1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
3 // Copyright (C) 2011 Gerhard de Koning Gans
4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
9 //-----------------------------------------------------------------------------
10 // High frequency iClass commands
11 //-----------------------------------------------------------------------------
17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
19 #include "proxmark3.h"
21 #include "cmdparser.h"
22 #include "cmdhficlass.h"
26 #include "loclass/des.h"
27 #include "loclass/cipherutils.h"
28 #include "loclass/cipher.h"
29 #include "loclass/ikeys.h"
30 #include "loclass/elite_crack.h"
31 #include "loclass/fileutils.h"
32 #include "protocols.h"
38 static int CmdHelp(const char *Cmd
);
40 #define ICLASS_KEYS_MAX 8
41 static uint8_t iClass_Key_Table
[ICLASS_KEYS_MAX
][8] = {
42 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
43 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
44 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
45 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
46 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
47 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
48 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
49 { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
52 typedef struct iclass_block
{
56 int xorbits_8(uint8_t val
) {
57 uint8_t res
= val
^ (val
>> 1); //1st pass
58 res
= res
^ (res
>> 1); // 2nd pass
59 res
= res
^ (res
>> 2); // 3rd pass
60 res
= res
^ (res
>> 4); // 4th pass
64 int CmdHFiClassList(const char *Cmd
) {
65 PrintAndLog("Deprecated command, use 'hf list iclass' instead");
69 int CmdHFiClassSnoop(const char *Cmd
) {
70 UsbCommand c
= {CMD_SNOOP_ICLASS
};
75 int usage_hf_iclass_sim(void) {
76 PrintAndLog("Usage: hf iclass sim <option> [CSN]");
77 PrintAndLog(" options");
78 PrintAndLog(" 0 <CSN> simulate the given CSN");
79 PrintAndLog(" 1 simulate default CSN");
80 PrintAndLog(" 2 Reader-attack, gather reader responses to extract elite key");
81 PrintAndLog(" 3 Full simulation using emulator memory (see 'hf iclass eload')");
82 PrintAndLog(" example: hf iclass sim 0 031FEC8AF7FF12E0");
83 PrintAndLog(" example: hf iclass sim 2");
84 PrintAndLog(" example: hf iclass eload 'tagdump.bin'");
85 PrintAndLog(" hf iclass sim 3");
90 int CmdHFiClassSim(const char *Cmd
) {
92 uint8_t CSN
[8] = {0, 0, 0, 0, 0, 0, 0, 0};
95 return usage_hf_iclass_sim();
97 simType
= param_get8ex(Cmd
, 0, 0, 10);
101 if (param_gethex(Cmd
, 1, CSN
, 16)) {
102 PrintAndLog("A CSN should consist of 16 HEX symbols");
103 return usage_hf_iclass_sim();
106 PrintAndLog("--simtype:%02x csn:%s", simType
, sprint_hex(CSN
, 8));
110 PrintAndLog("Undefined simptype %d", simType
);
111 return usage_hf_iclass_sim();
114 uint8_t numberOfCSNs
=0;
117 UsbCommand c
= {CMD_SIMULATE_TAG_ICLASS
, {simType
,NUM_CSNS
}};
118 UsbCommand resp
= {0};
120 uint8_t csns
[8*NUM_CSNS
] = {
121 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
122 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
123 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
124 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
125 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
126 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
127 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
128 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
129 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
130 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
131 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
132 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
133 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
134 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
135 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
137 memcpy(c
.d
.asBytes
, csns
, 8*NUM_CSNS
);
140 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, -1)) {
141 PrintAndLog("Command timed out");
145 uint8_t num_mac_responses
= resp
.arg
[1];
146 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses
,NUM_CSNS
);
148 size_t datalen
= NUM_CSNS
*24;
150 * Now, time to dump to file. We'll use this format:
151 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
152 * So, it should wind up as
155 * The returndata from the pm3 is on the following format
156 * <4 byte NR><4 byte MAC>
157 * CC are all zeroes, CSN is the same as was sent in
159 void* dump
= malloc(datalen
);
160 memset(dump
,0,datalen
);//<-- Need zeroes for the CC-field
162 for(i
= 0 ; i
< NUM_CSNS
; i
++)
164 memcpy(dump
+i
*24, csns
+i
*8,8); //CSN
165 //8 zero bytes here...
166 //Then comes NR_MAC (eight bytes from the response)
167 memcpy(dump
+i
*24+16,resp
.d
.asBytes
+i
*8,8);
170 /** Now, save to dumpfile **/
171 saveFile("iclass_mac_attack", "bin", dump
,datalen
);
175 UsbCommand c
= {CMD_SIMULATE_TAG_ICLASS
, {simType
,numberOfCSNs
}};
176 memcpy(c
.d
.asBytes
, CSN
, 8);
183 int HFiClassReader(const char *Cmd
, bool loop
, bool verbose
) {
184 bool tagFound
= false;
185 UsbCommand c
= {CMD_READER_ICLASS
, {FLAG_ICLASS_READER_CSN
|
186 FLAG_ICLASS_READER_CONF
|FLAG_ICLASS_READER_AA
}};
187 // loop in client not device - else on windows have a communication error
188 c
.arg
[0] |= FLAG_ICLASS_READER_ONLY_ONCE
| FLAG_ICLASS_READER_ONE_TRY
;
192 if (WaitForResponseTimeout(CMD_ACK
,&resp
, 4500)) {
193 uint8_t readStatus
= resp
.arg
[0] & 0xff;
194 uint8_t *data
= resp
.d
.asBytes
;
197 PrintAndLog("Readstatus:%02x", readStatus
);
198 if( readStatus
== 0){
200 if (verbose
) PrintAndLog("Quitting...");
203 if( readStatus
& FLAG_ICLASS_READER_CSN
){
204 PrintAndLog("CSN: %s",sprint_hex(data
,8));
207 if( readStatus
& FLAG_ICLASS_READER_CC
) PrintAndLog("CC: %s",sprint_hex(data
+16,8));
208 if( readStatus
& FLAG_ICLASS_READER_CONF
){
209 printIclassDumpInfo(data
);
211 if (tagFound
