//-----------------------------------------------------------------------------
// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
// Copyright (C) 2011 Gerhard de Koning Gans
-// Copyright (C) 2014 Midnitesnake & Andy Davies
+// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
int CmdHFiClassList(const char *Cmd)
{
-
bool ShowWaitCycles = false;
char param = param_getchar(Cmd, 0);
-
+
if (param != 0) {
PrintAndLog("List data in trace buffer.");
PrintAndLog("Usage: hf iclass list");
return 0;
}
- uint8_t got[1920];
- GetFromBigBuf(got,sizeof(got),0);
- WaitForResponse(CMD_ACK,NULL);
+// for the time being. Need better Bigbuf handling.
+#define TRACE_SIZE 3000
+
+ uint8_t trace[TRACE_SIZE];
+ GetFromBigBuf(trace, TRACE_SIZE, 0);
+ WaitForResponse(CMD_ACK, NULL);
PrintAndLog("Recorded Activity");
PrintAndLog("");
PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
PrintAndLog("");
- PrintAndLog(" Start | End | Src | Data");
- PrintAndLog("-----------|-----------|-----|--------");
-
- int i;
- uint32_t first_timestamp = 0;
+ PrintAndLog(" Start | End | Src | Data (! denotes parity error) | CRC ");
+ PrintAndLog("-----------|-----------|-----|-----------------------------------------------------------------------");
+
+ uint16_t tracepos = 0;
+ uint16_t duration;
+ uint16_t data_len;
+ uint16_t parity_len;
+ bool isResponse;
uint32_t timestamp;
- bool tagToReader;
- uint32_t parityBits;
- uint8_t len;
- uint8_t *frame;
- uint32_t EndOfTransmissionTimestamp = 0;
+ uint32_t first_timestamp;
+ uint32_t EndOfTransmissionTimestamp;
+
+ for (;;) {
+ if(tracepos >= TRACE_SIZE) {
+ break;
+ }
- for( i=0; i < 1900;)
- {
- //First 32 bits contain
- // isResponse (1 bit)
- // timestamp (remaining)
- //Then paritybits
- //Then length
- timestamp = *((uint32_t *)(got+i));
- parityBits = *((uint32_t *)(got+i+4));
- len = got[i+8];
- frame = (got+i+9);
- uint32_t next_timestamp = (*((uint32_t *)(got+i+9))) & 0x7fffffff;
-
- tagToReader = timestamp & 0x80000000;
- timestamp &= 0x7fffffff;
-
- if(i==0) {
+ timestamp = *((uint32_t *)(trace + tracepos));
+ if(tracepos == 0) {
first_timestamp = timestamp;
}
// Break and stick with current result if buffer was not completely full
- if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;
-
- char line[1000] = "";
-
- if(len)//We have some data to display
- {
- int j,oddparity;
+ if (timestamp == 0x44444444) break;
+
+ tracepos += 4;
+ duration = *((uint16_t *)(trace + tracepos));
+ tracepos += 2;
+ data_len = *((uint16_t *)(trace + tracepos));
+ tracepos += 2;
+
+ if (data_len & 0x8000) {
+ data_len &= 0x7fff;
+ isResponse = true;
+ } else {
+ isResponse = false;
+ }
- for(j = 0; j < len ; j++)
- {
- oddparity = 0x01 ^ xorbits_8(frame[j] & 0xFF);
+ parity_len = (data_len-1)/8 + 1;
- if (tagToReader && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
- sprintf(line+(j*4), "%02x! ", frame[j]);
- } else {
- sprintf(line+(j*4), "%02x ", frame[j]);
- }
+ if (tracepos + data_len + parity_len >= TRACE_SIZE) {
+ break;
+ }
+
+ uint8_t *frame = trace + tracepos;
+ tracepos += data_len;
+ uint8_t *parityBytes = trace + tracepos;
+ tracepos += parity_len;
+
+ char line[16][110];
+ for (int j = 0; j < data_len; j++) {
+ int oddparity = 0x01;
