]> cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhficlass.c
projects / proxmark3-svn / blob
? search:


605793a57ff4028593ea38fe274493ebe30504f9
[proxmark3-svn] / client / cmdhficlass.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3 // Copyright (C) 2011 Gerhard de Koning Gans
4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // High frequency iClass commands
11 //-----------------------------------------------------------------------------
12
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <sys/stat.h>
17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
18 #include "data.h"
19 #include "proxmark3.h"
20 #include "ui.h"
21 #include "cmdparser.h"
22 #include "cmdhficlass.h"
23 #include "common.h"
24 #include "util.h"
25 #include "cmdmain.h"
26 #include "loclass/des.h"
27 #include "loclass/cipherutils.h"
28 #include "loclass/cipher.h"
29 #include "loclass/ikeys.h"
30 #include "loclass/elite_crack.h"
31 #include "loclass/fileutils.h"
32 #include "protocols.h"
33 #include "usb_cmd.h"
34 #include "cmdhfmfu.h"
35
36 #define llX PRIx64
37
38 static int CmdHelp(const char *Cmd);
39
40 #define ICLASS_KEYS_MAX 8
41 static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
49 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
50 };
51
52 typedef struct iclass_block {
53 uint8_t d[8];
54 } iclass_block_t;
55
56 int xorbits_8(uint8_t val) {
57 uint8_t res = val ^ (val >> 1); //1st pass
58 res = res ^ (res >> 1); // 2nd pass
59 res = res ^ (res >> 2); // 3rd pass
60 res = res ^ (res >> 4); // 4th pass
61 return res & 1;
62 }
63
64 int CmdHFiClassList(const char *Cmd) {
65 PrintAndLog("Deprecated command, use 'hf list iclass' instead");
66 return 0;
67 }
68
69 int CmdHFiClassSnoop(const char *Cmd) {
70 UsbCommand c = {CMD_SNOOP_ICLASS};
71 SendCommand(&c);
72 return 0;
73 }
74
75 int usage_hf_iclass_sim(void) {
76 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
77 PrintAndLog(" options");
78 PrintAndLog(" 0 <CSN> simulate the given CSN");
79 PrintAndLog(" 1 simulate default CSN");
80 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
81 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
82 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
83 PrintAndLog(" example: hf iclass sim 2");
84 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
85 PrintAndLog(" hf iclass sim 3");
86 return 0;
87 }
88
89 #define NUM_CSNS 15
90 int CmdHFiClassSim(const char *Cmd) {
91 uint8_t simType = 0;
92 uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
93
94 if (strlen(Cmd)<1) {
95 return usage_hf_iclass_sim();
96 }
97 simType = param_get8ex(Cmd, 0, 0, 10);
98
99 if(simType == 0)
100 {
101 if (param_gethex(Cmd, 1, CSN, 16)) {
102 PrintAndLog("A CSN should consist of 16 HEX symbols");
103 return usage_hf_iclass_sim();
104 }
105
106 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
107 }
108 if(simType > 3)
109 {
110 PrintAndLog("Undefined simptype %d", simType);
111 return usage_hf_iclass_sim();
112 }
113
114 uint8_t numberOfCSNs=0;
115 if(simType == 2)
116 {
117 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
118 UsbCommand resp = {0};
119
120 uint8_t csns[8*NUM_CSNS] = {
121 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
136
137 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
138
139 SendCommand(&c);
140 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
141 PrintAndLog("Command timed out");
142 return 0;
143 }
144
145 uint8_t num_mac_responses = resp.arg[1];
146 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
147
148 size_t datalen = NUM_CSNS*24;
149 /*
150 * Now, time to dump to file. We'll use this format:
151 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
152 * So, it should wind up as
153 * 8 * 24 bytes.
154 *
155 * The returndata from the pm3 is on the following format
156 * <4 byte NR><4 byte MAC>
157 * CC are all zeroes, CSN is the same as was sent in
158 **/
159 void* dump = malloc(datalen);
160 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
161 uint8_t i = 0;
162 for(i = 0 ; i < NUM_CSNS ; i++)
163 {
164 memcpy(dump+i*24, csns+i*8,8); //CSN
165 //8 zero bytes here...
