]> cvs.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhficlass.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Add mifare crypto trace decryption utility
[proxmark3-svn] / client / cmdhficlass.c
CommitLineData
cee5a30d 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833 4// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// High frequency iClass commands
11//-----------------------------------------------------------------------------
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <string.h>
9f6e9d15 16#include <sys/stat.h>
cee5a30d 17#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18#include "data.h"
902cb3c0 19#include "proxmark3.h"
cee5a30d 20#include "ui.h"
21#include "cmdparser.h"
22#include "cmdhficlass.h"
23#include "common.h"
14006804 24#include "util.h"
17cba269 25#include "cmdmain.h"
a66fca86
AD		 26#include "loclass/des.h"
27#include "loclass/cipherutils.h"
28#include "loclass/cipher.h"
29#include "loclass/ikeys.h"
3ad48540
MHS		 30#include "loclass/elite_crack.h"
31#include "loclass/fileutils.h"
1defcf60 32#include "protocols.h"
caaf9618 33#include "usb_cmd.h"
aa53efc3 34#include "cmdhfmfu.h"
35
36#define llX PRIx64
cee5a30d 37
38static int CmdHelp(const char *Cmd);
39
aa53efc3 40#define ICLASS_KEYS_MAX 8
41static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
49 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
50};
51
52typedef struct iclass_block {
53 uint8_t d[8];
54} iclass_block_t;
55
4d68ec02 56int xorbits_8(uint8_t val) {
53444513
MHS		 57 uint8_t res = val ^ (val >> 1); //1st pass
58 res = res ^ (res >> 1); // 2nd pass
59 res = res ^ (res >> 2); // 3rd pass
60 res = res ^ (res >> 4); // 4th pass
61 return res & 1;
17cba269
MHS		 62}
63
4d68ec02 64int CmdHFiClassList(const char *Cmd) {
4c3de57a 65 PrintAndLog("Deprecated command, use 'hf list iclass' instead");
17cba269
MHS		 66 return 0;
67}
68
4d68ec02 69int CmdHFiClassSnoop(const char *Cmd) {
53444513
MHS		 70 UsbCommand c = {CMD_SNOOP_ICLASS};
71 SendCommand(&c);
72 return 0;
cee5a30d 73}
4d68ec02 74
75int usage_hf_iclass_sim(void) {
41524d8a
MHS		 76 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
77 PrintAndLog(" options");
78 PrintAndLog(" 0 <CSN> simulate the given CSN");
79 PrintAndLog(" 1 simulate default CSN");
80 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
81 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
82 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
83 PrintAndLog(" example: hf iclass sim 2");
84 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
85 PrintAndLog(" hf iclass sim 3");
86 return 0;
87}
88
6116c796 89#define NUM_CSNS 15
4d68ec02 90int CmdHFiClassSim(const char *Cmd) {
53444513
MHS		 91 uint8_t simType = 0;
92 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
93
94 if (strlen(Cmd)<1) {
1defcf60 95 return usage_hf_iclass_sim();
53444513 96 }
1defcf60 97 simType = param_get8ex(Cmd, 0, 0, 10);
53444513
MHS		 98
99 if(simType == 0)
100 {
101 if (param_gethex(Cmd, 1, CSN, 16)) {
102 PrintAndLog("A CSN should consist of 16 HEX symbols");
41524d8a 103 return usage_hf_iclass_sim();
53444513 104 }
53444513 105
41524d8a 106 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
53444513 107 }
41524d8a 108 if(simType > 3)
53444513
MHS		 109 {
110 PrintAndLog("Undefined simptype %d", simType);
41524d8a 111 return usage_hf_iclass_sim();
53444513 112 }
1e262141 113
41524d8a 114 uint8_t numberOfCSNs=0;
9f6e9d15
MHS		 115 if(simType == 2)
116 {
6116c796 117 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
9f6e9d15 118 UsbCommand resp = {0};
17cba269 119
53444513
MHS		 120 uint8_t csns[8*NUM_CSNS] = {
121 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
6116c796
MHS		 136
137 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
9f6e9d15
MHS		 138
139 SendCommand(&c);
140 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
141 PrintAndLog("Command timed out");
142 return 0;
143 }
1e262141 144
77abe781 145 uint8_t num_mac_responses = resp.arg[1];
6116c796 146 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
9f6e9d15 147
6116c796 148 size_t datalen = NUM_CSNS*24;
9f6e9d15
MHS		 149 /*
150 * Now, time to dump to file. We'll use this format:
77abe781 151 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15 152 * So, it should wind up as
77abe781
MHS		 153 * 8 * 24 bytes.
154 *
155 * The returndata from the pm3 is on the following format
156 * <4 byte NR><4 byte MAC>
157 * CC are all zeroes, CSN is the same as was sent in
9f6e9d15 158 **/
77abe781
MHS		 159 void* dump = malloc(datalen);
160 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15 161 uint8_t i = 0;
6116c796 162 for(i = 0 ; i < NUM_CSNS ; i++)
9f6e9d15 163 {
77abe781
MHS		 164 memcpy(dump+i*24, csns+i*8,8); //CSN
165 //8 zero bytes here...
