X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/be09ea86035044f67e0419b067ac54ee055ad9ee..e6158a48ecc4dbd344604fcb562315931c68d2ff:/armsrc/iclass.c?ds=sidebyside diff --git a/armsrc/iclass.c b/armsrc/iclass.c index 6a2fd648..3f89ae85 100644 --- a/armsrc/iclass.c +++ b/armsrc/iclass.c @@ -3,6 +3,7 @@ // Hagen Fritsch - June 2010 // Gerhard de Koning Gans - May 2011 // Gerhard de Koning Gans - June 2012 - Added iClass card and reader emulation +// piwi - 2019 // // This code is licensed to you under the terms of the GNU GPL, version 2 or, // at your option, any later version. See the LICENSE.txt file for the text of @@ -10,31 +11,10 @@ //----------------------------------------------------------------------------- // Routines to support iClass. //----------------------------------------------------------------------------- -// Based on ISO14443a implementation. Still in experimental phase. // Contribution made during a security research at Radboud University Nijmegen // // Please feel free to contribute and extend iClass support!! //----------------------------------------------------------------------------- -// -// FIX: -// ==== -// We still have sometimes a demodulation error when snooping iClass communication. -// The resulting trace of a read-block-03 command may look something like this: -// -// + 22279: : 0c 03 e8 01 -// -// ...with an incorrect answer... -// -// + 85: 0: TAG ff! ff! ff! ff! ff! ff! ff! ff! bb 33 bb 00 01! 0e! 04! bb !crc -// -// We still left the error signalling bytes in the traces like 0xbb -// -// A correct trace should look like this: -// -// + 21112: : 0c 03 e8 01 -// + 85: 0: TAG ff ff ff ff ff ff ff ff ea f5 -// -//----------------------------------------------------------------------------- #include "iclass.h" @@ -44,7 +24,7 @@ #include "string.h" #include "printf.h" #include "common.h" -#include "cmd.h" +#include "usb_cdc.h" #include "iso14443a.h" #include "iso15693.h" // Needed for CRC in emulation mode; @@ -54,7 +34,6 @@ #include "iso15693tools.h" #include "protocols.h" #include "optimized_cipher.h" -#include "usb_cdc.h" // for usb_poll_validate_length #include "fpgaloader.h" // iCLASS has a slightly different timing compared to ISO15693. According to the picopass data sheet the tag response is expected 330us after @@ -559,7 +538,7 @@ int doIClassSimulation(int simulationMode, uint8_t *reader_mac_buf) { if (modulated_response_size > 0) { uint32_t response_time = reader_eof_time + DELAY_ICLASS_VCD_TO_VICC_SIM; TransmitTo15693Reader(modulated_response, modulated_response_size, &response_time, 0, false); - LogTrace_ISO15693(trace_data, trace_data_size, response_time*32, response_time*32 + modulated_response_size/2, NULL, false); + LogTrace_ISO15693(trace_data, trace_data_size, response_time*32, response_time*32 + modulated_response_size*32*64, NULL, false); } } @@ -587,17 +566,11 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain LED_A_ON(); + Iso15693InitTag(); + uint32_t simType = arg0; uint32_t numberOfCSNS = arg1; - // setup hardware for simulation: - FpgaDownloadAndGo(FPGA_BITSTREAM_HF); - SetAdcMuxFor(GPIO_MUXSEL_HIPKD); - FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION); - LED_D_OFF(); - FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR); - StartCountSspClk(); - // Enable and clear the trace set_tracing(true); clear_trace(); @@ -610,9 +583,8 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain doIClassSimulation(ICLASS_SIM_MODE_CSN, NULL); } else if (simType == ICLASS_SIM_MODE_CSN_DEFAULT) { //Default CSN - uint8_t csn_crc[] = { 0x03, 0x1f, 0xec, 0x8a, 0xf7, 0xff, 0x12, 0xe0, 0x00, 0x00 }; - // Use the CSN from commandline - memcpy(emulator, csn_crc, 8); + uint8_t csn[] = {0x03, 0x1f, 0xec, 0x8a, 0xf7, 0xff, 0x12, 0xe0}; + memcpy(emulator, csn, 8); doIClassSimulation(ICLASS_SIM_MODE_CSN, NULL); } else if (simType == ICLASS_SIM_MODE_READER_ATTACK) { uint8_t mac_responses[USB_CMD_DATA_SIZE] = { 0 }; @@ -657,17 +629,15 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain static void ReaderTransmitIClass(uint8_t *frame, int len, uint32_t *start_time) { CodeIso15693AsReader(frame, len); - TransmitTo15693Tag(ToSend, ToSendMax, start_time); - uint32_t end_time = *start_time + 32*(8*ToSendMax-4); // substract the 4 padding bits after EOF LogTrace_ISO15693(frame, len, *start_time*4, end_time*4, NULL, true); } static bool