[proxmark3-svn] / client / cmdhficlass.c

//-----------------------------------------------------------------------------
// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
// Copyright (C) 2011 Gerhard de Koning Gans
// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// High frequency iClass commands
//-----------------------------------------------------------------------------

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
#include "data.h"
//#include "proxusb.h"
#include "proxmark3.h"
#include "ui.h"
#include "cmdparser.h"
#include "cmdhficlass.h"
#include "common.h"
#include "util.h"
#include "cmdmain.h"
#include "loclass/des.h"
#include "loclass/cipherutils.h"
#include "loclass/cipher.h"
#include "loclass/ikeys.h"
#include "loclass/elite_crack.h"
#include "loclass/fileutils.h"

static int CmdHelp(const char *Cmd);

int xorbits_8(uint8_t val)
{
    uint8_t res = val ^ (val >> 1); //1st pass
    res = res ^ (res >> 1); 		// 2nd pass
    res = res ^ (res >> 2); 		// 3rd pass
    res = res ^ (res >> 4); 			// 4th pass
    return res & 1;
}

int CmdHFiClassList(const char *Cmd)
{

	bool ShowWaitCycles = false;
	char param = param_getchar(Cmd, 0);

	if (param != 0) {
		PrintAndLog("List data in trace buffer.");
		PrintAndLog("Usage:  hf iclass list");
		PrintAndLog("h - help");
		PrintAndLog("sample: hf iclass list");
		return 0;
	}

	uint8_t got[1920];
	GetFromBigBuf(got,sizeof(got),0);
	WaitForResponse(CMD_ACK,NULL);

	PrintAndLog("Recorded Activity");
	PrintAndLog("");
	PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
	PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
	PrintAndLog("");
	PrintAndLog("     Start |       End | Src | Data");
	PrintAndLog("-----------|-----------|-----|--------");

	int i;
	uint32_t first_timestamp = 0;
	uint32_t timestamp;
	bool tagToReader;
	uint32_t parityBits;
	uint8_t len;
	uint8_t *frame;
	uint32_t EndOfTransmissionTimestamp = 0;


	for( i=0; i < 1900;)
	{
		//First 32 bits contain
		// isResponse (1 bit)
		// timestamp (remaining)
		//Then paritybits
		//Then length
		timestamp = *((uint32_t *)(got+i));
		parityBits = *((uint32_t *)(got+i+4));
		len = got[i+8];
        frame = (got+i+9);
		uint32_t next_timestamp = (*((uint32_t *)(got+i+9))) & 0x7fffffff;

		tagToReader = timestamp & 0x80000000;
		timestamp &= 0x7fffffff;

		if(i==0) {
			first_timestamp = timestamp;
		}

        // Break and stick with current result idf buffer was not completely full
		if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;

		char line[1000] = "";

		if(len)//We have some data to display
		{
			int j,oddparity;

			for(j = 0; j < len ; j++)
			{
				oddparity = 0x01 ^ xorbits_8(frame[j] & 0xFF);

				if (tagToReader && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
					sprintf(line+(j*4), "%02x!  ", frame[j]);
				} else {
					sprintf(line+(j*4), "%02x   ", frame[j]);
				}
			}
		}else
		{
			if (ShowWaitCycles) {
				sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
			}
		}

		char *crc = "";

		if(len > 2)
		{
			uint8_t b1, b2;
			if(!tagToReader && len == 4) {
				// Rough guess that this is a command from the reader
				// For iClass the command byte is not part of the CRC
					ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
			}
			else {
				  // For other data.. CRC might not be applicable (UPDATE commands etc.)
				ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
			}

			if (b1 != frame[len-2] || b2 != frame[len-1]) {
				crc = (tagToReader & (len < 8)) ? "" : " !crc";
			}
		}

		i += (len + 9);
		EndOfTransmissionTimestamp = (*((uint32_t *)(got+i))) & 0x7fffffff;

		// Not implemented for iclass on the ARM-side
		//if (!ShowWaitCycles) i += 9;

		PrintAndLog(" %9d | %9d | %s | %s %s",
			(timestamp - first_timestamp),
			(EndOfTransmissionTimestamp - first_timestamp),
			(len?(tagToReader ? "Tag" : "Rdr"):"   "),
			line, crc);
	}
	return 0;
}

int CmdHFiClassListOld(const char *Cmd)
{
  uint8_t got[1920];
  GetFromBigBuf(got,sizeof(got),0);

