cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhfmfdes.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2014 Iceman
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency MIFARE Desfire commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <string.h>
  14 #include <ctype.h>
  15 #include <openssl/des.h>
  16 #include "cmdmain.h"
  17 #include "proxmark3.h"
  18 #include "../include/common.h"
  19 #include "../include/mifare.h"
  20 #include "../common/iso14443crc.h"
  21 #include "data.h"
  22 #include "ui.h"
  23 #include "cmdparser.h"
  24 #include "util.h"
  25 #include "cmdhfmfdes.h"
  26
  27
  28 uint8_t key_zero_data[16] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
  29 uint8_t key_defa_data[16] = { 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f };
  30 uint8_t key_ones_data[16] = { 0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01 };
  31
  32
  33 static int CmdHelp(const char *Cmd);
  34 static void xor(unsigned char * dst, unsigned char * src, size_t len);
  35 static int32_t le24toh (uint8_t data[3]);
  36
  37
  38 int CmdHF14ADesWb(const char *Cmd)
  39 {
  40 /*      uint8_t blockNo = 0;
  41         uint8_t keyType = 0;
  42         uint8_t key[6] = {0, 0, 0, 0, 0, 0};
  43         uint8_t bldata[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
  44
  45         char cmdp       = 0x00;
  46
  47         if (strlen(Cmd)<3) {
  48                 PrintAndLog("Usage:  hf mf wrbl    <block number> <key A/B> <key (12 hex symbols)> <block data (32 hex symbols)>");
  49                 PrintAndLog("        sample: hf mf wrbl 0 A FFFFFFFFFFFF 000102030405060708090A0B0C0D0E0F");
  50                 return 0;
  51         }
  52
  53         blockNo = param_get8(Cmd, 0);
  54         cmdp = param_getchar(Cmd, 1);
  55         if (cmdp == 0x00) {
  56                 PrintAndLog("Key type must be A or B");
  57                 return 1;
  58         }
  59         if (cmdp != 'A' && cmdp != 'a') keyType = 1;
  60         if (param_gethex(Cmd, 2, key, 12)) {
  61                 PrintAndLog("Key must include 12 HEX symbols");
  62                 return 1;
  63         }
  64         if (param_gethex(Cmd, 3, bldata, 32)) {
  65                 PrintAndLog("Block data must include 32 HEX symbols");
  66                 return 1;
  67         }
  68         PrintAndLog("--block no:%02x key type:%02x key:%s", blockNo, keyType, sprint_hex(key, 6));
  69         PrintAndLog("--data: %s", sprint_hex(bldata, 16));
  70
  71   UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};
  72         memcpy(c.d.asBytes, key, 6);
  73         memcpy(c.d.asBytes + 10, bldata, 16);
  74   SendCommand(&c);
  75
  76         UsbCommand resp;
  77         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
  78                 uint8_t isOK  = resp.arg[0] & 0xff;
  79                 PrintAndLog("isOk:%02x", isOK);
  80         } else {
  81                 PrintAndLog("Command execute timeout");
  82         }
  83  */
  84         return 0;
  85 }
  86
  87 int CmdHF14ADesRb(const char *Cmd)
  88 {
  89         // uint8_t blockNo = 0;
  90         // uint8_t keyType = 0;
  91         // uint8_t key[6] = {0, 0, 0, 0, 0, 0};
  92
  93         // char cmdp    = 0x00;
  94
  95
  96         // if (strlen(Cmd)<3) {
  97                 // PrintAndLog("Usage:  hf mf rdbl    <block number> <key A/B> <key (12 hex symbols)>");
  98                 // PrintAndLog("        sample: hf mf rdbl 0 A FFFFFFFFFFFF ");
  99                 // return 0;
 100         // }
 101
 102         // blockNo = param_get8(Cmd, 0);
 103         // cmdp = param_getchar(Cmd, 1);
 104         // if (cmdp == 0x00) {
 105                 // PrintAndLog("Key type must be A or B");
 106                 // return 1;
 107         // }
