PCF7931: improved read code and implemented a simple password bruteforce (#745)

[proxmark3-svn] / client / emv / emvcore.c

diff --git a/client/emv/emvcore.c b/client/emv/emvcore.c
index 98ecc5b04ba8d43c4ca4c4965d0782682eb2b8fb..04d8f44c2af036c6c683c4e95b4116f0f38a415c 100644 (file)
--- a/client/emv/emvcore.c
+++ b/client/emv/emvcore.c
@@ -11,6 +11,9 @@
 #include "emvcore.h"
 #include "emvjson.h"
 #include "util_posix.h"
 #include "emvcore.h"
 #include "emvjson.h"
 #include "util_posix.h"

+#ifdef WITH_SMARTCARD
+#include "cmdsmartcard.h"
+#endif

 
 // Got from here. Thanks)
 // https://eftlab.co.uk/index.php/site-map/knowledge-base/211-emv-aid-rid-pix
 
 // Got from here. Thanks)
 // https://eftlab.co.uk/index.php/site-map/knowledge-base/211-emv-aid-rid-pix


@@ -230,12 +233,13 @@ struct tlvdb *GetdCVVRawFromTrack2(const struct tlv *track2) {
   return tlvdb_fixed(0x02, dCVVlen, dCVV);
 }
 
   return tlvdb_fixed(0x02, dCVVlen, dCVV);
 }
 

-int EMVExchangeEx(bool ActivateField, bool LeaveFieldON, sAPDU apdu, bool IncludeLe, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
+int EMVExchangeEx(EMVCommandChannel channel, bool ActivateField, bool LeaveFieldON, sAPDU apdu, bool IncludeLe, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {

        uint8_t data[APDU_RES_LEN] = {0};
 
        *ResultLen = 0;
        if (sw) *sw = 0;
        uint16_t isw = 0;
        uint8_t data[APDU_RES_LEN] = {0};
 
        *ResultLen = 0;
        if (sw) *sw = 0;
        uint16_t isw = 0;

+       int res = 0;

        
        if (ActivateField){
                DropField();
        
        if (ActivateField){
                DropField();


@@ -250,25 +254,46 @@ int EMVExchangeEx(bool ActivateField, bool LeaveFieldON, sAPDU apdu, bool Includ
        if (APDULogging)
                PrintAndLog(">>>> %s", sprint_hex(data, (IncludeLe?6:5) + apdu.Lc));
 
        if (APDULogging)
                PrintAndLog(">>>> %s", sprint_hex(data, (IncludeLe?6:5) + apdu.Lc));
 

-       // 6 byes + data = INS + CLA + P1 + P2 + Lc + <data = Nc> + Le(?IncludeLe)
-       int res = ExchangeAPDU14a(data, (IncludeLe?6:5) + apdu.Lc, ActivateField, LeaveFieldON, Result, (int)MaxResultLen, (int *)ResultLen);
-       
-       if (res) {
-               return res;
+       switch(channel) {
+       case ECC_CONTACTLESS:
+               // 6 byes + data = INS + CLA + P1 + P2 + Lc + <data = Nc> + Le(?IncludeLe)
+               res = ExchangeAPDU14a(data, (IncludeLe?6:5) + apdu.Lc, ActivateField, LeaveFieldON, Result, (int)MaxResultLen, (int *)ResultLen);
+               if (res) {
+                       return res;
+               }
+               break;
+       case ECC_CONTACT:
+               //int ExchangeAPDUSC(uint8_t *datain, int datainlen, bool activateCard, bool leaveSignalON, uint8_t *dataout, int maxdataoutlen, int *dataoutlen);
+#ifdef WITH_SMARTCARD          
+               res = ExchangeAPDUSC(data, (IncludeLe?6:5) + apdu.Lc, ActivateField, LeaveFieldON, Result, (int)MaxResultLen, (int *)ResultLen);
+               if (res) {
+                       return res;
+               }
+#endif
+               break;

        }
 
        if (APDULogging)
                PrintAndLog("<<<< %s", sprint_hex(Result, *ResultLen));
 
        }
 
        if (APDULogging)
                PrintAndLog("<<<< %s", sprint_hex(Result, *ResultLen));
 

