]> cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhficlass.c
projects / proxmark3-svn / blob
? search:


577baa54ac008e44382d93715af2f6308d73862a
[proxmark3-svn] / client / cmdhficlass.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3 // Copyright (C) 2011 Gerhard de Koning Gans
4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // High frequency iClass commands
11 //-----------------------------------------------------------------------------
12
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <sys/stat.h>
17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18 #include "data.h"
19 #include "proxmark3.h"
20 #include "ui.h"
21 #include "cmdparser.h"
22 #include "cmdhficlass.h"
23 #include "common.h"
24 #include "util.h"
25 #include "cmdmain.h"
26 #include "loclass/des.h"
27 #include "loclass/cipherutils.h"
28 #include "loclass/cipher.h"
29 #include "loclass/ikeys.h"
30 #include "loclass/elite_crack.h"
31 #include "loclass/fileutils.h"
32 #include "protocols.h"
33 #include "usb_cmd.h"
34 #include "cmdhfmfu.h"
35 #include "cmdhf.h"
36
37 #define llX PRIx64
38
39 static int CmdHelp(const char *Cmd);
40
41 #define ICLASS_KEYS_MAX 8
42 static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
49 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
50 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
51 };
52
53 typedef struct iclass_block {
54 uint8_t d[8];
55 } iclass_block_t;
56
57 int xorbits_8(uint8_t val) {
58 uint8_t res = val ^ (val >> 1); //1st pass
59 res = res ^ (res >> 1); // 2nd pass
60 res = res ^ (res >> 2); // 3rd pass
61 res = res ^ (res >> 4); // 4th pass
62 return res & 1;
63 }
64
65 int CmdHFiClassList(const char *Cmd) {
66 //PrintAndLog("Deprecated command, use 'hf list iclass' instead");
67 CmdHFList("iclass");
68 return 0;
69 }
70
71 int CmdHFiClassSnoop(const char *Cmd) {
72 UsbCommand c = {CMD_SNOOP_ICLASS};
73 SendCommand(&c);
74 return 0;
75 }
76
77 int usage_hf_iclass_sim(void) {
78 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
79 PrintAndLog(" options");
80 PrintAndLog(" 0 <CSN> simulate the given CSN");
81 PrintAndLog(" 1 simulate default CSN");
82 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
83 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
84 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
85 PrintAndLog(" example: hf iclass sim 2");
86 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
87 PrintAndLog(" hf iclass sim 3");
88 return 0;
89 }
90
91 #define NUM_CSNS 15
92 int CmdHFiClassSim(const char *Cmd) {
93 uint8_t simType = 0;
94 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
95
96 if (strlen(Cmd)<1) {
97 return usage_hf_iclass_sim();
98 }
99 simType = param_get8ex(Cmd, 0, 0, 10);
100
101 if(simType == 0)
102 {
103 if (param_gethex(Cmd, 1, CSN, 16)) {
104 PrintAndLog("A CSN should consist of 16 HEX symbols");
105 return usage_hf_iclass_sim();
106 }
107
108 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
109 }
110 if(simType > 3)
111 {
112 PrintAndLog("Undefined simptype %d", simType);
113 return usage_hf_iclass_sim();
114 }
115
116 uint8_t numberOfCSNs=0;
117 if(simType == 2)
118 {
119 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
120 UsbCommand resp = {0};
121
122 uint8_t csns[8*NUM_CSNS] = {
123 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
136 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
137 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
138
139 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
140
141 SendCommand(&c);
142 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
143 PrintAndLog("Command timed out");
144 return 0;
145 }
146
147 uint8_t num_mac_responses = resp.arg[1];
148 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
149
150 size_t datalen = NUM_CSNS*24;
151 /*
152 * Now, time to dump to file. We'll use this format:
153 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
154 * So, it should wind up as
155 * 8 * 24 bytes.
156 *
157 * The returndata from the pm3 is on the following format
158 * <4 byte NR><4 byte MAC>
159 * CC are all zeroes, CSN is the same as was sent in
160 **/
161 void* dump = malloc(datalen);
162 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
163 uint8_t i = 0;
164 for(i = 0 ; i < NUM_CSNS ; i++)
165 {
166 memcpy(dump+i*24, csns+i*8,8); //CSN
167 //8 zero bytes here...
