]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifaredesfire.c
e064c33aa45068e5924075d4b1cbcddcfec9988a
[proxmark3-svn] / armsrc / mifaredesfire.c
1 #include "mifaredesfire.h"
2 #include "des.h"
3
4 #define MAX_APPLICATION_COUNT 28
5 #define MAX_FILE_COUNT 16
6 #define MAX_DESFIRE_FRAME_SIZE 60
7 #define NOT_YET_AUTHENTICATED 255
8 #define FRAME_PAYLOAD_SIZE (MAX_DESFIRE_FRAME_SIZE - 5)
9 #define RECEIVE_SIZE 64
10
11 // the block number for the ISO14443-4 PCB
12 uint8_t pcb_blocknum = 0;
13 // Deselect card by sending a s-block. the crc is precalced for speed
14 static uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};
15
16 //static uint8_t __msg[MAX_FRAME_SIZE] = { 0x0A, 0x00, 0x00, /* ..., */ 0x00 };
17 /* PCB CID CMD PAYLOAD */
18 //static uint8_t __res[MAX_FRAME_SIZE];
19
20 bool InitDesfireCard(){
21
22 byte_t cardbuf[USB_CMD_DATA_SIZE] = {0x00};
23
24 iso14a_card_select_t *card = (iso14a_card_select_t*)cardbuf;
25
26 iso14a_set_tracing(TRUE);
27 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
28
29 int len = iso14443a_select_card(NULL,card,NULL);
30
31 if (!len) {
32 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
33 OnError();
34 return false;
35 }
36 return true;
37 }
38
39 // ARG0 flag enums
40 enum {
41 NONE = 0x00,
42 INIT = 0x01,
43 DISCONNECT = 0x02,
44 CLEARTRACE = 0x04,
45 BAR = 0x08,
46 } CmdOptions ;
47
48 void MifareSendCommand(uint8_t arg0, uint8_t arg1, uint8_t *datain){
49
50 /* ARG0 contains flags.
51 0x01 = init card.
52 0x02 = Disconnect
53 0x03
54 */
55 uint8_t flags = arg0;
56 size_t datalen = arg1;
57 uint8_t resp[RECEIVE_SIZE];
58 memset(resp,0,sizeof(resp));
59
60 if (MF_DBGLEVEL >= 4) {
61 Dbprintf(" flags : %02X", flags);
62 Dbprintf(" len : %02X", datalen);
63 print_result(" RX : ", datain, datalen);
64 }
65
66 if ( flags & CLEARTRACE ){
67 iso14a_clear_trace();
68 }
69
70 if ( flags & INIT ){
71 if ( !InitDesfireCard() )
72 return;
73 }
74
75 int len = DesfireAPDU(datain, datalen, resp);
76 if (MF_DBGLEVEL >= 4) {
77 print_result("ERR <--: ", resp, len);
78 }
79
80 if ( !len ) {
81 OnError();
82 return;
83 }
84
85 // reset the pcb_blocknum,
86 pcb_blocknum = 0;
87
88 if ( flags & DISCONNECT ){
89 OnSuccess();
90 }
91
92 cmd_send(CMD_ACK,1,len,0,resp,len);
93 }
94
95 void MifareDesfireGetInformation(){
96
97 int len = 0;
98 uint8_t resp[USB_CMD_DATA_SIZE] = {0x00};
99 uint8_t dataout[USB_CMD_DATA_SIZE] = {0x00};
100 byte_t cardbuf[USB_CMD_DATA_SIZE] = {0x00};