+       if (*ResultLen < 2) {
+               return 200;
+       }
+       

        *ResultLen -= 2;
        isw = Result[*ResultLen] * 0x0100 + Result[*ResultLen + 1];
        if (sw)
                *sw = isw;
 
        if (isw != 0x9000) {
        *ResultLen -= 2;
        isw = Result[*ResultLen] * 0x0100 + Result[*ResultLen + 1];
        if (sw)
                *sw = isw;
 
        if (isw != 0x9000) {

-               if (APDULogging)
-                       PrintAndLog("APDU(%02x%02x) ERROR: [%4X] %s", apdu.CLA, apdu.INS, isw, GetAPDUCodeDescription(*sw >> 8, *sw & 0xff));
-               return 5;
+               if (APDULogging) {
+                       if (*sw >> 8 == 0x61) {
+                               PrintAndLog("APDU chaining len:%02x -->", *sw & 0xff);
+                       } else {
+                               PrintAndLog("APDU(%02x%02x) ERROR: [%4X] %s", apdu.CLA, apdu.INS, isw, GetAPDUCodeDescription(*sw >> 8, *sw & 0xff));
+                               return 5;
+                       }
+               }

        }
 
        // add to tlv tree
        }
 
        // add to tlv tree


@@ -280,15 +305,15 @@ int EMVExchangeEx(bool ActivateField, bool LeaveFieldON, sAPDU apdu, bool Includ
        return 0;
 }
 
        return 0;
 }
 

-int EMVExchange(bool LeaveFieldON, sAPDU apdu, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
-       return EMVExchangeEx(false, LeaveFieldON, apdu, true, Result, MaxResultLen, ResultLen, sw, tlv);
+int EMVExchange(EMVCommandChannel channel, bool LeaveFieldON, sAPDU apdu, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
+       return EMVExchangeEx(channel, false, LeaveFieldON, apdu, true, Result, MaxResultLen, ResultLen, sw, tlv);

 }
 
 }
 

-int EMVSelect(bool ActivateField, bool LeaveFieldON, uint8_t *AID, size_t AIDLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
-       return EMVExchangeEx(ActivateField, LeaveFieldON, (sAPDU){0x00, 0xa4, 0x04, 0x00, AIDLen, AID}, true, Result, MaxResultLen, ResultLen, sw, tlv);
+int EMVSelect(EMVCommandChannel channel, bool ActivateField, bool LeaveFieldON, uint8_t *AID, size_t AIDLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
+       return EMVExchangeEx(channel, ActivateField, LeaveFieldON, (sAPDU){0x00, 0xa4, 0x04, 0x00, AIDLen, AID}, true, Result, MaxResultLen, ResultLen, sw, tlv);

 }
 
 }
 

-int EMVSelectPSE(bool ActivateField, bool LeaveFieldON, uint8_t PSENum, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw) {
+int EMVSelectPSE(EMVCommandChannel channel, bool ActivateField, bool LeaveFieldON, uint8_t PSENum, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw) {

        uint8_t buf[APDU_AID_LEN] = {0};
        *ResultLen = 0;
        int len = 0;
        uint8_t buf[APDU_AID_LEN] = {0};
        *ResultLen = 0;
        int len = 0;


@@ -305,19 +330,19 @@ int EMVSelectPSE(bool ActivateField, bool LeaveFieldON, uint8_t PSENum, uint8_t
        }
        
        // select
        }
        
        // select

-       res = EMVSelect(ActivateField, LeaveFieldON, buf, len, Result, MaxResultLen, ResultLen, sw, NULL);
+       res = EMVSelect(channel, ActivateField, LeaveFieldON, buf, len, Result, MaxResultLen, ResultLen, sw, NULL);

 
        return res;
 }
 
 
        return res;
 }
 

-int EMVSearchPSE(bool ActivateField, bool LeaveFieldON, bool decodeTLV, struct tlvdb *tlv) {
+int EMVSearchPSE(EMVCommandChannel channel, bool ActivateField, bool LeaveFieldON, bool decodeTLV, struct tlvdb *tlv) {

        uint8_t data[APDU_RES_LEN] = {0};
        size_t datalen = 0;
        uint16_t sw = 0;
        int res;
 
