]> cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhficlass.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
REM: removed an unused doublett function "printBits" in util.c
[proxmark3-svn] / client / cmdhficlass.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3 // Copyright (C) 2011 Gerhard de Koning Gans
4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // High frequency iClass commands
11 //-----------------------------------------------------------------------------
12
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <sys/stat.h>
17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18 #include "data.h"
19 #include "proxmark3.h"
20 #include "ui.h"
21 #include "cmdparser.h"
22 #include "cmdhficlass.h"
23 #include "common.h"
24 #include "util.h"
25 #include "cmdmain.h"
26 #include "loclass/des.h"
27 #include "loclass/cipherutils.h"
28 #include "loclass/cipher.h"
29 #include "loclass/ikeys.h"
30 #include "loclass/elite_crack.h"
31 #include "loclass/fileutils.h"
32 #include "protocols.h"
33 #include "usb_cmd.h"
34 #include "cmdhfmfu.h"
35
36 #define llX PRIx64
37
38 static int CmdHelp(const char *Cmd);
39
40 #define ICLASS_KEYS_MAX 8
41 static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
49 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
50 };
51
52 typedef struct iclass_block {
53 uint8_t d[8];
54 } iclass_block_t;
55
56 int xorbits_8(uint8_t val) {
57 uint8_t res = val ^ (val >> 1); //1st pass
58 res = res ^ (res >> 1); // 2nd pass
59 res = res ^ (res >> 2); // 3rd pass
60 res = res ^ (res >> 4); // 4th pass
61 return res & 1;
62 }
63
64 int CmdHFiClassList(const char *Cmd) {
65 PrintAndLog("Deprecated command, use 'hf list iclass' instead");
66 return 0;
67 }
68
69 int CmdHFiClassSnoop(const char *Cmd) {
70 UsbCommand c = {CMD_SNOOP_ICLASS};
71 SendCommand(&c);
72 return 0;
73 }
74
75 int usage_hf_iclass_sim(void) {
76 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
77 PrintAndLog(" options");
78 PrintAndLog(" 0 <CSN> simulate the given CSN");
79 PrintAndLog(" 1 simulate default CSN");
80 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
81 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
82 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
83 PrintAndLog(" example: hf iclass sim 2");
84 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
85 PrintAndLog(" hf iclass sim 3");
86 return 0;
87 }
88
89 #define NUM_CSNS 15
90 int CmdHFiClassSim(const char *Cmd) {
91 uint8_t simType = 0;
92 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
93
94 if (strlen(Cmd)<1) {
95 return usage_hf_iclass_sim();
96 }
97 simType = param_get8ex(Cmd, 0, 0, 10);
98
99 if(simType == 0)
100 {
101 if (param_gethex(Cmd, 1, CSN, 16)) {
102 PrintAndLog("A CSN should consist of 16 HEX symbols");
103 return usage_hf_iclass_sim();
104 }
105
106 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
107 }
108 if(simType > 3)
109 {
110 PrintAndLog("Undefined simptype %d", simType);
111 return usage_hf_iclass_sim();
112 }
113
114 uint8_t numberOfCSNs=0;
115 if(simType == 2)
116 {
117 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
118 UsbCommand resp = {0};
119
120 uint8_t csns[8*NUM_CSNS] = {
121 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
136
137 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
138
139 SendCommand(&c);
140 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
141 PrintAndLog("Command timed out");
142 return 0;
143 }
144
145 uint8_t num_mac_responses = resp.arg[1];
146 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
147
148 size_t datalen = NUM_CSNS*24;
149 /*
150 * Now, time to dump to file. We'll use this format:
151 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
152 * So, it should wind up as
153 * 8 * 24 bytes.
154 *
155 * The returndata from the pm3 is on the following format
156 * <4 byte NR><4 byte MAC>
157 * CC are all zeroes, CSN is the same as was sent in
158 **/
159 void* dump = malloc(datalen);
160 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
161 uint8_t i = 0;
162 for(i = 0 ; i < NUM_CSNS ; i++)
163 {
164 memcpy(dump+i*24, csns+i*8,8); //CSN
165 //8 zero bytes here...
