* Check for Credidt Keys as well
* reduce authentication tries from 6 to 3
* correct text in 'hf iclass clone' for 'l' parameter
* some reformatting and whitespace fixes
static bool sendCmdGetResponseWithRetries(uint8_t* command, size_t cmdsize, uint8_t* resp, size_t max_resp_size,
static bool sendCmdGetResponseWithRetries(uint8_t* command, size_t cmdsize, uint8_t* resp, size_t max_resp_size,
- uint8_t expected_size, uint8_t retries, uint32_t start_time, uint32_t timeout, uint32_t *eof_time) {
- while (retries-- > 0) {
+ uint8_t expected_size, uint8_t tries, uint32_t start_time, uint32_t timeout, uint32_t *eof_time) {
+ while (tries-- > 0) {
ReaderTransmitIClass(command, cmdsize, &start_time);
if (expected_size == GetIso15693AnswerFromTag(resp, max_resp_size, timeout, eof_time)) {
return true;
ReaderTransmitIClass(command, cmdsize, &start_time);
if (expected_size == GetIso15693AnswerFromTag(resp, max_resp_size, timeout, eof_time)) {
return true;
uint8_t resp[4];
memcpy(check+1, NRMAC, 8);
uint32_t eof_time;
uint8_t resp[4];
memcpy(check+1, NRMAC, 8);
uint32_t eof_time;
- bool isOK = sendCmdGetResponseWithRetries(check, sizeof(check), resp, sizeof(resp), 4, 6, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
+ bool isOK = sendCmdGetResponseWithRetries(check, sizeof(check), resp, sizeof(resp), 4, 3, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp));
}
cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp));
}
}
uint8_t resp[8];
uint32_t eof_time;
}
uint8_t resp[8];
uint32_t eof_time;
- bool isOK = sendCmdGetResponseWithRetries(readcheck, sizeof(readcheck), resp, sizeof(resp), 8, 6, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
+ bool isOK = sendCmdGetResponseWithRetries(readcheck, sizeof(readcheck), resp, sizeof(resp), 8, 3, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp));
}
cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp));
}
void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) {
void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) {
- int total_block = (endblock - startblock) + 1;
- for (i = 0; i < total_block; i++) {
+ int total_blocks = (endblock - startblock) + 1;
+
+ for (i = 0; i < total_blocks; i++) {
// block number
if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){
Dbprintf("Write block [%02x] successful", i + startblock);
written++;
} else {
// block number
if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){
Dbprintf("Write block [%02x] successful", i + startblock);
written++;
} else {
- if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){
- Dbprintf("Write block [%02x] successful", i + startblock);
- written++;
- } else {
- Dbprintf("Write block [%02x] failed", i + startblock);
- }
+ Dbprintf("Write block [%02x] failed", i + startblock);
- if (written == total_block)
+
+ if (written == total_blocks)
Dbprintf("Clone complete");
else
Dbprintf("Clone incomplete");
Dbprintf("Clone complete");
else
Dbprintf("Clone incomplete");
cmd_send(CMD_ACK, 1, 0, 0, 0, 0);
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
cmd_send(CMD_ACK, 1, 0, 0, 0, 0);
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
bool jam_epurse_update = arg_get_lit(1);
const uint8_t update_epurse_sequence[2] = {0x87, 0x02};
bool jam_epurse_update = arg_get_lit(1);
const uint8_t update_epurse_sequence[2] = {0x87, 0x02};
UsbCommand c = {CMD_SNOOP_ICLASS, {0}};
if (jam_epurse_update) {
c.arg[0] = sizeof(update_epurse_sequence);
UsbCommand c = {CMD_SNOOP_ICLASS, {0}};
if (jam_epurse_update) {
c.arg[0] = sizeof(update_epurse_sequence);
} else if (elite) {
strcpy(keytypetext, "Elite diversified key");
}
} else if (elite) {
strcpy(keytypetext, "Elite diversified key");
}
if (verbose) PrintAndLog("Authenticating with %s: %s", keytypetext, sprint_hex(div_key, 8));
UsbCommand resp;
if (verbose) PrintAndLog("Authenticating with %s: %s", keytypetext, sprint_hex(div_key, 8));
UsbCommand resp;
PrintAndLog("You cannot combine the 'e', 'r', and 'n' options\n");
errors = true;
}
PrintAndLog("You cannot combine the 'e', 'r', and 'n' options\n");
errors = true;
}
if (errors || cmdp < 2) {
usage_hf_iclass_dump();
return 0;
if (errors || cmdp < 2) {
usage_hf_iclass_dump();
return 0;
bool errors = false;
