+
+static void usage_hf_iclass_readblock(void) {
+ PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> [c] [e|r]\n");
+ PrintAndLog("Options:");
+ PrintAndLog(" b <Block> : The block number as 2 hex symbols");
+ PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
+ PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
+ PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
+ PrintAndLog(" r : If 'r' is specified, no computations applied to key");
+ PrintAndLog("Samples:");
+ PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
+ PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
+ PrintAndLog(" hf iclass readblk b 0A k 0");
+}
+
+
+static int CmdHFiClass_ReadBlock(const char *Cmd) {
+ uint8_t blockno=0;
+ uint8_t keyType = 0x88; //debit key
+ uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t keyNbr = 0;
+ uint8_t dataLen = 0;
+ char tempStr[50] = {0};
+ bool elite = false;
+ bool rawkey = false;
+ bool errors = false;
+ bool auth = false;
+ uint8_t cmdp = 0;
+ while (param_getchar(Cmd, cmdp) != 0x00) {
+ switch (param_getchar(Cmd, cmdp)) {
+ case 'h':
+ case 'H':
+ usage_hf_iclass_readblock();
+ return 0;
+ case 'b':
+ case 'B':
+ if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
+ PrintAndLog("Block No must include 2 HEX symbols\n");
+ errors = true;
+ }
+ cmdp += 2;
+ break;
+ case 'c':
+ case 'C':
+ keyType = 0x18;
+ cmdp++;
+ break;
+ case 'e':
+ case 'E':
+ elite = true;
+ cmdp++;
+ break;
+ case 'k':
+ case 'K':
+ auth = true;
+ dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
+ if (dataLen == 16) {
+ errors = param_gethex(tempStr, 0, KEY, dataLen);
+ } else if (dataLen == 1) {
+ keyNbr = param_get8(Cmd, cmdp+1);
+ if (keyNbr < ICLASS_KEYS_MAX) {
+ memcpy(KEY, iClass_Key_Table[keyNbr], 8);
+ } else {
+ PrintAndLog("\nERROR: KeyNbr is invalid\n");
+ errors = true;
+ }
+ } else {
+ PrintAndLog("\nERROR: Key is incorrect length\n");
+ errors = true;
+ }
+ cmdp += 2;
+ break;
+ case 'r':
+ case 'R':
+ rawkey = true;
+ cmdp++;
+ break;
+ default:
+ PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
+ errors = true;
+ break;
+ }
+ if (errors) {
+ usage_hf_iclass_readblock();
+ return 0;
+ }
+ }
+
+ if (cmdp < 2) {
+ usage_hf_iclass_readblock();
+ return 0;
+ }
+ if (!auth)
+ PrintAndLog("warning: no authentication used with read, only a few specific blocks can be read accurately without authentication.");
+
+ return ReadBlock(KEY, blockno, keyType, elite, rawkey, true, auth);
+}
+
+
+static int CmdHFiClass_loclass(const char *Cmd) {
+ char opt = param_getchar(Cmd, 0);
+
+ if (strlen(Cmd)<1 || opt == 'h') {
+ PrintAndLog("Usage: hf iclass loclass [options]");
+ PrintAndLog("Options:");
+ PrintAndLog("h Show this help");
+ PrintAndLog("t Perform self-test");
+ PrintAndLog("f <filename> Bruteforce iclass dumpfile");
+ PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
+ PrintAndLog(" malicious CSNs, and their protocol responses");
+ PrintAndLog(" The binary format of the file is expected to be as follows: ");
+ PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
+ PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
+ PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
+ PrintAndLog(" ... totalling N*24 bytes");
+ return 0;
+ }
+ char fileName[255] = {0};
+ if(opt == 'f') {
+ if(param_getstr(Cmd, 1, fileName, sizeof(fileName)) > 0) {
+ return bruteforceFileNoKeys(fileName);
+ } else {
+ PrintAndLog("You must specify a filename");
+ }
+ } else if(opt == 't') {
+ int errors = testCipherUtils();
+ errors += testMAC();
+ errors += doKeyTests(0);
+ errors += testElite();
+ if(errors) {
+ prnlog("OBS! There were errors!!!");
+ }
+ return errors;
+ }
+
+ return 0;
+}
+
+
+static void usage_hf_iclass_readtagfile() {
+ PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
+}
+
+
+static int CmdHFiClassReadTagFile(const char *Cmd) {
+ int startblock = 0;
+ int endblock = 0;
+ char tempnum[5];
+ FILE *f;
+ char filename[FILE_PATH_SIZE];
+ if (param_getstr(Cmd, 0, filename, sizeof(filename)) < 1) {
+ usage_hf_iclass_readtagfile();
+ return 0;
+ }
+ if (param_getstr(Cmd, 1, tempnum, sizeof(tempnum)) < 1)
+ startblock = 0;
+ else
+ sscanf(tempnum,"%d",&startblock);
+
+ if (param_getstr(Cmd,2, tempnum, sizeof(tempnum)) < 1)
