X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/be09ea86035044f67e0419b067ac54ee055ad9ee..fd6675219387500f61bfdcde608e326d30ff904b:/client/cmdhficlass.c?ds=inline diff --git a/client/cmdhficlass.c b/client/cmdhficlass.c index 00493166..93e46b67 100644 --- a/client/cmdhficlass.c +++ b/client/cmdhficlass.c @@ -2,6 +2,7 @@ // Copyright (C) 2010 iZsh , Hagen Fritsch // Copyright (C) 2011 Gerhard de Koning Gans // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende +// Copyright (C) 2019 piwi // // This code is licensed to you under the terms of the GNU GPL, version 2 or, // at your option, any later version. See the LICENSE.txt file for the text of @@ -50,11 +51,6 @@ static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = { }; -typedef struct iclass_block { - uint8_t d[8]; -} iclass_block_t; - - // iclass / picopass chip config structures and shared routines typedef struct { uint8_t app_limit; //[8] @@ -180,7 +176,7 @@ static int CmdHFiClassSnoop(const char *Cmd) { CLIParserInit("hf iclass snoop", "\nSnoop a communication between an iClass Reader and an iClass Tag.", NULL); void* argtable[] = { arg_param_begin, - arg_lit0("j", "--jam", "Jam (prevent) e-purse Updates"), + arg_lit0("j", "jam", "Jam (prevent) e-purse Updates"), arg_param_end }; if (CLIParserParseString(Cmd, argtable, arg_getsize(argtable), true)){ @@ -191,7 +187,7 @@ static int CmdHFiClassSnoop(const char *Cmd) { bool jam_epurse_update = arg_get_lit(1); const uint8_t update_epurse_sequence[2] = {0x87, 0x02}; - + UsbCommand c = {CMD_SNOOP_ICLASS, {0}}; if (jam_epurse_update) { c.arg[0] = sizeof(update_epurse_sequence); @@ -337,7 +333,7 @@ int HFiClassReader(bool loop, bool verbose) { while (!ukbhit()) { SendCommand(&c); - if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) { + if (WaitForResponseTimeout(CMD_ACK, &resp, 1000)) { uint8_t readStatus = resp.arg[0] & 0xff; uint8_t *data = resp.d.asBytes; @@ -372,7 +368,8 @@ int HFiClassReader(bool loop, bool verbose) { if (tagFound && !loop) return 1; } else { - if (verbose) PrintAndLog("Command execute timeout"); + if (verbose) PrintAndLog("Error: No response from Proxmark."); + break; } if (!loop) break; } @@ -404,29 +401,6 @@ static int CmdHFiClassReader(const char *Cmd) { } -static int CmdHFiClassReader_Replay(const char *Cmd) { - uint8_t readerType = 0; - uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00}; - - if (strlen(Cmd)<1) { - PrintAndLog("Usage: hf iclass replay "); - PrintAndLog(" sample: hf iclass replay 00112233"); - return 0; - } - - if (param_gethex(Cmd, 0, MAC, 8)) { - PrintAndLog("MAC must include 8 HEX symbols"); - return 1; - } - - UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}}; - memcpy(c.d.asBytes, MAC, 4); - SendCommand(&c); - - return 0; -} - - static void usage_hf_iclass_eload(void) { PrintAndLog("Loads iclass tag-dump into emulator memory on device"); PrintAndLog("Usage: hf iclass eload f "); @@ -710,15 +684,24 @@ static void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, boo } -static bool iClass_authenticate(uint8_t *CSN, uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) { +static bool iClass_authenticate(uint8_t *CSN, uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool replay, bool verbose) { //get div_key - if (rawkey) + if (rawkey || replay) memcpy(div_key, KEY, 8); else HFiClassCalcDivKey(CSN, KEY, div_key, elite); - if (verbose) PrintAndLog("Authenticating with %s: %s", rawkey ? "raw key" : "diversified key", sprint_hex(div_key, 8)); + char keytypetext[23] = "legacy diversified key"; + if (rawkey) { + strcpy(keytypetext, "raw key"); + } else if (replay) { + strcpy(keytypetext, "replayed NR/MAC"); + } else if (elite) { + strcpy(keytypetext, "Elite diversified key"); + } + + if (verbose) PrintAndLog("Authenticating with %s: %s", keytypetext, sprint_hex(div_key, 8)); UsbCommand resp; UsbCommand d = {CMD_ICLASS_READCHECK, {2, use_credit_key, 0}}; @@ -736,14 +719,22 @@ static bool iClass_authenticate(uint8_t *CSN, uint8_t *KEY, uint8_t *MAC, uint8_ return