168 //Then comes NR_MAC (eight bytes from the response)
169 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
170
171 }
172 /** Now, save to dumpfile **/
173 saveFile("iclass_mac_attack", "bin", dump,datalen);
174 free(dump);
175 }else
176 {
177 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
178 memcpy(c.d.asBytes, CSN, 8);
179 SendCommand(&c);
180 }
181
182 return 0;
183 }
184
185 int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
186 bool tagFound = false;
187 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
188 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
189 // loop in client not device - else on windows have a communication error
190 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
191 UsbCommand resp;
192 while(!ukbhit()){
193 SendCommand(&c);
194 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
195 uint8_t readStatus = resp.arg[0] & 0xff;
196 uint8_t *data = resp.d.asBytes;
197
198 if (verbose)
199 PrintAndLog("Readstatus:%02x", readStatus);
200 if( readStatus == 0){
201 //Aborted
202 if (verbose) PrintAndLog("Quitting...");
203 return 0;
204 }
205 if( readStatus & FLAG_ICLASS_READER_CSN){
206 PrintAndLog("CSN: %s",sprint_hex(data,8));
207 tagFound = true;
208 }
209 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
210 if( readStatus & FLAG_ICLASS_READER_CONF){
211 printIclassDumpInfo(data);
212 }
213 if (tagFound && !loop) return 1;
214 } else {
215 if (verbose) PrintAndLog("Command execute timeout");
216 }
217 if (!loop) break;
218 }
219 return 0;
220 }
221
222 int CmdHFiClassReader(const char *Cmd) {
223 return HFiClassReader(Cmd, true, true);
224 }
225
226 int CmdHFiClassReader_Replay(const char *Cmd) {
227 uint8_t readerType = 0;
228 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
229
230 if (strlen(Cmd)<1) {
231 PrintAndLog("Usage: hf iclass replay <MAC>");
232 PrintAndLog(" sample: hf iclass replay 00112233");
233 return 0;
234 }
235
236 if (param_gethex(Cmd, 0, MAC, 8)) {
237 PrintAndLog("MAC must include 8 HEX symbols");
238 return 1;
239 }
240
241 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
242 memcpy(c.d.asBytes, MAC, 4);
243 SendCommand(&c);
244
245 return 0;
246 }
247
248 int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
249 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
250 memcpy(c.d.asBytes, data, blocksCount * 16);
251 SendCommand(&c);
252 return 0;
253 }
254
255 int hf_iclass_eload_usage(void) {
256 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
257 PrintAndLog("Usage: hf iclass eload f <filename>");
258 PrintAndLog("");
259 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
260 return 0;
261 }
262
263 int CmdHFiClassELoad(const char *Cmd) {
264
265 char opt = param_getchar(Cmd, 0);
266 if (strlen(Cmd)<1 || opt == 'h')
267 return hf_iclass_eload_usage();
268
269 //File handling and reading
270 FILE *f;
271 char filename[FILE_PATH_SIZE];
272 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
273 {
274 f = fopen(filename, "rb");
275 }else{
276 return hf_iclass_eload_usage();
277 }
278
279 if(!f) {
280 PrintAndLog("Failed to read from file '%s'", filename);
281 return 1;
282 }
283
284 fseek(f, 0, SEEK_END);
285 long fsize = ftell(f);
286 fseek(f, 0, SEEK_SET);
287
288 uint8_t *dump = malloc(fsize);
289
290
291 size_t bytes_read = fread(dump, 1, fsize, f);
292 fclose(f);
293
294 printIclassDumpInfo(dump);
295 //Validate
296
297 if (bytes_read < fsize)
298 {
299 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
300 free(dump);
301 return 1;
302 }
303 //Send to device
304 uint32_t bytes_sent = 0;
305 uint32_t bytes_remaining = bytes_read;
306
307 while(bytes_remaining > 0){
308 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
309 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
310 memcpy(c.d.asBytes, dump, bytes_in_packet);
311 SendCommand(&c);
312 bytes_remaining -= bytes_in_packet;
313 bytes_sent += bytes_in_packet;
314 }
315 free(dump);
316 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
317 return 0;
318 }
319
320 static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
321 FILE *f = fopen(filename, "rb");
322 if(!f) {
323 PrintAndLog("Failed to read from file '%s'", filename);
324 return 1;
325 }
326 fseek(f, 0, SEEK_END);
327 long fsize = ftell(f);
328 fseek(f, 0, SEEK_SET);
329 size_t bytes_read = fread(buffer, 1, len, f);
330 fclose(f);
331 if(fsize != len)
332 {
333 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
334 return 1;
335 }
336 if(bytes_read != len)
337 {
338 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
339 return 1;
340 }
341 return 0;
342 }
343
344 int usage_hf_iclass_decrypt(void) {
345 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
346 PrintAndLog("");
347 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
348 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
349 PrintAndLog("");
350 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
351 PrintAndLog("");
352 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
353 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
354 PrintAndLog("which is defined by the configuration block.");
355 return 1;
356 }
357
358 int CmdHFiClassDecrypt(const char *Cmd) {
359 uint8_t key[16] = { 0 };
360 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
361 {
362 usage_hf_iclass_decrypt();
363 return 1;
364 }
365 PrintAndLog("Decryption file found... ");
366 char opt = param_getchar(Cmd, 0);
367 if (strlen(Cmd)<1 || opt == 'h')
368 return usage_hf_iclass_decrypt();
369
370 //Open the tagdump-file
371 FILE *f;
372 char filename[FILE_PATH_SIZE];
373 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
374 {
375 f = fopen(filename, "rb");
376 }else{
377 return usage_hf_iclass_decrypt();
378 }
379
380 fseek(f, 0, SEEK_END);
381 long fsize = ftell(f);
382 fseek(f, 0, SEEK_SET);
383 uint8_t enc_dump[8] = {0};
384 uint8_t *decrypted = malloc(fsize);
385 des3_context ctx = { DES_DECRYPT ,{ 0 } };
386 des3_set2key_dec( &ctx, key);
387 size_t bytes_read = fread(enc_dump, 1, 8, f);
388
389 //Use the first block (CSN) for filename
390 char outfilename[FILE_PATH_SIZE] = { 0 };
391 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
392 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
393 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
394
395 size_t blocknum =0;
396 while(bytes_read == 8)
397 {
398 if(blocknum < 7)
399 {
400 memcpy(decrypted+(blocknum*8), enc_dump, 8);
401 }else{
402 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
403 }
404 printvar("decrypted block", decrypted +(blocknum*8), 8);
405 bytes_read = fread(enc_dump, 1, 8, f);
406 blocknum++;
407 }
408 fclose(f);
409
410 saveFile(outfilename,"bin", decrypted, blocknum*8);
411
412 return 0;
413 }
414
415 int usage_hf_iclass_encrypt(void) {
416 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
417 PrintAndLog("");
418 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
419 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
420 PrintAndLog("");
421 PrintAndLog("example: hf iclass encrypt 0102030405060708");
422 PrintAndLog("");
423 return 0;
424 }
425
426 static int iClassEncryptBlkData(uint8_t *blkData) {
427 uint8_t key[16] = { 0 };
428 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
429 {
430 usage_hf_iclass_encrypt();
431 return 1;
432 }
433 PrintAndLog("Decryption file found... ");
434
