//-----------------------------------------------------------------------------
// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
// Copyright (C) 2011 Gerhard de Koning Gans
+// Copyright (C) 2014 Midnitesnake & Andy Davies
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
#include <string.h>
#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
#include "data.h"
-#include "proxusb.h"
+//#include "proxusb.h"
+#include "proxmark3.h"
#include "ui.h"
#include "cmdparser.h"
#include "cmdhficlass.h"
#include "common.h"
+#include "util.h"
+#include "loclass/des.h"
+#include "loclass/cipherutils.h"
+#include "loclass/cipher.h"
+#include "loclass/ikeys.h"
static int CmdHelp(const char *Cmd);
int CmdHFiClassList(const char *Cmd)
{
uint8_t got[1920];
- GetFromBigBuf(got, sizeof(got));
+ GetFromBigBuf(got,sizeof(got),0);
PrintAndLog("recorded activity:");
PrintAndLog(" ETU :rssi: who bytes");
return 0;
}
-/*void iso14a_set_timeout(uint32_t timeout) {
- UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_SET_TIMEOUT, 0, timeout}};
- SendCommand(&c);
-}*/
-
int CmdHFiClassSnoop(const char *Cmd)
{
UsbCommand c = {CMD_SNOOP_ICLASS};
return 0;
}
+int CmdHFiClassSim(const char *Cmd)
+{
+ uint8_t simType = 0;
+ uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
+
+ if (strlen(Cmd)<2) {
+ PrintAndLog("Usage: hf iclass sim <sim type> <CSN (16 hex symbols)>");
+ PrintAndLog(" sample: hf iclass sim 0 031FEC8AF7FF12E0");
+ return 0;
+ }
+
+ simType = param_get8(Cmd, 0);
+ if (param_gethex(Cmd, 1, CSN, 16)) {
+ PrintAndLog("A CSN should consist of 16 HEX symbols");
+ return 1;
+ }
+ PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
+
+ UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType}};
+ memcpy(c.d.asBytes, CSN, 8);
+ SendCommand(&c);
+
+ return 0;
+}
+
+int CmdHFiClassReader(const char *Cmd)
+{
+ uint8_t readerType = 0;
+
+ if (strlen(Cmd)<1) {
+ PrintAndLog("Usage: hf iclass reader <reader type>");
+ PrintAndLog(" sample: hf iclass reader 0");
+ return 0;
+ }
+
+ readerType = param_get8(Cmd, 0);
+ PrintAndLog("--readertype:%02x", readerType);
+
+ UsbCommand c = {CMD_READER_ICLASS, {readerType}};
+ SendCommand(&c);
+
+ return 0;
+}
+
+int CmdHFiClassReader_Replay(const char *Cmd)
+{
+ uint8_t readerType = 0;
+ uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
+
+ if (strlen(Cmd)<1) {
+ PrintAndLog("Usage: hf iclass replay <MAC>");
+ PrintAndLog(" sample: hf iclass replay 00112233");
+ return 0;
+ }
+
+ if (param_gethex(Cmd, 0, MAC, 8)) {
+ PrintAndLog("MAC must include 8 HEX symbols");
+ return 1;
+ }
+
+ UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
+ memcpy(c.d.asBytes, MAC, 4);
+ SendCommand(&c);
+
+ return 0;
+}
+
+int CmdHFiClassReader_Dump(const char *Cmd)
+{
+ uint8_t readerType = 0;
+ uint8_t MAC[4]={0x00,0x00,0x00,0x00};
+ uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ //uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t result[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ des_context ctx_enc;
+ uint64_t crypted_id=0;
+
+ if (strlen(Cmd)<1)
+ {
+ //PrintAndLog("Usage: hf iclass dump <Key> <CSN> <CC>");
+ //PrintAndLog(" sample: hf iclass dump 0011223344556677 aabbccddeeffgghh FFFFFFFFFFFFFFFF");
+ PrintAndLog("Usage: hf iclass dump <Key>");
+ PrintAndLog(" sample: hf iclass dump 0011223344556677");
+ return 0;
+ }
+
+ if (param_gethex(Cmd, 0, KEY, 16))
+ {
+ PrintAndLog("KEY must include 16 HEX symbols");
+ return 1;
+ }
+
+ /*if (param_gethex(Cmd, 1, CSN, 16))
+ {
+ PrintAndLog("CSN must include 16 HEX symbols");
+ return 1;
+ }
+ if (param_gethex(Cmd, 2, CC_temp, 16))
+ {
+ PrintAndLog("CC must include 16 HEX symbols");
+ return 1;
+ }*/
+
+ UsbCommand c = {CMD_ICLASS_ISO14443A_GETPUBLIC, {0}};
+ //memcpy(c.d.asBytes, MAC, 4);
+ SendCommand(&c);
+
+ UsbCommand resp;
+ if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
+ uint8_t isOK = resp.arg[0] & 0xff;
+ uint8_t * data = resp.d.asBytes;
+
+ memcpy(CSN,data,8);
+ memcpy(CCNR,data+8,8);
+ PrintAndLog("DEBUG: CSN %s",sprint_hex(CSN,8));
+ PrintAndLog("DEBUG: CC %s",sprint_hex(CCNR,8));
+ PrintAndLog("isOk:%02x", isOK);
+ } else {
+ PrintAndLog("Command execute timeout");
+ }
+
+ //memcpy(CCNR,CC_temp,8);
+ des_setkey_enc( &ctx_enc, KEY);
+ des_crypt_ecb(&ctx_enc,CSN,result);
+ PrintAndLog("DES Key: %s",sprint_hex(result,8));
+ uint64_t newz=0;
+ crypted_id = bytes_to_num(result,8);
+ uint64_t x = (crypted_id & 0xFFFF000000000000 );
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,0),7);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,1),6);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,2),5);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,3),4);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,4),3);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,5),2);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,6),1);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,7),0);
+ newz|= x;
+ crypted_id=newz;
+ num_to_bytes(crypted_id,8,result);
+ PrintAndLog("DESr Key: %s",sprint_hex(result,8));
+ hash0(crypted_id,div_key);
+ PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
+ calc_iclass_mac(CCNR,12,div_key,MAC);
+
+ UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
+ memcpy(d.d.asBytes, MAC, 4);
+ SendCommand(&d);
+
+ return 0;
+}
+
static command_t CommandTable[] =
{
- {"help", CmdHelp, 1, "This help"},
- {"list", CmdHFiClassList, 0, "List iClass history"},
- {"snoop", CmdHFiClassSnoop, 0, "Eavesdrop iClass communication"},
+ {"help", CmdHelp, 1, "This help"},
+ {"list", CmdHFiClassList, 0, "List iClass history"},
+ {"snoop", CmdHFiClassSnoop, 0, "Eavesdrop iClass communication"},
+ {"sim", CmdHFiClassSim, 0, "Simulate iClass tag"},
+ {"reader", CmdHFiClassReader, 0, "Read an iClass tag"},
+ {"replay", CmdHFiClassReader_Replay,0, "Read an iClass tag via Reply Attack"},
+ {"dump", CmdHFiClassReader_Dump, 0, "Authenticate and Dump iClass tag"},
{NULL, NULL, 0, NULL}
};
CmdsHelp(CommandTable);
return 0;
}
+
projects / proxmark3-svn / blobdiff