]> cvs.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhficlass.c
CHG: generic code clean up. Removal of commented code.
[proxmark3-svn] / client / cmdhficlass.c
CommitLineData
cee5a30d 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833 4// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// High frequency iClass commands
11//-----------------------------------------------------------------------------
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <string.h>
9f6e9d15 16#include <sys/stat.h>
cee5a30d 17#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18#include "data.h"
902cb3c0 19#include "proxmark3.h"
cee5a30d 20#include "ui.h"
21#include "cmdparser.h"
22#include "cmdhficlass.h"
23#include "common.h"
14006804 24#include "util.h"
17cba269 25#include "cmdmain.h"
a66fca86
AD
26#include "loclass/des.h"
27#include "loclass/cipherutils.h"
28#include "loclass/cipher.h"
29#include "loclass/ikeys.h"
3ad48540
MHS
30#include "loclass/elite_crack.h"
31#include "loclass/fileutils.h"
cee5a30d 32
33static int CmdHelp(const char *Cmd);
34
17cba269
MHS
35int xorbits_8(uint8_t val)
36{
3ad48540
MHS
37 uint8_t res = val ^ (val >> 1); //1st pass
38 res = res ^ (res >> 1); // 2nd pass
39 res = res ^ (res >> 2); // 3rd pass
40 res = res ^ (res >> 4); // 4th pass
41 return res & 1;
17cba269
MHS
42}
43
cee5a30d 44int CmdHFiClassList(const char *Cmd)
17cba269 45{
4c3de57a 46 PrintAndLog("Deprecated command, use 'hf list iclass' instead");
17cba269
MHS
47 return 0;
48}
49
cee5a30d 50int CmdHFiClassSnoop(const char *Cmd)
51{
52 UsbCommand c = {CMD_SNOOP_ICLASS};
53 SendCommand(&c);
54 return 0;
55}
6116c796 56#define NUM_CSNS 15
1e262141 57int CmdHFiClassSim(const char *Cmd)
58{
59 uint8_t simType = 0;
60 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
61
17cba269
MHS
62 if (strlen(Cmd)<1) {
63 PrintAndLog("Usage: hf iclass sim [0 <CSN>] | x");
64 PrintAndLog(" options");
65 PrintAndLog(" 0 <CSN> simulate the given CSN");
66 PrintAndLog(" 1 simulate default CSN");
67 PrintAndLog(" 2 iterate CSNs, gather MACs");
1e262141 68 PrintAndLog(" sample: hf iclass sim 0 031FEC8AF7FF12E0");
17cba269 69 PrintAndLog(" sample: hf iclass sim 2");
1e262141 70 return 0;
71 }
72
73 simType = param_get8(Cmd, 0);
17cba269
MHS
74
75 if(simType == 0)
76 {
77 if (param_gethex(Cmd, 1, CSN, 16)) {
78 PrintAndLog("A CSN should consist of 16 HEX symbols");
79 return 1;
80 }
81 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
82
83 }
77abe781 84 if(simType > 2)
17cba269
MHS
85 {
86 PrintAndLog("Undefined simptype %d", simType);
87 return 1;
1e262141 88 }
17cba269 89 uint8_t numberOfCSNs=0;
1e262141 90
9f6e9d15
MHS
91 if(simType == 2)
92 {
6116c796 93 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
9f6e9d15 94 UsbCommand resp = {0};
17cba269 95
6116c796 96 /*uint8_t csns[8 * NUM_CSNS] = {
77abe781
MHS
97 0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,
98 0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,
99 0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,
100 0x17,0x12,0x01,0xfd,0xf7,0xff,0x12,0xe0 ,
101 0xcd,0x56,0x01,0x7c,0x6f,0xff,0x12,0xe0 ,
102 0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,
103 0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,
104 0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };
6116c796
MHS
105*/
106
107 uint8_t csns[8*NUM_CSNS] = {
108 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
109 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
110 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
111 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
112 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
113 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
114 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
115 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
116 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
117 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
118 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
119 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
120 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
121 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
123
124 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
9f6e9d15
MHS
125
126 SendCommand(&c);
127 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
128 PrintAndLog("Command timed out");
129 return 0;
130 }
1e262141 131
77abe781 132 uint8_t num_mac_responses = resp.arg[1];
6116c796 133 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
9f6e9d15 134
6116c796 135 size_t datalen = NUM_CSNS*24;
9f6e9d15
MHS
136 /*
137 * Now, time to dump to file. We'll use this format:
77abe781 138 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15 139 * So, it should wind up as
77abe781
MHS
140 * 8 * 24 bytes.