sendCmdGetResponseWithRetries(uint8_t* command, size_t cmdsize, uint8_t* resp, size_t max_resp_size, - uint8_t expected_size, uint8_t retries, uint32_t start_time, uint32_t timeout, uint32_t *eof_time) { - while (retries-- > 0) { + uint8_t expected_size, uint8_t tries, uint32_t start_time, uint32_t timeout, uint32_t *eof_time) { + while (tries-- > 0) { ReaderTransmitIClass(command, cmdsize, &start_time); if (expected_size == GetIso15693AnswerFromTag(resp, max_resp_size, timeout, eof_time)) { return true; @@ -676,6 +646,7 @@ static bool sendCmdGetResponseWithRetries(uint8_t* command, size_t cmdsize, uint return false;//Error } + /** * @brief Selects an iclass tag * @param card_data where the CSN is stored for return @@ -694,14 +665,14 @@ static bool selectIclassTag(uint8_t *card_data, uint32_t *eof_time) { // Send act_all ReaderTransmitIClass(act_all, 1, &start_time); // Card present? - if (GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_ACTALL, eof_time) < 0) return false;//Fail + if (GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_ACTALL, eof_time) < 0) return false; //Fail //Send Identify start_time = *eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; ReaderTransmitIClass(identify, 1, &start_time); //We expect a 10-byte response here, 8 byte anticollision-CSN and 2 byte CRC uint8_t len = GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_OTHERS, eof_time); - if (len != 10) return false;//Fail + if (len != 10) return false; //Fail //Copy the Anti-collision CSN to our select-packet memcpy(&select[1], resp, 8); @@ -710,7 +681,7 @@ static bool selectIclassTag(uint8_t *card_data, uint32_t *eof_time) { ReaderTransmitIClass(select, sizeof(select), &start_time); //We expect a 10-byte response here, 8 byte CSN and 2 byte CRC len = GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_OTHERS, eof_time); - if (len != 10) return false;//Fail + if (len != 10) return false; //Fail //Success - we got CSN //Save CSN in response data @@ -753,208 +724,54 @@ void ReaderIClass(uint8_t flags) { if (selectIclassTag(resp, &eof_time)) { result_status = FLAG_ICLASS_READER_CSN; memcpy(card_data, resp, 8); - } - - start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; - - //Read block 1, config - if (flags & FLAG_ICLASS_READER_CONF) { - if (sendCmdGetResponseWithRetries(readConf, sizeof(readConf), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) { - result_status |= FLAG_ICLASS_READER_CONF; - memcpy(card_data+8, resp, 8); - } else { - Dbprintf("Failed to read config block"); - } - start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; - } - - //Read block 2, e-purse - if (flags & FLAG_ICLASS_READER_CC) { - if (sendCmdGetResponseWithRetries(readEpurse, sizeof(readEpurse), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) { - result_status |= FLAG_ICLASS_READER_CC; - memcpy(card_data + (8*2), resp, 8); - } else { - Dbprintf("Failed to read e-purse"); - } - start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; - } - - //Read block 5, AA - if (flags & FLAG_ICLASS_READER_AA) { - if (sendCmdGetResponseWithRetries(readAA, sizeof(readAA), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) { - result_status |= FLAG_ICLASS_READER_AA; - memcpy(card_data + (8*5), resp, 8); - } else { - Dbprintf("Failed to read AA block"); - } - } - - cmd_send(CMD_ACK, result_status, 0, 0, card_data, sizeof(card_data)); - - LED_A_OFF(); -} - - -void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) { - - LED_A_ON(); - - bool use_credit_key = false; - uint8_t card_data[USB_CMD_DATA_SIZE]={0}; - uint16_t block_crc_LUT[255] = {0}; - - //Generate a lookup table for block crc - for (int block = 0; block < 255; block++){ - char bl = block; - block_crc_LUT[block] = iclass_crc16(&bl ,1); - } - //Dbprintf("Lookup table: %02x %02x %02x" ,block_crc_LUT[0],block_crc_LUT[1],block_crc_LUT[2]); - - uint8_t readcheck_cc[] = { ICLASS_CMD_READCHECK_KD, 0x02 }; - if (use_credit_key) - readcheck_cc[0] = ICLASS_CMD_READCHECK_KC; - uint8_t check[] = { 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; - uint8_t read[] = { 0x0c, 0x00, 0x00, 0x00 }; - - uint16_t crc = 0; - uint8_t cardsize = 0; - uint8_t mem = 0; - - static struct memory_t { - int k16; - int book; - int k2; - int lockauth; - int keyaccess; - } memory; - - uint8_t resp[ICLASS_BUFFER_SIZE]; - - set_tracing(true); - clear_trace(); - Iso15693InitReader(); - - StartCountSspClk(); - uint32_t