cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhficlass.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
   3 // Copyright (C) 2011 Gerhard de Koning Gans
   4 //
   5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   6 // at your option, any later version. See the LICENSE.txt file for the text of
   7 // the license.
   8 //-----------------------------------------------------------------------------
   9 // High frequency iClass commands
  10 //-----------------------------------------------------------------------------
  11
  12 #include <stdio.h>
  13 #include <stdlib.h>
  14 #include <string.h>
  15 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
  16 #include "data.h"
  17 //#include "proxusb.h"
  18 #include "proxmark3.h"
  19 #include "ui.h"
  20 #include "cmdparser.h"
  21 #include "cmdhficlass.h"
  22 #include "common.h"
  23 #include "util.h"
  24 #include "loclass/des.h"
  25 #include "loclass/cipherutils.h"
  26 #include "loclass/cipher.h"
  27 #include "loclass/ikeys.h"
  28
  29 static int CmdHelp(const char *Cmd);
  30
  31 int CmdHFiClassList(const char *Cmd)
  32 {
  33   uint8_t got[1920];
  34   GetFromBigBuf(got,sizeof(got),0);
  35
  36   PrintAndLog("recorded activity:");
  37   PrintAndLog(" ETU     :rssi: who bytes");
  38   PrintAndLog("---------+----+----+-----------");
  39
  40   int i = 0;
  41   int prev = -1;
  42
  43   for (;;) {
  44     if(i >= 1900) {
  45       break;
  46     }
  47
  48     bool isResponse;
  49     int timestamp = *((uint32_t *)(got+i));
  50     if (timestamp & 0x80000000) {
  51       timestamp &= 0x7fffffff;
  52       isResponse = 1;
  53     } else {
  54       isResponse = 0;
  55     }
  56
  57     int metric = 0;
  58     int parityBits = *((uint32_t *)(got+i+4));
  59     // 4 bytes of additional information...
  60     // maximum of 32 additional parity bit information
  61     //
  62     // TODO:
  63     // at each quarter bit period we can send power level (16 levels)
  64     // or each half bit period in 256 levels.
  65
  66
  67     int len = got[i+8];
  68
  69     if (len > 100) {
  70       break;
  71     }
  72     if (i + len >= 1900) {
  73       break;
  74     }
  75
  76     uint8_t *frame = (got+i+9);
  77
  78     // Break and stick with current result if buffer was not completely full
  79     if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }
  80
  81     char line[1000] = "";
  82     int j;
  83     for (j = 0; j < len; j++) {
  84       int oddparity = 0x01;
  85       int k;
  86
  87       for (k=0;k<8;k++) {
  88         oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
  89       }
  90
  91       //if((parityBits >> (len - j - 1)) & 0x01) {
  92       if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
  93         sprintf(line+(j*4), "%02x!  ", frame[j]);
  94       }
  95       else {
  96         sprintf(line+(j*4), "%02x   ", frame[j]);
  97       }
  98     }
  99
 100     char *crc;
 101     crc = "";
 102     if (len > 2) {
 103       uint8_t b1, b2;
 104       for (j = 0; j < (len - 1); j++) {
 105         // gives problems... search for the reason..
 106         /*if(frame[j] == 0xAA) {
 107           switch(frame[j+1]) {
 108             case 0x01:
 109               crc = "[1] Two drops close after each other";
 110             break;
 111             case 0x02:
 112               crc = "[2] Potential SOC with a drop in second half of bitperiod";
 113               break;
 114             case 0x03:
 115               crc = "[3] Segment Z after segment X is not possible";
 116               break;
 117             case 0x04:
 118               crc = "[4] Parity bit of a fully received byte was wrong";
 119               break;
 120             default:
 121               crc = "[?] Unknown error";
 122               break;
 123           }
 124           break;
 125         }*/
 126       }
 127
 128       if (strlen(crc)==0) {
 129         if(!isResponse && len == 4) {
 130                 // Rough guess that this is a command from the reader
 131                 // For iClass the command byte is not part of the CRC
 132                 ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
 133         }
 134         else {
 135                 // For other data.. CRC might not be applicable (UPDATE commands etc.)
