// Hagen Fritsch - June 2010
// Gerhard de Koning Gans - May 2011
// Gerhard de Koning Gans - June 2012 - Added iClass card and reader emulation
+// piwi - 2019
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
//-----------------------------------------------------------------------------
// Routines to support iClass.
//-----------------------------------------------------------------------------
-// Based on ISO14443a implementation. Still in experimental phase.
// Contribution made during a security research at Radboud University Nijmegen
//
// Please feel free to contribute and extend iClass support!!
//-----------------------------------------------------------------------------
-//
-// FIX:
-// ====
-// We still have sometimes a demodulation error when snooping iClass communication.
-// The resulting trace of a read-block-03 command may look something like this:
-//
-// + 22279: : 0c 03 e8 01
-//
-// ...with an incorrect answer...
-//
-// + 85: 0: TAG ff! ff! ff! ff! ff! ff! ff! ff! bb 33 bb 00 01! 0e! 04! bb !crc
-//
-// We still left the error signalling bytes in the traces like 0xbb
-//
-// A correct trace should look like this:
-//
-// + 21112: : 0c 03 e8 01
-// + 85: 0: TAG ff ff ff ff ff ff ff ff ea f5
-//
-//-----------------------------------------------------------------------------
#include "iclass.h"
#include "string.h"
#include "printf.h"
#include "common.h"
-#include "cmd.h"
+#include "usb_cdc.h"
#include "iso14443a.h"
#include "iso15693.h"
// Needed for CRC in emulation mode;
#include "iso15693tools.h"
#include "protocols.h"
#include "optimized_cipher.h"
-#include "usb_cdc.h" // for usb_poll_validate_length
#include "fpgaloader.h"
// iCLASS has a slightly different timing compared to ISO15693. According to the picopass data sheet the tag response is expected 330us after
if (modulated_response_size > 0) {
uint32_t response_time = reader_eof_time + DELAY_ICLASS_VCD_TO_VICC_SIM;
TransmitTo15693Reader(modulated_response, modulated_response_size, &response_time, 0, false);
- LogTrace_ISO15693(trace_data, trace_data_size, response_time*32, response_time*32 + modulated_response_size/2, NULL, false);
+ LogTrace_ISO15693(trace_data, trace_data_size, response_time*32, response_time*32 + modulated_response_size*32*64, NULL, false);
}
}
LED_A_ON();
+ Iso15693InitTag();
+
uint32_t simType = arg0;
uint32_t numberOfCSNS = arg1;
- // setup hardware for simulation:
- FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
- SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
- FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
- LED_D_OFF();
- FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);
- StartCountSspClk();
-
// Enable and clear the trace
set_tracing(true);
clear_trace();
doIClassSimulation(ICLASS_SIM_MODE_CSN, NULL);
} else if (simType == ICLASS_SIM_MODE_CSN_DEFAULT) {
//Default CSN
- uint8_t csn_crc[] = { 0x03, 0x1f, 0xec, 0x8a, 0xf7, 0xff, 0x12, 0xe0, 0x00, 0x00 };
- // Use the CSN from commandline
- memcpy(emulator, csn_crc, 8);
+ uint8_t csn[] = {0x03, 0x1f, 0xec, 0x8a, 0xf7, 0xff, 0x12, 0xe0};
+ memcpy(emulator, csn, 8);
doIClassSimulation(ICLASS_SIM_MODE_CSN, NULL);
} else if (simType == ICLASS_SIM_MODE_READER_ATTACK) {
uint8_t mac_responses[USB_CMD_DATA_SIZE] = { 0 };
static void ReaderTransmitIClass(uint8_t *frame, int len, uint32_t *start_time) {
CodeIso15693AsReader(frame, len);
-
TransmitTo15693Tag(ToSend, ToSendMax, start_time);
-
uint32_t end_time = *start_time + 32*(8*ToSendMax-4); // substract the 4 padding bits after EOF
LogTrace_ISO15693(frame, len, *start_time*4, end_time*4, NULL, true);
}
static bool sendCmdGetResponseWithRetries(uint8_t* command, size_t cmdsize, uint8_t* resp, size_t max_resp_size,
- uint8_t expected_size, uint8_t retries, uint32_t start_time, uint32_t timeout, uint32_t *eof_time) {
- while (retries-- > 0) {
+ uint8_t expected_size, uint8_t tries, uint32_t start_time, uint32_t timeout, uint32_t *eof_time) {
+ while (tries-- > 0) {
ReaderTransmitIClass(command, cmdsize, &start_time);
if (expected_size == GetIso15693AnswerFromTag(resp, max_resp_size, timeout, eof_time)) {
return true;
return false;//Error
}
+
/**
* @brief Selects an iclass tag
* @param card_data where the CSN is stored for return
// Send act_all
ReaderTransmitIClass(act_all, 1, &start_time);
// Card present?