        // select PPSE
        uint8_t data[APDU_RES_LEN] = {0};
        size_t datalen = 0;
        uint16_t sw = 0;
        int res;
 
        // select PPSE

-       res = EMVSelectPSE(ActivateField, true, 2, data, sizeof(data), &datalen, &sw);
+       res = EMVSelectPSE(channel, ActivateField, true, 2, data, sizeof(data), &datalen, &sw);

 
        if (!res){
                struct tlvdb *t = NULL;
 
        if (!res){
                struct tlvdb *t = NULL;


@@ -331,7 +356,7 @@ int EMVSearchPSE(bool ActivateField, bool LeaveFieldON, bool decodeTLV, struct t
                        while (ttmp) {
                                const struct tlv *tgAID = tlvdb_get_inchild(ttmp, 0x4f, NULL);
                                if (tgAID) {
                        while (ttmp) {
                                const struct tlv *tgAID = tlvdb_get_inchild(ttmp, 0x4f, NULL);
                                if (tgAID) {

-                                       res = EMVSelect(false, true, (uint8_t *)tgAID->value, tgAID->len, data, sizeof(data), &datalen, &sw, tlv);
+                                       res = EMVSelect(channel, false, true, (uint8_t *)tgAID->value, tgAID->len, data, sizeof(data), &datalen, &sw, tlv);

 
                                        // retry if error and not returned sw error
                                        if (res && res != 5) {
 
                                        // retry if error and not returned sw error
                                        if (res && res != 5) {


@@ -378,7 +403,7 @@ int EMVSearchPSE(bool ActivateField, bool LeaveFieldON, bool decodeTLV, struct t
        return res;
 }
 
        return res;
 }
 

-int EMVSearch(bool ActivateField, bool LeaveFieldON, bool decodeTLV, struct tlvdb *tlv) {
+int EMVSearch(EMVCommandChannel channel, bool ActivateField, bool LeaveFieldON, bool decodeTLV, struct tlvdb *tlv) {

        uint8_t aidbuf[APDU_AID_LEN] = {0};
        int aidlen = 0;
        uint8_t data[APDU_RES_LEN] = {0};
        uint8_t aidbuf[APDU_AID_LEN] = {0};
        int aidlen = 0;
        uint8_t data[APDU_RES_LEN] = {0};


@@ -389,15 +414,15 @@ int EMVSearch(bool ActivateField, bool LeaveFieldON, bool decodeTLV, struct tlvd
        int retrycnt = 0;
        for(int i = 0; i < AIDlistLen; i ++) {
                param_gethex_to_eol(AIDlist[i].aid, 0, aidbuf, sizeof(aidbuf), &aidlen);
        int retrycnt = 0;
        for(int i = 0; i < AIDlistLen; i ++) {
                param_gethex_to_eol(AIDlist[i].aid, 0, aidbuf, sizeof(aidbuf), &aidlen);

-               res = EMVSelect((i == 0) ? ActivateField : false, (i == AIDlistLen - 1) ? LeaveFieldON : true, aidbuf, aidlen, data, sizeof(data), &datalen, &sw, tlv);
+               res = EMVSelect(channel, (i == 0) ? ActivateField : false, (i == AIDlistLen - 1) ? LeaveFieldON : true, aidbuf, aidlen, data, sizeof(data), &datalen, &sw, tlv);

                // retry if error and not returned sw error
                if (res && res != 5) {
                        if (++retrycnt < 3){
                                i--;
                        } else {
                // retry if error and not returned sw error
                if (res && res != 5) {
                        if (++retrycnt < 3){
                                i--;
                        } else {

-                               // card select error, proxmark error
-                               if (res == 1) {
-                                       PrintAndLog("Exit...");
+                               // (1) - card select error, proxmark error OR (200) - result length = 0
+                               if (res == 1 || res == 200) {
+                                       PrintAndLogEx(WARNING, "Exit...");

