]> cvs.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhficlass.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
added a tag
[proxmark3-svn] / client / cmdhficlass.c
CommitLineData
cee5a30d 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833 4// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// High frequency iClass commands
11//-----------------------------------------------------------------------------
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <string.h>
9f6e9d15 16#include <sys/stat.h>
cee5a30d 17#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18#include "data.h"
902cb3c0 19#include "proxmark3.h"
cee5a30d 20#include "ui.h"
21#include "cmdparser.h"
22#include "cmdhficlass.h"
23#include "common.h"
14006804 24#include "util.h"
17cba269 25#include "cmdmain.h"
930763e8 26#include "polarssl/des.h"
a66fca86
AD		 27#include "loclass/cipherutils.h"
28#include "loclass/cipher.h"
29#include "loclass/ikeys.h"
3ad48540
MHS		 30#include "loclass/elite_crack.h"
31#include "loclass/fileutils.h"
1defcf60 32#include "protocols.h"
caaf9618 33#include "usb_cmd.h"
aa53efc3 34#include "cmdhfmfu.h"
35
cee5a30d 36static int CmdHelp(const char *Cmd);
37
aa53efc3 38#define ICLASS_KEYS_MAX 8
39static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
40 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
41 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
48};
49
50typedef struct iclass_block {
51 uint8_t d[8];
52} iclass_block_t;
53
4d68ec02 54int xorbits_8(uint8_t val) {
53444513
MHS		 55 uint8_t res = val ^ (val >> 1); //1st pass
56 res = res ^ (res >> 1); // 2nd pass
57 res = res ^ (res >> 2); // 3rd pass
58 res = res ^ (res >> 4); // 4th pass
59 return res & 1;
17cba269
MHS		 60}
61
4d68ec02 62int CmdHFiClassList(const char *Cmd) {
4c3de57a 63 PrintAndLog("Deprecated command, use 'hf list iclass' instead");
17cba269
MHS		 64 return 0;
65}
66
4d68ec02 67int CmdHFiClassSnoop(const char *Cmd) {
53444513
MHS		 68 UsbCommand c = {CMD_SNOOP_ICLASS};
69 SendCommand(&c);
70 return 0;
cee5a30d 71}
4d68ec02 72
73int usage_hf_iclass_sim(void) {
41524d8a
MHS		 74 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
75 PrintAndLog(" options");
76 PrintAndLog(" 0 <CSN> simulate the given CSN");
77 PrintAndLog(" 1 simulate default CSN");
78 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
79 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
80 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
81 PrintAndLog(" example: hf iclass sim 2");
82 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
83 PrintAndLog(" hf iclass sim 3");
84 return 0;
85}
86
6116c796 87#define NUM_CSNS 15
4d68ec02 88int CmdHFiClassSim(const char *Cmd) {
53444513
MHS		 89 uint8_t simType = 0;
90 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
91
92 if (strlen(Cmd)<1) {
1defcf60 93 return usage_hf_iclass_sim();
53444513 94 }
1defcf60 95 simType = param_get8ex(Cmd, 0, 0, 10);
53444513
MHS		 96
97 if(simType == 0)
98 {
99 if (param_gethex(Cmd, 1, CSN, 16)) {
100 PrintAndLog("A CSN should consist of 16 HEX symbols");
41524d8a 101 return usage_hf_iclass_sim();
53444513 102 }
53444513 103
41524d8a 104 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
53444513 105 }
41524d8a 106 if(simType > 3)
53444513
MHS		 107 {
108 PrintAndLog("Undefined simptype %d", simType);
41524d8a 109 return usage_hf_iclass_sim();
53444513 110 }
1e262141 111
41524d8a 112 uint8_t numberOfCSNs=0;
9f6e9d15
MHS		 113 if(simType == 2)
114 {
6116c796 115 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
9f6e9d15 116 UsbCommand resp = {0};
17cba269 117
53444513
MHS		 118 uint8_t csns[8*NUM_CSNS] = {
119 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
120 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
121 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
6116c796
MHS		 134
135 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
9f6e9d15
MHS		 136
137 SendCommand(&c);
138 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
139 PrintAndLog("Command timed out");
140 return 0;
141 }
1e262141 142
77abe781 143 uint8_t num_mac_responses = resp.arg[1];
6116c796 144 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
9f6e9d15 145
6116c796 146 size_t datalen = NUM_CSNS*24;
9f6e9d15
MHS		 147 /*
148 * Now, time to dump to file. We'll use this format:
77abe781 149 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15 150 * So, it should wind up as
77abe781
MHS		 151 * 8 * 24 bytes.
152 *
153 * The returndata from the pm3 is on the following format
154 * <4 byte NR><4 byte MAC>
155 * CC are all zeroes, CSN is the same as was sent in
9f6e9d15 156 **/
77abe781
MHS		 157 void* dump = malloc(datalen);
158 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15 159 uint8_t i = 0;
6116c796 160 for(i = 0 ; i < NUM_CSNS ; i++)
9f6e9d15 161 {
77abe781
MHS		 162 memcpy(dump+i*24, csns+i*8,8); //CSN
163 //8 zero bytes here...