435 uint8_t encryptedData[16];
436 uint8_t *encrypted = encryptedData;
437 des3_context ctx = { DES_DECRYPT ,{ 0 } };
438 des3_set2key_enc( &ctx, key);
439
440 des3_crypt_ecb(&ctx, blkData,encrypted);
441 //printvar("decrypted block", decrypted, 8);
442 memcpy(blkData,encrypted,8);
443
444 return 1;
445 }
446
447 int CmdHFiClassEncryptBlk(const char *Cmd) {
448 uint8_t blkData[8] = {0};
449 char opt = param_getchar(Cmd, 0);
450 if (strlen(Cmd)<1 || opt == 'h')
451 return usage_hf_iclass_encrypt();
452
453 //get the bytes to encrypt
454 if (param_gethex(Cmd, 0, blkData, 16))
455 {
456 PrintAndLog("BlockData must include 16 HEX symbols");
457 return 0;
458 }
459 if (!iClassEncryptBlkData(blkData)) return 0;
460
461 printvar("encrypted block", blkData, 8);
462 return 1;
463 }
464
465 void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
466 uint8_t WB[9];
467 WB[0] = blockno;
468 memcpy(WB + 1,data,8);
469 doMAC_N(WB,sizeof(WB),div_key,MAC);
470 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
471 }
472
473 static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
474 UsbCommand resp;
475
476 UsbCommand c = {CMD_READER_ICLASS, {0}};
477 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
478 if (use_credit_key)
479 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
480
481 clearCommandBuffer();
482 SendCommand(&c);
483 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
484 {
485 PrintAndLog("Command execute timeout");
486 return false;
487 }
488
489 uint8_t isOK = resp.arg[0] & 0xff;
490 uint8_t *data = resp.d.asBytes;
491
492 memcpy(CSN,data,8);
493 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
494 if(isOK > 0)
495 {
496 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
497 }
498 if(isOK <= 1){
499 PrintAndLog("Failed to obtain CC! Aborting");
500 return false;
501 }
502 return true;
503 }
504
505 static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool verbose) {
506 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
507 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
508
509 if (!select_only(CSN, CCNR, use_credit_key, verbose))
510 return false;
511
512 //get div_key
513 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
514
515 doMAC(CCNR, div_key, MAC);
516 UsbCommand resp;
517 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
518 memcpy(d.d.asBytes, MAC, 4);
519 clearCommandBuffer();
520 SendCommand(&d);
521 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
522 {
523 PrintAndLog("Auth Command execute timeout");
524 return false;
525 }
526 uint8_t isOK = resp.arg[0] & 0xff;
527 if (!isOK) {
528 PrintAndLog("Authentication error");
529 return false;
530 }
531 return true;
532 }
533
534 int usage_hf_iclass_dump(void) {
535 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e\n");
536 PrintAndLog("Options:");
537 PrintAndLog(" f <filename> : specify a filename to save dump to");
538 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
539 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
540 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
541 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
542 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
543 PrintAndLog(" NOTE: * = required");
544 PrintAndLog("Samples:");
545 PrintAndLog(" hf iclass dump k 001122334455667B");
546 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
547 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
548 return 0;
549 }
550
551 int CmdHFiClassReader_Dump(const char *Cmd) {
552
553 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
554 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
555 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
556 uint8_t blockno = 0;
557 uint8_t numblks = 0;
558 uint8_t maxBlk = 31;
559 uint8_t app_areas = 1;
560 uint8_t kb = 2;
561 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
562 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
563 uint8_t keyNbr = 0;
564 uint8_t dataLen = 0;
565 uint8_t fileNameLen = 0;
566 char filename[FILE_PATH_SIZE]={0};
567 char tempStr[50] = {0};
568 bool have_debit_key = false;
569 bool have_credit_key = false;
570 bool use_credit_key = false;
571 bool elite = false;
572 bool errors = false;
573 uint8_t cmdp = 0;
574
575 while(param_getchar(Cmd, cmdp) != 0x00)
576 {
577 switch(param_getchar(Cmd, cmdp))
578 {
579 case 'h':
580 case 'H':
581 return usage_hf_iclass_dump();
582 case 'c':
583 case 'C':
584 have_credit_key = true;
585 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
586 if (dataLen == 16) {
587 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
588 } else if (dataLen == 1) {
589 keyNbr = param_get8(Cmd, cmdp+1);
590 if (keyNbr <= ICLASS_KEYS_MAX) {
591 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
592 } else {
593 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
594 errors = true;
595 }
596 } else {
597 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
598 errors = true;
599 }
600 cmdp += 2;
601 break;
602 case 'e':
603 case 'E':
604 elite = true;
605 cmdp++;
606 break;
607 case 'f':
608 case 'F':
609 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
610 if (fileNameLen < 1) {
611 PrintAndLog("No filename found after f");
612 errors = true;
613 }
614 cmdp += 2;
615 break;
616 case 'k':
617 case 'K':
618 have_debit_key = true;
619 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
620 if (dataLen == 16) {
621 errors = param_gethex(tempStr, 0, KEY, dataLen);
622 } else if (dataLen == 1) {
623 keyNbr = param_get8(Cmd, cmdp+1);
624 if (keyNbr <= ICLASS_KEYS_MAX) {
625 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
626 } else {
627 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
628 errors = true;
629 }
630 } else {
631 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
632 errors = true;
633 }
634 cmdp += 2;
635 break;
636 default:
637 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
638 errors = true;
639 break;
640 }
641 if(errors) return usage_hf_iclass_dump();
642 }
643
644 if (cmdp < 2) return usage_hf_iclass_dump();
645 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
646 if (!have_debit_key && have_credit_key) use_credit_key = true;
647
648 //get config and first 3 blocks
649 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
650 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
651 UsbCommand resp;
652 uint8_t tag_data[255*8];
653
654 clearCommandBuffer();
655 SendCommand(&c);
656 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
657 PrintAndLog("Command execute timeout");
658 ul_switch_off_field();
659 return 0;
660 }
661 uint8_t readStatus = resp.arg[0] & 0xff;
662 uint8_t * data = resp.d.asBytes;
663
664 if(readStatus == 0){
665 PrintAndLog("No tag found...");
666 ul_switch_off_field();
667 return 0;
668 }
669 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
670 memcpy(tag_data, data, 8*3);
671 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
672 numblks = data[8];
673 getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
674 // large memory - not able to dump pages currently
675 if (numblks > maxBlk) numblks = maxBlk;
676 }
677 ul_switch_off_field();
678 // authenticate debit key and get div_key - later store in dump block 3
679 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
680 //try twice - for some reason it sometimes fails the first time...
