- } else {
- PrintAndLog(" Auth0 [42/0x2A] : %s auth byte is out-of-range", sprint_hex(data+8, 4) );
- }
- }
- PrintAndLog(" Auth1 [43/0x2B] : %s %s",
- sprint_hex(data+12, 4),
- (data[12] & 1) ? "write access restricted": "read and write access restricted"
- );
- return 0;
-}
-
-static int ulev1_print_configuration( uint8_t *data, uint8_t startPage){
-
- PrintAndLog("\n--- Tag Configuration");
-
- bool strg_mod_en = (data[0] & 2);
- uint8_t authlim = (data[4] & 0x07);
- bool cfglck = (data[4] & 0x40);
- bool prot = (data[4] & 0x80);
- uint8_t vctid = data[5];
-
- PrintAndLog(" cfg0 [%u/0x%02X] : %s", startPage, startPage, sprint_hex(data, 4));
- if ( data[3] < 0xff )
- PrintAndLog(" - page %d and above need authentication",data[3]);
- else
- PrintAndLog(" - pages don't need authentication");
- PrintAndLog(" - strong modulation mode %s", (strg_mod_en) ? "enabled":"disabled");
- PrintAndLog(" cfg1 [%u/0x%02X] : %s", startPage + 1, startPage + 1, sprint_hex(data+4, 4) );
- if ( authlim == 0)
- PrintAndLog(" - Unlimited password attempts");
- else
- PrintAndLog(" - Max number of password attempts is %d", authlim);
- PrintAndLog(" - user configuration %s", cfglck ? "permanently locked":"writeable");
- PrintAndLog(" - %s access is protected with password", prot ? "read and write":"write");
- PrintAndLog(" - %02X, Virtual Card Type Identifier is %s default", vctid, (vctid==0x05)? "":"not");
- PrintAndLog(" PWD [%u/0x%02X] : %s- (cannot be read)", startPage + 2, startPage + 2, sprint_hex(data+8, 4));
- PrintAndLog(" PACK [%u/0x%02X] : %s - (cannot be read)", startPage + 3, startPage + 3, sprint_hex(data+12, 2));
- PrintAndLog(" RFU [%u/0x%02X] : %s- (cannot be read)", startPage + 3, startPage + 3, sprint_hex(data+12, 2));
- return 0;
-}
-
-static int ulev1_print_counters(){
- PrintAndLog("--- Tag Counters");
- uint8_t tear[1] = {0};
- uint8_t counter[3] = {0,0,0};
- uint16_t len = 0;
- for ( uint8_t i = 0; i<3; ++i) {
- ulev1_readTearing(i,tear,sizeof(tear));
- len = ulev1_readCounter(i,counter, sizeof(counter) );
- if (len == 3) {
- PrintAndLog(" [%0d] : %s", i, sprint_hex(counter,3));
- PrintAndLog(" - %02X tearing %s", tear[0], ( tear[0]==0xBD)?"Ok":"failure");
- }
- }
- return len;
-}
-
-static int ulev1_print_signature( uint8_t *data, uint8_t len){
- PrintAndLog("\n--- Tag Signature");
- //PrintAndLog("IC signature public key name : NXP NTAG21x 2013"); // don't know if there is other NXP public keys.. :(
- PrintAndLog("IC signature public key value : 04494e1a386d3d3cfe3dc10e5de68a499b1c202db5b132393e89ed19fe5be8bc61");
- PrintAndLog(" Elliptic curve parameters : secp128r1");
- PrintAndLog(" Tag ECC Signature : %s", sprint_hex(data, len));
- //to do: verify if signature is valid
- //PrintAndLog("IC signature status: %s valid", (iseccvalid() )?"":"not");
- return 0;
-}
-
-static int ulev1_print_version(uint8_t *data){
- PrintAndLog("\n--- Tag Version");
- PrintAndLog(" Raw bytes : %s",sprint_hex(data, 8) );
- PrintAndLog(" Vendor ID : %02X, %s", data[1], getTagInfo(data[1]));
- PrintAndLog(" Product type : %s", getProductTypeStr(data[2]));
- PrintAndLog(" Product subtype : %02X, %s", data[3], (data[3]==1) ?"17 pF":"50pF");
- PrintAndLog(" Major version : %02X", data[4]);
- PrintAndLog(" Minor version : %02X", data[5]);
- PrintAndLog(" Size : %s", getUlev1CardSizeStr(data[6]));
- PrintAndLog(" Protocol type : %02X", data[7]);
- return 0;
-}
-
-/*
-static int ulc_magic_test(){
- // Magic Ultralight test
- // Magic UL-C, by observation,
- // 1) it seems to have a static nonce response to 0x1A command.