164 //Then comes NR_MAC (eight bytes from the response)
165 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
1e262141 166
9f6e9d15
MHS		 167 }
168 /** Now, save to dumpfile **/
77abe781
MHS		 169 saveFile("iclass_mac_attack", "bin", dump,datalen);
170 free(dump);
9f6e9d15
MHS		 171 }else
172 {
173 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
174 memcpy(c.d.asBytes, CSN, 8);
175 SendCommand(&c);
176 }
1e262141 177
53444513 178 return 0;
1e262141 179}
180
4d68ec02 181int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
6ce0e538 182 bool tagFound = false;
34e2af02 183 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
184 FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_AA |
185 FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY } };
aa53efc3 186 // loop in client not device - else on windows have a communication error
53444513
MHS		 187 UsbCommand resp;
188 while(!ukbhit()){
aa53efc3 189 SendCommand(&c);
6ce0e538 190 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
191 uint8_t readStatus = resp.arg[0] & 0xff;
192 uint8_t *data = resp.d.asBytes;
53444513 193
979c7655 194 // no tag found or button pressed
195 if( (readStatus == 0 && !loop) || readStatus == 0xFF) {
196 // abort
197 if (verbose) PrintAndLog("Quitting...");
198 return 0;
199 }
34e2af02 200
201 if( readStatus & FLAG_ICLASS_READER_CSN) {
67e344df 202 PrintAndLog(" CSN: %s",sprint_hex(data,8));
6ce0e538 203 tagFound = true;
204 }
34e2af02 205 if( readStatus & FLAG_ICLASS_READER_CC) {
206 PrintAndLog(" CC: %s",sprint_hex(data+16,8));
207 }
208 if( readStatus & FLAG_ICLASS_READER_CONF) {
caaf9618 209 printIclassDumpInfo(data);
53444513 210 }
67e344df 211 if (readStatus & FLAG_ICLASS_READER_AA) {
212 bool legacy = true;
34e2af02 213 PrintAndLog(" AppIA: %s",sprint_hex(data+8*5,8));
67e344df 214 for (int i = 0; i<8; i++) {
34e2af02 215 if (data[8*5+i] != 0xFF) {
67e344df 216 legacy = false;
217 }
218 }
219 PrintAndLog(" : Possible iClass %s",(legacy) ? "(legacy tag)" : "(NOT legacy tag)");
220 }
221
6ce0e538 222 if (tagFound && !loop) return 1;
53444513 223 } else {
6ce0e538 224 if (verbose) PrintAndLog("Command execute timeout");
53444513 225 }
6ce0e538 226 if (!loop) break;
53444513 227 }
53444513 228 return 0;
6ce0e538 229}
230
4d68ec02 231int CmdHFiClassReader(const char *Cmd) {
6ce0e538 232 return HFiClassReader(Cmd, true, true);
c3963755 233}
234
4d68ec02 235int CmdHFiClassReader_Replay(const char *Cmd) {
53444513
MHS		 236 uint8_t readerType = 0;
237 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
c3963755 238
53444513
MHS		 239 if (strlen(Cmd)<1) {
240 PrintAndLog("Usage: hf iclass replay <MAC>");
241 PrintAndLog(" sample: hf iclass replay 00112233");
242 return 0;
243 }
c3963755 244
53444513
MHS		 245 if (param_gethex(Cmd, 0, MAC, 8)) {
246 PrintAndLog("MAC must include 8 HEX symbols");
247 return 1;
248 }
c3963755 249
53444513
MHS		 250 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
251 memcpy(c.d.asBytes, MAC, 4);
252 SendCommand(&c);
1e262141 253
53444513 254 return 0;
1e262141 255}
256
4d68ec02 257int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
258 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
259 memcpy(c.d.asBytes, data, blocksCount * 16);
260 SendCommand(&c);
261 return 0;
262}
263
264int hf_iclass_eload_usage(void) {
7781a656
MHS		 265 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
266 PrintAndLog("Usage: hf iclass eload f <filename>");
267 PrintAndLog("");
268 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
269 return 0;
7781a656
MHS		 270}
271
4d68ec02 272int CmdHFiClassELoad(const char *Cmd) {
7781a656
MHS		 273
274 char opt = param_getchar(Cmd, 0);
275 if (strlen(Cmd)<1 || opt == 'h')
276 return hf_iclass_eload_usage();
277
278 //File handling and reading
279 FILE *f;
280 char filename[FILE_PATH_SIZE];
874572d4 281 if(opt == 'f' && param_getstr(Cmd, 1, filename, sizeof(filename)) > 0)
7781a656
MHS		 282 {
283 f = fopen(filename, "rb");
284 }else{
285 return hf_iclass_eload_usage();
286 }
287
288 if(!f) {
289 PrintAndLog("Failed to read from file '%s'", filename);
290 return 1;
291 }
292
293 fseek(f, 0, SEEK_END);
294 long fsize = ftell(f);
295 fseek(f, 0, SEEK_SET);
296
7a616c0d 297 if (fsize < 0) {
298 PrintAndLog("Error, when getting filesize");
eb5b63b4 299 fclose(f);
7a616c0d 300 return 1;
301 }
1defcf60 302
7a616c0d 303 uint8_t *dump = malloc(fsize);
1defcf60 304
7781a656
MHS		 305 size_t bytes_read = fread(dump, 1, fsize, f);
306 fclose(f);
307
1defcf60 308 printIclassDumpInfo(dump);
7781a656
MHS		 309 //Validate
310
311 if (bytes_read < fsize)
312 {
313 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
314 free(dump);
315 return 1;
316 }
317 //Send to device
318 uint32_t bytes_sent = 0;
319 uint32_t bytes_remaining = bytes_read;
320
321 while(bytes_remaining > 0){
322 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
323 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
324 memcpy(c.d.asBytes, dump, bytes_in_packet);
325 SendCommand(&c);
326 bytes_remaining -= bytes_in_packet;
327 bytes_sent += bytes_in_packet;
328 }
329 free(dump);
330 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
331 return 0;
332}
333
4d68ec02 334static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
41524d8a
MHS		 335 FILE *f = fopen(filename, "rb");
336 if(!f) {
337 PrintAndLog("Failed to read from file '%s'", filename);
338 return 1;
339 }
340 fseek(f, 0, SEEK_END);
341 long fsize = ftell(f);
342 fseek(f, 0, SEEK_SET);
343 size_t bytes_read = fread(buffer, 1, len, f);
344 fclose(f);
345 if(fsize != len)
346 {
347 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
348 return 1;
349 }
350 if(bytes_read != len)
351 {
352 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
353 return 1;
354 }
355 return 0;
356}
357
4d68ec02 358int usage_hf_iclass_decrypt(void) {
359 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
aa53efc3 360 PrintAndLog("");
361 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
362 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
363 PrintAndLog("");
364 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
365 PrintAndLog("");
366 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
367 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
368 PrintAndLog("which is defined by the configuration block.");
369 return 1;
370}
371
4d68ec02 372int CmdHFiClassDecrypt(const char *Cmd) {
41524d8a
MHS		 373 uint8_t key[16] = { 0 };
374 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
375 {
376 usage_hf_iclass_decrypt();
377 return 1;
378 }
379 PrintAndLog("Decryption file found... ");
380 char opt = param_getchar(Cmd, 0);
381 if (strlen(Cmd)<1 || opt == 'h')
382 return usage_hf_iclass_decrypt();