166 //Then comes NR_MAC (eight bytes from the response)
167 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
168
169 }
170 /** Now, save to dumpfile **/
171 saveFile("iclass_mac_attack", "bin", dump,datalen);
172 free(dump);
173 }else
174 {
175 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
176 memcpy(c.d.asBytes, CSN, 8);
177 SendCommand(&c);
178 }
179
180 return 0;
181 }
182
183 int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
184 bool tagFound = false;
185 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
186 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
187 // loop in client not device - else on windows have a communication error
188 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
189 UsbCommand resp;
190 while(!ukbhit()){
191 SendCommand(&c);
192 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
193 uint8_t readStatus = resp.arg[0] & 0xff;
194 uint8_t *data = resp.d.asBytes;
195
196 if (verbose)
197 PrintAndLog("Readstatus:%02x", readStatus);
198 if( readStatus == 0){
199 //Aborted
200 if (verbose) PrintAndLog("Quitting...");
201 return 0;
202 }
203 if( readStatus & FLAG_ICLASS_READER_CSN){
204 PrintAndLog("CSN: %s",sprint_hex(data,8));
205 tagFound = true;
206 }
207 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
208 if( readStatus & FLAG_ICLASS_READER_CONF){
209 printIclassDumpInfo(data);
210 }
211 if (tagFound && !loop) return 1;
212 } else {
213 if (verbose) PrintAndLog("Command execute timeout");
214 }
215 if (!loop) break;
216 }
217 return 0;
218 }
219
220 int CmdHFiClassReader(const char *Cmd) {
221 return HFiClassReader(Cmd, true, true);
222 }
223
224 int CmdHFiClassReader_Replay(const char *Cmd) {
225 uint8_t readerType = 0;
226 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
227
228 if (strlen(Cmd)<1) {
229 PrintAndLog("Usage: hf iclass replay <MAC>");
230 PrintAndLog(" sample: hf iclass replay 00112233");
231 return 0;
232 }
233
234 if (param_gethex(Cmd, 0, MAC, 8)) {
235 PrintAndLog("MAC must include 8 HEX symbols");
236 return 1;
237 }
238
239 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
240 memcpy(c.d.asBytes, MAC, 4);
241 SendCommand(&c);
242
243 return 0;
244 }
245
246 int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
247 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
248 memcpy(c.d.asBytes, data, blocksCount * 16);
249 SendCommand(&c);
250 return 0;
251 }
252
253 int hf_iclass_eload_usage(void) {
254 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
255 PrintAndLog("Usage: hf iclass eload f <filename>");
256 PrintAndLog("");
257 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
258 return 0;
259 }
260
261 int CmdHFiClassELoad(const char *Cmd) {
262
263 char opt = param_getchar(Cmd, 0);
264 if (strlen(Cmd)<1 || opt == 'h')
265 return hf_iclass_eload_usage();
266
267 //File handling and reading
268 FILE *f;
269 char filename[FILE_PATH_SIZE];
270 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
271 {
272 f = fopen(filename, "rb");
273 }else{
274 return hf_iclass_eload_usage();
275 }
276
277 if(!f) {
278 PrintAndLog("Failed to read from file '%s'", filename);
279 return 1;
280 }
281
282 fseek(f, 0, SEEK_END);
283 long fsize = ftell(f);
284 fseek(f, 0, SEEK_SET);
285
286 uint8_t *dump = malloc(fsize);
287
288
289 size_t bytes_read = fread(dump, 1, fsize, f);
290 fclose(f);
291
292 printIclassDumpInfo(dump);
293 //Validate
294
295 if (bytes_read < fsize)
296 {
297 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
298 free(dump);
299 return 1;
300 }
301 //Send to device
302 uint32_t bytes_sent = 0;
303 uint32_t bytes_remaining = bytes_read;
304
305 while(bytes_remaining > 0){
306 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
307 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
308 memcpy(c.d.asBytes, dump, bytes_in_packet);
309 SendCommand(&c);
310 bytes_remaining -= bytes_in_packet;
311 bytes_sent += bytes_in_packet;
312 }
313 free(dump);
314 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
315 return 0;
316 }
317
318 static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
319 FILE *f = fopen(filename, "rb");
320 if(!f) {
321 PrintAndLog("Failed to read from file '%s'", filename);
322 return 1;
323 }
324 fseek(f, 0, SEEK_END);
325 long fsize = ftell(f);
326 fseek(f, 0, SEEK_SET);
327 size_t bytes_read = fread(buffer, 1, len, f);
328 fclose(f);
329 if(fsize != len)
330 {
331 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
332 return 1;
333 }
334 if(bytes_read != len)
335 {
336 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
337 return 1;
338 }
339 return 0;
340 }
341
342 int usage_hf_iclass_decrypt(void) {
343 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
344 PrintAndLog("");
345 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
346 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
347 PrintAndLog("");
348 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
349 PrintAndLog("");
350 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
351 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
352 PrintAndLog("which is defined by the configuration block.");
353 return 1;
354 }
355
356 int CmdHFiClassDecrypt(const char *Cmd) {
357 uint8_t key[16] = { 0 };
358 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
359 {
360 usage_hf_iclass_decrypt();
361 return 1;
362 }
363 PrintAndLog("Decryption file found... ");
364 char opt = param_getchar(Cmd, 0);
365 if (strlen(Cmd)<1 || opt == 'h')
366 return usage_hf_iclass_decrypt();
367
368 //Open the tagdump-file
369 FILE *f;
370 char filename[FILE_PATH_SIZE];
371 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
372 {
373 f = fopen(filename, "rb");
374 }else{
375 return usage_hf_iclass_decrypt();
376 }
377
378 fseek(f, 0, SEEK_END);
379 long fsize = ftell(f);
380 fseek(f, 0, SEEK_SET);
381 uint8_t enc_dump[8] = {0};
382 uint8_t *decrypted = malloc(fsize);
383 des3_context ctx = { DES_DECRYPT ,{ 0 } };
384 des3_set2key_dec( &ctx, key);
385 size_t bytes_read = fread(enc_dump, 1, 8, f);
386
387 //Use the first block (CSN) for filename
388 char outfilename[FILE_PATH_SIZE] = { 0 };
389 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
390 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
391 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
392
393 size_t blocknum =0;
394 while(bytes_read == 8)
395 {
396 if(blocknum < 7)
397 {
398 memcpy(decrypted+(blocknum*8), enc_dump, 8);
399 }else{
400 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
401 }
402 printvar("decrypted block", decrypted +(blocknum*8), 8);
403 bytes_read = fread(enc_dump, 1, 8, f);
404 blocknum++;
405 }
406 fclose(f);
407
408 saveFile(outfilename,"bin", decrypted, blocknum*8);
409
410 return 0;
411 }
412
413 int usage_hf_iclass_encrypt(void) {
414 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
415 PrintAndLog("");
416 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
417 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
418 PrintAndLog("");
419 PrintAndLog("example: hf iclass encrypt 0102030405060708");
420 PrintAndLog("");
421 return 0;
422 }
423
424 static int iClassEncryptBlkData(uint8_t *blkData) {
425 uint8_t key[16] = { 0 };
426 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
427 {
428 usage_hf_iclass_encrypt();
429 return 1;
430 }
431 PrintAndLog("Decryption file found... ");