+ int k;
+
+ for (k=0;k<8;k++) {
+ oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
}
- }else
- {
- if (ShowWaitCycles) {
- sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
+
+ uint8_t parityBits = parityBytes[j>>3];
+ if (isResponse && (oddparity != ((parityBits >> (7-(j&0x0007))) & 0x01))) {
+ sprintf(line[j/16]+((j%16)*4), "%02x! ", frame[j]);
+ } else {
+ sprintf(line[j/16]+((j%16)*4), "%02x ", frame[j]);
}
- }
- char *crc = "";
+ }
- if(len > 2)
- {
+ char *crc = "";
+ if (data_len > 2) {
uint8_t b1, b2;
- if(!tagToReader && len == 4) {
+ if(!isResponse && data_len == 4 ) {
// Rough guess that this is a command from the reader
// For iClass the command byte is not part of the CRC
- ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
+ ComputeCrc14443(CRC_ICLASS, &frame[1], data_len-3, &b1, &b2);
+ if (b1 != frame[data_len-2] || b2 != frame[data_len-1]) {
+ crc = "!crc";
+ }
}
else {
- // For other data.. CRC might not be applicable (UPDATE commands etc.)
- ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
+ // For other data.. CRC might not be applicable (UPDATE commands etc.)
+ ComputeCrc14443(CRC_ICLASS, frame, data_len-2, &b1, &b2);
+ if (b1 != frame[data_len-2] || b2 != frame[data_len-1]) {
+ crc = "!crc";
+ }
}
+ }
- if (b1 != frame[len-2] || b2 != frame[len-1]) {
- crc = (tagToReader & (len < 8)) ? "" : " !crc";
+ EndOfTransmissionTimestamp = timestamp + duration;
+
+ int num_lines = (data_len - 1)/16 + 1;
+ for (int j = 0; j < num_lines; j++) {
+ if (j == 0) {
+ PrintAndLog(" %9d | %9d | %s | %-64s| %s",
+ (timestamp - first_timestamp),
+ (EndOfTransmissionTimestamp - first_timestamp),
+ (isResponse ? "Tag" : "Rdr"),
+ line[j],
+ (j == num_lines-1)?crc:"");
+ } else {
+ PrintAndLog(" | | | %-64s| %s",
+ line[j],
+ (j == num_lines-1)?crc:"");
+ }
+ }
+
+ bool next_isResponse = *((uint16_t *)(trace + tracepos + 6)) & 0x8000;
+
+ if (ShowWaitCycles && !isResponse && next_isResponse) {
+ uint32_t next_timestamp = *((uint32_t *)(trace + tracepos));
+ if (next_timestamp != 0x44444444) {
+ PrintAndLog(" %9d | %9d | %s | fdt (Frame Delay Time): %d",
+ (EndOfTransmissionTimestamp - first_timestamp),
+ (next_timestamp - first_timestamp),
+ " ",
+ (next_timestamp - EndOfTransmissionTimestamp));
}
}
-
- i += (len + 9);
- EndOfTransmissionTimestamp = (*((uint32_t *)(got+i))) & 0x7fffffff;
-
- // Not implemented for iclass on the ARM-side
- //if (!ShowWaitCycles) i += 9;
-
- PrintAndLog(" %9d | %9d | %s | %s %s",
- (timestamp - first_timestamp),
- (EndOfTransmissionTimestamp - first_timestamp),
- (len?(tagToReader ? "Tag" : "Rdr"):" "),
- line, crc);
+
}
+
return 0;
}
-int CmdHFiClassListOld(const char *Cmd)
-{
- uint8_t got[1920];
- GetFromBigBuf(got,sizeof(got),0);
-
- PrintAndLog("recorded activity:");
- PrintAndLog(" ETU :rssi: who bytes");
- PrintAndLog("---------+----+----+-----------");
-
- int i = 0;
- int prev = -1;
-
- for (;;) {
- if(i >= 1900) {
- break;
- }
-
- bool isResponse;
- int timestamp = *((uint32_t *)(got+i));
- if (timestamp & 0x80000000) {
- timestamp &= 0x7fffffff;
- isResponse = 1;
- } else {
- isResponse = 0;
- }
-
-
- int metric = 0;
-
- int parityBits = *((uint32_t *)(got+i+4));
- // 4 bytes of additional information...