 136                 ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
 137         }
 138         //printf("%1x %1x",(unsigned)b1,(unsigned)b2);
 139         if (b1 != frame[len-2] || b2 != frame[len-1]) {
 140           crc = (isResponse & (len < 8)) ? "" : " !crc";
 141         } else {
 142           crc = "";
 143         }
 144       }
 145     } else {
 146       crc = ""; // SHORT
 147     }
 148
 149     char metricString[100];
 150     if (isResponse) {
 151       sprintf(metricString, "%3d", metric);
 152     } else {
 153       strcpy(metricString, "   ");
 154     }
 155
 156     PrintAndLog(" +%7d: %s: %s %s %s",
 157       (prev < 0 ? 0 : (timestamp - prev)),
 158       metricString,
 159       (isResponse ? "TAG" : "   "), line, crc);
 160
 161     prev = timestamp;
 162     i += (len + 9);
 163   }
 164   return 0;
 165 }
 166
 167 /*void iso14a_set_timeout(uint32_t timeout) {
 168         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_SET_TIMEOUT, 0, timeout}};
 169         SendCommand(&c);
 170 }*/
 171
 172 int CmdHFiClassSnoop(const char *Cmd)
 173 {
 174   UsbCommand c = {CMD_SNOOP_ICLASS};
 175   SendCommand(&c);
 176   return 0;
 177 }
 178
 179 int CmdHFiClassSim(const char *Cmd)
 180 {
 181   uint8_t simType = 0;
 182   uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
 183
 184   if (strlen(Cmd)<2) {
 185         PrintAndLog("Usage:  hf iclass sim    <sim type> <CSN (16 hex symbols)>");
 186         PrintAndLog("        sample: hf iclass sim 0 031FEC8AF7FF12E0");
 187         return 0;
 188   }
 189
 190   simType = param_get8(Cmd, 0);
 191   if (param_gethex(Cmd, 1, CSN, 16)) {
 192         PrintAndLog("A CSN should consist of 16 HEX symbols");
 193         return 1;
 194   }
 195   PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
 196
 197   UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType}};
 198   memcpy(c.d.asBytes, CSN, 8);
 199   SendCommand(&c);
 200
 201   /*UsbCommand * resp = WaitForResponseTimeout(CMD_ACK, 1500);
 202   if (resp != NULL) {
 203         uint8_t                isOK  = resp->arg[0] & 0xff;
 204         PrintAndLog("isOk:%02x", isOK);
 205   } else {
 206         PrintAndLog("Command execute timeout");
 207   }*/
 208
 209   return 0;
 210 }
 211
 212 int CmdHFiClassReader(const char *Cmd)
 213 {
 214   uint8_t readerType = 0;
 215
 216   if (strlen(Cmd)<1) {
 217         PrintAndLog("Usage:  hf iclass reader    <reader type>");
 218         PrintAndLog("        sample: hf iclass reader 0");
 219         return 0;
 220   }
 221
 222   readerType = param_get8(Cmd, 0);
 223   PrintAndLog("--readertype:%02x", readerType);
 224
 225   UsbCommand c = {CMD_READER_ICLASS, {readerType}};
 226   SendCommand(&c);
 227
 228   return 0;
 229 }
 230
 231 int CmdHFiClassReader_Replay(const char *Cmd)
 232 {
 233   uint8_t readerType = 0;
 234   uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
 235
 236   if (strlen(Cmd)<1) {
 237     PrintAndLog("Usage:  hf iclass replay <MAC>");
 238     PrintAndLog("        sample: hf iclass replay 00112233");
 239     return 0;
 240   }
 241
 242   if (param_gethex(Cmd, 0, MAC, 8)) {
 243     PrintAndLog("MAC must include 8 HEX symbols");
 244     return 1;
 245   }
 246
 247   UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
 248   memcpy(c.d.asBytes, MAC, 4);
 249   SendCommand(&c);
 250
 251   return 0;
 252 }
 253
 254 int CmdHFiClassReader_Dump(const char *Cmd)
