]> cvs.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhficlass.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
disable extra attack - disable stats.txt
[proxmark3-svn] / client / cmdhficlass.c
CommitLineData
cee5a30d 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833 4// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// High frequency iClass commands
11//-----------------------------------------------------------------------------
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <string.h>
9f6e9d15 16#include <sys/stat.h>
cee5a30d 17#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18#include "data.h"
902cb3c0 19#include "proxmark3.h"
cee5a30d 20#include "ui.h"
21#include "cmdparser.h"
22#include "cmdhficlass.h"
23#include "common.h"
14006804 24#include "util.h"
17cba269 25#include "cmdmain.h"
a66fca86
AD		 26#include "loclass/des.h"
27#include "loclass/cipherutils.h"
28#include "loclass/cipher.h"
29#include "loclass/ikeys.h"
3ad48540
MHS		 30#include "loclass/elite_crack.h"
31#include "loclass/fileutils.h"
1defcf60 32#include "protocols.h"
caaf9618 33#include "usb_cmd.h"
aa53efc3 34#include "cmdhfmfu.h"
35
cee5a30d 36static int CmdHelp(const char *Cmd);
37
aa53efc3 38#define ICLASS_KEYS_MAX 8
39static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
40 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
41 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
48};
49
50typedef struct iclass_block {
51 uint8_t d[8];
52} iclass_block_t;
53
4d68ec02 54int xorbits_8(uint8_t val) {
53444513
MHS		 55 uint8_t res = val ^ (val >> 1); //1st pass
56 res = res ^ (res >> 1); // 2nd pass
57 res = res ^ (res >> 2); // 3rd pass
58 res = res ^ (res >> 4); // 4th pass
59 return res & 1;
17cba269
MHS		 60}
61
4d68ec02 62int CmdHFiClassList(const char *Cmd) {
4c3de57a 63 PrintAndLog("Deprecated command, use 'hf list iclass' instead");
17cba269
MHS		 64 return 0;
65}
66
4d68ec02 67int CmdHFiClassSnoop(const char *Cmd) {
53444513
MHS		 68 UsbCommand c = {CMD_SNOOP_ICLASS};
69 SendCommand(&c);
70 return 0;
cee5a30d 71}
4d68ec02 72
73int usage_hf_iclass_sim(void) {
41524d8a
MHS		 74 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
75 PrintAndLog(" options");
76 PrintAndLog(" 0 <CSN> simulate the given CSN");
77 PrintAndLog(" 1 simulate default CSN");
78 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
79 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
80 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
81 PrintAndLog(" example: hf iclass sim 2");
82 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
83 PrintAndLog(" hf iclass sim 3");
84 return 0;
85}
86
6116c796 87#define NUM_CSNS 15
4d68ec02 88int CmdHFiClassSim(const char *Cmd) {
53444513
MHS		 89 uint8_t simType = 0;
90 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
91
92 if (strlen(Cmd)<1) {
1defcf60 93 return usage_hf_iclass_sim();
53444513 94 }
1defcf60 95 simType = param_get8ex(Cmd, 0, 0, 10);
53444513
MHS		 96
97 if(simType == 0)
98 {
99 if (param_gethex(Cmd, 1, CSN, 16)) {
100 PrintAndLog("A CSN should consist of 16 HEX symbols");
41524d8a 101 return usage_hf_iclass_sim();
53444513 102 }
53444513 103
41524d8a 104 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
53444513 105 }
41524d8a 106 if(simType > 3)
53444513
MHS		 107 {
108 PrintAndLog("Undefined simptype %d", simType);
41524d8a 109 return usage_hf_iclass_sim();
53444513 110 }
1e262141 111
41524d8a 112 uint8_t numberOfCSNs=0;
9f6e9d15
MHS		 113 if(simType == 2)
114 {
6116c796 115 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
9f6e9d15 116 UsbCommand resp = {0};
17cba269 117
53444513
MHS		 118 uint8_t csns[8*NUM_CSNS] = {
119 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
120 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
121 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
6116c796
MHS		 134
135 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
9f6e9d15
MHS		 136
137 SendCommand(&c);
138 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
139 PrintAndLog("Command timed out");
140 return 0;
141 }
1e262141 142
77abe781 143 uint8_t num_mac_responses = resp.arg[1];
6116c796 144 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
9f6e9d15 145
6116c796 146 size_t datalen = NUM_CSNS*24;
9f6e9d15
MHS		 147 /*
148 * Now, time to dump to file. We'll use this format:
77abe781 149 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15 150 * So, it should wind up as
77abe781
MHS		 151 * 8 * 24 bytes.
152 *
153 * The returndata from the pm3 is on the following format
154 * <4 byte NR><4 byte MAC>
155 * CC are all zeroes, CSN is the same as was sent in
9f6e9d15 156 **/
77abe781
MHS		 157 void* dump = malloc(datalen);
158 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15 159 uint8_t i = 0;
6116c796 160 for(i = 0 ; i < NUM_CSNS ; i++)
9f6e9d15 161 {
77abe781
MHS		 162 memcpy(dump+i*24, csns+i*8,8); //CSN
163 //8 zero bytes here...
