]> cvs.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhficlass.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
added @broken_bad's imp of showing T555/Q5 trace data. (with my modifications ;) )
[proxmark3-svn] / client / cmdhficlass.c
CommitLineData
cee5a30d 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833 4// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// High frequency iClass commands
11//-----------------------------------------------------------------------------
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <string.h>
9f6e9d15 16#include <sys/stat.h>
cee5a30d 17#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18#include "data.h"
902cb3c0 19#include "proxmark3.h"
cee5a30d 20#include "ui.h"
21#include "cmdparser.h"
22#include "cmdhficlass.h"
23#include "common.h"
14006804 24#include "util.h"
17cba269 25#include "cmdmain.h"
a66fca86
AD		 26#include "loclass/des.h"
27#include "loclass/cipherutils.h"
28#include "loclass/cipher.h"
29#include "loclass/ikeys.h"
3ad48540
MHS		 30#include "loclass/elite_crack.h"
31#include "loclass/fileutils.h"
1defcf60 32#include "protocols.h"
caaf9618 33#include "usb_cmd.h"
e98572a1 34#include "cmdhfmfu.h"
9332b857 35#include "cmdhf.h"
e98572a1 36
37#define llX PRIx64
cee5a30d 38
39static int CmdHelp(const char *Cmd);
40
e98572a1 41#define ICLASS_KEYS_MAX 8
42static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
49 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
50 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
51};
52
53typedef struct iclass_block {
54 uint8_t d[8];
55} iclass_block_t;
56
57int xorbits_8(uint8_t val) {
53444513
MHS		 58 uint8_t res = val ^ (val >> 1); //1st pass
59 res = res ^ (res >> 1); // 2nd pass
60 res = res ^ (res >> 2); // 3rd pass
61 res = res ^ (res >> 4); // 4th pass
62 return res & 1;
17cba269
MHS		 63}
64
e98572a1 65int CmdHFiClassList(const char *Cmd) {
9332b857 66 //PrintAndLog("Deprecated command, use 'hf list iclass' instead");
67 CmdHFList("iclass");
17cba269
MHS		 68 return 0;
69}
70
e98572a1 71int CmdHFiClassSnoop(const char *Cmd) {
53444513
MHS		 72 UsbCommand c = {CMD_SNOOP_ICLASS};
73 SendCommand(&c);
74 return 0;
cee5a30d 75}
e98572a1 76
77int usage_hf_iclass_sim(void) {
41524d8a
MHS		 78 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
79 PrintAndLog(" options");
80 PrintAndLog(" 0 <CSN> simulate the given CSN");
81 PrintAndLog(" 1 simulate default CSN");
82 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
83 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
84 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
85 PrintAndLog(" example: hf iclass sim 2");
86 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
87 PrintAndLog(" hf iclass sim 3");
88 return 0;
89}
90
6116c796 91#define NUM_CSNS 15
e98572a1 92int CmdHFiClassSim(const char *Cmd) {
53444513
MHS		 93 uint8_t simType = 0;
94 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
95
96 if (strlen(Cmd)<1) {
1defcf60 97 return usage_hf_iclass_sim();
53444513 98 }
1defcf60 99 simType = param_get8ex(Cmd, 0, 0, 10);
53444513
MHS		 100
101 if(simType == 0)
102 {
103 if (param_gethex(Cmd, 1, CSN, 16)) {
104 PrintAndLog("A CSN should consist of 16 HEX symbols");
41524d8a 105 return usage_hf_iclass_sim();
53444513 106 }
53444513 107
41524d8a 108 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
53444513 109 }
41524d8a 110 if(simType > 3)
53444513
MHS		 111 {
112 PrintAndLog("Undefined simptype %d", simType);
41524d8a 113 return usage_hf_iclass_sim();
53444513 114 }
1e262141 115
41524d8a 116 uint8_t numberOfCSNs=0;
9f6e9d15
MHS		 117 if(simType == 2)
118 {
6116c796 119 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
9f6e9d15 120 UsbCommand resp = {0};
17cba269 121
53444513
MHS		 122 uint8_t csns[8*NUM_CSNS] = {
123 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
136 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
137 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
6116c796
MHS		 138
139 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
9f6e9d15
MHS		 140
141 SendCommand(&c);
142 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
143 PrintAndLog("Command timed out");
144 return 0;
145 }
1e262141 146
77abe781 147 uint8_t num_mac_responses = resp.arg[1];
6116c796 148 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
9f6e9d15 149
6116c796 150 size_t datalen = NUM_CSNS*24;
9f6e9d15
MHS		 151 /*
152 * Now, time to dump to file. We'll use this format:
77abe781 153 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15 154 * So, it should wind up as
77abe781
MHS		 155 * 8 * 24 bytes.
156 *
157 * The returndata from the pm3 is on the following format
158 * <4 byte NR><4 byte MAC>
159 * CC are all zeroes, CSN is the same as was sent in
9f6e9d15 160 **/
77abe781
MHS		 161 void* dump = malloc(datalen);
162 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15 163 uint8_t i = 0;
6116c796 164 for(i = 0 ; i < NUM_CSNS ; i++)
9f6e9d15 165 {
77abe781
MHS		 166 memcpy(dump+i*24, csns+i*8,8); //CSN
167 //8 zero bytes here...