- // 2) the deskey bytes is not-zero:d out on as datasheet states.
- // 3) UID - changeable, not only, but pages 0-1-2-3.
- // 4) use the ul_magic_test ! magic tags answers specially!
- int returnValue = UL_ERROR;
- iso14a_card_select_t card;
- uint8_t nonce1[11] = {0x00};
- uint8_t nonce2[11] = {0x00};
- int status = ul_select(&card);
- if ( !status ){
- return UL_ERROR;
- }
- status = ulc_requestAuthentication(nonce1, sizeof(nonce1));
- if ( status > 0 ) {
- status = ulc_requestAuthentication(nonce2, sizeof(nonce2));
- returnValue = ( !memcmp(nonce1, nonce2, 11) ) ? UL_C_MAGIC : UL_C;
- } else {
- returnValue = UL;
- }
- ul_switch_off_field();
- return returnValue;
-}
-*/
-static int ul_magic_test(){
-
- // Magic Ultralight tests
- // 1) take present UID, and try to write it back. OBSOLETE
- // 2) make a wrong length write to page0, and see if tag answers with ACK/NACK:
- iso14a_card_select_t card;
- if ( !ul_select(&card) )
- return UL_ERROR;
- int status = ul_comp_write(0, NULL, 0);
- ul_switch_off_field();
- if ( status == 0 )
- return MAGIC;
- return 0;
-}
-
-uint32_t GetHF14AMfU_Type(void){
-
- TagTypeUL_t tagtype = UNKNOWN;
- iso14a_card_select_t card;
- uint8_t version[10] = {0x00};
- int status = 0;
- int len;
-
- if (!ul_select(&card)) return UL_ERROR;
-
- // Ultralight - ATQA / SAK
- if ( card.atqa[1] != 0x00 || card.atqa[0] != 0x44 || card.sak != 0x00 ) {
- PrintAndLog("Tag is not Ultralight | NTAG | MY-D [ATQA: %02X %02X SAK: %02X]\n", card.atqa[1], card.atqa[0], card.sak);
- ul_switch_off_field();
- return UL_ERROR;
- }
-
- if ( card.uid[0] != 0x05) {
-
- len = ulev1_getVersion(version, sizeof(version));
- ul_switch_off_field();
-
- switch (len) {
- case 0x0A: {
-
- if ( version[2] == 0x03 && version[6] == 0x0B )
- tagtype = UL_EV1_48;
- else if ( version[2] == 0x03 && version[6] != 0x0B )
- tagtype = UL_EV1_128;
- else if ( version[2] == 0x04 && version[3] == 0x01 && version[6] == 0x0B )
- tagtype = NTAG_210;
- else if ( version[2] == 0x04 && version[3] == 0x01 && version[6] == 0x0E )
- tagtype = NTAG_212;
- else if ( version[2] == 0x04 && version[3] == 0x02 && version[6] == 0x0F )
- tagtype = NTAG_213;
- else if ( version[2] == 0x04 && version[3] == 0x02 && version[6] == 0x11 )
- tagtype = NTAG_215;
- else if ( version[2] == 0x04 && version[3] == 0x02 && version[6] == 0x13 )
- tagtype = NTAG_216;
- else if ( version[2] == 0x04 && version[3] == 0x05 && version[6] == 0x13 )
- tagtype = NTAG_I2C_1K;
- else if ( version[2] == 0x04 && version[3] == 0x05 && version[6] == 0x15 )
- tagtype = NTAG_I2C_2K;
- else if ( version[2] == 0x04 )
- tagtype = NTAG;
-
- break;
- }
- case 0x01: tagtype = UL_C; break;
- case 0x00: tagtype = UL; break;
- case -1 : tagtype = (UL | UL_C | NTAG_203); break; // could be UL | UL_C magic tags
- default : tagtype = UNKNOWN; break;
- }
- // UL vs UL-C vs ntag203 test
- if (tagtype & (UL | UL_C | NTAG_203)) {
- if ( !ul_select(&card) ) return UL_ERROR;
-
- // do UL_C check first...