166 //Then comes NR_MAC (eight bytes from the response)
167 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
1e262141 168
9f6e9d15
MHS		 169 }
170 /** Now, save to dumpfile **/
77abe781
MHS		 171 saveFile("iclass_mac_attack", "bin", dump,datalen);
172 free(dump);
9f6e9d15
MHS		 173 }else
174 {
175 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
176 memcpy(c.d.asBytes, CSN, 8);
177 SendCommand(&c);
178 }
1e262141 179
53444513 180 return 0;
1e262141 181}
182
4d68ec02 183int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
6ce0e538 184 bool tagFound = false;
caaf9618
MHS		 185 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
186 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
aa53efc3 187 // loop in client not device - else on windows have a communication error
188 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
53444513
MHS		 189 UsbCommand resp;
190 while(!ukbhit()){
aa53efc3 191 SendCommand(&c);
6ce0e538 192 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
193 uint8_t readStatus = resp.arg[0] & 0xff;
194 uint8_t *data = resp.d.asBytes;
53444513 195
6ce0e538 196 if (verbose)
197 PrintAndLog("Readstatus:%02x", readStatus);
caaf9618 198 if( readStatus == 0){
53444513 199 //Aborted
6ce0e538 200 if (verbose) PrintAndLog("Quitting...");
53444513
MHS		 201 return 0;
202 }
6ce0e538 203 if( readStatus & FLAG_ICLASS_READER_CSN){
204 PrintAndLog("CSN: %s",sprint_hex(data,8));
205 tagFound = true;
206 }
caaf9618
MHS		 207 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
208 if( readStatus & FLAG_ICLASS_READER_CONF){
209 printIclassDumpInfo(data);
53444513 210 }
6ce0e538 211 if (tagFound && !loop) return 1;
53444513 212 } else {
6ce0e538 213 if (verbose) PrintAndLog("Command execute timeout");
53444513 214 }
6ce0e538 215 if (!loop) break;
53444513 216 }
53444513 217 return 0;
6ce0e538 218}
219
4d68ec02 220int CmdHFiClassReader(const char *Cmd) {
6ce0e538 221 return HFiClassReader(Cmd, true, true);
c3963755 222}
223
4d68ec02 224int CmdHFiClassReader_Replay(const char *Cmd) {
53444513
MHS		 225 uint8_t readerType = 0;
226 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
c3963755 227
53444513
MHS		 228 if (strlen(Cmd)<1) {
229 PrintAndLog("Usage: hf iclass replay <MAC>");
230 PrintAndLog(" sample: hf iclass replay 00112233");
231 return 0;
232 }
c3963755 233
53444513
MHS		 234 if (param_gethex(Cmd, 0, MAC, 8)) {
235 PrintAndLog("MAC must include 8 HEX symbols");
236 return 1;
237 }
c3963755 238
53444513
MHS		 239 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
240 memcpy(c.d.asBytes, MAC, 4);
241 SendCommand(&c);
1e262141 242
53444513 243 return 0;
1e262141 244}
245
4d68ec02 246int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
247 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
248 memcpy(c.d.asBytes, data, blocksCount * 16);
249 SendCommand(&c);
250 return 0;
251}
252
253int hf_iclass_eload_usage(void) {
7781a656
MHS		 254 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
255 PrintAndLog("Usage: hf iclass eload f <filename>");
256 PrintAndLog("");
257 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
258 return 0;
7781a656
MHS		 259}
260
4d68ec02 261int CmdHFiClassELoad(const char *Cmd) {
7781a656
MHS		 262
263 char opt = param_getchar(Cmd, 0);
264 if (strlen(Cmd)<1 || opt == 'h')
265 return hf_iclass_eload_usage();
266
267 //File handling and reading
268 FILE *f;
269 char filename[FILE_PATH_SIZE];
270 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
271 {
272 f = fopen(filename, "rb");
273 }else{
274 return hf_iclass_eload_usage();
275 }
276
277 if(!f) {
278 PrintAndLog("Failed to read from file '%s'", filename);
279 return 1;
280 }
281
282 fseek(f, 0, SEEK_END);
283 long fsize = ftell(f);
284 fseek(f, 0, SEEK_SET);
285
286 uint8_t *dump = malloc(fsize);
1defcf60
MHS		 287
288
7781a656
MHS		 289 size_t bytes_read = fread(dump, 1, fsize, f);
290 fclose(f);
291
1defcf60 292 printIclassDumpInfo(dump);
7781a656
MHS		 293 //Validate
294
295 if (bytes_read < fsize)
296 {
297 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
298 free(dump);
299 return 1;
300 }
301 //Send to device
302 uint32_t bytes_sent = 0;
303 uint32_t bytes_remaining = bytes_read;
304
305 while(bytes_remaining > 0){
306 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
307 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
308 memcpy(c.d.asBytes, dump, bytes_in_packet);
309 SendCommand(&c);
310 bytes_remaining -= bytes_in_packet;
311 bytes_sent += bytes_in_packet;
312 }
313 free(dump);
314 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
315 return 0;
316}
317
4d68ec02 318static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
41524d8a
MHS		 319 FILE *f = fopen(filename, "rb");
320 if(!f) {
321 PrintAndLog("Failed to read from file '%s'", filename);
322 return 1;
323 }
324 fseek(f, 0, SEEK_END);
325 long fsize = ftell(f);
326 fseek(f, 0, SEEK_SET);
327 size_t bytes_read = fread(buffer, 1, len, f);
328 fclose(f);
329 if(fsize != len)
330 {
331 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
332 return 1;
333 }
334 if(bytes_read != len)
335 {
336 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
337 return 1;
338 }
339 return 0;
340}
341
4d68ec02 342int usage_hf_iclass_decrypt(void) {
343 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
aa53efc3 344 PrintAndLog("");
345 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
346 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
347 PrintAndLog("");
348 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
349 PrintAndLog("");
350 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
351 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
352 PrintAndLog("which is defined by the configuration block.");
353 return 1;
354}
355
4d68ec02 356int CmdHFiClassDecrypt(const char *Cmd) {
41524d8a
MHS		 357 uint8_t key[16] = { 0 };
358 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
359 {
360 usage_hf_iclass_decrypt();
361 return 1;
362 }
363 PrintAndLog("Decryption file found... ");
364 char opt = param_getchar(Cmd, 0);
365 if (strlen(Cmd)<1 || opt == 'h')
366 return usage_hf_iclass_decrypt();
367
368 //Open the tagdump-file
369 FILE *f;
370 char filename[FILE_PATH_SIZE];
371 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