383
384 //Open the tagdump-file
385 FILE *f;
386 char filename[FILE_PATH_SIZE];
874572d4 387 if(opt == 'f' && param_getstr(Cmd, 1, filename, sizeof(filename)) > 0) {
41524d8a 388 f = fopen(filename, "rb");
165e0775 389 if ( f == NULL ) {
390 PrintAndLog("Could not find file %s", filename);
391 return 1;
392 }
393 } else {
41524d8a
MHS		 394 return usage_hf_iclass_decrypt();
395 }
396
397 fseek(f, 0, SEEK_END);
398 long fsize = ftell(f);
399 fseek(f, 0, SEEK_SET);
400 uint8_t enc_dump[8] = {0};
401 uint8_t *decrypted = malloc(fsize);
402 des3_context ctx = { DES_DECRYPT ,{ 0 } };
403 des3_set2key_dec( &ctx, key);
404 size_t bytes_read = fread(enc_dump, 1, 8, f);
405
406 //Use the first block (CSN) for filename
407 char outfilename[FILE_PATH_SIZE] = { 0 };
408 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
409 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
410 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
411
412 size_t blocknum =0;
413 while(bytes_read == 8)
414 {
9a9bcea8 415 if(blocknum < 7)
41524d8a
MHS		 416 {
417 memcpy(decrypted+(blocknum*8), enc_dump, 8);
418 }else{
419 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
420 }
421 printvar("decrypted block", decrypted +(blocknum*8), 8);
422 bytes_read = fread(enc_dump, 1, 8, f);
423 blocknum++;
424 }
425 fclose(f);
426
427 saveFile(outfilename,"bin", decrypted, blocknum*8);
c4c3af7c 428 free(decrypted);
41524d8a
MHS		 429 return 0;
430}
7781a656 431
4d68ec02 432int usage_hf_iclass_encrypt(void) {
aa53efc3 433 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
434 PrintAndLog("");
435 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
436 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
437 PrintAndLog("");
438 PrintAndLog("example: hf iclass encrypt 0102030405060708");
439 PrintAndLog("");
440 return 0;
441}
442
4d68ec02 443static int iClassEncryptBlkData(uint8_t *blkData) {
aa53efc3 444 uint8_t key[16] = { 0 };
445 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
446 {
447 usage_hf_iclass_encrypt();
448 return 1;
449 }
450 PrintAndLog("Decryption file found... ");
53444513 451
4d68ec02 452 uint8_t encryptedData[16];
453 uint8_t *encrypted = encryptedData;
aa53efc3 454 des3_context ctx = { DES_DECRYPT ,{ 0 } };
455 des3_set2key_enc( &ctx, key);
456
4d68ec02 457 des3_crypt_ecb(&ctx, blkData,encrypted);
aa53efc3 458 //printvar("decrypted block", decrypted, 8);
4d68ec02 459 memcpy(blkData,encrypted,8);
aa53efc3 460
461 return 1;
462}
463
4d68ec02 464int CmdHFiClassEncryptBlk(const char *Cmd) {
aa53efc3 465 uint8_t blkData[8] = {0};
466 char opt = param_getchar(Cmd, 0);
467 if (strlen(Cmd)<1 || opt == 'h')
468 return usage_hf_iclass_encrypt();
53444513 469
aa53efc3 470 //get the bytes to encrypt
471 if (param_gethex(Cmd, 0, blkData, 16))
53444513 472 {
aa53efc3 473 PrintAndLog("BlockData must include 16 HEX symbols");
53444513
MHS		 474 return 0;
475 }
aa53efc3 476 if (!iClassEncryptBlkData(blkData)) return 0;
53444513 477
aa53efc3 478 printvar("encrypted block", blkData, 8);
479 return 1;
480}
53444513 481
4d68ec02 482void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
aa53efc3 483 uint8_t WB[9];
484 WB[0] = blockno;
485 memcpy(WB + 1,data,8);
486 doMAC_N(WB,sizeof(WB),div_key,MAC);
487 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
488}
53444513 489
4d68ec02 490static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
53444513
MHS		 491 UsbCommand resp;
492
aa53efc3 493 UsbCommand c = {CMD_READER_ICLASS, {0}};
3ac22ee1 494 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
aa53efc3 495 if (use_credit_key)
496 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
53444513 497
aa53efc3 498 clearCommandBuffer();
499 SendCommand(&c);
500 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
501 {
53444513 502 PrintAndLog("Command execute timeout");
aa53efc3 503 return false;
53444513
MHS		 504 }
505
aa53efc3 506 uint8_t isOK = resp.arg[0] & 0xff;
507 uint8_t *data = resp.d.asBytes;
53444513 508
aa53efc3 509 memcpy(CSN,data,8);
510 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
aa53efc3 511 if(isOK > 0)
512 {
513 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
53444513 514 }
aa53efc3 515 if(isOK <= 1){
516 PrintAndLog("Failed to obtain CC! Aborting");
517 return false;
518 }
519 return true;
a66fca86 520}
6f101995 521
bc37cfb3 522static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
aa53efc3 523 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
524 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
aa53efc3 525
526 if (!select_only(CSN, CCNR, use_credit_key, verbose))
527 return false;
528
4d68ec02 529 //get div_key
bc37cfb3
AL		 530 if(rawkey)
531 memcpy(div_key, KEY, 8);
532 else
533 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
534 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey ? "raw key" : "diversified key", div_key[0],div_key[1],div_key[2],div_key[3],div_key[4],div_key[5],div_key[6],div_key[7]);
4d68ec02 535
aa53efc3 536 doMAC(CCNR, div_key, MAC);
aa53efc3 537 UsbCommand resp;
538 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
539 memcpy(d.d.asBytes, MAC, 4);
540 clearCommandBuffer();
541 SendCommand(&d);
542 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
543 {
544 PrintAndLog("Auth Command execute timeout");
545 return false;
546 }
547 uint8_t isOK = resp.arg[0] & 0xff;
548 if (!isOK) {
549 PrintAndLog("Authentication error");
550 return false;
551 }
552 return true;
553}
554
4d68ec02 555int usage_hf_iclass_dump(void) {
bc37cfb3 556 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
aa53efc3 557 PrintAndLog("Options:");
558 PrintAndLog(" f <filename> : specify a filename to save dump to");
559 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
560 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
561 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
562 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
563 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
bc37cfb3 564 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
aa53efc3 565 PrintAndLog(" NOTE: * = required");
566 PrintAndLog("Samples:");
567 PrintAndLog(" hf iclass dump k 001122334455667B");
568 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
569 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
570 return 0;
571}
572
4d68ec02 573int CmdHFiClassReader_Dump(const char *Cmd) {
aa53efc3 574
575 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
576 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
577 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
578 uint8_t blockno = 0;
579 uint8_t numblks = 0;
4d68ec02 580 uint8_t maxBlk = 31;
bbd19bec 581 uint8_t app_areas = 1;