- // maximum of 32 additional parity bit information
- //
- // TODO:
- // at each quarter bit period we can send power level (16 levels)
- // or each half bit period in 256 levels.
-
-
- int len = got[i+8];
-
- if (len > 100) {
- break;
- }
- if (i + len >= 1900) {
- break;
- }
-
- uint8_t *frame = (got+i+9);
-
- // Break and stick with current result if buffer was not completely full
- if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }
-
- char line[1000] = "";
- int j;
- for (j = 0; j < len; j++) {
- int oddparity = 0x01;
- int k;
-
- for (k=0;k<8;k++) {
- oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
- }
-
- //if((parityBits >> (len - j - 1)) & 0x01) {
- if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
- sprintf(line+(j*4), "%02x! ", frame[j]);
- }
- else {
- sprintf(line+(j*4), "%02x ", frame[j]);
- }
- }
-
- char *crc;
- crc = "";
- if (len > 2) {
- uint8_t b1, b2;
- for (j = 0; j < (len - 1); j++) {
- // gives problems... search for the reason..
- /*if(frame[j] == 0xAA) {
- switch(frame[j+1]) {
- case 0x01:
- crc = "[1] Two drops close after each other";
- break;
- case 0x02:
- crc = "[2] Potential SOC with a drop in second half of bitperiod";
- break;
- case 0x03:
- crc = "[3] Segment Z after segment X is not possible";
- break;
- case 0x04:
- crc = "[4] Parity bit of a fully received byte was wrong";
- break;
- default:
- crc = "[?] Unknown error";
- break;
- }
- break;
- }*/
- }
-
- if (strlen(crc)==0) {
- if(!isResponse && len == 4) {
- // Rough guess that this is a command from the reader
- // For iClass the command byte is not part of the CRC
- ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
- }
- else {
- // For other data.. CRC might not be applicable (UPDATE commands etc.)
- ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
- }
- //printf("%1x %1x",(unsigned)b1,(unsigned)b2);
- if (b1 != frame[len-2] || b2 != frame[len-1]) {
- crc = (isResponse & (len < 8)) ? "" : " !crc";
- } else {
- crc = "";
- }
- }
- } else {
- crc = ""; // SHORT
- }
-
- char metricString[100];
- if (isResponse) {
- sprintf(metricString, "%3d", metric);
- } else {
- strcpy(metricString, " ");
- }
-
- PrintAndLog(" +%7d: %s: %s %s %s",
- (prev < 0 ? 0 : (timestamp - prev)),
- metricString,
- (isResponse ? "TAG" : " "), line, crc);
-
- prev = timestamp;
- i += (len + 9);
- }
- return 0;
-}
-
int CmdHFiClassSnoop(const char *Cmd)
{
UsbCommand c = {CMD_SNOOP_ICLASS};
SendCommand(&c);
return 0;
}
-
+#define NUM_CSNS 15
int CmdHFiClassSim(const char *Cmd)
{
uint8_t simType = 0;
if(simType == 2)
{
- UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,63}};
+ UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
UsbCommand resp = {0};
- uint8_t csns[64] = {
+ /*uint8_t csns[8 * NUM_CSNS] = {
0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,
0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,
0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,
0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,
0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,
0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };
-
- memcpy(c.d.asBytes, csns, 64);
+*/
+
+ uint8_t csns[8*NUM_CSNS] = {
+ 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
+
+ memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
SendCommand(&c);
if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
}
uint8_t num_mac_responses = resp.arg[1];
- PrintAndLog("Mac responses: %d MACs obtained (should be 8)", num_mac_responses);
+ PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
- size_t datalen = 8*24;
+ size_t datalen = NUM_CSNS*24;
/*
* Now, time to dump to file. We'll use this format:
* <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
void* dump = malloc(datalen);
memset(dump,0,datalen);//<-- Need zeroes for the CC-field
uint8_t i = 0;
- for(i = 0 ; i < 8 ; i++)
+ for(i = 0 ; i < NUM_CSNS ; i++)
{
memcpy(dump+i*24, csns+i*8,8); //CSN
//8 zero bytes here...