372 {
373 f = fopen(filename, "rb");
374 }else{
375 return usage_hf_iclass_decrypt();
376 }
377
378 fseek(f, 0, SEEK_END);
379 long fsize = ftell(f);
380 fseek(f, 0, SEEK_SET);
381 uint8_t enc_dump[8] = {0};
382 uint8_t *decrypted = malloc(fsize);
383 des3_context ctx = { DES_DECRYPT ,{ 0 } };
384 des3_set2key_dec( &ctx, key);
385 size_t bytes_read = fread(enc_dump, 1, 8, f);
386
387 //Use the first block (CSN) for filename
388 char outfilename[FILE_PATH_SIZE] = { 0 };
389 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
390 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
391 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
392
393 size_t blocknum =0;
394 while(bytes_read == 8)
395 {
9a9bcea8 396 if(blocknum < 7)
41524d8a
MHS		 397 {
398 memcpy(decrypted+(blocknum*8), enc_dump, 8);
399 }else{
400 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
401 }
402 printvar("decrypted block", decrypted +(blocknum*8), 8);
403 bytes_read = fread(enc_dump, 1, 8, f);
404 blocknum++;
405 }
406 fclose(f);
407
408 saveFile(outfilename,"bin", decrypted, blocknum*8);
409
410 return 0;
411}
7781a656 412
4d68ec02 413int usage_hf_iclass_encrypt(void) {
aa53efc3 414 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
415 PrintAndLog("");
416 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
417 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
418 PrintAndLog("");
419 PrintAndLog("example: hf iclass encrypt 0102030405060708");
420 PrintAndLog("");
421 return 0;
422}
423
4d68ec02 424static int iClassEncryptBlkData(uint8_t *blkData) {
aa53efc3 425 uint8_t key[16] = { 0 };
426 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
427 {
428 usage_hf_iclass_encrypt();
429 return 1;
430 }
431 PrintAndLog("Decryption file found... ");
53444513 432
4d68ec02 433 uint8_t encryptedData[16];
434 uint8_t *encrypted = encryptedData;
aa53efc3 435 des3_context ctx = { DES_DECRYPT ,{ 0 } };
436 des3_set2key_enc( &ctx, key);
437
4d68ec02 438 des3_crypt_ecb(&ctx, blkData,encrypted);
aa53efc3 439 //printvar("decrypted block", decrypted, 8);
4d68ec02 440 memcpy(blkData,encrypted,8);
aa53efc3 441
442 return 1;
443}
444
4d68ec02 445int CmdHFiClassEncryptBlk(const char *Cmd) {
aa53efc3 446 uint8_t blkData[8] = {0};
447 char opt = param_getchar(Cmd, 0);
448 if (strlen(Cmd)<1 || opt == 'h')
449 return usage_hf_iclass_encrypt();
53444513 450
aa53efc3 451 //get the bytes to encrypt
452 if (param_gethex(Cmd, 0, blkData, 16))
53444513 453 {
aa53efc3 454 PrintAndLog("BlockData must include 16 HEX symbols");
53444513
MHS		 455 return 0;
456 }
aa53efc3 457 if (!iClassEncryptBlkData(blkData)) return 0;
53444513 458
aa53efc3 459 printvar("encrypted block", blkData, 8);
460 return 1;
461}
53444513 462
4d68ec02 463void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
aa53efc3 464 uint8_t WB[9];
465 WB[0] = blockno;
466 memcpy(WB + 1,data,8);
467 doMAC_N(WB,sizeof(WB),div_key,MAC);
468 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
469}
53444513 470
4d68ec02 471static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
53444513
MHS		 472 UsbCommand resp;
473
aa53efc3 474 UsbCommand c = {CMD_READER_ICLASS, {0}};
3ac22ee1 475 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
aa53efc3 476 if (use_credit_key)
477 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
53444513 478
aa53efc3 479 clearCommandBuffer();
480 SendCommand(&c);
481 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
482 {
53444513 483 PrintAndLog("Command execute timeout");
aa53efc3 484 return false;
53444513
MHS		 485 }
486
aa53efc3 487 uint8_t isOK = resp.arg[0] & 0xff;
488 uint8_t *data = resp.d.asBytes;
53444513 489
aa53efc3 490 memcpy(CSN,data,8);
491 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
aa53efc3 492 if(isOK > 0)
493 {
494 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
53444513 495 }
aa53efc3 496 if(isOK <= 1){
497 PrintAndLog("Failed to obtain CC! Aborting");
498 return false;
499 }
500 return true;
a66fca86 501}
6f101995 502
aa53efc3 503static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool verbose) {
504 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
505 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
aa53efc3 506
507 if (!select_only(CSN, CCNR, use_credit_key, verbose))
508 return false;
509
4d68ec02 510 //get div_key
511 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
512
aa53efc3 513 doMAC(CCNR, div_key, MAC);
aa53efc3 514 UsbCommand resp;
515 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
516 memcpy(d.d.asBytes, MAC, 4);
517 clearCommandBuffer();
518 SendCommand(&d);
519 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
520 {
521 PrintAndLog("Auth Command execute timeout");
522 return false;
523 }
524 uint8_t isOK = resp.arg[0] & 0xff;
525 if (!isOK) {
526 PrintAndLog("Authentication error");
527 return false;
528 }
529 return true;
530}
531
4d68ec02 532int usage_hf_iclass_dump(void) {
aa53efc3 533 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e\n");
534 PrintAndLog("Options:");
535 PrintAndLog(" f <filename> : specify a filename to save dump to");
536 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
537 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
538 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
539 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
540 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
541 PrintAndLog(" NOTE: * = required");
542 PrintAndLog("Samples:");
543 PrintAndLog(" hf iclass dump k 001122334455667B");
544 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
545 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
546 return 0;
547}
548
4d68ec02 549int CmdHFiClassReader_Dump(const char *Cmd) {
aa53efc3 550
551 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
552 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
553 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
554 uint8_t blockno = 0;
555 uint8_t numblks = 0;
4d68ec02 556 uint8_t maxBlk = 31;
bbd19bec 557 uint8_t app_areas = 1;
b82d8098 558 uint8_t kb = 2;
aa53efc3 559 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
560 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
561 uint8_t keyNbr = 0;
562 uint8_t dataLen = 0;
563 uint8_t fileNameLen = 0;