&& !loop
) return 1;
213 if (verbose
) PrintAndLog("Command execute timeout");
220 int CmdHFiClassReader(const char *Cmd
) {
221 return HFiClassReader(Cmd
, true, true);
224 int CmdHFiClassReader_Replay(const char *Cmd
) {
225 uint8_t readerType
= 0;
226 uint8_t MAC
[4]={0x00, 0x00, 0x00, 0x00};
229 PrintAndLog("Usage: hf iclass replay <MAC>");
230 PrintAndLog(" sample: hf iclass replay 00112233");
234 if (param_gethex(Cmd
, 0, MAC
, 8)) {
235 PrintAndLog("MAC must include 8 HEX symbols");
239 UsbCommand c
= {CMD_READER_ICLASS_REPLAY
, {readerType
}};
240 memcpy(c
.d
.asBytes
, MAC
, 4);
246 int iclassEmlSetMem(uint8_t *data
, int blockNum
, int blocksCount
) {
247 UsbCommand c
= {CMD_MIFARE_EML_MEMSET
, {blockNum
, blocksCount
, 0}};
248 memcpy(c
.d
.asBytes
, data
, blocksCount
* 16);
253 int hf_iclass_eload_usage(void) {
254 PrintAndLog("Loads iclass tag-dump into emulator memory on device");
255 PrintAndLog("Usage: hf iclass eload f <filename>");
257 PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
261 int CmdHFiClassELoad(const char *Cmd
) {
263 char opt
= param_getchar(Cmd
, 0);
264 if (strlen(Cmd
)<1 || opt
== 'h')
265 return hf_iclass_eload_usage();
267 //File handling and reading
269 char filename
[FILE_PATH_SIZE
];
270 if(opt
== 'f' && param_getstr(Cmd
, 1, filename
) > 0)
272 f
= fopen(filename
, "rb");
274 return hf_iclass_eload_usage();
278 PrintAndLog("Failed to read from file '%s'", filename
);
282 fseek(f
, 0, SEEK_END
);
283 long fsize
= ftell(f
);
284 fseek(f
, 0, SEEK_SET
);
286 uint8_t *dump
= malloc(fsize
);
289 size_t bytes_read
= fread(dump
, 1, fsize
, f
);
292 printIclassDumpInfo(dump
);
295 if (bytes_read
< fsize
)
297 prnlog("Error, could only read %d bytes (should be %d)",bytes_read
, fsize
);
302 uint32_t bytes_sent
= 0;
303 uint32_t bytes_remaining
= bytes_read
;
305 while(bytes_remaining
> 0){
306 uint32_t bytes_in_packet
= MIN(USB_CMD_DATA_SIZE
, bytes_remaining
);
307 UsbCommand c
= {CMD_ICLASS_EML_MEMSET
, {bytes_sent
,bytes_in_packet
,0}};
308 memcpy(c
.d
.asBytes
, dump
, bytes_in_packet
);
310 bytes_remaining
-= bytes_in_packet
;
311 bytes_sent
+= bytes_in_packet
;
314 PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent
);
318 static int readKeyfile(const char *filename
, size_t len
, uint8_t* buffer
) {
319 FILE *f
= fopen(filename
, "rb");
321 PrintAndLog("Failed to read from file '%s'", filename
);
324 fseek(f
, 0, SEEK_END
);
325 long fsize
= ftell(f
);
326 fseek(f
, 0, SEEK_SET
);
327 size_t bytes_read
= fread(buffer
, 1, len
, f
);
331 PrintAndLog("Warning, file size is %d, expected %d", fsize
, len
);
334 if(bytes_read
!= len
)
336 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read
, len
);
342 int usage_hf_iclass_decrypt(void) {
343 PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
345 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
346 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
348 PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
350 PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
351 PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
352 PrintAndLog("which is defined by the configuration block.");
356 int CmdHFiClassDecrypt(const char *Cmd
) {
357 uint8_t key
[16] = { 0 };
358 if(readKeyfile("iclass_decryptionkey.bin", 16, key
))
360 usage_hf_iclass_decrypt();
363 PrintAndLog("Decryption file found... ");
364 char opt
= param_getchar(Cmd
, 0);
365 if (strlen(Cmd
)<1 || opt
== 'h')
366 return usage_hf_iclass_decrypt();
368 //Open the tagdump-file
370 char filename
[FILE_PATH_SIZE
];
371 if(opt
== 'f' && param_getstr(Cmd
, 1, filename
) > 0)
373 f
= fopen(filename
, "rb");
375 return usage_hf_iclass_decrypt();
378 fseek(f
, 0, SEEK_END
);
379 long fsize
= ftell(f
);
380 fseek(f
, 0, SEEK_SET
);
381 uint8_t enc_dump
[8] = {0};
382 uint8_t *decrypted
= malloc(fsize
);
383 des3_context ctx
= { DES_DECRYPT
,{ 0 } };
384 des3_set2key_dec( &ctx
, key
);
385 size_t bytes_read
= fread(enc_dump
, 1, 8, f
);
387 //Use the first block (CSN) for filename
388 char outfilename
[FILE_PATH_SIZE
] = { 0 };
389 snprintf(outfilename
,FILE_PATH_SIZE
,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
390 enc_dump
[0],enc_dump
[1],enc_dump
[2],enc_dump
[3],
391 enc_dump
[4],enc_dump
[5],enc_dump
[6],enc_dump
[7]);
394 while(bytes_read
== 8)
398 memcpy(decrypted
+(blocknum
*8), enc_dump
, 8);
400 des3_crypt_ecb(&ctx
, enc_dump
,decrypted
+(blocknum
*8) );
402 printvar("decrypted block", decrypted
+(blocknum
*8), 8);
403 bytes_read
= fread(enc_dump
, 1, 8, f
);
408 saveFile(outfilename
,"bin", decrypted
, blocknum
*8);
413 int usage_hf_iclass_encrypt(void) {
414 PrintAndLog("Usage: hf iclass encrypt <BlockData>");
416 PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
417 PrintAndLog("in the working directory. The file should be 16 bytes binary data");
419 PrintAndLog("example: hf iclass encrypt 0102030405060708");
424 static int iClassEncryptBlkData(uint8_t *blkData
) {
425 uint8_t key
[16] = { 0 };
426 if(readKeyfile("iclass_decryptionkey.bin", 16, key
))
428 usage_hf_iclass_encrypt();
431 PrintAndLog("Decryption file found... ");
433 uint8_t encryptedData
[16];
434 uint8_t *encrypted
= encryptedData
;
435 des3_context ctx
= { DES_DECRYPT
,{ 0 } };
436 des3_set2key_enc( &ctx
, key
);
438 des3_crypt_ecb(&ctx
, blkData
,encrypted
);
439 //printvar("decrypted block", decrypted, 8);
440 memcpy(blkData
,encrypted
,8);
445 int CmdHFiClassEncryptBlk(const char *Cmd
) {
446 uint8_t blkData
[8] = {0};
447 char opt
= param_getchar(Cmd
, 0);
448 if (strlen(Cmd
)<1 || opt
== 'h')
449 return usage_hf_iclass_encrypt();
451 //get the bytes to encrypt
452 if (param_gethex(Cmd
, 0, blkData
, 16))
454 PrintAndLog("BlockData must include 16 HEX symbols");
457 if (!iClassEncryptBlkData(blkData
)) return 0;
459 printvar("encrypted block", blkData
, 8);