168 //Then comes NR_MAC (eight bytes from the response)
169 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
1e262141 170
9f6e9d15
MHS		 171 }
172 /** Now, save to dumpfile **/
77abe781
MHS		 173 saveFile("iclass_mac_attack", "bin", dump,datalen);
174 free(dump);
9f6e9d15
MHS		 175 }else
176 {
177 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
178 memcpy(c.d.asBytes, CSN, 8);
179 SendCommand(&c);
180 }
1e262141 181
53444513 182 return 0;
1e262141 183}
184
e98572a1 185int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
8949bb5d 186 bool tagFound = false;
caaf9618
MHS		 187 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
188 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
e98572a1 189 // loop in client not device - else on windows have a communication error
190 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
53444513
MHS		 191 UsbCommand resp;
192 while(!ukbhit()){
e98572a1 193 SendCommand(&c);
6ce0e538 194 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
caaf9618 195 uint8_t readStatus = resp.arg[0] & 0xff;
6ce0e538 196 uint8_t *data = resp.d.asBytes;
53444513 197
8949bb5d 198 if (verbose)
caaf9618
MHS		 199 PrintAndLog("Readstatus:%02x", readStatus);
200 if( readStatus == 0){
53444513 201 //Aborted
8949bb5d 202 if (verbose) PrintAndLog("Quitting...");
53444513
MHS		 203 return 0;
204 }
8949bb5d 205 if( readStatus & FLAG_ICLASS_READER_CSN){
206 PrintAndLog("CSN: %s",sprint_hex(data,8));
207 tagFound = true;
208 }
caaf9618
MHS		 209 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
210 if( readStatus & FLAG_ICLASS_READER_CONF){
211 printIclassDumpInfo(data);
53444513 212 }
8949bb5d 213 if (tagFound && !loop) return 1;
53444513 214 } else {
8949bb5d 215 if (verbose) PrintAndLog("Command execute timeout");
53444513 216 }
8949bb5d 217 if (!loop) break;
53444513 218 }
53444513 219 return 0;
8949bb5d 220}
221
e98572a1 222int CmdHFiClassReader(const char *Cmd) {
8949bb5d 223 return HFiClassReader(Cmd, true, true);
c3963755 224}
225
e98572a1 226int CmdHFiClassReader_Replay(const char *Cmd) {
53444513
MHS		 227 uint8_t readerType = 0;
228 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
c3963755 229
53444513
MHS		 230 if (strlen(Cmd)<1) {
231 PrintAndLog("Usage: hf iclass replay <MAC>");
232 PrintAndLog(" sample: hf iclass replay 00112233");
233 return 0;
234 }
c3963755 235
53444513
MHS		 236 if (param_gethex(Cmd, 0, MAC, 8)) {
237 PrintAndLog("MAC must include 8 HEX symbols");
238 return 1;
239 }
c3963755 240
53444513
MHS		 241 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
242 memcpy(c.d.asBytes, MAC, 4);
243 SendCommand(&c);
1e262141 244
53444513 245 return 0;
1e262141 246}
247
e98572a1 248int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
249 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
250 memcpy(c.d.asBytes, data, blocksCount * 16);
53444513 251 SendCommand(&c);
53444513 252 return 0;
1e262141 253}
254
e98572a1 255int hf_iclass_eload_usage(void) {
7781a656
MHS		 256 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
257 PrintAndLog("Usage: hf iclass eload f <filename>");
258 PrintAndLog("");
259 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
260 return 0;
7781a656
MHS		 261}
262
e98572a1 263int CmdHFiClassELoad(const char *Cmd) {
7781a656
MHS		 264
265 char opt = param_getchar(Cmd, 0);
266 if (strlen(Cmd)<1 || opt == 'h')
267 return hf_iclass_eload_usage();
268
269 //File handling and reading
270 FILE *f;
271 char filename[FILE_PATH_SIZE];
272 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
273 {
274 f = fopen(filename, "rb");
275 }else{
276 return hf_iclass_eload_usage();
277 }
278
279 if(!f) {
280 PrintAndLog("Failed to read from file '%s'", filename);
281 return 1;
282 }
283
284 fseek(f, 0, SEEK_END);
285 long fsize = ftell(f);
286 fseek(f, 0, SEEK_SET);
287
288 uint8_t *dump = malloc(fsize);
1defcf60
MHS		 289
290
7781a656
MHS		 291 size_t bytes_read = fread(dump, 1, fsize, f);
292 fclose(f);
293
1defcf60 294 printIclassDumpInfo(dump);
7781a656
MHS		 295 //Validate
296
297 if (bytes_read < fsize)
298 {
299 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
300 free(dump);
301 return 1;
302 }
303 //Send to device
304 uint32_t bytes_sent = 0;
305 uint32_t bytes_remaining = bytes_read;
306
307 while(bytes_remaining > 0){
308 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
309 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
310 memcpy(c.d.asBytes, dump, bytes_in_packet);
311 SendCommand(&c);
312 bytes_remaining -= bytes_in_packet;
313 bytes_sent += bytes_in_packet;
314 }
315 free(dump);
316 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
317 return 0;
318}
319
e98572a1 320static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
41524d8a
MHS		 321 FILE *f = fopen(filename, "rb");
322 if(!f) {
323 PrintAndLog("Failed to read from file '%s'", filename);
324 return 1;
325 }
326 fseek(f, 0, SEEK_END);
327 long fsize = ftell(f);
328 fseek(f, 0, SEEK_SET);
329 size_t bytes_read = fread(buffer, 1, len, f);
330 fclose(f);
331 if(fsize != len)
332 {
333 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
334 return 1;
335 }
336 if(bytes_read != len)
337 {
338 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
339 return 1;
340 }
341 return 0;
342}
343
e98572a1 344int usage_hf_iclass_decrypt(void) {
345 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
346 PrintAndLog("");
347 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
348 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
349 PrintAndLog("");
350 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
351 PrintAndLog("");
352 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
353 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
354 PrintAndLog("which is defined by the configuration block.");
355 return 1;
356}
357
358int CmdHFiClassDecrypt(const char *Cmd) {
41524d8a
MHS		 359 uint8_t key[16] = { 0 };
360 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
361 {
362 usage_hf_iclass_decrypt();
363 return 1;
364 }
365 PrintAndLog("Decryption file found... ");
366 char opt = param_getchar(Cmd, 0);
367 if (strlen(Cmd)<1 || opt == 'h')
368 return usage_hf_iclass_decrypt();
369
370 //Open the tagdump-file