564 char filename[FILE_PATH_SIZE]={0};
565 char tempStr[50] = {0};
4d68ec02 566 bool have_debit_key = false;
aa53efc3 567 bool have_credit_key = false;
4d68ec02 568 bool use_credit_key = false;
aa53efc3 569 bool elite = false;
570 bool errors = false;
571 uint8_t cmdp = 0;
572
573 while(param_getchar(Cmd, cmdp) != 0x00)
574 {
575 switch(param_getchar(Cmd, cmdp))
576 {
577 case 'h':
578 case 'H':
579 return usage_hf_iclass_dump();
580 case 'c':
581 case 'C':
582 have_credit_key = true;
583 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
584 if (dataLen == 16) {
585 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
586 } else if (dataLen == 1) {
587 keyNbr = param_get8(Cmd, cmdp+1);
588 if (keyNbr <= ICLASS_KEYS_MAX) {
589 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
590 } else {
591 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
592 errors = true;
593 }
594 } else {
595 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
596 errors = true;
597 }
598 cmdp += 2;
599 break;
600 case 'e':
601 case 'E':
602 elite = true;
603 cmdp++;
604 break;
605 case 'f':
606 case 'F':
607 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
608 if (fileNameLen < 1) {
609 PrintAndLog("No filename found after f");
610 errors = true;
611 }
612 cmdp += 2;
613 break;
614 case 'k':
615 case 'K':
4d68ec02 616 have_debit_key = true;
aa53efc3 617 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
618 if (dataLen == 16) {
619 errors = param_gethex(tempStr, 0, KEY, dataLen);
620 } else if (dataLen == 1) {
621 keyNbr = param_get8(Cmd, cmdp+1);
622 if (keyNbr <= ICLASS_KEYS_MAX) {
623 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
624 } else {
625 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
626 errors = true;
627 }
628 } else {
629 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
630 errors = true;
631 }
632 cmdp += 2;
633 break;
634 default:
635 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
636 errors = true;
637 break;
638 }
639 if(errors) return usage_hf_iclass_dump();
640 }
641
642 if (cmdp < 2) return usage_hf_iclass_dump();
4d68ec02 643 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
644 if (!have_debit_key && have_credit_key) use_credit_key = true;
aa53efc3 645
646 //get config and first 3 blocks
647 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
648 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
649 UsbCommand resp;
650 uint8_t tag_data[255*8];
4d68ec02 651
aa53efc3 652 clearCommandBuffer();
653 SendCommand(&c);
4d68ec02 654 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
aa53efc3 655 PrintAndLog("Command execute timeout");
3ac22ee1 656 ul_switch_off_field();
aa53efc3 657 return 0;
658 }
4d68ec02 659 uint8_t readStatus = resp.arg[0] & 0xff;
660 uint8_t *data = resp.d.asBytes;
661
662 if(readStatus == 0){
663 PrintAndLog("No tag found...");
3ac22ee1 664 ul_switch_off_field();
4d68ec02 665 return 0;
666 }
667 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
668 memcpy(tag_data, data, 8*3);
669 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
670 numblks = data[8];
bbd19bec 671 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
b82d8098 672 // large memory - not able to dump pages currently
4d68ec02 673 if (numblks > maxBlk) numblks = maxBlk;
674 }
3ac22ee1 675 ul_switch_off_field();
4d68ec02 676 // authenticate debit key and get div_key - later store in dump block 3
677 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
aa53efc3 678 //try twice - for some reason it sometimes fails the first time...
4d68ec02 679 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
aa53efc3 680 ul_switch_off_field();
681 return 0;
682 }
683 }
aa53efc3 684
4d68ec02 685 // begin dump
3ac22ee1 686 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
aa53efc3 687 clearCommandBuffer();
688 SendCommand(&w);
689 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
690 PrintAndLog("Command execute time-out 1");
3ac22ee1 691 ul_switch_off_field();
aa53efc3 692 return 1;
693 }
694 uint32_t blocksRead = resp.arg[1];
695 uint8_t isOK = resp.arg[0] & 0xff;
696 if (!isOK && !blocksRead) {
697 PrintAndLog("Read Block Failed");
3ac22ee1 698 ul_switch_off_field();
aa53efc3 699 return 0;
700 }
701 uint32_t startindex = resp.arg[2];
702 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
703 PrintAndLog("Data exceeded Buffer size!");
704 blocksRead = (sizeof(tag_data)/8) - blockno;
705 }
4d68ec02 706 // response ok - now get bigbuf content of the dump
aa53efc3 707 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
708 WaitForResponse(CMD_ACK,NULL);
4d68ec02 709 size_t gotBytes = blocksRead*8 + blockno*8;
aa53efc3 710
4d68ec02 711 // try AA2
712 if (have_credit_key) {
713 //turn off hf field before authenticating with different key
aa53efc3 714 ul_switch_off_field();
aa53efc3 715 memset(MAC,0,4);
4d68ec02 716 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
aa53efc3 717 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
718 //try twice - for some reason it sometimes fails the first time...
719 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
720 ul_switch_off_field();
721 return 0;
722 }
723 }
4d68ec02 724 // do we still need to read more block? (aa2 enabled?)
725 if (maxBlk > blockno+numblks+1) {
726 // setup dump and start
727 w.arg[0] = blockno + blocksRead;
728 w.arg[1] = maxBlk - (blockno + blocksRead);
4d68ec02 729 clearCommandBuffer();
730 SendCommand(&w);
731 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
732 PrintAndLog("Command execute timeout 2");
3ac22ee1 733 ul_switch_off_field();
4d68ec02 734 return 0;
735 }
736 uint8_t isOK = resp.arg[0] & 0xff;
737 blocksRead = resp.arg[1];
738 if (!isOK && !blocksRead) {
739 PrintAndLog("Read Block Failed 2");
3ac22ee1 740 ul_switch_off_field();
4d68ec02 741 return 0;
742 }
aa53efc3 743
4d68ec02 744 startindex = resp.arg[2];
745 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
746 PrintAndLog("Data exceeded Buffer size!");
747 blocksRead = (sizeof(tag_data) - gotBytes)/8;
748 }
749 // get dumped data from bigbuf
750 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
751 WaitForResponse(CMD_ACK,NULL);
aa53efc3 752
4d68ec02 753 gotBytes += blocksRead*8;
754 } else { //field is still on - turn it off...