int CmdHFiClassReader(const char *Cmd)
{
- uint8_t readerType = 0;
-
- if (strlen(Cmd)<1) {
- PrintAndLog("Usage: hf iclass reader <reader type>");
- PrintAndLog(" sample: hf iclass reader 0");
- return 0;
- }
-
- readerType = param_get8(Cmd, 0);
- PrintAndLog("--readertype:%02x", readerType);
-
- UsbCommand c = {CMD_READER_ICLASS, {readerType}};
+ UsbCommand c = {CMD_READER_ICLASS, {0}};
SendCommand(&c);
+ UsbCommand resp;
+ while(!ukbhit()){
+ if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
+ uint8_t isOK = resp.arg[0] & 0xff;
+ uint8_t * data = resp.d.asBytes;
+
+ PrintAndLog("isOk:%02x", isOK);
+
+ if(isOK > 0)
+ {
+ PrintAndLog("CSN: %s",sprint_hex(data,8));
+ }
+ if(isOK >= 1)
+ {
+ PrintAndLog("CC: %s",sprint_hex(data+8,8));
+ }else{
+ PrintAndLog("No CC obtained");
+ }
+ } else {
+ PrintAndLog("Command execute timeout");
+ }
+ }
return 0;
}
uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
//uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
-
+ uint8_t keytable[128] = {0};
+ int elite = 0;
+ uint8_t *used_key;
+ int i;
if (strlen(Cmd)<1)
{
- //PrintAndLog("Usage: hf iclass dump <Key> <CSN> <CC>");
- //PrintAndLog(" sample: hf iclass dump 0011223344556677 aabbccddeeffgghh FFFFFFFFFFFFFFFF");
- PrintAndLog("Usage: hf iclass dump <Key>");
+ PrintAndLog("Usage: hf iclass dump <Key> [e]");
+ PrintAndLog(" Key - A 16 byte master key");
+ PrintAndLog(" e - If 'e' is specified, the key is interpreted as the 16 byte");
+ PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
+ PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
PrintAndLog(" sample: hf iclass dump 0011223344556677");
+
+
return 0;
}
PrintAndLog("KEY must include 16 HEX symbols");
return 1;
}
-
- /*if (param_gethex(Cmd, 1, CSN, 16))
+
+ if (param_getchar(Cmd, 1) == 'e')
{
- PrintAndLog("CSN must include 16 HEX symbols");
- return 1;
+ PrintAndLog("Elite switch on");
+ elite = 1;
+
+ //calc h2
+ hash2(KEY, keytable);
+ printarr_human_readable("keytable", keytable, 128);
+
}
- if (param_gethex(Cmd, 2, CC_temp, 16))
+
+ UsbCommand resp;
+ uint8_t key_sel[8] = {0};
+ uint8_t key_sel_p[8] = { 0 };
+
+ //HACK -- Below is for testing without access to a tag
+ uint8_t fake_dummy_test = false;
+ if(fake_dummy_test)
{
- PrintAndLog("CC must include 16 HEX symbols");
- return 1;
- }*/
+ uint8_t xdata[16] = {0x01,0x02,0x03,0x04,0xF7,0xFF,0x12,0xE0, //CSN from http://www.proxmark.org/forum/viewtopic.php?pid=11230#p11230
+ 0xFE,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF}; // Just a random CC. Would be good to add a real testcase here
+ memcpy(resp.d.asBytes,xdata, 16);
+ resp.arg[0] = 2;
+ }
- UsbCommand c = {CMD_ICLASS_ISO14443A_GETPUBLIC, {0}};
- //memcpy(c.d.asBytes, MAC, 4);
- SendCommand(&c);
+ //End hack
+
+
+ UsbCommand c = {CMD_READER_ICLASS, {0}};