101
102 /*
103 1 = PCB 1
104 2 = cid 2
105 3 = desfire command 3
106 4-5 = crc 4 key
107 5-6 crc
108 PCB == 0x0A because sending CID byte.
109 CID == 0x00 first card?
110 */
111 iso14a_clear_trace();
112 iso14a_set_tracing(TRUE);
113 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
114
115 // card select - information
116 iso14a_card_select_t *card = (iso14a_card_select_t*)cardbuf;
117 byte_t isOK = iso14443a_select_card(NULL, card, NULL);
118 if ( isOK == 0) {
119 if (MF_DBGLEVEL >= 1) {
120 Dbprintf("Can't select card");
121 }
122 OnError();
123 return;
124 }
125
126 memcpy(dataout,card->uid,7);
127
128 LED_A_ON();
129 LED_B_OFF();
130 LED_C_OFF();
131
132 uint8_t cmd[] = {GET_VERSION};
133 size_t cmd_len = sizeof(cmd);
134
135 len = DesfireAPDU(cmd, cmd_len, resp);
136 if ( !len ) {
137 print_result("ERROR <--: ", resp, len);
138 OnError();
139 return;
140 }
141
142 LED_A_OFF();
143 LED_B_ON();
144 memcpy(dataout+7,resp+3,7);
145
146 // ADDITION_FRAME 1
147 cmd[0] = ADDITIONAL_FRAME;
148 len = DesfireAPDU(cmd, cmd_len, resp);
149 if ( !len ) {
150 print_result("ERROR <--: ", resp, len);
151 OnError();
152 return;
153 }
154
155 LED_B_OFF();
156 LED_C_ON();
157 memcpy(dataout+7+7,resp+3,7);
158
159 // ADDITION_FRAME 2
160 len = DesfireAPDU(cmd, cmd_len, resp);
161 if ( !len ) {
162 print_result("ERROR <--: ", resp, len);
163 OnError();
164 return;
165 }
166
167 memcpy(dataout+7+7+7,resp+3,14);
168
169 cmd_send(CMD_ACK,1,0,0,dataout,sizeof(dataout));
170
171 // reset the pcb_blocknum,
172 pcb_blocknum = 0;
173 OnSuccess();
174 }
175
176 void MifareDES_Auth1(uint8_t mode, uint8_t algo, uint8_t keyno, uint8_t *datain){
177
178 int len = 0;
179 //uint8_t PICC_MASTER_KEY8[8] = { 0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47};
180 uint8_t PICC_MASTER_KEY16[16] = { 0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47,0x48,0x49,0x4a,0x4b,0x4c,0x4d,0x4e,0x4f };
181 uint8_t null_key_data8[8] = {0x00};
182 //uint8_t null_key_data16[16] = {0x00};
183 //uint8_t new_key_data8[8] = { 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77};
184 //uint8_t new_key_data16[16] = { 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xDD,0xEE,0xFF};
185
186 uint8_t resp[256] = {0x00};
187 uint8_t IV[16] = {0x00};
188
189 size_t datalen = datain[0];
190
191 uint8_t cmd[40] = {0x00};
192 uint8_t encRndB[16] = {0x00};
193 uint8_t decRndB[16] = {0x00};
194 uint8_t nonce[16] = {0x00};
195 uint8_t both[32] = {0x00};
196 uint8_t encBoth[32] = {0x00};
197
198 InitDesfireCard();
199
200 LED_A_ON();
201 LED_B_OFF();
202 LED_C_OFF();
203
204 // 3 olika sätt att authenticera. AUTH (CRC16) , AUTH_ISO (CRC32) , AUTH_AES (CRC32)
205 // 4 olika crypto algo DES, 3DES, 3K3DES, AES
206 // 3 olika kommunikations sätt, PLAIN,MAC,CRYPTO
207
208 // des, nyckel 0,
209 switch (mode){
210 case 1:{
211 if (algo == 1) {
212
213 uint8_t keybytes[8] = {0x00};
214 uint8_t RndA[8] = {0x00};
215 uint8_t RndB[8] = {0x00};
216
217 if (datain[1] == 0xff){
218 memcpy(keybytes,null_key_data8,8);
219 } else{
220 memcpy(keybytes, datain+1, datalen);
221 }
222
223 struct desfire_key defaultkey = {0};
224 desfirekey_t key = &defaultkey;
225 Desfire_des_key_new(keybytes, key);
226
227 cmd[0] = AUTHENTICATE;
228 cmd[1] = keyno; //keynumber
229 len = DesfireAPDU(cmd, 2, resp);
230 if ( !len ) {
231 if (MF_DBGLEVEL >= 1) {
232 DbpString("Authentication failed. Card timeout.");
233 }
234 OnError();
235 return;
236 }
237
238 if ( resp[2] == 0xaf ){
239 } else {
240 DbpString("Authetication failed. Invalid key number.");
241 OnError();
242 return;
243 }
244
245 memcpy( encRndB, resp+3, 8);
246
247 des_dec(&decRndB, &encRndB, key->data);
248 memcpy(RndB, decRndB, 8);
249 rol(decRndB,8);
250
251 // This should be random
252 uint8_t decRndA[8] = {0x00};
253 memcpy(RndA, decRndA, 8);
254 uint8_t encRndA[8] = {0x00};
255
256 des_dec(&encRndA, &decRndA, key->data);
257
258 memcpy(both, encRndA, 8);
259
260 for (int x = 0; x < 8; x++) {
261 decRndB[x] = decRndB[x] ^ encRndA[x];
262 }
263
264 des_dec(&encRndB, &decRndB, key->data);
265
266 memcpy(both + 8, encRndB, 8);
267
268 cmd[0] = ADDITIONAL_FRAME;
269 memcpy(cmd+1, both, 16 );
270
271 len = DesfireAPDU(cmd, 17, resp);
272 if ( !len ) {
273 if (MF_DBGLEVEL >= 1) {
274 DbpString("Authentication failed. Card timeout.");
275 }
276 OnError();
277 return;
278 }
279
280 if ( resp[2] == 0x00 ){
281
282 struct desfire_key sessionKey = {0};
283 desfirekey_t skey = &sessionKey;
284 Desfire_session_key_new( RndA, RndB , key, skey );
285 //print_result("SESSION : ", skey->data, 8);
286
287 memcpy(encRndA, resp+3, 8);
288 des_dec(&encRndA, &encRndA, key->data);
289 rol(decRndA,8);
290 for (int x = 0; x < 8; x++) {
291 if (decRndA[x] != encRndA[x]) {
292 DbpString("Authetication failed. Cannot varify PICC.");
293 OnError();
294 return;
295 }
296 }
297
298 //Change the selected key to a new value.