432
433 uint8_t encryptedData[16];
434 uint8_t *encrypted = encryptedData;
435 des3_context ctx = { DES_DECRYPT ,{ 0 } };
436 des3_set2key_enc( &ctx, key);
437
438 des3_crypt_ecb(&ctx, blkData,encrypted);
439 //printvar("decrypted block", decrypted, 8);
440 memcpy(blkData,encrypted,8);
441
442 return 1;
443 }
444
445 int CmdHFiClassEncryptBlk(const char *Cmd) {
446 uint8_t blkData[8] = {0};
447 char opt = param_getchar(Cmd, 0);
448 if (strlen(Cmd)<1 || opt == 'h')
449 return usage_hf_iclass_encrypt();
450
451 //get the bytes to encrypt
452 if (param_gethex(Cmd, 0, blkData, 16))
453 {
454 PrintAndLog("BlockData must include 16 HEX symbols");
455 return 0;
456 }
457 if (!iClassEncryptBlkData(blkData)) return 0;
458
459 printvar("encrypted block", blkData, 8);
460 return 1;
461 }
462
463 void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
464 uint8_t WB[9];
465 WB[0] = blockno;
466 memcpy(WB + 1,data,8);
467 doMAC_N(WB,sizeof(WB),div_key,MAC);
468 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
469 }
470
471 static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
472 UsbCommand resp;
473
474 UsbCommand c = {CMD_READER_ICLASS, {0}};
475 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
476 if (use_credit_key)
477 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
478
479 clearCommandBuffer();
480 SendCommand(&c);
481 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
482 {
483 PrintAndLog("Command execute timeout");
484 return false;
485 }
486
487 uint8_t isOK = resp.arg[0] & 0xff;
488 uint8_t *data = resp.d.asBytes;
489
490 memcpy(CSN,data,8);
491 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
492 if(isOK > 0)
493 {
494 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
495 }
496 if(isOK <= 1){
497 PrintAndLog("Failed to obtain CC! Aborting");
498 return false;
499 }
500 return true;
501 }
502
503 static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool verbose) {
504 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
505 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
506
507 if (!select_only(CSN, CCNR, use_credit_key, verbose))
508 return false;
509
510 //get div_key
511 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
512
513 doMAC(CCNR, div_key, MAC);
514 UsbCommand resp;
515 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
516 memcpy(d.d.asBytes, MAC, 4);
517 clearCommandBuffer();
518 SendCommand(&d);
519 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
520 {
521 PrintAndLog("Auth Command execute timeout");
522 return false;
523 }
524 uint8_t isOK = resp.arg[0] & 0xff;
525 if (!isOK) {
526 PrintAndLog("Authentication error");
527 return false;
528 }
529 return true;
530 }
531
532 int usage_hf_iclass_dump(void) {
533 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e\n");
534 PrintAndLog("Options:");
535 PrintAndLog(" f <filename> : specify a filename to save dump to");
536 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
537 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
538 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
539 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
540 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
541 PrintAndLog(" NOTE: * = required");
542 PrintAndLog("Samples:");
543 PrintAndLog(" hf iclass dump k 001122334455667B");
544 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
545 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
546 return 0;
547 }
548
549 int CmdHFiClassReader_Dump(const char *Cmd) {
550
551 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
552 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
553 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
554 uint8_t blockno = 0;
555 uint8_t numblks = 0;
556 uint8_t maxBlk = 31;
557 uint8_t app_areas = 1;
558 uint8_t kb = 2;
559 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
560 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
561 uint8_t keyNbr = 0;
562 uint8_t dataLen = 0;
563 uint8_t fileNameLen = 0;
564 char filename[FILE_PATH_SIZE]={0};
565 char tempStr[50] = {0};
566 bool have_debit_key = false;
567 bool have_credit_key = false;
568 bool use_credit_key = false;
569 bool elite = false;
570 bool errors = false;
571 uint8_t cmdp = 0;
572
573 while(param_getchar(Cmd, cmdp) != 0x00)
574 {
575 switch(param_getchar(Cmd, cmdp))
576 {
577 case 'h':
578 case 'H':
579 return usage_hf_iclass_dump();
580 case 'c':
581 case 'C':
582 have_credit_key = true;
583 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
584 if (dataLen == 16) {
585 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
586 } else if (dataLen == 1) {
587 keyNbr = param_get8(Cmd, cmdp+1);
588 if (keyNbr <= ICLASS_KEYS_MAX) {
589 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
590 } else {
591 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
592 errors = true;
593 }
594 } else {
595 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
596 errors = true;
597 }
598 cmdp += 2;
599 break;
600 case 'e':
601 case 'E':
602 elite = true;
603 cmdp++;
604 break;
605 case 'f':
606 case 'F':
607 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
608 if (fileNameLen < 1) {
609 PrintAndLog("No filename found after f");
610 errors = true;
611 }
612 cmdp += 2;
613 break;
614 case 'k':
615 case 'K':
616 have_debit_key = true;
617 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
618 if (dataLen == 16) {
619 errors = param_gethex(tempStr, 0, KEY, dataLen);
620 } else if (dataLen == 1) {
621 keyNbr = param_get8(Cmd, cmdp+1);
622 if (keyNbr <= ICLASS_KEYS_MAX) {
623 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
624 } else {
625 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
626 errors = true;
627 }
628 } else {
629 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
630 errors = true;
631 }
632 cmdp += 2;
633 break;
634 default:
635 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
636 errors = true;
637 break;
638 }
639 if(errors) return usage_hf_iclass_dump();
640 }
641
642 if (cmdp < 2) return usage_hf_iclass_dump();
643 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
644 if (!have_debit_key && have_credit_key) use_credit_key = true;
645
646 //get config and first 3 blocks
647 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
648 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
649 UsbCommand resp;
650 uint8_t tag_data[255*8];
651
652 clearCommandBuffer();
653 SendCommand(&c);
654 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
655 PrintAndLog("Command execute timeout");
656 ul_switch_off_field();
657 return 0;
658 }
659 uint8_t readStatus = resp.arg[0] & 0xff;
660 uint8_t * data = resp.d.asBytes;
661
662 if(readStatus == 0){
663 PrintAndLog("No tag found...");
664 ul_switch_off_field();
665 return 0;
666 }
667 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
668 memcpy(tag_data, data, 8*3);
669 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
670 numblks = data[8];
671 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
672 // large memory - not able to dump pages currently
673 if (numblks > maxBlk) numblks = maxBlk;
674 }
675 ul_switch_off_field();
676 // authenticate debit key and get div_key - later store in dump block 3
677 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
678 //try twice - for some reason it sometimes fails the first time...
