Added the changes to armsrc for milfare ultralight C and Desfire commands

[proxmark3-svn] / client / cmdhficlass.c

diff --git a/client/cmdhficlass.c b/client/cmdhficlass.c
index 9f6842b8109d6a52f820ea86daa3904034409d24..21297b5ee83e04e3fa75af77adaa76aad81b7006 100644 (file)
--- a/client/cmdhficlass.c
+++ b/client/cmdhficlass.c
@@ -1,6 +1,7 @@
 //-----------------------------------------------------------------------------
 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
 // Copyright (C) 2011 Gerhard de Koning Gans
 //-----------------------------------------------------------------------------
 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
 // Copyright (C) 2011 Gerhard de Koning Gans

+// Copyright (C) 2014 Midnitesnake & Andy Davies

 //
 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
 // at your option, any later version. See the LICENSE.txt file for the text of
 //
 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
 // at your option, any later version. See the LICENSE.txt file for the text of


@@ -21,139 +22,14 @@
 #include "cmdhficlass.h"
 #include "common.h"
 #include "util.h"
 #include "cmdhficlass.h"
 #include "common.h"
 #include "util.h"

-#include "cmdmain.h"
+#include "loclass/des.h"
+#include "loclass/cipherutils.h"
+#include "loclass/cipher.h"
+#include "loclass/ikeys.h"

 
 static int CmdHelp(const char *Cmd);
 
 
 static int CmdHelp(const char *Cmd);
 

-int xorbits_8(uint8_t val)
-{
-       uint8_t res = val ^ (val >> 1); //1st pass
-       res = res ^ (res >> 1);                 // 2nd pass
-       res = res ^ (res >> 2);                 // 3rd pass
-       res = res ^ (res >> 4);                         // 4th pass
-       return res & 1;
-}
-

 int CmdHFiClassList(const char *Cmd)
 int CmdHFiClassList(const char *Cmd)

-{
-
-       bool ShowWaitCycles = false;
-       char param = param_getchar(Cmd, 0);
-
-       if (param != 0) {
-               PrintAndLog("List data in trace buffer.");
-               PrintAndLog("Usage:  hf iclass list");
-               PrintAndLog("h - help");
-               PrintAndLog("sample: hf iclass list");
-               return 0;
-       }
-
-       uint8_t got[1920];
-       GetFromBigBuf(got,sizeof(got),0);
-       WaitForResponse(CMD_ACK,NULL);
-
-       PrintAndLog("Recorded Activity");
-       PrintAndLog("");
-       PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
-       PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
-       PrintAndLog("");
-       PrintAndLog("     Start |       End | Src | Data");
-       PrintAndLog("-----------|-----------|-----|--------");
-
-       int i;
-       uint32_t first_timestamp = 0;
-       uint32_t timestamp;
-       bool tagToReader;
-       uint32_t parityBits;
-       uint8_t len;
-       uint8_t *frame;
-       uint32_t EndOfTransmissionTimestamp = 0;
-
-       uint8_t empty[4] = {0x44,0x44,0x44,0x44};
-
-       for( i=0; i < 1900;)
-       {
-               //First 32 bits contain
-               // isResponse (1 bit)
-               // timestamp (remaining)
-               //Then paritybits
-               //Then length
-               timestamp = *((uint32_t *)(got+i));
-               parityBits = *((uint32_t *)(got+i+4));
-               len = got[i+8];
-               frame = (got+i+9);
-               uint32_t next_timestamp = (*((uint32_t *)(got+i+9))) & 0x7fffffff;
-
-               tagToReader = timestamp & 0x80000000;
-               timestamp &= 0x7fffffff;
-
-               if(i==0) {
-                       first_timestamp = timestamp;
-               }
-
-               // Break and stick with current result if buffer
-               // was not completely full
-               if(memcmp(frame,empty,sizeof(empty))) break;
-
-               char line[1000] = "";
-
-               if(len)//We have some data to display
-               {
-                       int j,oddparity;
-
-                       for(j = 0; j < len ; j++)
-                       {
-                               oddparity = 0x01 ^ xorbits_8(frame[j] & 0xFF);
-
-                               if (tagToReader && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
-                                       sprintf(line+(j*4), "%02x!  ", frame[j]);
-                               } else {
-                                       sprintf(line+(j*4), "%02x   ", frame[j]);
-                               }
-                       }
-               }else
-               {
-                       if (ShowWaitCycles) {
-                               sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
-                       }
-               }
-
-               char *crc = "";
-
-               if(len > 2)
-               {
-                       uint8_t b1, b2;
-                       if(!tagToReader && len == 4) {
-                               // Rough guess that this is a command from the reader
-                               // For iClass the command byte is not part of the CRC
-                                       ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
-                       }
-                       else {
-                                 // For other data.. CRC might not be applicable (UPDATE commands etc.)
-                               ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
-                       }
-
-                       if (b1 != frame[len-2] || b2 != frame[len-1]) {
-                               crc = (tagToReader & (len < 8)) ? "" : " !crc";
-                       }
-               }
-
-               i += (len + 9);
-               EndOfTransmissionTimestamp = (*((uint32_t *)(got+i))) & 0x7fffffff;
-
-               // Not implemented for iclass on the ARM-side
-               //if (!ShowWaitCycles) i += 9;
-
-               PrintAndLog(" %9d | %9d | %s | %s %s",
-                       (timestamp - first_timestamp),
-                       (EndOfTransmissionTimestamp - first_timestamp),
-                       (len?(tagToReader ? "Tag" : "Rdr"):"   "),
-                       line, crc);
-       }
-       return 0;
-}
-
-int CmdHFiClassListOld(const char *Cmd)