166 //Then comes NR_MAC (eight bytes from the response)
167 memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
168
169 }
170 /** Now, save to dumpfile **/
171 saveFile("iclass_mac_attack", "bin", dump,datalen);
172 free(dump);
173 }else
174 {
175 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
176 memcpy(c.d.asBytes, CSN, 8);
177 SendCommand(&c);
178 }
179
180 return 0;
181 }
182
183 int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
184 bool tagFound = false;
185 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
186 FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
187 // loop in client not device - else on windows have a communication error
188 c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
189 UsbCommand resp;
190 while(!ukbhit()){
191 SendCommand(&c);
192 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
193 uint8_t readStatus = resp.arg[0] & 0xff;
194 uint8_t *data = resp.d.asBytes;
195
196 if (verbose)
197 PrintAndLog("Readstatus:%02x", readStatus);
198 if( readStatus == 0){
199 //Aborted
200 if (verbose) PrintAndLog("Quitting...");
201 return 0;
202 }
203 if( readStatus & FLAG_ICLASS_READER_CSN){
204 PrintAndLog("CSN: %s",sprint_hex(data,8));
205 tagFound = true;
206 }
207 if( readStatus & FLAG_ICLASS_READER_CC) PrintAndLog("CC: %s",sprint_hex(data+16,8));
208 if( readStatus & FLAG_ICLASS_READER_CONF){
209 printIclassDumpInfo(data);
210 }
211 if (tagFound && !loop) return 1;
212 } else {
213 if (verbose) PrintAndLog("Command execute timeout");
214 }
215 if (!loop) break;
216 }
217 return 0;
218 }
219
220 int CmdHFiClassReader(const char *Cmd) {
221 return HFiClassReader(Cmd, true, true);
222 }
223
224 int CmdHFiClassReader_Replay(const char *Cmd) {
225 uint8_t readerType = 0;
226 uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
227
228 if (strlen(Cmd)<1) {
229 PrintAndLog("Usage: hf iclass replay <MAC>");
230 PrintAndLog(" sample: hf iclass replay 00112233");
231 return 0;
232 }
233
234 if (param_gethex(Cmd, 0, MAC, 8)) {
235 PrintAndLog("MAC must include 8 HEX symbols");
236 return 1;
237 }
238
239 UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
240 memcpy(c.d.asBytes, MAC, 4);
241 SendCommand(&c);
242
243 return 0;
244 }
245
246 int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
247 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
248 memcpy(c.d.asBytes, data, blocksCount * 16);
249 SendCommand(&c);
250 return 0;
251 }
252
253 int hf_iclass_eload_usage(void) {
254 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
255 PrintAndLog("Usage: hf iclass eload f <filename>");
256 PrintAndLog("");
257 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
258 return 0;
259 }
260
261 int CmdHFiClassELoad(const char *Cmd) {
262
263 char opt = param_getchar(Cmd, 0);
264 if (strlen(Cmd)<1 || opt == 'h')
265 return hf_iclass_eload_usage();
266
267 //File handling and reading
268 FILE *f;
269 char filename[FILE_PATH_SIZE];
270 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
271 {
272 f = fopen(filename, "rb");
273 }else{
274 return hf_iclass_eload_usage();
275 }
276
277 if(!f) {
278 PrintAndLog("Failed to read from file '%s'", filename);
279 return 1;
280 }
281
282 fseek(f, 0, SEEK_END);
283 long fsize = ftell(f);
284 fseek(f, 0, SEEK_SET);
285
286 uint8_t *dump = malloc(fsize);
287
288
289 size_t bytes_read = fread(dump, 1, fsize, f);
290 fclose(f);
291
292 printIclassDumpInfo(dump);
293 //Validate
294
295 if (bytes_read < fsize)
296 {
297 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
298 free(dump);
299 return 1;
300 }
301 //Send to device
302 uint32_t bytes_sent = 0;
303 uint32_t bytes_remaining = bytes_read;
304
305 while(bytes_remaining > 0){
306 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
307 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
308 memcpy(c.d.asBytes, dump, bytes_in_packet);
309 SendCommand(&c);
310 bytes_remaining -= bytes_in_packet;
311 bytes_sent += bytes_in_packet;
312 }
313 free(dump);
314 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
315 return 0;
316 }
317
318 static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
319 FILE *f = fopen(filename, "rb");
320 if(!f) {
321 PrintAndLog("Failed to read from file '%s'", filename);
322 return 1;
323 }
324 fseek(f, 0, SEEK_END);
325 long fsize = ftell(f);
326 fseek(f, 0, SEEK_SET);
327 size_t bytes_read = fread(buffer, 1, len, f);
328 fclose(f);
329 if(fsize != len)
330 {
331 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
332 return 1;
333 }
334 if(bytes_read != len)
335 {
336 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
337 return 1;
338 }
339 return 0;
340 }
341
342 int usage_hf_iclass_decrypt(void) {
343 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
344 PrintAndLog("");
345 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
346 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
347 PrintAndLog("");
348 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
349 PrintAndLog("");
350 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
351 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
352 PrintAndLog("which is defined by the configuration block.");
353 return 1;
354 }
355
356 int CmdHFiClassDecrypt(const char *Cmd) {
357 uint8_t key[16] = { 0 };
358 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
359 {
360 usage_hf_iclass_decrypt();
361 return 1;
362 }
363 PrintAndLog("Decryption file found... ");
364 char opt = param_getchar(Cmd, 0);
365 if (strlen(Cmd)<1 || opt == 'h')
366 return usage_hf_iclass_decrypt();
367
368 //Open the tagdump-file
369 FILE *f;
370 char filename[FILE_PATH_SIZE];
371 if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
372 {
373 f = fopen(filename, "rb");
374 }else{
375 return usage_hf_iclass_decrypt();
376 }
377
378 fseek(f, 0, SEEK_END);
379 long fsize = ftell(f);
380 fseek(f, 0, SEEK_SET);
381 uint8_t enc_dump[8] = {0};
382 uint8_t *decrypted = malloc(fsize);
383 des3_context ctx = { DES_DECRYPT ,{ 0 } };
384 des3_set2key_dec( &ctx, key);
385 size_t bytes_read = fread(enc_dump, 1, 8, f);
386
387 //Use the first block (CSN) for filename
388 char outfilename[FILE_PATH_SIZE] = { 0 };
389 snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
390 enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
391 enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
392
393 size_t blocknum =0;
394 while(bytes_read == 8)
395 {
396 if(blocknum < 7)
397 {
398 memcpy(decrypted+(blocknum*8), enc_dump, 8);
399 }else{
400 des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
401 }
402 printvar("decrypted block", decrypted +(blocknum*8), 8);
403 bytes_read = fread(enc_dump, 1, 8, f);
404 blocknum++;
405 }
406 fclose(f);
407
408 saveFile(outfilename,"bin", decrypted, blocknum*8);
409
410 return 0;
411 }
412
413 int usage_hf_iclass_encrypt(void) {
414 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
415 PrintAndLog("");
416 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
417 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
418 PrintAndLog("");
419 PrintAndLog("example: hf iclass encrypt 0102030405060708");
420 PrintAndLog("");
421 return 0;
422 }
423
424 static int iClassEncryptBlkData(uint8_t *blkData) {
425 uint8_t key[16] = { 0 };
426 if(readKeyfile("iclass_decryptionkey.bin", 16, key))
427 {
428 usage_hf_iclass_encrypt();