679 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
680 ul_switch_off_field();
681 return 0;
682 }
683 }
684
685 // begin dump
686 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
687 clearCommandBuffer();
688 SendCommand(&w);
689 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
690 PrintAndLog("Command execute time-out 1");
691 ul_switch_off_field();
692 return 1;
693 }
694 uint32_t blocksRead = resp.arg[1];
695 uint8_t isOK = resp.arg[0] & 0xff;
696 if (!isOK && !blocksRead) {
697 PrintAndLog("Read Block Failed");
698 ul_switch_off_field();
699 return 0;
700 }
701 uint32_t startindex = resp.arg[2];
702 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
703 PrintAndLog("Data exceeded Buffer size!");
704 blocksRead = (sizeof(tag_data)/8) - blockno;
705 }
706 // response ok - now get bigbuf content of the dump
707 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
708 WaitForResponse(CMD_ACK,NULL);
709 size_t gotBytes = blocksRead*8 + blockno*8;
710
711 // try AA2
712 if (have_credit_key) {
713 //turn off hf field before authenticating with different key
714 ul_switch_off_field();
715 memset(MAC,0,4);
716 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
717 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
718 //try twice - for some reason it sometimes fails the first time...
719 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
720 ul_switch_off_field();
721 return 0;
722 }
723 }
724 // do we still need to read more block? (aa2 enabled?)
725 if (maxBlk > blockno+numblks+1) {
726 // setup dump and start
727 w.arg[0] = blockno + blocksRead;
728 w.arg[1] = maxBlk - (blockno + blocksRead);
729 clearCommandBuffer();
730 SendCommand(&w);
731 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
732 PrintAndLog("Command execute timeout 2");
733 ul_switch_off_field();
734 return 0;
735 }
736 uint8_t isOK = resp.arg[0] & 0xff;
737 blocksRead = resp.arg[1];
738 if (!isOK && !blocksRead) {
739 PrintAndLog("Read Block Failed 2");
740 ul_switch_off_field();
741 return 0;
742 }
743
744 startindex = resp.arg[2];
745 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
746 PrintAndLog("Data exceeded Buffer size!");
747 blocksRead = (sizeof(tag_data) - gotBytes)/8;
748 }
749 // get dumped data from bigbuf
750 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
751 WaitForResponse(CMD_ACK,NULL);
752
753 gotBytes += blocksRead*8;
754 } else { //field is still on - turn it off...
755 ul_switch_off_field();
756 }
757 }
758
759 // add diversified keys to dump
760 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
761 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
762 // print the dump
763 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
764 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
765 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
766
767 if (filename[0] == 0){
768 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
769 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
770 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
771 }
772
773 // save the dump to .bin file
774 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
775 saveFile(filename, "bin", tag_data, gotBytes);
776 return 1;
777 }
778
779 static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool verbose) {
780 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
781 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
782 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, verbose))
783 return 0;
784
785 UsbCommand resp;
786
787 Calc_wb_mac(blockno,bldata,div_key,MAC);
788 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
789 memcpy(w.d.asBytes, bldata, 8);
790 memcpy(w.d.asBytes + 8, MAC, 4);
791
792 clearCommandBuffer();
793 SendCommand(&w);
794 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
795 {
796 PrintAndLog("Write Command execute timeout");
797 return 0;
798 }
799 uint8_t isOK = resp.arg[0] & 0xff;
800 if (!isOK) {
801 PrintAndLog("Write Block Failed");
802 return 0;
803 }
804 PrintAndLog("Write Block Successful");
805 return 1;
806 }
807
808 int usage_hf_iclass_writeblock(void) {
809 PrintAndLog("Options:");
810 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
811 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
812 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
813 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
814 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
815 PrintAndLog("Samples:");
816 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
817 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
818 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
819 return 0;
820 }
821
822 int CmdHFiClass_WriteBlock(const char *Cmd) {
823 uint8_t blockno=0;
824 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
825 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
826 uint8_t keyNbr = 0;
827 uint8_t dataLen = 0;
828 char tempStr[50] = {0};
829 bool use_credit_key = false;
830 bool elite = false;
831 bool errors = false;
832 uint8_t cmdp = 0;
833 while(param_getchar(Cmd, cmdp) != 0x00)
834 {
835 switch(param_getchar(Cmd, cmdp))
836 {
837 case 'h':
838 case 'H':
839 return usage_hf_iclass_writeblock();
840 case 'b':
841 case 'B':
842 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
843 PrintAndLog("Block No must include 2 HEX symbols\n");
844 errors = true;
845 }
846 cmdp += 2;
847 break;
848 case 'c':
849 case 'C':
850 use_credit_key = true;
851 cmdp++;
852 break;
853 case 'd':
854 case 'D':
855 if (param_gethex(Cmd, cmdp+1, bldata, 16))
856 {
857 PrintAndLog("KEY must include 16 HEX symbols\n");
858 errors = true;
859 }
860 cmdp += 2;
861 break;
862 case 'e':
863 case 'E':
864 elite = true;
865 cmdp++;
866 break;
867 case 'k':
868 case 'K':
869 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
870 if (dataLen == 16) {