 108         // if (cmdp != 'A' && cmdp != 'a') keyType = 1;
 109         // if (param_gethex(Cmd, 2, key, 12)) {
 110                 // PrintAndLog("Key must include 12 HEX symbols");
 111                 // return 1;
 112         // }
 113         // PrintAndLog("--block no:%02x key type:%02x key:%s ", blockNo, keyType, sprint_hex(key, 6));
 114
 115   // UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};
 116         // memcpy(c.d.asBytes, key, 6);
 117   // SendCommand(&c);
 118
 119         // UsbCommand resp;
 120         // if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 121                 // uint8_t                isOK  = resp.arg[0] & 0xff;
 122                 // uint8_t              * data  = resp.d.asBytes;
 123
 124                 // if (isOK)
 125                         // PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 16));
 126                 // else
 127                         // PrintAndLog("isOk:%02x", isOK);
 128         // } else {
 129                 // PrintAndLog("Command execute timeout");
 130         // }
 131
 132   return 0;
 133 }
 134
 135 int CmdHF14ADesInfo(const char *Cmd){
 136
 137         UsbCommand c = {CMD_MIFARE_DESFIRE_INFO};
 138     SendCommand(&c);
 139         UsbCommand resp;
 140
 141         if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500) ) {
 142                 PrintAndLog("Command execute timeout");
 143                 return 0;
 144         }
 145         uint8_t isOK  = resp.arg[0] & 0xff;
 146         if ( !isOK ){
 147                 PrintAndLog("Command unsuccessfull");
 148                 return 0;
 149         }
 150
 151         PrintAndLog("---Desfire Information---------------------------------------");
 152         PrintAndLog("-------------------------------------------------------------");
 153         PrintAndLog("  UID                : %s",sprint_hex(resp.d.asBytes, 7));
 154         PrintAndLog("  Batch number       : %s",sprint_hex(resp.d.asBytes+28,5));
 155         PrintAndLog("  Production date    : week %02x, 20%02x",resp.d.asBytes[33], resp.d.asBytes[34]);
 156         PrintAndLog("-------------------------------------------------------------");
 157         PrintAndLog("  Hardware Information");
 158         PrintAndLog("      Vendor Id      : %s", GetVendorStr(resp.d.asBytes[7]));
 159         PrintAndLog("      Type           : 0x%02X",resp.d.asBytes[8]);
 160         PrintAndLog("      Subtype        : 0x%02X",resp.d.asBytes[9]);
 161         PrintAndLog("      Version        : %d.%d",resp.d.asBytes[10], resp.d.asBytes[11]);
 162         PrintAndLog("      Storage size   : %s",GetCardSizeStr(resp.d.asBytes[12]));
 163         PrintAndLog("      Protocol       : %s",GetProtocolStr(resp.d.asBytes[13]));
 164         PrintAndLog("-------------------------------------------------------------");
 165         PrintAndLog("  Software Information");
 166         PrintAndLog("      Vendor Id      : %s",GetVendorStr(resp.d.asBytes[14]));
 167         PrintAndLog("      Type           : 0x%02X",resp.d.asBytes[15]);
 168         PrintAndLog("      Subtype        : 0x%02X",resp.d.asBytes[16]);
 169         PrintAndLog("      Version        : %d.%d",resp.d.asBytes[17], resp.d.asBytes[18]);
 170         PrintAndLog("      storage size   : %s", GetCardSizeStr(resp.d.asBytes[19]));
 171         PrintAndLog("      Protocol       : %s", GetProtocolStr(resp.d.asBytes[20]));
 172         PrintAndLog("-------------------------------------------------------------");
 173
 174
 175         UsbCommand c1 = {CMD_MIFARE_DESFIRE, { 0x01, 0x01 }};
 176         c1.d.asBytes[0] = GET_KEY_SETTINGS;
 177     SendCommand(&c1);
 178         if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500) ) {
 179                 return 0;
 180         }
 181
 182         PrintAndLog("  Master Key settings");