429 return 1;
430 }
431 PrintAndLog("Decryption file found... ");
432
433 uint8_t encryptedData[16];
434 uint8_t *encrypted = encryptedData;
435 des3_context ctx = { DES_DECRYPT ,{ 0 } };
436 des3_set2key_enc( &ctx, key);
437
438 des3_crypt_ecb(&ctx, blkData,encrypted);
439 //printvar("decrypted block", decrypted, 8);
440 memcpy(blkData,encrypted,8);
441
442 return 1;
443 }
444
445 int CmdHFiClassEncryptBlk(const char *Cmd) {
446 uint8_t blkData[8] = {0};
447 char opt = param_getchar(Cmd, 0);
448 if (strlen(Cmd)<1 || opt == 'h')
449 return usage_hf_iclass_encrypt();
450
451 //get the bytes to encrypt
452 if (param_gethex(Cmd, 0, blkData, 16))
453 {
454 PrintAndLog("BlockData must include 16 HEX symbols");
455 return 0;
456 }
457 if (!iClassEncryptBlkData(blkData)) return 0;
458
459 printvar("encrypted block", blkData, 8);
460 return 1;
461 }
462
463 void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
464 uint8_t WB[9];
465 WB[0] = blockno;
466 memcpy(WB + 1,data,8);
467 doMAC_N(WB,sizeof(WB),div_key,MAC);
468 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
469 }
470
471 static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
472 UsbCommand resp;
473
474 UsbCommand c = {CMD_READER_ICLASS, {0}};
475 c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE| FLAG_ICLASS_READER_CC;
476 if (use_credit_key)
477 c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
478
479 clearCommandBuffer();
480 SendCommand(&c);
481 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
482 {
483 PrintAndLog("Command execute timeout");
484 return false;
485 }
486
487 uint8_t isOK = resp.arg[0] & 0xff;
488 uint8_t *data = resp.d.asBytes;
489
490 memcpy(CSN,data,8);
491 if (CCNR!=NULL)memcpy(CCNR,data+16,8);
492 if(isOK > 0)
493 {
494 if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
495 }
496 if(isOK <= 1){
497 PrintAndLog("Failed to obtain CC! Aborting");
498 return false;
499 }
500 return true;
501 }
502
503 static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool verbose) {
504 uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
505 uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
506
507 if (!select_only(CSN, CCNR, use_credit_key, verbose))
508 return false;
509
510 //get div_key
511 HFiClassCalcDivKey(CSN, KEY, div_key, elite);
512
513 doMAC(CCNR, div_key, MAC);
514 UsbCommand resp;
515 UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
516 memcpy(d.d.asBytes, MAC, 4);
517 clearCommandBuffer();
518 SendCommand(&d);
519 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
520 {
521 PrintAndLog("Auth Command execute timeout");
522 return false;
523 }
524 uint8_t isOK = resp.arg[0] & 0xff;
525 if (!isOK) {
526 PrintAndLog("Authentication error");
527 return false;
528 }
529 return true;
530 }
531
532 int usage_hf_iclass_dump(void) {
533 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e\n");
534 PrintAndLog("Options:");
535 PrintAndLog(" f <filename> : specify a filename to save dump to");
536 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
537 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
538 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
539 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
540 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
541 PrintAndLog(" NOTE: * = required");
542 PrintAndLog("Samples:");
543 PrintAndLog(" hf iclass dump k 001122334455667B");
544 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
545 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
546 return 0;
547 }
548
549 int CmdHFiClassReader_Dump(const char *Cmd) {
550
551 uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
552 uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
553 uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
554 uint8_t blockno = 0;
555 uint8_t numblks = 0;
556 uint8_t maxBlk = 31;
557 uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
558 uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
559 uint8_t keyNbr = 0;
560 uint8_t dataLen = 0;
561 uint8_t fileNameLen = 0;
562 char filename[FILE_PATH_SIZE]={0};
563 char tempStr[50] = {0};
564 bool have_debit_key = false;
565 bool have_credit_key = false;
566 bool use_credit_key = false;
567 bool elite = false;
568 bool errors = false;
569 uint8_t cmdp = 0;
570
571 while(param_getchar(Cmd, cmdp) != 0x00)
572 {
573 switch(param_getchar(Cmd, cmdp))
574 {
575 case 'h':
576 case 'H':
577 return usage_hf_iclass_dump();
578 case 'c':
579 case 'C':
580 have_credit_key = true;
581 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
582 if (dataLen == 16) {
583 errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
584 } else if (dataLen == 1) {
585 keyNbr = param_get8(Cmd, cmdp+1);
586 if (keyNbr <= ICLASS_KEYS_MAX) {
587 memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
588 } else {
589 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
590 errors = true;
591 }
592 } else {
593 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
594 errors = true;
595 }
596 cmdp += 2;
597 break;
598 case 'e':
599 case 'E':
600 elite = true;
601 cmdp++;
602 break;
603 case 'f':
604 case 'F':
605 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
606 if (fileNameLen < 1) {
607 PrintAndLog("No filename found after f");
608 errors = true;
609 }
610 cmdp += 2;
611 break;
612 case 'k':
613 case 'K':
614 have_debit_key = true;
615 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
616 if (dataLen == 16) {
617 errors = param_gethex(tempStr, 0, KEY, dataLen);
618 } else if (dataLen == 1) {
619 keyNbr = param_get8(Cmd, cmdp+1);
620 if (keyNbr <= ICLASS_KEYS_MAX) {
621 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
622 } else {
623 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
624 errors = true;
625 }
626 } else {
627 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
628 errors = true;
629 }
630 cmdp += 2;
631 break;
632 default:
633 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
634 errors = true;
635 break;
636 }
637 if(errors) return usage_hf_iclass_dump();
638 }
639
640 if (cmdp < 2) return usage_hf_iclass_dump();
641 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
642 if (!have_debit_key && have_credit_key) use_credit_key = true;
643
644 //get config and first 3 blocks
645 UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
646 FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
647 UsbCommand resp;
648 uint8_t tag_data[255*8];
649
650 clearCommandBuffer();
651 SendCommand(&c);
652 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
653 PrintAndLog("Command execute timeout");
654 return 0;
655 }
656 uint8_t readStatus = resp.arg[0] & 0xff;
657 uint8_t *data = resp.d.asBytes;
658
659 if(readStatus == 0){
660 PrintAndLog("No tag found...");
661 return 0;
662 }
663 if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
664 memcpy(tag_data, data, 8*3);
665 blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
666 numblks = data[8];
667
668 if (data[13] & 0x80) {
669 // large memory - not able to dump pages currently
670 maxBlk = 255;
671 } else {
672 maxBlk = 31;
673 }
674 if (numblks > maxBlk) numblks = maxBlk;
675 }
676 // authenticate debit key and get div_key - later store in dump block 3
677 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
678 //try twice - for some reason it sometimes fails the first time...