b82d8098 582 uint8_t kb = 2;
aa53efc3 583 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
584 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
585 uint8_t keyNbr = 0;
586 uint8_t dataLen = 0;
587 uint8_t fileNameLen = 0;
588 char filename[FILE_PATH_SIZE]={0};
589 char tempStr[50] = {0};
4d68ec02 590 bool have_debit_key = false;
aa53efc3 591 bool have_credit_key = false;
4d68ec02 592 bool use_credit_key = false;
aa53efc3 593 bool elite = false;
bc37cfb3 594 bool rawkey = false;
aa53efc3 595 bool errors = false;
596 uint8_t cmdp = 0;
597
598 while(param_getchar(Cmd, cmdp) != 0x00)
599 {
600 switch(param_getchar(Cmd, cmdp))
601 {
602 case 'h':
603 case 'H':
604 return usage_hf_iclass_dump();
605 case 'c':
606 case 'C':
607 have_credit_key = true;
874572d4 608 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
aa53efc3 609 if (dataLen == 16) {
610 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
611 } else if (dataLen == 1) {
612 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 613 if (keyNbr < ICLASS_KEYS_MAX) {
aa53efc3 614 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
615 } else {
616 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
617 errors = true;
618 }
619 } else {
620 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
621 errors = true;
622 }
623 cmdp += 2;
624 break;
625 case 'e':
626 case 'E':
627 elite = true;
628 cmdp++;
629 break;
630 case 'f':
631 case 'F':
874572d4 632 fileNameLen = param_getstr(Cmd, cmdp+1, filename, sizeof(filename));
aa53efc3 633 if (fileNameLen < 1) {
634 PrintAndLog("No filename found after f");
635 errors = true;
636 }
637 cmdp += 2;
638 break;
639 case 'k':
640 case 'K':
4d68ec02 641 have_debit_key = true;
874572d4 642 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
aa53efc3 643 if (dataLen == 16) {
644 errors = param_gethex(tempStr, 0, KEY, dataLen);
645 } else if (dataLen == 1) {
646 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 647 if (keyNbr < ICLASS_KEYS_MAX) {
aa53efc3 648 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
649 } else {
650 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
651 errors = true;
652 }
653 } else {
654 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
655 errors = true;
656 }
657 cmdp += 2;
658 break;
bc37cfb3
AL		 659 case 'r':
660 case 'R':
661 rawkey = true;
662 cmdp++;
663 break;
aa53efc3 664 default:
665 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
666 errors = true;
667 break;
668 }
669 if(errors) return usage_hf_iclass_dump();
670 }
671
672 if (cmdp < 2) return usage_hf_iclass_dump();
4d68ec02 673 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
674 if (!have_debit_key && have_credit_key) use_credit_key = true;
aa53efc3 675
676 //get config and first 3 blocks
677 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
678 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
679 UsbCommand resp;
680 uint8_t tag_data[255*8];
4d68ec02 681
aa53efc3 682 clearCommandBuffer();
683 SendCommand(&c);
4d68ec02 684 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
aa53efc3 685 PrintAndLog("Command execute timeout");
872337e0 686 DropField();
aa53efc3 687 return 0;
688 }
4d68ec02 689 uint8_t readStatus = resp.arg[0] & 0xff;
690 uint8_t *data = resp.d.asBytes;
691
692 if(readStatus == 0){
693 PrintAndLog("No tag found...");
872337e0 694 DropField();
4d68ec02 695 return 0;
696 }
697 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
698 memcpy(tag_data, data, 8*3);
699 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
700 numblks = data[8];
bbd19bec 701 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
b82d8098 702 // large memory - not able to dump pages currently
4d68ec02 703 if (numblks > maxBlk) numblks = maxBlk;
704 }
872337e0 705 DropField();
4d68ec02 706 // authenticate debit key and get div_key - later store in dump block 3
bc37cfb3 707 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
aa53efc3 708 //try twice - for some reason it sometimes fails the first time...
bc37cfb3 709 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, false)){
872337e0 710 DropField();
aa53efc3 711 return 0;
712 }
713 }
aa53efc3 714
4d68ec02 715 // begin dump
3ac22ee1 716 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
aa53efc3 717 clearCommandBuffer();
718 SendCommand(&w);
719 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
720 PrintAndLog("Command execute time-out 1");
872337e0 721 DropField();
aa53efc3 722 return 1;
723 }
724 uint32_t blocksRead = resp.arg[1];
725 uint8_t isOK = resp.arg[0] & 0xff;
726 if (!isOK && !blocksRead) {
727 PrintAndLog("Read Block Failed");
872337e0 728 DropField();
aa53efc3 729 return 0;
730 }
731 uint32_t startindex = resp.arg[2];
732 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
733 PrintAndLog("Data exceeded Buffer size!");
734 blocksRead = (sizeof(tag_data)/8) - blockno;
735 }
4d68ec02 736 // response ok - now get bigbuf content of the dump
aa53efc3 737 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
738 WaitForResponse(CMD_ACK,NULL);
4d68ec02 739 size_t gotBytes = blocksRead*8 + blockno*8;
aa53efc3 740
4d68ec02 741 // try AA2
742 if (have_credit_key) {
743 //turn off hf field before authenticating with different key
872337e0 744 DropField();
aa53efc3 745 memset(MAC,0,4);
4d68ec02 746 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
bc37cfb3 747 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
aa53efc3 748 //try twice - for some reason it sometimes fails the first time...
bc37cfb3 749 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false, false)){
872337e0 750 DropField();
aa53efc3 751 return 0;
752 }
753 }
4d68ec02 754 // do we still need to read more block? (aa2 enabled?)
755 if (maxBlk > blockno+numblks+1) {
756 // setup dump and start
757 w.arg[0] = blockno + blocksRead;
758 w.arg[1] = maxBlk - (blockno + blocksRead);
4d68ec02 759 clearCommandBuffer();
760 SendCommand(&w);
761 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
762 PrintAndLog("Command execute timeout 2");
872337e0 763 DropField();
4d68ec02 764 return 0;
765 }
766 uint8_t isOK = resp.arg[0] & 0xff;
767 blocksRead = resp.arg[1];
768 if (!isOK && !blocksRead) {
769 PrintAndLog("Read Block Failed 2");
872337e0 770 DropField();
4d68ec02 771 return 0;
772 }
aa53efc3 773
4d68ec02 774 startindex = resp.arg[2];
775 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
776 PrintAndLog("Data exceeded Buffer size!");
777 blocksRead = (sizeof(tag_data) - gotBytes)/8;
778 }
779 // get dumped data from bigbuf
780 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
781 WaitForResponse(CMD_ACK,NULL);
aa53efc3 782
4d68ec02 783 gotBytes += blocksRead*8;
784 } else { //field is still on - turn it off...
