]> cvs.zerfleddert.de Git - proxmark3-svn/blame_incremental - client/cmdhfmfdes.c
LF t55xx and LF em4x commands now should manchester decode data. However t55xx...
[proxmark3-svn] / client / cmdhfmfdes.c
... / ...
CommitLineData
1//-----------------------------------------------------------------------------
2// Copyright (C) 2014 Iceman
3//
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,
5// at your option, any later version. See the LICENSE.txt file for the text of
6// the license.
7//-----------------------------------------------------------------------------
8// High frequency MIFARE Desfire commands
9//-----------------------------------------------------------------------------
10
11#include <stdio.h>
12#include <stdlib.h>
13#include <string.h>
14#include <ctype.h>
15#include <openssl/des.h>
16#include "cmdmain.h"
17#include "proxmark3.h"
18#include "../include/common.h"
19#include "../include/mifare.h"
20#include "../common/iso14443crc.h"
21#include "data.h"
22#include "ui.h"
23#include "cmdparser.h"
24#include "util.h"
25#include "cmdhfmfdes.h"
26
27
28uint8_t key_zero_data[16] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
29uint8_t key_defa_data[16] = { 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f };
30uint8_t key_ones_data[16] = { 0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01 };
31
32
33static int CmdHelp(const char *Cmd);
34static void xor(unsigned char * dst, unsigned char * src, size_t len);
35static int32_t le24toh (uint8_t data[3]);
36
37
38int CmdHF14ADesWb(const char *Cmd)
39{
40/* uint8_t blockNo = 0;
41 uint8_t keyType = 0;
42 uint8_t key[6] = {0, 0, 0, 0, 0, 0};
43 uint8_t bldata[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
44
45 char cmdp = 0x00;
46
47 if (strlen(Cmd)<3) {
48 PrintAndLog("Usage: hf mf wrbl <block number> <key A/B> <key (12 hex symbols)> <block data (32 hex symbols)>");
49 PrintAndLog(" sample: hf mf wrbl 0 A FFFFFFFFFFFF 000102030405060708090A0B0C0D0E0F");
50 return 0;
51 }
52
53 blockNo = param_get8(Cmd, 0);
54 cmdp = param_getchar(Cmd, 1);
55 if (cmdp == 0x00) {
56 PrintAndLog("Key type must be A or B");
57 return 1;
58 }
59 if (cmdp != 'A' && cmdp != 'a') keyType = 1;
60 if (param_gethex(Cmd, 2, key, 12)) {
61 PrintAndLog("Key must include 12 HEX symbols");
62 return 1;
63 }
64 if (param_gethex(Cmd, 3, bldata, 32)) {
65 PrintAndLog("Block data must include 32 HEX symbols");
66 return 1;
67 }
68 PrintAndLog("--block no:%02x key type:%02x key:%s", blockNo, keyType, sprint_hex(key, 6));
69 PrintAndLog("--data: %s", sprint_hex(bldata, 16));
70
71 UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};
72 memcpy(c.d.asBytes, key, 6);
73 memcpy(c.d.asBytes + 10, bldata, 16);
74 SendCommand(&c);
75
76 UsbCommand resp;
77 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
78 uint8_t isOK = resp.arg[0] & 0xff;
79 PrintAndLog("isOk:%02x", isOK);
80 } else {
81 PrintAndLog("Command execute timeout");
82 }
83 */
84 return 0;
85}
86
87int CmdHF14ADesRb(const char *Cmd)
88{
89 // uint8_t blockNo = 0;
90 // uint8_t keyType = 0;
91 // uint8_t key[6] = {0, 0, 0, 0, 0, 0};
92
93 // char cmdp = 0x00;
94
95
96 // if (strlen(Cmd)<3) {
97 // PrintAndLog("Usage: hf mf rdbl <block number> <key A/B> <key (12 hex symbols)>");
98 // PrintAndLog(" sample: hf mf rdbl 0 A FFFFFFFFFFFF ");
99 // return 0;
100 // }
101
102 // blockNo = param_get8(Cmd, 0);
103 // cmdp = param_getchar(Cmd, 1);
104 // if (cmdp == 0x00) {
105 // PrintAndLog("Key type must be A or B");
106 // return 1;
107 // }
108 // if (cmdp != 'A' && cmdp != 'a') keyType = 1;
109 // if (param_gethex(Cmd, 2, key, 12)) {
110 // PrintAndLog("Key must include 12 HEX symbols");
