// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
// Copyright (C) 2011 Gerhard de Koning Gans
// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
+// Copyright (C) 2019 piwi
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
};
-typedef struct iclass_block {
- uint8_t d[8];
-} iclass_block_t;
-
-
// iclass / picopass chip config structures and shared routines
typedef struct {
uint8_t app_limit; //[8]
CLIParserInit("hf iclass snoop", "\nSnoop a communication between an iClass Reader and an iClass Tag.", NULL);
void* argtable[] = {
arg_param_begin,
- arg_lit0("j", "--jam", "Jam (prevent) e-purse Updates"),
+ arg_lit0("j", "jam", "Jam (prevent) e-purse Updates"),
arg_param_end
};
if (CLIParserParseString(Cmd, argtable, arg_getsize(argtable), true)){
bool jam_epurse_update = arg_get_lit(1);
const uint8_t update_epurse_sequence[2] = {0x87, 0x02};
-
+
UsbCommand c = {CMD_SNOOP_ICLASS, {0}};
if (jam_epurse_update) {
c.arg[0] = sizeof(update_epurse_sequence);
while (!ukbhit()) {
SendCommand(&c);
- if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
+ if (WaitForResponseTimeout(CMD_ACK, &resp, 1000)) {
uint8_t readStatus = resp.arg[0] & 0xff;
uint8_t *data = resp.d.asBytes;
if (tagFound && !loop) return 1;
} else {
- if (verbose) PrintAndLog("Command execute timeout");
+ if (verbose) PrintAndLog("Error: No response from Proxmark.");
+ break;
}
if (!loop) break;
}
}
-static int CmdHFiClassReader_Replay(const char *Cmd) {
- uint8_t readerType = 0;
- uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
-
- if (strlen(Cmd)<1) {
- PrintAndLog("Usage: hf iclass replay <MAC>");
- PrintAndLog(" sample: hf iclass replay 00112233");
- return 0;
- }
-
- if (param_gethex(Cmd, 0, MAC, 8)) {
- PrintAndLog("MAC must include 8 HEX symbols");
- return 1;
- }
-
- UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
- memcpy(c.d.asBytes, MAC, 4);
- SendCommand(&c);
-
- return 0;
-}
-
-
static void usage_hf_iclass_eload(void) {
PrintAndLog("Loads iclass tag-dump into emulator memory on device");
PrintAndLog("Usage: hf iclass eload f <filename>");
}
-static bool iClass_authenticate(uint8_t *CSN, uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
+static bool iClass_authenticate(uint8_t *CSN, uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool replay, bool verbose) {
//get div_key
- if (rawkey)
+ if (rawkey || replay)
memcpy(div_key, KEY, 8);
else
HFiClassCalcDivKey(CSN, KEY, div_key, elite);
- if (verbose) PrintAndLog("Authenticating with %s: %s", rawkey ? "raw key" : "diversified key", sprint_hex(div_key, 8));
+ char keytypetext[23] = "legacy diversified key";
+ if (rawkey) {
+ strcpy(keytypetext, "raw key");
+ } else if (replay) {
+ strcpy(keytypetext, "replayed NR/MAC");
+ } else if (elite) {
+ strcpy(keytypetext, "Elite diversified key");
+ }
+
+ if (verbose) PrintAndLog("Authenticating with %s: %s", keytypetext, sprint_hex(div_key, 8));
UsbCommand resp;
UsbCommand d = {CMD_ICLASS_READCHECK, {2, use_credit_key, 0}};
return false;
}
- uint8_t CCNR[12];
- memcpy(CCNR, resp.d.asBytes, 8);
- memset(CCNR+8, 0x00, 4); // NR = {0, 0, 0, 0}
-
- doMAC(CCNR, div_key, MAC);
+ if (replay) {
+ memcpy(MAC, KEY+4, 4);
+ } else {
+ uint8_t CCNR[12];
+ memcpy(CCNR, resp.d.asBytes, 8);
+ memset(CCNR+8, 0x00, 4); // default NR = {0, 0, 0, 0}
+ doMAC(CCNR, div_key, MAC);
+ }
d.cmd = CMD_ICLASS_CHECK;
- memcpy(d.d.asBytes, MAC, 4);
+ if (replay) {
+ memcpy(d.d.asBytes, KEY, 8);
+ } else {
+ memset(d.d.asBytes, 0x00, 4); // default NR = {0, 0, 0, 0}
+ memcpy(d.d.asBytes+4, MAC, 4);
+ }
clearCommandBuffer();
SendCommand(&d);
if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
static void usage_hf_iclass_dump(void) {
- PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r\n");
+ PrintAndLog("Usage: hf iclass dump f <fileName> k <Key> c <CreditKey> e|r|n\n");
PrintAndLog("Options:");
PrintAndLog(" f <filename> : specify a filename to save dump to");
- PrintAndLog(" k <Key> : *Access Key as 16 hex symbols or 1 hex to select key from memory");
- PrintAndLog(" c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
- PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte");
- PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
+ PrintAndLog(" k <Key> : *Debit Key (AA1) as 16 hex symbols (8 bytes) or 1 hex to select key from memory");
+ PrintAndLog(" c <CreditKey>: Credit Key (AA2) as 16 hex symbols (8 bytes) or 1 hex to select key from memory");
+ PrintAndLog(" e : If 'e' is specified, the keys are interpreted as Elite");
+ PrintAndLog(" Custom Keys (KCus), which can be obtained via reader-attack");
PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
- PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4");
+ PrintAndLog(" r : If 'r' is specified, keys are interpreted as raw blocks 3/4");
+ PrintAndLog(" n : If 'n' is specified, keys are interpreted as NR/MAC pairs which can be obtained by 'hf iclass snoop'");
PrintAndLog(" NOTE: * = required");
PrintAndLog("Samples:");
PrintAndLog(" hf iclass dump k 001122334455667B");
bool use_credit_key = false;
bool elite = false;
bool rawkey = false;
+ bool NRMAC_replay = false;
bool errors = false;
bool verbose = false;
uint8_t cmdp = 0;
if (keyNbr < ICLASS_KEYS_MAX) {
memcpy(KEY, iClass_Key_Table[keyNbr], 8);
} else {
- PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
+ PrintAndLog("\nERROR: Debit KeyNbr is invalid\n");
errors = true;
}
} else {
- PrintAndLog("\nERROR: Credit Key is incorrect length\n");
+ PrintAndLog("\nERROR: Debit Key is incorrect length\n");
errors = true;
}
cmdp += 2;
rawkey = true;
cmdp++;
break;
+ case 'n':
+ case 'N':
+ NRMAC_replay = true;
+ cmdp++;
+ break;
case 'v':
case 'V':
verbose = true;
}
}
+ if (elite + rawkey + NRMAC_replay > 1) {
+ PrintAndLog("You cannot combine the 'e', 'r', and 'n' options\n");
+ errors = true;
+ }
+
if (errors || cmdp < 2) {
usage_hf_iclass_dump();
return 0;
// if only credit key is given: try for AA1 as well (not for iclass but for some picopass this will work)
if (!have_debit_key && have_credit_key) {
- use_credit_key = true;
memcpy(KEY, CreditKEY, 8);
}
if (AA1_maxBlk > maxBlk) AA1_maxBlk = maxBlk;
}
- // authenticate debit key (or credit key if we have no debit key) and get div_key - later store in dump block 3
- if (!iClass_authenticate(tag_data, KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose)){
+ // authenticate with debit key (or credit key if we have no debit key) and get div_key - later store in dump block 3
+ if (!iClass_authenticate(tag_data, KEY, MAC, div_key, false, elite, rawkey, NRMAC_replay, verbose)) {
DropField();
return 0;
}
DropField();
// AA2 authenticate credit key and git c_div_key - later store in dump block 4
uint8_t CSN[8];
- if (!iClass_select(CSN, verbose, false, true) || !iClass_authenticate(CSN, CreditKEY, MAC, c_div_key, true, false, false, verbose)){
+ if (!iClass_select(CSN, verbose, false, true) || !iClass_authenticate(CSN, CreditKEY, MAC, c_div_key, true, false, false, NRMAC_replay, verbose)){
DropField();
return 0;
}
}
-static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) {
+static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool NRMAC_replay, bool verbose) {
uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
uint8_t CSN[8];
- if (!iClass_select(CSN, verbose, true, true) || !iClass_authenticate(CSN, KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose)) {