164 //Then comes NR_MAC (eight bytes from the response)
165 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
1e262141 166
9f6e9d15
MHS		 167 }
168 /** Now, save to dumpfile **/
77abe781
MHS		 169 saveFile("iclass_mac_attack", "bin", dump,datalen);
170 free(dump);
9f6e9d15
MHS		 171 }else
172 {
173 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
174 memcpy(c.d.asBytes, CSN, 8);
175 SendCommand(&c);
176 }
1e262141 177
53444513 178 return 0;
1e262141 179}
180
4d68ec02 181int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
6ce0e538 182 bool tagFound = false;
caaf9618
MHS		 183 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
184 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
aa53efc3 185 // loop in client not device - else on windows have a communication error
186 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
53444513
MHS		 187 UsbCommand resp;
188 while(!ukbhit()){
aa53efc3 189 SendCommand(&c);
6ce0e538 190 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
191 uint8_t readStatus = resp.arg[0] & 0xff;
192 uint8_t *data = resp.d.asBytes;
53444513 193
6ce0e538 194 if (verbose)
195 PrintAndLog("Readstatus:%02x", readStatus);
caaf9618 196 if( readStatus == 0){
53444513 197 //Aborted
6ce0e538 198 if (verbose) PrintAndLog("Quitting...");
53444513
MHS		 199 return 0;
200 }
6ce0e538 201 if( readStatus & FLAG_ICLASS_READER_CSN){
202 PrintAndLog("CSN: %s",sprint_hex(data,8));
203 tagFound = true;
204 }
caaf9618
MHS		 205 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
206 if( readStatus & FLAG_ICLASS_READER_CONF){
207 printIclassDumpInfo(data);
53444513 208 }
6ce0e538 209 if (tagFound && !loop) return 1;
53444513 210 } else {
6ce0e538 211 if (verbose) PrintAndLog("Command execute timeout");
53444513 212 }
6ce0e538 213 if (!loop) break;
53444513 214 }
53444513 215 return 0;
6ce0e538 216}
217
4d68ec02 218int CmdHFiClassReader(const char *Cmd) {
6ce0e538 219 return HFiClassReader(Cmd, true, true);
c3963755 220}
221
4d68ec02 222int CmdHFiClassReader_Replay(const char *Cmd) {
53444513
MHS		 223 uint8_t readerType = 0;
224 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
c3963755 225
53444513
MHS		 226 if (strlen(Cmd)<1) {
227 PrintAndLog("Usage: hf iclass replay <MAC>");
228 PrintAndLog(" sample: hf iclass replay 00112233");
229 return 0;
230 }
c3963755 231
53444513
MHS		 232 if (param_gethex(Cmd, 0, MAC, 8)) {
233 PrintAndLog("MAC must include 8 HEX symbols");
234 return 1;
235 }
c3963755 236
53444513
MHS		 237 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
238 memcpy(c.d.asBytes, MAC, 4);
239 SendCommand(&c);
1e262141 240
53444513 241 return 0;
1e262141 242}
243
4d68ec02 244int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
245 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
246 memcpy(c.d.asBytes, data, blocksCount * 16);
247 SendCommand(&c);
248 return 0;
249}
250
251int hf_iclass_eload_usage(void) {
7781a656
MHS		 252 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
253 PrintAndLog("Usage: hf iclass eload f <filename>");
254 PrintAndLog("");
255 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
256 return 0;
7781a656
MHS		 257}
258
4d68ec02 259int CmdHFiClassELoad(const char *Cmd) {
7781a656
MHS		 260
261 char opt = param_getchar(Cmd, 0);
262 if (strlen(Cmd)<1 || opt == 'h')
263 return hf_iclass_eload_usage();
264
265 //File handling and reading
266 FILE *f;
267 char filename[FILE_PATH_SIZE];
268 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
269 {
270 f = fopen(filename, "rb");
271 }else{
272 return hf_iclass_eload_usage();
273 }
274
275 if(!f) {
276 PrintAndLog("Failed to read from file '%s'", filename);
277 return 1;
278 }
279
280 fseek(f, 0, SEEK_END);
281 long fsize = ftell(f);
282 fseek(f, 0, SEEK_SET);
283
7a616c0d 284 if (fsize < 0) {
285 PrintAndLog("Error, when getting filesize");
eb5b63b4 286 fclose(f);
7a616c0d 287 return 1;
288 }
1defcf60 289
7a616c0d 290 uint8_t *dump = malloc(fsize);
1defcf60 291
7781a656
MHS		 292 size_t bytes_read = fread(dump, 1, fsize, f);
293 fclose(f);
294
1defcf60 295 printIclassDumpInfo(dump);
7781a656
MHS		 296 //Validate
297
298 if (bytes_read < fsize)
299 {
300 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
301 free(dump);
302 return 1;
303 }
304 //Send to device
305 uint32_t bytes_sent = 0;
306 uint32_t bytes_remaining = bytes_read;
307
308 while(bytes_remaining > 0){
309 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
310 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
311 memcpy(c.d.asBytes, dump, bytes_in_packet);
312 SendCommand(&c);
313 bytes_remaining -= bytes_in_packet;
314 bytes_sent += bytes_in_packet;
315 }
316 free(dump);
317 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
318 return 0;
319}
320
4d68ec02 321static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
41524d8a
MHS		 322 FILE *f = fopen(filename, "rb");
323 if(!f) {
324 PrintAndLog("Failed to read from file '%s'", filename);
325 return 1;
326 }
327 fseek(f, 0, SEEK_END);
328 long fsize = ftell(f);
329 fseek(f, 0, SEEK_SET);
330 size_t bytes_read = fread(buffer, 1, len, f);
331 fclose(f);
332 if(fsize != len)
333 {
334 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
335 return 1;
336 }
337 if(bytes_read != len)
338 {
339 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
340 return 1;
341 }
342 return 0;
343}
344
4d68ec02 345int usage_hf_iclass_decrypt(void) {
346 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
aa53efc3 347 PrintAndLog("");
348 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
349 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
350 PrintAndLog("");
351 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
352 PrintAndLog("");
353 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
354 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
355 PrintAndLog("which is defined by the configuration block.");
356 return 1;
357}
358
4d68ec02 359int CmdHFiClassDecrypt(const char *Cmd) {
41524d8a
MHS		 360 uint8_t key[16] = { 0 };
361 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
362 {
363 usage_hf_iclass_decrypt();
364 return 1;
365 }
366 PrintAndLog("Decryption file found... ");
367 char opt = param_getchar(Cmd, 0);
368 if (strlen(Cmd)<1 || opt == 'h')
369 return usage_hf_iclass_decrypt();
370
371 //Open the tagdump-file
372 FILE *f;
373 char filename[FILE_PATH_SIZE];
165e0775 374 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0) {
41524d8a 375 f = fopen(filename, "rb");
165e0775 376 if ( f == NULL ) {