111 // return 1;
112 // }
113 // PrintAndLog("--block no:%02x key type:%02x key:%s ", blockNo, keyType, sprint_hex(key, 6));
114
115 // UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};
116 // memcpy(c.d.asBytes, key, 6);
117 // SendCommand(&c);
118
119 // UsbCommand resp;
120 // if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
121 // uint8_t isOK = resp.arg[0] & 0xff;
122 // uint8_t * data = resp.d.asBytes;
123
124 // if (isOK)
125 // PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 16));
126 // else
127 // PrintAndLog("isOk:%02x", isOK);
128 // } else {
129 // PrintAndLog("Command execute timeout");
130 // }
131
132 return 0;
133}
134
135int CmdHF14ADesInfo(const char *Cmd){
136
137 UsbCommand c = {CMD_MIFARE_DESFIRE_INFO, { 0x00 }};
138
139 SendCommand(&c);
140 UsbCommand resp;
141
142 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
143 uint8_t isOK = resp.arg[0] & 0xff;
144 PrintAndLog("isOk:%02x", isOK);
145 } else {
146 PrintAndLog("Command execute timeout");
147 return 0;
148 }
149
150 PrintAndLog("---Desfire Information---------------------------------------");
151 PrintAndLog("-------------------------------------------------------------");
152 PrintAndLog(" UID : %s",sprint_hex(resp.d.asBytes, 7));
153 PrintAndLog(" Batch number : %s",sprint_hex(resp.d.asBytes+28,5));
154 PrintAndLog(" Production date : week %02x, 20%02x",resp.d.asBytes[33], resp.d.asBytes[34]);
155 PrintAndLog("-------------------------------------------------------------");
156 PrintAndLog(" Hardware Information");
157 PrintAndLog(" Vendor Id : %s", GetVendorStr(resp.d.asBytes[7]));
158 PrintAndLog(" Type : 0x%02X",resp.d.asBytes[8]);
159 PrintAndLog(" Subtype : 0x%02X",resp.d.asBytes[9]);
160 PrintAndLog(" Version : %d.%d",resp.d.asBytes[10], resp.d.asBytes[11]);
161 PrintAndLog(" Storage size : %s",GetCardSizeStr(resp.d.asBytes[12]));
162 PrintAndLog(" Protocol : %s",GetProtocolStr(resp.d.asBytes[13]));
163 PrintAndLog("-------------------------------------------------------------");
164 PrintAndLog(" Software Information");
165 PrintAndLog(" Vendor Id : %s",GetVendorStr(resp.d.asBytes[14]));
166 PrintAndLog(" Type : 0x%02X",resp.d.asBytes[15]);
167 PrintAndLog(" Subtype : 0x%02X",resp.d.asBytes[16]);
168 PrintAndLog(" Version : %d.%d",resp.d.asBytes[17], resp.d.asBytes[18]);
169 PrintAndLog(" storage size : %s", GetCardSizeStr(resp.d.asBytes[19]));
170 PrintAndLog(" Protocol : %s", GetProtocolStr(resp.d.asBytes[20]));
171 PrintAndLog("-------------------------------------------------------------");
172
173 PrintAndLog(" Master Key settings");
174 if ( resp.d.asBytes[35] & (1 << 3 ) )
175 PrintAndLog(" 0x08 Configuration changeable;");
176 else
177 PrintAndLog(" 0x08 Configuration NOT changeable;");
178
179 if ( resp.d.asBytes[35] & (1 << 2 ) )
180 PrintAndLog(" 0x04 PICC Master Key not required for create / delete;");
181 else
182 PrintAndLog(" 0x04 PICC Master Key required for create / delete;");
183
184 if ( resp.d.asBytes[35] & (1 << 1 ) )
185 PrintAndLog(" 0x02 Free directory list access without PICC Master Key;");
186 else
187 PrintAndLog(" 0x02 Directory list access with PICC Master Key;");
188
189 if ( resp.d.asBytes[35] & (1 << 0 ) )
190 PrintAndLog(" 0x01 Allow changing the Master Key;");
191 else
192 PrintAndLog(" 0x01 Master Key is not changeable anymore;");
193
194 PrintAndLog("");
195 PrintAndLog(" Max number of keys : %d", resp.d.asBytes[36]);
196 PrintAndLog(" Master key Version : %d (0x%02x)", resp.d.asBytes[37], resp.d.asBytes[37]);
197 PrintAndLog("-------------------------------------------------------------");
198
199 uint8_t tmp[3];
200 memcpy(tmp, resp.d.asBytes+38,3);