872337e0 785 DropField();
4d68ec02 786 }
aa53efc3 787 }
788
4d68ec02 789 // add diversified keys to dump
790 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
791 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
792 // print the dump
89696b8b 793 printf("------+--+-------------------------+\n");
794 printf("CSN |00| %s|\n",sprint_hex(tag_data, 8));
795 printIclassDumpContents(tag_data, 1, (gotBytes/8), gotBytes);
796
aa53efc3 797 if (filename[0] == 0){
798 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
799 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
800 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
801 }
4d68ec02 802
803 // save the dump to .bin file
aa53efc3 804 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
4d68ec02 805 saveFile(filename, "bin", tag_data, gotBytes);
aa53efc3 806 return 1;
807}
808
bc37cfb3 809static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
aa53efc3 810 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
811 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
bc37cfb3 812 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose))
aa53efc3 813 return 0;
814
815 UsbCommand resp;
816
817 Calc_wb_mac(blockno,bldata,div_key,MAC);
3ac22ee1 818 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
aa53efc3 819 memcpy(w.d.asBytes, bldata, 8);
3ac22ee1 820 memcpy(w.d.asBytes + 8, MAC, 4);
aa53efc3 821
822 clearCommandBuffer();
823 SendCommand(&w);
824 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
825 {
826 PrintAndLog("Write Command execute timeout");
827 return 0;
828 }
829 uint8_t isOK = resp.arg[0] & 0xff;
830 if (!isOK) {
831 PrintAndLog("Write Block Failed");
832 return 0;
833 }
834 PrintAndLog("Write Block Successful");
aa53efc3 835 return 1;
836}
837
4d68ec02 838int usage_hf_iclass_writeblock(void) {
aa53efc3 839 PrintAndLog("Options:");
840 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
841 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
842 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
843 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
844 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
bc37cfb3 845 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
aa53efc3 846 PrintAndLog("Samples:");
847 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
848 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
849 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
850 return 0;
851}
852
853int CmdHFiClass_WriteBlock(const char *Cmd) {
854 uint8_t blockno=0;
3ac22ee1 855 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
aa53efc3 856 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
857 uint8_t keyNbr = 0;
858 uint8_t dataLen = 0;
859 char tempStr[50] = {0};
860 bool use_credit_key = false;
861 bool elite = false;
bc37cfb3 862 bool rawkey= false;
aa53efc3 863 bool errors = false;
864 uint8_t cmdp = 0;
865 while(param_getchar(Cmd, cmdp) != 0x00)
866 {
867 switch(param_getchar(Cmd, cmdp))
868 {
869 case 'h':
870 case 'H':
871 return usage_hf_iclass_writeblock();
872 case 'b':
873 case 'B':
874 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
875 PrintAndLog("Block No must include 2 HEX symbols\n");
876 errors = true;
877 }
878 cmdp += 2;
879 break;
880 case 'c':
881 case 'C':
882 use_credit_key = true;
883 cmdp++;
884 break;
885 case 'd':
886 case 'D':
887 if (param_gethex(Cmd, cmdp+1, bldata, 16))
888 {
889 PrintAndLog("KEY must include 16 HEX symbols\n");
890 errors = true;
891 }
892 cmdp += 2;
893 break;
894 case 'e':
895 case 'E':
896 elite = true;
897 cmdp++;
898 break;
899 case 'k':
900 case 'K':
874572d4 901 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
aa53efc3 902 if (dataLen == 16) {
903 errors = param_gethex(tempStr, 0, KEY, dataLen);
904 } else if (dataLen == 1) {
905 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 906 if (keyNbr < ICLASS_KEYS_MAX) {
aa53efc3 907 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
908 } else {
909 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
910 errors = true;
911 }
912 } else {
913 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
914 errors = true;
915 }
916 cmdp += 2;
917 break;
bc37cfb3
AL		 918 case 'r':
919 case 'R':
920 rawkey = true;
921 cmdp++;
922 break;
aa53efc3 923 default:
924 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
925 errors = true;
926 break;
927 }
928 if(errors) return usage_hf_iclass_writeblock();
929 }
930
931 if (cmdp < 6) return usage_hf_iclass_writeblock();
bc37cfb3 932 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
872337e0 933 DropField();
3ac22ee1 934 return ans;
aa53efc3 935}
936
4d68ec02 937int usage_hf_iclass_clone(void) {
bc37cfb3 938 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
aa53efc3 939 PrintAndLog("Options:");
940 PrintAndLog(" f <filename>: specify a filename to clone from");
941 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
942 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
943 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
944 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
945 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
bc37cfb3 946 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
aa53efc3 947 PrintAndLog("Samples:");
948 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
949 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
950 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
951 return -1;
952}
953
954int CmdHFiClassCloneTag(const char *Cmd) {
165e0775 955 char filename[FILE_PATH_SIZE] = {0};
aa53efc3 956 char tempStr[50]={0};
957 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
958 uint8_t keyNbr = 0;
959 uint8_t fileNameLen = 0;
960 uint8_t startblock = 0;
961 uint8_t endblock = 0;
962 uint8_t dataLen = 0;
963 bool use_credit_key = false;
964 bool elite = false;
bc37cfb3 965 bool rawkey = false;
aa53efc3 966 bool errors = false;
967 uint8_t cmdp = 0;
968 while(param_getchar(Cmd, cmdp) != 0x00)
969 {
970 switch(param_getchar(Cmd, cmdp))
971 {
972 case 'h':
973 case 'H':
974 return usage_hf_iclass_clone();
975 case 'b':
976 case 'B':
977 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
978 PrintAndLog("Start Block No must include 2 HEX symbols\n");
979 errors = true;
980 }
981 cmdp += 2;
982 break;
983 case 'c':
984 case 'C':
985 use_credit_key = true;
986 cmdp++;
987 break;
988 case 'e':
989 case 'E':
990 elite = true;
991 cmdp++;
992 break;
993 case 'f':
994 case 'F':
874572d4 995 fileNameLen = param_getstr(Cmd, cmdp+1, filename, sizeof(filename));
aa53efc3 996 if (fileNameLen < 1) {
997 PrintAndLog("No filename found after f");
998 errors = true;
999 }
1000 cmdp += 2;
1001 break;
1002 case 'k':
1003 case 'K':
874572d4 1004 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
aa53efc3 1005 if (dataLen == 16) {
1006 errors = param_gethex(tempStr, 0, KEY, dataLen);
1007 } else if (dataLen == 1) {
1008 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 1009 if (keyNbr < ICLASS_KEYS_MAX) {
aa53efc3 1010 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1011 } else {
1012 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1013 errors = true;
1014 }
1015 } else {
1016 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1017 errors = true;
1018 }
1019 cmdp += 2;
1020 break;
1021 case 'l':
1022 case 'L':
1023 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
1024 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1025 errors = true;
1026 }
1027 cmdp += 2;
1028 break;
bc37cfb3
AL		 1029 case 'r':
1030 case 'R':
1031 rawkey = true;
1032 cmdp++;
1033 break;
aa53efc3 1034 default:
1035 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1036 errors = true;
1037 break;
1038 }
1039 if(errors) return usage_hf_iclass_clone();
1040 }
1041
1042 if (cmdp < 8) return usage_hf_iclass_clone();
1043
1044 FILE *f;
1045
1046 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1047
1048 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1049 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1050 }
1051 // file handling and reading
1052 f = fopen(filename,"rb");