  PrintAndLog("recorded activity:");
  PrintAndLog(" ETU     :rssi: who bytes");
  PrintAndLog("---------+----+----+-----------");

  int i = 0;
  int prev = -1;

  for (;;) {
    if(i >= 1900) {
      break;
    }

    bool isResponse;
    int timestamp = *((uint32_t *)(got+i));
    if (timestamp & 0x80000000) {
      timestamp &= 0x7fffffff;
      isResponse = 1;
    } else {
      isResponse = 0;
    }


    int metric = 0;

    int parityBits = *((uint32_t *)(got+i+4));
    // 4 bytes of additional information...
    // maximum of 32 additional parity bit information
    //
    // TODO:
    // at each quarter bit period we can send power level (16 levels)
    // or each half bit period in 256 levels.


    int len = got[i+8];

    if (len > 100) {
      break;
    }
    if (i + len >= 1900) {
      break;
    }

    uint8_t *frame = (got+i+9);

    // Break and stick with current result if buffer was not completely full
    if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }

    char line[1000] = "";
    int j;
    for (j = 0; j < len; j++) {
      int oddparity = 0x01;
      int k;

      for (k=0;k<8;k++) {
        oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
      }

      //if((parityBits >> (len - j - 1)) & 0x01) {
      if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
        sprintf(line+(j*4), "%02x!  ", frame[j]);
      }
      else {
        sprintf(line+(j*4), "%02x   ", frame[j]);
      }
    }

    char *crc;
    crc = "";
    if (len > 2) {
      uint8_t b1, b2;
      for (j = 0; j < (len - 1); j++) {
        // gives problems... search for the reason..
        /*if(frame[j] == 0xAA) {
          switch(frame[j+1]) {
            case 0x01:
              crc = "[1] Two drops close after each other";
            break;
            case 0x02:
              crc = "[2] Potential SOC with a drop in second half of bitperiod";
              break;
            case 0x03:
              crc = "[3] Segment Z after segment X is not possible";
              break;
            case 0x04:
              crc = "[4] Parity bit of a fully received byte was wrong";
              break;
            default:
              crc = "[?] Unknown error";
              break;
          }
          break;
        }*/
      }

      if (strlen(crc)==0) {
	if(!isResponse && len == 4) {
		// Rough guess that this is a command from the reader
		// For iClass the command byte is not part of the CRC
	        ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
	}
	else {
		// For other data.. CRC might not be applicable (UPDATE commands etc.)
	        ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
	}
	//printf("%1x %1x",(unsigned)b1,(unsigned)b2);
        if (b1 != frame[len-2] || b2 != frame[len-1]) {
          crc = (isResponse & (len < 8)) ? "" : " !crc";
        } else {
          crc = "";
        }
      }
    } else {
      crc = ""; // SHORT
    }

    char metricString[100];
    if (isResponse) {
      sprintf(metricString, "%3d", metric);
    } else {
      strcpy(metricString, "   ");
    }

    PrintAndLog(" +%7d: %s: %s %s %s",
      (prev < 0 ? 0 : (timestamp - prev)),
      metricString,
      (isResponse ? "TAG" : "   "), line, crc);

    prev = timestamp;
    i += (len + 9);
  }
  return 0;
}

int CmdHFiClassSnoop(const char *Cmd)
{
  UsbCommand c = {CMD_SNOOP_ICLASS};
  SendCommand(&c);
  return 0;
}

int CmdHFiClassSim(const char *Cmd)
{
  uint8_t simType = 0;
  uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  if (strlen(Cmd)<1) {
	PrintAndLog("Usage:  hf iclass sim [0 <CSN>] | x");
	PrintAndLog("        options");
	PrintAndLog("                0 <CSN> simulate the given CSN");
	PrintAndLog("                1       simulate default CSN");
	PrintAndLog("                2       iterate CSNs, gather MACs");
	PrintAndLog("        sample: hf iclass sim 0 031FEC8AF7FF12E0");
	PrintAndLog("        sample: hf iclass sim 2");
	return 0;
  }	

  simType = param_get8(Cmd, 0);

  if(simType == 0)
  {
	  if (param_gethex(Cmd, 1, CSN, 16)) {
		  PrintAndLog("A CSN should consist of 16 HEX symbols");
		  return 1;
	  }
	  PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));

  }
  if(simType > 2)
  {
	  PrintAndLog("Undefined simptype %d", simType);
	  return 1;
  }
  uint8_t numberOfCSNs=0;

	if(simType == 2)
	{
		UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,63}};
		UsbCommand resp = {0};

		uint8_t csns[64] = {
			 0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,
			 0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,
			 0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,
			 0x17,0x12,0x01,0xfd,0xf7,0xff,0x12,0xe0 ,
			 0xcd,0x56,0x01,0x7c,0x6f,0xff,0x12,0xe0 ,
			 0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,
			 0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,
			 0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };

		memcpy(c.d.asBytes, csns, 64);