 {
   uint8_t got[1920];
   GetFromBigBuf(got,sizeof(got),0);
 {
   uint8_t got[1920];
   GetFromBigBuf(got,sizeof(got),0);


@@ -179,9 +55,7 @@ int CmdHFiClassListOld(const char *Cmd)
       isResponse = 0;
     }
 
       isResponse = 0;
     }
 

-

     int metric = 0;
     int metric = 0;

-

     int parityBits = *((uint32_t *)(got+i+4));
     // 4 bytes of additional information...
     // maximum of 32 additional parity bit information
     int parityBits = *((uint32_t *)(got+i+4));
     // 4 bytes of additional information...
     // maximum of 32 additional parity bit information


@@ -291,11 +165,6 @@ int CmdHFiClassListOld(const char *Cmd)
   return 0;
 }
 
   return 0;
 }
 

-/*void iso14a_set_timeout(uint32_t timeout) {
-       UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_SET_TIMEOUT, 0, timeout}};
-       SendCommand(&c);
-}*/
-

 int CmdHFiClassSnoop(const char *Cmd)
 {
   UsbCommand c = {CMD_SNOOP_ICLASS};
 int CmdHFiClassSnoop(const char *Cmd)
 {
   UsbCommand c = {CMD_SNOOP_ICLASS};


@@ -308,88 +177,23 @@ int CmdHFiClassSim(const char *Cmd)
   uint8_t simType = 0;
   uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
 
   uint8_t simType = 0;
   uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
 

-  if (strlen(Cmd)<1) {
-       PrintAndLog("Usage:  hf iclass sim [0 <CSN>] | x");
-       PrintAndLog("        options");
-       PrintAndLog("                0 <CSN> simulate the given CSN");
-       PrintAndLog("                1       simulate default CSN");
-       PrintAndLog("                2       iterate CSNs, gather MACs");
+  if (strlen(Cmd)<2) {
+       PrintAndLog("Usage:  hf iclass sim    <sim type> <CSN (16 hex symbols)>");

        PrintAndLog("        sample: hf iclass sim 0 031FEC8AF7FF12E0");
        PrintAndLog("        sample: hf iclass sim 0 031FEC8AF7FF12E0");

-       PrintAndLog("        sample: hf iclass sim 2");

        return 0;
   }    
 
   simType = param_get8(Cmd, 0);
        return 0;
   }    
 
   simType = param_get8(Cmd, 0);