- if (GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_ACTALL, eof_time) < 0) return false;//Fail
+ if (GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_ACTALL, eof_time) < 0) return false; //Fail
//Send Identify
start_time = *eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
ReaderTransmitIClass(identify, 1, &start_time);
//We expect a 10-byte response here, 8 byte anticollision-CSN and 2 byte CRC
uint8_t len = GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_OTHERS, eof_time);
- if (len != 10) return false;//Fail
+ if (len != 10) return false; //Fail
//Copy the Anti-collision CSN to our select-packet
memcpy(&select[1], resp, 8);
ReaderTransmitIClass(select, sizeof(select), &start_time);
//We expect a 10-byte response here, 8 byte CSN and 2 byte CRC
len = GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_OTHERS, eof_time);
- if (len != 10) return false;//Fail
+ if (len != 10) return false; //Fail
//Success - we got CSN
//Save CSN in response data
if (selectIclassTag(resp, &eof_time)) {
result_status = FLAG_ICLASS_READER_CSN;
memcpy(card_data, resp, 8);
- }
-
- start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
-
- //Read block 1, config
- if (flags & FLAG_ICLASS_READER_CONF) {
- if (sendCmdGetResponseWithRetries(readConf, sizeof(readConf), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
- result_status |= FLAG_ICLASS_READER_CONF;
- memcpy(card_data+8, resp, 8);
- } else {
- Dbprintf("Failed to read config block");
- }
- start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
- }
-
- //Read block 2, e-purse
- if (flags & FLAG_ICLASS_READER_CC) {
- if (sendCmdGetResponseWithRetries(readEpurse, sizeof(readEpurse), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
- result_status |= FLAG_ICLASS_READER_CC;
- memcpy(card_data + (8*2), resp, 8);
- } else {
- Dbprintf("Failed to read e-purse");
- }
- start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
- }
-
- //Read block 5, AA
- if (flags & FLAG_ICLASS_READER_AA) {
- if (sendCmdGetResponseWithRetries(readAA, sizeof(readAA), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
- result_status |= FLAG_ICLASS_READER_AA;
- memcpy(card_data + (8*5), resp, 8);
- } else {
- Dbprintf("Failed to read AA block");
- }
- }
-
- cmd_send(CMD_ACK, result_status, 0, 0, card_data, sizeof(card_data));
-
- LED_A_OFF();
-}
-
-
-void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
-
- LED_A_ON();
-
- bool use_credit_key = false;
- uint8_t card_data[USB_CMD_DATA_SIZE]={0};
- uint16_t block_crc_LUT[255] = {0};
-
- //Generate a lookup table for block crc
- for (int block = 0; block < 255; block++){
- char bl = block;
- block_crc_LUT[block] = iclass_crc16(&bl ,1);
- }
- //Dbprintf("Lookup table: %02x %02x %02x" ,block_crc_LUT[0],block_crc_LUT[1],block_crc_LUT[2]);
-
- uint8_t readcheck_cc[] = { ICLASS_CMD_READCHECK_KD, 0x02 };
- if (use_credit_key)
- readcheck_cc[0] = ICLASS_CMD_READCHECK_KC;
- uint8_t check[] = { 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
- uint8_t read[] = { 0x0c, 0x00, 0x00, 0x00 };
-
- uint16_t crc = 0;
- uint8_t cardsize = 0;
- uint8_t mem = 0;
-
- static struct memory_t {
- int k16;
- int book;
- int k2;
- int lockauth;
- int keyaccess;
- } memory;
-
- uint8_t resp[ICLASS_BUFFER_SIZE];
-
- set_tracing(true);
- clear_trace();
- Iso15693InitReader();
-
- StartCountSspClk();
- uint32_t start_time = 0;
- uint32_t eof_time = 0;
-
- while (!BUTTON_PRESS()) {
-
- WDT_HIT();
-
- if (!get_tracing()) {
- DbpString("Trace full");
- break;
- }
-
- if (!selectIclassTag(card_data, &eof_time)) continue;
start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