377 PrintAndLog("Could not find file %s", filename);
378 return 1;
379 }
380 } else {
41524d8a
MHS		 381 return usage_hf_iclass_decrypt();
382 }
383
384 fseek(f, 0, SEEK_END);
385 long fsize = ftell(f);
386 fseek(f, 0, SEEK_SET);
387 uint8_t enc_dump[8] = {0};
388 uint8_t *decrypted = malloc(fsize);
389 des3_context ctx = { DES_DECRYPT ,{ 0 } };
390 des3_set2key_dec( &ctx, key);
391 size_t bytes_read = fread(enc_dump, 1, 8, f);
392
393 //Use the first block (CSN) for filename
394 char outfilename[FILE_PATH_SIZE] = { 0 };
395 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
396 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
397 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
398
399 size_t blocknum =0;
400 while(bytes_read == 8)
401 {
9a9bcea8 402 if(blocknum < 7)
41524d8a
MHS		 403 {
404 memcpy(decrypted+(blocknum*8), enc_dump, 8);
405 }else{
406 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
407 }
408 printvar("decrypted block", decrypted +(blocknum*8), 8);
409 bytes_read = fread(enc_dump, 1, 8, f);
410 blocknum++;
411 }
412 fclose(f);
413
414 saveFile(outfilename,"bin", decrypted, blocknum*8);
c4c3af7c 415 free(decrypted);
41524d8a
MHS		 416 return 0;
417}
7781a656 418
4d68ec02 419int usage_hf_iclass_encrypt(void) {
aa53efc3 420 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
421 PrintAndLog("");
422 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
423 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
424 PrintAndLog("");
425 PrintAndLog("example: hf iclass encrypt 0102030405060708");
426 PrintAndLog("");
427 return 0;
428}
429
4d68ec02 430static int iClassEncryptBlkData(uint8_t *blkData) {
aa53efc3 431 uint8_t key[16] = { 0 };
432 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
433 {
434 usage_hf_iclass_encrypt();
435 return 1;
436 }
437 PrintAndLog("Decryption file found... ");
53444513 438
4d68ec02 439 uint8_t encryptedData[16];
440 uint8_t *encrypted = encryptedData;
aa53efc3 441 des3_context ctx = { DES_DECRYPT ,{ 0 } };
442 des3_set2key_enc( &ctx, key);
443
4d68ec02 444 des3_crypt_ecb(&ctx, blkData,encrypted);
aa53efc3 445 //printvar("decrypted block", decrypted, 8);
4d68ec02 446 memcpy(blkData,encrypted,8);
aa53efc3 447
448 return 1;
449}
450
4d68ec02 451int CmdHFiClassEncryptBlk(const char *Cmd) {
aa53efc3 452 uint8_t blkData[8] = {0};
453 char opt = param_getchar(Cmd, 0);
454 if (strlen(Cmd)<1 || opt == 'h')
455 return usage_hf_iclass_encrypt();
53444513 456
aa53efc3 457 //get the bytes to encrypt
458 if (param_gethex(Cmd, 0, blkData, 16))
53444513 459 {
aa53efc3 460 PrintAndLog("BlockData must include 16 HEX symbols");
53444513
MHS		 461 return 0;
462 }
aa53efc3 463 if (!iClassEncryptBlkData(blkData)) return 0;
53444513 464
aa53efc3 465 printvar("encrypted block", blkData, 8);
466 return 1;
467}
53444513 468
4d68ec02 469void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
aa53efc3 470 uint8_t WB[9];
471 WB[0] = blockno;
472 memcpy(WB + 1,data,8);
473 doMAC_N(WB,sizeof(WB),div_key,MAC);
474 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
475}
53444513 476
4d68ec02 477static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
53444513
MHS		 478 UsbCommand resp;
479
aa53efc3 480 UsbCommand c = {CMD_READER_ICLASS, {0}};
3ac22ee1 481 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
aa53efc3 482 if (use_credit_key)
483 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
53444513 484
aa53efc3 485 clearCommandBuffer();
486 SendCommand(&c);
487 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
488 {
53444513 489 PrintAndLog("Command execute timeout");
aa53efc3 490 return false;
53444513
MHS		 491 }
492
aa53efc3 493 uint8_t isOK = resp.arg[0] & 0xff;
494 uint8_t *data = resp.d.asBytes;
53444513 495
aa53efc3 496 memcpy(CSN,data,8);
497 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
aa53efc3 498 if(isOK > 0)
499 {
500 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
53444513 501 }
aa53efc3 502 if(isOK <= 1){
503 PrintAndLog("Failed to obtain CC! Aborting");
504 return false;
505 }
506 return true;
a66fca86 507}
6f101995 508
bc37cfb3 509static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
aa53efc3 510 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
511 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
aa53efc3 512
513 if (!select_only(CSN, CCNR, use_credit_key, verbose))
514 return false;
515
4d68ec02 516 //get div_key
bc37cfb3
AL		 517 if(rawkey)
518 memcpy(div_key, KEY, 8);
519 else
520 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
521 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
4d68ec02 522
aa53efc3 523 doMAC(CCNR, div_key, MAC);
aa53efc3 524 UsbCommand resp;
525 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
526 memcpy(d.d.asBytes, MAC, 4);
527 clearCommandBuffer();
528 SendCommand(&d);
529 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
530 {
531 PrintAndLog("Auth Command execute timeout");
532 return false;
533 }
534 uint8_t isOK = resp.arg[0] & 0xff;
535 if (!isOK) {
536 PrintAndLog("Authentication error");
537 return false;
538 }
539 return true;
540}
541
4d68ec02 542int usage_hf_iclass_dump(void) {
bc37cfb3 543 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
aa53efc3 544 PrintAndLog("Options:");
545 PrintAndLog(" f <filename> : specify a filename to save dump to");
546 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
547 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
548 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
549 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
550 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
bc37cfb3 551 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
aa53efc3 552 PrintAndLog(" NOTE: * = required");
553 PrintAndLog("Samples:");
554 PrintAndLog(" hf iclass dump k 001122334455667B");
555 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
556 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
557 return 0;
558}
559
4d68ec02 560int CmdHFiClassReader_Dump(const char *Cmd) {
aa53efc3 561
562 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
563 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
564 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
565 uint8_t blockno = 0;
566 uint8_t numblks = 0;
4d68ec02 567 uint8_t maxBlk = 31;
bbd19bec 568 uint8_t app_areas = 1;
b82d8098 569 uint8_t kb = 2;
aa53efc3 570 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
571 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
572 uint8_t keyNbr = 0;
573 uint8_t dataLen = 0;