371 FILE *f;
372 char filename[FILE_PATH_SIZE];
373 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
374 {
375 f = fopen(filename, "rb");
376 }else{
377 return usage_hf_iclass_decrypt();
378 }
379
380 fseek(f, 0, SEEK_END);
381 long fsize = ftell(f);
382 fseek(f, 0, SEEK_SET);
383 uint8_t enc_dump[8] = {0};
384 uint8_t *decrypted = malloc(fsize);
385 des3_context ctx = { DES_DECRYPT ,{ 0 } };
386 des3_set2key_dec( &ctx, key);
387 size_t bytes_read = fread(enc_dump, 1, 8, f);
388
389 //Use the first block (CSN) for filename
390 char outfilename[FILE_PATH_SIZE] = { 0 };
391 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
392 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
393 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
394
395 size_t blocknum =0;
396 while(bytes_read == 8)
397 {
9a9bcea8 398 if(blocknum < 7)
41524d8a
MHS		 399 {
400 memcpy(decrypted+(blocknum*8), enc_dump, 8);
401 }else{
402 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
403 }
404 printvar("decrypted block", decrypted +(blocknum*8), 8);
405 bytes_read = fread(enc_dump, 1, 8, f);
406 blocknum++;
407 }
408 fclose(f);
409
410 saveFile(outfilename,"bin", decrypted, blocknum*8);
411
412 return 0;
413}
7781a656 414
e98572a1 415int usage_hf_iclass_encrypt(void) {
416 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
417 PrintAndLog("");
418 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
419 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
420 PrintAndLog("");
421 PrintAndLog("example: hf iclass encrypt 0102030405060708");
422 PrintAndLog("");
423 return 0;
424}
425
426static int iClassEncryptBlkData(uint8_t *blkData) {
427 uint8_t key[16] = { 0 };
428 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
429 {
430 usage_hf_iclass_encrypt();
431 return 1;
432 }
433 PrintAndLog("Decryption file found... ");
53444513 434
e98572a1 435 uint8_t encryptedData[16];
436 uint8_t *encrypted = encryptedData;
437 des3_context ctx = { DES_DECRYPT ,{ 0 } };
438 des3_set2key_enc( &ctx, key);
439
440 des3_crypt_ecb(&ctx, blkData,encrypted);
441 //printvar("decrypted block", decrypted, 8);
442 memcpy(blkData,encrypted,8);
443
444 return 1;
445}
53444513 446
e98572a1 447int CmdHFiClassEncryptBlk(const char *Cmd) {
448 uint8_t blkData[8] = {0};
449 char opt = param_getchar(Cmd, 0);
450 if (strlen(Cmd)<1 || opt == 'h')
451 return usage_hf_iclass_encrypt();
452
453 //get the bytes to encrypt
454 if (param_gethex(Cmd, 0, blkData, 16))
53444513 455 {
e98572a1 456 PrintAndLog("BlockData must include 16 HEX symbols");
53444513
MHS		 457 return 0;
458 }
e98572a1 459 if (!iClassEncryptBlkData(blkData)) return 0;
53444513 460
e98572a1 461 printvar("encrypted block", blkData, 8);
462 return 1;
463}
464
465void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
466 uint8_t WB[9];
467 WB[0] = blockno;
468 memcpy(WB + 1,data,8);
469 doMAC_N(WB,sizeof(WB),div_key,MAC);
470 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
471}
472
473static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
474 UsbCommand resp;
475
476 UsbCommand c = {CMD_READER_ICLASS, {0}};
477 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
478 if (use_credit_key)
479 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
480
481 clearCommandBuffer();
482 SendCommand(&c);
483 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
53444513 484 {
e98572a1 485 PrintAndLog("Command execute timeout");
486 return false;
53444513
MHS		 487 }
488
e98572a1 489 uint8_t isOK = resp.arg[0] & 0xff;
490 uint8_t *data = resp.d.asBytes;
491
492 memcpy(CSN,data,8);
493 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
494 if(isOK > 0)
53444513 495 {
e98572a1 496 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
497 }
498 if(isOK <= 1){
499 PrintAndLog("Failed to obtain CC! Aborting");
500 return false;
53444513 501 }
e98572a1 502 return true;
503}
504
a7474bb3 505static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
e98572a1 506 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
507 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
508
509 if (!select_only(CSN, CCNR, use_credit_key, verbose))
510 return false;
511
512 //get div_key
a7474bb3 513 if(rawkey)
514 memcpy(div_key, KEY, 8);
515 else
e98572a1 516 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
a7474bb3 517 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
e98572a1 518
519 doMAC(CCNR, div_key, MAC);
520 UsbCommand resp;
521 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
522 memcpy(d.d.asBytes, MAC, 4);
523 clearCommandBuffer();
524 SendCommand(&d);
525 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
53444513 526 {
e98572a1 527 PrintAndLog("Auth Command execute timeout");
528 return false;
529 }
530 uint8_t isOK = resp.arg[0] & 0xff;
531 if (!isOK) {
532 PrintAndLog("Authentication error");
533 return false;
53444513 534 }
e98572a1 535 return true;
536}
53444513 537
e98572a1 538int usage_hf_iclass_dump(void) {
a7474bb3 539 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
e98572a1 540 PrintAndLog("Options:");
541 PrintAndLog(" f <filename> : specify a filename to save dump to");
542 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
543 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
544 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
545 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
546 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
a7474bb3 547 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
e98572a1 548 PrintAndLog(" NOTE: * = required");
549 PrintAndLog("Samples:");
550 PrintAndLog(" hf iclass dump k 001122334455667B");
551 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
552 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
553 return 0;
554}
555
556int CmdHFiClassReader_Dump(const char *Cmd) {
557
558 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
559 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
560 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
561 uint8_t blockno = 0;
562 uint8_t numblks = 0;
563 uint8_t maxBlk = 31;
564 uint8_t app_areas = 1;
565 uint8_t kb = 2;
566 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
567 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