755 ul_switch_off_field();
756 }
aa53efc3 757 }
758
4d68ec02 759 // add diversified keys to dump
760 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
761 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
762 // print the dump
763 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
764 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
765 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
aa53efc3 766
aa53efc3 767 if (filename[0] == 0){
768 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
769 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
770 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
771 }
4d68ec02 772
773 // save the dump to .bin file
aa53efc3 774 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
4d68ec02 775 saveFile(filename, "bin", tag_data, gotBytes);
aa53efc3 776 return 1;
777}
778
4d68ec02 779static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool verbose) {
aa53efc3 780 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
781 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
aa53efc3 782 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, verbose))
783 return 0;
784
785 UsbCommand resp;
786
787 Calc_wb_mac(blockno,bldata,div_key,MAC);
3ac22ee1 788 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
aa53efc3 789 memcpy(w.d.asBytes, bldata, 8);
3ac22ee1 790 memcpy(w.d.asBytes + 8, MAC, 4);
aa53efc3 791
792 clearCommandBuffer();
793 SendCommand(&w);
794 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
795 {
796 PrintAndLog("Write Command execute timeout");
797 return 0;
798 }
799 uint8_t isOK = resp.arg[0] & 0xff;
800 if (!isOK) {
801 PrintAndLog("Write Block Failed");
802 return 0;
803 }
804 PrintAndLog("Write Block Successful");
aa53efc3 805 return 1;
806}
807
4d68ec02 808int usage_hf_iclass_writeblock(void) {
aa53efc3 809 PrintAndLog("Options:");
810 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
811 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
812 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
813 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
814 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
815 PrintAndLog("Samples:");
816 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
817 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
818 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
819 return 0;
820}
821
822int CmdHFiClass_WriteBlock(const char *Cmd) {
823 uint8_t blockno=0;
3ac22ee1 824 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
aa53efc3 825 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
826 uint8_t keyNbr = 0;
827 uint8_t dataLen = 0;
828 char tempStr[50] = {0};
829 bool use_credit_key = false;
830 bool elite = false;
831 bool errors = false;
832 uint8_t cmdp = 0;
833 while(param_getchar(Cmd, cmdp) != 0x00)
834 {
835 switch(param_getchar(Cmd, cmdp))
836 {
837 case 'h':
838 case 'H':
839 return usage_hf_iclass_writeblock();
840 case 'b':
841 case 'B':
842 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
843 PrintAndLog("Block No must include 2 HEX symbols\n");
844 errors = true;
845 }
846 cmdp += 2;
847 break;
848 case 'c':
849 case 'C':
850 use_credit_key = true;
851 cmdp++;
852 break;
853 case 'd':
854 case 'D':
855 if (param_gethex(Cmd, cmdp+1, bldata, 16))
856 {
857 PrintAndLog("KEY must include 16 HEX symbols\n");
858 errors = true;
859 }
860 cmdp += 2;
861 break;
862 case 'e':
863 case 'E':
864 elite = true;
865 cmdp++;
866 break;
867 case 'k':
868 case 'K':
869 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
870 if (dataLen == 16) {
871 errors = param_gethex(tempStr, 0, KEY, dataLen);
872 } else if (dataLen == 1) {
873 keyNbr = param_get8(Cmd, cmdp+1);
874 if (keyNbr <= ICLASS_KEYS_MAX) {
875 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
876 } else {
877 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
878 errors = true;
879 }
880 } else {
881 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
882 errors = true;
883 }
884 cmdp += 2;
885 break;
886 default:
887 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
888 errors = true;
889 break;
890 }
891 if(errors) return usage_hf_iclass_writeblock();
892 }
893
894 if (cmdp < 6) return usage_hf_iclass_writeblock();
3ac22ee1 895 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, true);
896 ul_switch_off_field();
897 return ans;
aa53efc3 898}
899
4d68ec02 900int usage_hf_iclass_clone(void) {
aa53efc3 901 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> e c");
902 PrintAndLog("Options:");
903 PrintAndLog(" f <filename>: specify a filename to clone from");
904 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
905 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
906 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
907 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
908 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
909 PrintAndLog("Samples:");
910 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
911 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
912 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
913 return -1;
914}
915
916int CmdHFiClassCloneTag(const char *Cmd) {
917 char filename[FILE_PATH_SIZE];
918 char tempStr[50]={0};
919 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
920 uint8_t keyNbr = 0;
921 uint8_t fileNameLen = 0;
922 uint8_t startblock = 0;
923 uint8_t endblock = 0;
924 uint8_t dataLen = 0;
925 bool use_credit_key = false;
926 bool elite = false;
927 bool errors = false;
928 uint8_t cmdp = 0;
929 while(param_getchar(Cmd, cmdp) != 0x00)
930 {
931 switch(param_getchar(Cmd, cmdp))
932 {
933 case 'h':
934 case 'H':
935 return usage_hf_iclass_clone();
936 case 'b':
937 case 'B':
938 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
939 PrintAndLog("Start Block No must include 2 HEX symbols\n");
940 errors = true;
941 }
942 cmdp += 2;
943 break;
944 case 'c':
945 case 'C':
946 use_credit_key = true;
947 cmdp++;
948 break;
949 case 'e':
950 case 'E':
951 elite = true;
952 cmdp++;
953 break;
954 case 'f':
955 case 'F':
956 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
957 if (fileNameLen < 1) {
958 PrintAndLog("No filename found after f");
959 errors = true;
960 }
961 cmdp += 2;
962 break;
963 case 'k':
964 case 'K':
965 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
966 if (dataLen == 16) {
967 errors = param_gethex(tempStr, 0, KEY, dataLen);
968 } else if (dataLen == 1) {
969 keyNbr = param_get8(Cmd, cmdp+1);
970 if (keyNbr <= ICLASS_KEYS_MAX) {
971 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
972 } else {
973 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
974 errors = true;
975 }
976 } else {
977 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
978 errors = true;
979 }
980 cmdp += 2;
981 break;
982 case 'l':
983 case 'L':
984 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
985 PrintAndLog("Start Block No must include 2 HEX symbols\n");