uint8_t cmdp = 0;
bool errors = false;
uint8_t cmdp = 0;
- while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
+ while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
switch(param_getchar(Cmd, cmdp)) {
case 'h':
case 'H':
switch(param_getchar(Cmd, cmdp)) {
case 'h':
case 'H':
PrintAndLog("You cannot combine the 'e' and 'r' options\n");
errors = true;
}
PrintAndLog("You cannot combine the 'e' and 'r' options\n");
errors = true;
}
if (cmdp < 6) {
usage_hf_iclass_writeblock();
return 0;
if (cmdp < 6) {
usage_hf_iclass_writeblock();
return 0;
PrintAndLog("Options:");
PrintAndLog(" f <filename>: specify a filename to clone from");
PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
PrintAndLog("Options:");
PrintAndLog(" f <filename>: specify a filename to clone from");
PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
- PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
+ PrintAndLog(" l <Last Blk>: The last block to clone as 2 hex symbols");
PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
bool rawkey = false;
bool errors = false;
uint8_t cmdp = 0;
bool rawkey = false;
bool errors = false;
uint8_t cmdp = 0;
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
- switch(param_getchar(Cmd, cmdp)) {
+ switch (param_getchar(Cmd, cmdp)) {
case 'h':
case 'H':
usage_hf_iclass_clone();
case 'h':
case 'H':
usage_hf_iclass_clone();
case 'l':
case 'L':
if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
case 'l':
case 'L':
if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
- PrintAndLog("Start Block No must include 2 HEX symbols\n");
+ PrintAndLog("Last Block No must include 2 HEX symbols\n");
errors = true;
}
cmdp += 2;
errors = true;
}
cmdp += 2;
UsbCommand w = {CMD_ICLASS_CLONE, {startblock, endblock}};
uint8_t *ptr;
// calculate all mac for every the block we will write
UsbCommand w = {CMD_ICLASS_CLONE, {startblock, endblock}};
uint8_t *ptr;
// calculate all mac for every the block we will write
- for (i = startblock; i <= endblock; i++){
+ for (i = startblock; i <= endblock; i++) {
Calc_wb_mac(i, tag_data[i - startblock].d, div_key, MAC);
// usb command d start pointer = d + (i - 6) * 12
// memcpy(pointer,tag_data[i - 6],8) 8 bytes
Calc_wb_mac(i, tag_data[i - startblock].d, div_key, MAC);
// usb command d start pointer = d + (i - 6) * 12
// memcpy(pointer,tag_data[i - 6],8) 8 bytes
UsbCommand resp;
SendCommand(&w);
UsbCommand resp;
SendCommand(&w);
- if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
- {
+ if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
PrintAndLog("Command execute timeout");
DropField();
return 0;
}
PrintAndLog("Command execute timeout");
DropField();
return 0;
}
if (elite + rawkey + NRMAC_replay > 1) {
PrintAndLog("You cannot combine the 'e', 'r', and 'n' options\n");
errors = true;
if (elite + rawkey + NRMAC_replay > 1) {
PrintAndLog("You cannot combine the 'e', 'r', and 'n' options\n");
errors = true;
bool elite = false;
bool errors = false;
uint8_t cmdp = 0;
bool elite = false;
bool errors = false;
uint8_t cmdp = 0;
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
switch(param_getchar(Cmd, cmdp)) {
case 'h':
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
switch(param_getchar(Cmd, cmdp)) {
case 'h':
bool found_credit = false;
bool errors = false;
uint8_t cmdp = 0x00;
bool found_credit = false;
bool errors = false;
uint8_t cmdp = 0x00;
char filename[FILE_PATH_SIZE] = {0};
uint8_t fileNameLen = 0;
char buf[17];
uint8_t *keyBlock = NULL, *p;
char filename[FILE_PATH_SIZE] = {0};
uint8_t fileNameLen = 0;
char buf[17];
uint8_t *keyBlock = NULL, *p;
- int keyitems = 0, keycnt = 0;
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
switch (param_getchar(Cmd, cmdp)) {
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
switch (param_getchar(Cmd, cmdp)) {
- if ( !(f = fopen( filename , "r")) ) {
- PrintAndLog("File: %s: not found or locked.", filename);
+ if (!(f = fopen(filename , "r"))) {
+ PrintAndLog("File %s not found or locked.", filename);
- while( fgets(buf, sizeof(buf), f) ){
+ while (fgets(buf, sizeof(buf), f)) {
if (strlen(buf) < 16 || buf[15] == '\n')
continue;
while (fgetc(f) != '\n' && !feof(f)) ; //goto next line