568 uint8_t keyNbr = 0;
569 uint8_t dataLen = 0;
570 uint8_t fileNameLen = 0;
571 char filename[FILE_PATH_SIZE]={0};
572 char tempStr[50] = {0};
573 bool have_debit_key = false;
574 bool have_credit_key = false;
575 bool use_credit_key = false;
576 bool elite = false;
a7474bb3 577 bool rawkey = false;
e98572a1 578 bool errors = false;
579 uint8_t cmdp = 0;
580
581 while(param_getchar(Cmd, cmdp) != 0x00)
582 {
583 switch(param_getchar(Cmd, cmdp))
584 {
585 case 'h':
586 case 'H':
587 return usage_hf_iclass_dump();
588 case 'c':
589 case 'C':
590 have_credit_key = true;
591 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
592 if (dataLen == 16) {
593 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
594 } else if (dataLen == 1) {
595 keyNbr = param_get8(Cmd, cmdp+1);
596 if (keyNbr <= ICLASS_KEYS_MAX) {
597 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
598 } else {
599 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
600 errors = true;
601 }
602 } else {
603 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
604 errors = true;
605 }
606 cmdp += 2;
607 break;
608 case 'e':
609 case 'E':
610 elite = true;
611 cmdp++;
612 break;
613 case 'f':
614 case 'F':
615 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
616 if (fileNameLen < 1) {
617 PrintAndLog("No filename found after f");
618 errors = true;
619 }
620 cmdp += 2;
621 break;
622 case 'k':
623 case 'K':
624 have_debit_key = true;
625 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
626 if (dataLen == 16) {
627 errors = param_gethex(tempStr, 0, KEY, dataLen);
628 } else if (dataLen == 1) {
629 keyNbr = param_get8(Cmd, cmdp+1);
630 if (keyNbr <= ICLASS_KEYS_MAX) {
631 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
632 } else {
633 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
634 errors = true;
635 }
636 } else {
637 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
638 errors = true;
639 }
640 cmdp += 2;
641 break;
a7474bb3 642 case 'r':
643 case 'R':
644 rawkey = true;
645 cmdp++;
646 break;
e98572a1 647 default:
648 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
649 errors = true;
650 break;
651 }
652 if(errors) return usage_hf_iclass_dump();
653 }
654
655 if (cmdp < 2) return usage_hf_iclass_dump();
656 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
657 if (!have_debit_key && have_credit_key) use_credit_key = true;
658
659 //get config and first 3 blocks
660 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
661 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
53444513 662 UsbCommand resp;
e98572a1 663 uint8_t tag_data[255*8];
53444513 664
e98572a1 665 clearCommandBuffer();
666 SendCommand(&c);
667 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
668 PrintAndLog("Command execute timeout");
669 ul_switch_off_field();
670 return 0;
671 }
672 uint8_t readStatus = resp.arg[0] & 0xff;
53444513
MHS		 673 uint8_t * data = resp.d.asBytes;
674
e98572a1 675 if(readStatus == 0){
676 PrintAndLog("No tag found...");
677 ul_switch_off_field();
678 return 0;
679}
680 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
681 memcpy(tag_data, data, 8*3);
682 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
683 numblks = data[8];
684 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
685 // large memory - not able to dump pages currently
686 if (numblks > maxBlk) numblks = maxBlk;
687 }
688 ul_switch_off_field();
689 // authenticate debit key and get div_key - later store in dump block 3
a7474bb3 690 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
e98572a1 691 //try twice - for some reason it sometimes fails the first time...
a7474bb3 692 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
e98572a1 693 ul_switch_off_field();
694 return 0;
695 }
53444513 696 }
e98572a1 697
698 // begin dump
699 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
700 clearCommandBuffer();
701 SendCommand(&w);
702 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
703 PrintAndLog("Command execute time-out 1");
704 ul_switch_off_field();
705 return 1;
706 }
707 uint32_t blocksRead = resp.arg[1];
708 uint8_t isOK = resp.arg[0] & 0xff;
709 if (!isOK && !blocksRead) {
710 PrintAndLog("Read Block Failed");
711 ul_switch_off_field();
712 return 0;
713 }
714 uint32_t startindex = resp.arg[2];
715 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
716 PrintAndLog("Data exceeded Buffer size!");
717 blocksRead = (sizeof(tag_data)/8) - blockno;
718 }
719 // response ok - now get bigbuf content of the dump
720 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
721 WaitForResponse(CMD_ACK,NULL);
722 size_t gotBytes = blocksRead*8 + blockno*8;
723
724 // try AA2
725 if (have_credit_key) {
726 //turn off hf field before authenticating with different key
727 ul_switch_off_field();
728 memset(MAC,0,4);
729 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
a7474bb3 730 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
e98572a1 731 //try twice - for some reason it sometimes fails the first time...
a7474bb3 732 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
e98572a1 733 ul_switch_off_field();
734 return 0;
735 }
736 }
737 // do we still need to read more block? (aa2 enabled?)
738 if (maxBlk > blockno+numblks+1) {
739 // setup dump and start
740 w.arg[0] = blockno + blocksRead;
741 w.arg[1] = maxBlk - (blockno + blocksRead);
742 clearCommandBuffer();
743 SendCommand(&w);
744 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
745 PrintAndLog("Command execute timeout 2");
746 ul_switch_off_field();
747 return 0;
748 }
749 uint8_t isOK = resp.arg[0] & 0xff;
750 blocksRead = resp.arg[1];
751 if (!isOK && !blocksRead) {
752 PrintAndLog("Read Block Failed 2");
753 ul_switch_off_field();
754 return 0;
755 }
53444513 756
e98572a1 757 startindex = resp.arg[2];
758 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
759 PrintAndLog("Data exceeded Buffer size!");
760 blocksRead = (sizeof(tag_data) - gotBytes)/8;
761 }
762 // get dumped data from bigbuf
763 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
764 WaitForResponse(CMD_ACK,NULL);
53444513 765
e98572a1 766 gotBytes += blocksRead*8;
767 } else { //field is still on - turn it off...
