-static command_t CommandTable[] =
-{
- {"help", CmdHelp, 1, "This help"},
- {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
- {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
- {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
- {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
- {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
- {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
- {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
- {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
- {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
- {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
- {"reader", CmdHFiClassReader, 0, " Read an iClass tag"},
- {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
- {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
- {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
- {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
- {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
+
+static int CmdHFiClassCheckKeys(const char *Cmd) {
+
+ uint8_t mac[4] = {0x00,0x00,0x00,0x00};
+ uint8_t key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+
+ // elite key, raw key, standard key
+ bool use_elite = false;
+ bool use_raw = false;
+ bool found_debit = false;
+ bool found_credit = false;
+ bool errors = false;
+ uint8_t cmdp = 0x00;
+ FILE * f;
+ char filename[FILE_PATH_SIZE] = {0};
+ uint8_t fileNameLen = 0;
+ char buf[17];
+ uint8_t *keyBlock = NULL, *p;
+ int keyitems = 0, keycnt = 0;
+
+ while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
+ switch (param_getchar(Cmd, cmdp)) {
+ case 'h':
+ case 'H':
+ usage_hf_iclass_chk();
+ return 0;
+ case 'f':
+ case 'F':
+ fileNameLen = param_getstr(Cmd, cmdp+1, filename, sizeof(filename));
+ if (fileNameLen < 1) {
+ PrintAndLog("No filename found after f");
+ errors = true;
+ }
+ cmdp += 2;
+ break;
+ case 'e':
+ case 'E':
+ use_elite = true;
+ cmdp++;
+ break;
+ case 'r':
+ case 'R':
+ use_raw = true;
+ cmdp++;
+ break;
+ default:
+ PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
+ errors = true;
+ break;
+ }
+ }
+ if (errors) {
+ usage_hf_iclass_chk();
+ return 0;
+ }
+
+ if ( !(f = fopen( filename , "r")) ) {
+ PrintAndLog("File: %s: not found or locked.", filename);
+ return 1;
+ }
+
+ while( fgets(buf, sizeof(buf), f) ){
+ if (strlen(buf) < 16 || buf[15] == '\n')
+ continue;
+
+ while (fgetc(f) != '\n' && !feof(f)) ; //goto next line
+
+ if( buf[0]=='#' ) continue; //The line start with # is comment, skip
+
+ if (!isxdigit(buf[0])){
+ PrintAndLog("File content error. '%s' must include 16 HEX symbols",buf);
+ continue;
+ }
+
+ buf[16] = 0;
+
+ p = realloc(keyBlock, 8 * (keyitems += 64));
+ if (!p) {
+ PrintAndLog("Cannot allocate memory for default keys");
+ free(keyBlock);
+ fclose(f);
+ return 2;
+ }
+ keyBlock = p;
+
+ memset(keyBlock + 8 * keycnt, 0, 8);
+ num_to_bytes(strtoull(buf, NULL, 16), 8, keyBlock + 8 * keycnt);
+
+ //PrintAndLog("check key[%2d] %016" PRIx64, keycnt, bytes_to_num(keyBlock + 8*keycnt, 8));
+ keycnt++;
+ memset(buf, 0, sizeof(buf));
+ }
+ fclose(f);
+ PrintAndLog("Loaded %2d keys from %s", keycnt, filename);
+
+ // time
+ uint64_t t1 = msclock();
+
+ for (uint32_t c = 0; c < keycnt; c += 1) {
+ printf("."); fflush(stdout);
+ if (ukbhit()) {
+ int gc = getchar(); (void)gc;
+ printf("\naborted via keyboard!\n");
+ break;
+ }
+
+ memcpy(key, keyBlock + 8 * c , 8);
+
+ // debit key. try twice
+ for (int foo = 0; foo < 2 && !found_debit; foo++) {
+ if (!select_and_auth(key, mac, div_key, false, use_elite, use_raw, false))
+ continue;
+
+ // key found.