574 uint8_t fileNameLen = 0;
575 char filename[FILE_PATH_SIZE]={0};
576 char tempStr[50] = {0};
4d68ec02 577 bool have_debit_key = false;
aa53efc3 578 bool have_credit_key = false;
4d68ec02 579 bool use_credit_key = false;
aa53efc3 580 bool elite = false;
bc37cfb3 581 bool rawkey = false;
aa53efc3 582 bool errors = false;
583 uint8_t cmdp = 0;
584
585 while(param_getchar(Cmd, cmdp) != 0x00)
586 {
587 switch(param_getchar(Cmd, cmdp))
588 {
589 case 'h':
590 case 'H':
591 return usage_hf_iclass_dump();
592 case 'c':
593 case 'C':
594 have_credit_key = true;
595 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
596 if (dataLen == 16) {
597 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
598 } else if (dataLen == 1) {
599 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 600 if (keyNbr < ICLASS_KEYS_MAX) {
aa53efc3 601 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
602 } else {
603 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
604 errors = true;
605 }
606 } else {
607 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
608 errors = true;
609 }
610 cmdp += 2;
611 break;
612 case 'e':
613 case 'E':
614 elite = true;
615 cmdp++;
616 break;
617 case 'f':
618 case 'F':
619 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
620 if (fileNameLen < 1) {
621 PrintAndLog("No filename found after f");
622 errors = true;
623 }
624 cmdp += 2;
625 break;
626 case 'k':
627 case 'K':
4d68ec02 628 have_debit_key = true;
aa53efc3 629 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
630 if (dataLen == 16) {
631 errors = param_gethex(tempStr, 0, KEY, dataLen);
632 } else if (dataLen == 1) {
633 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 634 if (keyNbr < ICLASS_KEYS_MAX) {
aa53efc3 635 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
636 } else {
637 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
638 errors = true;
639 }
640 } else {
641 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
642 errors = true;
643 }
644 cmdp += 2;
645 break;
bc37cfb3
AL		 646 case 'r':
647 case 'R':
648 rawkey = true;
649 cmdp++;
650 break;
aa53efc3 651 default:
652 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
653 errors = true;
654 break;
655 }
656 if(errors) return usage_hf_iclass_dump();
657 }
658
659 if (cmdp < 2) return usage_hf_iclass_dump();
4d68ec02 660 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
661 if (!have_debit_key && have_credit_key) use_credit_key = true;
aa53efc3 662
663 //get config and first 3 blocks
664 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
665 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
666 UsbCommand resp;
667 uint8_t tag_data[255*8];
4d68ec02 668
aa53efc3 669 clearCommandBuffer();
670 SendCommand(&c);
4d68ec02 671 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
aa53efc3 672 PrintAndLog("Command execute timeout");
3ac22ee1 673 ul_switch_off_field();
aa53efc3 674 return 0;
675 }
4d68ec02 676 uint8_t readStatus = resp.arg[0] & 0xff;
677 uint8_t *data = resp.d.asBytes;
678
679 if(readStatus == 0){
680 PrintAndLog("No tag found...");
3ac22ee1 681 ul_switch_off_field();
4d68ec02 682 return 0;
683 }
684 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
685 memcpy(tag_data, data, 8*3);
686 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
687 numblks = data[8];
bbd19bec 688 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
b82d8098 689 // large memory - not able to dump pages currently
4d68ec02 690 if (numblks > maxBlk) numblks = maxBlk;
691 }
3ac22ee1 692 ul_switch_off_field();
4d68ec02 693 // authenticate debit key and get div_key - later store in dump block 3
bc37cfb3 694 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
aa53efc3 695 //try twice - for some reason it sometimes fails the first time...
bc37cfb3 696 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
aa53efc3 697 ul_switch_off_field();
698 return 0;
699 }
700 }
aa53efc3 701
4d68ec02 702 // begin dump
3ac22ee1 703 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
aa53efc3 704 clearCommandBuffer();
705 SendCommand(&w);
706 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
707 PrintAndLog("Command execute time-out 1");
3ac22ee1 708 ul_switch_off_field();
aa53efc3 709 return 1;
710 }
711 uint32_t blocksRead = resp.arg[1];
712 uint8_t isOK = resp.arg[0] & 0xff;
713 if (!isOK && !blocksRead) {
714 PrintAndLog("Read Block Failed");
3ac22ee1 715 ul_switch_off_field();
aa53efc3 716 return 0;
717 }
718 uint32_t startindex = resp.arg[2];
719 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
720 PrintAndLog("Data exceeded Buffer size!");
721 blocksRead = (sizeof(tag_data)/8) - blockno;
722 }
4d68ec02 723 // response ok - now get bigbuf content of the dump
aa53efc3 724 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
725 WaitForResponse(CMD_ACK,NULL);
4d68ec02 726 size_t gotBytes = blocksRead*8 + blockno*8;
aa53efc3 727
4d68ec02 728 // try AA2
729 if (have_credit_key) {
730 //turn off hf field before authenticating with different key
aa53efc3 731 ul_switch_off_field();
aa53efc3 732 memset(MAC,0,4);
4d68ec02 733 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
bc37cfb3 734 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
aa53efc3 735 //try twice - for some reason it sometimes fails the first time...
bc37cfb3 736 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
aa53efc3 737 ul_switch_off_field();
738 return 0;
739 }
740 }
4d68ec02 741 // do we still need to read more block? (aa2 enabled?)
742 if (maxBlk > blockno+numblks+1) {
743 // setup dump and start
744 w.arg[0] = blockno + blocksRead;
745 w.arg[1] = maxBlk - (blockno + blocksRead);
4d68ec02 746 clearCommandBuffer();
747 SendCommand(&w);
748 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
749 PrintAndLog("Command execute timeout 2");
3ac22ee1 750 ul_switch_off_field();
4d68ec02 751 return 0;
752 }
753 uint8_t isOK = resp.arg[0] & 0xff;
754 blocksRead = resp.arg[1];
755 if (!isOK && !blocksRead) {
756 PrintAndLog("Read Block Failed 2");
3ac22ee1 757 ul_switch_off_field();
4d68ec02 758 return 0;
759 }
aa53efc3 760
4d68ec02 761 startindex = resp.arg[2];
762 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
763 PrintAndLog("Data exceeded Buffer size!");
764 blocksRead = (sizeof(tag_data) - gotBytes)/8;
765 }
766 // get dumped data from bigbuf
767 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
768 WaitForResponse(CMD_ACK,NULL);
aa53efc3 769
4d68ec02 770 gotBytes += blocksRead*8;
771 } else { //field is still on - turn it off...