463 void Calc_wb_mac(uint8_t blockno
, uint8_t *data
, uint8_t *div_key
, uint8_t MAC
[4]) {
466 memcpy(WB
+ 1,data
,8);
467 doMAC_N(WB
,sizeof(WB
),div_key
,MAC
);
468 //printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
471 static bool select_only(uint8_t *CSN
, uint8_t *CCNR
, bool use_credit_key
, bool verbose
) {
474 UsbCommand c
= {CMD_READER_ICLASS
, {0}};
475 c
.arg
[0] = FLAG_ICLASS_READER_ONLY_ONCE
| FLAG_ICLASS_READER_CC
| FLAG_ICLASS_READER_ONE_TRY
;
477 c
.arg
[0] |= FLAG_ICLASS_READER_CEDITKEY
;
479 clearCommandBuffer();
481 if (!WaitForResponseTimeout(CMD_ACK
,&resp
,4500))
483 PrintAndLog("Command execute timeout");
487 uint8_t isOK
= resp
.arg
[0] & 0xff;
488 uint8_t *data
= resp
.d
.asBytes
;
491 if (CCNR
!=NULL
)memcpy(CCNR
,data
+16,8);
494 if (verbose
) PrintAndLog("CSN: %s",sprint_hex(CSN
,8));
497 PrintAndLog("Failed to obtain CC! Aborting");
503 static bool select_and_auth(uint8_t *KEY
, uint8_t *MAC
, uint8_t *div_key
, bool use_credit_key
, bool elite
, bool rawkey
, bool verbose
) {
504 uint8_t CSN
[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
505 uint8_t CCNR
[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
507 if (!select_only(CSN
, CCNR
, use_credit_key
, verbose
))
512 memcpy(div_key
, KEY
, 8);
514 HFiClassCalcDivKey(CSN
, KEY
, div_key
, elite
);
515 PrintAndLog("Authing with %s: %02x%02x%02x%02x%02x%02x%02x%02x", rawkey
? "raw key" : "diversified key", div_key
[0],div_key
[1],div_key
[2],div_key
[3],div_key
[4],div_key
[5],div_key
[6],div_key
[7]);
517 doMAC(CCNR
, div_key
, MAC
);
519 UsbCommand d
= {CMD_ICLASS_AUTHENTICATION
, {0}};
520 memcpy(d
.d
.asBytes
, MAC
, 4);
521 clearCommandBuffer();
523 if (!WaitForResponseTimeout(CMD_ACK
,&resp
,4500))
525 PrintAndLog("Auth Command execute timeout");
528 uint8_t isOK
= resp
.arg
[0] & 0xff;
530 PrintAndLog("Authentication error");
536 int usage_hf_iclass_dump(void) {
537 PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
538 PrintAndLog("Options:");
539 PrintAndLog(" f <filename> : specify a filename to save dump to");
540 PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
541 PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
542 PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
543 PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
544 PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
545 PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
546 PrintAndLog(" NOTE: * = required");
547 PrintAndLog("Samples:");
548 PrintAndLog(" hf iclass dump k 001122334455667B");
549 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
550 PrintAndLog(" hf iclass dump k AAAAAAAAAAAAAAAA e");
554 int CmdHFiClassReader_Dump(const char *Cmd
) {
556 uint8_t MAC
[4] = {0x00,0x00,0x00,0x00};
557 uint8_t div_key
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
558 uint8_t c_div_key
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
562 uint8_t app_areas
= 1;
564 uint8_t KEY
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
565 uint8_t CreditKEY
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
568 uint8_t fileNameLen
= 0;
569 char filename
[FILE_PATH_SIZE
]={0};
570 char tempStr
[50] = {0};
571 bool have_debit_key
= false;
572 bool have_credit_key
= false;
573 bool use_credit_key
= false;
579 while(param_getchar(Cmd
, cmdp
) != 0x00)
581 switch(param_getchar(Cmd
, cmdp
))
585 return usage_hf_iclass_dump();
588 have_credit_key
= true;
589 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
591 errors
= param_gethex(tempStr
, 0, CreditKEY
, dataLen
);
592 } else if (dataLen
== 1) {
593 keyNbr
= param_get8(Cmd
, cmdp
+1);
594 if (keyNbr
<= ICLASS_KEYS_MAX
) {
595 memcpy(CreditKEY
, iClass_Key_Table
[keyNbr
], 8);
597 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
601 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
613 fileNameLen
= param_getstr(Cmd
, cmdp
+1, filename
);
614 if (fileNameLen
< 1) {
615 PrintAndLog("No filename found after f");
622 have_debit_key
= true;
623 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
625 errors
= param_gethex(tempStr
, 0, KEY
, dataLen
);
626 } else if (dataLen
== 1) {
627 keyNbr
= param_get8(Cmd
, cmdp
+1);
628 if (keyNbr
<= ICLASS_KEYS_MAX
) {
629 memcpy(KEY
, iClass_Key_Table
[keyNbr
], 8);
631 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
635 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
646 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd
, cmdp
));
650 if(errors
) return usage_hf_iclass_dump();
653 if (cmdp
< 2) return usage_hf_iclass_dump();
654 // if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
655 if (!have_debit_key
&& have_credit_key
) use_credit_key
= true;
657 //get config and first 3 blocks
658 UsbCommand c
= {CMD_READER_ICLASS
, {FLAG_ICLASS_READER_CSN
|
659 FLAG_ICLASS_READER_CONF
| FLAG_ICLASS_READER_ONLY_ONCE
| FLAG_ICLASS_READER_ONE_TRY
}};
661 uint8_t tag_data
[255*8];
663 clearCommandBuffer();
665 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, 4500)) {
666 PrintAndLog("Command execute timeout");
667 ul_switch_off_field();
670 uint8_t readStatus
= resp
.arg
[0] & 0xff;
671 uint8_t *data
= resp
.d
.asBytes
;
674 PrintAndLog("No tag found...");
675 ul_switch_off_field();
678 if( readStatus
& (FLAG_ICLASS_READER_CSN
|FLAG_ICLASS_READER_CONF
|FLAG_ICLASS_READER_CC
)){
679 memcpy(tag_data
, data
, 8*3);
680 blockno
+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
682 getMemConfig(data
[13], data
[12], &maxBlk
, &app_areas
, &kb
);
683 // large memory - not able to dump pages currently
684 if (numblks
> maxBlk
) numblks
= maxBlk
;
686 ul_switch_off_field();
687 // authenticate debit key and get div_key - later store in dump block 3
688 if (!select_and_auth(KEY
, MAC
, div_key
, use_credit_key
, elite
, rawkey
, false)){
689 //try twice - for some reason it sometimes fails the first time...