768 ul_switch_off_field();
769 }
770 }
53444513 771
e98572a1 772 // add diversified keys to dump
773 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
774 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
775 // print the dump
776 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
777 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
778 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
779
780 if (filename[0] == 0){
781 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
782 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
783 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
784 }
53444513 785
e98572a1 786 // save the dump to .bin file
787 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
788 saveFile(filename, "bin", tag_data, gotBytes);
789 return 1;
790}
53444513 791
a7474bb3 792static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
e98572a1 793 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
794 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
a7474bb3 795 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
e98572a1 796 return 0;
797
798 UsbCommand resp;
799
800 Calc_wb_mac(blockno,bldata,div_key,MAC);
801 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
802 memcpy(w.d.asBytes, bldata, 8);
803 memcpy(w.d.asBytes + 8, MAC, 4);
804
805 clearCommandBuffer();
806 SendCommand(&w);
807 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
808 {
809 PrintAndLog("Write Command execute timeout");
810 return 0;
811 }
812 uint8_t isOK = resp.arg[0] & 0xff;
813 if (!isOK) {
814 PrintAndLog("Write Block Failed");
815 return 0;
816 }
817 PrintAndLog("Write Block Successful");
818 return 1;
819}
820
821int usage_hf_iclass_writeblock(void) {
822 PrintAndLog("Options:");
823 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
824 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
825 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
826 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
827 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
a7474bb3 828 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
e98572a1 829 PrintAndLog("Samples:");
830 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
831 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
832 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
833 return 0;
834}
835
836int CmdHFiClass_WriteBlock(const char *Cmd) {
837 uint8_t blockno=0;
838 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
839 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
840 uint8_t keyNbr = 0;
841 uint8_t dataLen = 0;
842 char tempStr[50] = {0};
843 bool use_credit_key = false;
844 bool elite = false;
a7474bb3 845 bool rawkey= false;
e98572a1 846 bool errors = false;
847 uint8_t cmdp = 0;
848 while(param_getchar(Cmd, cmdp) != 0x00)
849 {
850 switch(param_getchar(Cmd, cmdp))
851 {
852 case 'h':
853 case 'H':
854 return usage_hf_iclass_writeblock();
855 case 'b':
856 case 'B':
857 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
858 PrintAndLog("Block No must include 2 HEX symbols\n");
859 errors = true;
860 }
861 cmdp += 2;
862 break;
863 case 'c':
864 case 'C':
865 use_credit_key = true;
866 cmdp++;
867 break;
868 case 'd':
869 case 'D':
870 if (param_gethex(Cmd, cmdp+1, bldata, 16))
871 {
872 PrintAndLog("KEY must include 16 HEX symbols\n");
873 errors = true;
874 }
875 cmdp += 2;
876 break;
877 case 'e':
878 case 'E':
879 elite = true;
880 cmdp++;
881 break;
882 case 'k':
883 case 'K':
884 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
885 if (dataLen == 16) {
886 errors = param_gethex(tempStr, 0, KEY, dataLen);
887 } else if (dataLen == 1) {
888 keyNbr = param_get8(Cmd, cmdp+1);
889 if (keyNbr <= ICLASS_KEYS_MAX) {
890 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
891 } else {
892 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
893 errors = true;
894 }
895 } else {
896 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
897 errors = true;
898 }
899 cmdp += 2;
900 break;
a7474bb3 901 case 'r':
902 case 'R':
903 rawkey = true;
904 cmdp++;
905 break;
e98572a1 906 default:
907 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
908 errors = true;
909 break;
910 }
911 if(errors) return usage_hf_iclass_writeblock();
912 }
913
914 if (cmdp < 6) return usage_hf_iclass_writeblock();
a7474bb3 915 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
e98572a1 916 ul_switch_off_field();
917 return ans;
918}
919
920int usage_hf_iclass_clone(void) {
a7474bb3 921 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
e98572a1 922 PrintAndLog("Options:");
923 PrintAndLog(" f <filename>: specify a filename to clone from");
924 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
925 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
926 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
927 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
928 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
a7474bb3 929 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
e98572a1 930 PrintAndLog("Samples:");
931 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
932 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
933 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
934 return -1;
935}
936
937int CmdHFiClassCloneTag(const char *Cmd) {
938 char filename[FILE_PATH_SIZE];
939 char tempStr[50]={0};
940 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
941 uint8_t keyNbr = 0;
942 uint8_t fileNameLen = 0;
943 uint8_t startblock = 0;
944 uint8_t endblock = 0;
945 uint8_t dataLen = 0;
946 bool use_credit_key = false;
947 bool elite = false;
a7474bb3 948 bool rawkey = false;
e98572a1 949 bool errors = false;
950 uint8_t cmdp = 0;
951 while(param_getchar(Cmd, cmdp) != 0x00)
952 {
953 switch(param_getchar(Cmd, cmdp))
954 {
955 case 'h':
956 case 'H':
957 return usage_hf_iclass_clone();
958 case 'b':
959 case 'B':
960 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
961 PrintAndLog("Start Block No must include 2 HEX symbols\n");
962 errors = true;
963 }
964 cmdp += 2;
965 break;
966 case 'c':
967 case 'C':
968 use_credit_key = true;
969 cmdp++;
970 break;
971 case 'e':
972 case 'E':
973 elite = true;
974 cmdp++;
975 break;
976 case 'f':
977 case 'F':
978 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
979 if (fileNameLen < 1) {
980 PrintAndLog("No filename found after f");
981 errors = true;
982 }
983 cmdp += 2;
984 break;
985 case 'k':
986 case 'K':
987 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
988 if (dataLen == 16) {
989 errors = param_gethex(tempStr, 0, KEY, dataLen);
990 } else if (dataLen == 1) {
991 keyNbr = param_get8(Cmd, cmdp+1);
992 if (keyNbr <= ICLASS_KEYS_MAX) {
993 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
994 } else {
995 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
996 errors = true;
997 }
998 } else {
999 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1000 errors = true;
1001 }
1002 cmdp += 2;
1003 break;
1004 case 'l':