871 errors = param_gethex(tempStr, 0, KEY, dataLen);
872 } else if (dataLen == 1) {
873 keyNbr = param_get8(Cmd, cmdp+1);
874 if (keyNbr <= ICLASS_KEYS_MAX) {
875 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
876 } else {
877 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
878 errors = true;
879 }
880 } else {
881 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
882 errors = true;
883 }
884 cmdp += 2;
885 break;
886 default:
887 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
888 errors = true;
889 break;
890 }
891 if(errors) return usage_hf_iclass_writeblock();
892 }
893
894 if (cmdp < 6) return usage_hf_iclass_writeblock();
895 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, true);
896 ul_switch_off_field();
897 return ans;
898 }
899
900 int usage_hf_iclass_clone(void) {
901 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> e c");
902 PrintAndLog("Options:");
903 PrintAndLog(" f <filename>: specify a filename to clone from");
904 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
905 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
906 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
907 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
908 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
909 PrintAndLog("Samples:");
910 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
911 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
912 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
913 return -1;
914 }
915
916 int CmdHFiClassCloneTag(const char *Cmd) {
917 char filename[FILE_PATH_SIZE];
918 char tempStr[50]={0};
919 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
920 uint8_t keyNbr = 0;
921 uint8_t fileNameLen = 0;
922 uint8_t startblock = 0;
923 uint8_t endblock = 0;
924 uint8_t dataLen = 0;
925 bool use_credit_key = false;
926 bool elite = false;
927 bool errors = false;
928 uint8_t cmdp = 0;
929 while(param_getchar(Cmd, cmdp) != 0x00)
930 {
931 switch(param_getchar(Cmd, cmdp))
932 {
933 case 'h':
934 case 'H':
935 return usage_hf_iclass_clone();
936 case 'b':
937 case 'B':
938 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
939 PrintAndLog("Start Block No must include 2 HEX symbols\n");
940 errors = true;
941 }
942 cmdp += 2;
943 break;
944 case 'c':
945 case 'C':
946 use_credit_key = true;
947 cmdp++;
948 break;
949 case 'e':
950 case 'E':
951 elite = true;
952 cmdp++;
953 break;
954 case 'f':
955 case 'F':
956 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
957 if (fileNameLen < 1) {
958 PrintAndLog("No filename found after f");
959 errors = true;
960 }
961 cmdp += 2;
962 break;
963 case 'k':
964 case 'K':
965 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
966 if (dataLen == 16) {
967 errors = param_gethex(tempStr, 0, KEY, dataLen);
968 } else if (dataLen == 1) {
969 keyNbr = param_get8(Cmd, cmdp+1);
970 if (keyNbr <= ICLASS_KEYS_MAX) {
971 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
972 } else {
973 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
974 errors = true;
975 }
976 } else {
977 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
978 errors = true;
979 }
980 cmdp += 2;
981 break;
982 case 'l':
983 case 'L':
984 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
985 PrintAndLog("Start Block No must include 2 HEX symbols\n");
986 errors = true;
987 }
988 cmdp += 2;
989 break;
990 default:
991 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
992 errors = true;
993 break;
994 }
995 if(errors) return usage_hf_iclass_clone();
996 }
997
998 if (cmdp < 8) return usage_hf_iclass_clone();
999
1000 FILE *f;
1001
1002 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1003
1004 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1005 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1006 }
1007 // file handling and reading
1008 f = fopen(filename,"rb");
1009 if(!f) {
1010 PrintAndLog("Failed to read from file '%s'", filename);
1011 return 1;
1012 }
1013
1014 if (startblock<5) {
1015 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1016 return 0;
1017 }
1018 // now read data from the file from block 6 --- 19
1019 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1020 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1021 // else we have to create a share memory
1022 int i;
1023 fseek(f,startblock*8,SEEK_SET);
1024 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0){
1025 PrintAndLog("File reading error.");
1026 fclose(f);
1027 return 2;
1028 }
1029
1030 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1031 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1032
1033 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, true))
1034 return 0;
1035
1036 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
1037 uint8_t *ptr;
1038 // calculate all mac for every the block we will write
1039 for (i = startblock; i <= endblock; i++){
1040 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1041 // usb command d start pointer = d + (i - 6) * 12
1042 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1043 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1044 // next one
1045 ptr = w.d.asBytes + (i - startblock) * 12;
1046 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1047 memcpy(ptr + 8,MAC, 4);
1048 }
1049 uint8_t p[12];
1050 for (i = 0; i <= endblock - startblock;i++){
1051 memcpy(p,w.d.asBytes + (i * 12),12);
1052 printf("Block |%02x|",i + startblock);
1053 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1054 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1055 }
1056 UsbCommand resp;
1057 SendCommand(&w);
1058 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1059 {
1060 PrintAndLog("Command execute timeout");
1061 return 0;
1062 }
1063 return 1;
1064 }
1065
1066 static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool verbose) {