772 ul_switch_off_field();
773 }
aa53efc3 774 }
775
4d68ec02 776 // add diversified keys to dump
777 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
778 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
779 // print the dump
780 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
781 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
782 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
aa53efc3 783
aa53efc3 784 if (filename[0] == 0){
785 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
786 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
787 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
788 }
4d68ec02 789
790 // save the dump to .bin file
aa53efc3 791 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
4d68ec02 792 saveFile(filename, "bin", tag_data, gotBytes);
aa53efc3 793 return 1;
794}
795
bc37cfb3 796static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
aa53efc3 797 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
798 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
bc37cfb3 799 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
aa53efc3 800 return 0;
801
802 UsbCommand resp;
803
804 Calc_wb_mac(blockno,bldata,div_key,MAC);
3ac22ee1 805 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
aa53efc3 806 memcpy(w.d.asBytes, bldata, 8);
3ac22ee1 807 memcpy(w.d.asBytes + 8, MAC, 4);
aa53efc3 808
809 clearCommandBuffer();
810 SendCommand(&w);
811 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
812 {
813 PrintAndLog("Write Command execute timeout");
814 return 0;
815 }
816 uint8_t isOK = resp.arg[0] & 0xff;
817 if (!isOK) {
818 PrintAndLog("Write Block Failed");
819 return 0;
820 }
821 PrintAndLog("Write Block Successful");
aa53efc3 822 return 1;
823}
824
4d68ec02 825int usage_hf_iclass_writeblock(void) {
aa53efc3 826 PrintAndLog("Options:");
827 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
828 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
829 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
830 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
831 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
bc37cfb3 832 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
aa53efc3 833 PrintAndLog("Samples:");
834 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
835 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
836 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
837 return 0;
838}
839
840int CmdHFiClass_WriteBlock(const char *Cmd) {
841 uint8_t blockno=0;
3ac22ee1 842 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
aa53efc3 843 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
844 uint8_t keyNbr = 0;
845 uint8_t dataLen = 0;
846 char tempStr[50] = {0};
847 bool use_credit_key = false;
848 bool elite = false;
bc37cfb3 849 bool rawkey= false;
aa53efc3 850 bool errors = false;
851 uint8_t cmdp = 0;
852 while(param_getchar(Cmd, cmdp) != 0x00)
853 {
854 switch(param_getchar(Cmd, cmdp))
855 {
856 case 'h':
857 case 'H':
858 return usage_hf_iclass_writeblock();
859 case 'b':
860 case 'B':
861 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
862 PrintAndLog("Block No must include 2 HEX symbols\n");
863 errors = true;
864 }
865 cmdp += 2;
866 break;
867 case 'c':
868 case 'C':
869 use_credit_key = true;
870 cmdp++;
871 break;
872 case 'd':
873 case 'D':
874 if (param_gethex(Cmd, cmdp+1, bldata, 16))
875 {
876 PrintAndLog("KEY must include 16 HEX symbols\n");
877 errors = true;
878 }
879 cmdp += 2;
880 break;
881 case 'e':
882 case 'E':
883 elite = true;
884 cmdp++;
885 break;
886 case 'k':
887 case 'K':
888 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
889 if (dataLen == 16) {
890 errors = param_gethex(tempStr, 0, KEY, dataLen);
891 } else if (dataLen == 1) {
892 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 893 if (keyNbr < ICLASS_KEYS_MAX) {
aa53efc3 894 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
895 } else {
896 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
897 errors = true;
898 }
899 } else {
900 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
901 errors = true;
902 }
903 cmdp += 2;
904 break;
bc37cfb3
AL		 905 case 'r':
906 case 'R':
907 rawkey = true;
908 cmdp++;
909 break;
aa53efc3 910 default:
911 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
912 errors = true;
913 break;
914 }
915 if(errors) return usage_hf_iclass_writeblock();
916 }
917
918 if (cmdp < 6) return usage_hf_iclass_writeblock();
bc37cfb3 919 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
3ac22ee1 920 ul_switch_off_field();
921 return ans;
aa53efc3 922}
923
4d68ec02 924int usage_hf_iclass_clone(void) {
bc37cfb3 925 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
aa53efc3 926 PrintAndLog("Options:");
927 PrintAndLog(" f <filename>: specify a filename to clone from");
928 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
929 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
930 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
931 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
932 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
bc37cfb3 933 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
aa53efc3 934 PrintAndLog("Samples:");
935 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
936 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
937 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
938 return -1;
939}
940
941int CmdHFiClassCloneTag(const char *Cmd) {
165e0775 942 char filename[FILE_PATH_SIZE] = {0};
aa53efc3 943 char tempStr[50]={0};
944 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
945 uint8_t keyNbr = 0;
946 uint8_t fileNameLen = 0;
947 uint8_t startblock = 0;
948 uint8_t endblock = 0;
949 uint8_t dataLen = 0;
950 bool use_credit_key = false;
951 bool elite = false;
bc37cfb3 952 bool rawkey = false;
aa53efc3 953 bool errors = false;
954 uint8_t cmdp = 0;
955 while(param_getchar(Cmd, cmdp) != 0x00)
956 {
957 switch(param_getchar(Cmd, cmdp))
958 {
959 case 'h':
960 case 'H':
961 return usage_hf_iclass_clone();
962 case 'b':
963 case 'B':
964 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
965 PrintAndLog("Start Block No must include 2 HEX symbols\n");
966 errors = true;
967 }
968 cmdp += 2;
969 break;
970 case 'c':
971 case 'C':
972 use_credit_key = true;
973 cmdp++;
974 break;
975 case 'e':
976 case 'E':
977 elite = true;
978 cmdp++;
979 break;
980 case 'f':
981 case 'F':
982 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
983 if (fileNameLen < 1) {
984 PrintAndLog("No filename found after f");
985 errors = true;
986 }
987 cmdp += 2;
988 break;
989 case 'k':
990 case 'K':
991 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
992 if (dataLen == 16) {
993 errors = param_gethex(tempStr, 0, KEY, dataLen);
994 } else if (dataLen == 1) {
995 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 996 if (keyNbr < ICLASS_KEYS_MAX) {
aa53efc3 997 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
998 } else {
999 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1000 errors = true;
1001 }
1002 } else {
1003 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1004 errors = true;
1005 }
1006 cmdp += 2;
1007 break;
1008 case 'l':
1009 case 'L':