1005 case 'L':
1006 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1007 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1008 errors = true;
1009 }
1010 cmdp += 2;
1011 break;
a7474bb3 1012 case 'r':
1013 case 'R':
1014 rawkey = true;
1015 cmdp++;
1016 break;
e98572a1 1017 default:
1018 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1019 errors = true;
1020 break;
1021 }
1022 if(errors) return usage_hf_iclass_clone();
1023 }
1024
1025 if (cmdp < 8) return usage_hf_iclass_clone();
1026
1027 FILE *f;
1028
1029 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1030
1031 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1032 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1033 }
1034 // file handling and reading
1035 f = fopen(filename,"rb");
1036 if(!f) {
1037 PrintAndLog("Failed to read from file '%s'", filename);
1038 return 1;
1039 }
1040
1041 if (startblock<5) {
1042 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1043 return 0;
1044 }
1045 // now read data from the file from block 6 --- 19
1046 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1047 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1048 // else we have to create a share memory
1049 int i;
1050 fseek(f,startblock*8,SEEK_SET);
2b9006bd 1051 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0){
1052 PrintAndLog("File reading error.");
1053 fclose(f);
1054 return 2;
1055 }
e98572a1 1056
1057 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1058 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1059
a7474bb3 1060 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
e98572a1 1061 return 0;
1062
1063 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
1064 uint8_t *ptr;
1065 // calculate all mac for every the block we will write
1066 for (i = startblock; i <= endblock; i++){
1067 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1068 // usb command d start pointer = d + (i - 6) * 12
1069 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1070 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1071 // next one
1072 ptr = w.d.asBytes + (i - startblock) * 12;
1073 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1074 memcpy(ptr + 8,MAC, 4);
1075 }
1076 uint8_t p[12];
1077 for (i = 0; i <= endblock - startblock;i++){
1078 memcpy(p,w.d.asBytes + (i * 12),12);
1079 printf("Block |%02x|",i + startblock);
1080 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1081 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1082 }
1083 UsbCommand resp;
1084 SendCommand(&w);
1085 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1086 {
1087 PrintAndLog("Command execute timeout");
1088 return 0;
1089 }
1090 return 1;
1091}
1092
a7474bb3 1093static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose) {
e98572a1 1094 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1095 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1096
a7474bb3 1097 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
e98572a1 1098 return 0;
1099
1100 UsbCommand resp;
1101 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
1102 clearCommandBuffer();
1103 SendCommand(&w);
1104 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1105 {
53444513 1106 PrintAndLog("Command execute timeout");
e98572a1 1107 return 0;
53444513 1108 }
e98572a1 1109 uint8_t isOK = resp.arg[0] & 0xff;
1110 if (!isOK) {
1111 PrintAndLog("Read Block Failed");
1112 return 0;
1113 }
1114 //data read is stored in: resp.d.asBytes[0-15]
1115 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1116 return 1;
1117}
1118
1119int usage_hf_iclass_readblock(void) {
a7474bb3 1120 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
e98572a1 1121 PrintAndLog("Options:");
1122 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1123 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1124 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1125 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
a7474bb3 1126 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
e98572a1 1127 PrintAndLog("Samples:");
1128 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1129 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1130 PrintAndLog(" hf iclass readblk b 0A k 0");
53444513 1131 return 0;
a66fca86 1132}
e98572a1 1133
1134int CmdHFiClass_ReadBlock(const char *Cmd) {
1135 uint8_t blockno=0;
1136 uint8_t keyType = 0x88; //debit key
1137 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1138 uint8_t keyNbr = 0;
1139 uint8_t dataLen = 0;
1140 char tempStr[50] = {0};
1141 bool elite = false;
a7474bb3 1142 bool rawkey = false;
e98572a1 1143 bool errors = false;
1144 uint8_t cmdp = 0;
1145 while(param_getchar(Cmd, cmdp) != 0x00)
1146 {
1147 switch(param_getchar(Cmd, cmdp))
1148 {
1149 case 'h':
1150 case 'H':
1151 return usage_hf_iclass_readblock();
1152 case 'b':
1153 case 'B':
1154 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1155 PrintAndLog("Block No must include 2 HEX symbols\n");
1156 errors = true;
1157 }
1158 cmdp += 2;
1159 break;
1160 case 'c':
1161 case 'C':
1162 keyType = 0x18;
1163 cmdp++;
1164 break;
1165 case 'e':
1166 case 'E':
1167 elite = true;
1168 cmdp++;
1169 break;
1170 case 'k':
1171 case 'K':
1172 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1173 if (dataLen == 16) {
1174 errors = param_gethex(tempStr, 0, KEY, dataLen);
1175 } else if (dataLen == 1) {
1176 keyNbr = param_get8(Cmd, cmdp+1);
1177 if (keyNbr <= ICLASS_KEYS_MAX) {
1178 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1179 } else {
1180 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1181 errors = true;
1182 }
1183 } else {
1184 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1185 errors = true;
1186 }
1187 cmdp += 2;
1188 break;
a7474bb3 1189 case 'r':
1190 case 'R':
1191 rawkey = true;
1192 cmdp++;
1193 break;
e98572a1 1194 default:
1195 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1196 errors = true;
1197 break;
1198 }
1199 if(errors) return usage_hf_iclass_readblock();
1200 }
1201
1202 if (cmdp < 4) return usage_hf_iclass_readblock();
1203
a7474bb3 1204 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true);
e98572a1 1205}
1206
1207int CmdHFiClass_loclass(const char *Cmd) {
6f101995
MHS		 1208 char opt = param_getchar(Cmd, 0);
1209
1210 if (strlen(Cmd)<1 || opt == 'h') {
1211 PrintAndLog("Usage: hf iclass loclass [options]");
1212 PrintAndLog("Options:");
1213 PrintAndLog("h Show this help");
1214 PrintAndLog("t Perform self-test");
1215 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1216 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1217 PrintAndLog(" malicious CSNs, and their protocol responses");
1218 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1219 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1220 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1221 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1222 PrintAndLog(" ... totalling N*24 bytes");
1223 return 0;
1224 }
1225 char fileName[255] = {0};