986 errors = true;
987 }
988 cmdp += 2;
989 break;
990 default:
991 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
992 errors = true;
993 break;
994 }
995 if(errors) return usage_hf_iclass_clone();
996 }
997
998 if (cmdp < 8) return usage_hf_iclass_clone();
999
1000 FILE *f;
1001
1002 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1003
1004 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1005 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1006 }
1007 // file handling and reading
1008 f = fopen(filename,"rb");
1009 if(!f) {
1010 PrintAndLog("Failed to read from file '%s'", filename);
1011 return 1;
1012 }
1013
1014 if (startblock<5) {
1015 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1016 return 0;
1017 }
1018 // now read data from the file from block 6 --- 19
1019 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1020 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1021 // else we have to create a share memory
1022 int i;
1023 fseek(f,startblock*8,SEEK_SET);
1024 fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f);
aa53efc3 1025
1026 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1027 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1028
1029 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, true))
1030 return 0;
1031
3ac22ee1 1032 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
aa53efc3 1033 uint8_t *ptr;
1034 // calculate all mac for every the block we will write
1035 for (i = startblock; i <= endblock; i++){
1036 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1037 // usb command d start pointer = d + (i - 6) * 12
1038 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1039 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1040 // next one
1041 ptr = w.d.asBytes + (i - startblock) * 12;
1042 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1043 memcpy(ptr + 8,MAC, 4);
1044 }
1045 uint8_t p[12];
1046 for (i = 0; i <= endblock - startblock;i++){
1047 memcpy(p,w.d.asBytes + (i * 12),12);
4d68ec02 1048 printf("Block |%02x|",i + startblock);
1049 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1050 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
aa53efc3 1051 }
1052 UsbCommand resp;
1053 SendCommand(&w);
1054 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1055 {
1056 PrintAndLog("Command execute timeout");
1057 return 0;
1058 }
1059 return 1;
1060}
1061
4d68ec02 1062static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool verbose) {
aa53efc3 1063 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1064 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1065
1066 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, verbose))
1067 return 0;
1068
1069 UsbCommand resp;
3ac22ee1 1070 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
aa53efc3 1071 clearCommandBuffer();
1072 SendCommand(&w);
1073 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1074 {
1075 PrintAndLog("Command execute timeout");
1076 return 0;
1077 }
1078 uint8_t isOK = resp.arg[0] & 0xff;
1079 if (!isOK) {
1080 PrintAndLog("Read Block Failed");
1081 return 0;
1082 }
1083 //data read is stored in: resp.d.asBytes[0-15]
1084 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1085 return 1;
1086}
1087
4d68ec02 1088int usage_hf_iclass_readblock(void) {
aa53efc3 1089 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e\n");
1090 PrintAndLog("Options:");
1091 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1092 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1093 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1094 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1095 PrintAndLog("Samples:");
1096 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1097 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1098 PrintAndLog(" hf iclass readblk b 0A k 0");
1099 return 0;
1100}
1101
4d68ec02 1102int CmdHFiClass_ReadBlock(const char *Cmd) {
aa53efc3 1103 uint8_t blockno=0;
1104 uint8_t keyType = 0x88; //debit key
1105 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1106 uint8_t keyNbr = 0;
1107 uint8_t dataLen = 0;
1108 char tempStr[50] = {0};
1109 bool elite = false;
1110 bool errors = false;
1111 uint8_t cmdp = 0;
1112 while(param_getchar(Cmd, cmdp) != 0x00)
1113 {
1114 switch(param_getchar(Cmd, cmdp))
1115 {
1116 case 'h':
1117 case 'H':
1118 return usage_hf_iclass_readblock();
1119 case 'b':
1120 case 'B':
1121 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1122 PrintAndLog("Block No must include 2 HEX symbols\n");
1123 errors = true;
1124 }
1125 cmdp += 2;
1126 break;
1127 case 'c':
1128 case 'C':
1129 keyType = 0x18;
1130 cmdp++;
1131 break;
1132 case 'e':
1133 case 'E':
1134 elite = true;
1135 cmdp++;
1136 break;
1137 case 'k':
1138 case 'K':
1139 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1140 if (dataLen == 16) {
1141 errors = param_gethex(tempStr, 0, KEY, dataLen);
1142 } else if (dataLen == 1) {
1143 keyNbr = param_get8(Cmd, cmdp+1);
1144 if (keyNbr <= ICLASS_KEYS_MAX) {
1145 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1146 } else {
1147 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1148 errors = true;
1149 }
1150 } else {
1151 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1152 errors = true;
1153 }
1154 cmdp += 2;
1155 break;
1156 default:
1157 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1158 errors = true;
1159 break;
1160 }
1161 if(errors) return usage_hf_iclass_readblock();
1162 }
1163
1164 if (cmdp < 4) return usage_hf_iclass_readblock();
4d68ec02 1165
aa53efc3 1166 return ReadBlock(KEY, blockno, keyType, elite, true);
1167}
1168
4d68ec02 1169int CmdHFiClass_loclass(const char *Cmd) {
aa53efc3 1170 char opt = param_getchar(Cmd, 0);
1171
1172 if (strlen(Cmd)<1 || opt == 'h') {
1173 PrintAndLog("Usage: hf iclass loclass [options]");
1174 PrintAndLog("Options:");
1175 PrintAndLog("h Show this help");
6f101995
MHS		 1176 PrintAndLog("t Perform self-test");
1177 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1178 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1179 PrintAndLog(" malicious CSNs, and their protocol responses");
1180 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1181 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1182 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1183 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1184 PrintAndLog(" ... totalling N*24 bytes");
1185 return 0;
1186 }
1187 char fileName[255] = {0};
1188 if(opt == 'f')
1189 {
53444513
MHS		 1190 if(param_getstr(Cmd, 1, fileName) > 0)
1191 {
1192 return bruteforceFileNoKeys(fileName);
1193 }else
1194 {
1195 PrintAndLog("You must specify a filename");
1196 }
6f101995
MHS		 1197 }
1198 else if(opt == 't')
1199 {
1200 int errors = testCipherUtils();
1201 errors += testMAC();
1202 errors += doKeyTests(0);
1203 errors += testElite();
1204 if(errors)
1205 {
1206 prnlog("OBS! There were errors!!!");
1207 }
1208 return errors;