201
202 PrintAndLog(" Free memory on card : %d bytes", le24toh( tmp ));
203 PrintAndLog("-------------------------------------------------------------");
204 /*
205 Card Master key (CMK) 0x00 on AID = 00 00 00 (card level)
206 0x1
207
208 Application Master Key (AMK) 0x00 on AID != 00 00 00
209 Application keys (APK) = 0x01-0x0D
210 Application free = 0x0E
211 Application never = 0x0F
212
213 ACCESS RIGHTS:
214 keys 0,1,2,3 C
215 keys 4,5,6,7 RW
216 keys 8,9,10,11 W
217 keys 12,13,14,15 R
218
219 KEY Versioning.
220 Se GetKeyVersion (samma nyckel kan ha olika versionen?)
221
222 Session key:
223 16 : RndA(byte0-byte3) + RndB(byte0-byte3) + RndA(byte4-byte7) + RndB(byte4-byte7)
224 8 : RndA(byte0-byte3) + RndB(byte0-byte3)
225
226 AES 16 : RndA(byte0-byte3) + RndB(byte0-byte3) + RndA(byte12-byte15) + RndB(byte12-byte15)
227 */
228
229 PrintAndLog(" RX :%s",sprint_hex(resp.d.asBytes, 40));
230 return 1;
231}
232
233char * GetVendorStr( uint8_t id){
234 static char buf[30];
235 char *retStr = buf;
236
237 if ( id == 0x04 )
238 sprintf(retStr, "0x%02X (NXP)",id);
239 else
240 sprintf(retStr,"0x%02X (Unknown)",id);
241 return buf;
242}
243
244/*
245 The 7 MSBits (= n) code the storage size itself based on 2^n,
246 the LSBit is set to '0' if the size is exactly 2^n
247 and set to '1' if the storage size is between 2^n and 2^(n+1).
248 For this version of DESFire the 7 MSBits are set to 0x0C (2^12 = 4096) and the LSBit is '0'.
249*/
250char * GetCardSizeStr( uint8_t fsize ){
251
252 static char buf[30];
253 char *retStr = buf;
254
255 uint16_t usize = 1 << ((fsize >>1) + 1);
256 uint16_t lsize = 1 << (fsize >>1);
257
258 // is LSB set?
259 if ( fsize & (1 << 0 ) )
260 sprintf(retStr, "0x%02X (%d - %d bytes)",fsize, usize, lsize);
261 else
262 sprintf(retStr, "0x%02X (%d bytes)", fsize, lsize);
263 return buf;
264}
265
266char * GetProtocolStr(uint8_t id){
267
268 static char buf[30];
269 char *retStr = buf;
270
271 if ( id == 0x05)
272 sprintf(retStr,"0x%02X (ISO 14443-3, 14443-4)", id);
273 else
274 sprintf(retStr,"0x%02X", id);
275 return buf;
276}
277
278int CmdHF14ADesEnumApplications(const char *Cmd){
279 return 1;
280}
281
282int CmdHF14ADesNonces(const char *Cmd){
283 return 1;
284}
285
286//
287// MIAFRE DesFire Authentication
288//
289#define BUFSIZE 64
290int CmdHF14ADesAuth(const char *Cmd){
291
292 // NR DESC KEYLENGHT
293 // ------------------------
294 // 1 = DES 8
295 // 2 = 3DES 16
296 // 3 = 3K 3DES 24
297 // 4 = AES 16
298
299 // AUTHENTICTION MODES:
300 // 1 Normal
301 // 2 ISO
302 // 3 AES
303
304 uint8_t keylength = 8;
305 //unsigned char testinput[] = { 0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xdd,0xee,0xff,0x00};
306 unsigned char key[24]; // = { 0x75,0x28,0x78,0x39,0x74,0x93,0xCB,0x70};
307
308 if (strlen(Cmd)<3) {
309 PrintAndLog("Usage: hf mfdes auth <1|2|3> <1|2|3|4> <keyno> <key> ");
310 PrintAndLog(" AUTH modes 1 = normal, 2 = iso, 3 = aes");
311 PrintAndLog(" Crypto: 1 = DES 2 = 3DES 3 = 3K3DES 4 = AES");
312 PrintAndLog(" keynumber");
313 PrintAndLog(" sample: hf mfdes auth 1 1 0 11223344");
314 return 0;
315 }
316 uint8_t cmdAuthMode = param_get8(Cmd,0);
317 uint8_t cmdAuthAlgo = param_get8(Cmd,1);
318 uint8_t cmdKeyNo = param_get8(Cmd,2);
319
320 switch (cmdAuthMode)
321 {
322 case 1:
323 if ( cmdAuthAlgo != 1 && cmdAuthAlgo != 2) {
324 PrintAndLog("Crypto algo not valid for the auth mode");
325 return 1;
326 }
327 break;
328 case 2:
329 if ( cmdAuthAlgo != 1 && cmdAuthAlgo != 2 && cmdAuthAlgo != 3) {
330 PrintAndLog("Crypto algo not valid for the auth mode");
331 return 1;
332 }
333 break;
334 case 3:
335 if ( cmdAuthAlgo != 4) {
336 PrintAndLog("Crypto algo not valid for the auth mode");
337 return 1;
338 }
339 break;
340 default:
341 PrintAndLog("Wrong Auth mode");
342 return 1;
343 break;
344 }
345
346 switch (cmdAuthAlgo){
347 case 2:
348 keylength = 16;
349 PrintAndLog("3DES selected");
350 break;
351 case 3:
352 keylength = 24;
353 PrintAndLog("3 key 3DES selected");
354 break;
355 case 4:
356 keylength = 16;
357 PrintAndLog("AES selected");
358 break;
359 default:
360 cmdAuthAlgo = 1;
361 keylength = 8;
362 PrintAndLog("DES selected");
363 break;
364 }
365
366 // key
367 if (param_gethex(Cmd, 3, key, keylength*2)) {
368 PrintAndLog("Key must include %d HEX symbols", keylength);
369 return 1;
370 }
371