1226 if(opt == 'f')
1227 {
53444513
MHS		 1228 if(param_getstr(Cmd, 1, fileName) > 0)
1229 {
1230 return bruteforceFileNoKeys(fileName);
1231 }else
1232 {
1233 PrintAndLog("You must specify a filename");
1234 }
6f101995
MHS		 1235 }
1236 else if(opt == 't')
1237 {
1238 int errors = testCipherUtils();
1239 errors += testMAC();
1240 errors += doKeyTests(0);
1241 errors += testElite();
1242 if(errors)
1243 {
1244 prnlog("OBS! There were errors!!!");
1245 }
1246 return errors;
1247 }
a66fca86 1248
6f101995
MHS		 1249 return 0;
1250}
c3963755 1251
e98572a1 1252void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1253 uint8_t blockdata[8];
1254 uint8_t mem_config;
1255 memcpy(&mem_config, iclass_dump + 13,1);
1256 uint8_t maxmemcount;
1257 uint8_t filemaxblock = filesize / 8;
1258 if (mem_config & 0x80)
1259 maxmemcount = 255;
1260 else
1261 maxmemcount = 31;
1262 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1263
1264 if (startblock == 0)
1265 startblock = 6;
1266 if ((endblock > maxmemcount) || (endblock == 0))
1267 endblock = maxmemcount;
1268 if (endblock > filemaxblock)
1269 endblock = filemaxblock;
1270 int i = startblock;
1271 int j;
1272 while (i <= endblock){
1273 printf("Block |%02X| ",i);
1274 memcpy(blockdata,iclass_dump + (i * 8),8);
1275 for (j = 0;j < 8;j++)
1276 printf("%02X ",blockdata[j]);
1277 printf("|\n");
1278 i++;
1279 }
1280}
1281
1282int usage_hf_iclass_readtagfile() {
1283 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1284 return 1;
1285}
1286
1287int CmdHFiClassReadTagFile(const char *Cmd) {
1288 int startblock = 0;
1289 int endblock = 0;
1290 char tempnum[5];
1291 FILE *f;
1292 char filename[FILE_PATH_SIZE];
1293 if (param_getstr(Cmd, 0, filename) < 1)
1294 return usage_hf_iclass_readtagfile();
1295 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1296 startblock = 0;
1297 else
1298 sscanf(tempnum,"%d",&startblock);
1299
1300 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1301 endblock = 0;
1302 else
1303 sscanf(tempnum,"%d",&endblock);
1304 // file handling and reading
1305 f = fopen(filename,"rb");
1306 if(!f) {
1307 PrintAndLog("Failed to read from file '%s'", filename);
1308 return 1;
1309 }
1310 fseek(f, 0, SEEK_END);
1311 long fsize = ftell(f);
1312 fseek(f, 0, SEEK_SET);
1313
1314 uint8_t *dump = malloc(fsize);
1315
1316
1317 size_t bytes_read = fread(dump, 1, fsize, f);
1318 fclose(f);
1319 uint8_t *csn = dump;
1320 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
1321 // printIclassDumpInfo(dump);
1322 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1323 free(dump);
1324 return 0;
1325}
1326
1327/*
1328uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1329 uint64_t new_div = 0x00;
1330 new_div ^= sdiv;
1331 new_div ^= hdiv;
1332 return new_div;
1333}
1334
1335uint64_t hexarray_to_uint64(uint8_t *key) {
1336 char temp[17];
1337 uint64_t uint_key;
1338 for (int i = 0;i < 8;i++)
1339 sprintf(&temp[(i *2)],"%02X",key[i]);
1340 temp[16] = '\0';
1341 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1342 return 0;
1343 return uint_key;
1344}
1345*/
1346void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1347 uint8_t keytable[128] = {0};
1348 uint8_t key_index[8] = {0};
1349 if (elite) {
1350 uint8_t key_sel[8] = { 0 };
1351 uint8_t key_sel_p[8] = { 0 };
1352 hash2(KEY, keytable);
1353 hash1(CSN, key_index);
1354 for(uint8_t i = 0; i < 8 ; i++)
1355 key_sel[i] = keytable[key_index[i]] & 0xFF;
1356
1357 //Permute from iclass format to standard format
1358 permutekey_rev(key_sel, key_sel_p);
1359 diversifyKey(CSN, key_sel_p, div_key);
1360 } else {
1361 diversifyKey(CSN, KEY, div_key);
1362 }
1363}
1364
1365//when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1366//calculate and return xor_div_key (ready for a key write command)
1367//print all div_keys if verbose
1368static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1369 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1370 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1371 //get old div key
1372 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1373 //get new div key
1374 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1375
1376 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1377 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1378 }
1379 if (verbose) {
1380 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1381 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1382 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1383 }
1384}
1385
1386int usage_hf_iclass_calc_newkey(void) {
1387 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1388 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1389 PrintAndLog(" Options:");
1390 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1391 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1392 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1393 PrintAndLog(" e : specify new key as elite calc");
1394 PrintAndLog(" ee : specify old and new key as elite calc");
1395 PrintAndLog("Samples:");
1396 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1397 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1398 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1399 PrintAndLog("NOTE: * = required\n");
1400
1401 return 1;
1402}
1403
1404int CmdHFiClassCalcNewKey(const char *Cmd) {
1405 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1406 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1407 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1408 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1409 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1410 uint8_t keyNbr = 0;
1411 uint8_t dataLen = 0;
1412 char tempStr[50] = {0};
1413 bool givenCSN = false;
1414 bool oldElite = false;
1415 bool elite = false;
1416 bool errors = false;
1417 uint8_t cmdp = 0;
1418 while(param_getchar(Cmd, cmdp) != 0x00)
1419 {
1420 switch(param_getchar(Cmd, cmdp))
1421 {
1422 case 'h':
1423 case 'H':
1424 return usage_hf_iclass_calc_newkey();
1425 case 'e':
1426 case 'E':
1427 dataLen = param_getstr(Cmd, cmdp, tempStr);
1428 if (dataLen==2)
1429 oldElite = true;
1430 elite = true;
1431 cmdp++;
1432 break;
1433 case 'n':
1434 case 'N':
1435 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1436 if (dataLen == 16) {
1437 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1438 } else if (dataLen == 1) {
1439 keyNbr = param_get8(Cmd, cmdp+1);
1440 if (keyNbr <= ICLASS_KEYS_MAX) {
1441 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1442 } else {
1443 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1444 errors = true;
1445 }
1446 } else {
1447 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1448 errors = true;
1449 }
1450 cmdp += 2;
1451 break;
1452 case 'o':
1453 case 'O':
1454 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1455 if (dataLen == 16) {
1456 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1457 } else if (dataLen == 1) {
1458 keyNbr = param_get8(Cmd, cmdp+1);