if (strlen(buf) < 16 || buf[15] == '\n')
continue;
while (fgetc(f) != '\n' && !feof(f)) ; //goto next line
- if( buf[0]=='#' ) continue; //The line start with # is comment, skip
+ if (buf[0] == '#') continue; //The line start with # is comment, skip
- PrintAndLog("File content error. '%s' must include 16 HEX symbols",buf);
+ PrintAndLog("File content error. '%s' must include 16 HEX symbols", buf);
- p = realloc(keyBlock, 8 * (keyitems += 64));
+ p = realloc(keyBlock, 8 * (keycnt + 1));
if (!p) {
PrintAndLog("Cannot allocate memory for default keys");
free(keyBlock);
if (!p) {
PrintAndLog("Cannot allocate memory for default keys");
free(keyBlock);
memset(keyBlock + 8 * keycnt, 0, 8);
num_to_bytes(strtoull(buf, NULL, 16), 8, keyBlock + 8 * keycnt);
memset(keyBlock + 8 * keycnt, 0, 8);
num_to_bytes(strtoull(buf, NULL, 16), 8, keyBlock + 8 * keycnt);
- //PrintAndLog("check key[%2d] %016" PRIx64, keycnt, bytes_to_num(keyBlock + 8*keycnt, 8));
keycnt++;
memset(buf, 0, sizeof(buf));
}
fclose(f);
PrintAndLog("Loaded %2d keys from %s", keycnt, filename);
keycnt++;
memset(buf, 0, sizeof(buf));
}
fclose(f);
PrintAndLog("Loaded %2d keys from %s", keycnt, filename);
- // time
- uint64_t t1 = msclock();
-
uint8_t CSN[8];
if (!iClass_select(CSN, false, true, true)) {
uint8_t CSN[8];
if (!iClass_select(CSN, false, true, true)) {
- PrintAndLog("Couldn't select card");
DropField();
return 0;
}
for (uint32_t c = 0; c < keycnt; c++) {
DropField();
return 0;
}
for (uint32_t c = 0; c < keycnt; c++) {
- printf("."); fflush(stdout);
- if (ukbhit()) {
- int gc = getchar(); (void)gc;
- printf("\naborted via keyboard!\n");
- break;
- }
- memcpy(key, keyBlock + 8 * c , 8);
+ memcpy(key, keyBlock + 8 * c, 8);
- if (!iClass_authenticate(CSN, key, mac, div_key, false, use_elite, use_raw, false, false))
- continue;
-
- // key found.
- PrintAndLog("\n--------------------------------------------------------");
- PrintAndLog(" Found AA1 debit key\t\t[%s]", sprint_hex(key, 8));
- found_debit = true;
+ if (iClass_authenticate(CSN, key, mac, div_key, false, use_elite, use_raw, false, false)) {
+ PrintAndLog("\n Found AA1 debit key\t\t[%s]", sprint_hex(key, 8));
+ found_debit = true;
+ }
- if (!iClass_authenticate(CSN, key, mac, div_key, true, use_elite, use_raw, false, false))
- continue;
-
- // key found
- PrintAndLog("\n--------------------------------------------------------");
- PrintAndLog(" Found AA2 credit key\t\t[%s]", sprint_hex(key, 8));
- found_credit = true;
+ if (iClass_authenticate(CSN, key, mac, div_key, true, use_elite, use_raw, false, false)) {
+ PrintAndLog("\n Found AA2 credit key\t\t[%s]", sprint_hex(key, 8));
+ found_credit = true;
+ }
// both keys found.
if (found_debit && found_credit)
break;
}
// both keys found.
if (found_debit && found_credit)
break;
}
- t1 = msclock() - t1;
-
- PrintAndLog("\nTime in iclass checkkeys: %.0f seconds\n", (float)t1/1000.0);
-
DropField();
free(keyBlock);
PrintAndLog("");
DropField();
free(keyBlock);
PrintAndLog("");
const size_t min_str_len, const size_t spaces_between, bool uppercase) {
char *tmp = (char *)buf;
const size_t min_str_len, const size_t spaces_between, bool uppercase) {
char *tmp = (char *)buf;
- size_t i;
- memset(tmp, 0x00, hex_max_len);
- int maxLen = ( hex_len > hex_max_len) ? hex_max_len : hex_len;
+ int maxLen = (hex_len > hex_max_len) ? hex_max_len : hex_len;
- for (i = 0; i < maxLen; ++i, tmp += 2 + spaces_between) {
+ for (int i = 0; i < maxLen; ++i, tmp += 2 + spaces_between) {
sprintf(tmp, (uppercase) ? "%02X" : "%02x", (unsigned int) hex_data[i]);
sprintf(tmp, (uppercase) ? "%02X" : "%02x", (unsigned int) hex_data[i]);
- for (int j = 0; j < spaces_between; j++)
- sprintf(tmp + 2 + j, " ");
+ if (i != maxLen - 1)
+ for (int j = 0; j < spaces_between; j++)
+ sprintf(tmp + 2 + j, " ");
- i *= (2 + spaces_between);
- int minStrLen = min_str_len > i ? min_str_len : 0;
+ size_t len = strlen(tmp);
+ int minStrLen = min_str_len > len ? min_str_len : 0;
if (minStrLen > hex_max_len)
minStrLen = hex_max_len;
if (minStrLen > hex_max_len)
minStrLen = hex_max_len;
- for(; i < minStrLen; i++, tmp += 1)
+ for (int i = len; i < minStrLen; i++, tmp += 1)
sprintf(tmp, " ");
return;
sprintf(tmp, " ");
return;