-
-  if(simType == 0)
-  {
-         if (param_gethex(Cmd, 1, CSN, 16)) {
-                 PrintAndLog("A CSN should consist of 16 HEX symbols");
-                 return 1;
-         }
-         PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
-
-  }
-  if(simType > 2)
-  {
-         PrintAndLog("Undefined simptype %d", simType);
-         return 1;
+  if (param_gethex(Cmd, 1, CSN, 16)) {
+       PrintAndLog("A CSN should consist of 16 HEX symbols");
+       return 1;

   }
   }

-  uint8_t numberOfCSNs=0;
+  PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));

 
 

-  UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
+  UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType}};

   memcpy(c.d.asBytes, CSN, 8);
   memcpy(c.d.asBytes, CSN, 8);

-
-  if(simType == 2)
-  {
-         c.arg[1] = 10;//10 CSNs
-         uint8_t csns[] ={
-                         /* Order    Simulated CSN                               HASH1           Recovered key bytes */
-                         /*   1   */ 0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0,// 0101000045014545 00,01 45
-                         /*   2   */  0x03,0x0B,0x0E,0xFE,0xF7,0xFF,0x12,0xE0,// 0202000045014545 02
-                         /*   3   */  0x04,0x0D,0x0D,0xFD,0xF7,0xFF,0x12,0xE0,// 0303000045014545 03
-                         /*   4   */  0x04,0x0F,0x0F,0xF7,0xF7,0xFF,0x12,0xE0,// 0901000045014545 09
-                         /*   5   */  0x01,0x13,0x10,0xF4,0xF7,0xFF,0x12,0xE0,// 0C00000045014545 0C
-                         /*   6   */  0x02,0x14,0x10,0xF2,0xF7,0xFF,0x12,0xE0,// 0E00000045014545 0E
-                         /*   7   */  0x05,0x17,0x10,0xEC,0xF7,0xFF,0x12,0xE0,// 1400000045014545 14
-                         /*   8   */  0x00,0x6B,0x6F,0xDF,0xF7,0xFF,0x12,0xE0,// 2121000045014545 21
-                         /*   9   */  0x03,0x6B,0x6E,0xDE,0xF7,0xFF,0x12,0xE0,// 2222000045014545 22
-                         /*   10  */  0x04,0x6D,0x6D,0xDD,0xF7,0xFF,0x12,0xE0,// 2323000045014545 23
-                         /*   11  */  0x00,0x4F,0x4B,0x43,0xF7,0xFF,0x12,0xE0,// 3D45000045014545 3D
-                         /*   12  */  0x00,0x4B,0x4F,0x3F,0xF7,0xFF,0x12,0xE0,// 4141000045014545 41
-                         /*   13  */  0x03,0x4B,0x4E,0x3E,0xF7,0xFF,0x12,0xE0,// 4242000045014545 42
-                         /*   14  */  0x04,0x4D,0x4D,0x3D,0xF7,0xFF,0x12,0xE0,// 4343000045014545 43
-                         /*   15  */  0x04,0x37,0x37,0x7F,0xF7,0xFF,0x12,0xE0,// 0159000045014545 59
-                         /*   16  */  0x00,0x2B,0x2F,0x9F,0xF7,0xFF,0x12,0xE0,// 6161000045014545 61
-                         /*   17  */  0x03,0x2B,0x2E,0x9E,0xF7,0xFF,0x12,0xE0,// 6262000045014545 62
-                         /*   18  */  0x04,0x2D,0x2D,0x9D,0xF7,0xFF,0x12,0xE0,// 6363000045014545 63
-                         /*   19  */  0x00,0x27,0x23,0xBB,0xF7,0xFF,0x12,0xE0,// 456D000045014545 6D
-                         /*   20  */  0x02,0x52,0xAA,0x80,0xF7,0xFF,0x12,0xE0,// 0066000045014545 66
-                         /*   21  */  0x00,0x5C,0xA6,0x80,0xF7,0xFF,0x12,0xE0,// 006A000045014545 6A
-                         /*   22  */  0x01,0x5F,0xA4,0x80,0xF7,0xFF,0x12,0xE0,// 006C000045014545 6C
-                         /*   23  */  0x06,0x5E,0xA2,0x80,0xF7,0xFF,0x12,0xE0,// 006E000045014545 6E
-                         /*   24  */  0x02,0x0E,0x0E,0xFC,0xF7,0xFF,0x12,0xE0,// 0402000045014545 04
-                         /*   25  */  0x05,0x0D,0x0E,0xFA,0xF7,0xFF,0x12,0xE0,// 0602000045014545 06
-                         /*   26  */  0x06,0x0F,0x0D,0xF9,0xF7,0xFF,0x12,0xE0,// 0703000045014545 07
-                         /*   27  */  0x00,0x01,0x05,0x1D,0xF7,0xFF,0x12,0xE0,// 630B000045014545 0B
-                         /*   28  */  0x02,0x07,0x01,0x1D,0xF7,0xFF,0x12,0xE0,// 630F000045014545 0F
-                         /*   29  */  0x04,0x7F,0x7F,0xA7,0xF7,0xFF,0x12,0xE0,// 5911000045014545 11
-                         /*   30  */  0x04,0x60,0x6E,0xE8,0xF7,0xFF,0x12,0xE0,// 1822000045014545 18
-                       };
-         memcpy(c.d.asBytes, csns, sizeof(c.d.asBytes));
-
-  }
-