299 /*
300
301 cmd[0] = CHANGE_KEY;
302 cmd[1] = keyno;
303
304 uint8_t newKey[16] = {0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77};
305
306 uint8_t first, second;
307 uint8_t buff1[8] = {0x00};
308 uint8_t buff2[8] = {0x00};
309 uint8_t buff3[8] = {0x00};
310
311 memcpy(buff1,newKey, 8);
312 memcpy(buff2,newKey + 8, 8);
313
314 ComputeCrc14443(CRC_14443_A, newKey, 16, &first, &second);
315 memcpy(buff3, &first, 1);
316 memcpy(buff3 + 1, &second, 1);
317
318 des_dec(&buff1, &buff1, skey->data);
319 memcpy(cmd+2,buff1,8);
320
321 for (int x = 0; x < 8; x++) {
322 buff2[x] = buff2[x] ^ buff1[x];
323 }
324 des_dec(&buff2, &buff2, skey->data);
325 memcpy(cmd+10,buff2,8);
326
327 for (int x = 0; x < 8; x++) {
328 buff3[x] = buff3[x] ^ buff2[x];
329 }
330 des_dec(&buff3, &buff3, skey->data);
331 memcpy(cmd+18,buff3,8);
332
333 // The command always times out on the first attempt, this will retry until a response
334 // is recieved.
335 len = 0;
336 while(!len) {
337 len = DesfireAPDU(cmd,26,resp);
338 }
339 */
340
341 OnSuccess();
342 cmd_send(CMD_ACK,1,0,0,skey->data,8);
343
344 } else {
345 DbpString("Authetication failed.");
346 OnError();
347 return;
348 }
349
350 }
351 }
352 break;
353 case 2:
354 //SendDesfireCommand(AUTHENTICATE_ISO, &keyno, resp);
355 break;
356 case 3:{
357
358 //defaultkey
359 uint8_t keybytes[16] = {0x00};
360 if (datain[1] == 0xff){
361 memcpy(keybytes,PICC_MASTER_KEY16,16);
362 } else{
363 memcpy(keybytes, datain+1, datalen);
364 }
365
366 struct desfire_key defaultkey = {0x00};
367 desfirekey_t key = &defaultkey;
368 Desfire_aes_key_new( keybytes, key);
369
370 AesCtx ctx;
371 if ( AesCtxIni(&ctx, IV, key->data, KEY128, CBC) < 0 ){
372 if( MF_DBGLEVEL >= 4) {
373 Dbprintf("AES context failed to init");
374 }
375 OnError();
376 return;
377 }
378
379 cmd[0] = AUTHENTICATE_AES;
380 cmd[1] = 0x00; //keynumber
381 len = DesfireAPDU(cmd, 2, resp);
382 if ( !len ) {
383 if (MF_DBGLEVEL >= 1) {
384 DbpString("Authentication failed. Card timeout.");
385 }
386 OnError();
387 return;
388 }
389
390 memcpy( encRndB, resp+3, 16);
391
392 // dekryptera tagnonce.