141 *
142 * The returndata from the pm3 is on the following format
143 * <4 byte NR><4 byte MAC>
144 * CC are all zeroes, CSN is the same as was sent in
9f6e9d15 145 **/
77abe781
MHS
146 void* dump = malloc(datalen);
147 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15 148 uint8_t i = 0;
6116c796 149 for(i = 0 ; i < NUM_CSNS ; i++)
9f6e9d15 150 {
77abe781
MHS
151 memcpy(dump+i*24, csns+i*8,8); //CSN
152 //8 zero bytes here...
153 //Then comes NR_MAC (eight bytes from the response)
154 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
1e262141 155
9f6e9d15
MHS
156 }
157 /** Now, save to dumpfile **/
77abe781
MHS
158 saveFile("iclass_mac_attack", "bin", dump,datalen);
159 free(dump);
9f6e9d15
MHS
160 }else
161 {
162 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
163 memcpy(c.d.asBytes, CSN, 8);
164 SendCommand(&c);
165 }
1e262141 166
1e262141 167 return 0;
168}
169
170int CmdHFiClassReader(const char *Cmd)
171{
aa41c605 172 UsbCommand c = {CMD_READER_ICLASS, {0}};
1e262141 173 SendCommand(&c);
aa41c605
MHS
174 UsbCommand resp;
175 while(!ukbhit()){
176 if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
177 uint8_t isOK = resp.arg[0] & 0xff;
178 uint8_t * data = resp.d.asBytes;
179
180 PrintAndLog("isOk:%02x", isOK);
2e9d4b3f
MHS
181 if( isOK == 0){
182 //Aborted
183 PrintAndLog("Quitting...");
184 return 0;
185 }
aa41c605
MHS
186 if(isOK > 0)
187 {
188 PrintAndLog("CSN: %s",sprint_hex(data,8));
189 }
190 if(isOK >= 1)
191 {
192 PrintAndLog("CC: %s",sprint_hex(data+8,8));
193 }else{
194 PrintAndLog("No CC obtained");
195 }
196 } else {
197 PrintAndLog("Command execute timeout");
198 }
199 }
1e262141 200
c3963755 201 return 0;
202}
203
204int CmdHFiClassReader_Replay(const char *Cmd)
205{
206 uint8_t readerType = 0;
207 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
208
209 if (strlen(Cmd)<1) {
210 PrintAndLog("Usage: hf iclass replay <MAC>");
211 PrintAndLog(" sample: hf iclass replay 00112233");
212 return 0;
213 }
214
215 if (param_gethex(Cmd, 0, MAC, 8)) {
216 PrintAndLog("MAC must include 8 HEX symbols");
217 return 1;
218 }
219
220 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
221 memcpy(c.d.asBytes, MAC, 4);
222 SendCommand(&c);
1e262141 223
224 return 0;
225}
226
a66fca86
AD
227int CmdHFiClassReader_Dump(const char *Cmd)
228{
229 uint8_t readerType = 0;
230 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
231 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
232 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
233 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
fecd8202 234 //uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
a66fca86 235 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
9b82de75
MHS
236 uint8_t keytable[128] = {0};
237 int elite = 0;
238 uint8_t *used_key;
239 int i;
fecd8202 240 if (strlen(Cmd)<1)
241 {
9b82de75
MHS
242 PrintAndLog("Usage: hf iclass dump <Key> [e]");
243 PrintAndLog(" Key - A 16 byte master key");
244 PrintAndLog(" e - If 'e' is specified, the key is interpreted as the 16 byte");
245 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
246 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
fecd8202 247 PrintAndLog(" sample: hf iclass dump 0011223344556677");
9b82de75
MHS
248
249
a66fca86
AD
250 return 0;
251 }
252
fecd8202 253 if (param_gethex(Cmd, 0, KEY, 16))
254 {
a66fca86
AD
255 PrintAndLog("KEY must include 16 HEX symbols");
256 return 1;
257 }
9b82de75
MHS
258
259 if (param_getchar(Cmd, 1) == 'e')
260 {
261 PrintAndLog("Elite switch on");
262 elite = 1;
263
264 //calc h2
265 hash2(KEY, keytable);
9e28ee9f 266 printarr_human_readable("keytable", keytable, 128);
9b82de75
MHS
267
268 }
269
0eea34a2
MHS
270 UsbCommand resp;
271 uint8_t key_sel[8] = {0};
272 uint8_t key_sel_p[8] = { 0 };