1053 if(!f) {
1054 PrintAndLog("Failed to read from file '%s'", filename);
1055 return 1;
1056 }
1057
1058 if (startblock<5) {
1059 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
165e0775 1060 fclose(f);
aa53efc3 1061 return 0;
1062 }
1063 // now read data from the file from block 6 --- 19
1064 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1065 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1066 // else we have to create a share memory
1067 int i;
1068 fseek(f,startblock*8,SEEK_SET);
33c795d0 1069 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0 ) {
1070 PrintAndLog("File reading error.");
1071 fclose(f);
1072 return 2;
1073 }
aa53efc3 1074
1075 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1076 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1077
bc37cfb3 1078 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, true))
aa53efc3 1079 return 0;
1080
3ac22ee1 1081 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
aa53efc3 1082 uint8_t *ptr;
1083 // calculate all mac for every the block we will write
1084 for (i = startblock; i <= endblock; i++){
1085 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1086 // usb command d start pointer = d + (i - 6) * 12
1087 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1088 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1089 // next one
1090 ptr = w.d.asBytes + (i - startblock) * 12;
1091 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1092 memcpy(ptr + 8,MAC, 4);
1093 }
1094 uint8_t p[12];
1095 for (i = 0; i <= endblock - startblock;i++){
1096 memcpy(p,w.d.asBytes + (i * 12),12);
4d68ec02 1097 printf("Block |%02x|",i + startblock);
1098 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1099 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
aa53efc3 1100 }
1101 UsbCommand resp;
1102 SendCommand(&w);
1103 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1104 {
1105 PrintAndLog("Command execute timeout");
1106 return 0;
1107 }
1108 return 1;
1109}
1110
67e344df 1111static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose, bool auth) {
aa53efc3 1112 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1113 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1114
67e344df 1115 if (auth) {
1116 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose))
1117 return 0;
1118 } else {
1119 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1120 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1121 if (!select_only(CSN, CCNR, (keyType==0x18), verbose))
1122 return 0;
1123 }
aa53efc3 1124
1125 UsbCommand resp;
3ac22ee1 1126 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
aa53efc3 1127 clearCommandBuffer();
1128 SendCommand(&w);
1129 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1130 {
1131 PrintAndLog("Command execute timeout");
1132 return 0;
1133 }
1134 uint8_t isOK = resp.arg[0] & 0xff;
1135 if (!isOK) {
1136 PrintAndLog("Read Block Failed");
1137 return 0;
1138 }
1139 //data read is stored in: resp.d.asBytes[0-15]
1140 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1141 return 1;
1142}
1143
4d68ec02 1144int usage_hf_iclass_readblock(void) {
bc37cfb3 1145 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
aa53efc3 1146 PrintAndLog("Options:");
1147 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1148 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1149 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1150 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
bc37cfb3 1151 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
aa53efc3 1152 PrintAndLog("Samples:");
1153 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1154 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1155 PrintAndLog(" hf iclass readblk b 0A k 0");
1156 return 0;
1157}
1158
4d68ec02 1159int CmdHFiClass_ReadBlock(const char *Cmd) {
aa53efc3 1160 uint8_t blockno=0;
1161 uint8_t keyType = 0x88; //debit key
1162 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1163 uint8_t keyNbr = 0;
1164 uint8_t dataLen = 0;
1165 char tempStr[50] = {0};
1166 bool elite = false;
bc37cfb3 1167 bool rawkey = false;
aa53efc3 1168 bool errors = false;
67e344df 1169 bool auth = false;
aa53efc3 1170 uint8_t cmdp = 0;
1171 while(param_getchar(Cmd, cmdp) != 0x00)
1172 {
1173 switch(param_getchar(Cmd, cmdp))
1174 {
1175 case 'h':
1176 case 'H':
1177 return usage_hf_iclass_readblock();
1178 case 'b':
1179 case 'B':
1180 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1181 PrintAndLog("Block No must include 2 HEX symbols\n");
1182 errors = true;
1183 }
1184 cmdp += 2;
1185 break;
1186 case 'c':
1187 case 'C':
1188 keyType = 0x18;
1189 cmdp++;
1190 break;
1191 case 'e':
1192 case 'E':
1193 elite = true;
1194 cmdp++;
1195 break;
1196 case 'k':
1197 case 'K':
67e344df 1198 auth = true;
874572d4 1199 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
aa53efc3 1200 if (dataLen == 16) {
1201 errors = param_gethex(tempStr, 0, KEY, dataLen);
1202 } else if (dataLen == 1) {
1203 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 1204 if (keyNbr < ICLASS_KEYS_MAX) {
aa53efc3 1205 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1206 } else {
1207 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1208 errors = true;
1209 }
1210 } else {
1211 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1212 errors = true;
1213 }
1214 cmdp += 2;
1215 break;
bc37cfb3
AL		 1216 case 'r':
1217 case 'R':
1218 rawkey = true;
1219 cmdp++;
1220 break;
aa53efc3 1221 default:
1222 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1223 errors = true;
1224 break;
1225 }
1226 if(errors) return usage_hf_iclass_readblock();
1227 }
1228
67e344df 1229 if (cmdp < 2) return usage_hf_iclass_readblock();
1230 if (!auth)
1231 PrintAndLog("warning: no authentication used with read, only a few specific blocks can be read accurately without authentication.");
1232 return ReadBlock(KEY, blockno, keyType, elite, rawkey, true, auth);
aa53efc3 1233}
1234
4d68ec02 1235int CmdHFiClass_loclass(const char *Cmd) {
aa53efc3 1236 char opt = param_getchar(Cmd, 0);
1237
1238 if (strlen(Cmd)<1 || opt == 'h') {
1239 PrintAndLog("Usage: hf iclass loclass [options]");
1240 PrintAndLog("Options:");
1241 PrintAndLog("h Show this help");
6f101995
MHS		 1242 PrintAndLog("t Perform self-test");
1243 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1244 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1245 PrintAndLog(" malicious CSNs, and their protocol responses");
b8140ab1 1246 PrintAndLog(" The binary format of the file is expected to be as follows: ");
6f101995
MHS		 1247 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1248 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1249 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1250 PrintAndLog(" ... totalling N*24 bytes");
1251 return 0;
1252 }
1253 char fileName[255] = {0};
1254 if(opt == 'f')
1255 {
874572d4 1256 if(param_getstr(Cmd, 1, fileName, sizeof(fileName)) > 0)
53444513
MHS		 1257 {
1258 return bruteforceFileNoKeys(fileName);
1259 }else
1260 {
1261 PrintAndLog("You must specify a filename");
1262 }
6f101995
MHS		 1263 }
1264 else if(opt == 't')
1265 {
1266 int errors = testCipherUtils();
1267 errors += testMAC();
1268 errors += doKeyTests(0);
1269 errors += testElite();
1270 if(errors)
1271 {
1272 prnlog("OBS! There were errors!!!");
1273 }
1274 return errors;
1275 }
a66fca86 1276
6f101995
MHS		 1277 return 0;
1278}
c3963755 1279
4d68ec02 1280void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
aa53efc3 1281 uint8_t mem_config;
1282 memcpy(&mem_config, iclass_dump + 13,1);
1283 uint8_t maxmemcount;
1284 uint8_t filemaxblock = filesize / 8;
4d68ec02 1285 if (mem_config & 0x80)
aa53efc3 1286 maxmemcount = 255;
1287 else
4d68ec02 1288 maxmemcount = 31;
1289 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
aa53efc3 1290
1291 if (startblock == 0)
1292 startblock = 6;
1293 if ((endblock > maxmemcount) || (endblock == 0))
1294 endblock = maxmemcount;
89696b8b 1295
1296 // remember endblock need to relate to zero-index arrays.