+ c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE;
+ if(!fake_dummy_test)
+ SendCommand(&c);
- UsbCommand resp;
- if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
- uint8_t isOK = resp.arg[0] & 0xff;
- uint8_t * data = resp.d.asBytes;
-
- memcpy(CSN,data,8);
- memcpy(CCNR,data+8,8);
- PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
- PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
- PrintAndLog("isOk:%02x", isOK);
- } else {
- PrintAndLog("Command execute timeout");
- }
- diversifyKey(CSN,KEY, div_key);
- doMAC(CCNR,div_key, MAC);
+ if (fake_dummy_test || WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
+ uint8_t isOK = resp.arg[0] & 0xff;
+ uint8_t * data = resp.d.asBytes;
- UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
- memcpy(d.d.asBytes, MAC, 4);
- SendCommand(&d);
+ memcpy(CSN,data,8);
+ memcpy(CCNR,data+8,8);
+
+ PrintAndLog("isOk:%02x", isOK);
+
+ if(isOK > 0)
+ {
+ PrintAndLog("CSN: %s",sprint_hex(CSN,8));
+ }
+ if(isOK > 1)
+ {
+ if(elite)
+ {
+ //Get the key index (hash1)
+ uint8_t key_index[8] = {0};
+
+ hash1(CSN, key_index);
+ printvar("hash1", key_index,8);
+ for(i = 0; i < 8 ; i++)
+ key_sel[i] = keytable[key_index[i]] & 0xFF;
+ PrintAndLog("Pre-fortified 'permuted' HS key that would be needed by an iclass reader to talk to above CSN:");
+ printvar("k_sel", key_sel,8);
+ //Permute from iclass format to standard format
+ permutekey_rev(key_sel,key_sel_p);
+ used_key = key_sel_p;
+ }else{
+ //Perhaps this should also be permuted to std format?
+ // Something like the code below? I have no std system
+ // to test this with /Martin
+
+ //uint8_t key_sel_p[8] = { 0 };
+ //permutekey_rev(KEY,key_sel_p);
+ //used_key = key_sel_p;
+
+ used_key = KEY;
+
+ }
+
+ PrintAndLog("Pre-fortified key that would be needed by the OmniKey reader to talk to above CSN:");
+ printvar("Used key",used_key,8);
+ diversifyKey(CSN,used_key, div_key);
+ PrintAndLog("Hash0, a.k.a diversified key, that is computed using Ksel and stored in the card (Block 3):");
+ printvar("Div key", div_key, 8);
+ printvar("CC_NR:",CCNR,12);
+ doMAC(CCNR,12,div_key, MAC);
+ printvar("MAC", MAC, 4);
+
+ UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
+ memcpy(d.d.asBytes, MAC, 4);
+ if(!fake_dummy_test) SendCommand(&d);
+
+ }else{
+ PrintAndLog("Failed to obtain CC! Aborting");
+ }
+ } else {
+ PrintAndLog("Command execute timeout");
+ }
return 0;
}
return 1;
}
- UsbCommand c = {CMD_ICLASS_ISO14443A_GETPUBLIC, {0}};
+ UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};
SendCommand(&c);
UsbCommand resp;
diversifyKey(CSN,KEY, div_key);
PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
- doMAC(CCNR, div_key, MAC);
+ doMAC(CCNR, 12,div_key, MAC);
UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
memcpy(c2.d.asBytes, bldata, 8);
projects / proxmark3-svn / blobdiff