1010 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1011 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1012 errors = true;
1013 }
1014 cmdp += 2;
1015 break;
bc37cfb3
AL		 1016 case 'r':
1017 case 'R':
1018 rawkey = true;
1019 cmdp++;
1020 break;
aa53efc3 1021 default:
1022 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1023 errors = true;
1024 break;
1025 }
1026 if(errors) return usage_hf_iclass_clone();
1027 }
1028
1029 if (cmdp < 8) return usage_hf_iclass_clone();
1030
1031 FILE *f;
1032
1033 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1034
1035 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1036 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1037 }
1038 // file handling and reading
1039 f = fopen(filename,"rb");
1040 if(!f) {
1041 PrintAndLog("Failed to read from file '%s'", filename);
1042 return 1;
1043 }
1044
1045 if (startblock<5) {
1046 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
165e0775 1047 fclose(f);
aa53efc3 1048 return 0;
1049 }
1050 // now read data from the file from block 6 --- 19
1051 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1052 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1053 // else we have to create a share memory
1054 int i;
1055 fseek(f,startblock*8,SEEK_SET);
33c795d0 1056 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0 ) {
1057 PrintAndLog("File reading error.");
1058 fclose(f);
1059 return 2;
1060 }
aa53efc3 1061
1062 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1063 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1064
bc37cfb3 1065 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
aa53efc3 1066 return 0;
1067
3ac22ee1 1068 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
aa53efc3 1069 uint8_t *ptr;
1070 // calculate all mac for every the block we will write
1071 for (i = startblock; i <= endblock; i++){
1072 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1073 // usb command d start pointer = d + (i - 6) * 12
1074 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1075 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1076 // next one
1077 ptr = w.d.asBytes + (i - startblock) * 12;
1078 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1079 memcpy(ptr + 8,MAC, 4);
1080 }
1081 uint8_t p[12];
1082 for (i = 0; i <= endblock - startblock;i++){
1083 memcpy(p,w.d.asBytes + (i * 12),12);
4d68ec02 1084 printf("Block |%02x|",i + startblock);
1085 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1086 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
aa53efc3 1087 }
1088 UsbCommand resp;
1089 SendCommand(&w);
1090 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1091 {
1092 PrintAndLog("Command execute timeout");
1093 return 0;
1094 }
1095 return 1;
1096}
1097
bc37cfb3 1098static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose) {
aa53efc3 1099 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1100 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1101
bc37cfb3 1102 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
aa53efc3 1103 return 0;
1104
1105 UsbCommand resp;
3ac22ee1 1106 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
aa53efc3 1107 clearCommandBuffer();
1108 SendCommand(&w);
1109 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1110 {
1111 PrintAndLog("Command execute timeout");
1112 return 0;
1113 }
1114 uint8_t isOK = resp.arg[0] & 0xff;
1115 if (!isOK) {
1116 PrintAndLog("Read Block Failed");
1117 return 0;
1118 }
1119 //data read is stored in: resp.d.asBytes[0-15]
1120 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1121 return 1;
1122}
1123
4d68ec02 1124int usage_hf_iclass_readblock(void) {
bc37cfb3 1125 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
aa53efc3 1126 PrintAndLog("Options:");
1127 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1128 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1129 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1130 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
bc37cfb3 1131 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
aa53efc3 1132 PrintAndLog("Samples:");
1133 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1134 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1135 PrintAndLog(" hf iclass readblk b 0A k 0");
1136 return 0;
1137}
1138
4d68ec02 1139int CmdHFiClass_ReadBlock(const char *Cmd) {
aa53efc3 1140 uint8_t blockno=0;
1141 uint8_t keyType = 0x88; //debit key
1142 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1143 uint8_t keyNbr = 0;
1144 uint8_t dataLen = 0;
1145 char tempStr[50] = {0};
1146 bool elite = false;
bc37cfb3 1147 bool rawkey = false;
aa53efc3 1148 bool errors = false;
1149 uint8_t cmdp = 0;
1150 while(param_getchar(Cmd, cmdp) != 0x00)
1151 {
1152 switch(param_getchar(Cmd, cmdp))
1153 {
1154 case 'h':
1155 case 'H':
1156 return usage_hf_iclass_readblock();
1157 case 'b':
1158 case 'B':
1159 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1160 PrintAndLog("Block No must include 2 HEX symbols\n");
1161 errors = true;
1162 }
1163 cmdp += 2;
1164 break;
1165 case 'c':
1166 case 'C':
1167 keyType = 0x18;
1168 cmdp++;
1169 break;
1170 case 'e':
1171 case 'E':
1172 elite = true;
1173 cmdp++;
1174 break;
1175 case 'k':
1176 case 'K':
1177 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1178 if (dataLen == 16) {
1179 errors = param_gethex(tempStr, 0, KEY, dataLen);
1180 } else if (dataLen == 1) {
1181 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 1182 if (keyNbr < ICLASS_KEYS_MAX) {
aa53efc3 1183 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1184 } else {
1185 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1186 errors = true;
1187 }
1188 } else {
1189 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1190 errors = true;
1191 }
1192 cmdp += 2;
1193 break;
bc37cfb3
AL		 1194 case 'r':
1195 case 'R':
1196 rawkey = true;
1197 cmdp++;
1198 break;
aa53efc3 1199 default:
1200 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1201 errors = true;
1202 break;
1203 }
1204 if(errors) return usage_hf_iclass_readblock();
1205 }
1206
1207 if (cmdp < 4) return usage_hf_iclass_readblock();
4d68ec02 1208
bc37cfb3 1209 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true);
aa53efc3 1210}
1211
4d68ec02 1212int CmdHFiClass_loclass(const char *Cmd) {
aa53efc3 1213 char opt = param_getchar(Cmd, 0);
1214
1215 if (strlen(Cmd)<1 || opt == 'h') {
1216 PrintAndLog("Usage: hf iclass loclass [options]");
1217 PrintAndLog("Options:");
1218 PrintAndLog("h Show this help");
6f101995
MHS		 1219 PrintAndLog("t Perform self-test");
1220 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1221 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1222 PrintAndLog(" malicious CSNs, and their protocol responses");
b8140ab1 1223 PrintAndLog(" The binary format of the file is expected to be as follows: ");
6f101995
MHS		 1224 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1225 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1226 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1227 PrintAndLog(" ... totalling N*24 bytes");
1228 return 0;
1229 }
1230 char fileName[255] = {0};
1231 if(opt == 'f')
1232 {
53444513
MHS		 1233 if(param_getstr(Cmd, 1, fileName) > 0)
1234 {
1235 return bruteforceFileNoKeys(fileName);
1236 }else
1237 {
1238 PrintAndLog("You must specify a filename");