   SendCommand(&c);
 
   SendCommand(&c);
 

-  /*UsbCommand * resp = WaitForResponseTimeout(CMD_ACK, 1500);
-  if (resp != NULL) {
-       uint8_t                isOK  = resp->arg[0] & 0xff;
-       PrintAndLog("isOk:%02x", isOK);
-  } else {
-       PrintAndLog("Command execute timeout");
-  }*/
-

   return 0;
 }
 
   return 0;
 }
 


@@ -407,27 +211,130 @@ int CmdHFiClassReader(const char *Cmd)
   PrintAndLog("--readertype:%02x", readerType);
 
   UsbCommand c = {CMD_READER_ICLASS, {readerType}};
   PrintAndLog("--readertype:%02x", readerType);
 
   UsbCommand c = {CMD_READER_ICLASS, {readerType}};

-  //memcpy(c.d.asBytes, CSN, 8);

   SendCommand(&c);
 
   SendCommand(&c);
 

-  /*UsbCommand * resp = WaitForResponseTimeout(CMD_ACK, 1500);
-  if (resp != NULL) {
-       uint8_t                isOK  = resp->arg[0] & 0xff;
+  return 0;
+}
+
+int CmdHFiClassReader_Replay(const char *Cmd)
+{
+  uint8_t readerType = 0;
+  uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
+
+  if (strlen(Cmd)<1) {
+    PrintAndLog("Usage:  hf iclass replay <MAC>");
+    PrintAndLog("        sample: hf iclass replay 00112233");
+    return 0;
+  }
+
+  if (param_gethex(Cmd, 0, MAC, 8)) {
+    PrintAndLog("MAC must include 8 HEX symbols");
+    return 1;
+  }
+
+  UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
+  memcpy(c.d.asBytes, MAC, 4);
+  SendCommand(&c);
+
+  return 0;
+}
+
+int CmdHFiClassReader_Dump(const char *Cmd)
+{
+  uint8_t readerType = 0;
+  uint8_t MAC[4]={0x00,0x00,0x00,0x00};
+  uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+  uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+  uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+  //uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+  uint8_t result[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+  uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+  des_context ctx_enc;
+  uint64_t crypted_id=0;
+
+  if (strlen(Cmd)<1) 
+  {
+    //PrintAndLog("Usage:  hf iclass dump <Key> <CSN> <CC>");
+    //PrintAndLog("        sample: hf iclass dump 0011223344556677 aabbccddeeffgghh FFFFFFFFFFFFFFFF");
+    PrintAndLog("Usage:  hf iclass dump <Key>");
+    PrintAndLog("        sample: hf iclass dump 0011223344556677");
+    return 0;
+  }
+
+  if (param_gethex(Cmd, 0, KEY, 16)) 
+  {
+    PrintAndLog("KEY must include 16 HEX symbols");
+    return 1;
+  }
+  
+  /*if (param_gethex(Cmd, 1, CSN, 16)) 
+  {
+    PrintAndLog("CSN must include 16 HEX symbols");
+    return 1;
+  }
+  if (param_gethex(Cmd, 2, CC_temp, 16)) 
+  {
+    PrintAndLog("CC must include 16 HEX symbols");
+    return 1;
+  }*/
+  
+  UsbCommand c = {CMD_ICLASS_ISO14443A_GETPUBLIC, {0}};
+  //memcpy(c.d.asBytes, MAC, 4);
+  SendCommand(&c);
+  
+  UsbCommand resp;
+  if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
+    uint8_t isOK    = resp.arg[0] & 0xff;
+    uint8_t * data  = resp.d.asBytes;
+    
+    memcpy(CSN,data,8);
+    memcpy(CCNR,data+8,8);
+    PrintAndLog("DEBUG: CSN %s",sprint_hex(CSN,8));
+    PrintAndLog("DEBUG: CC  %s",sprint_hex(CCNR,8));