start_time = 0; - uint32_t eof_time = 0; - - while (!BUTTON_PRESS()) { - - WDT_HIT(); - - if (!get_tracing()) { - DbpString("Trace full"); - break; - } - - if (!selectIclassTag(card_data, &eof_time)) continue; start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; - if (!sendCmdGetResponseWithRetries(readcheck_cc, sizeof(readcheck_cc), resp, sizeof(resp), 8, 3, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) continue; - - // replay captured auth (cc must not have been updated) - memcpy(check+5, MAC, 4); - start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; - if (!sendCmdGetResponseWithRetries(check, sizeof(check), resp, sizeof(resp), 4, 5, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) { - Dbprintf("Error: Authentication Fail!"); - continue; - } - - //first get configuration block (block 1) - crc = block_crc_LUT[1]; - read[1] = 1; - read[2] = crc >> 8; - read[3] = crc & 0xff; - - start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; - if (!sendCmdGetResponseWithRetries(read, sizeof(read), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) { + //Read block 1, config + if (flags & FLAG_ICLASS_READER_CONF) { + if (sendCmdGetResponseWithRetries(readConf, sizeof(readConf), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) { + result_status |= FLAG_ICLASS_READER_CONF; + memcpy(card_data+8, resp, 8); + } else { + Dbprintf("Failed to read config block"); + } start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; - Dbprintf("Dump config (block 1) failed"); - continue; } - mem = resp[5]; - memory.k16 = (mem & 0x80); - memory.book = (mem & 0x20); - memory.k2 = (mem & 0x8); - memory.lockauth = (mem & 0x2); - memory.keyaccess = (mem & 0x1); - - cardsize = memory.k16 ? 255 : 32; - WDT_HIT(); - //Set card_data to all zeroes, we'll fill it with data - memset(card_data, 0x0, USB_CMD_DATA_SIZE); - uint8_t failedRead = 0; - uint32_t stored_data_length = 0; - //then loop around remaining blocks - for (int block = 0; block < cardsize; block++) { - read[1] = block; - crc = block_crc_LUT[block]; - read[2] = crc >> 8; - read[3] = crc & 0xff; - - start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; - if (sendCmdGetResponseWithRetries(read, sizeof(read), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) { - Dbprintf(" %02x: %02x %02x %02x %02x %02x %02x %02x %02x", - block, resp[0], resp[1], resp[2], - resp[3], resp[4], resp[5], - resp[6], resp[7]); - - //Fill up the buffer - memcpy(card_data+stored_data_length, resp, 8); - stored_data_length += 8; - if (stored_data_length +8 > USB_CMD_DATA_SIZE) { - //Time to send this off and start afresh - cmd_send(CMD_ACK, - stored_data_length,//data length - failedRead,//Failed blocks? - 0,//Not used ATM - card_data, stored_data_length); - //reset - stored_data_length = 0; - failedRead = 0; - } - + //Read block 2, e-purse + if (flags & FLAG_ICLASS_READER_CC) { + if (sendCmdGetResponseWithRetries(readEpurse, sizeof(readEpurse), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) { + result_status |= FLAG_ICLASS_READER_CC; + memcpy(card_data + (8*2), resp, 8); } else { - failedRead = 1; - stored_data_length += 8;//Otherwise, data becomes misaligned - Dbprintf("Failed to dump block %d", block); + Dbprintf("Failed to read e-purse"); } + start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; } - //Send off any remaining data - if (stored_data_length > 0) { - cmd_send(CMD_ACK, - stored_data_length,//data length - failedRead,//Failed blocks? - 0,//Not used ATM - card_data, - stored_data_length); + //Read block 5, AA + if (flags & FLAG_ICLASS_READER_AA) { + if (sendCmdGetResponseWithRetries(readAA, sizeof(readAA), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) { + result_status |= FLAG_ICLASS_READER_AA; + memcpy(card_data + (8*5), resp, 8); + } else { + Dbprintf("Failed to read AA block"); + } } - //If we got here, let's break - break; } - //Signal end of transmission - cmd_send(CMD_ACK, - 0,//data length - 0,//Failed blocks? - 0,//Not used ATM - card_data, - 0); + + cmd_send(CMD_ACK, result_status, 0, 0, card_data, sizeof(card_data)); - FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); - LED_D_OFF(); LED_A_OFF(); } -void iClass_Check(uint8_t *MAC) { +void iClass_Check(uint8_t *NRMAC) { uint8_t check[9] = {ICLASS_CMD_CHECK_KD, 0x00}; uint8_t resp[4]; - memcpy(check+5, MAC, 