681 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
682 ul_switch_off_field();
683 return 0;
684 }
685 }
686
687 // begin dump
688 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
689 clearCommandBuffer();
690 SendCommand(&w);
691 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
692 PrintAndLog("Command execute time-out 1");
693 ul_switch_off_field();
694 return 1;
695 }
696 uint32_t blocksRead = resp.arg[1];
697 uint8_t isOK = resp.arg[0] & 0xff;
698 if (!isOK && !blocksRead) {
699 PrintAndLog("Read Block Failed");
700 ul_switch_off_field();
701 return 0;
702 }
703 uint32_t startindex = resp.arg[2];
704 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
705 PrintAndLog("Data exceeded Buffer size!");
706 blocksRead = (sizeof(tag_data)/8) - blockno;
707 }
708 // response ok - now get bigbuf content of the dump
709 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
710 WaitForResponse(CMD_ACK,NULL);
711 size_t gotBytes = blocksRead*8 + blockno*8;
712
713 // try AA2
714 if (have_credit_key) {
715 //turn off hf field before authenticating with different key
716 ul_switch_off_field();
717 memset(MAC,0,4);
718 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
719 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
720 //try twice - for some reason it sometimes fails the first time...
721 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
722 ul_switch_off_field();
723 return 0;
724 }
725 }
726 // do we still need to read more block? (aa2 enabled?)
727 if (maxBlk > blockno+numblks+1) {
728 // setup dump and start
729 w.arg[0] = blockno + blocksRead;
730 w.arg[1] = maxBlk - (blockno + blocksRead);
731 clearCommandBuffer();
732 SendCommand(&w);
733 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
734 PrintAndLog("Command execute timeout 2");
735 ul_switch_off_field();
736 return 0;
737 }
738 uint8_t isOK = resp.arg[0] & 0xff;
739 blocksRead = resp.arg[1];
740 if (!isOK && !blocksRead) {
741 PrintAndLog("Read Block Failed 2");
742 ul_switch_off_field();
743 return 0;
744 }
745
746 startindex = resp.arg[2];
747 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
748 PrintAndLog("Data exceeded Buffer size!");
749 blocksRead = (sizeof(tag_data) - gotBytes)/8;
750 }
751 // get dumped data from bigbuf
752 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
753 WaitForResponse(CMD_ACK,NULL);
754
755 gotBytes += blocksRead*8;
756 } else { //field is still on - turn it off...
757 ul_switch_off_field();
758 }
759 }
760
761 // add diversified keys to dump
762 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
763 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
764 // print the dump
765 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
766 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
767 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
768
769 if (filename[0] == 0){
770 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
771 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
772 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
773 }
774
775 // save the dump to .bin file
776 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
777 saveFile(filename, "bin", tag_data, gotBytes);
778 return 1;
779 }
780
781 static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool verbose) {
782 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
783 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
784 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, verbose))
785 return 0;
786
787 UsbCommand resp;
788
789 Calc_wb_mac(blockno,bldata,div_key,MAC);
790 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
791 memcpy(w.d.asBytes, bldata, 8);
792 memcpy(w.d.asBytes + 8, MAC, 4);
793
794 clearCommandBuffer();
795 SendCommand(&w);
796 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
797 {
798 PrintAndLog("Write Command execute timeout");
799 return 0;
800 }
801 uint8_t isOK = resp.arg[0] & 0xff;
802 if (!isOK) {
803 PrintAndLog("Write Block Failed");
804 return 0;
805 }
806 PrintAndLog("Write Block Successful");
807 return 1;
808 }
809
810 int usage_hf_iclass_writeblock(void) {
811 PrintAndLog("Options:");
812 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
813 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
814 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
815 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
816 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
817 PrintAndLog("Samples:");
818 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
819 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
820 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
821 return 0;
822 }
823
824 int CmdHFiClass_WriteBlock(const char *Cmd) {
825 uint8_t blockno=0;
826 uint8_t bldata[8]={0,0,0,0,0,0,0,0};
827 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
828 uint8_t keyNbr = 0;
829 uint8_t dataLen = 0;
830 char tempStr[50] = {0};
831 bool use_credit_key = false;
832 bool elite = false;
833 bool errors = false;
834 uint8_t cmdp = 0;
835 while(param_getchar(Cmd, cmdp) != 0x00)
836 {
837 switch(param_getchar(Cmd, cmdp))
838 {
839 case 'h':
840 case 'H':
841 return usage_hf_iclass_writeblock();
842 case 'b':
843 case 'B':
844 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
845 PrintAndLog("Block No must include 2 HEX symbols\n");
846 errors = true;
847 }
848 cmdp += 2;
849 break;
850 case 'c':
851 case 'C':
852 use_credit_key = true;
853 cmdp++;
854 break;
855 case 'd':
856 case 'D':
857 if (param_gethex(Cmd, cmdp+1, bldata, 16))
858 {
859 PrintAndLog("KEY must include 16 HEX symbols\n");
860 errors = true;
861 }
862 cmdp += 2;
863 break;
864 case 'e':
865 case 'E':
866 elite = true;
867 cmdp++;
868 break;
869 case 'k':
870 case 'K':
871 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
872 if (dataLen == 16) {
873 errors = param_gethex(tempStr, 0, KEY, dataLen);