                                        return 1;
                                }
                                
                                        return 1;
                                }
                                


@@ -459,38 +484,38 @@ int EMVSelectApplication(struct tlvdb *tlv, uint8_t *AID, size_t *AIDlen) {
        return 0;
 }
 
        return 0;
 }
 

-int EMVGPO(bool LeaveFieldON, uint8_t *PDOL, size_t PDOLLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
-       return EMVExchange(LeaveFieldON, (sAPDU){0x80, 0xa8, 0x00, 0x00, PDOLLen, PDOL}, Result, MaxResultLen, ResultLen, sw, tlv);
+int EMVGPO(EMVCommandChannel channel, bool LeaveFieldON, uint8_t *PDOL, size_t PDOLLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
+       return EMVExchange(channel, LeaveFieldON, (sAPDU){0x80, 0xa8, 0x00, 0x00, PDOLLen, PDOL}, Result, MaxResultLen, ResultLen, sw, tlv);

 }
 
 }
 

-int EMVReadRecord(bool LeaveFieldON, uint8_t SFI, uint8_t SFIrec, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
-       int res = EMVExchange(LeaveFieldON, (sAPDU){0x00, 0xb2, SFIrec, (SFI << 3) | 0x04, 0, NULL}, Result, MaxResultLen, ResultLen, sw, tlv);
+int EMVReadRecord(EMVCommandChannel channel, bool LeaveFieldON, uint8_t SFI, uint8_t SFIrec, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
+       int res = EMVExchange(channel, LeaveFieldON, (sAPDU){0x00, 0xb2, SFIrec, (SFI << 3) | 0x04, 0, NULL}, Result, MaxResultLen, ResultLen, sw, tlv);

        if (*sw == 0x6700) {
        if (*sw == 0x6700) {

-               PrintAndLog(">>> trying to reissue command withouth Le...");
-               res = EMVExchangeEx(false, LeaveFieldON, (sAPDU){0x00, 0xb2, SFIrec, (SFI << 3) | 0x04, 0, NULL}, false, Result, MaxResultLen, ResultLen, sw, tlv);
+               PrintAndLogEx(INFO, ">>> trying to reissue command withouth Le...");
+               res = EMVExchangeEx(channel, false, LeaveFieldON, (sAPDU){0x00, 0xb2, SFIrec, (SFI << 3) | 0x04, 0, NULL}, false, Result, MaxResultLen, ResultLen, sw, tlv);

        }
        return res;
 }
 
        }
        return res;
 }
 

-int EMVAC(bool LeaveFieldON, uint8_t RefControl, uint8_t *CDOL, size_t CDOLLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
-       return EMVExchange(LeaveFieldON, (sAPDU){0x80, 0xae, RefControl, 0x00, CDOLLen, CDOL}, Result, MaxResultLen, ResultLen, sw, tlv);
+int EMVAC(EMVCommandChannel channel, bool LeaveFieldON, uint8_t RefControl, uint8_t *CDOL, size_t CDOLLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
+       return EMVExchange(channel, LeaveFieldON, (sAPDU){0x80, 0xae, RefControl, 0x00, CDOLLen, CDOL}, Result, MaxResultLen, ResultLen, sw, tlv);

 }
 
 }
 

-int EMVGenerateChallenge(bool LeaveFieldON, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
-       int res = EMVExchange(LeaveFieldON, (sAPDU){0x00, 0x84, 0x00, 0x00, 0x00, NULL}, Result, MaxResultLen, ResultLen, sw, tlv);
+int EMVGenerateChallenge(EMVCommandChannel channel, bool LeaveFieldON, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
+       int res = EMVExchange(channel, LeaveFieldON, (sAPDU){0x00, 0x84, 0x00, 0x00, 0x00, NULL}, Result, MaxResultLen, ResultLen, sw, tlv);

        if (*sw == 0x6700) {
        if (*sw == 0x6700) {

-               PrintAndLog(">>> trying to reissue command withouth Le...");
-               res = EMVExchangeEx(false, LeaveFieldON, (sAPDU){0x00, 0x84, 0x00, 0x00, 0x00, NULL}, false, Result, MaxResultLen, ResultLen, sw, tlv);
+               PrintAndLogEx(INFO, ">>> trying to reissue command withouth Le...");
+               res = EMVExchangeEx(channel, false, LeaveFieldON, (sAPDU){0x00, 0x84, 0x00, 0x00, 0x00, NULL}, false, Result, MaxResultLen, ResultLen, sw, tlv);