 183         if (  resp.d.asBytes[3] & (1 << 3 ) )
 184                 PrintAndLog("     0x08 Configuration changeable;");
 185         else
 186                 PrintAndLog("     0x08 Configuration NOT changeable;");
 187
 188         if (  resp.d.asBytes[3] & (1 << 2 ) )
 189                 PrintAndLog("     0x04 PICC Master Key not required for create / delete;");
 190         else
 191                 PrintAndLog("     0x04 PICC Master Key required for create / delete;");
 192
 193         if (  resp.d.asBytes[3] & (1 << 1 ) )
 194                 PrintAndLog("     0x02 Free directory list access without PICC Master Key;");
 195         else
 196                 PrintAndLog("     0x02 Directory list access with PICC Master Key;");
 197
 198         if (  resp.d.asBytes[3] & (1 << 0 ) )
 199                 PrintAndLog("     0x01 Allow changing the Master Key;");
 200         else
 201                 PrintAndLog("     0x01 Master Key is not changeable anymore;");
 202
 203         //                                      init   len
 204         UsbCommand c2 = {CMD_MIFARE_DESFIRE, { 0x01, 0x02 }};
 205     c2.d.asBytes[0] = GET_KEY_VERSION;
 206         c2.d.asBytes[1] = 0x00;
 207         SendCommand(&c2);
 208         if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500) ) {
 209                 return 0;
 210         }
 211
 212         PrintAndLog("");
 213         PrintAndLog("     Max number of keys  : %d", resp.d.asBytes[2]);
 214         PrintAndLog("     Master key Version  : %d (0x%02x)", resp.d.asBytes[3], resp.d.asBytes[3]);
 215         PrintAndLog("-------------------------------------------------------------");
 216
 217
 218         UsbCommand c3 = {CMD_MIFARE_DESFIRE, { 0x01, 0x01 }};
 219         c3.d.asBytes[0] = GET_FREE_MEMORY;
 220     SendCommand(&c3);
 221         if ( !WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 222                 return 0;
 223         }
 224
 225         uint8_t tmp[3];
 226         memcpy(tmp, resp.d.asBytes+3,3);
 227
 228         PrintAndLog("     Free memory on card : %d bytes", le24toh( tmp ));
 229         PrintAndLog("-------------------------------------------------------------");
 230         /*
 231                 Card Master key (CMK)  0x00 on AID = 00 00 00 (card level)
 232                 0x1
 233
 234                 Application Master Key (AMK) 0x00 on AID != 00 00 00
 235                 Application keys (APK) = 0x01-0x0D
 236                 Application free = 0x0E
 237                 Application never = 0x0F
 238
 239                 ACCESS RIGHTS:
 240                 keys 0,1,2,3     C
 241                 keys 4,5,6,7     RW
 242                 keys 8,9,10,11   W
 243                 keys 12,13,14,15 R
 244
 245                 KEY Versioning.
 246                         Se GetKeyVersion (samma nyckel kan ha olika versionen?)
 247
 248                 Session key:
 249                         16 : RndA(byte0-byte3) + RndB(byte0-byte3) + RndA(byte4-byte7) + RndB(byte4-byte7)
 250                         8  : RndA(byte0-byte3) + RndB(byte0-byte3)
 251
 252                         AES 16 : RndA(byte0-byte3) + RndB(byte0-byte3) + RndA(byte12-byte15) + RndB(byte12-byte15)
 253         */
 254
 255     return 1;
 256 }
 257
 258 char * GetVendorStr( uint8_t id){
 259         static char buf[30];
 260         char *retStr = buf;
 261
 262         if ( id == 0x04 )
 263                 sprintf(retStr, "0x%02X (NXP)",id);
 264         else
 265                 sprintf(retStr,"0x%02X (Unknown)",id);
 266         return buf;
 267 }
 268
 269 /*
 270   The 7 MSBits (= n) code the storage size itself based on 2^n,
 271   the LSBit is set to '0' if the size is exactly 2^n
 272         and set to '1' if the storage size is between 2^n and 2^(n+1).
