 return 1;

80 }

           PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));

83 }

   if(simType > 2)

85 {

           PrintAndLog("Undefined simptype %d", simType);

87 return 1;

88 }

89 uint8_t numberOfCSNs=0;

         if(simType == 2)

92 {

93 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};

94 UsbCommand resp = {0};

96 /*uint8_t csns[8 * NUM_CSNS] = {

97 0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,

98 0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,

99 0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,

100 0x17,0x12,0x01,0xfd,0xf7,0xff,0x12,0xe0 ,

101 0xcd,0x56,0x01,0x7c,0x6f,0xff,0x12,0xe0 ,

102 0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,

103 0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,

104 0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };

105 */

106

        uint8_t csns[8*NUM_CSNS] = {

         0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,

         0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,

         0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,

         0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,

         0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,

         0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,

         0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,

         0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,

         0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,

         0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,

         0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,

         0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,

         0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,

         0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,

         0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };

123

                 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);

125

126 SendCommand(&c);

                 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {

128 PrintAndLog("Command timed out");

129 return 0;

130 }

131

                 uint8_t num_mac_responses  = resp.arg[1];

                 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);

134

                 size_t datalen = NUM_CSNS*24;

136 /*

137 * Now, time to dump to file. We'll use this format:

138 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....

139 * So, it should wind up as

140 * 8 * 24 bytes.

141 *

142 * The returndata from the pm3 is on the following format

143 * <4 byte NR><4 byte MAC>

144 * CC are all zeroes, CSN is the same as was sent in

145 **/

                 void* dump = malloc(datalen);

                 memset(dump,0,datalen);//<-- Need zeroes for the CC-field

148 uint8_t i = 0;

                 for(i = 0 ; i < NUM_CSNS ; i++)

150 {

                         memcpy(dump+i*24, csns+i*8,8); //CSN

152 //8 zero bytes here...

153 //Then comes NR_MAC (eight bytes from the response)

                         memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);

155

156 }

157 /** Now, save to dumpfile **/

                 saveFile("iclass_mac_attack", "bin", dump,datalen);

159 free(dump);

160 }else

161 {

162 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};

                 memcpy(c.d.asBytes, CSN, 8);

164 SendCommand(&c);

165 }

166

167 return 0;

168 }

169

 int CmdHFiClassReader(const char *Cmd)

171 {

172 UsbCommand c = {CMD_READER_ICLASS, {0}};

173 SendCommand(&c);

174 UsbCommand resp;

175 while(!ukbhit()){

       if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {

             uint8_t isOK    = resp.arg[0] & 0xff;

             uint8_t * data  = resp.d.asBytes;

179

             PrintAndLog("isOk:%02x", isOK);

             if( isOK == 0){

182 //Aborted

183 PrintAndLog("Quitting...");

184 return 0;

185 }

             if(isOK > 0)

187 {

                 PrintAndLog("CSN: %s",sprint_hex(data,8));

189 }

             if(isOK >= 1)

191 {

                 PrintAndLog("CC: %s",sprint_hex(data+8,8));

193 }else{

194 PrintAndLog("No CC obtained");

195 }

196 } else {

197 PrintAndLog("Command execute timeout");

198 }

199 }

200

201 return 0;

202 }

203

 int CmdHFiClassReader_Replay(const char *Cmd)

205 {

206 uint8_t readerType = 0;

   uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};

208

   if (strlen(Cmd)<1) {

210 PrintAndLog("Usage: hf iclass replay <MAC>");

211 PrintAndLog(" sample: hf iclass replay 00112233");

212 return 0;

213 }

214

   if (param_gethex(Cmd, 0, MAC, 8)) {

216 PrintAndLog("MAC must include 8 HEX symbols");

217 return 1;

218 }

219

220 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};

   memcpy(c.d.asBytes, MAC, 4);

222 SendCommand(&c);

223

224 return 0;

225 }

226

 int CmdHFiClassReader_Dump(const char *Cmd)

228 {

229 uint8_t readerType = 0;

   uint8_t MAC[4]={0x00,0x00,0x00,0x00};

   uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

   uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

   uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

234 //uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

   uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

   uint8_t keytable[128] = {0};

237 int elite = 0;

238 uint8_t *used_key;

239 int i;

   if (strlen(Cmd)<1) 

241 {

242 PrintAndLog("Usage: hf iclass dump <Key> [e]");

243 PrintAndLog(" Key - A 16 byte master key");

244 PrintAndLog(" e - If 'e' is specified, the key is interpreted as the 16 byte");

245 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");

246 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");

247 PrintAndLog(" sample: hf iclass dump 0011223344556677");

248

249

250 return 0;