		SendCommand(&c);
		if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
			PrintAndLog("Command timed out");
			return 0;
		}

		uint8_t num_mac_responses  = resp.arg[1];
		PrintAndLog("Mac responses: %d MACs obtained (should be 8)", num_mac_responses);

		size_t datalen = 8*24;
		/*
		 * Now, time to dump to file. We'll use this format:
		 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
		 * So, it should wind up as
		 * 8 * 24 bytes.
		 *
		 * The returndata from the pm3 is on the following format
		 * <4 byte NR><4 byte MAC>
		 * CC are all zeroes, CSN is the same as was sent in
		 **/
		void* dump = malloc(datalen);
		memset(dump,0,datalen);//<-- Need zeroes for the CC-field
		uint8_t i = 0;
		for(i = 0 ; i < 8 ; i++)
		{
			memcpy(dump+i*24, csns+i*8,8); //CSN
			//8 zero bytes here...
			//Then comes NR_MAC (eight bytes from the response)
			memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);

		}
		/** Now, save to dumpfile **/
		saveFile("iclass_mac_attack", "bin", dump,datalen);
		free(dump);
	}else
	{
		UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
		memcpy(c.d.asBytes, CSN, 8);
		SendCommand(&c);
	}

  return 0;
}

int CmdHFiClassReader(const char *Cmd)
{
  uint8_t readerType = 0;

  if (strlen(Cmd)<1) {
	PrintAndLog("Usage:  hf iclass reader    <reader type>");
	PrintAndLog("        sample: hf iclass reader 0");
	return 0;
  }	

  readerType = param_get8(Cmd, 0);
  PrintAndLog("--readertype:%02x", readerType);

  UsbCommand c = {CMD_READER_ICLASS, {readerType}};
  SendCommand(&c);

  return 0;
}

int CmdHFiClassReader_Replay(const char *Cmd)
{
  uint8_t readerType = 0;
  uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};

  if (strlen(Cmd)<1) {
    PrintAndLog("Usage:  hf iclass replay <MAC>");
    PrintAndLog("        sample: hf iclass replay 00112233");
    return 0;
  }

  if (param_gethex(Cmd, 0, MAC, 8)) {
    PrintAndLog("MAC must include 8 HEX symbols");
    return 1;
  }

  UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
  memcpy(c.d.asBytes, MAC, 4);
  SendCommand(&c);

  return 0;
}

int CmdHFiClassReader_Dump(const char *Cmd)
{
  uint8_t readerType = 0;
  uint8_t MAC[4]={0x00,0x00,0x00,0x00};
  uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  //uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

  if (strlen(Cmd)<1) 
  {
    PrintAndLog("Usage:  hf iclass dump <Key>");
    PrintAndLog("        sample: hf iclass dump 0011223344556677");
    return 0;
  }

  if (param_gethex(Cmd, 0, KEY, 16)) 
  {
    PrintAndLog("KEY must include 16 HEX symbols");
    return 1;
  }
    
  UsbCommand c = {CMD_ICLASS_ISO14443A_GETPUBLIC, {0}};

  SendCommand(&c);
  
  UsbCommand resp;

  if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
        uint8_t isOK    = resp.arg[0] & 0xff;
        uint8_t * data  = resp.d.asBytes;

        memcpy(CSN,data,8);
        memcpy(CCNR,data+8,8);

        PrintAndLog("isOk:%02x", isOK);

        if(isOK != 0)
        {
            PrintAndLog("CSN: %s",sprint_hex(CSN,8));
        }
        if(isOK == 0)
        {
            //PrintAndLog("CC: %s",sprint_hex(CCNR,8));
            diversifyKey(CSN,KEY, div_key);
            doMAC(CCNR,12,div_key, MAC);
            PrintAndLog("MAC:  %s",sprint_hex(MAC,sizeof(MAC)));
            UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
            memcpy(d.d.asBytes, MAC, 4);
            SendCommand(&d);

        }else{
            PrintAndLog("Failed to obtain CC! Aborting");
        }
    } else {
        PrintAndLog("Command execute timeout");
    }

  return 0;
}

int CmdHFiClass_iso14443A_write(const char *Cmd)
{
  uint8_t readerType = 0;
  uint8_t MAC[4]={0x00,0x00,0x00,0x00};
  uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

  uint8_t blockNo=0;
  uint8_t bldata[8]={0};

  if (strlen(Cmd)<3) 
  {
    PrintAndLog("Usage:  hf iclass write <Key> <Block> <Data>");
    PrintAndLog("        sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
    return 0;
  }

  if (param_gethex(Cmd, 0, KEY, 16)) 
  {
    PrintAndLog("KEY must include 16 HEX symbols");
    return 1;
  }
  
  blockNo = param_get8(Cmd, 1);
  if (blockNo>32)
  {
        PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
        return 1;
  }
  if (param_gethex(Cmd, 2, bldata, 8)) 
  {
        PrintAndLog("Block data must include 8 HEX symbols");
        return 1;
  }
  