4); + memcpy(check+1, NRMAC, 8); uint32_t eof_time; - bool isOK = sendCmdGetResponseWithRetries(check, sizeof(check), resp, sizeof(resp), 4, 6, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time); + bool isOK = sendCmdGetResponseWithRetries(check, sizeof(check), resp, sizeof(resp), 4, 3, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time); cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp)); } @@ -966,14 +783,14 @@ void iClass_Readcheck(uint8_t block, bool use_credit_key) { } uint8_t resp[8]; uint32_t eof_time; - bool isOK = sendCmdGetResponseWithRetries(readcheck, sizeof(readcheck), resp, sizeof(resp), 8, 6, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time); + bool isOK = sendCmdGetResponseWithRetries(readcheck, sizeof(readcheck), resp, sizeof(resp), 8, 3, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time); cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp)); } static bool iClass_ReadBlock(uint8_t blockNo, uint8_t *readdata) { uint8_t readcmd[] = {ICLASS_CMD_READ_OR_IDENTIFY, blockNo, 0x00, 0x00}; //0x88, 0x00 // can i use 0C? - char bl = blockNo; + uint8_t bl = blockNo; uint16_t rdCrc = iclass_crc16(&bl, 1); readcmd[2] = rdCrc >> 8; readcmd[3] = rdCrc & 0xff; @@ -991,11 +808,11 @@ void iClass_ReadBlk(uint8_t blockno) { LED_A_ON(); - uint8_t readblockdata[] = {0,0,0,0,0,0,0,0,0,0}; + uint8_t readblockdata[10]; bool isOK = iClass_ReadBlock(blockno, readblockdata); - cmd_send(CMD_ACK, isOK, 0, 0, readblockdata, 8); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LED_D_OFF(); + cmd_send(CMD_ACK, isOK, 0, 0, readblockdata, 8); LED_A_OFF(); } @@ -1021,6 +838,9 @@ void iClass_Dump(uint8_t startblock, uint8_t numblks) { } } + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + LED_D_OFF(); + cmd_send(CMD_ACK, isOK, blkCnt, 0, readblockdata, blkCnt*8); LED_A_OFF(); @@ -1036,12 +856,27 @@ static bool iClass_WriteBlock_ext(uint8_t blockNo, uint8_t *data) { bool isOK = false; uint32_t eof_time = 0; - isOK = sendCmdGetResponseWithRetries(write, sizeof(write), resp, sizeof(resp), 10, 10, 0, ICLASS_READER_TIMEOUT_UPDATE, &eof_time); - if (isOK && blockNo != 3 && blockNo != 4 && memcmp(write+2, resp, 8)) { // check response - isOK = false; + isOK = sendCmdGetResponseWithRetries(write, sizeof(write), resp, sizeof(resp), 10, 3, 0, ICLASS_READER_TIMEOUT_UPDATE, &eof_time); + if (!isOK) { + return false; + } + + uint8_t all_ff[8] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; + if (blockNo == 2) { + if (memcmp(data+4, resp, 4) || memcmp(data, resp+4, 4)) { // check response. e-purse update swaps first and second half + return false; + } + } else if (blockNo == 3 || blockNo == 4) { + if (memcmp(all_ff, resp, 8)) { // check response. Key updates always return 0xffffffffffffffff + return false; + } + } else { + if (memcmp(data, resp, 8)) { // check response. All other updates return unchanged data + return false; + } } - return isOK; + return true; } @@ -1055,40 +890,39 @@ void iClass_WriteBlock(uint8_t blockNo, uint8_t *data) { } else { Dbprintf("Write block [%02x] failed", blockNo); } - cmd_send(CMD_ACK, isOK, 0, 0, 0, 0); - FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LED_D_OFF(); + cmd_send(CMD_ACK, isOK, 0, 0, 0, 0); LED_A_OFF(); } void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) { - int i; + + LED_A_ON(); + int written = 0; - int total_block = (endblock - startblock) + 1; - for (i = 0; i < total_block; i++) { + int total_blocks = (endblock - startblock) + 1; + + for (uint8_t block = startblock; block <= endblock; block++) { // block number - if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){ - Dbprintf("Write block [%02x] successful", i + startblock); + if (iClass_WriteBlock_ext(block, data + (block-startblock)*12)) { + Dbprintf("Write block [%02x] successful", block); written++; } else { - if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){ - Dbprintf("Write block [%02x] successful", i + startblock); - written++; - } else { - Dbprintf("Write block [%02x] failed", i + startblock); - } + Dbprintf("Write block [%02x] failed", block); } } - if (written == total_block) + + if (written == total_blocks) Dbprintf("Clone complete"); else Dbprintf("Clone incomplete"); - cmd_send(CMD_ACK, 1, 0, 0, 0, 0); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LED_D_OFF(); + + cmd_send(CMD_ACK, 1, 0, 0, 0, 0); LED_A_OFF(); }