1239 }
6f101995
MHS		 1240 }
1241 else if(opt == 't')
1242 {
1243 int errors = testCipherUtils();
1244 errors += testMAC();
1245 errors += doKeyTests(0);
1246 errors += testElite();
1247 if(errors)
1248 {
1249 prnlog("OBS! There were errors!!!");
1250 }
1251 return errors;
1252 }
a66fca86 1253
6f101995
MHS		 1254 return 0;
1255}
c3963755 1256
4d68ec02 1257void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
aa53efc3 1258 uint8_t blockdata[8];
1259 uint8_t mem_config;
1260 memcpy(&mem_config, iclass_dump + 13,1);
1261 uint8_t maxmemcount;
1262 uint8_t filemaxblock = filesize / 8;
4d68ec02 1263 if (mem_config & 0x80)
aa53efc3 1264 maxmemcount = 255;
1265 else
4d68ec02 1266 maxmemcount = 31;
1267 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
aa53efc3 1268
1269 if (startblock == 0)
1270 startblock = 6;
1271 if ((endblock > maxmemcount) || (endblock == 0))
1272 endblock = maxmemcount;
1273 if (endblock > filemaxblock)
1274 endblock = filemaxblock;
1275 int i = startblock;
1276 int j;
4d68ec02 1277 while (i <= endblock){
1278 printf("Block |%02X| ",i);
aa53efc3 1279 memcpy(blockdata,iclass_dump + (i * 8),8);
1280 for (j = 0;j < 8;j++)
1281 printf("%02X ",blockdata[j]);
4d68ec02 1282 printf("|\n");
aa53efc3 1283 i++;
1284 }
aa53efc3 1285}
1286
4d68ec02 1287int usage_hf_iclass_readtagfile() {
1288 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1289 return 1;
1290}
1291
1292int CmdHFiClassReadTagFile(const char *Cmd) {
aa53efc3 1293 int startblock = 0;
1294 int endblock = 0;
1295 char tempnum[5];
1296 FILE *f;
1297 char filename[FILE_PATH_SIZE];
1298 if (param_getstr(Cmd, 0, filename) < 1)
1299 return usage_hf_iclass_readtagfile();
1300 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1301 startblock = 0;
1302 else
1303 sscanf(tempnum,"%d",&startblock);
1304
1305 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1306 endblock = 0;
1307 else
1308 sscanf(tempnum,"%d",&endblock);
1309 // file handling and reading
1310 f = fopen(filename,"rb");
1311 if(!f) {
1312 PrintAndLog("Failed to read from file '%s'", filename);
1313 return 1;
1314 }
1315 fseek(f, 0, SEEK_END);
1316 long fsize = ftell(f);
1317 fseek(f, 0, SEEK_SET);
1318
b0c68b72 1319 if ( fsize < 0 ) {
1320 PrintAndLog("Error, when getting filesize");
1321 fclose(f);
1322 return 1;
1323 }
aa53efc3 1324
b0c68b72 1325 uint8_t *dump = malloc(fsize);
aa53efc3 1326
1327 size_t bytes_read = fread(dump, 1, fsize, f);
1328 fclose(f);
1329 uint8_t *csn = dump;
4d68ec02 1330 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
aa53efc3 1331 // printIclassDumpInfo(dump);
1332 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1333 free(dump);
1334 return 0;
1335}
1336
4d68ec02 1337/*
1338uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
aa53efc3 1339 uint64_t new_div = 0x00;
1340 new_div ^= sdiv;
1341 new_div ^= hdiv;
1342 return new_div;
1343}
1344
4d68ec02 1345uint64_t hexarray_to_uint64(uint8_t *key) {
aa53efc3 1346 char temp[17];
1347 uint64_t uint_key;
1348 for (int i = 0;i < 8;i++)
1349 sprintf(&temp[(i *2)],"%02X",key[i]);
1350 temp[16] = '\0';
38d618ba 1351 if (sscanf(temp,"%016"llx,&uint_key) < 1)
aa53efc3 1352 return 0;
1353 return uint_key;
1354}
4d68ec02 1355*/
1356void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
aa53efc3 1357 uint8_t keytable[128] = {0};
1358 uint8_t key_index[8] = {0};
4d68ec02 1359 if (elite) {
1360 uint8_t key_sel[8] = { 0 };
1361 uint8_t key_sel_p[8] = { 0 };
1362 hash2(KEY, keytable);
1363 hash1(CSN, key_index);
1364 for(uint8_t i = 0; i < 8 ; i++)
1365 key_sel[i] = keytable[key_index[i]] & 0xFF;
aa53efc3 1366
4d68ec02 1367 //Permute from iclass format to standard format
1368 permutekey_rev(key_sel, key_sel_p);
1369 diversifyKey(CSN, key_sel_p, div_key);
1370 } else {
1371 diversifyKey(CSN, KEY, div_key);
1372 }
1373}
aa53efc3 1374
4d68ec02 1375//when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1376//calculate and return xor_div_key (ready for a key write command)
1377//print all div_keys if verbose
1378static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1379 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1380 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1381 //get old div key
1382 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1383 //get new div key
1384 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1385
1386 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1387 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1388 }
1389 if (verbose) {
1390 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1391 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1392 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1393 }
1394}
aa53efc3 1395
4d68ec02 1396int usage_hf_iclass_calc_newkey(void) {
1397 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1398 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1399 PrintAndLog(" Options:");
1400 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1401 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1402 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1403 PrintAndLog(" e : specify new key as elite calc");
1404 PrintAndLog(" ee : specify old and new key as elite calc");
1405 PrintAndLog("Samples:");
1406 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1407 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1408 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1409 PrintAndLog("NOTE: * = required\n");
aa53efc3 1410
4d68ec02 1411 return 1;
1412}
aa53efc3 1413
4d68ec02 1414int CmdHFiClassCalcNewKey(const char *Cmd) {
1415 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1416 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1417 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1418 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1419 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1420 uint8_t keyNbr = 0;
1421 uint8_t dataLen = 0;
1422 char tempStr[50] = {0};
1423 bool givenCSN = false;
1424 bool oldElite = false;
1425 bool elite = false;
1426 bool errors = false;
1427 uint8_t cmdp = 0;
1428 while(param_getchar(Cmd, cmdp) != 0x00)
1429 {
1430 switch(param_getchar(Cmd, cmdp))
1431 {
1432 case 'h':
1433 case 'H':
1434 return usage_hf_iclass_calc_newkey();
1435 case 'e':
1436 case 'E':
1437 dataLen = param_getstr(Cmd, cmdp, tempStr);
1438 if (dataLen==2)
1439 oldElite = true;
1440 elite = true;
1441 cmdp++;
1442 break;
1443 case 'n':
1444 case 'N':
1445 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1446 if (dataLen == 16) {
1447 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1448 } else if (dataLen == 1) {
1449 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 1450 if (keyNbr < ICLASS_KEYS_MAX) {
4d68ec02 1451 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1452 } else {
1453 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1454 errors = true;
1455 }
1456 } else {
1457 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1458 errors = true;
1459 }
1460 cmdp += 2;
1461 break;
1462 case 'o':
1463 case 'O':
1464 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1465 if (dataLen == 16) {
1466 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1467 } else if (dataLen == 1) {
1468 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 1469 if (keyNbr < ICLASS_KEYS_MAX) {