        }
        return res;
 }
 
        }
        return res;
 }
 

-int EMVInternalAuthenticate(bool LeaveFieldON, uint8_t *DDOL, size_t DDOLLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
-       return EMVExchange(LeaveFieldON, (sAPDU){0x00, 0x88, 0x00, 0x00, DDOLLen, DDOL}, Result, MaxResultLen, ResultLen, sw, tlv);
+int EMVInternalAuthenticate(EMVCommandChannel channel, bool LeaveFieldON, uint8_t *DDOL, size_t DDOLLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
+       return EMVExchange(channel, LeaveFieldON, (sAPDU){0x00, 0x88, 0x00, 0x00, DDOLLen, DDOL}, Result, MaxResultLen, ResultLen, sw, tlv);

 }
 
 }
 

-int MSCComputeCryptoChecksum(bool LeaveFieldON, uint8_t *UDOL, uint8_t UDOLlen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
-       return EMVExchange(LeaveFieldON, (sAPDU){0x80, 0x2a, 0x8e, 0x80, UDOLlen, UDOL}, Result, MaxResultLen, ResultLen, sw, tlv);
+int MSCComputeCryptoChecksum(EMVCommandChannel channel, bool LeaveFieldON, uint8_t *UDOL, uint8_t UDOLlen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
+       return EMVExchange(channel, LeaveFieldON, (sAPDU){0x80, 0x2a, 0x8e, 0x80, UDOLlen, UDOL}, Result, MaxResultLen, ResultLen, sw, tlv);

 }
 
 // Authentication 
 }
 
 // Authentication 


@@ -560,7 +585,7 @@ int trSDA(struct tlvdb *tlv) {
 static const unsigned char default_ddol_value[] = {0x9f, 0x37, 0x04};
 static struct tlv default_ddol_tlv = {.tag = 0x9f49, .len = 3, .value = default_ddol_value };
 
 static const unsigned char default_ddol_value[] = {0x9f, 0x37, 0x04};
 static struct tlv default_ddol_tlv = {.tag = 0x9f49, .len = 3, .value = default_ddol_value };
 

-int trDDA(bool decodeTLV, struct tlvdb *tlv) {
+int trDDA(EMVCommandChannel channel, bool decodeTLV, struct tlvdb *tlv) {

        uint8_t buf[APDU_RES_LEN] = {0};
        size_t len = 0;
        uint16_t sw = 0;
        uint8_t buf[APDU_RES_LEN] = {0};
        size_t len = 0;
        uint16_t sw = 0;


@@ -700,9 +725,9 @@ int trDDA(bool decodeTLV, struct tlvdb *tlv) {
                PrintAndLog("DDOL data[%d]: %s", ddol_data_tlv->len, sprint_hex(ddol_data_tlv->value, ddol_data_tlv->len));
 
                PrintAndLog("\n* Internal Authenticate");
                PrintAndLog("DDOL data[%d]: %s", ddol_data_tlv->len, sprint_hex(ddol_data_tlv->value, ddol_data_tlv->len));
 
                PrintAndLog("\n* Internal Authenticate");

-               int res = EMVInternalAuthenticate(true, (uint8_t *)ddol_data_tlv->value, ddol_data_tlv->len, buf, sizeof(buf), &len, &sw, NULL);
+               int res = EMVInternalAuthenticate(channel, true, (uint8_t *)ddol_data_tlv->value, ddol_data_tlv->len, buf, sizeof(buf), &len, &sw, NULL);

                if (res) {      
                if (res) {      

-                       PrintAndLog("Internal Authenticate error(%d): %4x. Exit...", res, sw);
+                       PrintAndLogEx(WARNING, "Internal Authenticate error(%d): %4x. Exit...", res, sw);

                        free(ddol_data_tlv);
                        emv_pk_free(pk);
                        emv_pk_free(issuer_pk);
                        free(ddol_data_tlv);
                        emv_pk_free(pk);
                        emv_pk_free(issuer_pk);