+ if (!iClass_select(CSN, verbose, true, true) || !iClass_authenticate(CSN, KEY, MAC, div_key, use_credit_key, elite, rawkey, NRMAC_replay, verbose)) {
DropField();
return 0;
}
PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
PrintAndLog(" r : If 'r' is specified, no computations applied to key");
+ PrintAndLog(" o : override protection and allow modification of blocks 0...4");
PrintAndLog("Samples:");
PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
- PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
+ PrintAndLog(" hf iclass writeblk b 03 d AAAAAAAAAAAAAAAA k 001122334455667B c o");
}
static int CmdHFiClass_WriteBlock(const char *Cmd) {
- uint8_t blockno=0;
- uint8_t bldata[8]={0,0,0,0,0,0,0,0};
- uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t blockno = 0;
+ uint8_t bldata[8] = {0};
+ uint8_t KEY[8] = {0};
uint8_t keyNbr = 0;
uint8_t dataLen = 0;
char tempStr[50] = {0};
bool use_credit_key = false;
bool elite = false;
- bool rawkey= false;
+ bool rawkey = false;
+ bool override_protection = false;
bool errors = false;
uint8_t cmdp = 0;
- while(param_getchar(Cmd, cmdp) != 0x00)
- {
- switch(param_getchar(Cmd, cmdp))
- {
+
+ while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
+ switch(param_getchar(Cmd, cmdp)) {
case 'h':
case 'H':
usage_hf_iclass_writeblock();
rawkey = true;
cmdp++;
break;
+ case 'o':
+ case 'O':
+ override_protection = true;
+ cmdp++;
+ break;
default:
PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
errors = true;
}
}
+ if (elite && rawkey) {
+ PrintAndLog("You cannot combine the 'e' and 'r' options\n");
+ errors = true;
+ }
+
if (cmdp < 6) {
usage_hf_iclass_writeblock();
return 0;
}
- int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true);
+
+ if (blockno < 5) {
+ if (override_protection) {
+ PrintAndLog("Info: modifying keys, e-purse or configuration block.");
+ } else {
+ PrintAndLog("You are going to modify keys, e-purse or configuration block.");
+ PrintAndLog("You must add the 'o' (override) option to confirm that you know what you are doing");
+ return 0;
+ }
+ }
+
+ int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, false, true);
+
DropField();
return ans;
}
static void usage_hf_iclass_clone(void) {
- PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
+ PrintAndLog("Usage: hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r o");
PrintAndLog("Options:");
PrintAndLog(" f <filename>: specify a filename to clone from");
PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
- PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols");
+ PrintAndLog(" l <Last Blk>: The last block to clone as 2 hex symbols");
PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
PrintAndLog(" r : If 'r' is specified, no computations applied to key");
+ PrintAndLog(" o : override protection and allow modification of target blocks 0...4");
PrintAndLog("Samples:");
PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
+ PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
+ PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 03 l 19 k 0 e o");
}
bool use_credit_key = false;
bool elite = false;
bool rawkey = false;
+ bool override_protection = false;
bool errors = false;
uint8_t cmdp = 0;
- while(param_getchar(Cmd, cmdp) != 0x00)
- {
- switch(param_getchar(Cmd, cmdp))
- {
+
+ while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
+ switch (param_getchar(Cmd, cmdp)) {
case 'h':
case 'H':
usage_hf_iclass_clone();
case 'l':
case 'L':
if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
- PrintAndLog("Start Block No must include 2 HEX symbols\n");
+ PrintAndLog("Last Block No must include 2 HEX symbols\n");
errors = true;
}
cmdp += 2;
rawkey = true;
cmdp++;
break;
+ case 'o':
+ case 'O':
