fix 'hf iclass sim':

[proxmark3-svn] / client / cmdhficlass.c

diff --git a/client/cmdhficlass.c b/client/cmdhficlass.c
index 55804cf8c20e75a90c6983e56d357cc682bf1e69..48b62b176b94e07002d221d89f12f9217b4ff7cb 100644 (file)
--- a/client/cmdhficlass.c
+++ b/client/cmdhficlass.c
@@ -33,6 +33,7 @@
 #include "usb_cmd.h"
 #include "cmdhfmfu.h"
 #include "util_posix.h"
 #include "usb_cmd.h"
 #include "cmdhfmfu.h"
 #include "util_posix.h"

+#include "cmdhf14a.h" // DropField()

 
 static int CmdHelp(const char *Cmd);
 
 
 static int CmdHelp(const char *Cmd);
 


@@ -99,7 +100,46 @@ int usage_hf_iclass_sim(void) {
        return 0;
 }
 
        return 0;
 }
 

+// the original malicious IDs from Flavio D. Garcia, Gerhard de Koning Gans, Roel Verdult,
+// and Milosch Meriac. Dismantling iClass and iClass Elite.

 #define NUM_CSNS 15
 #define NUM_CSNS 15

+static uint8_t csns[8 * NUM_CSNS] = {
+       0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
+       0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
+       0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
+       0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
+       0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
+       0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
+       0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
+       0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
+       0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
+       0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
+       0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
+       0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
+       0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
+       0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
+       0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
+
+
+// pre-defined 9 CSNs by iceman.
+// only one csn depend on several others.
+// six depends only on the first csn,  (0,1, 0x45)
+
+// #define NUM_CSNS 9
+// static uint8_t csns[8 * NUM_CSNS] = {
+    // 0x01, 0x0A, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
+    // 0x0C, 0x06, 0x0C, 0xFE, 0xF7, 0xFF, 0x12, 0xE0,
+    // 0x10, 0x97, 0x83, 0x7B, 0xF7, 0xFF, 0x12, 0xE0,
+    // 0x13, 0x97, 0x82, 0x7A, 0xF7, 0xFF, 0x12, 0xE0,
+    // 0x07, 0x0E, 0x0D, 0xF9, 0xF7, 0xFF, 0x12, 0xE0,
+    // 0x14, 0x96, 0x84, 0x76, 0xF7, 0xFF, 0x12, 0xE0,
+    // 0x17, 0x96, 0x85, 0x71, 0xF7, 0xFF, 0x12, 0xE0,
+    // 0xCE, 0xC5, 0x0F, 0x77, 0xF7, 0xFF, 0x12, 0xE0,
+    // 0xD2, 0x5A, 0x82, 0xF8, 0xF7, 0xFF, 0x12, 0xE0
+    // //0x04, 0x08, 0x9F, 0x78, 0x6E, 0xFF, 0x12, 0xE0
+// };
+
+

 int CmdHFiClassSim(const char *Cmd) {
        uint8_t simType = 0;
        uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
 int CmdHFiClassSim(const char *Cmd) {
        uint8_t simType = 0;
        uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};


@@ -109,45 +149,20 @@ int CmdHFiClassSim(const char *Cmd) {
        }
        simType = param_get8ex(Cmd, 0, 0, 10);
 
        }
        simType = param_get8ex(Cmd, 0, 0, 10);
 

-       if(simType == 0)
-       {
+       if (simType == ICLASS_SIM_MODE_CSN) {

                if (param_gethex(Cmd, 1, CSN, 16)) {
                        PrintAndLog("A CSN should consist of 16 HEX symbols");
                        return usage_hf_iclass_sim();
                }
                if (param_gethex(Cmd, 1, CSN, 16)) {
                        PrintAndLog("A CSN should consist of 16 HEX symbols");
                        return usage_hf_iclass_sim();
                }

-

                PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
        }
                PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
        }

-       if(simType > 3)
-       {
-               PrintAndLog("Undefined simptype %d", simType);
-               return usage_hf_iclass_sim();
-       }

 
 

-       uint8_t numberOfCSNs=0;
-       if(simType == 2)
-       {
-               UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
+       uint8_t numberOfCSNs = 0;
+       if (simType == ICLASS_SIM_MODE_READER_ATTACK) {
+               UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType, NUM_CSNS}};

                UsbCommand resp = {0};
 
                UsbCommand resp = {0};
 