251 }

252

   if (param_gethex(Cmd, 0, KEY, 16)) 

254 {

255 PrintAndLog("KEY must include 16 HEX symbols");

256 return 1;

257 }

258

   if (param_getchar(Cmd, 1) == 'e')

260 {

261 PrintAndLog("Elite switch on");

262 elite = 1;

263

264 //calc h2

265 hash2(KEY, keytable);

     printarr_human_readable("keytable", keytable, 128);

267

268 }

269

270 UsbCommand resp;

   uint8_t key_sel[8] = {0};

   uint8_t key_sel_p[8] = { 0 };

273

274 UsbCommand c = {CMD_READER_ICLASS, {0}};

   c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE| FLAG_ICLASS_READER_GET_CC;

276 SendCommand(&c);

277

278

279

   if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))

281 {

282 PrintAndLog("Command execute timeout");

283 return 0;

284 }

285

         uint8_t isOK    = resp.arg[0] & 0xff;

         uint8_t * data  = resp.d.asBytes;

288

         memcpy(CSN,data,8);

         memcpy(CCNR,data+8,8);

291

         PrintAndLog("isOk:%02x", isOK);

293

         if(isOK > 0)

295 {

                 PrintAndLog("CSN: %s",sprint_hex(CSN,8));

297 }

         if(isOK <= 1){

299 PrintAndLog("Failed to obtain CC! Aborting");

300 return 0;

301 }

302 //Status 2 or higher

303

304 if(elite)

305 {

306 //Get the key index (hash1)

                 uint8_t key_index[8] = {0};

308

309 hash1(CSN, key_index);

                 printvar("hash1", key_index,8);

                 for(i = 0; i < 8 ; i++)

                         key_sel[i] = keytable[key_index[i]] & 0xFF;

313 PrintAndLog("Pre-fortified 'permuted' HS key that would be needed by an iclass reader to talk to above CSN:");

                 printvar("k_sel", key_sel,8);

315 //Permute from iclass format to standard format

316 permutekey_rev(key_sel,key_sel_p);

317 used_key = key_sel_p;

318 }else{

319 used_key = KEY;

320 }

321

322 PrintAndLog("Pre-fortified key that would be needed by the OmniKey reader to talk to above CSN:");

         printvar("Used key",used_key,8);

         diversifyKey(CSN,used_key, div_key);

325 PrintAndLog("Hash0, a.k.a diversified key, that is computed using Ksel and stored in the card (Block 3):");

         printvar("Div key", div_key, 8);

         printvar("CC_NR:",CCNR,12);

         doMAC(CCNR,12,div_key, MAC);

         printvar("MAC", MAC, 4);

330

         uint8_t iclass_data[32000] = {0};

332 uint8_t iclass_datalen = 0;

         uint8_t iclass_blocksFailed = 0;//Set to 1 if dump was incomplete

334

335 UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};

         memcpy(d.d.asBytes, MAC, 4);

337 clearCommandBuffer();

338 SendCommand(&d);

339 PrintAndLog("Waiting for device to dump data. Press button on device and key on keyboard to abort...");

340 while (true) {

341 printf(".");

342 if (ukbhit()) {

343 getchar();

                         printf("\naborted via keyboard!\n");

345 break;

346 }

                 if(WaitForResponseTimeout(CMD_ACK,&resp,4500))

348 {

                         uint64_t dataLength = resp.arg[0];

                         iclass_blocksFailed |= resp.arg[1];

351

                         if(dataLength > 0)

353 {

                                 memcpy(iclass_data, resp.d.asBytes,dataLength);

355 iclass_datalen += dataLength;

356 }else

357 {//Last transfer, datalength 0 means the dump is finished

                                 PrintAndLog("Dumped %d bytes of data from tag. ", iclass_datalen);

359 if(iclass_blocksFailed)

360 {

361 PrintAndLog("OBS! Some blocks failed to be dumped correctly!");

362 }

                                 if(iclass_datalen > 0)

364 {

                                         char filename[100] = {0};

366 //create a preferred filename

                                         snprintf(filename, 100,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",

                                                          CSN[0],CSN[1],CSN[2],CSN[3],

                                                          CSN[4],CSN[5],CSN[6],CSN[7]);

                                         saveFile(filename,"bin",iclass_data, iclass_datalen );

371

372 }

373 //Aaaand we're finished

374 return 0;

375 }

376 }

377 }

378

379

380 return 0;

381 }

382

 int CmdHFiClass_iso14443A_write(const char *Cmd)