  UsbCommand c = {CMD_ICLASS_ISO14443A_GETPUBLIC, {0}};
  SendCommand(&c);
  UsbCommand resp;

  if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
    uint8_t isOK    = resp.arg[0] & 0xff;
    uint8_t * data  = resp.d.asBytes;
    
    memcpy(CSN,data,8);
    memcpy(CCNR,data+8,8);
    PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
    PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
	PrintAndLog("isOk:%02x", isOK);
  } else {
	PrintAndLog("Command execute timeout");
  }

  diversifyKey(CSN,KEY, div_key);

  PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
  doMAC(CCNR, 12,div_key, MAC);

  UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
  memcpy(c2.d.asBytes, bldata, 8);
  memcpy(c2.d.asBytes+8, MAC, 4);
  SendCommand(&c2);

  if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
    uint8_t isOK    = resp.arg[0] & 0xff;
    uint8_t * data  = resp.d.asBytes;

    if (isOK)
      PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
    else
      PrintAndLog("isOk:%02x", isOK);
  } else {
      PrintAndLog("Command execute timeout");
  }
  return 0;
}


static command_t CommandTable[] = 
{
  {"help",	CmdHelp,			1,	"This help"},
  {"list",	CmdHFiClassList,	0,	"List iClass history"},
  {"snoop",	CmdHFiClassSnoop,	0,	"Eavesdrop iClass communication"},
  {"sim",	CmdHFiClassSim,		0,	"Simulate iClass tag"},
  {"reader",CmdHFiClassReader,	0,	"Read an iClass tag"},
  {"replay",CmdHFiClassReader_Replay,	0,	"Read an iClass tag via Reply Attack"},
  {"dump",	CmdHFiClassReader_Dump,	0,		"Authenticate and Dump iClass tag"},
  {"write",	CmdHFiClass_iso14443A_write,	0,	"Authenticate and Write iClass block"},
  {NULL, NULL, 0, NULL}
};