679 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
680 ul_switch_off_field();
681 return 0;
682 }
683 }
684
685 // begin dump
686 UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1, 0x88}};
687 clearCommandBuffer();
688 SendCommand(&w);
689 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
690 PrintAndLog("Command execute time-out 1");
691 return 1;
692 }
693 uint32_t blocksRead = resp.arg[1];
694 uint8_t isOK = resp.arg[0] & 0xff;
695 if (!isOK && !blocksRead) {
696 PrintAndLog("Read Block Failed");
697 return 0;
698 }
699 uint32_t startindex = resp.arg[2];
700 if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
701 PrintAndLog("Data exceeded Buffer size!");
702 blocksRead = (sizeof(tag_data)/8) - blockno;
703 }
704 // response ok - now get bigbuf content of the dump
705 GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
706 WaitForResponse(CMD_ACK,NULL);
707 size_t gotBytes = blocksRead*8 + blockno*8;
708
709 // try AA2
710 if (have_credit_key) {
711 //turn off hf field before authenticating with different key
712 ul_switch_off_field();
713 memset(MAC,0,4);
714 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
715 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
716 //try twice - for some reason it sometimes fails the first time...
717 if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
718 ul_switch_off_field();
719 return 0;
720 }
721 }
722 // do we still need to read more block? (aa2 enabled?)
723 if (maxBlk > blockno+numblks+1) {
724 // setup dump and start
725 w.arg[0] = blockno + blocksRead;
726 w.arg[1] = maxBlk - (blockno + blocksRead);
727 w.arg[2] = 0x18;
728 clearCommandBuffer();
729 SendCommand(&w);
730 if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
731 PrintAndLog("Command execute timeout 2");
732 return 0;
733 }
734 uint8_t isOK = resp.arg[0] & 0xff;
735 blocksRead = resp.arg[1];
736 if (!isOK && !blocksRead) {
737 PrintAndLog("Read Block Failed 2");
738 return 0;
739 }
740
741 startindex = resp.arg[2];
742 if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
743 PrintAndLog("Data exceeded Buffer size!");
744 blocksRead = (sizeof(tag_data) - gotBytes)/8;
745 }
746 // get dumped data from bigbuf
747 GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
748 WaitForResponse(CMD_ACK,NULL);
749
750 gotBytes += blocksRead*8;
751 } else { //field is still on - turn it off...
752 ul_switch_off_field();
753 }
754 }
755
756 // add diversified keys to dump
757 if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
758 if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
759 // print the dump
760 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
761 ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
762 printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
763
764 if (filename[0] == 0){
765 snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
766 tag_data[0],tag_data[1],tag_data[2],tag_data[3],
767 tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
768 }
769
770 // save the dump to .bin file
771 PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
772 saveFile(filename, "bin", tag_data, gotBytes);
773 return 1;
774 }
775
776 static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool verbose) {
777 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
778 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
779 uint8_t keyType = (use_credit_key) ? 0x18 : 0x88;
780 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, verbose))
781 return 0;
782
783 UsbCommand resp;
784
785 Calc_wb_mac(blockno,bldata,div_key,MAC);
786 UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno, keyType}};
787 memcpy(w.d.asBytes, bldata, 8);
788 memcpy(w.d.asBytes + 8,MAC, 4);
789
790 clearCommandBuffer();
791 SendCommand(&w);
792 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
793 {
794 PrintAndLog("Write Command execute timeout");
795 return 0;
796 }
797 uint8_t isOK = resp.arg[0] & 0xff;
798 if (!isOK) {
799 PrintAndLog("Write Block Failed");
800 return 0;
801 }
802 PrintAndLog("Write Block Successful");
803
804 return 1;
805 }
806
807 int usage_hf_iclass_writeblock(void) {
808 PrintAndLog("Options:");
809 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
810 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
811 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
812 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
813 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
814 PrintAndLog("Samples:");
815 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
816 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
817 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
818 return 0;
819 }
820
821 int CmdHFiClass_WriteBlock(const char *Cmd) {
822 uint8_t blockno=0;
823 uint8_t bldata[8]={0};
824 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
825 uint8_t keyNbr = 0;
826 uint8_t dataLen = 0;
827 char tempStr[50] = {0};
828 bool use_credit_key = false;
829 bool elite = false;
830 bool errors = false;
831 uint8_t cmdp = 0;
832 while(param_getchar(Cmd, cmdp) != 0x00)
833 {
834 switch(param_getchar(Cmd, cmdp))
835 {
836 case 'h':
837 case 'H':
838 return usage_hf_iclass_writeblock();
839 case 'b':
840 case 'B':
841 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
842 PrintAndLog("Block No must include 2 HEX symbols\n");
843 errors = true;
844 }
845 cmdp += 2;
846 break;
847 case 'c':
848 case 'C':
849 use_credit_key = true;
850 cmdp++;
851 break;
852 case 'd':
853 case 'D':
854 if (param_gethex(Cmd, cmdp+1, bldata, 16))
855 {
856 PrintAndLog("KEY must include 16 HEX symbols\n");
857 errors = true;
858 }
859 cmdp += 2;
860 break;
861 case 'e':
862 case 'E':
863 elite = true;
864 cmdp++;
865 break;
866 case 'k':
867 case 'K':
868 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
869 if (dataLen == 16) {
870 errors = param_gethex(tempStr, 0, KEY, dataLen);