384 {

385 uint8_t readerType = 0;

   uint8_t MAC[4]={0x00,0x00,0x00,0x00};

   uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

   uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

   uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

   uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

391

392 uint8_t blockNo=0;

   uint8_t bldata[8]={0};

394

   if (strlen(Cmd)<3) 

396 {

397 PrintAndLog("Usage: hf iclass write <Key> <Block> <Data>");

398 PrintAndLog(" sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");

399 return 0;

400 }

401

   if (param_gethex(Cmd, 0, KEY, 16)) 

403 {

404 PrintAndLog("KEY must include 16 HEX symbols");

405 return 1;

406 }

407

   blockNo = param_get8(Cmd, 1);

   if (blockNo>32)

410 {

411 PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");

412 return 1;

413 }

   if (param_gethex(Cmd, 2, bldata, 8)) 

415 {

416 PrintAndLog("Block data must include 8 HEX symbols");

417 return 1;

418 }

419

420 UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};

421 SendCommand(&c);

422 UsbCommand resp;

423

   if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {

     uint8_t isOK    = resp.arg[0] & 0xff;

     uint8_t * data  = resp.d.asBytes;

427

     memcpy(CSN,data,8);

     memcpy(CCNR,data+8,8);

     PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));

     PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));

         PrintAndLog("isOk:%02x", isOK);

433 } else {

434 PrintAndLog("Command execute timeout");

435 }

436

   diversifyKey(CSN,KEY, div_key);

438

   PrintAndLog("Div Key: %s",sprint_hex(div_key,8));

   doMAC(CCNR, 12,div_key, MAC);

441

442 UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};

   memcpy(c2.d.asBytes, bldata, 8);

   memcpy(c2.d.asBytes+8, MAC, 4);

445 SendCommand(&c2);

446

   if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {

     uint8_t isOK    = resp.arg[0] & 0xff;

     uint8_t * data  = resp.d.asBytes;

450

451 if (isOK)

       PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));

453 else

       PrintAndLog("isOk:%02x", isOK);

455 } else {

456 PrintAndLog("Command execute timeout");

457 }

458 return 0;

459 }

 int CmdHFiClass_loclass(const char *Cmd)

461 {

         char opt = param_getchar(Cmd, 0);

463

         if (strlen(Cmd)<1 || opt == 'h') {

465 PrintAndLog("Usage: hf iclass loclass [options]");

466 PrintAndLog("Options:");

467 PrintAndLog("h Show this help");

468 PrintAndLog("t Perform self-test");

469 PrintAndLog("f <filename> Bruteforce iclass dumpfile");

470 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");

471 PrintAndLog(" malicious CSNs, and their protocol responses");

472 PrintAndLog(" The the binary format of the file is expected to be as follows: ");

473 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");

474 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");

475 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");

476 PrintAndLog(" ... totalling N*24 bytes");

477 return 0;

478 }

         char fileName[255] = {0};

         if(opt == 'f')

481 {

                         if(param_getstr(Cmd, 1, fileName) > 0)

483 {

484 return bruteforceFileNoKeys(fileName);

485 }else

486 {

487 PrintAndLog("You must specify a filename");

488 }

489 }

         else if(opt == 't')

491 {

492 int errors = testCipherUtils();

493 errors += testMAC();

                 errors += doKeyTests(0);

495 errors += testElite();

496 if(errors)

497 {

498 prnlog("OBS! There were errors!!!");

499 }

500 return errors;

501 }

502

503 return 0;

504 }

505

506 static command_t CommandTable[] =

507 {

         {"help",        CmdHelp,                        1,      "This help"},

         {"list",        CmdHFiClassList,        0,      "[Deprecated] List iClass history"},

         {"snoop",       CmdHFiClassSnoop,       0,      "Eavesdrop iClass communication"},

         {"sim", CmdHFiClassSim,         0,      "Simulate iClass tag"},

         {"reader",CmdHFiClassReader,    0,      "Read an iClass tag"},

         {"replay",CmdHFiClassReader_Replay,     0,      "Read an iClass tag via Reply Attack"},

         {"dump",        CmdHFiClassReader_Dump, 0,              "Authenticate and Dump iClass tag"},

         {"write",       CmdHFiClass_iso14443A_write,    0,      "Authenticate and Write iClass block"},

         {"loclass",     CmdHFiClass_loclass,    1,      "Use loclass to perform bruteforce of reader attack dump"},

         {NULL, NULL, 0, NULL}

518 };

519

 int CmdHFiClass(const char *Cmd)

521 {

522 CmdsParse(CommandTable, Cmd);

523 return 0;

524 }

525

 int CmdHelp(const char *Cmd)

527 {

528 CmdsHelp(CommandTable);

529 return 0;

530 }