int CmdHFiClass(const char *Cmd)
{
  CmdsParse(CommandTable, Cmd);
  return 0;
}

int CmdHelp(const char *Cmd)
{
  CmdsHelp(CommandTable);
  return 0;
}
Commit	Line	Data
cee5a30d	1	//-----------------------------------------------------------------------------
	2	// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
	3	// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833	4	// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d	5	//
	6	// This code is licensed to you under the terms of the GNU GPL, version 2 or,
	7	// at your option, any later version. See the LICENSE.txt file for the text of
	8	// the license.
	9	//-----------------------------------------------------------------------------
	10	// High frequency iClass commands
	11	//-----------------------------------------------------------------------------
	12
	13	#include <stdio.h>
	14	#include <stdlib.h>
	15	#include <string.h>
9f6e9d15	16	#include <sys/stat.h>
cee5a30d	17	#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
cee5a30d	18	#include "data.h"
28fdb04f	19	//#include "proxusb.h"
902cb3c0	20	#include "proxmark3.h"
cee5a30d	21	#include "ui.h"
	22	#include "cmdparser.h"
	23	#include "cmdhficlass.h"
	24	#include "common.h"
14006804	25	#include "util.h"
17cba269	26	#include "cmdmain.h"
a66fca86 AD	27	#include "loclass/des.h"
	28	#include "loclass/cipherutils.h"
	29	#include "loclass/cipher.h"
	30	#include "loclass/ikeys.h"
3ad48540 MHS	31	#include "loclass/elite_crack.h"
3ad48540 MHS	32	#include "loclass/fileutils.h"
cee5a30d	33
	34	static int CmdHelp(const char *Cmd);
	35
17cba269 MHS	36	int xorbits_8(uint8_t val)
17cba269 MHS	37	{
3ad48540 MHS	38	uint8_t res = val ^ (val >> 1); //1st pass
	39	res = res ^ (res >> 1); // 2nd pass
	40	res = res ^ (res >> 2); // 3rd pass
	41	res = res ^ (res >> 4); // 4th pass
	42	return res & 1;
17cba269 MHS	43	}
17cba269 MHS	44
cee5a30d	45	int CmdHFiClassList(const char *Cmd)
17cba269 MHS	46	{
	47
	48	bool ShowWaitCycles = false;
	49	char param = param_getchar(Cmd, 0);
	50
	51	if (param != 0) {
	52	PrintAndLog("List data in trace buffer.");
	53	PrintAndLog("Usage: hf iclass list");
	54	PrintAndLog("h - help");
	55	PrintAndLog("sample: hf iclass list");
	56	return 0;
	57	}
	58
	59	uint8_t got[1920];
	60	GetFromBigBuf(got,sizeof(got),0);
	61	WaitForResponse(CMD_ACK,NULL);
	62
	63	PrintAndLog("Recorded Activity");
	64	PrintAndLog("");
	65	PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
	66	PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
	67	PrintAndLog("");
	68	PrintAndLog(" Start \| End \| Src \| Data");
	69	PrintAndLog("-----------\|-----------\|-----\|--------");
	70
	71	int i;
	72	uint32_t first_timestamp = 0;
	73	uint32_t timestamp;
	74	bool tagToReader;
	75	uint32_t parityBits;
	76	uint8_t len;
	77	uint8_t *frame;
	78	uint32_t EndOfTransmissionTimestamp = 0;
	79
17cba269 MHS	80
	81	for( i=0; i < 1900;)
	82	{
	83	//First 32 bits contain
	84	// isResponse (1 bit)
	85	// timestamp (remaining)
	86	//Then paritybits
	87	//Then length
	88	timestamp = ((uint32_t )(got+i));
	89	parityBits = ((uint32_t )(got+i+4));
	90	len = got[i+8];
26c0d833	91	frame = (got+i+9);
17cba269 MHS	92	uint32_t next_timestamp = (((uint32_t )(got+i+9))) & 0x7fffffff;
	93
	94	tagToReader = timestamp & 0x80000000;
	95	timestamp &= 0x7fffffff;
	96
	97	if(i==0) {
	98	first_timestamp = timestamp;
	99	}
	100
26c0d833	101	// Break and stick with current result idf buffer was not completely full
f83cc126	102	if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;
17cba269 MHS	103
	104	char line[1000] = "";
	105
	106	if(len)//We have some data to display
	107	{
	108	int j,oddparity;
	109
	110	for(j = 0; j < len ; j++)
	111	{
	112	oddparity = 0x01 ^ xorbits_8(frame[j] & 0xFF);
	113
	114	if (tagToReader && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
	115	sprintf(line+(j*4), "%02x! ", frame[j]);
	116	} else {
	117	sprintf(line+(j*4), "%02x ", frame[j]);
	118	}
	119	}
	120	}else
	121	{
	122	if (ShowWaitCycles) {
	123	sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
	124	}
	125	}
	126
	127	char *crc = "";
	128
	129	if(len > 2)
	130	{
	131	uint8_t b1, b2;
	132	if(!tagToReader && len == 4) {
	133	// Rough guess that this is a command from the reader
	134	// For iClass the command byte is not part of the CRC
	135	ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
	136	}
	137	else {
	138	// For other data.. CRC might not be applicable (UPDATE commands etc.)
	139	ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
	140	}
	141