871 } else if (dataLen == 1) {
872 keyNbr = param_get8(Cmd, cmdp+1);
873 if (keyNbr <= ICLASS_KEYS_MAX) {
874 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
875 } else {
876 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
877 errors = true;
878 }
879 } else {
880 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
881 errors = true;
882 }
883 cmdp += 2;
884 break;
885 default:
886 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
887 errors = true;
888 break;
889 }
890 if(errors) return usage_hf_iclass_writeblock();
891 }
892
893 if (cmdp < 6) return usage_hf_iclass_writeblock();
894
895 return WriteBlock(blockno, bldata, KEY, use_credit_key, elite, true);
896 }
897
898 int usage_hf_iclass_clone(void) {
899 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> e c");
900 PrintAndLog("Options:");
901 PrintAndLog(" f <filename>: specify a filename to clone from");
902 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
903 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
904 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
905 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
906 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
907 PrintAndLog("Samples:");
908 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
909 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
910 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
911 return -1;
912 }
913
914 int CmdHFiClassCloneTag(const char *Cmd) {
915 char filename[FILE_PATH_SIZE];
916 char tempStr[50]={0};
917 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
918 uint8_t keyNbr = 0;
919 uint8_t fileNameLen = 0;
920 uint8_t startblock = 0;
921 uint8_t endblock = 0;
922 uint8_t dataLen = 0;
923 bool use_credit_key = false;
924 bool elite = false;
925 bool errors = false;
926 uint8_t cmdp = 0;
927 while(param_getchar(Cmd, cmdp) != 0x00)
928 {
929 switch(param_getchar(Cmd, cmdp))
930 {
931 case 'h':
932 case 'H':
933 return usage_hf_iclass_clone();
934 case 'b':
935 case 'B':
936 if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
937 PrintAndLog("Start Block No must include 2 HEX symbols\n");
938 errors = true;
939 }
940 cmdp += 2;
941 break;
942 case 'c':
943 case 'C':
944 use_credit_key = true;
945 cmdp++;
946 break;
947 case 'e':
948 case 'E':
949 elite = true;
950 cmdp++;
951 break;
952 case 'f':
953 case 'F':
954 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
955 if (fileNameLen < 1) {
956 PrintAndLog("No filename found after f");
957 errors = true;
958 }
959 cmdp += 2;
960 break;
961 case 'k':
962 case 'K':
963 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
964 if (dataLen == 16) {
965 errors = param_gethex(tempStr, 0, KEY, dataLen);
966 } else if (dataLen == 1) {
967 keyNbr = param_get8(Cmd, cmdp+1);
968 if (keyNbr <= ICLASS_KEYS_MAX) {
969 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
970 } else {
971 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
972 errors = true;
973 }
974 } else {
975 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
976 errors = true;
977 }
978 cmdp += 2;
979 break;
980 case 'l':
981 case 'L':
982 if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
983 PrintAndLog("Start Block No must include 2 HEX symbols\n");
984 errors = true;
985 }
986 cmdp += 2;
987 break;
988 default:
989 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
990 errors = true;
991 break;
992 }
993 if(errors) return usage_hf_iclass_clone();
994 }
995
996 if (cmdp < 8) return usage_hf_iclass_clone();
997
998 FILE *f;
999
1000 iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
1001
1002 if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
1003 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
1004 }
1005 // file handling and reading
1006 f = fopen(filename,"rb");
1007 if(!f) {
1008 PrintAndLog("Failed to read from file '%s'", filename);
1009 return 1;
1010 }
1011
1012 if (startblock<5) {
1013 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1014 return 0;
1015 }
1016 // now read data from the file from block 6 --- 19
1017 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1018 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1019 // else we have to create a share memory
1020 int i;
1021 fseek(f,startblock*8,SEEK_SET);
1022 fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f);
1023
1024 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1025 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1026
1027 if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, true))
1028 return 0;
1029
1030 UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock,((use_credit_key) ? 0x18 : 0x88)}};
1031 uint8_t *ptr;
1032 // calculate all mac for every the block we will write
1033 for (i = startblock; i <= endblock; i++){
1034 Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
1035 // usb command d start pointer = d + (i - 6) * 12
1036 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1037 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1038 // next one
1039 ptr = w.d.asBytes + (i - startblock) * 12;
1040 memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
1041 memcpy(ptr + 8,MAC, 4);
1042 }
1043 uint8_t p[12];
1044 for (i = 0; i <= endblock - startblock;i++){
1045 memcpy(p,w.d.asBytes + (i * 12),12);
1046 printf("Block |%02x|",i + startblock);
1047 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
1048 printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
1049 }
1050 UsbCommand resp;
1051 SendCommand(&w);
1052 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1053 {
1054 PrintAndLog("Command execute timeout");
1055 return 0;
1056 }
1057 return 1;
1058 }
1059
1060 static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool verbose) {
1061 uint8_t MAC[4]={0x00,0x00,0x00,0x00};
1062 uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1063
1064 if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, verbose))