1209 }
a66fca86 1210
6f101995
MHS		 1211 return 0;
1212}
c3963755 1213
4d68ec02 1214void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
aa53efc3 1215 uint8_t blockdata[8];
1216 uint8_t mem_config;
1217 memcpy(&mem_config, iclass_dump + 13,1);
1218 uint8_t maxmemcount;
1219 uint8_t filemaxblock = filesize / 8;
4d68ec02 1220 if (mem_config & 0x80)
aa53efc3 1221 maxmemcount = 255;
1222 else
4d68ec02 1223 maxmemcount = 31;
1224 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
aa53efc3 1225
1226 if (startblock == 0)
1227 startblock = 6;
1228 if ((endblock > maxmemcount) || (endblock == 0))
1229 endblock = maxmemcount;
1230 if (endblock > filemaxblock)
1231 endblock = filemaxblock;
1232 int i = startblock;
1233 int j;
4d68ec02 1234 while (i <= endblock){
1235 printf("Block |%02X| ",i);
aa53efc3 1236 memcpy(blockdata,iclass_dump + (i * 8),8);
1237 for (j = 0;j < 8;j++)
1238 printf("%02X ",blockdata[j]);
4d68ec02 1239 printf("|\n");
aa53efc3 1240 i++;
1241 }
aa53efc3 1242}
1243
4d68ec02 1244int usage_hf_iclass_readtagfile() {
1245 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1246 return 1;
1247}
1248
1249int CmdHFiClassReadTagFile(const char *Cmd) {
aa53efc3 1250 int startblock = 0;
1251 int endblock = 0;
1252 char tempnum[5];
1253 FILE *f;
1254 char filename[FILE_PATH_SIZE];
1255 if (param_getstr(Cmd, 0, filename) < 1)
1256 return usage_hf_iclass_readtagfile();
1257 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1258 startblock = 0;
1259 else
1260 sscanf(tempnum,"%d",&startblock);
1261
1262 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1263 endblock = 0;
1264 else
1265 sscanf(tempnum,"%d",&endblock);
1266 // file handling and reading
1267 f = fopen(filename,"rb");
1268 if(!f) {
1269 PrintAndLog("Failed to read from file '%s'", filename);
1270 return 1;
1271 }
1272 fseek(f, 0, SEEK_END);
1273 long fsize = ftell(f);
1274 fseek(f, 0, SEEK_SET);
1275
1276 uint8_t *dump = malloc(fsize);
1277
1278
1279 size_t bytes_read = fread(dump, 1, fsize, f);
1280 fclose(f);
1281 uint8_t *csn = dump;
4d68ec02 1282 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
aa53efc3 1283 // printIclassDumpInfo(dump);
1284 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1285 free(dump);
1286 return 0;
1287}
1288
4d68ec02 1289/*
1290uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
aa53efc3 1291 uint64_t new_div = 0x00;
1292 new_div ^= sdiv;
1293 new_div ^= hdiv;
1294 return new_div;
1295}
1296
4d68ec02 1297uint64_t hexarray_to_uint64(uint8_t *key) {
aa53efc3 1298 char temp[17];
1299 uint64_t uint_key;
1300 for (int i = 0;i < 8;i++)
1301 sprintf(&temp[(i *2)],"%02X",key[i]);
1302 temp[16] = '\0';
1303 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1304 return 0;
1305 return uint_key;
1306}
4d68ec02 1307*/
1308void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
aa53efc3 1309 uint8_t keytable[128] = {0};
1310 uint8_t key_index[8] = {0};
4d68ec02 1311 if (elite) {
1312 uint8_t key_sel[8] = { 0 };
1313 uint8_t key_sel_p[8] = { 0 };
1314 hash2(KEY, keytable);
1315 hash1(CSN, key_index);
1316 for(uint8_t i = 0; i < 8 ; i++)
1317 key_sel[i] = keytable[key_index[i]] & 0xFF;
aa53efc3 1318
4d68ec02 1319 //Permute from iclass format to standard format
1320 permutekey_rev(key_sel, key_sel_p);
1321 diversifyKey(CSN, key_sel_p, div_key);
1322 } else {
1323 diversifyKey(CSN, KEY, div_key);
1324 }
1325}
aa53efc3 1326
4d68ec02 1327//when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1328//calculate and return xor_div_key (ready for a key write command)
1329//print all div_keys if verbose
1330static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1331 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1332 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1333 //get old div key
1334 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1335 //get new div key
1336 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1337
1338 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1339 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1340 }
1341 if (verbose) {
1342 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1343 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1344 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1345 }
1346}
aa53efc3 1347
4d68ec02 1348int usage_hf_iclass_calc_newkey(void) {
1349 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1350 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1351 PrintAndLog(" Options:");
1352 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1353 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1354 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1355 PrintAndLog(" e : specify new key as elite calc");
1356 PrintAndLog(" ee : specify old and new key as elite calc");
1357 PrintAndLog("Samples:");
1358 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1359 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1360 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1361 PrintAndLog("NOTE: * = required\n");
aa53efc3 1362
4d68ec02 1363 return 1;
1364}
aa53efc3 1365
4d68ec02 1366int CmdHFiClassCalcNewKey(const char *Cmd) {
1367 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1368 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1369 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1370 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1371 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1372 uint8_t keyNbr = 0;
1373 uint8_t dataLen = 0;
1374 char tempStr[50] = {0};
1375 bool givenCSN = false;
1376 bool oldElite = false;
1377 bool elite = false;
1378 bool errors = false;
1379 uint8_t cmdp = 0;
1380 while(param_getchar(Cmd, cmdp) != 0x00)
1381 {
1382 switch(param_getchar(Cmd, cmdp))
1383 {
1384 case 'h':
1385 case 'H':
1386 return usage_hf_iclass_calc_newkey();
1387 case 'e':
1388 case 'E':
1389 dataLen = param_getstr(Cmd, cmdp, tempStr);
1390 if (dataLen==2)
1391 oldElite = true;
1392 elite = true;
1393 cmdp++;
1394 break;
1395 case 'n':
1396 case 'N':
1397 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1398 if (dataLen == 16) {
1399 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1400 } else if (dataLen == 1) {
1401 keyNbr = param_get8(Cmd, cmdp+1);
1402 if (keyNbr <= ICLASS_KEYS_MAX) {
1403 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1404 } else {
1405 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1406 errors = true;
1407 }
1408 } else {
1409 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1410 errors = true;
1411 }
1412 cmdp += 2;
1413 break;
1414 case 'o':
1415 case 'O':
1416 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1417 if (dataLen == 16) {
1418 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1419 } else if (dataLen == 1) {
1420 keyNbr = param_get8(Cmd, cmdp+1);
1421 if (keyNbr <= ICLASS_KEYS_MAX) {
1422 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1423 } else {
1424 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1425 errors = true;