1297 if (endblock > filemaxblock-1)
aa53efc3 1298 endblock = filemaxblock;
89696b8b 1299
aa53efc3 1300 int i = startblock;
89696b8b 1301 printf("------+--+-------------------------+\n");
1302 while (i <= endblock) {
1303 uint8_t *blk = iclass_dump + (i * 8);
1304 printf("Block |%02X| %s|\n", i, sprint_hex(blk, 8) );
aa53efc3 1305 i++;
1306 }
89696b8b 1307 printf("------+--+-------------------------+\n");
aa53efc3 1308}
1309
4d68ec02 1310int usage_hf_iclass_readtagfile() {
1311 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1312 return 1;
1313}
1314
1315int CmdHFiClassReadTagFile(const char *Cmd) {
aa53efc3 1316 int startblock = 0;
1317 int endblock = 0;
1318 char tempnum[5];
1319 FILE *f;
1320 char filename[FILE_PATH_SIZE];
874572d4 1321 if (param_getstr(Cmd, 0, filename, sizeof(filename)) < 1)
aa53efc3 1322 return usage_hf_iclass_readtagfile();
874572d4 1323 if (param_getstr(Cmd, 1, tempnum, sizeof(tempnum)) < 1)
aa53efc3 1324 startblock = 0;
1325 else
1326 sscanf(tempnum,"%d",&startblock);
1327
874572d4 1328 if (param_getstr(Cmd,2, tempnum, sizeof(tempnum)) < 1)
aa53efc3 1329 endblock = 0;
1330 else
1331 sscanf(tempnum,"%d",&endblock);
1332 // file handling and reading
1333 f = fopen(filename,"rb");
1334 if(!f) {
1335 PrintAndLog("Failed to read from file '%s'", filename);
1336 return 1;
1337 }
1338 fseek(f, 0, SEEK_END);
1339 long fsize = ftell(f);
1340 fseek(f, 0, SEEK_SET);
1341
b0c68b72 1342 if ( fsize < 0 ) {
1343 PrintAndLog("Error, when getting filesize");
1344 fclose(f);
1345 return 1;
1346 }
aa53efc3 1347
b0c68b72 1348 uint8_t *dump = malloc(fsize);
aa53efc3 1349
1350 size_t bytes_read = fread(dump, 1, fsize, f);
1351 fclose(f);
1352 uint8_t *csn = dump;
89696b8b 1353 printf("------+--+-------------------------+\n");
1354 printf("CSN |00| %s|\n", sprint_hex(csn, 8) );
aa53efc3 1355 // printIclassDumpInfo(dump);
1356 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1357 free(dump);
1358 return 0;
1359}
1360
4d68ec02 1361/*
1362uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
aa53efc3 1363 uint64_t new_div = 0x00;
1364 new_div ^= sdiv;
1365 new_div ^= hdiv;
1366 return new_div;
1367}
1368
4d68ec02 1369uint64_t hexarray_to_uint64(uint8_t *key) {
aa53efc3 1370 char temp[17];
1371 uint64_t uint_key;
1372 for (int i = 0;i < 8;i++)
1373 sprintf(&temp[(i *2)],"%02X",key[i]);
1374 temp[16] = '\0';
43534cba 1375 if (sscanf(temp,"%016" SCNx64,&uint_key) < 1)
aa53efc3 1376 return 0;
1377 return uint_key;
1378}
4d68ec02 1379*/
1380void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
aa53efc3 1381 uint8_t keytable[128] = {0};
1382 uint8_t key_index[8] = {0};
4d68ec02 1383 if (elite) {
1384 uint8_t key_sel[8] = { 0 };
1385 uint8_t key_sel_p[8] = { 0 };
1386 hash2(KEY, keytable);
1387 hash1(CSN, key_index);
1388 for(uint8_t i = 0; i < 8 ; i++)
1389 key_sel[i] = keytable[key_index[i]] & 0xFF;
aa53efc3 1390
4d68ec02 1391 //Permute from iclass format to standard format
1392 permutekey_rev(key_sel, key_sel_p);
1393 diversifyKey(CSN, key_sel_p, div_key);
1394 } else {
1395 diversifyKey(CSN, KEY, div_key);
1396 }
1397}
aa53efc3 1398
4d68ec02 1399//when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1400//calculate and return xor_div_key (ready for a key write command)
1401//print all div_keys if verbose
1402static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1403 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1404 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1405 //get old div key
1406 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1407 //get new div key
1408 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1409
1410 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1411 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1412 }
1413 if (verbose) {
1414 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1415 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1416 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1417 }
1418}
aa53efc3 1419
4d68ec02 1420int usage_hf_iclass_calc_newkey(void) {
1421 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1422 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1423 PrintAndLog(" Options:");
1424 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1425 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1426 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1427 PrintAndLog(" e : specify new key as elite calc");
1428 PrintAndLog(" ee : specify old and new key as elite calc");
1429 PrintAndLog("Samples:");
1430 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1431 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1432 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1433 PrintAndLog("NOTE: * = required\n");
aa53efc3 1434
4d68ec02 1435 return 1;
1436}
aa53efc3 1437
4d68ec02 1438int CmdHFiClassCalcNewKey(const char *Cmd) {
1439 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1440 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1441 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1442 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1443 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1444 uint8_t keyNbr = 0;
1445 uint8_t dataLen = 0;
1446 char tempStr[50] = {0};
1447 bool givenCSN = false;
1448 bool oldElite = false;
1449 bool elite = false;
1450 bool errors = false;
1451 uint8_t cmdp = 0;
1452 while(param_getchar(Cmd, cmdp) != 0x00)
1453 {
1454 switch(param_getchar(Cmd, cmdp))
1455 {
1456 case 'h':
1457 case 'H':
1458 return usage_hf_iclass_calc_newkey();
1459 case 'e':
1460 case 'E':
874572d4 1461 dataLen = param_getstr(Cmd, cmdp, tempStr, sizeof(tempStr));
4d68ec02 1462 if (dataLen==2)
1463 oldElite = true;
1464 elite = true;
1465 cmdp++;
1466 break;
1467 case 'n':
1468 case 'N':
874572d4 1469 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
4d68ec02 1470 if (dataLen == 16) {
1471 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1472 } else if (dataLen == 1) {
1473 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 1474 if (keyNbr < ICLASS_KEYS_MAX) {
4d68ec02 1475 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1476 } else {
1477 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1478 errors = true;
1479 }
1480 } else {
1481 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1482 errors = true;
1483 }
1484 cmdp += 2;
1485 break;
1486 case 'o':
1487 case 'O':
874572d4 1488 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
4d68ec02 1489 if (dataLen == 16) {
1490 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1491 } else if (dataLen == 1) {
1492 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 1493 if (keyNbr < ICLASS_KEYS_MAX) {
4d68ec02 1494 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1495 } else {
1496 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1497 errors = true;
1498 }
1499 } else {
1500 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1501 errors = true;
1502 }
1503 cmdp += 2;
1504 break;
1505 case 's':
1506 case 'S':
1507 givenCSN = true;