+ override_protection = true;
+ cmdp++;
+ break;
default:
PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
errors = true;
return 0;
}
- FILE *f;
-
- iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
-
- if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
- PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8);
+ if (startblock < 5) {
+ if (override_protection) {
+ PrintAndLog("Info: modifying keys, e-purse or configuration block.");
+ } else {
+ PrintAndLog("You are going to modify keys, e-purse or configuration block.");
+ PrintAndLog("You must add the 'o' (override) option to confirm that you know what you are doing");
+ return 0;
+ }
}
+
+ if ((endblock - startblock + 1) * 12 > USB_CMD_DATA_SIZE) {
+ PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/12);
+ }
+
// file handling and reading
+ FILE *f;
f = fopen(filename,"rb");
if (!f) {
PrintAndLog("Failed to read from file '%s'", filename);
return 1;
}
- if (startblock<5) {
- PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
- fclose(f);
- return 0;
- }
- // now read data from the file from block 6 --- 19
- // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
- // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
- // else we have to create a share memory
- int i;
+ uint8_t tag_data[USB_CMD_DATA_SIZE/12][8];
fseek(f, startblock*8, SEEK_SET);
- if (fread(tag_data, sizeof(iclass_block_t), endblock - startblock + 1, f) == 0 ) {
- PrintAndLog("File reading error.");
- fclose(f);
- return 2;
+ for (int i = 0; i < endblock - startblock + 1; i++) {
+ if (fread(&tag_data[i], 1, 8, f) == 0 ) {
+ PrintAndLog("File reading error.");
+ fclose(f);
+ return 2;
+ }
}
- uint8_t MAC[4]={0x00,0x00,0x00,0x00};
- uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t MAC[4] = {0x00, 0x00, 0x00, 0x00};
+ uint8_t div_key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
uint8_t CSN[8];
- if (!iClass_select(CSN, true, false, false) || !iClass_authenticate(CSN, KEY, MAC, div_key, use_credit_key, elite, rawkey, true)) {
+ if (!iClass_select(CSN, true, true, true) || !iClass_authenticate(CSN, KEY, MAC, div_key, use_credit_key, elite, rawkey, false, true)) {
DropField();
return 0;
}
UsbCommand w = {CMD_ICLASS_CLONE, {startblock, endblock}};
uint8_t *ptr;
- // calculate all mac for every the block we will write
- for (i = startblock; i <= endblock; i++){
- Calc_wb_mac(i, tag_data[i - startblock].d, div_key, MAC);
- // usb command d start pointer = d + (i - 6) * 12
- // memcpy(pointer,tag_data[i - 6],8) 8 bytes
- // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
- // next one
- ptr = w.d.asBytes + (i - startblock) * 12;
- memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
- memcpy(ptr + 8,MAC, 4);
+ // calculate MAC for every block we will write
+ for (int i = 0; i < endblock - startblock + 1; i++) {
+ Calc_wb_mac(startblock + i, tag_data[i], div_key, MAC);
+ ptr = w.d.asBytes + i * 12;
+ memcpy(ptr, tag_data[i], 8);
+ memcpy(ptr + 8, MAC, 4);
}
+
uint8_t p[12];
- for (i = 0; i <= endblock - startblock;i++){
- memcpy(p,w.d.asBytes + (i * 12),12);
- printf("Block |%02x|",i + startblock);
- printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
- printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
+ PrintAndLog("Cloning");
+ for (int i = 0; i < endblock - startblock + 1; i++){
+ memcpy(p, w.d.asBytes + (i * 12), 12);
+ PrintAndLog("Block |%02x| %02x%02x%02x%02x%02x%02x%02x%02x | MAC |%02x%02x%02x%02x|",
+ i + startblock, p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7], p[8], p[9], p[10], p[11]);
}
UsbCommand resp;
SendCommand(&w);
- if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
- {
+ if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
