+// the original malicious IDs from Flavio D. Garcia, Gerhard de Koning Gans, Roel Verdult,
+// and Milosch Meriac. Dismantling iClass and iClass Elite.
+#define NUM_CSNS 15
+static uint8_t csns[8 * NUM_CSNS] = {
+ 0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
+ 0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
+
+
+// pre-defined 9 CSNs by iceman.
+// only one csn depend on several others.
+// six depends only on the first csn, (0,1, 0x45)
+
+// #define NUM_CSNS 9
+// static uint8_t csns[8 * NUM_CSNS] = {
+ // 0x01, 0x0A, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
+ // 0x0C, 0x06, 0x0C, 0xFE, 0xF7, 0xFF, 0x12, 0xE0,
+ // 0x10, 0x97, 0x83, 0x7B, 0xF7, 0xFF, 0x12, 0xE0,
+ // 0x13, 0x97, 0x82, 0x7A, 0xF7, 0xFF, 0x12, 0xE0,
+ // 0x07, 0x0E, 0x0D, 0xF9, 0xF7, 0xFF, 0x12, 0xE0,
+ // 0x14, 0x96, 0x84, 0x76, 0xF7, 0xFF, 0x12, 0xE0,
+ // 0x17, 0x96, 0x85, 0x71, 0xF7, 0xFF, 0x12, 0xE0,
+ // 0xCE, 0xC5, 0x0F, 0x77, 0xF7, 0xFF, 0x12, 0xE0,
+ // 0xD2, 0x5A, 0x82, 0xF8, 0xF7, 0xFF, 0x12, 0xE0
+ // //0x04, 0x08, 0x9F, 0x78, 0x6E, 0xFF, 0x12, 0xE0
+// };
+
+
+int CmdHFiClassSim(const char *Cmd) {
+ uint8_t simType = 0;
+ uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
+
+ if (strlen(Cmd) < 1) {
+ return usage_hf_iclass_sim();
+ }
+ simType = param_get8ex(Cmd, 0, 0, 10);
+
+ if (simType == ICLASS_SIM_MODE_CSN) {
+ if (param_gethex(Cmd, 1, CSN, 16)) {
+ PrintAndLog("A CSN should consist of 16 HEX symbols");
+ return usage_hf_iclass_sim();
+ }
+ PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
+ }
+
+ if (simType == ICLASS_SIM_MODE_READER_ATTACK) {
+ UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType, NUM_CSNS}};
+ UsbCommand resp = {0};
+
+ memcpy(c.d.asBytes, csns, 8 * NUM_CSNS);
+
+ SendCommand(&c);
+ if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
+ PrintAndLog("Command timed out");
+ return 0;
+ }
+
+ uint8_t num_mac_responses = resp.arg[1];
+ PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses, NUM_CSNS);
+
+ size_t datalen = NUM_CSNS * 24;
+ /*
+ * Now, time to dump to file. We'll use this format:
+ * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
+ * So, it should wind up as
+ * 8 * 24 bytes.
+ *
+ * The returndata from the pm3 is on the following format
+ * <8 byte CC><4 byte NR><4 byte MAC>
+ * CSN is the same as was sent in
+ **/
+ void* dump = malloc(datalen);
+ for(int i = 0; i < NUM_CSNS; i++) {
+ memcpy(dump + i*24, csns+i*8, 8); //CSN
+ //copy CC from response
+ memcpy(dump + i*24 + 8, resp.d.asBytes + i*16, 8);
+ //Then comes NR_MAC (eight bytes from the response)
+ memcpy(dump + i*24 + 16, resp.d.asBytes + i*16 + 8, 8);
+ }
+ /** Now, save to dumpfile **/
+ saveFile("iclass_mac_attack", "bin", dump,datalen);
+ free(dump);
+
+ } else if (simType == ICLASS_SIM_MODE_CSN || simType == ICLASS_SIM_MODE_CSN_DEFAULT || simType == ICLASS_SIM_MODE_FULL) {
+ UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType, 0}};
+ memcpy(c.d.asBytes, CSN, 8);
+ SendCommand(&c);
+
+ } else {
+ PrintAndLog("Undefined simtype %d", simType);
+ return usage_hf_iclass_sim();
+ }
+
+ return 0;
+}
+
+int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
+ bool tagFound = false;
+ UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
+ FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_AA |
+ FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY } };
+ // loop in client not device - else on windows have a communication error
+ UsbCommand resp;
+ while(!ukbhit()){
+ SendCommand(&c);
+ if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
+ uint8_t readStatus = resp.arg[0] & 0xff;
+ uint8_t *data = resp.d.asBytes;
+
+ // no tag found or button pressed
+ if( (readStatus == 0 && !loop) || readStatus == 0xFF) {
+ // abort
+ if (verbose) PrintAndLog("Quitting...");
+ return 0;
+ }
+
+ if( readStatus & FLAG_ICLASS_READER_CSN) {
+ PrintAndLog(" CSN: %s",sprint_hex(data,8));
+ tagFound = true;
+ }
+ if( readStatus & FLAG_ICLASS_READER_CC) {
+ PrintAndLog(" CC: %s",sprint_hex(data+16,8));
+ }
+ if( readStatus & FLAG_ICLASS_READER_CONF) {
+ printIclassDumpInfo(data);
+ }
+ if (readStatus & FLAG_ICLASS_READER_AA) {
+ bool legacy = true;
+ PrintAndLog(" AppIA: %s",sprint_hex(data+8*5,8));
+ for (int i = 0; i<8; i++) {
+ if (data[8*5+i] != 0xFF) {
+ legacy = false;
+ }
+ }
+ PrintAndLog(" : Possible iClass %s",(legacy) ? "(legacy tag)" : "(NOT legacy tag)");
+ }
+
+ if (tagFound && !loop) return 1;
+ } else {
+ if (verbose) PrintAndLog("Command execute timeout");
+ }
+ if (!loop) break;
+ }
+ return 0;
+}
+
+int CmdHFiClassReader(const char *Cmd) {
+ return HFiClassReader(Cmd, true, true);
+}
+
+int CmdHFiClassReader_Replay(const char *Cmd) {
+ uint8_t readerType = 0;
+ uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
+
+ if (strlen(Cmd)<1) {
+ PrintAndLog("Usage: hf iclass replay <MAC>");
+ PrintAndLog(" sample: hf iclass replay 00112233");
projects / proxmark3-svn / blobdiff