1508 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1509 return usage_hf_iclass_calc_newkey();
1510 cmdp += 2;
1511 break;
1512 default:
1513 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1514 errors = true;
1515 break;
1516 }
1517 if(errors) return usage_hf_iclass_calc_newkey();
1518 }
aa53efc3 1519
4d68ec02 1520 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
aa53efc3 1521
4d68ec02 1522 if (!givenCSN)
1523 if (!select_only(CSN, CCNR, false, true))
1524 return 0;
1525
1526 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
aa53efc3 1527 return 0;
1528}
1529
4d68ec02 1530static int loadKeys(char *filename) {
aa53efc3 1531 FILE *f;
1532 f = fopen(filename,"rb");
1533 if(!f) {
1534 PrintAndLog("Failed to read from file '%s'", filename);
1535 return 0;
1536 }
1537 fseek(f, 0, SEEK_END);
1538 long fsize = ftell(f);
1539 fseek(f, 0, SEEK_SET);
1540
eb5b63b4 1541 if ( fsize < 0 ) {
1542 PrintAndLog("Error, when getting filesize");
1543 fclose(f);
1544 return 1;
1545 }
1546
aa53efc3 1547 uint8_t *dump = malloc(fsize);
1548
1549 size_t bytes_read = fread(dump, 1, fsize, f);
1550 fclose(f);
1551 if (bytes_read > ICLASS_KEYS_MAX * 8){
1552 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1553 free(dump);
1554 return 0;
1555 }
1556 uint8_t i = 0;
1557 for (; i < bytes_read/8; i++){
1558 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1559 }
1560 free(dump);
1561 PrintAndLog("%u keys loaded", i);
1562 return 1;
1563}
1564
4d68ec02 1565static int saveKeys(char *filename) {
aa53efc3 1566 FILE *f;
1567 f = fopen(filename,"wb");
1568 if (f == NULL) {
1569 printf("error opening file %s\n",filename);
1570 return 0;
1571 }
1572 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1573 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1574 PrintAndLog("save key failed to write to file: %s", filename);
1575 break;
1576 }
1577 }
1578 fclose(f);
1579 return 0;
1580}
1581
4d68ec02 1582static int printKeys(void) {
aa53efc3 1583 PrintAndLog("");
1584 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1585 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1586 }
1587 PrintAndLog("");
1588 return 0;
1589}
1590
4d68ec02 1591int usage_hf_iclass_managekeys(void) {
aa53efc3 1592 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1593 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1594 PrintAndLog(" Options:");
1595 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1596 PrintAndLog(" k <key> : set a key in memory");
1597 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1598 PrintAndLog(" s : save keys in memory to file specified by filename");
1599 PrintAndLog(" l : load keys to memory from file specified by filename");
1600 PrintAndLog(" p : print keys loaded into memory\n");
1601 PrintAndLog("Samples:");
1602 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1603 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1604 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1605 PrintAndLog(" print keys : hf iclass managekeys p\n");
1606 return 0;
1607}
1608
4d68ec02 1609int CmdHFiClassManageKeys(const char *Cmd) {
aa53efc3 1610 uint8_t keyNbr = 0;
1611 uint8_t dataLen = 0;
1612 uint8_t KEY[8] = {0};
1613 char filename[FILE_PATH_SIZE];
1614 uint8_t fileNameLen = 0;
1615 bool errors = false;
1616 uint8_t operation = 0;
1617 char tempStr[20];
1618 uint8_t cmdp = 0;
1619
1620 while(param_getchar(Cmd, cmdp) != 0x00)
1621 {
1622 switch(param_getchar(Cmd, cmdp))
1623 {
1624 case 'h':
1625 case 'H':
1626 return usage_hf_iclass_managekeys();
1627 case 'f':
1628 case 'F':
874572d4 1629 fileNameLen = param_getstr(Cmd, cmdp+1, filename, sizeof(filename));
aa53efc3 1630 if (fileNameLen < 1) {
1631 PrintAndLog("No filename found after f");
1632 errors = true;
1633 }
1634 cmdp += 2;
1635 break;
1636 case 'n':
1637 case 'N':
1638 keyNbr = param_get8(Cmd, cmdp+1);
b0c68b72 1639 if (keyNbr >= ICLASS_KEYS_MAX) {
1640 PrintAndLog("Invalid block number");
aa53efc3 1641 errors = true;
1642 }
1643 cmdp += 2;
1644 break;
1645 case 'k':
1646 case 'K':
1647 operation += 3; //set key
874572d4 1648 dataLen = param_getstr(Cmd, cmdp+1, tempStr, sizeof(tempStr));
aa53efc3 1649 if (dataLen == 16) { //ul-c or ev1/ntag key length
1650 errors = param_gethex(tempStr, 0, KEY, dataLen);
1651 } else {
1652 PrintAndLog("\nERROR: Key is incorrect length\n");
1653 errors = true;
1654 }
1655 cmdp += 2;
1656 break;
1657 case 'p':
1658 case 'P':
1659 operation += 4; //print keys in memory
1660 cmdp++;
1661 break;
1662 case 'l':
1663 case 'L':
1664 operation += 5; //load keys from file
1665 cmdp++;
1666 break;
1667 case 's':
1668 case 'S':
1669 operation += 6; //save keys to file
1670 cmdp++;
1671 break;
1672 default:
1673 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1674 errors = true;
1675 break;
1676 }
1677 if(errors) return usage_hf_iclass_managekeys();
1678 }
1679 if (operation == 0){
1680 PrintAndLog("no operation specified (load, save, or print)\n");
1681 return usage_hf_iclass_managekeys();
1682 }
1683 if (operation > 6){
1684 PrintAndLog("Too many operations specified\n");
1685 return usage_hf_iclass_managekeys();
1686 }
1687 if (operation > 4 && fileNameLen == 0){
1688 PrintAndLog("You must enter a filename when loading or saving\n");
1689 return usage_hf_iclass_managekeys();
1690 }
1691
1692 switch (operation){
1693 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1694 case 4: return printKeys();
1695 case 5: return loadKeys(filename);
1696 case 6: return saveKeys(filename);
1697 break;
1698 }
1699 return 0;
1700}
1701
cee5a30d 1702static command_t CommandTable[] =
1703{
aa53efc3 1704 {"help", CmdHelp, 1, "This help"},
4d68ec02 1705 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1706 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1707 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1708 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1709 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1710 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1711 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1712 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1713 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1714 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
979c7655 1715 {"reader", CmdHFiClassReader, 0, " Look for iClass tags until a key or the pm3 button is pressed"},
4d68ec02 1716 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1717 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1718 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1719 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1720 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
6f101995 1721 {NULL, NULL, 0, NULL}
cee5a30d 1722};
1723
1724int CmdHFiClass(const char *Cmd)
1725{
53444513
MHS		 1726 CmdsParse(CommandTable, Cmd);
1727 return 0;
cee5a30d 1728}
1729
1730int CmdHelp(const char *Cmd)
1731{
53444513
MHS		 1732 CmdsHelp(CommandTable);
1733 return 0;
cee5a30d 1734}
Proxmark3 GIT tracking
Impressum, Datenschutz