874 } else if (dataLen == 1) {
875 keyNbr = param_get8(Cmd, cmdp+1);
876 if (keyNbr <= ICLASS_KEYS_MAX) {
877 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
878 } else {
879 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
880 errors = true;
881 }
882 } else {
883 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
884 errors = true;
885 }
886 cmdp += 2;
887 break;
888 default:
889 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
890 errors = true;
891 break;
892 }
893 if(errors) return usage_hf_iclass_writeblock();
894 }
895
896 if (cmdp < 6) return usage_hf_iclass_writeblock();
897 int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, true);
898 ul_switch_off_field();
899 return ans;
900 }
901
902 int usage_hf_iclass_clone(void) {
903 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> e c");
904 PrintAndLog("Options:");
905 PrintAndLog(" f <filename>: specify a filename to clone from");
906 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
907 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
908 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
909 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
910 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
911 PrintAndLog("Samples:");
912 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
913 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
914 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
915 return -1;
916 }
917
918 int CmdHFiClassCloneTag(const char *Cmd) {
919 char filename[FILE_PATH_SIZE];
920 char tempStr[50]={0};
921 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
922 uint8_t keyNbr = 0;
923 uint8_t fileNameLen = 0;
924 uint8_t startblock = 0;
925 uint8_t endblock = 0;
926 uint8_t dataLen = 0;
927 bool use_credit_key = false;
928 bool elite = false;
929 bool errors = false;
930 uint8_t cmdp = 0;
931 while(param_getchar(Cmd, cmdp) != 0x00)
932 {
933 switch(param_getchar(Cmd, cmdp))
934 {
935 case 'h':
936 case 'H':
937 return usage_hf_iclass_clone();
938 case 'b':
939 case 'B':
940 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
941 PrintAndLog("Start Block No must include 2 HEX symbols\n");
942 errors = true;
943 }
944 cmdp += 2;
945 break;
946 case 'c':
947 case 'C':
948 use_credit_key = true;
949 cmdp++;
950 break;
951 case 'e':
952 case 'E':
953 elite = true;
954 cmdp++;
955 break;
956 case 'f':
957 case 'F':
958 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
959 if (fileNameLen < 1) {
960 PrintAndLog("No filename found after f");
961 errors = true;
962 }
963 cmdp += 2;
964 break;
965 case 'k':
966 case 'K':
967 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
968 if (dataLen == 16) {
969 errors = param_gethex(tempStr, 0, KEY, dataLen);
970 } else if (dataLen == 1) {
971 keyNbr = param_get8(Cmd, cmdp+1);
972 if (keyNbr <= ICLASS_KEYS_MAX) {
973 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
974 } else {
975 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
976 errors = true;
977 }
978 } else {
979 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
980 errors = true;
981 }
982 cmdp += 2;
983 break;
984 case 'l':
985 case 'L':
986 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
987 PrintAndLog("Start Block No must include 2 HEX symbols\n");
988 errors = true;
989 }
990 cmdp += 2;
991 break;
992 default:
993 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
994 errors = true;
995 break;
996 }
997 if(errors) return usage_hf_iclass_clone();
998 }
999
1000 if (cmdp < 8) return usage_hf_iclass_clone();
1001
1002 FILE *f;
1003
1004 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1005
1006 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1007 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1008 }
1009 // file handling and reading
1010 f = fopen(filename,"rb");
1011 if(!f) {
1012 PrintAndLog("Failed to read from file '%s'", filename);
1013 return 1;
1014 }
1015
1016 if (startblock<5) {
1017 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1018 return 0;
1019 }
1020 // now read data from the file from block 6 --- 19
1021 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1022 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1023 // else we have to create a share memory
1024 int i;
1025 fseek(f,startblock*8,SEEK_SET);
1026 if ( fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f) == 0){
1027 PrintAndLog("File reading error.");
1028 fclose(f);
1029 return 2;
1030 }
1031
1032 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1033 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1034
1035 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, true))
1036 return 0;
1037
1038 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
1039 uint8_t *ptr;
1040 // calculate all mac for every the block we will write
1041 for (i = startblock; i <= endblock; i++){
1042 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1043 // usb command d start pointer = d + (i - 6) * 12
1044 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1045 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1046 // next one
1047 ptr = w.d.asBytes + (i - startblock) * 12;
1048 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1049 memcpy(ptr + 8,MAC, 4);
1050 }
1051 uint8_t p[12];
1052 for (i = 0; i <= endblock - startblock;i++){
1053 memcpy(p,w.d.asBytes + (i * 12),12);
1054 printf("Block |%02x|",i + startblock);
1055 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1056 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1057 }
1058 UsbCommand resp;
1059 SendCommand(&w);
1060 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1061 {
1062 PrintAndLog("Command execute timeout");
1063 return 0;
1064 }
1065 return 1;
1066 }
1067
1068 static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool verbose) {