690 if (!select_and_auth(KEY
, MAC
, div_key
, use_credit_key
, elite
, rawkey
, false)){
691 ul_switch_off_field();
697 UsbCommand w
= {CMD_ICLASS_DUMP
, {blockno
, numblks
-blockno
+1}};
698 clearCommandBuffer();
700 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, 4500)) {
701 PrintAndLog("Command execute time-out 1");
702 ul_switch_off_field();
705 uint32_t blocksRead
= resp
.arg
[1];
706 uint8_t isOK
= resp
.arg
[0] & 0xff;
707 if (!isOK
&& !blocksRead
) {
708 PrintAndLog("Read Block Failed");
709 ul_switch_off_field();
712 uint32_t startindex
= resp
.arg
[2];
713 if (blocksRead
*8 > sizeof(tag_data
)-(blockno
*8)) {
714 PrintAndLog("Data exceeded Buffer size!");
715 blocksRead
= (sizeof(tag_data
)/8) - blockno
;
717 // response ok - now get bigbuf content of the dump
718 GetFromBigBuf(tag_data
+(blockno
*8), blocksRead
*8, startindex
);
719 WaitForResponse(CMD_ACK
,NULL
);
720 size_t gotBytes
= blocksRead
*8 + blockno
*8;
723 if (have_credit_key
) {
724 //turn off hf field before authenticating with different key
725 ul_switch_off_field();
727 // AA2 authenticate credit key and git c_div_key - later store in dump block 4
728 if (!select_and_auth(CreditKEY
, MAC
, c_div_key
, true, false, false, false)){
729 //try twice - for some reason it sometimes fails the first time...
730 if (!select_and_auth(CreditKEY
, MAC
, c_div_key
, true, false, false, false)){
731 ul_switch_off_field();
735 // do we still need to read more block? (aa2 enabled?)
736 if (maxBlk
> blockno
+numblks
+1) {
737 // setup dump and start
738 w
.arg
[0] = blockno
+ blocksRead
;
739 w
.arg
[1] = maxBlk
- (blockno
+ blocksRead
);
740 clearCommandBuffer();
742 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, 4500)) {
743 PrintAndLog("Command execute timeout 2");
744 ul_switch_off_field();
747 uint8_t isOK
= resp
.arg
[0] & 0xff;
748 blocksRead
= resp
.arg
[1];
749 if (!isOK
&& !blocksRead
) {
750 PrintAndLog("Read Block Failed 2");
751 ul_switch_off_field();
755 startindex
= resp
.arg
[2];
756 if (blocksRead
*8 > sizeof(tag_data
)-gotBytes
) {
757 PrintAndLog("Data exceeded Buffer size!");
758 blocksRead
= (sizeof(tag_data
) - gotBytes
)/8;
760 // get dumped data from bigbuf
761 GetFromBigBuf(tag_data
+gotBytes
, blocksRead
*8, startindex
);
762 WaitForResponse(CMD_ACK
,NULL
);
764 gotBytes
+= blocksRead
*8;
765 } else { //field is still on - turn it off...