 255 {
 256   uint8_t readerType = 0;
 257   uint8_t MAC[4]={0x00,0x00,0x00,0x00};
 258   uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 259   uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 260   uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 261   uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 262   uint8_t result[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 263   uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 264   des_context ctx_enc;
 265   uint64_t crypted_id=0;
 266
 267   if (strlen(Cmd)<3) {
 268     PrintAndLog("Usage:  hf iclass dump <Key> <CSN> <CC>");
 269     PrintAndLog("        sample: hf iclass dump 0011223344556677 aabbccddeeffgghh FFFFFFFFFFFFFFFF");
 270     return 0;
 271   }
 272
 273   if (param_gethex(Cmd, 0, KEY, 16)) {
 274     PrintAndLog("KEY must include 16 HEX symbols");
 275     return 1;
 276   }
 277
 278   if (param_gethex(Cmd, 1, CSN, 16)) {
 279     PrintAndLog("CSN must include 16 HEX symbols");
 280     return 1;
 281   }
 282   if (param_gethex(Cmd, 2, CC_temp, 16)) {
 283     PrintAndLog("CC must include 16 HEX symbols");
 284     return 1;
 285   }
 286
 287   memcpy(CCNR,CC_temp,8);
 288   des_setkey_enc( &ctx_enc, KEY);
 289   des_crypt_ecb(&ctx_enc,CSN,result);
 290   PrintAndLog("DES Key: %s",sprint_hex(result,8));
 291     uint64_t newz=0;
 292         crypted_id = bytes_to_num(result,8);
 293         uint64_t x = (crypted_id & 0xFFFF000000000000 );
 294         pushbackSixBitByte(&newz, getSixBitByte(crypted_id,0),7);
 295         pushbackSixBitByte(&newz, getSixBitByte(crypted_id,1),6);
 296         pushbackSixBitByte(&newz, getSixBitByte(crypted_id,2),5);
 297         pushbackSixBitByte(&newz, getSixBitByte(crypted_id,3),4);
 298         pushbackSixBitByte(&newz, getSixBitByte(crypted_id,4),3);
 299         pushbackSixBitByte(&newz, getSixBitByte(crypted_id,5),2);
 300         pushbackSixBitByte(&newz, getSixBitByte(crypted_id,6),1);
 301         pushbackSixBitByte(&newz, getSixBitByte(crypted_id,7),0);
 302         newz|= x;
 303         crypted_id=newz;
 304         num_to_bytes(crypted_id,8,result);
 305   PrintAndLog("DESr Key: %s",sprint_hex(result,8));
 306   //crypted_id = bytes_to_num(result,8);
 307   //memset(result,0,8);
 308   hash0(crypted_id,div_key);
 309   //memcpy(div_key,result,8);
 310   PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
 311   calc_iclass_mac(CCNR,12,div_key,MAC);
 312
 313   UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
 314   memcpy(c.d.asBytes, MAC, 4);
 315   SendCommand(&c);
 316
 317   return 0;
 318 }
 319
 320
 321 static command_t CommandTable[] =
 322 {
 323   {"help",    CmdHelp,        1, "This help"},
 324   {"list",    CmdHFiClassList,   0, "List iClass history"},
 325   {"snoop",   CmdHFiClassSnoop,  0, "Eavesdrop iClass communication"},
 326   {"sim",     CmdHFiClassSim,    0, "Simulate iClass tag"},
 327   {"reader",  CmdHFiClassReader, 0, "Read an iClass tag"},
 328   {"replay",  CmdHFiClassReader_Replay, 0, "Read an iClass tag via Reply Attack"},
 329   {"dump",        CmdHFiClassReader_Dump, 0, "Authenticate and Dump iClass tag"},
 330   {NULL, NULL, 0, NULL}
 331 };
 332
 333 int CmdHFiClass(const char *Cmd)
 334 {
 335   CmdsParse(CommandTable, Cmd);
 336   return 0;
 337 }
 338
 339 int CmdHelp(const char *Cmd)
 340 {
 341   CmdsHelp(CommandTable);
 342   return 0;
 343 }