1069 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1070 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1071
1072 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, verbose))
1073 return 0;
1074
1075 UsbCommand resp;
1076 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
1077 clearCommandBuffer();
1078 SendCommand(&w);
1079 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1080 {
1081 PrintAndLog("Command execute timeout");
1082 return 0;
1083 }
1084 uint8_t isOK = resp.arg[0] & 0xff;
1085 if (!isOK) {
1086 PrintAndLog("Read Block Failed");
1087 return 0;
1088 }
1089 //data read is stored in: resp.d.asBytes[0-15]
1090 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1091 return 1;
1092 }
1093
1094 int usage_hf_iclass_readblock(void) {
1095 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e\n");
1096 PrintAndLog("Options:");
1097 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1098 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1099 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1100 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1101 PrintAndLog("Samples:");
1102 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1103 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1104 PrintAndLog(" hf iclass readblk b 0A k 0");
1105 return 0;
1106 }
1107
1108 int CmdHFiClass_ReadBlock(const char *Cmd) {
1109 uint8_t blockno=0;
1110 uint8_t keyType = 0x88; //debit key
1111 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1112 uint8_t keyNbr = 0;
1113 uint8_t dataLen = 0;
1114 char tempStr[50] = {0};
1115 bool elite = false;
1116 bool errors = false;
1117 uint8_t cmdp = 0;
1118 while(param_getchar(Cmd, cmdp) != 0x00)
1119 {
1120 switch(param_getchar(Cmd, cmdp))
1121 {
1122 case 'h':
1123 case 'H':
1124 return usage_hf_iclass_readblock();
1125 case 'b':
1126 case 'B':
1127 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1128 PrintAndLog("Block No must include 2 HEX symbols\n");
1129 errors = true;
1130 }
1131 cmdp += 2;
1132 break;
1133 case 'c':
1134 case 'C':
1135 keyType = 0x18;
1136 cmdp++;
1137 break;
1138 case 'e':
1139 case 'E':
1140 elite = true;
1141 cmdp++;
1142 break;
1143 case 'k':
1144 case 'K':
1145 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1146 if (dataLen == 16) {
1147 errors = param_gethex(tempStr, 0, KEY, dataLen);
1148 } else if (dataLen == 1) {
1149 keyNbr = param_get8(Cmd, cmdp+1);
1150 if (keyNbr <= ICLASS_KEYS_MAX) {
1151 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1152 } else {
1153 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1154 errors = true;
1155 }
1156 } else {
1157 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1158 errors = true;
1159 }
1160 cmdp += 2;
1161 break;
1162 default:
1163 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1164 errors = true;
1165 break;
1166 }
1167 if(errors) return usage_hf_iclass_readblock();
1168 }
1169
1170 if (cmdp < 4) return usage_hf_iclass_readblock();
1171
1172 return ReadBlock(KEY, blockno, keyType, elite, true);
1173 }
1174
1175 int CmdHFiClass_loclass(const char *Cmd) {
1176 char opt = param_getchar(Cmd, 0);
1177
1178 if (strlen(Cmd)<1 || opt == 'h') {
1179 PrintAndLog("Usage: hf iclass loclass [options]");
1180 PrintAndLog("Options:");
1181 PrintAndLog("h Show this help");
1182 PrintAndLog("t Perform self-test");
1183 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1184 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1185 PrintAndLog(" malicious CSNs, and their protocol responses");
1186 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1187 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1188 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1189 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1190 PrintAndLog(" ... totalling N*24 bytes");
1191 return 0;
1192 }
1193 char fileName[255] = {0};
1194 if(opt == 'f')
1195 {
1196 if(param_getstr(Cmd, 1, fileName) > 0)
1197 {
1198 return bruteforceFileNoKeys(fileName);
1199 }else
1200 {
1201 PrintAndLog("You must specify a filename");
1202 }
1203 }
1204 else if(opt == 't')
1205 {
1206 int errors = testCipherUtils();
1207 errors += testMAC();
1208 errors += doKeyTests(0);
1209 errors += testElite();
1210 if(errors)
1211 {
1212 prnlog("OBS! There were errors!!!");
1213 }
1214 return errors;
1215 }
1216
1217 return 0;
1218 }
1219
1220 void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1221 uint8_t blockdata[8];
1222 uint8_t mem_config;
1223 memcpy(&mem_config, iclass_dump + 13,1);
1224 uint8_t maxmemcount;
1225 uint8_t filemaxblock = filesize / 8;
1226 if (mem_config & 0x80)
1227 maxmemcount = 255;
1228 else
1229 maxmemcount = 31;
1230 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1231
1232 if (startblock == 0)
1233 startblock = 6;
1234 if ((endblock > maxmemcount) || (endblock == 0))
1235 endblock = maxmemcount;
1236 if (endblock > filemaxblock)
1237 endblock = filemaxblock;
1238 int i = startblock;
1239 int j;
1240 while (i <= endblock){
1241 printf("Block |%02X| ",i);
1242 memcpy(blockdata,iclass_dump + (i * 8),8);
1243 for (j = 0;j < 8;j++)
1244 printf("%02X ",blockdata[j]);
1245 printf("|\n");
1246 i++;
1247 }
1248 }
1249
1250 int usage_hf_iclass_readtagfile() {
1251 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1252 return 1;
1253 }
1254
1255 int CmdHFiClassReadTagFile(const char *Cmd) {
1256 int startblock = 0;
1257 int endblock = 0;
1258 char tempnum[5];
1259 FILE *f;
1260 char filename[FILE_PATH_SIZE];
1261 if (param_getstr(Cmd, 0, filename) < 1)
1262 return usage_hf_iclass_readtagfile();
1263 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1264 startblock = 0;
1265 else
1266 sscanf(tempnum,"%d",&startblock);
1267
1268 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1269 endblock = 0;
1270 else
1271 sscanf(tempnum,"%d",&endblock);
1272 // file handling and reading
1273 f = fopen(filename,"rb");
1274 if(!f) {