766 ul_switch_off_field();
770 // add diversified keys to dump
771 if (have_debit_key
) memcpy(tag_data
+(3*8),div_key
,8);
772 if (have_credit_key
) memcpy(tag_data
+(4*8),c_div_key
,8);
774 printf("CSN |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data
[0],tag_data
[1],tag_data
[2]
775 ,tag_data
[3],tag_data
[4],tag_data
[5],tag_data
[6],tag_data
[7]);
776 printIclassDumpContents(tag_data
, 1, (gotBytes
/8)-1, gotBytes
-8);
778 if (filename
[0] == 0){
779 snprintf(filename
, FILE_PATH_SIZE
,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
780 tag_data
[0],tag_data
[1],tag_data
[2],tag_data
[3],
781 tag_data
[4],tag_data
[5],tag_data
[6],tag_data
[7]);
784 // save the dump to .bin file
785 PrintAndLog("Saving dump file - %d blocks read", gotBytes
/8);
786 saveFile(filename
, "bin", tag_data
, gotBytes
);
790 static int WriteBlock(uint8_t blockno
, uint8_t *bldata
, uint8_t *KEY
, bool use_credit_key
, bool elite
, bool rawkey
, bool verbose
) {
791 uint8_t MAC
[4]={0x00,0x00,0x00,0x00};
792 uint8_t div_key
[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
793 if (!select_and_auth(KEY
, MAC
, div_key
, use_credit_key
, elite
, rawkey
, verbose
))
798 Calc_wb_mac(blockno
,bldata
,div_key
,MAC
);
799 UsbCommand w
= {CMD_ICLASS_WRITEBLOCK
, {blockno
}};
800 memcpy(w
.d
.asBytes
, bldata
, 8);
801 memcpy(w
.d
.asBytes
+ 8, MAC
, 4);
803 clearCommandBuffer();
805 if (!WaitForResponseTimeout(CMD_ACK
,&resp
,4500))
807 PrintAndLog("Write Command execute timeout");
810 uint8_t isOK
= resp
.arg
[0] & 0xff;
812 PrintAndLog("Write Block Failed");
815 PrintAndLog("Write Block Successful");
819 int usage_hf_iclass_writeblock(void) {
820 PrintAndLog("Options:");
821 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
822 PrintAndLog(" d <data> : Set the Data to write as 16 hex symbols");
823 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
824 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
825 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
826 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
827 PrintAndLog("Samples:");
828 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
829 PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
830 PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
834 int CmdHFiClass_WriteBlock(const char *Cmd
) {
836 uint8_t bldata
[8]={0,0,0,0,0,0,0,0};
837 uint8_t KEY
[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
840 char tempStr
[50] = {0};
841 bool use_credit_key
= false;
846 while(param_getchar(Cmd
, cmdp
) != 0x00)
848 switch(param_getchar(Cmd
, cmdp
))
852 return usage_hf_iclass_writeblock();
855 if (param_gethex(Cmd
, cmdp
+1, &blockno
, 2)) {
856 PrintAndLog("Block No must include 2 HEX symbols\n");
863 use_credit_key
= true;
868 if (param_gethex(Cmd
, cmdp
+1, bldata
, 16))
870 PrintAndLog("KEY must include 16 HEX symbols\n");
882 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
884 errors
= param_gethex(tempStr
, 0, KEY
, dataLen
);
885 } else if (dataLen
== 1) {
886 keyNbr
= param_get8(Cmd
, cmdp
+1);
887 if (keyNbr
<= ICLASS_KEYS_MAX
) {
888 memcpy(KEY
, iClass_Key_Table
[keyNbr
], 8);
890 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
894 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
905 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd
, cmdp
));
909 if(errors
) return usage_hf_iclass_writeblock();
912 if (cmdp
< 6) return usage_hf_iclass_writeblock();
913 int ans
= WriteBlock(blockno
, bldata
, KEY
, use_credit_key
, elite
, rawkey
, true);
914 ul_switch_off_field();
918 int usage_hf_iclass_clone(void) {
919 PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
920 PrintAndLog("Options:");
921 PrintAndLog(" f <filename>: specify a filename to clone from");
922 PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
923 PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
924 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
925 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
926 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
927 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
928 PrintAndLog("Samples:");
929 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
930 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
931 PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
935 int CmdHFiClassCloneTag(const char *Cmd
) {
936 char filename
[FILE_PATH_SIZE
];
937 char tempStr
[50]={0};
938 uint8_t KEY
[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
940 uint8_t fileNameLen
= 0;
941 uint8_t startblock
= 0;
942 uint8_t endblock
= 0;
944 bool use_credit_key
= false;
949 while(param_getchar(Cmd
, cmdp
) != 0x00)
951 switch(param_getchar(Cmd
, cmdp
))
955 return usage_hf_iclass_clone();
958 if (param_gethex(Cmd
, cmdp
+1, &startblock
, 2)) {
959 PrintAndLog("Start Block No must include 2 HEX symbols\n");
966 use_credit_key
= true;
976 fileNameLen
= param_getstr(Cmd
, cmdp
+1, filename
);
977 if (fileNameLen
< 1) {
978 PrintAndLog("No filename found after f");
985 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
987 errors
= param_gethex(tempStr
, 0, KEY
, dataLen
);
988 } else if (dataLen
== 1) {
989 keyNbr
= param_get8(Cmd
, cmdp
+1);
990 if (keyNbr
<= ICLASS_KEYS_MAX
) {
991 memcpy(KEY
, iClass_Key_Table
[keyNbr
], 8);
993 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
997 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1004 if (param_gethex(Cmd
, cmdp
+1, &endblock
, 2)) {
1005 PrintAndLog("Start Block No must include 2 HEX symbols\n");
1016 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd
, cmdp
));
1020 if(errors
) return usage_hf_iclass_clone();
1023 if (cmdp
< 8) return usage_hf_iclass_clone();
1027 iclass_block_t tag_data
[USB_CMD_DATA_SIZE
/12];
1029 if ((endblock