4d68ec02 1470 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1471 } else {
1472 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1473 errors = true;
1474 }
1475 } else {
1476 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1477 errors = true;
1478 }
1479 cmdp += 2;
1480 break;
1481 case 's':
1482 case 'S':
1483 givenCSN = true;
1484 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1485 return usage_hf_iclass_calc_newkey();
1486 cmdp += 2;
1487 break;
1488 default:
1489 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1490 errors = true;
1491 break;
1492 }
1493 if(errors) return usage_hf_iclass_calc_newkey();
1494 }
aa53efc3 1495
4d68ec02 1496 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
aa53efc3 1497
4d68ec02 1498 if (!givenCSN)
1499 if (!select_only(CSN, CCNR, false, true))
1500 return 0;
1501
1502 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
aa53efc3 1503 return 0;
1504}
1505
4d68ec02 1506static int loadKeys(char *filename) {
aa53efc3 1507 FILE *f;
1508 f = fopen(filename,"rb");
1509 if(!f) {
1510 PrintAndLog("Failed to read from file '%s'", filename);
1511 return 0;
1512 }
1513 fseek(f, 0, SEEK_END);
1514 long fsize = ftell(f);
1515 fseek(f, 0, SEEK_SET);
1516
eb5b63b4 1517 if ( fsize < 0 ) {
1518 PrintAndLog("Error, when getting filesize");
1519 fclose(f);
1520 return 1;
1521 }
1522
aa53efc3 1523 uint8_t *dump = malloc(fsize);
1524
1525 size_t bytes_read = fread(dump, 1, fsize, f);
1526 fclose(f);
1527 if (bytes_read > ICLASS_KEYS_MAX * 8){
1528 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1529 free(dump);
1530 return 0;
1531 }
1532 uint8_t i = 0;
1533 for (; i < bytes_read/8; i++){
1534 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1535 }
1536 free(dump);
1537 PrintAndLog("%u keys loaded", i);
1538 return 1;
1539}
1540
4d68ec02 1541static int saveKeys(char *filename) {
aa53efc3 1542 FILE *f;
1543 f = fopen(filename,"wb");
1544 if (f == NULL) {
1545 printf("error opening file %s\n",filename);
1546 return 0;
1547 }
1548 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1549 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1550 PrintAndLog("save key failed to write to file: %s", filename);
1551 break;
1552 }
1553 }
1554 fclose(f);
1555 return 0;
1556}
1557
4d68ec02 1558static int printKeys(void) {
aa53efc3 1559 PrintAndLog("");
1560 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1561 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1562 }
1563 PrintAndLog("");
1564 return 0;
1565}
1566
4d68ec02 1567int usage_hf_iclass_managekeys(void) {
aa53efc3 1568 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1569 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1570 PrintAndLog(" Options:");
1571 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1572 PrintAndLog(" k <key> : set a key in memory");
1573 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1574 PrintAndLog(" s : save keys in memory to file specified by filename");
1575 PrintAndLog(" l : load keys to memory from file specified by filename");
1576 PrintAndLog(" p : print keys loaded into memory\n");
1577 PrintAndLog("Samples:");
1578 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1579 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1580 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1581 PrintAndLog(" print keys : hf iclass managekeys p\n");
1582 return 0;
1583}
1584
4d68ec02 1585int CmdHFiClassManageKeys(const char *Cmd) {
aa53efc3 1586 uint8_t keyNbr = 0;
1587 uint8_t dataLen = 0;
1588 uint8_t KEY[8] = {0};
1589 char filename[FILE_PATH_SIZE];
1590 uint8_t fileNameLen = 0;
1591 bool errors = false;
1592 uint8_t operation = 0;
1593 char tempStr[20];
1594 uint8_t cmdp = 0;
1595
1596 while(param_getchar(Cmd, cmdp) != 0x00)
1597 {
1598 switch(param_getchar(Cmd, cmdp))
1599 {
1600 case 'h':
1601 case 'H':
1602 return usage_hf_iclass_managekeys();
1603 case 'f':
1604 case 'F':
1605 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1606 if (fileNameLen < 1) {
1607 PrintAndLog("No filename found after f");
1608 errors = true;
1609 }
1610 cmdp += 2;
1611 break;
1612 case 'n':
1613 case 'N':
1614 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 1615 if (keyNbr >= ICLASS_KEYS_MAX) {
1616 PrintAndLog("Invalid block number");
aa53efc3 1617 errors = true;
1618 }
1619 cmdp += 2;
1620 break;
1621 case 'k':
1622 case 'K':
1623 operation += 3; //set key
1624 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1625 if (dataLen == 16) { //ul-c or ev1/ntag key length
1626 errors = param_gethex(tempStr, 0, KEY, dataLen);
1627 } else {
1628 PrintAndLog("\nERROR: Key is incorrect length\n");
1629 errors = true;
1630 }
1631 cmdp += 2;
1632 break;
1633 case 'p':
1634 case 'P':
1635 operation += 4; //print keys in memory
1636 cmdp++;
1637 break;
1638 case 'l':
1639 case 'L':
1640 operation += 5; //load keys from file
1641 cmdp++;
1642 break;
1643 case 's':
1644 case 'S':
1645 operation += 6; //save keys to file
1646 cmdp++;
1647 break;
1648 default:
1649 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1650 errors = true;
1651 break;
1652 }
1653 if(errors) return usage_hf_iclass_managekeys();
1654 }
1655 if (operation == 0){
1656 PrintAndLog("no operation specified (load, save, or print)\n");
1657 return usage_hf_iclass_managekeys();
1658 }
1659 if (operation > 6){
1660 PrintAndLog("Too many operations specified\n");
1661 return usage_hf_iclass_managekeys();
1662 }
1663 if (operation > 4 && fileNameLen == 0){
1664 PrintAndLog("You must enter a filename when loading or saving\n");
1665 return usage_hf_iclass_managekeys();
1666 }
1667
1668 switch (operation){
1669 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1670 case 4: return printKeys();
1671 case 5: return loadKeys(filename);
1672 case 6: return saveKeys(filename);
1673 break;
1674 }
1675 return 0;
1676}
1677
cee5a30d 1678static command_t CommandTable[] =
1679{
aa53efc3 1680 {"help", CmdHelp, 1, "This help"},
4d68ec02 1681 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1682 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1683 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1684 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1685 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1686 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1687 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1688 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1689 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1690 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1691 {"reader", CmdHFiClassReader, 0, " Read an iClass tag"},
1692 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1693 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1694 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1695 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1696 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
6f101995 1697 {NULL, NULL, 0, NULL}
cee5a30d 1698};
1699
1700int CmdHFiClass(const char *Cmd)
1701{
53444513
MHS		 1702 CmdsParse(CommandTable, Cmd);
1703 return 0;
cee5a30d 1704}
1705
1706int CmdHelp(const char *Cmd)
1707{
53444513
MHS		 1708 CmdsHelp(CommandTable);
1709 return 0;
cee5a30d 1710}
Proxmark3 GIT tracking
Impressum, Datenschutz