1065 return 0;
1066
1067 UsbCommand resp;
1068 UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno, keyType}};
1069 clearCommandBuffer();
1070 SendCommand(&w);
1071 if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
1072 {
1073 PrintAndLog("Command execute timeout");
1074 return 0;
1075 }
1076 uint8_t isOK = resp.arg[0] & 0xff;
1077 if (!isOK) {
1078 PrintAndLog("Read Block Failed");
1079 return 0;
1080 }
1081 //data read is stored in: resp.d.asBytes[0-15]
1082 if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
1083 return 1;
1084 }
1085
1086 int usage_hf_iclass_readblock(void) {
1087 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e\n");
1088 PrintAndLog("Options:");
1089 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1090 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1091 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1092 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1093 PrintAndLog("Samples:");
1094 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1095 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1096 PrintAndLog(" hf iclass readblk b 0A k 0");
1097 return 0;
1098 }
1099
1100 int CmdHFiClass_ReadBlock(const char *Cmd) {
1101 uint8_t blockno=0;
1102 uint8_t keyType = 0x88; //debit key
1103 uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1104 uint8_t keyNbr = 0;
1105 uint8_t dataLen = 0;
1106 char tempStr[50] = {0};
1107 bool elite = false;
1108 bool errors = false;
1109 uint8_t cmdp = 0;
1110 while(param_getchar(Cmd, cmdp) != 0x00)
1111 {
1112 switch(param_getchar(Cmd, cmdp))
1113 {
1114 case 'h':
1115 case 'H':
1116 return usage_hf_iclass_readblock();
1117 case 'b':
1118 case 'B':
1119 if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
1120 PrintAndLog("Block No must include 2 HEX symbols\n");
1121 errors = true;
1122 }
1123 cmdp += 2;
1124 break;
1125 case 'c':
1126 case 'C':
1127 keyType = 0x18;
1128 cmdp++;
1129 break;
1130 case 'e':
1131 case 'E':
1132 elite = true;
1133 cmdp++;
1134 break;
1135 case 'k':
1136 case 'K':
1137 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1138 if (dataLen == 16) {
1139 errors = param_gethex(tempStr, 0, KEY, dataLen);
1140 } else if (dataLen == 1) {
1141 keyNbr = param_get8(Cmd, cmdp+1);
1142 if (keyNbr <= ICLASS_KEYS_MAX) {
1143 memcpy(KEY, iClass_Key_Table[keyNbr], 8);
1144 } else {
1145 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1146 errors = true;
1147 }
1148 } else {
1149 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1150 errors = true;
1151 }
1152 cmdp += 2;
1153 break;
1154 default:
1155 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1156 errors = true;
1157 break;
1158 }
1159 if(errors) return usage_hf_iclass_readblock();
1160 }
1161
1162 if (cmdp < 4) return usage_hf_iclass_readblock();
1163
1164 return ReadBlock(KEY, blockno, keyType, elite, true);
1165 }
1166
1167 int CmdHFiClass_loclass(const char *Cmd) {
1168 char opt = param_getchar(Cmd, 0);
1169
1170 if (strlen(Cmd)<1 || opt == 'h') {
1171 PrintAndLog("Usage: hf iclass loclass [options]");
1172 PrintAndLog("Options:");
1173 PrintAndLog("h Show this help");
1174 PrintAndLog("t Perform self-test");
1175 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1176 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1177 PrintAndLog(" malicious CSNs, and their protocol responses");
1178 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1179 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1180 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1181 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1182 PrintAndLog(" ... totalling N*24 bytes");
1183 return 0;
1184 }
1185 char fileName[255] = {0};
1186 if(opt == 'f')
1187 {
1188 if(param_getstr(Cmd, 1, fileName) > 0)
1189 {
1190 return bruteforceFileNoKeys(fileName);
1191 }else
1192 {
1193 PrintAndLog("You must specify a filename");
1194 }
1195 }
1196 else if(opt == 't')
1197 {
1198 int errors = testCipherUtils();
1199 errors += testMAC();
1200 errors += doKeyTests(0);
1201 errors += testElite();
1202 if(errors)
1203 {
1204 prnlog("OBS! There were errors!!!");
1205 }
1206 return errors;
1207 }
1208
1209 return 0;
1210 }
1211
1212 void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
1213 uint8_t blockdata[8];
1214 uint8_t mem_config;
1215 memcpy(&mem_config, iclass_dump + 13,1);
1216 uint8_t maxmemcount;
1217 uint8_t filemaxblock = filesize / 8;
1218 if (mem_config & 0x80)
1219 maxmemcount = 255;
1220 else
1221 maxmemcount = 31;
1222 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1223
1224 if (startblock == 0)
1225 startblock = 6;
1226 if ((endblock > maxmemcount) || (endblock == 0))
1227 endblock = maxmemcount;
1228 if (endblock > filemaxblock)
1229 endblock = filemaxblock;
1230 int i = startblock;
1231 int j;
1232 while (i <= endblock){
1233 printf("Block |%02X| ",i);
1234 memcpy(blockdata,iclass_dump + (i * 8),8);
1235 for (j = 0;j < 8;j++)
1236 printf("%02X ",blockdata[j]);
1237 printf("|\n");
1238 i++;
1239 }
1240 }
1241
1242 int usage_hf_iclass_readtagfile() {
1243 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1244 return 1;
1245 }
1246
1247 int CmdHFiClassReadTagFile(const char *Cmd) {
1248 int startblock = 0;
1249 int endblock = 0;
1250 char tempnum[5];
1251 FILE *f;
1252 char filename[FILE_PATH_SIZE];
1253 if (param_getstr(Cmd, 0, filename) < 1)
1254 return usage_hf_iclass_readtagfile();
1255 if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
1256 startblock = 0;
1257 else
1258 sscanf(tempnum,"%d",&startblock);
1259
1260 if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
1261 endblock = 0;
1262 else
1263 sscanf(tempnum,"%d",&endblock);
1264 // file handling and reading
1265 f = fopen(filename,"rb");
1266 if(!f) {
1267 PrintAndLog("Failed to read from file '%s'", filename);
1268 return 1;
1269 }
1270 fseek(f, 0, SEEK_END);