-               uint8_t csns[8*NUM_CSNS] = {
-                       0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
-                       0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
-                       0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
-                       0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
-                       0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
-                       0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
-                       0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
-                       0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
-                       0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
-                       0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
-                       0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
-                       0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
-                       0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
-                       0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
-                       0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
-
-               memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
+               memcpy(c.d.asBytes, csns, 8 * NUM_CSNS);

 
                SendCommand(&c);
                if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
 
                SendCommand(&c);
                if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {


@@ -156,9 +171,9 @@ int CmdHFiClassSim(const char *Cmd) {
                }
 
                uint8_t num_mac_responses  = resp.arg[1];
                }
 
                uint8_t num_mac_responses  = resp.arg[1];

-               PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
+               PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses, NUM_CSNS);

 
 

-               size_t datalen = NUM_CSNS*24;
+               size_t datalen = NUM_CSNS * 24;

                /*
                 * Now, time to dump to file. We'll use this format:
                 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
                /*
                 * Now, time to dump to file. We'll use this format:
                 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....


@@ -166,28 +181,29 @@ int CmdHFiClassSim(const char *Cmd) {
                 * 8 * 24 bytes.
                 *
                 * The returndata from the pm3 is on the following format
                 * 8 * 24 bytes.
                 *
                 * The returndata from the pm3 is on the following format

-                * <4 byte NR><4 byte MAC>
-                * CC are all zeroes, CSN is the same as was sent in
+                * <8 byte CC><4 byte NR><4 byte MAC>
+                * CSN is the same as was sent in

                 **/
                void* dump = malloc(datalen);
                 **/
                void* dump = malloc(datalen);

-               memset(dump,0,datalen);//<-- Need zeroes for the CC-field
-               uint8_t i = 0;
-               for(i = 0 ; i < NUM_CSNS ; i++)
-               {
-                       memcpy(dump+i*24, csns+i*8,8); //CSN
-                       //8 zero bytes here...
+               for(int i = 0; i < NUM_CSNS; i++) {
+                       memcpy(dump + i*24, csns+i*8, 8); //CSN
+            //copy CC from response
+            memcpy(dump + i*24 + 8, resp.d.asBytes + i*16, 8);

                        //Then comes NR_MAC (eight bytes from the response)
                        //Then comes NR_MAC (eight bytes from the response)

-                       memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
-
+                       memcpy(dump + i*24 + 16, resp.d.asBytes + i*16 + 8, 8);

                }
                /** Now, save to dumpfile **/
                saveFile("iclass_mac_attack", "bin", dump,datalen);
                free(dump);
                }
                /** Now, save to dumpfile **/
                saveFile("iclass_mac_attack", "bin", dump,datalen);
                free(dump);

-       }else
-       {
-               UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
+
+       } else if (simType == ICLASS_SIM_MODE_CSN || simType == ICLASS_SIM_MODE_CSN_DEFAULT) {
+               UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType, numberOfCSNs}};

                memcpy(c.d.asBytes, CSN, 8);
                SendCommand(&c);
                memcpy(c.d.asBytes, CSN, 8);
                SendCommand(&c);

+
+       } else {
+               PrintAndLog("Undefined simtype %d", simType);
+               return usage_hf_iclass_sim();

        }
 
        return 0;
        }
 
        return 0;


@@ -1264,24 +1280,18 @@ int CmdHFiClass_loclass(const char *Cmd) {
                return 0;
        }
        char fileName[255] = {0};
                return 0;
        }
        char fileName[255] = {0};

-       if(opt == 'f')
-       {
-               if(param_getstr(Cmd, 1, fileName, sizeof(fileName)) > 0)
-               {
+       if(opt == 'f') {
+               if(param_getstr(Cmd, 1, fileName, sizeof(fileName)) > 0) {

                        return bruteforceFileNoKeys(fileName);
                        return bruteforceFileNoKeys(fileName);

-               }else
-               {
+               } else {

                        PrintAndLog("You must specify a filename");
                }
                        PrintAndLog("You must specify a filename");
                }

-       }
-       else if(opt == 't')
-       {
+       } else if(opt == 't') {

                int errors = testCipherUtils();
                errors += testMAC();
                errors += doKeyTests(0);
                errors += testElite();
                int errors = testCipherUtils();
                errors += testMAC();
                errors += doKeyTests(0);
                errors += testElite();

-               if(errors)
-               {
+               if(errors) {

                        prnlog("OBS! There were errors!!!");
                }
                return errors;
                        prnlog("OBS! There were errors!!!");
                }
                return errors;