PrintAndLog("Command execute timeout");
DropField();
return 0;
}
+
+ DropField();
return 1;
}
-static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose, bool auth) {
+static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool NRMAC_replay, bool verbose, bool auth) {
uint8_t MAC[4]={0x00,0x00,0x00,0x00};
uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
}
if (auth) {
- if (!iClass_authenticate(CSN, KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose)) {
+ if (!iClass_authenticate(CSN, KEY, MAC, div_key, (keyType==0x18), elite, rawkey, NRMAC_replay, verbose)) {
DropField();
return 0;
}
static void usage_hf_iclass_readblock(void) {
- PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> [c] [e|r]\n");
+ PrintAndLog("Usage: hf iclass readblk b <Block> k <Key> [c] [e|r|n]\n");
PrintAndLog("Options:");
PrintAndLog(" b <Block> : The block number as 2 hex symbols");
PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
PrintAndLog(" r : If 'r' is specified, no computations applied to key");
+ PrintAndLog(" n : If 'n' is specified, <Key> specifies a NR/MAC pair which can be obtained by 'hf iclass snoop'");
PrintAndLog("Samples:");
PrintAndLog(" hf iclass readblk b 06 k 0011223344556677");
PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c");
char tempStr[50] = {0};
bool elite = false;
bool rawkey = false;
+ bool NRMAC_replay = false;
bool errors = false;
bool auth = false;
uint8_t cmdp = 0;
- while (param_getchar(Cmd, cmdp) != 0x00) {
+
+ while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
switch (param_getchar(Cmd, cmdp)) {
case 'h':
case 'H':
rawkey = true;
cmdp++;
break;
+ case 'n':
+ case 'N':
+ NRMAC_replay = true;
+ cmdp++;
+ break;
default:
PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
errors = true;
break;
}
- if (errors) {
- usage_hf_iclass_readblock();
- return 0;
- }
+ }
+
+ if (elite + rawkey + NRMAC_replay > 1) {
+ PrintAndLog("You cannot combine the 'e', 'r', and 'n' options\n");
+ errors = true;
+ }
+
+ if (errors) {
+ usage_hf_iclass_readblock();
+ return 0;
}
if (cmdp < 2) {
if (!auth)
PrintAndLog("warning: no authentication used with read, only a few specific blocks can be read accurately without authentication.");
- return ReadBlock(KEY, blockno, keyType, elite, rawkey, true, auth);
+ return ReadBlock(KEY, blockno, keyType, elite, rawkey, NRMAC_replay, true, auth);
}
bool elite = false;
bool errors = false;
uint8_t cmdp = 0;
- while(param_getchar(Cmd, cmdp) != 0x00)
- {
- switch(param_getchar(Cmd, cmdp))
- {
+
+ while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
+ switch(param_getchar(Cmd, cmdp)) {
case 'h':
case 'H':
usage_hf_iclass_calc_newkey();
char tempStr[20];
uint8_t cmdp = 0;
- while(param_getchar(Cmd, cmdp) != 0x00)
- {
- switch(param_getchar(Cmd, cmdp))
- {
+ while(param_getchar(Cmd, cmdp) != 0x00) {
+ switch(param_getchar(Cmd, cmdp)) {
case 'h':
case 'H':
usage_hf_iclass_managekeys();
return 0;
}
}
+
if (operation == 0){
PrintAndLog("no operation specified (load, save, or print)\n");
usage_hf_iclass_managekeys();
return 0;
}
+
if (operation > 6){
PrintAndLog("Too many operations specified\n");
usage_hf_iclass_managekeys();
bool found_credit = false;
bool errors = false;
uint8_t cmdp = 0x00;
- FILE * f;
+ FILE *f;
char filename[FILE_PATH_SIZE] = {0};
uint8_t fileNameLen = 0;
char buf[17];
uint8_t *keyBlock = NULL, *p;
- int keyitems = 0, keycnt = 0;
+ int keycnt = 0;
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
switch (param_getchar(Cmd, cmdp)) {
break;
}
}
+
if (errors) {
usage_hf_iclass_chk();
return 0;
}
- if ( !(f = fopen( filename , "r")) ) {
- PrintAndLog("File: %s: not found or locked.", filename);
+ if (!(f = fopen(filename , "r"))) {