	142	if (b1 != frame[len-2] \|\| b2 != frame[len-1]) {
	143	crc = (tagToReader & (len < 8)) ? "" : " !crc";
	144	}
	145	}
	146
	147	i += (len + 9);
	148	EndOfTransmissionTimestamp = (((uint32_t )(got+i))) & 0x7fffffff;
	149
	150	// Not implemented for iclass on the ARM-side
	151	//if (!ShowWaitCycles) i += 9;
	152
	153	PrintAndLog(" %9d \| %9d \| %s \| %s %s",
	154	(timestamp - first_timestamp),
	155	(EndOfTransmissionTimestamp - first_timestamp),
	156	(len?(tagToReader ? "Tag" : "Rdr"):" "),
	157	line, crc);
	158	}
	159	return 0;
	160	}
	161
	162	int CmdHFiClassListOld(const char *Cmd)
cee5a30d	163	{
cee5a30d	164	uint8_t got[1920];
db09cb3a	165	GetFromBigBuf(got,sizeof(got),0);
cee5a30d	166
	167	PrintAndLog("recorded activity:");
	168	PrintAndLog(" ETU :rssi: who bytes");
	169	PrintAndLog("---------+----+----+-----------");
	170
	171	int i = 0;
	172	int prev = -1;
	173
	174	for (;;) {
	175	if(i >= 1900) {
	176	break;
	177	}
	178
	179	bool isResponse;
	180	int timestamp = ((uint32_t )(got+i));
	181	if (timestamp & 0x80000000) {
	182	timestamp &= 0x7fffffff;
	183	isResponse = 1;
	184	} else {
	185	isResponse = 0;
	186	}
	187
17cba269	188
cee5a30d	189	int metric = 0;
17cba269	190
cee5a30d	191	int parityBits = ((uint32_t )(got+i+4));
	192	// 4 bytes of additional information...
	193	// maximum of 32 additional parity bit information
	194	//
	195	// TODO:
	196	// at each quarter bit period we can send power level (16 levels)
	197	// or each half bit period in 256 levels.
	198
	199
	200	int len = got[i+8];
	201
	202	if (len > 100) {
	203	break;
	204	}
	205	if (i + len >= 1900) {
	206	break;
	207	}
	208
	209	uint8_t *frame = (got+i+9);
	210
	211	// Break and stick with current result if buffer was not completely full
	212	if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }
	213
	214	char line[1000] = "";
	215	int j;
	216	for (j = 0; j < len; j++) {
	217	int oddparity = 0x01;
	218	int k;
	219
	220	for (k=0;k<8;k++) {
	221	oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
	222	}
	223
	224	//if((parityBits >> (len - j - 1)) & 0x01) {
	225	if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
	226	sprintf(line+(j*4), "%02x! ", frame[j]);
	227	}
	228	else {
	229	sprintf(line+(j*4), "%02x ", frame[j]);
	230	}
	231	}
	232
	233	char *crc;
	234	crc = "";
	235	if (len > 2) {
	236	uint8_t b1, b2;
	237	for (j = 0; j < (len - 1); j++) {
	238	// gives problems... search for the reason..
	239	/*if(frame[j] == 0xAA) {
	240	switch(frame[j+1]) {
	241	case 0x01:
	242	crc = "[1] Two drops close after each other";
	243	break;
	244	case 0x02:
	245	crc = "[2] Potential SOC with a drop in second half of bitperiod";
	246	break;
	247	case 0x03:
	248	crc = "[3] Segment Z after segment X is not possible";
	249	break;
	250	case 0x04:
	251	crc = "[4] Parity bit of a fully received byte was wrong";
	252	break;
	253	default:
	254	crc = "[?] Unknown error";
255	break;
256	}
257	break;
258	}*/
259	}
260
261	if (strlen(crc)==0) {
262	if(!isResponse && len == 4) {
263	// Rough guess that this is a command from the reader
264	// For iClass the command byte is not part of the CRC
265	ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
266	}
267	else {
268	// For other data.. CRC might not be applicable (UPDATE commands etc.)
269	ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
270	}
271	//printf("%1x %1x",(unsigned)b1,(unsigned)b2);
272	if (b1 != frame[len-2] \|\| b2 != frame[len-1]) {
273	crc = (isResponse & (len < 8)) ? "" : " !crc";
274	} else {
275	crc = "";
276	}
277	}
278	} else {
279	crc = ""; // SHORT
280	}
281
282	char metricString[100];
283	if (isResponse) {
284	sprintf(metricString, "%3d", metric);
285	} else {
286	strcpy(metricString, " ");
287	}
288
289	PrintAndLog(" +%7d: %s: %s %s %s",
290	(prev < 0 ? 0 : (timestamp - prev)),
291	metricString,
292	(isResponse ? "TAG" : " "), line, crc);
293
294	prev = timestamp;
295	i += (len + 9);
296	}
297	return 0;
298	}
299
cee5a30d	300	int CmdHFiClassSnoop(const char *Cmd)
	301	{
	302	UsbCommand c = {CMD_SNOOP_ICLASS};
	303	SendCommand(&c);
	304	return 0;
	305	}
	306
1e262141	307	int CmdHFiClassSim(const char *Cmd)
	308	{
	309	uint8_t simType = 0;
	310	uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
	311
17cba269 MHS	312	if (strlen(Cmd)<1) {
	313	PrintAndLog("Usage: hf iclass sim [0 <CSN>] \| x");
	314	PrintAndLog(" options");
	315	PrintAndLog(" 0 <CSN> simulate the given CSN");
	316	PrintAndLog(" 1 simulate default CSN");
	317	PrintAndLog(" 2 iterate CSNs, gather MACs");
1e262141	318	PrintAndLog(" sample: hf iclass sim 0 031FEC8AF7FF12E0");