- uint8_t nonce[11] = {0x00};
- status = ulc_requestAuthentication(nonce, sizeof(nonce));
- ul_switch_off_field();
- if (status > 1) {
- tagtype = UL_C;
- } else {
- // need to re-select after authentication error
- if ( !ul_select(&card) ) return UL_ERROR;
-
- uint8_t data[16] = {0x00};
- // read page 0x26-0x29 (last valid ntag203 page)
- status = ul_read(0x26, data, sizeof(data));
- if ( status <= 1 ) {
- tagtype = UL;
- } else {
- // read page 0x30 (should error if it is a ntag203)
- status = ul_read(0x30, data, sizeof(data));
- if ( status <= 1 ){
- tagtype = NTAG_203;
- } else {
- tagtype = UNKNOWN;
- }
- }
- ul_switch_off_field();
- }
- }
- } else {
- // Infinition MY-D tests Exam high nibble
- uint8_t nib = (card.uid[1] & 0xf0) >> 4;
- switch ( nib ){
- case 1: tagtype = MY_D; break;
- case 2: tagtype = (MY_D | MY_D_NFC); break; //notice: we can not currently distinguish between these two
- case 3: tagtype = (MY_D_MOVE | MY_D_MOVE_NFC); break; //notice: we can not currently distinguish between these two
- }
- }
-
- tagtype |= ul_magic_test();
- if (tagtype == (UNKNOWN | MAGIC)) tagtype = (UL_MAGIC);
- return tagtype;
-}
-
-int CmdHF14AMfUInfo(const char *Cmd){
-
- uint8_t authlim = 0xff;
- uint8_t data[16] = {0x00};
- iso14a_card_select_t card;
- int status;
- bool errors = false;
- bool hasAuthKey = false;
- bool locked = false;
- bool swapEndian = false;
- uint8_t cmdp = 0;
- uint8_t dataLen = 0;
- uint8_t authenticationkey[16] = {0x00};
- uint8_t *authkeyptr = authenticationkey;
- uint8_t *key;
- uint8_t pack[4] = {0,0,0,0};
- int len = 0;
- char tempStr[50];
-
- while(param_getchar(Cmd, cmdp) != 0x00)
- {
- switch(param_getchar(Cmd, cmdp))
- {
- case 'h':
- case 'H':
- return usage_hf_mfu_info();
- case 'k':
- case 'K':
- dataLen = param_getstr(Cmd, cmdp+1, tempStr);
- if (dataLen == 32 || dataLen == 8) { //ul-c or ev1/ntag key length
- errors = param_gethex(tempStr, 0, authenticationkey, dataLen);
- dataLen /= 2; // handled as bytes from now on
- } else {
- PrintAndLog("\nERROR: Key is incorrect length\n");
- errors = true;
- }
- cmdp += 2;
- hasAuthKey = true;
- break;
- case 'l':
- case 'L':
- swapEndian = true;
- cmdp++;
- break;
- default:
- PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
- errors = true;
- break;
- }
- if(errors) break;
- }
-
- //Validations
- if(errors) return usage_hf_mfu_info();
-
- TagTypeUL_t tagtype = GetHF14AMfU_Type();
- if (tagtype == UL_ERROR) return -1;
-
- PrintAndLog("\n--- Tag Information ---------");
- PrintAndLog("-------------------------------------------------------------");
- ul_print_type(tagtype, 6);
-
- // Swap endianness
- if (swapEndian && hasAuthKey) authkeyptr = SwapEndian64(authenticationkey, dataLen, (dataLen == 16) ? 8 : 4 );
-
- if (!ul_auth_select( &card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack))) return -1;
-
- // read pages 0,1,2,3 (should read 4pages)
- status = ul_read(0, data, sizeof(data));
- if ( status == -1 ) {
- ul_switch_off_field();
- PrintAndLog("Error: tag didn't answer to READ");
- return status;
- } else if (status == 16) {
- ul_print_default(data);
- ndef_print_CC(data+12);
- } else {
- locked = true;
- }
-
- // UL_C Specific
- if ((tagtype & UL_C)) {
-
- // read pages 0x28, 0x29, 0x2A, 0x2B
- uint8_t ulc_conf[16] = {0x00};
- status = ul_read(0x28, ulc_conf, sizeof(ulc_conf));
- if ( status == -1 ){
- PrintAndLog("Error: tag didn't answer to READ UL-C");
- ul_switch_off_field();
- return status;
- }
- if (status == 16) ulc_print_configuration(ulc_conf);
- else locked = true;
-
- if ((tagtype & MAGIC)) {
- //just read key
- uint8_t ulc_deskey[16] = {0x00};