+ endblock = 0;
+ else
+ sscanf(tempnum,"%d",&endblock);
+ // file handling and reading
+ f = fopen(filename,"rb");
+ if(!f) {
+ PrintAndLog("Failed to read from file '%s'", filename);
+ return 1;
+ }
+ fseek(f, 0, SEEK_END);
+ long fsize = ftell(f);
+ fseek(f, 0, SEEK_SET);
+
+ if ( fsize < 0 ) {
+ PrintAndLog("Error, when getting filesize");
+ fclose(f);
+ return 1;
+ }
+
+ uint8_t *dump = malloc(fsize);
+
+ size_t bytes_read = fread(dump, 1, fsize, f);
+ fclose(f);
+ uint8_t *csn = dump;
+ printf("------+--+-------------------------+\n");
+ printf("CSN |00| %s|\n", sprint_hex(csn, 8) );
+ // printIclassDumpInfo(dump);
+ printIclassDumpContents(dump,startblock,endblock,bytes_read);
+ free(dump);
+ return 0;
+}
+
+/*
+uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
+ uint64_t new_div = 0x00;
+ new_div ^= sdiv;
+ new_div ^= hdiv;
+ return new_div;
+}
+
+uint64_t hexarray_to_uint64(uint8_t *key) {
+ char temp[17];
+ uint64_t uint_key;
+ for (int i = 0;i < 8;i++)
+ sprintf(&temp[(i *2)],"%02X",key[i]);
+ temp[16] = '\0';
+ if (sscanf(temp,"%016" SCNx64,&uint_key) < 1)
+ return 0;
+ return uint_key;
+}
+*/
+
+
+//when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
+//calculate and return xor_div_key (ready for a key write command)
+//print all div_keys if verbose
+static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
+ uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ //get old div key
+ HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
+ //get new div key
+ HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
+
+ for (uint8_t i = 0; i < sizeof(old_div_key); i++){
+ xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
+ }
+ if (verbose) {
+ printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
+ printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
+ printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
+ }
+}
+
+
+static void usage_hf_iclass_calc_newkey(void) {
+ PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
+ PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
+ PrintAndLog(" Options:");
+ PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
+ PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
+ PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
+ PrintAndLog(" e : specify new key as elite calc");
+ PrintAndLog(" ee : specify old and new key as elite calc");
+ PrintAndLog("Samples:");
+ PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
+ PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
+ PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
+ PrintAndLog("NOTE: * = required\n");
+}
+
+
+static int CmdHFiClassCalcNewKey(const char *Cmd) {
+ uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t keyNbr = 0;
+ uint8_t dataLen = 0;
+ char tempStr[50] = {0};
+ bool givenCSN = false;
+ bool oldElite = false;
+ bool elite = false;
+ bool errors = false;
+ uint8_t cmdp = 0;
+ while(param_getchar(Cmd, cmdp) != 0x00)
+ {
+ switch(param_getchar(Cmd, cmdp))
+ {
+ case 'h':
+ case 'H':
+ usage_hf_iclass_calc_newkey();
+ return 0;
+ case 'e':
+ case 'E':
+ dataLen = param_getstr(Cmd, cmdp, tempStr, sizeof(tempStr));
+ if (dataLen==2)
+ oldElite = true;
+ elite = true;
+ cmdp++;
+ break;
+ case 'n':
+ case 'N':
+ dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
+ if (dataLen == 16) {
+ errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
+ } else if (dataLen == 1) {
+ keyNbr = param_get8(Cmd, cmdp+1);
+ if (keyNbr < ICLASS_KEYS_MAX) {
+ memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
+ } else {
+ PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
+ errors = true;
+ }
+ } else {
+ PrintAndLog("\nERROR: NewKey is incorrect length\n");
+ errors = true;
+ }
+ cmdp += 2;
+ break;
+ case 'o':
+ case 'O':
+ dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
+ if (dataLen == 16) {
+ errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
+ } else if (dataLen == 1) {
+ keyNbr = param_get8(Cmd, cmdp+1);
+ if (keyNbr < ICLASS_KEYS_MAX) {
+ memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
+ } else {
+ PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
+ errors = true;
+ }
+ } else {
+ PrintAndLog("\nERROR: Credit Key is incorrect length\n");
+ errors = true;