-startblock
+1)*12 > USB_CMD_DATA_SIZE
) {
1030 PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE
/8);
1032 // file handling and reading
1033 f
= fopen(filename
,"rb");
1035 PrintAndLog("Failed to read from file '%s'", filename
);
1040 PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
1043 // now read data from the file from block 6 --- 19
1044 // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
1045 // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
1046 // else we have to create a share memory
1048 fseek(f
,startblock
*8,SEEK_SET
);
1049 fread(tag_data
,sizeof(iclass_block_t
),endblock
- startblock
+ 1,f
);
1051 uint8_t MAC
[4]={0x00,0x00,0x00,0x00};
1052 uint8_t div_key
[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1054 if (!select_and_auth(KEY
, MAC
, div_key
, use_credit_key
, elite
, rawkey
, true))
1057 UsbCommand w
= {CMD_ICLASS_CLONE
,{startblock
,endblock
}};
1059 // calculate all mac for every the block we will write
1060 for (i
= startblock
; i
<= endblock
; i
++){
1061 Calc_wb_mac(i
,tag_data
[i
- startblock
].d
,div_key
,MAC
);
1062 // usb command d start pointer = d + (i - 6) * 12
1063 // memcpy(pointer,tag_data[i - 6],8) 8 bytes
1064 // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
1066 ptr
= w
.d
.asBytes
+ (i
- startblock
) * 12;
1067 memcpy(ptr
, &(tag_data
[i
- startblock
].d
[0]), 8);
1068 memcpy(ptr
+ 8,MAC
, 4);
1071 for (i
= 0; i
<= endblock
- startblock
;i
++){
1072 memcpy(p
,w
.d
.asBytes
+ (i
* 12),12);
1073 printf("Block |%02x|",i
+ startblock
);
1074 printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p
[0],p
[1],p
[2],p
[3],p
[4],p
[5],p
[6],p
[7]);
1075 printf(" MAC |%02x%02x%02x%02x|\n",p
[8],p
[9],p
[10],p
[11]);
1079 if (!WaitForResponseTimeout(CMD_ACK
,&resp
,4500))
1081 PrintAndLog("Command execute timeout");
1087 static int ReadBlock(uint8_t *KEY
, uint8_t blockno
, uint8_t keyType
, bool elite
, bool rawkey
, bool verbose
) {
1088 uint8_t MAC
[4]={0x00,0x00,0x00,0x00};
1089 uint8_t div_key
[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1091 if (!select_and_auth(KEY
, MAC
, div_key
, (keyType
==0x18), elite
, rawkey
, verbose
))
1095 UsbCommand w
= {CMD_ICLASS_READBLOCK
, {blockno
}};
1096 clearCommandBuffer();
1098 if (!WaitForResponseTimeout(CMD_ACK
,&resp
,4500))
1100 PrintAndLog("Command execute timeout");
1103 uint8_t isOK
= resp
.arg
[0] & 0xff;
1105 PrintAndLog("Read Block Failed");
1108 //data read is stored in: resp.d.asBytes[0-15]
1109 if (verbose
) PrintAndLog("Block %02X: %s\n",blockno
, sprint_hex(resp
.d
.asBytes
,8));
1113 int usage_hf_iclass_readblock(void) {
1114 PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> c e|r\n");
1115 PrintAndLog("Options:");
1116 PrintAndLog(" b <Block> : The block number as 2 hex symbols");
1117 PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
1118 PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
1119 PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
1120 PrintAndLog(" r : If 'r' is specified, no computations applied to key");
1121 PrintAndLog("Samples:");
1122 PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
1123 PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
1124 PrintAndLog(" hf iclass readblk b 0A k 0");
1128 int CmdHFiClass_ReadBlock(const char *Cmd
) {
1130 uint8_t keyType
= 0x88; //debit key
1131 uint8_t KEY
[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1133 uint8_t dataLen
= 0;
1134 char tempStr
[50] = {0};
1136 bool rawkey
= false;
1137 bool errors
= false;
1139 while(param_getchar(Cmd
, cmdp
) != 0x00)
1141 switch(param_getchar(Cmd
, cmdp
))
1145 return usage_hf_iclass_readblock();
1148 if (param_gethex(Cmd
, cmdp
+1, &blockno
, 2)) {
1149 PrintAndLog("Block No must include 2 HEX symbols\n");
1166 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
1167 if (dataLen
== 16) {
1168 errors
= param_gethex(tempStr
, 0, KEY
, dataLen
);
1169 } else if (dataLen
== 1) {
1170 keyNbr
= param_get8(Cmd
, cmdp
+1);
1171 if (keyNbr
<= ICLASS_KEYS_MAX
) {
1172 memcpy(KEY
, iClass_Key_Table
[keyNbr
], 8);
1174 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1178 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1189 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd
, cmdp
));
1193 if(errors
) return usage_hf_iclass_readblock();
1196 if (cmdp
< 4) return usage_hf_iclass_readblock();
1198 return ReadBlock(KEY
, blockno
, keyType
, elite
, rawkey
, true);
1201 int CmdHFiClass_loclass(const char *Cmd
) {
1202 char opt
= param_getchar(Cmd
, 0);
1204 if (strlen(Cmd
)<1 || opt
== 'h') {
1205 PrintAndLog("Usage: hf iclass loclass [options]");
1206 PrintAndLog("Options:");
1207 PrintAndLog("h Show this help");
1208 PrintAndLog("t Perform self-test");
1209 PrintAndLog("f <filename> Bruteforce iclass dumpfile");
1210 PrintAndLog(" An iclass dumpfile is assumed to consist of an arbitrary number of");
1211 PrintAndLog(" malicious CSNs, and their protocol responses");
1212 PrintAndLog(" The the binary format of the file is expected to be as follows: ");
1213 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1214 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1215 PrintAndLog(" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
1216 PrintAndLog(" ... totalling N*24 bytes");
1219 char fileName
[255] = {0};
1222 if(param_getstr(Cmd
, 1, fileName
) > 0)
1224 return bruteforceFileNoKeys(fileName
);
1227 PrintAndLog("You must specify a filename");
1232 int errors
= testCipherUtils();
1233 errors
+= testMAC();
1234 errors
+= doKeyTests(0);
1235 errors
+= testElite();
1238 prnlog("OBS! There were errors!!!");
1246 void printIclassDumpContents(uint8_t *iclass_dump
, uint8_t startblock
, uint8_t endblock
, size_t filesize
) {
1247 uint8_t blockdata
[8];