1271 long fsize = ftell(f);
1272 fseek(f, 0, SEEK_SET);
1273
1274 uint8_t *dump = malloc(fsize);
1275
1276
1277 size_t bytes_read = fread(dump, 1, fsize, f);
1278 fclose(f);
1279 uint8_t *csn = dump;
1280 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
1281 // printIclassDumpInfo(dump);
1282 printIclassDumpContents(dump,startblock,endblock,bytes_read);
1283 free(dump);
1284 return 0;
1285 }
1286
1287 /*
1288 uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1289 uint64_t new_div = 0x00;
1290 new_div ^= sdiv;
1291 new_div ^= hdiv;
1292 return new_div;
1293 }
1294
1295 uint64_t hexarray_to_uint64(uint8_t *key) {
1296 char temp[17];
1297 uint64_t uint_key;
1298 for (int i = 0;i < 8;i++)
1299 sprintf(&temp[(i *2)],"%02X",key[i]);
1300 temp[16] = '\0';
1301 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1302 return 0;
1303 return uint_key;
1304 }
1305 */
1306 void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite){
1307 uint8_t keytable[128] = {0};
1308 uint8_t key_index[8] = {0};
1309 if (elite) {
1310 uint8_t key_sel[8] = { 0 };
1311 uint8_t key_sel_p[8] = { 0 };
1312 hash2(KEY, keytable);
1313 hash1(CSN, key_index);
1314 for(uint8_t i = 0; i < 8 ; i++)
1315 key_sel[i] = keytable[key_index[i]] & 0xFF;
1316
1317 //Permute from iclass format to standard format
1318 permutekey_rev(key_sel, key_sel_p);
1319 diversifyKey(CSN, key_sel_p, div_key);
1320 } else {
1321 diversifyKey(CSN, KEY, div_key);
1322 }
1323 }
1324
1325 //when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1326 //calculate and return xor_div_key (ready for a key write command)
1327 //print all div_keys if verbose
1328 static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
1329 uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1330 uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1331 //get old div key
1332 HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
1333 //get new div key
1334 HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
1335
1336 for (uint8_t i = 0; i < sizeof(old_div_key); i++){
1337 xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
1338 }
1339 if (verbose) {
1340 printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
1341 printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
1342 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));
1343 }
1344 }
1345
1346 int usage_hf_iclass_calc_newkey(void) {
1347 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1348 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1349 PrintAndLog(" Options:");
1350 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1351 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1352 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1353 PrintAndLog(" e : specify new key as elite calc");
1354 PrintAndLog(" ee : specify old and new key as elite calc");
1355 PrintAndLog("Samples:");
1356 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1357 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1358 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1359 PrintAndLog("NOTE: * = required\n");
1360
1361 return 1;
1362 }
1363
1364 int CmdHFiClassCalcNewKey(const char *Cmd) {
1365 uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1366 uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1367 uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1368 uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1369 uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1370 uint8_t keyNbr = 0;
1371 uint8_t dataLen = 0;
1372 char tempStr[50] = {0};
1373 bool givenCSN = false;
1374 bool oldElite = false;
1375 bool elite = false;
1376 bool errors = false;
1377 uint8_t cmdp = 0;
1378 while(param_getchar(Cmd, cmdp) != 0x00)
1379 {
1380 switch(param_getchar(Cmd, cmdp))
1381 {
1382 case 'h':
1383 case 'H':
1384 return usage_hf_iclass_calc_newkey();
1385 case 'e':
1386 case 'E':
1387 dataLen = param_getstr(Cmd, cmdp, tempStr);
1388 if (dataLen==2)
1389 oldElite = true;
1390 elite = true;
1391 cmdp++;
1392 break;
1393 case 'n':
1394 case 'N':
1395 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1396 if (dataLen == 16) {
1397 errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
1398 } else if (dataLen == 1) {
1399 keyNbr = param_get8(Cmd, cmdp+1);
1400 if (keyNbr <= ICLASS_KEYS_MAX) {
1401 memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
1402 } else {
1403 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1404 errors = true;
1405 }
1406 } else {
1407 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1408 errors = true;
1409 }
1410 cmdp += 2;
1411 break;
1412 case 'o':
1413 case 'O':
1414 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1415 if (dataLen == 16) {
1416 errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
1417 } else if (dataLen == 1) {
1418 keyNbr = param_get8(Cmd, cmdp+1);
1419 if (keyNbr <= ICLASS_KEYS_MAX) {
1420 memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
1421 } else {
1422 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1423 errors = true;
1424 }
1425 } else {
1426 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1427 errors = true;
1428 }
1429 cmdp += 2;
1430 break;
1431 case 's':
1432 case 'S':
1433 givenCSN = true;
1434 if (param_gethex(Cmd, cmdp+1, CSN, 16))
1435 return usage_hf_iclass_calc_newkey();
1436 cmdp += 2;
1437 break;
1438 default:
1439 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1440 errors = true;
1441 break;
1442 }
1443 if(errors) return usage_hf_iclass_calc_newkey();
1444 }
1445
1446 if (cmdp < 4) return usage_hf_iclass_calc_newkey();
1447
1448 if (!givenCSN)
1449 if (!select_only(CSN, CCNR, false, true))
1450 return 0;
1451
1452 HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
1453 return 0;
1454 }
1455
1456 static int loadKeys(char *filename) {
1457 FILE *f;
1458 f = fopen(filename,"rb");
1459 if(!f) {
1460 PrintAndLog("Failed to read from file '%s'", filename);