 273         For this version of DESFire the 7 MSBits are set to 0x0C (2^12 = 4096) and the LSBit is '0'.
 274 */
 275 char * GetCardSizeStr( uint8_t fsize ){
 276
 277         static char buf[30];
 278         char *retStr = buf;
 279
 280         uint16_t usize = 1 << ((fsize >>1) + 1);
 281         uint16_t lsize = 1 << (fsize >>1);
 282
 283         // is  LSB set?
 284         if (  fsize & (1 << 0 ) )
 285                 sprintf(retStr, "0x%02X (%d - %d bytes)",fsize, usize, lsize);
 286         else
 287                 sprintf(retStr, "0x%02X (%d bytes)", fsize, lsize);
 288         return buf;
 289 }
 290
 291 char * GetProtocolStr(uint8_t id){
 292
 293         static char buf[30];
 294         char *retStr = buf;
 295
 296         if ( id == 0x05)
 297                 sprintf(retStr,"0x%02X (ISO 14443-3, 14443-4)", id);
 298         else
 299                 sprintf(retStr,"0x%02X", id);
 300         return buf;
 301 }
 302
 303 int CmdHF14ADesEnumApplications(const char *Cmd){
 304         return 1;
 305 }
 306
 307 int CmdHF14ADesNonces(const char *Cmd){
 308         return 1;
 309 }
 310
 311 //
 312 // MIAFRE DesFire Authentication
 313 //
 314 #define BUFSIZE 64
 315 int CmdHF14ADesAuth(const char *Cmd){
 316
 317         // NR  DESC             KEYLENGHT
 318         // ------------------------
 319         // 1 = DES              8
 320         // 2 = 3DES             16
 321         // 3 = 3K 3DES  24
 322         // 4 = AES              16
 323
 324         // AUTHENTICTION MODES:
 325         // 1 Normal
 326         // 2 ISO
 327         // 3 AES
 328
 329         uint8_t keylength = 8;
 330         //unsigned char testinput[] = { 0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xdd,0xee,0xff,0x00};
 331         unsigned char key[24]; // =       { 0x75,0x28,0x78,0x39,0x74,0x93,0xCB,0x70};
 332
 333     if (strlen(Cmd)<3) {
 334         PrintAndLog("Usage:  hf mfdes auth <1|2|3> <1|2|3|4> <keyno> <key> ");
 335                 PrintAndLog("               AUTH modes 1 = normal, 2 = iso, 3 = aes");
 336                 PrintAndLog("               Crypto: 1 = DES 2 = 3DES 3 = 3K3DES 4 = AES");
 337                 PrintAndLog("               keynumber");
 338         PrintAndLog("        sample: hf mfdes auth 1 1 0 11223344");
 339         return 0;
 340     }
 341         uint8_t cmdAuthMode     = param_get8(Cmd,0);
 342         uint8_t cmdAuthAlgo     = param_get8(Cmd,1);
 343         uint8_t cmdKeyNo        = param_get8(Cmd,2);
 344
 345         switch (cmdAuthMode)
 346         {
 347                 case 1:
 348                         if ( cmdAuthAlgo != 1 && cmdAuthAlgo != 2) {
 349                                 PrintAndLog("Crypto algo not valid for the auth mode");
 350                                 return 1;
 351                         }
 352                         break;
 353                 case 2:
 354                         if ( cmdAuthAlgo != 1 && cmdAuthAlgo != 2 && cmdAuthAlgo != 3) {
 355                                 PrintAndLog("Crypto algo not valid for the auth mode");
 356                                 return 1;
 357                         }
 358                         break;
 359                 case 3:
 360                         if ( cmdAuthAlgo != 4) {
 361                                 PrintAndLog("Crypto algo not valid for the auth mode");
 362                                 return 1;
 363                         }
 364                         break;
 365                 default:
 366                         PrintAndLog("Wrong Auth mode");
 367                         return 1;
 368                         break;