        PrintAndLog("isOk:%02x", isOK);
   } else {
        PrintAndLog("Command execute timeout");
        PrintAndLog("isOk:%02x", isOK);
   } else {
        PrintAndLog("Command execute timeout");

-  }*/
+  }
+  
+  //memcpy(CCNR,CC_temp,8);
+  des_setkey_enc( &ctx_enc, KEY);
+  des_crypt_ecb(&ctx_enc,CSN,result);
+  PrintAndLog("DES Key: %s",sprint_hex(result,8));
+  uint64_t newz=0;
+  crypted_id = bytes_to_num(result,8);
+  uint64_t x = (crypted_id & 0xFFFF000000000000 );
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,0),7);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,1),6);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,2),5);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,3),4);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,4),3);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,5),2);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,6),1);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,7),0);
+  newz|= x;
+  crypted_id=newz;
+  num_to_bytes(crypted_id,8,result);
+  PrintAndLog("DESr Key: %s",sprint_hex(result,8));    
+  hash0(crypted_id,div_key);
+  PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
+  calc_iclass_mac(CCNR,12,div_key,MAC);
+
+  UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
+  memcpy(d.d.asBytes, MAC, 4);
+  SendCommand(&d);

 
   return 0;
 }
 
 static command_t CommandTable[] = 
 {
 
   return 0;
 }
 
 static command_t CommandTable[] = 
 {

-  {"help",    CmdHelp,        1, "This help"},
-  {"list",    CmdHFiClassList,   0, "List iClass history"},
-  {"snoop",   CmdHFiClassSnoop,  0, "Eavesdrop iClass communication"},
-  {"sim",     CmdHFiClassSim,    0, "Simulate iClass tag"},
-  {"reader",  CmdHFiClassReader, 0, "Read an iClass tag"},
+  {"help",     CmdHelp,                1,      "This help"},
+  {"list",     CmdHFiClassList,        0,      "List iClass history"},
+  {"snoop",    CmdHFiClassSnoop,       0,      "Eavesdrop iClass communication"},
+  {"sim",      CmdHFiClassSim,         0,      "Simulate iClass tag"},
+  {"reader",   CmdHFiClassReader,      0,      "Read an iClass tag"},
+  {"replay",   CmdHFiClassReader_Replay,0,     "Read an iClass tag via Reply Attack"},
+  {"dump",     CmdHFiClassReader_Dump, 0,      "Authenticate and Dump iClass tag"},

   {NULL, NULL, 0, NULL}
 };
 
   {NULL, NULL, 0, NULL}
 };
 


@@ -442,3 +349,4 @@ int CmdHelp(const char *Cmd)
   CmdsHelp(CommandTable);
   return 0;
 }
   CmdsHelp(CommandTable);
   return 0;
 }

+