- status = ul_read(0x2C, ulc_deskey, sizeof(ulc_deskey));
- if ( status == -1 ) {
- ul_switch_off_field();
- PrintAndLog("Error: tag didn't answer to READ magic");
- return status;
- }
- if (status == 16) ulc_print_3deskey(ulc_deskey);
-
- } else {
- ul_switch_off_field();
- // if we called info with key, just return
- if ( hasAuthKey ) return 1;
-
- // also try to diversify default keys.. look into CmdHF14AMfuGenDiverseKeys
- PrintAndLog("Trying some default 3des keys");
- for (uint8_t i = 0; i < KEYS_3DES_COUNT; ++i ) {
- key = default_3des_keys[i];
- if (ulc_authentication(key, true)) {
- PrintAndLog("Found default 3des key: ");
- uint8_t keySwap[16];
- memcpy(keySwap, SwapEndian64(key,16,8), 16);
- ulc_print_3deskey(keySwap);
- return 1;
- }
- }
- return 1;
- }
- }
-
- // do counters and signature first (don't neet auth)
-
- // ul counters are different than ntag counters
- if ((tagtype & (UL_EV1_48 | UL_EV1_128))) {
- if (ulev1_print_counters() != 3) {
- // failed - re-select
- if (!ul_auth_select( &card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack))) return -1;
- }
- }
-
- if ((tagtype & (UL_EV1_48 | UL_EV1_128 | NTAG_213 | NTAG_215 | NTAG_216 | NTAG_I2C_1K | NTAG_I2C_2K ))) {
- uint8_t ulev1_signature[32] = {0x00};
- status = ulev1_readSignature( ulev1_signature, sizeof(ulev1_signature));
- if ( status == -1 ) {
- PrintAndLog("Error: tag didn't answer to READ SIGNATURE");
- ul_switch_off_field();
- return status;
- }
- if (status == 32) ulev1_print_signature( ulev1_signature, sizeof(ulev1_signature));
- else {
- // re-select
- if (!ul_auth_select( &card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack))) return -1;
- }
- }
-
- if ((tagtype & (UL_EV1_48 | UL_EV1_128 | NTAG_210 | NTAG_212 | NTAG_213 | NTAG_215 | NTAG_216 | NTAG_I2C_1K | NTAG_I2C_2K))) {
- uint8_t version[10] = {0x00};
- status = ulev1_getVersion(version, sizeof(version));
- if ( status == -1 ) {
- PrintAndLog("Error: tag didn't answer to GETVERSION");
- ul_switch_off_field();
- return status;
- } else if (status == 10) {
- ulev1_print_version(version);
- } else {
- locked = true;
- if (!ul_auth_select( &card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack))) return -1;
- }
-
- uint8_t startconfigblock = 0;
- uint8_t ulev1_conf[16] = {0x00};
- // config blocks always are last 4 pages
- for (uint8_t idx = 0; idx < MAX_UL_TYPES; idx++)
- if (tagtype & UL_TYPES_ARRAY[idx])
- startconfigblock = UL_MEMORY_ARRAY[idx]-3;
-
- if (startconfigblock){ // if we know where the config block is...
- status = ul_read(startconfigblock, ulev1_conf, sizeof(ulev1_conf));
- if ( status == -1 ) {
- PrintAndLog("Error: tag didn't answer to READ EV1");
- ul_switch_off_field();
- return status;
- } else if (status == 16) {
- // save AUTHENTICATION LIMITS for later:
- authlim = (ulev1_conf[4] & 0x07);
- ulev1_print_configuration(ulev1_conf, startconfigblock);
- }
- }
-
- // AUTHLIMIT, (number of failed authentications)
- // 0 = limitless.
- // 1-7 = limit. No automatic tries then.
- // hasAuthKey, if we was called with key, skip test.
- if ( !authlim && !hasAuthKey ) {
- PrintAndLog("\n--- Known EV1/NTAG passwords.");
- len = 0;
- for (uint8_t i = 0; i < KEYS_PWD_COUNT; ++i ) {
- key = default_pwd_pack[i];
- len = ulev1_requestAuthentication(key, pack, sizeof(pack));
- if (len >= 1) {
- PrintAndLog("Found a default password: %s || Pack: %02X %02X",sprint_hex(key, 4), pack[0], pack[1]);
- break;
- } else {
- if (!ul_auth_select( &card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack))) return -1;
- }
- }
- if (len < 1) PrintAndLog("password not known");
projects / proxmark3-svn / blobdiff