17cba269	319	PrintAndLog(" sample: hf iclass sim 2");
1e262141	320	return 0;
	321	}
	322
	323	simType = param_get8(Cmd, 0);
17cba269 MHS	324
	325	if(simType == 0)
	326	{
	327	if (param_gethex(Cmd, 1, CSN, 16)) {
	328	PrintAndLog("A CSN should consist of 16 HEX symbols");
	329	return 1;
	330	}
	331	PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
	332
	333	}
77abe781	334	if(simType > 2)
17cba269 MHS	335	{
	336	PrintAndLog("Undefined simptype %d", simType);
	337	return 1;
1e262141	338	}
17cba269	339	uint8_t numberOfCSNs=0;
1e262141	340
9f6e9d15 MHS	341	if(simType == 2)
	342	{
	343	UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,63}};
	344	UsbCommand resp = {0};
17cba269	345
77abe781 MHS	346	uint8_t csns[64] = {
	347	0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,
	348	0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,
	349	0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,
	350	0x17,0x12,0x01,0xfd,0xf7,0xff,0x12,0xe0 ,
	351	0xcd,0x56,0x01,0x7c,0x6f,0xff,0x12,0xe0 ,
	352	0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,
	353	0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,
	354	0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };
	355
	356	memcpy(c.d.asBytes, csns, 64);
9f6e9d15 MHS	357
	358	SendCommand(&c);
	359	if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
	360	PrintAndLog("Command timed out");
	361	return 0;
	362	}
1e262141	363
77abe781 MHS	364	uint8_t num_mac_responses = resp.arg[1];
77abe781 MHS	365	PrintAndLog("Mac responses: %d MACs obtained (should be 8)", num_mac_responses);
9f6e9d15	366
77abe781	367	size_t datalen = 8*24;
9f6e9d15 MHS	368	/*
9f6e9d15 MHS	369	* Now, time to dump to file. We'll use this format:
77abe781	370	* <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15	371	* So, it should wind up as
77abe781 MHS	372	* 8 * 24 bytes.
	373	*
	374	* The returndata from the pm3 is on the following format
	375	* <4 byte NR><4 byte MAC>
	376	* CC are all zeroes, CSN is the same as was sent in
9f6e9d15	377	**/
77abe781 MHS	378	void* dump = malloc(datalen);
77abe781 MHS	379	memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15	380	uint8_t i = 0;
77abe781	381	for(i = 0 ; i < 8 ; i++)
9f6e9d15	382	{
77abe781 MHS	383	memcpy(dump+i24, csns+i8,8); //CSN
	384	//8 zero bytes here...
	385	//Then comes NR_MAC (eight bytes from the response)
	386	memcpy(dump+i24+16,resp.d.asBytes+i8,8);
1e262141	387
9f6e9d15 MHS	388	}
9f6e9d15 MHS	389	/ Now, save to dumpfile /
77abe781 MHS	390	saveFile("iclass_mac_attack", "bin", dump,datalen);
77abe781 MHS	391	free(dump);
9f6e9d15 MHS	392	}else
	393	{
	394	UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
	395	memcpy(c.d.asBytes, CSN, 8);
	396	SendCommand(&c);
	397	}
1e262141	398
1e262141	399	return 0;
	400	}
	401
	402	int CmdHFiClassReader(const char *Cmd)
	403	{
	404	uint8_t readerType = 0;
	405
	406	if (strlen(Cmd)<1) {
	407	PrintAndLog("Usage: hf iclass reader <reader type>");
	408	PrintAndLog(" sample: hf iclass reader 0");
	409	return 0;
	410	}
	411
	412	readerType = param_get8(Cmd, 0);
	413	PrintAndLog("--readertype:%02x", readerType);
	414
	415	UsbCommand c = {CMD_READER_ICLASS, {readerType}};
1e262141	416	SendCommand(&c);
1e262141	417
c3963755	418	return 0;
	419	}
	420
	421	int CmdHFiClassReader_Replay(const char *Cmd)
	422	{
	423	uint8_t readerType = 0;
	424	uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
	425
	426	if (strlen(Cmd)<1) {
	427	PrintAndLog("Usage: hf iclass replay <MAC>");
	428	PrintAndLog(" sample: hf iclass replay 00112233");
	429	return 0;
	430	}
	431
	432	if (param_gethex(Cmd, 0, MAC, 8)) {
	433	PrintAndLog("MAC must include 8 HEX symbols");
	434	return 1;
	435	}
	436
	437	UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
	438	memcpy(c.d.asBytes, MAC, 4);
	439	SendCommand(&c);
1e262141	440
	441	return 0;
	442	}
	443
a66fca86 AD	444	int CmdHFiClassReader_Dump(const char *Cmd)
	445	{
	446	uint8_t readerType = 0;
	447	uint8_t MAC[4]={0x00,0x00,0x00,0x00};
	448	uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	449	uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	450	uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
fecd8202	451	//uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
a66fca86	452	uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
a66fca86	453
fecd8202	454	if (strlen(Cmd)<1)
fecd8202	455	{
fecd8202	456	PrintAndLog("Usage: hf iclass dump <Key>");
fecd8202	457	PrintAndLog(" sample: hf iclass dump 0011223344556677");
a66fca86 AD	458	return 0;
	459	}
	460