 369         }
 370
 371         switch (cmdAuthAlgo){
 372                 case 2:
 373                         keylength = 16;
 374                         PrintAndLog("3DES selected");
 375                         break;
 376                 case 3:
 377                         keylength = 24;
 378                         PrintAndLog("3 key 3DES selected");
 379                         break;
 380                 case 4:
 381                         keylength = 16;
 382                         PrintAndLog("AES selected");
 383                         break;
 384                 default:
 385                         cmdAuthAlgo = 1;
 386                         keylength = 8;
 387                         PrintAndLog("DES selected");
 388                         break;
 389         }
 390
 391         // key
 392         if (param_gethex(Cmd, 3, key, keylength*2)) {
 393                 PrintAndLog("Key must include %d HEX symbols", keylength);
 394                 return 1;
 395         }
 396         // algo, nyckellängd,
 397         UsbCommand c = {CMD_MIFARE_DESFIRE_AUTH1, { cmdAuthMode, cmdAuthAlgo, cmdKeyNo }};
 398
 399         c.d.asBytes[0] = keylength;
 400         memcpy(c.d.asBytes+1, key, keylength);
 401         //memcpy(c.d.asBytes + 30, testinput, keylength);
 402
 403     SendCommand(&c);
 404         UsbCommand resp;
 405
 406         if (WaitForResponseTimeout(CMD_ACK,&resp,3000)) {
 407                 uint8_t isOK  = resp.arg[0] & 0xff;
 408                 PrintAndLog("isOk:%02x", isOK);
 409
 410         } else {
 411                 PrintAndLog("Command execute timeout");
 412                 return 0;
 413         }
 414
 415         uint8_t * data= resp.d.asBytes;
 416
 417         // PrintAndLog("-------------------------------------------------------------");
 418          PrintAndLog("  Key        :%s",sprint_hex(key, keylength));
 419         // PrintAndLog("  Plain      :%s",sprint_hex(testinput, keylength));
 420         PrintAndLog("  Encoded    :%s",sprint_hex(data, keylength));
 421         PrintAndLog("-------------------------------------------------------------");
 422         //PrintAndLog("  Expected   :B5 21 9E E8 1A A7 49 9D 21 96 68 7E 13 97 38 56");
 423
 424     return 1;
 425 }
 426
 427
 428 static void xor(unsigned char * dst, unsigned char * src, size_t len) {
 429    for( ; len > 0; len--,dst++,src++)
 430        *dst ^= *src;
 431 }
 432
 433 static int32_t le24toh (uint8_t data[3]) {
 434     return (data[2] << 16) | (data[1] << 8) | data[0];
 435 }
 436
 437 static command_t CommandTable[] =
 438 {
 439   {"help",              CmdHelp,                                        1, "This help"},
 440   {"auth",              CmdHF14ADesAuth,                        0, "Tries a MIFARE DesFire Authentication"},
 441   {"rb",                CmdHF14ADesRb,                          0, "Read MIFARE DesFire block"},
 442   {"wb",                CmdHF14ADesWb,                          0, "write MIFARE DesFire block"},
 443   {"info",              CmdHF14ADesInfo,                        0, "Get MIFARE DesFire information"},
 444   {"enum",              CmdHF14ADesEnumApplications,0, "Tries enumerate all applications"},
 445   {"nonce",             CmdHF14ADesNonces,                      0, "<n> Collect n>0 nonces"},
 446   {NULL, NULL, 0, NULL}
 447 };
 448
 449 int CmdHFMFDes(const char *Cmd)
 450 {
 451    // flush
 452    WaitForResponseTimeout(CMD_ACK,NULL,100);
 453    CmdsParse(CommandTable, Cmd);
 454   return 0;
 455 }
 456
 457 int CmdHelp(const char *Cmd)
 458 {
 459   CmdsHelp(CommandTable);
 460   return 0;
 461 }
 462
 463