+ PrintAndLog("\n--------------------------------------------------------");
+ PrintAndLog(" Found AA1 debit key\t\t[%s]", sprint_hex(key, 8));
+ found_debit = true;
+ }
+
+ // credit key. try twice
+ for (int foo = 0; foo < 2 && !found_credit; foo++) {
+ if (!select_and_auth(key, mac, div_key, true, use_elite, use_raw, false))
+ continue;
+
+ // key found
+ PrintAndLog("\n--------------------------------------------------------");
+ PrintAndLog(" Found AA2 credit key\t\t[%s]", sprint_hex(key, 8));
+ found_credit = true;
+ }
+
+ // both keys found.
+ if ( found_debit && found_credit )
+ break;
+ }
+
+ t1 = msclock() - t1;
+
+ PrintAndLog("\nTime in iclass checkkeys: %.0f seconds\n", (float)t1/1000.0);
+
+ DropField();
+ free(keyBlock);
+ PrintAndLog("");
+ return 0;
+}
+
+
+static void usage_hf_iclass_permutekey(void) {
+ PrintAndLogEx(NORMAL, "Convert keys from standard NIST to iClass format (and vice versa)");
+ PrintAndLogEx(NORMAL, "");
+ PrintAndLogEx(NORMAL, "Usage: hf iclass permute [h] [r] <key>");
+ PrintAndLogEx(NORMAL, "Options:");
+ PrintAndLogEx(NORMAL, " h This help");
+ PrintAndLogEx(NORMAL, " r reverse convert key from iClass to NIST format");
+ PrintAndLogEx(NORMAL, "");
+ PrintAndLogEx(NORMAL, "Examples:");
+ PrintAndLogEx(NORMAL, " hf iclass permute r 0123456789abcdef");
+}
+
+
+static int CmdHFiClassPermuteKey(const char *Cmd) {
+
+ uint8_t key[8] = {0};
+ uint8_t data[16] = {0};
+ bool isReverse = false;
+ int len = sizeof(data);
+ char cmdp = tolower(param_getchar(Cmd, 0));
+ if (strlen(Cmd) == 0 || cmdp == 'h') {
+ usage_hf_iclass_permutekey();
+ return 0;
+ }
+
+ if (cmdp == 'r') {
+ isReverse = true;
+ param_gethex_ex(Cmd, 1, data, &len);
+ } else if (cmdp == 'f') {
+ param_gethex_ex(Cmd, 1, data, &len);
+ } else {
+ param_gethex_ex(Cmd, 0, data, &len);
+ }
+
+
+ if (len % 2) {
+ usage_hf_iclass_permutekey();
+ return 0;
+ }
+
+ len >>= 1;
+
+ memcpy(key, data, 8);
+
+ if (isReverse) {
+ // generate_rev(data, len);
+ uint8_t key_std_format[8] = {0};
+ permutekey_rev(key, key_std_format);
+ PrintAndLogEx(SUCCESS, "key in standard NIST format: %s \n", sprint_hex(key_std_format, 8));
+ // if (mbedtls_des_key_check_key_parity(key_std_format
+ } else {
+ // generate(data, len);
+ uint8_t key_iclass_format[8] = {0};
+ permutekey(key, key_iclass_format);
+ PrintAndLogEx(SUCCESS, "key in iClass (permuted) format: %s \n", sprint_hex(key_iclass_format, 8));
+ }
+ return 0;
+}
+
+
+static int CmdHelp(const char *Cmd);
+
+static command_t CommandTable[] = {
+ {"help", CmdHelp, 1, "This help"},
+ {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
+ {"chk", CmdHFiClassCheckKeys, 0, " Check keys"},
+ {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
+ {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
+ {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
+ {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
+ {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
+ {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
+ {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
+ {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
+ {"permutekey", CmdHFiClassPermuteKey, 1, " iClass key permutation"},
+ {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
+ {"reader", CmdHFiClassReader, 0, " Look for iClass tags until a key or the pm3 button is pressed"},
+ {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
+ {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
+ {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
+ {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
+ {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
projects / proxmark3-svn / blobdiff