1067 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1068 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1069
1070 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, verbose))
1071 return 0;
1072
1073 UsbCommand resp;
1074 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
1075 clearCommandBuffer();
1076 SendCommand(&w);
1077 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1078 {
1079 PrintAndLog("Command execute timeout");
1080 return 0;
1081 }
1082 uint8_t isOK = resp.arg[0] & 0xff;
1083 if (!isOK) {
1084 PrintAndLog("Read Block Failed");
1085 return 0;
1086 }
1087 //data read is stored in: resp.d.asBytes[0-15]
1088 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1089 return 1;
1090 }
1091
1092 int usage_hf_iclass_readblock(void) {
1093 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e\n");
1094 PrintAndLog("Options:");
1095 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1096 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1097 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1098 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1099 PrintAndLog("Samples:");
1100 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1101 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1102 PrintAndLog(" hf iclass readblk b 0A k 0");
1103 return 0;
1104 }
1105
1106 int CmdHFiClass_ReadBlock(const char *Cmd) {
1107 uint8_t blockno=0;
1108 uint8_t keyType = 0x88; //debit key
1109 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1110 uint8_t keyNbr = 0;
1111 uint8_t dataLen = 0;
1112 char tempStr[50] = {0};
1113 bool elite = false;
1114 bool errors = false;
1115 uint8_t cmdp = 0;
1116 while(param_getchar(Cmd, cmdp) != 0x00)
1117 {
1118 switch(param_getchar(Cmd, cmdp))
1119 {
1120 case 'h':
1121 case 'H':
1122 return usage_hf_iclass_readblock();
1123 case 'b':
1124 case 'B':
1125 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1126 PrintAndLog("Block No must include 2 HEX symbols\n");
1127 errors = true;
1128 }
1129 cmdp += 2;
1130 break;
1131 case 'c':
1132 case 'C':
1133 keyType = 0x18;
1134 cmdp++;
1135 break;
1136 case 'e':
1137 case 'E':
1138 elite = true;
1139 cmdp++;
1140 break;
1141 case 'k':
1142 case 'K':
1143 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1144 if (dataLen == 16) {
1145 errors = param_gethex(tempStr, 0, KEY, dataLen);
1146 } else if (dataLen == 1) {
1147 keyNbr = param_get8(Cmd, cmdp+1);
1148 if (keyNbr <= ICLASS_KEYS_MAX) {
1149 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1150 } else {
1151 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1152 errors = true;
1153 }
1154 } else {
1155 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1156 errors = true;
1157 }
1158 cmdp += 2;
1159 break;
1160 default:
1161 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1162 errors = true;
1163 break;
1164 }
1165 if(errors) return usage_hf_iclass_readblock();
1166 }
1167
1168 if (cmdp < 4) return usage_hf_iclass_readblock();
1169
1170 return ReadBlock(KEY, blockno, keyType, elite, true);
1171 }
1172
1173 int CmdHFiClass_loclass(const char *Cmd) {
1174 char opt = param_getchar(Cmd, 0);
1175
1176 if (strlen(Cmd)<1 || opt == 'h') {
1177 PrintAndLog("Usage: hf iclass loclass [options]");
1178 PrintAndLog("Options:");
1179 PrintAndLog("h Show this help");
1180 PrintAndLog("t Perform self-test");
1181 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1182 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1183 PrintAndLog(" malicious CSNs, and their protocol responses");
1184 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1185 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1186 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1187 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1188 PrintAndLog(" ... totalling N*24 bytes");
1189 return 0;
1190 }
1191 char fileName[255] = {0};
1192 if(opt == 'f')
1193 {
1194 if(param_getstr(Cmd, 1, fileName) > 0)
1195 {
1196 return bruteforceFileNoKeys(fileName);
1197 }else
1198 {
1199 PrintAndLog("You must specify a filename");
1200 }
1201 }
1202 else if(opt == 't')
1203 {
1204 int errors = testCipherUtils();
1205 errors += testMAC();
1206 errors += doKeyTests(0);
1207 errors += testElite();
1208 if(errors)
1209 {
1210 prnlog("OBS! There were errors!!!");
1211 }
1212 return errors;
1213 }
1214
1215 return 0;
1216 }
1217
1218 void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1219 uint8_t blockdata[8];
1220 uint8_t mem_config;
1221 memcpy(&mem_config, iclass_dump + 13,1);
1222 uint8_t maxmemcount;
1223 uint8_t filemaxblock = filesize / 8;
1224 if (mem_config & 0x80)
1225 maxmemcount = 255;
1226 else
1227 maxmemcount = 31;
1228 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1229
1230 if (startblock == 0)
1231 startblock = 6;
1232 if ((endblock > maxmemcount) || (endblock == 0))
1233 endblock = maxmemcount;
1234 if (endblock > filemaxblock)
1235 endblock = filemaxblock;
1236 int i = startblock;
1237 int j;
1238 while (i <= endblock){
1239 printf("Block |%02X| ",i);
1240 memcpy(blockdata,iclass_dump + (i * 8),8);
1241 for (j = 0;j < 8;j++)
1242 printf("%02X ",blockdata[j]);
1243 printf("|\n");
1244 i++;
1245 }
1246 }
1247
1248 int usage_hf_iclass_readtagfile() {
1249 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1250 return 1;
1251 }
1252
1253 int CmdHFiClassReadTagFile(const char *Cmd) {
1254 int startblock = 0;
1255 int endblock = 0;
1256 char tempnum[5];
1257 FILE *f;
1258 char filename[FILE_PATH_SIZE];
1259 if (param_getstr(Cmd, 0, filename) < 1)
1260 return usage_hf_iclass_readtagfile();
1261 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1262 startblock = 0;
1263 else
1264 sscanf(tempnum,"%d",&startblock);
1265
1266 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1267 endblock = 0;
1268 else
1269 sscanf(tempnum,"%d",&endblock);
1270 // file handling and reading
1271 f = fopen(filename,"rb");
1272 if(!f) {