1459 if (keyNbr <= ICLASS_KEYS_MAX) {
1460 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1461 } else {
1462 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1463 errors = true;
1464 }
1465 } else {
1466 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1467 errors = true;
1468 }
1469 cmdp += 2;
1470 break;
1471 case 's':
1472 case 'S':
1473 givenCSN = true;
1474 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1475 return usage_hf_iclass_calc_newkey();
1476 cmdp += 2;
1477 break;
1478 default:
1479 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1480 errors = true;
1481 break;
1482 }
1483 if(errors) return usage_hf_iclass_calc_newkey();
1484 }
1485
1486 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1487
1488 if (!givenCSN)
1489 if (!select_only(CSN, CCNR, false, true))
1490 return 0;
1491
1492 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1493 return 0;
1494}
1495
1496static int loadKeys(char *filename) {
1497 FILE *f;
1498 f = fopen(filename,"rb");
1499 if(!f) {
1500 PrintAndLog("Failed to read from file '%s'", filename);
1501 return 0;
1502 }
1503 fseek(f, 0, SEEK_END);
1504 long fsize = ftell(f);
1505 fseek(f, 0, SEEK_SET);
1506
1507 uint8_t *dump = malloc(fsize);
1508
1509 size_t bytes_read = fread(dump, 1, fsize, f);
1510 fclose(f);
1511 if (bytes_read > ICLASS_KEYS_MAX * 8){
1512 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1513 free(dump);
1514 return 0;
1515 }
1516 uint8_t i = 0;
1517 for (; i < bytes_read/8; i++){
1518 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1519 }
1520 free(dump);
1521 PrintAndLog("%u keys loaded", i);
1522 return 1;
1523}
1524
1525static int saveKeys(char *filename) {
1526 FILE *f;
1527 f = fopen(filename,"wb");
1528 if (f == NULL) {
1529 printf("error opening file %s\n",filename);
1530 return 0;
1531 }
1532 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1533 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1534 PrintAndLog("save key failed to write to file: %s", filename);
1535 break;
1536 }
1537 }
1538 fclose(f);
1539 return 0;
1540}
1541
1542static int printKeys(void) {
1543 PrintAndLog("");
1544 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1545 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1546 }
1547 PrintAndLog("");
1548 return 0;
1549}
1550
1551int usage_hf_iclass_managekeys(void) {
1552 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1553 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1554 PrintAndLog(" Options:");
1555 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1556 PrintAndLog(" k <key> : set a key in memory");
1557 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1558 PrintAndLog(" s : save keys in memory to file specified by filename");
1559 PrintAndLog(" l : load keys to memory from file specified by filename");
1560 PrintAndLog(" p : print keys loaded into memory\n");
1561 PrintAndLog("Samples:");
1562 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1563 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1564 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1565 PrintAndLog(" print keys : hf iclass managekeys p\n");
1566 return 0;
1567}
1568
1569int CmdHFiClassManageKeys(const char *Cmd) {
1570 uint8_t keyNbr = 0;
1571 uint8_t dataLen = 0;
1572 uint8_t KEY[8] = {0};
1573 char filename[FILE_PATH_SIZE];
1574 uint8_t fileNameLen = 0;
1575 bool errors = false;
1576 uint8_t operation = 0;
1577 char tempStr[20];
1578 uint8_t cmdp = 0;
1579
1580 while(param_getchar(Cmd, cmdp) != 0x00)
1581 {
1582 switch(param_getchar(Cmd, cmdp))
1583 {
1584 case 'h':
1585 case 'H':
1586 return usage_hf_iclass_managekeys();
1587 case 'f':
1588 case 'F':
1589 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1590 if (fileNameLen < 1) {
1591 PrintAndLog("No filename found after f");
1592 errors = true;
1593 }
1594 cmdp += 2;
1595 break;
1596 case 'n':
1597 case 'N':
1598 keyNbr = param_get8(Cmd, cmdp+1);
1599 if (keyNbr < 0) {
1600 PrintAndLog("Wrong block number");
1601 errors = true;
1602 }
1603 cmdp += 2;
1604 break;
1605 case 'k':
1606 case 'K':
1607 operation += 3; //set key
1608 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1609 if (dataLen == 16) { //ul-c or ev1/ntag key length
1610 errors = param_gethex(tempStr, 0, KEY, dataLen);
1611 } else {
1612 PrintAndLog("\nERROR: Key is incorrect length\n");
1613 errors = true;
1614 }
1615 cmdp += 2;
1616 break;
1617 case 'p':
1618 case 'P':
1619 operation += 4; //print keys in memory
1620 cmdp++;
1621 break;
1622 case 'l':
1623 case 'L':
1624 operation += 5; //load keys from file
1625 cmdp++;
1626 break;
1627 case 's':
1628 case 'S':
1629 operation += 6; //save keys to file
1630 cmdp++;
1631 break;
1632 default:
1633 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1634 errors = true;
1635 break;
1636 }
1637 if(errors) return usage_hf_iclass_managekeys();
1638 }
1639 if (operation == 0){
1640 PrintAndLog("no operation specified (load, save, or print)\n");
1641 return usage_hf_iclass_managekeys();
1642 }
1643 if (operation > 6){
1644 PrintAndLog("Too many operations specified\n");
1645 return usage_hf_iclass_managekeys();
1646 }
1647 if (operation > 4 && fileNameLen == 0){
1648 PrintAndLog("You must enter a filename when loading or saving\n");
1649 return usage_hf_iclass_managekeys();
1650 }
1651
1652 switch (operation){
1653 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1654 case 4: return printKeys();
1655 case 5: return loadKeys(filename);
1656 case 6: return saveKeys(filename);
1657 break;
1658 }
1659 return 0;
1660}
1661
cee5a30d 1662static command_t CommandTable[] =
1663{
6f101995 1664 {"help", CmdHelp, 1, "This help"},
e98572a1 1665 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1666 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1667 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1668 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1669 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1670 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1671 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1672 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1673 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1674 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
6f101995 1675 {"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
e98572a1 1676 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1677 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1678 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1679 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1680 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
6f101995 1681 {NULL, NULL, 0, NULL}
cee5a30d 1682};
1683
1684int CmdHFiClass(const char *Cmd)
1685{
53444513
MHS		 1686 CmdsParse(CommandTable, Cmd);
1687 return 0;
cee5a30d 1688}
1689
1690int CmdHelp(const char *Cmd)
1691{
53444513
MHS		 1692 CmdsHelp(CommandTable);
1693 return 0;
cee5a30d 1694}
Proxmark3 GIT tracking
Impressum, Datenschutz