1461 return 0;
1462 }
1463 fseek(f, 0, SEEK_END);
1464 long fsize = ftell(f);
1465 fseek(f, 0, SEEK_SET);
1466
1467 uint8_t *dump = malloc(fsize);
1468
1469 size_t bytes_read = fread(dump, 1, fsize, f);
1470 fclose(f);
1471 if (bytes_read > ICLASS_KEYS_MAX * 8){
1472 PrintAndLog("File is too long to load - bytes: %u", bytes_read);
1473 free(dump);
1474 return 0;
1475 }
1476 uint8_t i = 0;
1477 for (; i < bytes_read/8; i++){
1478 memcpy(iClass_Key_Table[i],dump+(i*8),8);
1479 }
1480 free(dump);
1481 PrintAndLog("%u keys loaded", i);
1482 return 1;
1483 }
1484
1485 static int saveKeys(char *filename) {
1486 FILE *f;
1487 f = fopen(filename,"wb");
1488 if (f == NULL) {
1489 printf("error opening file %s\n",filename);
1490 return 0;
1491 }
1492 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1493 if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
1494 PrintAndLog("save key failed to write to file: %s", filename);
1495 break;
1496 }
1497 }
1498 fclose(f);
1499 return 0;
1500 }
1501
1502 static int printKeys(void) {
1503 PrintAndLog("");
1504 for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
1505 PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
1506 }
1507 PrintAndLog("");
1508 return 0;
1509 }
1510
1511 int usage_hf_iclass_managekeys(void) {
1512 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1513 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1514 PrintAndLog(" Options:");
1515 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1516 PrintAndLog(" k <key> : set a key in memory");
1517 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1518 PrintAndLog(" s : save keys in memory to file specified by filename");
1519 PrintAndLog(" l : load keys to memory from file specified by filename");
1520 PrintAndLog(" p : print keys loaded into memory\n");
1521 PrintAndLog("Samples:");
1522 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1523 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1524 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1525 PrintAndLog(" print keys : hf iclass managekeys p\n");
1526 return 0;
1527 }
1528
1529 int CmdHFiClassManageKeys(const char *Cmd) {
1530 uint8_t keyNbr = 0;
1531 uint8_t dataLen = 0;
1532 uint8_t KEY[8] = {0};
1533 char filename[FILE_PATH_SIZE];
1534 uint8_t fileNameLen = 0;
1535 bool errors = false;
1536 uint8_t operation = 0;
1537 char tempStr[20];
1538 uint8_t cmdp = 0;
1539
1540 while(param_getchar(Cmd, cmdp) != 0x00)
1541 {
1542 switch(param_getchar(Cmd, cmdp))
1543 {
1544 case 'h':
1545 case 'H':
1546 return usage_hf_iclass_managekeys();
1547 case 'f':
1548 case 'F':
1549 fileNameLen = param_getstr(Cmd, cmdp+1, filename);
1550 if (fileNameLen < 1) {
1551 PrintAndLog("No filename found after f");
1552 errors = true;
1553 }
1554 cmdp += 2;
1555 break;
1556 case 'n':
1557 case 'N':
1558 keyNbr = param_get8(Cmd, cmdp+1);
1559 if (keyNbr < 0) {
1560 PrintAndLog("Wrong block number");
1561 errors = true;
1562 }
1563 cmdp += 2;
1564 break;
1565 case 'k':
1566 case 'K':
1567 operation += 3; //set key
1568 dataLen = param_getstr(Cmd, cmdp+1, tempStr);
1569 if (dataLen == 16) { //ul-c or ev1/ntag key length
1570 errors = param_gethex(tempStr, 0, KEY, dataLen);
1571 } else {
1572 PrintAndLog("\nERROR: Key is incorrect length\n");
1573 errors = true;
1574 }
1575 cmdp += 2;
1576 break;
1577 case 'p':
1578 case 'P':
1579 operation += 4; //print keys in memory
1580 cmdp++;
1581 break;
1582 case 'l':
1583 case 'L':
1584 operation += 5; //load keys from file
1585 cmdp++;
1586 break;
1587 case 's':
1588 case 'S':
1589 operation += 6; //save keys to file
1590 cmdp++;
1591 break;
1592 default:
1593 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
1594 errors = true;
1595 break;
1596 }
1597 if(errors) return usage_hf_iclass_managekeys();
1598 }
1599 if (operation == 0){
1600 PrintAndLog("no operation specified (load, save, or print)\n");
1601 return usage_hf_iclass_managekeys();
1602 }
1603 if (operation > 6){
1604 PrintAndLog("Too many operations specified\n");
1605 return usage_hf_iclass_managekeys();
1606 }
1607 if (operation > 4 && fileNameLen == 0){
1608 PrintAndLog("You must enter a filename when loading or saving\n");
1609 return usage_hf_iclass_managekeys();
1610 }
1611
1612 switch (operation){
1613 case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
1614 case 4: return printKeys();
1615 case 5: return loadKeys(filename);
1616 case 6: return saveKeys(filename);
1617 break;
1618 }
1619 return 0;
1620 }
1621
1622 static command_t CommandTable[] =
1623 {
1624 {"help", CmdHelp, 1, "This help"},
1625 {"calcnewkey", CmdHFiClassCalcNewKey, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1626 {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
1627 {"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
1628 {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1629 {"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1630 {"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
1631 {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
1632 {"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1633 {"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
1634 {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
1635 {"reader", CmdHFiClassReader, 0, " Read an iClass tag"},
1636 {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
1637 {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
1638 {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
1639 {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
1640 {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
1641 {NULL, NULL, 0, NULL}
1642 };
1643
1644 int CmdHFiClass(const char *Cmd)
1645 {
1646 CmdsParse(CommandTable, Cmd);
1647 return 0;
1648 }
1649
1650 int CmdHelp(const char *Cmd)
1651 {
1652 CmdsHelp(CommandTable);
1653 return 0;
1654 }
Proxmark3 GIT tracking
Impressum, Datenschutz