1273 PrintAndLog("Failed to read from file '%s'", filename);
1274 return 1;
1275 }
1276 fseek(f, 0, SEEK_END);
1277 long fsize = ftell(f);
1278 fseek(f, 0, SEEK_SET);
1279
1280 uint8_t *dump = malloc(fsize);
1281
1282
1283 size_t bytes_read = fread(dump, 1, fsize, f);
1284 fclose(f);
1285 uint8_t *csn = dump;
1286 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
1287 // printIclassDumpInfo(dump);
1288 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1289 free(dump);
1290 return 0;
1291 }
1292
1293 /*
1294 uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1295 uint64_t new_div = 0x00;
1296 new_div ^= sdiv;
1297 new_div ^= hdiv;
1298 return new_div;
1299 }
1300
1301 uint64_t hexarray_to_uint64(uint8_t *key) {
1302 char temp[17];
1303 uint64_t uint_key;
1304 for (int i = 0;i < 8;i++)
1305 sprintf(&temp[(i *2)],"%02X",key[i]);
1306 temp[16] = '\0';
1307 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1308 return 0;
1309 return uint_key;
1310 }
1311 */
1312 void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1313 uint8_t keytable[128] = {0};
1314 uint8_t key_index[8] = {0};
1315 if (elite) {
1316 uint8_t key_sel[8] = { 0 };
1317 uint8_t key_sel_p[8] = { 0 };
1318 hash2(KEY, keytable);
1319 hash1(CSN, key_index);
1320 for(uint8_t i = 0; i < 8 ; i++)
1321 key_sel[i] = keytable[key_index[i]] & 0xFF;
1322
1323 //Permute from iclass format to standard format
1324 permutekey_rev(key_sel, key_sel_p);
1325 diversifyKey(CSN, key_sel_p, div_key);
1326 } else {
1327 diversifyKey(CSN, KEY, div_key);
1328 }
1329 }
1330
1331 //when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1332 //calculate and return xor_div_key (ready for a key write command)
1333 //print all div_keys if verbose
1334 static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1335 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1336 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1337 //get old div key
1338 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1339 //get new div key
1340 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1341
1342 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1343 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1344 }
1345 if (verbose) {
1346 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1347 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1348 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1349 }
1350 }
1351
1352 int usage_hf_iclass_calc_newkey(void) {
1353 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1354 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1355 PrintAndLog(" Options:");
1356 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1357 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1358 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1359 PrintAndLog(" e : specify new key as elite calc");
1360 PrintAndLog(" ee : specify old and new key as elite calc");
1361 PrintAndLog("Samples:");
1362 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1363 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1364 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1365 PrintAndLog("NOTE: * = required\n");
1366
1367 return 1;
1368 }
1369
1370 int CmdHFiClassCalcNewKey(const char *Cmd) {
1371 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1372 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1373 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1374 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1375 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1376 uint8_t keyNbr = 0;
1377 uint8_t dataLen = 0;
1378 char tempStr[50] = {0};
1379 bool givenCSN = false;
1380 bool oldElite = false;
1381 bool elite = false;
1382 bool errors = false;
1383 uint8_t cmdp = 0;
1384 while(param_getchar(Cmd, cmdp) != 0x00)
1385 {
1386 switch(param_getchar(Cmd, cmdp))
1387 {
1388 case 'h':
1389 case 'H':
1390 return usage_hf_iclass_calc_newkey();
1391 case 'e':
1392 case 'E':
1393 dataLen = param_getstr(Cmd, cmdp, tempStr);
1394 if (dataLen==2)
1395 oldElite = true;
1396 elite = true;
1397 cmdp++;
1398 break;
1399 case 'n':
1400 case 'N':
1401 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1402 if (dataLen == 16) {
1403 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1404 } else if (dataLen == 1) {
1405 keyNbr = param_get8(Cmd, cmdp+1);
1406 if (keyNbr <= ICLASS_KEYS_MAX) {
1407 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1408 } else {
1409 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1410 errors = true;
1411 }
1412 } else {
1413 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1414 errors = true;
1415 }
1416 cmdp += 2;
1417 break;
1418 case 'o':
1419 case 'O':
1420 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1421 if (dataLen == 16) {
1422 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1423 } else if (dataLen == 1) {
1424 keyNbr = param_get8(Cmd, cmdp+1);
1425 if (keyNbr <= ICLASS_KEYS_MAX) {
1426 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1427 } else {
1428 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1429 errors = true;
1430 }
1431 } else {
1432 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1433 errors = true;
1434 }
1435 cmdp += 2;
1436 break;
1437 case 's':
1438 case 'S':
1439 givenCSN = true;
1440 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1441 return usage_hf_iclass_calc_newkey();
1442 cmdp += 2;
1443 break;
1444 default:
1445 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1446 errors = true;
1447 break;
1448 }
1449 if(errors) return usage_hf_iclass_calc_newkey();
1450 }
1451
1452 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1453
1454 if (!givenCSN)
1455 if (!select_only(CSN, CCNR, false, true))
1456 return 0;
1457
1458 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1459 return 0;
1460 }
1461
1462 static int loadKeys(char *filename) {
1463 FILE *f;
1464 f = fopen(filename,"rb");