1249 memcpy(&mem_config
, iclass_dump
+ 13,1);
1250 uint8_t maxmemcount
;
1251 uint8_t filemaxblock
= filesize
/ 8;
1252 if (mem_config
& 0x80)
1256 //PrintAndLog ("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
1258 if (startblock
== 0)
1260 if ((endblock
> maxmemcount
) || (endblock
== 0))
1261 endblock
= maxmemcount
;
1262 if (endblock
> filemaxblock
)
1263 endblock
= filemaxblock
;
1266 while (i
<= endblock
){
1267 printf("Block |%02X| ",i
);
1268 memcpy(blockdata
,iclass_dump
+ (i
* 8),8);
1269 for (j
= 0;j
< 8;j
++)
1270 printf("%02X ",blockdata
[j
]);
1276 int usage_hf_iclass_readtagfile() {
1277 PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
1281 int CmdHFiClassReadTagFile(const char *Cmd
) {
1286 char filename
[FILE_PATH_SIZE
];
1287 if (param_getstr(Cmd
, 0, filename
) < 1)
1288 return usage_hf_iclass_readtagfile();
1289 if (param_getstr(Cmd
,1,(char *)&tempnum
) < 1)
1292 sscanf(tempnum
,"%d",&startblock
);
1294 if (param_getstr(Cmd
,2,(char *)&tempnum
) < 1)
1297 sscanf(tempnum
,"%d",&endblock
);
1298 // file handling and reading
1299 f
= fopen(filename
,"rb");
1301 PrintAndLog("Failed to read from file '%s'", filename
);
1304 fseek(f
, 0, SEEK_END
);
1305 long fsize
= ftell(f
);
1306 fseek(f
, 0, SEEK_SET
);
1308 uint8_t *dump
= malloc(fsize
);
1311 size_t bytes_read
= fread(dump
, 1, fsize
, f
);
1313 uint8_t *csn
= dump
;
1314 printf("CSN [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn
[0],csn
[1],csn
[2],csn
[3],csn
[4],csn
[5],csn
[6],csn
[7]);
1315 // printIclassDumpInfo(dump);
1316 printIclassDumpContents(dump
,startblock
,endblock
,bytes_read
);
1322 uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
1323 uint64_t new_div = 0x00;
1329 uint64_t hexarray_to_uint64(uint8_t *key) {
1332 for (int i = 0;i < 8;i++)
1333 sprintf(&temp[(i *2)],"%02X",key[i]);
1335 if (sscanf(temp,"%016"llX,&uint_key) < 1)
1340 void HFiClassCalcDivKey(uint8_t *CSN
, uint8_t *KEY
, uint8_t *div_key
, bool elite
){
1341 uint8_t keytable
[128] = {0};
1342 uint8_t key_index
[8] = {0};
1344 uint8_t key_sel
[8] = { 0 };
1345 uint8_t key_sel_p
[8] = { 0 };
1346 hash2(KEY
, keytable
);
1347 hash1(CSN
, key_index
);
1348 for(uint8_t i
= 0; i
< 8 ; i
++)
1349 key_sel
[i
] = keytable
[key_index
[i
]] & 0xFF;
1351 //Permute from iclass format to standard format
1352 permutekey_rev(key_sel
, key_sel_p
);
1353 diversifyKey(CSN
, key_sel_p
, div_key
);
1355 diversifyKey(CSN
, KEY
, div_key
);
1359 //when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
1360 //calculate and return xor_div_key (ready for a key write command)
1361 //print all div_keys if verbose
1362 static void HFiClassCalcNewKey(uint8_t *CSN
, uint8_t *OLDKEY
, uint8_t *NEWKEY
, uint8_t *xor_div_key
, bool elite
, bool oldElite
, bool verbose
){
1363 uint8_t old_div_key
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1364 uint8_t new_div_key
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1366 HFiClassCalcDivKey(CSN
, OLDKEY
, old_div_key
, oldElite
);
1368 HFiClassCalcDivKey(CSN
, NEWKEY
, new_div_key
, elite
);
1370 for (uint8_t i
= 0; i
< sizeof(old_div_key
); i
++){
1371 xor_div_key
[i
] = old_div_key
[i
] ^ new_div_key
[i
];
1374 printf("Old Div Key : %s\n",sprint_hex(old_div_key
,8));
1375 printf("New Div Key : %s\n",sprint_hex(new_div_key
,8));
1376 printf("Xor Div Key : %s\n",sprint_hex(xor_div_key
,8));
1380 int usage_hf_iclass_calc_newkey(void) {
1381 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1382 PrintAndLog("Usage: hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
1383 PrintAndLog(" Options:");
1384 PrintAndLog(" o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1385 PrintAndLog(" n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
1386 PrintAndLog(" s <csn> : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
1387 PrintAndLog(" e : specify new key as elite calc");
1388 PrintAndLog(" ee : specify old and new key as elite calc");
1389 PrintAndLog("Samples:");
1390 PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
1391 PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
1392 PrintAndLog(" std to std read csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
1393 PrintAndLog("NOTE: * = required\n");
1398 int CmdHFiClassCalcNewKey(const char *Cmd
) {
1399 uint8_t OLDKEY
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1400 uint8_t NEWKEY
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1401 uint8_t xor_div_key
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1402 uint8_t CSN
[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1403 uint8_t CCNR
[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1405 uint8_t dataLen
= 0;
1406 char tempStr
[50] = {0};
1407 bool givenCSN
= false;
1408 bool oldElite
= false;
1410 bool errors
= false;
1412 while(param_getchar(Cmd
, cmdp
) != 0x00)
1414 switch(param_getchar(Cmd
, cmdp
))
1418 return usage_hf_iclass_calc_newkey();
1421 dataLen
= param_getstr(Cmd
, cmdp
, tempStr
);
1429 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
1430 if (dataLen
== 16) {
1431 errors
= param_gethex(tempStr
, 0, NEWKEY
, dataLen
);
1432 } else if (dataLen
== 1) {
1433 keyNbr
= param_get8(Cmd
, cmdp
+1);
1434 if (keyNbr
<= ICLASS_KEYS_MAX
) {
1435 memcpy(NEWKEY
, iClass_Key_Table
[keyNbr
], 8);
1437 PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
1441 PrintAndLog("\nERROR: NewKey is incorrect length\n");
1448 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
1449 if (dataLen
== 16) {
1450 errors
= param_gethex(tempStr
, 0, OLDKEY
, dataLen
);
1451 } else if (dataLen
== 1) {
1452 keyNbr
= param_get8(Cmd
, cmdp
+1);
1453 if (keyNbr
<= ICLASS_KEYS_MAX
) {
1454 memcpy(OLDKEY
, iClass_Key_Table
[keyNbr
], 8);
1456 PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