393 AesDecrypt(&ctx, encRndB, decRndB, 16);
394 rol(decRndB,16);
395 memcpy(both, nonce,16);
396 memcpy(both+16, decRndB ,16 );
397 AesEncrypt(&ctx, both, encBoth, 32 );
398
399 cmd[0] = ADDITIONAL_FRAME;
400 memcpy(cmd+1, encBoth, 32 );
401
402 len = DesfireAPDU(cmd, 33, resp); // 1 + 32 == 33
403 if ( !len ) {
404 if (MF_DBGLEVEL >= 1) {
405 DbpString("Authentication failed. Card timeout.");
406 }
407 OnError();
408 return;
409 }
410
411 if ( resp[2] == 0x00 ){
412 // Create AES Session key
413 struct desfire_key sessionKey = {0};
414 desfirekey_t skey = &sessionKey;
415 Desfire_session_key_new( nonce, decRndB , key, skey );
416 print_result("SESSION : ", skey->data, 16);
417 } else {
418 DbpString("Authetication failed.");
419 OnError();
420 return;
421 }
422
423 break;
424 }
425 }
426
427 OnSuccess();
428 cmd_send(CMD_ACK,1,len,0,resp,len);
429 }
430
431 // 3 olika ISO sätt att skicka data till DESFIRE (direkt, inkapslat, inkapslat ISO)
432 // cmd = cmd bytes to send
433 // cmd_len = length of cmd
434 // dataout = pointer to response data array
435 int DesfireAPDU(uint8_t *cmd, size_t cmd_len, uint8_t *dataout){
436
437 size_t len = 0;
438 size_t wrappedLen = 0;
439 uint8_t wCmd[USB_CMD_DATA_SIZE] = {0};
440
441 uint8_t *resp = ((uint8_t *)BigBuf) + RECV_RESP_OFFSET;
442 uint8_t *resp_par = ((uint8_t *)BigBuf) + RECV_RESP_PAR_OFFSET;
443
444 wrappedLen = CreateAPDU( cmd, cmd_len, wCmd);
445
446 if (MF_DBGLEVEL >= 4) {
447 print_result("WCMD <--: ", wCmd, wrappedLen);
448 }
449 ReaderTransmit( wCmd, wrappedLen, NULL);
450
451 len = ReaderReceive(resp, resp_par);
452
453 if( len == 0x00 ){
454 if (MF_DBGLEVEL >= 4) {
455 Dbprintf("fukked");
456 }
457 return FALSE; //DATA LINK ERROR
458 }
459 // if we received an I- or R(ACK)-Block with a block number equal to the
460 // current block number, toggle the current block number
461 else if (len >= 4 // PCB+CID+CRC = 4 bytes
462 && ((resp[0] & 0xC0) == 0 // I-Block
463 || (resp[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
464 && (resp[0] & 0x01) == pcb_blocknum) // equal block numbers
465 {
466 pcb_blocknum ^= 1; //toggle next block
467 }
468
469 memcpy(dataout, resp, len);
470 return len;
471 }
472
473 // CreateAPDU
474 size_t CreateAPDU( uint8_t *datain, size_t len, uint8_t *dataout){
475
476 size_t cmdlen = MIN(len+4, USB_CMD_DATA_SIZE-1);
477
478 uint8_t cmd[cmdlen];
479 memset(cmd, 0, cmdlen);
480
481 cmd[0] = 0x0A; // 0x0A = skicka cid, 0x02 = ingen cid. Särskilda bitar //
482 cmd[0] |= pcb_blocknum; // OR the block number into the PCB
483 cmd[1] = 0x00; // CID: 0x00 //TODO: allow multiple selected cards
484
485 memcpy(cmd+2, datain, len);
486 AppendCrc14443a(cmd, len+2);
487
488 memcpy(dataout, cmd, cmdlen);
489
490 return cmdlen;
491 }
492
493 // crc_update(&desfire_crc32, 0, 1); /* CMD_WRITE */
494 // crc_update(&desfire_crc32, addr, addr_sz);
495 // crc_update(&desfire_crc32, byte, 8);
496 // uint32_t crc = crc_finish(&desfire_crc32);
497
498 void OnSuccess(){
499 pcb_blocknum = 0;
500 ReaderTransmit(deselect_cmd, 3 , NULL);
501 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
502 LEDsoff();
503 }
504
505 void OnError(){
506 pcb_blocknum = 0;
507 ReaderTransmit(deselect_cmd, 3 , NULL);
508 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
509 cmd_send(CMD_ACK,0,0,0,0,0);
510 LEDsoff();
511 }
Impressum, Datenschutz