fecd8202	461	if (param_gethex(Cmd, 0, KEY, 16))
fecd8202	462	{
a66fca86 AD	463	PrintAndLog("KEY must include 16 HEX symbols");
	464	return 1;
	465	}
26c0d833	466
fecd8202	467	UsbCommand c = {CMD_ICLASS_ISO14443A_GETPUBLIC, {0}};
26c0d833	468
fecd8202	469	SendCommand(&c);
	470
	471	UsbCommand resp;
26c0d833	472
fecd8202	473	if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
26c0d833 MHS	474	uint8_t isOK = resp.arg[0] & 0xff;
	475	uint8_t * data = resp.d.asBytes;
	476
26c0d833 MHS	477	memcpy(CSN,data,8);
26c0d833 MHS	478	memcpy(CCNR,data+8,8);
3ad48540	479
26c0d833	480	PrintAndLog("isOk:%02x", isOK);
a66fca86	481
74a38802	482	if(isOK != 0)
26c0d833 MHS	483	{
	484	PrintAndLog("CSN: %s",sprint_hex(CSN,8));
	485	}
74a38802	486	if(isOK == 0)
26c0d833	487	{
74a38802	488	//PrintAndLog("CC: %s",sprint_hex(CCNR,8));
26c0d833	489	diversifyKey(CSN,KEY, div_key);
74a38802 M	490	doMAC(CCNR,12,div_key, MAC);
74a38802 M	491	PrintAndLog("MAC: %s",sprint_hex(MAC,sizeof(MAC)));
26c0d833 MHS	492	UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
	493	memcpy(d.d.asBytes, MAC, 4);
	494	SendCommand(&d);
	495
	496	}else{
	497	PrintAndLog("Failed to obtain CC! Aborting");
	498	}
	499	} else {
	500	PrintAndLog("Command execute timeout");
	501	}
1e262141	502
	503	return 0;
	504	}
	505
fecd8202	506	int CmdHFiClass_iso14443A_write(const char *Cmd)
	507	{
	508	uint8_t readerType = 0;
	509	uint8_t MAC[4]={0x00,0x00,0x00,0x00};
	510	uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	511	uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	512	uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
fecd8202	513	uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
3ad48540	514
fecd8202	515	uint8_t blockNo=0;
	516	uint8_t bldata[8]={0};
	517
	518	if (strlen(Cmd)<3)
	519	{
	520	PrintAndLog("Usage: hf iclass write <Key> <Block> <Data>");
	521	PrintAndLog(" sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
	522	return 0;
	523	}
	524
	525	if (param_gethex(Cmd, 0, KEY, 16))
	526	{
	527	PrintAndLog("KEY must include 16 HEX symbols");
	528	return 1;
	529	}
	530
	531	blockNo = param_get8(Cmd, 1);
	532	if (blockNo>32)
	533	{
	534	PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
	535	return 1;
	536	}
	537	if (param_gethex(Cmd, 2, bldata, 8))
	538	{
	539	PrintAndLog("Block data must include 8 HEX symbols");
	540	return 1;
	541	}
	542
	543	UsbCommand c = {CMD_ICLASS_ISO14443A_GETPUBLIC, {0}};
fecd8202	544	SendCommand(&c);
fecd8202	545	UsbCommand resp;
3ad48540	546
fecd8202	547	if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
	548	uint8_t isOK = resp.arg[0] & 0xff;
	549	uint8_t * data = resp.d.asBytes;
	550
	551	memcpy(CSN,data,8);
	552	memcpy(CCNR,data+8,8);
	553	PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
	554	PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
	555	PrintAndLog("isOk:%02x", isOK);
	556	} else {
	557	PrintAndLog("Command execute timeout");
	558	}
3ad48540 MHS	559
	560	diversifyKey(CSN,KEY, div_key);
	561
fecd8202	562	PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
74a38802	563	doMAC(CCNR, 12,div_key, MAC);
fecd8202	564
3ad48540 MHS	565	UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
	566	memcpy(c2.d.asBytes, bldata, 8);
	567	memcpy(c2.d.asBytes+8, MAC, 4);
	568	SendCommand(&c2);
a66fca86	569
fecd8202	570	if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
	571	uint8_t isOK = resp.arg[0] & 0xff;
	572	uint8_t * data = resp.d.asBytes;
	573
	574	if (isOK)
	575	PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
	576	else
	577	PrintAndLog("isOk:%02x", isOK);
	578	} else {
	579	PrintAndLog("Command execute timeout");
	580	}
a66fca86 AD	581	return 0;
	582	}
	583
c3963755	584
cee5a30d	585	static command_t CommandTable[] =
cee5a30d	586	{
fecd8202	587	{"help", CmdHelp, 1, "This help"},
	588	{"list", CmdHFiClassList, 0, "List iClass history"},
	589	{"snoop", CmdHFiClassSnoop, 0, "Eavesdrop iClass communication"},
	590	{"sim", CmdHFiClassSim, 0, "Simulate iClass tag"},
	591	{"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
	592	{"replay",CmdHFiClassReader_Replay, 0, "Read an iClass tag via Reply Attack"},
	593	{"dump", CmdHFiClassReader_Dump, 0, "Authenticate and Dump iClass tag"},
	594	{"write", CmdHFiClass_iso14443A_write, 0, "Authenticate and Write iClass block"},
cee5a30d	595	{NULL, NULL, 0, NULL}
	596	};
	597
	598	int CmdHFiClass(const char *Cmd)
	599	{
	600	CmdsParse(CommandTable, Cmd);
	601	return 0;
	602	}
	603
	604	int CmdHelp(const char *Cmd)
	605	{
	606	CmdsHelp(CommandTable);
	607	return 0;
	608	}