1460 PrintAndLog("\nERROR: Credit Key is incorrect length\n");
1468 if (param_gethex(Cmd
, cmdp
+1, CSN
, 16))
1469 return usage_hf_iclass_calc_newkey();
1473 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd
, cmdp
));
1477 if(errors
) return usage_hf_iclass_calc_newkey();
1480 if (cmdp
< 4) return usage_hf_iclass_calc_newkey();
1483 if (!select_only(CSN
, CCNR
, false, true))
1486 HFiClassCalcNewKey(CSN
, OLDKEY
, NEWKEY
, xor_div_key
, elite
, oldElite
, true);
1490 static int loadKeys(char *filename
) {
1492 f
= fopen(filename
,"rb");
1494 PrintAndLog("Failed to read from file '%s'", filename
);
1497 fseek(f
, 0, SEEK_END
);
1498 long fsize
= ftell(f
);
1499 fseek(f
, 0, SEEK_SET
);
1501 uint8_t *dump
= malloc(fsize
);
1503 size_t bytes_read
= fread(dump
, 1, fsize
, f
);
1505 if (bytes_read
> ICLASS_KEYS_MAX
* 8){
1506 PrintAndLog("File is too long to load - bytes: %u", bytes_read
);
1511 for (; i
< bytes_read
/8; i
++){
1512 memcpy(iClass_Key_Table
[i
],dump
+(i
*8),8);
1515 PrintAndLog("%u keys loaded", i
);
1519 static int saveKeys(char *filename
) {
1521 f
= fopen(filename
,"wb");
1523 printf("error opening file %s\n",filename
);
1526 for (uint8_t i
= 0; i
< ICLASS_KEYS_MAX
; i
++){
1527 if (fwrite(iClass_Key_Table
[i
],8,1,f
) != 1){
1528 PrintAndLog("save key failed to write to file: %s", filename
);
1536 static int printKeys(void) {
1538 for (uint8_t i
= 0; i
< ICLASS_KEYS_MAX
; i
++){
1539 PrintAndLog("%u: %s",i
,sprint_hex(iClass_Key_Table
[i
],8));
1545 int usage_hf_iclass_managekeys(void) {
1546 PrintAndLog("HELP : Manage iClass Keys in client memory:\n");
1547 PrintAndLog("Usage: hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
1548 PrintAndLog(" Options:");
1549 PrintAndLog(" n <keynbr> : specify the keyNbr to set in memory");
1550 PrintAndLog(" k <key> : set a key in memory");
1551 PrintAndLog(" f <filename>: specify a filename to use with load or save operations");
1552 PrintAndLog(" s : save keys in memory to file specified by filename");
1553 PrintAndLog(" l : load keys to memory from file specified by filename");
1554 PrintAndLog(" p : print keys loaded into memory\n");
1555 PrintAndLog("Samples:");
1556 PrintAndLog(" set key : hf iclass managekeys n 0 k 1122334455667788");
1557 PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
1558 PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
1559 PrintAndLog(" print keys : hf iclass managekeys p\n");
1563 int CmdHFiClassManageKeys(const char *Cmd
) {
1565 uint8_t dataLen
= 0;
1566 uint8_t KEY
[8] = {0};
1567 char filename
[FILE_PATH_SIZE
];
1568 uint8_t fileNameLen
= 0;
1569 bool errors
= false;
1570 uint8_t operation
= 0;
1574 while(param_getchar(Cmd
, cmdp
) != 0x00)
1576 switch(param_getchar(Cmd
, cmdp
))
1580 return usage_hf_iclass_managekeys();
1583 fileNameLen
= param_getstr(Cmd
, cmdp
+1, filename
);
1584 if (fileNameLen
< 1) {
1585 PrintAndLog("No filename found after f");
1592 keyNbr
= param_get8(Cmd
, cmdp
+1);
1594 PrintAndLog("Wrong block number");
1601 operation
+= 3; //set key
1602 dataLen
= param_getstr(Cmd
, cmdp
+1, tempStr
);
1603 if (dataLen
== 16) { //ul-c or ev1/ntag key length
1604 errors
= param_gethex(tempStr
, 0, KEY
, dataLen
);
1606 PrintAndLog("\nERROR: Key is incorrect length\n");
1613 operation
+= 4; //print keys in memory
1618 operation
+= 5; //load keys from file
1623 operation
+= 6; //save keys to file
1627 PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd
, cmdp
));
1631 if(errors
) return usage_hf_iclass_managekeys();
1633 if (operation
== 0){
1634 PrintAndLog("no operation specified (load, save, or print)\n");
1635 return usage_hf_iclass_managekeys();
1638 PrintAndLog("Too many operations specified\n");
1639 return usage_hf_iclass_managekeys();
1641 if (operation
> 4 && fileNameLen
== 0){
1642 PrintAndLog("You must enter a filename when loading or saving\n");
1643 return usage_hf_iclass_managekeys();
1647 case 3: memcpy(iClass_Key_Table
[keyNbr
], KEY
, 8); return 1;
1648 case 4: return printKeys();
1649 case 5: return loadKeys(filename
);
1650 case 6: return saveKeys(filename
);
1656 static command_t CommandTable
[] =
1658 {"help", CmdHelp
, 1, "This help"},
1659 {"calcnewkey", CmdHFiClassCalcNewKey
, 1, "[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
1660 {"clone", CmdHFiClassCloneTag
, 0, "[options..] Authenticate and Clone from iClass bin file"},
1661 {"decrypt", CmdHFiClassDecrypt
, 1, "[f <fname>] Decrypt tagdump" },
1662 {"dump", CmdHFiClassReader_Dump
, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
1663 {"eload", CmdHFiClassELoad
, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
1664 {"encryptblk", CmdHFiClassEncryptBlk
, 1, "<BlockData> Encrypt given block data"},
1665 {"list", CmdHFiClassList
, 0, " (Deprecated) List iClass history"},
1666 {"loclass", CmdHFiClass_loclass
, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
1667 {"managekeys", CmdHFiClassManageKeys
, 1, "[options..] Manage the keys to use with iClass"},
1668 {"readblk", CmdHFiClass_ReadBlock
, 0, "[options..] Authenticate and Read iClass block"},
1669 {"reader", CmdHFiClassReader
, 0, " Read an iClass tag"},
1670 {"readtagfile", CmdHFiClassReadTagFile
, 1, "[options..] Display Content from tagfile"},
1671 {"replay", CmdHFiClassReader_Replay
, 0, "<mac> Read an iClass tag via Reply Attack"},
1672 {"sim", CmdHFiClassSim
, 0, "[options..] Simulate iClass tag"},
1673 {"snoop", CmdHFiClassSnoop
, 0, " Eavesdrop iClass communication"},
1674 {"writeblk", CmdHFiClass_WriteBlock
, 0, "[options..] Authenticate and Write iClass block"},
1675 {NULL
, NULL
, 0, NULL
}
1678 int CmdHFiClass(const char *Cmd
)
1680 CmdsParse(CommandTable
, Cmd
);
1684 int CmdHelp(const char *Cmd
)
1686 CmdsHelp(CommandTable
);