273
274 //HACK -- Below is for testing without access to a tag
0eea34a2 275 uint8_t fake_dummy_test = false;
8e976839
MHS
276 if(fake_dummy_test)
277 {
278 uint8_t xdata[16] = {0x01,0x02,0x03,0x04,0xF7,0xFF,0x12,0xE0, //CSN from http://www.proxmark.org/forum/viewtopic.php?pid=11230#p11230
279 0xFE,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF}; // Just a random CC. Would be good to add a real testcase here
280 memcpy(resp.d.asBytes,xdata, 16);
281 resp.arg[0] = 2;
282 }
283
0eea34a2
MHS
284 //End hack
285
9b82de75 286
aa41c605 287 UsbCommand c = {CMD_READER_ICLASS, {0}};
c8dd9b09 288 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE| FLAG_ICLASS_READER_GET_CC;
0eea34a2
MHS
289 if(!fake_dummy_test)
290 SendCommand(&c);
fecd8202 291
26c0d833 292
0eea34a2
MHS
293
294 if (fake_dummy_test || WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
26c0d833
MHS
295 uint8_t isOK = resp.arg[0] & 0xff;
296 uint8_t * data = resp.d.asBytes;
297
26c0d833
MHS
298 memcpy(CSN,data,8);
299 memcpy(CCNR,data+8,8);
3ad48540 300
26c0d833 301 PrintAndLog("isOk:%02x", isOK);
a66fca86 302
aa41c605 303 if(isOK > 0)
26c0d833
MHS
304 {
305 PrintAndLog("CSN: %s",sprint_hex(CSN,8));
306 }
9b82de75 307 if(isOK > 1)
26c0d833 308 {
9b82de75
MHS
309 if(elite)
310 {
9b82de75
MHS
311 //Get the key index (hash1)
312 uint8_t key_index[8] = {0};
313
314 hash1(CSN, key_index);
315 printvar("hash1", key_index,8);
316 for(i = 0; i < 8 ; i++)
317 key_sel[i] = keytable[key_index[i]] & 0xFF;
0eea34a2 318 PrintAndLog("Pre-fortified 'permuted' HS key that would be needed by an iclass reader to talk to above CSN:");
9b82de75
MHS
319 printvar("k_sel", key_sel,8);
320 //Permute from iclass format to standard format
321 permutekey_rev(key_sel,key_sel_p);
322 used_key = key_sel_p;
323 }else{
9e28ee9f
MHS
324 //Perhaps this should also be permuted to std format?
325 // Something like the code below? I have no std system
326 // to test this with /Martin
327
328 //uint8_t key_sel_p[8] = { 0 };
329 //permutekey_rev(KEY,key_sel_p);
330 //used_key = key_sel_p;
331
9b82de75
MHS
332 used_key = KEY;
333
334 }
0eea34a2
MHS
335
336 PrintAndLog("Pre-fortified key that would be needed by the OmniKey reader to talk to above CSN:");
9b82de75
MHS
337 printvar("Used key",used_key,8);
338 diversifyKey(CSN,used_key, div_key);
0eea34a2 339 PrintAndLog("Hash0, a.k.a diversified key, that is computed using Ksel and stored in the card (Block 3):");
9b82de75 340 printvar("Div key", div_key, 8);
9e28ee9f 341 printvar("CC_NR:",CCNR,12);
74a38802 342 doMAC(CCNR,12,div_key, MAC);
9b82de75
MHS
343 printvar("MAC", MAC, 4);
344
26c0d833
MHS
345 UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
346 memcpy(d.d.asBytes, MAC, 4);
0eea34a2 347 if(!fake_dummy_test) SendCommand(&d);
26c0d833
MHS
348
349 }else{
350 PrintAndLog("Failed to obtain CC! Aborting");
351 }
352 } else {
353 PrintAndLog("Command execute timeout");
354 }
1e262141 355
356 return 0;
357}
358
fecd8202 359int CmdHFiClass_iso14443A_write(const char *Cmd)
360{
361 uint8_t readerType = 0;
362 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
363 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
364 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
365 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
fecd8202 366 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
3ad48540 367
fecd8202 368 uint8_t blockNo=0;
369 uint8_t bldata[8]={0};
370
371 if (strlen(Cmd)<3)
372 {
373 PrintAndLog("Usage: hf iclass write <Key> <Block> <Data>");
374 PrintAndLog(" sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
375 return 0;
376 }
377
378 if (param_gethex(Cmd, 0, KEY, 16))
379 {
380 PrintAndLog("KEY must include 16 HEX symbols");
381 return 1;
382 }
383
384 blockNo = param_get8(Cmd, 1);