- if (!sendCmdGetResponseWithRetries(readcheck_cc, sizeof(readcheck_cc), resp, sizeof(resp), 8, 3, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) continue;
-
- // replay captured auth (cc must not have been updated)
- memcpy(check+5, MAC, 4);
- start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
- if (!sendCmdGetResponseWithRetries(check, sizeof(check), resp, sizeof(resp), 4, 5, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
- Dbprintf("Error: Authentication Fail!");
- continue;
- }
-
- //first get configuration block (block 1)
- crc = block_crc_LUT[1];
- read[1] = 1;
- read[2] = crc >> 8;
- read[3] = crc & 0xff;
-
- start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
- if (!sendCmdGetResponseWithRetries(read, sizeof(read), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
+ //Read block 1, config
+ if (flags & FLAG_ICLASS_READER_CONF) {
+ if (sendCmdGetResponseWithRetries(readConf, sizeof(readConf), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
+ result_status |= FLAG_ICLASS_READER_CONF;
+ memcpy(card_data+8, resp, 8);
+ } else {
+ Dbprintf("Failed to read config block");
+ }
start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
- Dbprintf("Dump config (block 1) failed");
- continue;
}
- mem = resp[5];
- memory.k16 = (mem & 0x80);
- memory.book = (mem & 0x20);
- memory.k2 = (mem & 0x8);
- memory.lockauth = (mem & 0x2);
- memory.keyaccess = (mem & 0x1);
-
- cardsize = memory.k16 ? 255 : 32;
- WDT_HIT();
- //Set card_data to all zeroes, we'll fill it with data
- memset(card_data, 0x0, USB_CMD_DATA_SIZE);
- uint8_t failedRead = 0;
- uint32_t stored_data_length = 0;
- //then loop around remaining blocks
- for (int block = 0; block < cardsize; block++) {
- read[1] = block;
- crc = block_crc_LUT[block];
- read[2] = crc >> 8;
- read[3] = crc & 0xff;
-
- start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
- if (sendCmdGetResponseWithRetries(read, sizeof(read), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
- Dbprintf(" %02x: %02x %02x %02x %02x %02x %02x %02x %02x",
- block, resp[0], resp[1], resp[2],
- resp[3], resp[4], resp[5],
- resp[6], resp[7]);
-
- //Fill up the buffer
- memcpy(card_data+stored_data_length, resp, 8);
- stored_data_length += 8;
- if (stored_data_length +8 > USB_CMD_DATA_SIZE) {
- //Time to send this off and start afresh
- cmd_send(CMD_ACK,
- stored_data_length,//data length
- failedRead,//Failed blocks?
- 0,//Not used ATM
- card_data, stored_data_length);
- //reset
- stored_data_length = 0;
- failedRead = 0;
- }
-
+ //Read block 2, e-purse
+ if (flags & FLAG_ICLASS_READER_CC) {
+ if (sendCmdGetResponseWithRetries(readEpurse, sizeof(readEpurse), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
+ result_status |= FLAG_ICLASS_READER_CC;
+ memcpy(card_data + (8*2), resp, 8);
} else {
- failedRead = 1;
- stored_data_length += 8;//Otherwise, data becomes misaligned
- Dbprintf("Failed to dump block %d", block);
+ Dbprintf("Failed to read e-purse");
}
+ start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
}
- //Send off any remaining data
- if (stored_data_length > 0) {
- cmd_send(CMD_ACK,
- stored_data_length,//data length
- failedRead,//Failed blocks?
- 0,//Not used ATM
- card_data,
- stored_data_length);
+ //Read block 5, AA
+ if (flags & FLAG_ICLASS_READER_AA) {
+ if (sendCmdGetResponseWithRetries(readAA, sizeof(readAA), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
+ result_status |= FLAG_ICLASS_READER_AA;
+ memcpy(card_data + (8*5), resp, 8);
+ } else {
+ Dbprintf("Failed to read AA block");
+ }
}
- //If we got here, let's break
- break;
}
- //Signal end of transmission
- cmd_send(CMD_ACK,
- 0,//data length
- 0,//Failed blocks?