1275 PrintAndLog("Failed to read from file '%s'", filename);
1276 return 1;
1277 }
1278 fseek(f, 0, SEEK_END);
1279 long fsize = ftell(f);
1280 fseek(f, 0, SEEK_SET);
1281
1282 uint8_t *dump = malloc(fsize);
1283
1284
1285 size_t bytes_read = fread(dump, 1, fsize, f);
1286 fclose(f);
1287 uint8_t *csn = dump;
1288 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
1289 // printIclassDumpInfo(dump);
1290 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1291 free(dump);
1292 return 0;
1293 }
1294
1295 /*
1296 uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1297 uint64_t new_div = 0x00;
1298 new_div ^= sdiv;
1299 new_div ^= hdiv;
1300 return new_div;
1301 }
1302
1303 uint64_t hexarray_to_uint64(uint8_t *key) {
1304 char temp[17];
1305 uint64_t uint_key;
1306 for (int i = 0;i < 8;i++)
1307 sprintf(&temp[(i *2)],"%02X",key[i]);
1308 temp[16] = '\0';
1309 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1310 return 0;
1311 return uint_key;
1312 }
1313 */
1314 void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1315 uint8_t keytable[128] = {0};
1316 uint8_t key_index[8] = {0};
1317 if (elite) {
1318 uint8_t key_sel[8] = { 0 };
1319 uint8_t key_sel_p[8] = { 0 };
1320 hash2(KEY, keytable);
1321 hash1(CSN, key_index);
1322 for(uint8_t i = 0; i < 8 ; i++)
1323 key_sel[i] = keytable[key_index[i]] & 0xFF;
1324
1325 //Permute from iclass format to standard format
1326 permutekey_rev(key_sel, key_sel_p);
1327 diversifyKey(CSN, key_sel_p, div_key);
1328 } else {
1329 diversifyKey(CSN, KEY, div_key);
1330 }
1331 }
1332
1333 //when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1334 //calculate and return xor_div_key (ready for a key write command)
1335 //print all div_keys if verbose
1336 static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1337 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1338 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1339 //get old div key
1340 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1341 //get new div key
1342 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1343
1344 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1345 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1346 }
1347 if (verbose) {
1348 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1349 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1350 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1351 }
1352 }
1353
1354 int usage_hf_iclass_calc_newkey(void) {
1355 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1356 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1357 PrintAndLog(" Options:");
1358 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1359 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1360 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1361 PrintAndLog(" e : specify new key as elite calc");
1362 PrintAndLog(" ee : specify old and new key as elite calc");
1363 PrintAndLog("Samples:");
1364 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1365 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1366 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1367 PrintAndLog("NOTE: * = required\n");
1368
1369 return 1;
1370 }
1371
1372 int CmdHFiClassCalcNewKey(const char *Cmd) {
1373 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1374 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1375 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1376 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1377 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1378 uint8_t keyNbr = 0;
1379 uint8_t dataLen = 0;
1380 char tempStr[50] = {0};
1381 bool givenCSN = false;
1382 bool oldElite = false;
1383 bool elite = false;
1384 bool errors = false;
1385 uint8_t cmdp = 0;
1386 while(param_getchar(Cmd, cmdp) != 0x00)
1387 {
1388 switch(param_getchar(Cmd, cmdp))
1389 {
1390 case 'h':
1391 case 'H':
1392 return usage_hf_iclass_calc_newkey();
1393 case 'e':
1394 case 'E':
1395 dataLen = param_getstr(Cmd, cmdp, tempStr);
1396 if (dataLen==2)
1397 oldElite = true;
1398 elite = true;
1399 cmdp++;
1400 break;
1401 case 'n':
1402 case 'N':
1403 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1404 if (dataLen == 16) {
1405 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1406 } else if (dataLen == 1) {
1407 keyNbr = param_get8(Cmd, cmdp+1);
1408 if (keyNbr <= ICLASS_KEYS_MAX) {
1409 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1410 } else {
1411 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1412 errors = true;
1413 }
1414 } else {
1415 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1416 errors = true;
1417 }
1418 cmdp += 2;
1419 break;
1420 case 'o':
1421 case 'O':
1422 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1423 if (dataLen == 16) {
1424 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1425 } else if (dataLen == 1) {
1426 keyNbr = param_get8(Cmd, cmdp+1);
1427 if (keyNbr <= ICLASS_KEYS_MAX) {
1428 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1429 } else {
1430 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1431 errors = true;
1432 }
1433 } else {
1434 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1435 errors = true;
1436 }
1437 cmdp += 2;
1438 break;
1439 case 's':
1440 case 'S':
1441 givenCSN = true;
1442 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1443 return usage_hf_iclass_calc_newkey();
1444 cmdp += 2;
1445 break;
1446 default:
1447 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1448 errors = true;
1449 break;
1450 }
1451 if(errors) return usage_hf_iclass_calc_newkey();
1452 }
1453
1454 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1455
1456 if (!givenCSN)
1457 if (!select_only(CSN, CCNR, false, true))
1458 return 0;
1459
1460 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1461 return 0;
1462 }
1463
1464 static int loadKeys(char *filename) {
1465 FILE *f;
1466 f = fopen(filename,"rb");