+ PrintAndLog("File %s not found or locked.", filename);
return 1;
}
- while( fgets(buf, sizeof(buf), f) ){
+ while (fgets(buf, sizeof(buf), f)) {
if (strlen(buf) < 16 || buf[15] == '\n')
continue;
while (fgetc(f) != '\n' && !feof(f)) ; //goto next line
- if( buf[0]=='#' ) continue; //The line start with # is comment, skip
+ if (buf[0] == '#') continue; //The line start with # is comment, skip
if (!isxdigit(buf[0])){
- PrintAndLog("File content error. '%s' must include 16 HEX symbols",buf);
+ PrintAndLog("File content error. '%s' must include 16 HEX symbols", buf);
continue;
}
buf[16] = 0;
- p = realloc(keyBlock, 8 * (keyitems += 64));
+ p = realloc(keyBlock, 8 * (keycnt + 1));
if (!p) {
PrintAndLog("Cannot allocate memory for default keys");
free(keyBlock);
memset(keyBlock + 8 * keycnt, 0, 8);
num_to_bytes(strtoull(buf, NULL, 16), 8, keyBlock + 8 * keycnt);
- //PrintAndLog("check key[%2d] %016" PRIx64, keycnt, bytes_to_num(keyBlock + 8*keycnt, 8));
keycnt++;
memset(buf, 0, sizeof(buf));
}
fclose(f);
PrintAndLog("Loaded %2d keys from %s", keycnt, filename);
- // time
- uint64_t t1 = msclock();
-
uint8_t CSN[8];
if (!iClass_select(CSN, false, true, true)) {
- PrintAndLog("Couldn't select card");
DropField();
return 0;
}
for (uint32_t c = 0; c < keycnt; c++) {
- printf("."); fflush(stdout);
- if (ukbhit()) {
- int gc = getchar(); (void)gc;
- printf("\naborted via keyboard!\n");
- break;
- }
- memcpy(key, keyBlock + 8 * c , 8);
+ memcpy(key, keyBlock + 8 * c, 8);
// debit key
- if (!iClass_authenticate(CSN, key, mac, div_key, false, use_elite, use_raw, false))
- continue;
-
- // key found.
- PrintAndLog("\n--------------------------------------------------------");
- PrintAndLog(" Found AA1 debit key\t\t[%s]", sprint_hex(key, 8));
- found_debit = true;
+ if (iClass_authenticate(CSN, key, mac, div_key, false, use_elite, use_raw, false, false)) {
+ PrintAndLog("\n Found AA1 debit key\t\t[%s]", sprint_hex(key, 8));
+ found_debit = true;
+ }
// credit key
- if (!iClass_authenticate(CSN, key, mac, div_key, true, use_elite, use_raw, false))
- continue;
-
- // key found
- PrintAndLog("\n--------------------------------------------------------");
- PrintAndLog(" Found AA2 credit key\t\t[%s]", sprint_hex(key, 8));
- found_credit = true;
+ if (iClass_authenticate(CSN, key, mac, div_key, true, use_elite, use_raw, false, false)) {
+ PrintAndLog("\n Found AA2 credit key\t\t[%s]", sprint_hex(key, 8));
+ found_credit = true;
+ }
// both keys found.
if (found_debit && found_credit)
break;
}
- t1 = msclock() - t1;
-
- PrintAndLog("\nTime in iclass checkkeys: %.0f seconds\n", (float)t1/1000.0);
-
DropField();
free(keyBlock);
PrintAndLog("");
{"chk", CmdHFiClassCheckKeys, 0, " Check keys"},
{"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"},
{"decrypt", CmdHFiClassDecrypt, 1, "[f <fname>] Decrypt tagdump" },
- {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"},
+ {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1 and/or AA2"},
{"eload", CmdHFiClassELoad, 0, "[f <fname>] (experimental) Load data into iClass emulator memory"},
{"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
{"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
{"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},
{"reader", CmdHFiClassReader, 0, " Look for iClass tags until a key or the pm3 button is pressed"},
{"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"},
- {"replay", CmdHFiClassReader_Replay, 0, "<mac> Read an iClass tag via Reply Attack"},
{"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"},
{"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"},
{"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},
projects / proxmark3-svn / blobdiff