1465 if(!f) {
1466 PrintAndLog("Failed to read from file '%s'", filename);
1467 return 0;
1468 }
1469 fseek(f, 0, SEEK_END);
1470 long fsize = ftell(f);
1471 fseek(f, 0, SEEK_SET);
1472
1473 uint8_t *dump = malloc(fsize);
1474
1475 size_t bytes_read = fread(dump, 1, fsize, f);
1476 fclose(f);
1477 if (bytes_read > ICLASS_KEYS_MAX * 8){
1478 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1479 free(dump);
1480 return 0;
1481 }
1482 uint8_t i = 0;
1483 for (; i < bytes_read/8; i++){
1484 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1485 }
1486 free(dump);
1487 PrintAndLog("%u keys loaded", i);
1488 return 1;
1489 }
1490
1491 static int saveKeys(char *filename) {
1492 FILE *f;
1493 f = fopen(filename,"wb");
1494 if (f == NULL) {
1495 printf("error opening file %s\n",filename);
1496 return 0;
1497 }
1498 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1499 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1500 PrintAndLog("save key failed to write to file: %s", filename);
1501 break;
1502 }
1503 }
1504 fclose(f);
1505 return 0;
1506 }
1507
1508 static int printKeys(void) {
1509 PrintAndLog("");
1510 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1511 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1512 }
1513 PrintAndLog("");
1514 return 0;
1515 }
1516
1517 int usage_hf_iclass_managekeys(void) {
1518 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1519 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1520 PrintAndLog(" Options:");
1521 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1522 PrintAndLog(" k <key> : set a key in memory");
1523 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1524 PrintAndLog(" s : save keys in memory to file specified by filename");
1525 PrintAndLog(" l : load keys to memory from file specified by filename");
1526 PrintAndLog(" p : print keys loaded into memory\n");
1527 PrintAndLog("Samples:");
1528 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1529 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1530 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1531 PrintAndLog(" print keys : hf iclass managekeys p\n");
1532 return 0;
1533 }
1534
1535 int CmdHFiClassManageKeys(const char *Cmd) {
1536 uint8_t keyNbr = 0;
1537 uint8_t dataLen = 0;
1538 uint8_t KEY[8] = {0};
1539 char filename[FILE_PATH_SIZE];
1540 uint8_t fileNameLen = 0;
1541 bool errors = false;
1542 uint8_t operation = 0;
1543 char tempStr[20];
1544 uint8_t cmdp = 0;
1545
1546 while(param_getchar(Cmd, cmdp) != 0x00)
1547 {
1548 switch(param_getchar(Cmd, cmdp))
1549 {
1550 case 'h':
1551 case 'H':
1552 return usage_hf_iclass_managekeys();
1553 case 'f':
1554 case 'F':
1555 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1556 if (fileNameLen < 1) {
1557 PrintAndLog("No filename found after f");
1558 errors = true;
1559 }
1560 cmdp += 2;
1561 break;
1562 case 'n':
1563 case 'N':
1564 keyNbr = param_get8(Cmd, cmdp+1);
1565 if (keyNbr < 0) {
1566 PrintAndLog("Wrong block number");
1567 errors = true;
1568 }
1569 cmdp += 2;
1570 break;
1571 case 'k':
1572 case 'K':
1573 operation += 3; //set key
1574 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1575 if (dataLen == 16) { //ul-c or ev1/ntag key length
1576 errors = param_gethex(tempStr, 0, KEY, dataLen);
1577 } else {
1578 PrintAndLog("\nERROR: Key is incorrect length\n");
1579 errors = true;
1580 }
1581 cmdp += 2;
1582 break;
1583 case 'p':
1584 case 'P':
1585 operation += 4; //print keys in memory
1586 cmdp++;
1587 break;
1588 case 'l':
1589 case 'L':
1590 operation += 5; //load keys from file
1591 cmdp++;
1592 break;
1593 case 's':
1594 case 'S':
1595 operation += 6; //save keys to file
1596 cmdp++;
1597 break;
1598 default:
1599 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1600 errors = true;
1601 break;
1602 }
1603 if(errors) return usage_hf_iclass_managekeys();
1604 }
1605 if (operation == 0){
1606 PrintAndLog("no operation specified (load, save, or print)\n");
1607 return usage_hf_iclass_managekeys();
1608 }
1609 if (operation > 6){
1610 PrintAndLog("Too many operations specified\n");
1611 return usage_hf_iclass_managekeys();
1612 }
1613 if (operation > 4 && fileNameLen == 0){
1614 PrintAndLog("You must enter a filename when loading or saving\n");
1615 return usage_hf_iclass_managekeys();
1616 }
1617
1618 switch (operation){
1619 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1620 case 4: return printKeys();
1621 case 5: return loadKeys(filename);
1622 case 6: return saveKeys(filename);
1623 break;
1624 }
1625 return 0;
1626 }
1627
1628 static command_t CommandTable[] =
1629 {
1630 {"help", CmdHelp, 1, "This help"},
1631 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1632 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1633 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1634 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1635 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1636 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1637 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1638 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1639 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1640 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1641 {"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
1642 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1643 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1644 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1645 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1646 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
1647 {NULL, NULL, 0, NULL}
1648 };
1649
1650 int CmdHFiClass(const char *Cmd)
1651 {
1652 CmdsParse(CommandTable, Cmd);
1653 return 0;
1654 }
1655
1656 int CmdHelp(const char *Cmd)
1657 {
1658 CmdsHelp(CommandTable);
1659 return 0;
1660 }
Proxmark3 GIT tracking
Impressum, Datenschutz