1467 if(!f) {
1468 PrintAndLog("Failed to read from file '%s'", filename);
1469 return 0;
1470 }
1471 fseek(f, 0, SEEK_END);
1472 long fsize = ftell(f);
1473 fseek(f, 0, SEEK_SET);
1474
1475 uint8_t *dump = malloc(fsize);
1476
1477 size_t bytes_read = fread(dump, 1, fsize, f);
1478 fclose(f);
1479 if (bytes_read > ICLASS_KEYS_MAX * 8){
1480 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1481 free(dump);
1482 return 0;
1483 }
1484 uint8_t i = 0;
1485 for (; i < bytes_read/8; i++){
1486 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1487 }
1488 free(dump);
1489 PrintAndLog("%u keys loaded", i);
1490 return 1;
1491 }
1492
1493 static int saveKeys(char *filename) {
1494 FILE *f;
1495 f = fopen(filename,"wb");
1496 if (f == NULL) {
1497 printf("error opening file %s\n",filename);
1498 return 0;
1499 }
1500 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1501 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1502 PrintAndLog("save key failed to write to file: %s", filename);
1503 break;
1504 }
1505 }
1506 fclose(f);
1507 return 0;
1508 }
1509
1510 static int printKeys(void) {
1511 PrintAndLog("");
1512 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1513 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1514 }
1515 PrintAndLog("");
1516 return 0;
1517 }
1518
1519 int usage_hf_iclass_managekeys(void) {
1520 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1521 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1522 PrintAndLog(" Options:");
1523 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1524 PrintAndLog(" k <key> : set a key in memory");
1525 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1526 PrintAndLog(" s : save keys in memory to file specified by filename");
1527 PrintAndLog(" l : load keys to memory from file specified by filename");
1528 PrintAndLog(" p : print keys loaded into memory\n");
1529 PrintAndLog("Samples:");
1530 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1531 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1532 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1533 PrintAndLog(" print keys : hf iclass managekeys p\n");
1534 return 0;
1535 }
1536
1537 int CmdHFiClassManageKeys(const char *Cmd) {
1538 uint8_t keyNbr = 0;
1539 uint8_t dataLen = 0;
1540 uint8_t KEY[8] = {0};
1541 char filename[FILE_PATH_SIZE];
1542 uint8_t fileNameLen = 0;
1543 bool errors = false;
1544 uint8_t operation = 0;
1545 char tempStr[20];
1546 uint8_t cmdp = 0;
1547
1548 while(param_getchar(Cmd, cmdp) != 0x00)
1549 {
1550 switch(param_getchar(Cmd, cmdp))
1551 {
1552 case 'h':
1553 case 'H':
1554 return usage_hf_iclass_managekeys();
1555 case 'f':
1556 case 'F':
1557 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1558 if (fileNameLen < 1) {
1559 PrintAndLog("No filename found after f");
1560 errors = true;
1561 }
1562 cmdp += 2;
1563 break;
1564 case 'n':
1565 case 'N':
1566 keyNbr = param_get8(Cmd, cmdp+1);
1567 if (keyNbr < 0) {
1568 PrintAndLog("Wrong block number");
1569 errors = true;
1570 }
1571 cmdp += 2;
1572 break;
1573 case 'k':
1574 case 'K':
1575 operation += 3; //set key
1576 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1577 if (dataLen == 16) { //ul-c or ev1/ntag key length
1578 errors = param_gethex(tempStr, 0, KEY, dataLen);
1579 } else {
1580 PrintAndLog("\nERROR: Key is incorrect length\n");
1581 errors = true;
1582 }
1583 cmdp += 2;
1584 break;
1585 case 'p':
1586 case 'P':
1587 operation += 4; //print keys in memory
1588 cmdp++;
1589 break;
1590 case 'l':
1591 case 'L':
1592 operation += 5; //load keys from file
1593 cmdp++;
1594 break;
1595 case 's':
1596 case 'S':
1597 operation += 6; //save keys to file
1598 cmdp++;
1599 break;
1600 default:
1601 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1602 errors = true;
1603 break;
1604 }
1605 if(errors) return usage_hf_iclass_managekeys();
1606 }
1607 if (operation == 0){
1608 PrintAndLog("no operation specified (load, save, or print)\n");
1609 return usage_hf_iclass_managekeys();
1610 }
1611 if (operation > 6){
1612 PrintAndLog("Too many operations specified\n");
1613 return usage_hf_iclass_managekeys();
1614 }
1615 if (operation > 4 && fileNameLen == 0){
1616 PrintAndLog("You must enter a filename when loading or saving\n");
1617 return usage_hf_iclass_managekeys();
1618 }
1619
1620 switch (operation){
1621 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1622 case 4: return printKeys();
1623 case 5: return loadKeys(filename);
1624 case 6: return saveKeys(filename);
1625 break;
1626 }
1627 return 0;
1628 }
1629
1630 static command_t CommandTable[] =
1631 {
1632 {"help", CmdHelp, 1, "This help"},
1633 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1634 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1635 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1636 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1637 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1638 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1639 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1640 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1641 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1642 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1643 {"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
1644 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1645 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1646 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1647 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1648 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
1649 {NULL, NULL, 0, NULL}
1650 };
1651
1652 int CmdHFiClass(const char *Cmd)
1653 {
1654 CmdsParse(CommandTable, Cmd);
1655 return 0;
1656 }
1657
1658 int CmdHelp(const char *Cmd)
1659 {
1660 CmdsHelp(CommandTable);
1661 return 0;
1662 }
Proxmark3 GIT tracking
Impressum, Datenschutz