385 if (blockNo>32)
386 {
387 PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
388 return 1;
389 }
390 if (param_gethex(Cmd, 2, bldata, 8))
391 {
392 PrintAndLog("Block data must include 8 HEX symbols");
393 return 1;
394 }
395
aa41c605 396 UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};
fecd8202 397 SendCommand(&c);
fecd8202 398 UsbCommand resp;
3ad48540 399
fecd8202 400 if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
401 uint8_t isOK = resp.arg[0] & 0xff;
402 uint8_t * data = resp.d.asBytes;
403
404 memcpy(CSN,data,8);
405 memcpy(CCNR,data+8,8);
406 PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
407 PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
408 PrintAndLog("isOk:%02x", isOK);
409 } else {
410 PrintAndLog("Command execute timeout");
411 }
3ad48540
MHS
412
413 diversifyKey(CSN,KEY, div_key);
414
fecd8202 415 PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
74a38802 416 doMAC(CCNR, 12,div_key, MAC);
fecd8202 417
3ad48540
MHS
418 UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
419 memcpy(c2.d.asBytes, bldata, 8);
420 memcpy(c2.d.asBytes+8, MAC, 4);
421 SendCommand(&c2);
a66fca86 422
fecd8202 423 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
424 uint8_t isOK = resp.arg[0] & 0xff;
425 uint8_t * data = resp.d.asBytes;
426
427 if (isOK)
428 PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
429 else
430 PrintAndLog("isOk:%02x", isOK);
431 } else {
432 PrintAndLog("Command execute timeout");
433 }
a66fca86
AD
434 return 0;
435}
6f101995
MHS
436int CmdHFiClass_loclass(const char *Cmd)
437{
438 char opt = param_getchar(Cmd, 0);
439
440 if (strlen(Cmd)<1 || opt == 'h') {
441 PrintAndLog("Usage: hf iclass loclass [options]");
442 PrintAndLog("Options:");
443 PrintAndLog("h Show this help");
444 PrintAndLog("t Perform self-test");
445 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
446 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
447 PrintAndLog(" malicious CSNs, and their protocol responses");
448 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
449 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
450 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
451 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
452 PrintAndLog(" ... totalling N*24 bytes");
453 return 0;
454 }
455 char fileName[255] = {0};
456 if(opt == 'f')
457 {
458 if(param_getstr(Cmd, 1, fileName) > 0)
459 {
460 return bruteforceFileNoKeys(fileName);
461 }else
462 {
463 PrintAndLog("You must specify a filename");
464 }
465 }
466 else if(opt == 't')
467 {
468 int errors = testCipherUtils();
469 errors += testMAC();
470 errors += doKeyTests(0);
471 errors += testElite();
472 if(errors)
473 {
474 prnlog("OBS! There were errors!!!");
475 }
476 return errors;
477 }
a66fca86 478
6f101995
MHS
479 return 0;
480}
c3963755 481
cee5a30d 482static command_t CommandTable[] =
483{
6f101995
MHS
484 {"help", CmdHelp, 1, "This help"},
485 {"list", CmdHFiClassList, 0, "[Deprecated] List iClass history"},
486 {"snoop", CmdHFiClassSnoop, 0, "Eavesdrop iClass communication"},
487 {"sim", CmdHFiClassSim, 0, "Simulate iClass tag"},
488 {"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
489 {"replay",CmdHFiClassReader_Replay, 0, "Read an iClass tag via Reply Attack"},
490 {"dump", CmdHFiClassReader_Dump, 0, "Authenticate and Dump iClass tag"},
491 {"write", CmdHFiClass_iso14443A_write, 0, "Authenticate and Write iClass block"},
492 {"loclass", CmdHFiClass_loclass, 1, "Use loclass to perform bruteforce of reader attack dump"},
493 {NULL, NULL, 0, NULL}
cee5a30d 494};
495
496int CmdHFiClass(const char *Cmd)
497{
498 CmdsParse(CommandTable, Cmd);
499 return 0;
500}
501
502int CmdHelp(const char *Cmd)
503{
504 CmdsHelp(CommandTable);
505 return 0;
506}
Impressum, Datenschutz