1426 }
1427 } else {
1428 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1429 errors = true;
1430 }
1431 cmdp += 2;
1432 break;
1433 case 's':
1434 case 'S':
1435 givenCSN = true;
1436 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1437 return usage_hf_iclass_calc_newkey();
1438 cmdp += 2;
1439 break;
1440 default:
1441 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1442 errors = true;
1443 break;
1444 }
1445 if(errors) return usage_hf_iclass_calc_newkey();
1446 }
aa53efc3 1447
4d68ec02 1448 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
aa53efc3 1449
4d68ec02 1450 if (!givenCSN)
1451 if (!select_only(CSN, CCNR, false, true))
1452 return 0;
1453
1454 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
aa53efc3 1455 return 0;
1456}
1457
4d68ec02 1458static int loadKeys(char *filename) {
aa53efc3 1459 FILE *f;
1460 f = fopen(filename,"rb");
1461 if(!f) {
1462 PrintAndLog("Failed to read from file '%s'", filename);
1463 return 0;
1464 }
1465 fseek(f, 0, SEEK_END);
1466 long fsize = ftell(f);
1467 fseek(f, 0, SEEK_SET);
1468
1469 uint8_t *dump = malloc(fsize);
1470
1471 size_t bytes_read = fread(dump, 1, fsize, f);
1472 fclose(f);
1473 if (bytes_read > ICLASS_KEYS_MAX * 8){
1474 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1475 free(dump);
1476 return 0;
1477 }
1478 uint8_t i = 0;
1479 for (; i < bytes_read/8; i++){
1480 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1481 }
1482 free(dump);
1483 PrintAndLog("%u keys loaded", i);
1484 return 1;
1485}
1486
4d68ec02 1487static int saveKeys(char *filename) {
aa53efc3 1488 FILE *f;
1489 f = fopen(filename,"wb");
1490 if (f == NULL) {
1491 printf("error opening file %s\n",filename);
1492 return 0;
1493 }
1494 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1495 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1496 PrintAndLog("save key failed to write to file: %s", filename);
1497 break;
1498 }
1499 }
1500 fclose(f);
1501 return 0;
1502}
1503
4d68ec02 1504static int printKeys(void) {
aa53efc3 1505 PrintAndLog("");
1506 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1507 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1508 }
1509 PrintAndLog("");
1510 return 0;
1511}
1512
4d68ec02 1513int usage_hf_iclass_managekeys(void) {
aa53efc3 1514 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1515 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1516 PrintAndLog(" Options:");
1517 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1518 PrintAndLog(" k <key> : set a key in memory");
1519 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1520 PrintAndLog(" s : save keys in memory to file specified by filename");
1521 PrintAndLog(" l : load keys to memory from file specified by filename");
1522 PrintAndLog(" p : print keys loaded into memory\n");
1523 PrintAndLog("Samples:");
1524 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1525 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1526 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1527 PrintAndLog(" print keys : hf iclass managekeys p\n");
1528 return 0;
1529}
1530
4d68ec02 1531int CmdHFiClassManageKeys(const char *Cmd) {
aa53efc3 1532 uint8_t keyNbr = 0;
1533 uint8_t dataLen = 0;
1534 uint8_t KEY[8] = {0};
1535 char filename[FILE_PATH_SIZE];
1536 uint8_t fileNameLen = 0;
1537 bool errors = false;
1538 uint8_t operation = 0;
1539 char tempStr[20];
1540 uint8_t cmdp = 0;
1541
1542 while(param_getchar(Cmd, cmdp) != 0x00)
1543 {
1544 switch(param_getchar(Cmd, cmdp))
1545 {
1546 case 'h':
1547 case 'H':
1548 return usage_hf_iclass_managekeys();
1549 case 'f':
1550 case 'F':
1551 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1552 if (fileNameLen < 1) {
1553 PrintAndLog("No filename found after f");
1554 errors = true;
1555 }
1556 cmdp += 2;
1557 break;
1558 case 'n':
1559 case 'N':
1560 keyNbr = param_get8(Cmd, cmdp+1);
1561 if (keyNbr < 0) {
1562 PrintAndLog("Wrong block number");
1563 errors = true;
1564 }
1565 cmdp += 2;
1566 break;
1567 case 'k':
1568 case 'K':
1569 operation += 3; //set key
1570 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1571 if (dataLen == 16) { //ul-c or ev1/ntag key length
1572 errors = param_gethex(tempStr, 0, KEY, dataLen);
1573 } else {
1574 PrintAndLog("\nERROR: Key is incorrect length\n");
1575 errors = true;
1576 }
1577 cmdp += 2;
1578 break;
1579 case 'p':
1580 case 'P':
1581 operation += 4; //print keys in memory
1582 cmdp++;
1583 break;
1584 case 'l':
1585 case 'L':
1586 operation += 5; //load keys from file
1587 cmdp++;
1588 break;
1589 case 's':
1590 case 'S':
1591 operation += 6; //save keys to file
1592 cmdp++;
1593 break;
1594 default:
1595 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1596 errors = true;
1597 break;
1598 }
1599 if(errors) return usage_hf_iclass_managekeys();
1600 }
1601 if (operation == 0){
1602 PrintAndLog("no operation specified (load, save, or print)\n");
1603 return usage_hf_iclass_managekeys();
1604 }
1605 if (operation > 6){
1606 PrintAndLog("Too many operations specified\n");
1607 return usage_hf_iclass_managekeys();
1608 }
1609 if (operation > 4 && fileNameLen == 0){
1610 PrintAndLog("You must enter a filename when loading or saving\n");
1611 return usage_hf_iclass_managekeys();
1612 }
1613
1614 switch (operation){
1615 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1616 case 4: return printKeys();
1617 case 5: return loadKeys(filename);
1618 case 6: return saveKeys(filename);
1619 break;
1620 }
1621 return 0;
1622}
1623
cee5a30d 1624static command_t CommandTable[] =
1625{
aa53efc3 1626 {"help", CmdHelp, 1, "This help"},
4d68ec02 1627 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1628 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1629 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1630 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1631 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1632 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1633 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1634 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1635 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1636 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1637 {"reader", CmdHFiClassReader, 0, " Read an iClass tag"},
1638 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1639 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1640 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1641 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1642 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
6f101995 1643 {NULL, NULL, 0, NULL}
cee5a30d 1644};
1645
1646int CmdHFiClass(const char *Cmd)
1647{
53444513
MHS		 1648 CmdsParse(CommandTable, Cmd);
1649 return 0;
cee5a30d 1650}
1651
1652int CmdHelp(const char *Cmd)
1653{
53444513
MHS		 1654 CmdsHelp(CommandTable);
1655 return 0;
cee5a30d 1656}
Proxmark3 GIT tracking
Impressum, Datenschutz