- 0,//Not used ATM
- card_data,
- 0);
+
+ cmd_send(CMD_ACK, result_status, 0, 0, card_data, sizeof(card_data));
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
- LED_D_OFF();
LED_A_OFF();
}
-void iClass_Check(uint8_t *MAC) {
+void iClass_Check(uint8_t *NRMAC) {
uint8_t check[9] = {ICLASS_CMD_CHECK_KD, 0x00};
uint8_t resp[4];
- memcpy(check+5, MAC, 4);
+ memcpy(check+1, NRMAC, 8);
uint32_t eof_time;
- bool isOK = sendCmdGetResponseWithRetries(check, sizeof(check), resp, sizeof(resp), 4, 6, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
+ bool isOK = sendCmdGetResponseWithRetries(check, sizeof(check), resp, sizeof(resp), 4, 3, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp));
}
}
uint8_t resp[8];
uint32_t eof_time;
- bool isOK = sendCmdGetResponseWithRetries(readcheck, sizeof(readcheck), resp, sizeof(resp), 8, 6, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
+ bool isOK = sendCmdGetResponseWithRetries(readcheck, sizeof(readcheck), resp, sizeof(resp), 8, 3, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp));
}
static bool iClass_ReadBlock(uint8_t blockNo, uint8_t *readdata) {
uint8_t readcmd[] = {ICLASS_CMD_READ_OR_IDENTIFY, blockNo, 0x00, 0x00}; //0x88, 0x00 // can i use 0C?
- char bl = blockNo;
+ uint8_t bl = blockNo;
uint16_t rdCrc = iclass_crc16(&bl, 1);
readcmd[2] = rdCrc >> 8;
readcmd[3] = rdCrc & 0xff;
LED_A_ON();
- uint8_t readblockdata[] = {0,0,0,0,0,0,0,0,0,0};
+ uint8_t readblockdata[10];
bool isOK = iClass_ReadBlock(blockno, readblockdata);
- cmd_send(CMD_ACK, isOK, 0, 0, readblockdata, 8);
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
+ cmd_send(CMD_ACK, isOK, 0, 0, readblockdata, 8);
LED_A_OFF();
}
}
}
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ LED_D_OFF();
+
cmd_send(CMD_ACK, isOK, blkCnt, 0, readblockdata, blkCnt*8);
LED_A_OFF();
bool isOK = false;
uint32_t eof_time = 0;
- isOK = sendCmdGetResponseWithRetries(write, sizeof(write), resp, sizeof(resp), 10, 10, 0, ICLASS_READER_TIMEOUT_UPDATE, &eof_time);
- if (isOK && blockNo != 3 && blockNo != 4 && memcmp(write+2, resp, 8)) { // check response
- isOK = false;
+ isOK = sendCmdGetResponseWithRetries(write, sizeof(write), resp, sizeof(resp), 10, 3, 0, ICLASS_READER_TIMEOUT_UPDATE, &eof_time);
+ if (!isOK) {
+ return false;
+ }
+
+ uint8_t all_ff[8] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+ if (blockNo == 2) {
+ if (memcmp(data+4, resp, 4) || memcmp(data, resp+4, 4)) { // check response. e-purse update swaps first and second half
+ return false;
+ }
+ } else if (blockNo == 3 || blockNo == 4) {
+ if (memcmp(all_ff, resp, 8)) { // check response. Key updates always return 0xffffffffffffffff
+ return false;
+ }
+ } else {
+ if (memcmp(data, resp, 8)) { // check response. All other updates return unchanged data
+ return false;
+ }
}
- return isOK;
+ return true;
}
} else {
Dbprintf("Write block [%02x] failed", blockNo);
}
- cmd_send(CMD_ACK, isOK, 0, 0, 0, 0);
-
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
+ cmd_send(CMD_ACK, isOK, 0, 0, 0, 0);
LED_A_OFF();
}
void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) {
- int i;
+
+ LED_A_ON();
+
int written = 0;
- int total_block = (endblock - startblock) + 1;
- for (i = 0; i < total_block; i++) {
+ int total_blocks = (endblock - startblock) + 1;
+
+ for (uint8_t block = startblock; block <= endblock; block++) {
// block number
- if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){
- Dbprintf("Write block [%02x] successful", i + startblock);
+ if (iClass_WriteBlock_ext(block, data + (block-startblock)*12)) {
+ Dbprintf("Write block [%02x] successful", block);
written++;
} else {
- if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){
- Dbprintf("Write block [%02x] successful", i + startblock);
- written++;
- } else {
- Dbprintf("Write block [%02x] failed", i + startblock);
- }
+ Dbprintf("Write block [%02x] failed", block);
}
}
- if (written == total_block)
+
+ if (written == total_blocks)
Dbprintf("Clone complete");
else
Dbprintf("Clone incomplete");
- cmd_send(CMD_ACK, 1, 0, 0, 0, 0);
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
+
+ cmd_send(CMD_ACK, 1, 0, 0, 0, 0);
LED_A_OFF();
}
projects / proxmark3-svn / blobdiff