false; } - uint8_t CCNR[12]; - memcpy(CCNR, resp.d.asBytes, 8); - memset(CCNR+8, 0x00, 4); // NR = {0, 0, 0, 0} - - doMAC(CCNR, div_key, MAC); + if (replay) { + memcpy(MAC, KEY+4, 4); + } else { + uint8_t CCNR[12]; + memcpy(CCNR, resp.d.asBytes, 8); + memset(CCNR+8, 0x00, 4); // default NR = {0, 0, 0, 0} + doMAC(CCNR, div_key, MAC); + } d.cmd = CMD_ICLASS_CHECK; - memcpy(d.d.asBytes, MAC, 4); + if (replay) { + memcpy(d.d.asBytes, KEY, 8); + } else { + memset(d.d.asBytes, 0x00, 4); // default NR = {0, 0, 0, 0} + memcpy(d.d.asBytes+4, MAC, 4); + } clearCommandBuffer(); SendCommand(&d); if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) { @@ -760,15 +751,16 @@ static bool iClass_authenticate(uint8_t *CSN, uint8_t *KEY, uint8_t *MAC, uint8_ static void usage_hf_iclass_dump(void) { - PrintAndLog("Usage: hf iclass dump f k c e|r\n"); + PrintAndLog("Usage: hf iclass dump f k c e|r|n\n"); PrintAndLog("Options:"); PrintAndLog(" f : specify a filename to save dump to"); - PrintAndLog(" k : *Access Key as 16 hex symbols or 1 hex to select key from memory"); - PrintAndLog(" c : Credit Key as 16 hex symbols or 1 hex to select key from memory"); - PrintAndLog(" e : If 'e' is specified, the key is interpreted as the 16 byte"); - PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack"); + PrintAndLog(" k : *Debit Key (AA1) as 16 hex symbols (8 bytes) or 1 hex to select key from memory"); + PrintAndLog(" c : Credit Key (AA2) as 16 hex symbols (8 bytes) or 1 hex to select key from memory"); + PrintAndLog(" e : If 'e' is specified, the keys are interpreted as Elite"); + PrintAndLog(" Custom Keys (KCus), which can be obtained via reader-attack"); PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format"); - PrintAndLog(" r : If 'r' is specified, the key is interpreted as raw block 3/4"); + PrintAndLog(" r : If 'r' is specified, keys are interpreted as raw blocks 3/4"); + PrintAndLog(" n : If 'n' is specified, keys are interpreted as NR/MAC pairs which can be obtained by 'hf iclass snoop'"); PrintAndLog(" NOTE: * = required"); PrintAndLog("Samples:"); PrintAndLog(" hf iclass dump k 001122334455667B"); @@ -830,6 +822,7 @@ static int CmdHFiClassReader_Dump(const char *Cmd) { bool use_credit_key = false; bool elite = false; bool rawkey = false; + bool NRMAC_replay = false; bool errors = false; bool verbose = false; uint8_t cmdp = 0; @@ -885,11 +878,11 @@ static int CmdHFiClassReader_Dump(const char *Cmd) { if (keyNbr < ICLASS_KEYS_MAX) { memcpy(KEY, iClass_Key_Table[keyNbr], 8); } else { - PrintAndLog("\nERROR: Credit KeyNbr is invalid\n"); + PrintAndLog("\nERROR: Debit KeyNbr is invalid\n"); errors = true; } } else { - PrintAndLog("\nERROR: Credit Key is incorrect length\n"); + PrintAndLog("\nERROR: Debit Key is incorrect length\n"); errors = true; } cmdp += 2; @@ -899,6 +892,11 @@ static int CmdHFiClassReader_Dump(const char *Cmd) { rawkey = true; cmdp++; break; + case 'n': + case 'N': + NRMAC_replay = true; + cmdp++; + break; case 'v': case 'V': verbose = true; @@ -911,6 +909,11 @@ static int CmdHFiClassReader_Dump(const char *Cmd) { } } + if (elite + rawkey + NRMAC_replay > 1) { + PrintAndLog("You cannot combine the 'e', 'r', and 'n' options\n"); + errors = true; + } + if (errors || cmdp < 2) { usage_hf_iclass_dump(); return 0; @@ -918,7 +921,6 @@ static int CmdHFiClassReader_Dump(const char *Cmd) { // if only credit key is given: try for AA1 as well (not for iclass but for some picopass this will work) if (!have_debit_key && have_credit_key) { - use_credit_key = true; memcpy(KEY, CreditKEY, 8); } @@ -951,8 +953,8 @@ static int CmdHFiClassReader_Dump(const char *Cmd) { if (AA1_maxBlk > maxBlk) AA1_maxBlk = maxBlk; } - // authenticate debit key (or credit key if we have no debit key) and get div_key - later store in dump block 3 - if (!iClass_authenticate(tag_data, KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose)){ + // authenticate with debit key (or credit key if we have no debit key) and get div_key - later store in dump block 3 + if (!iClass_authenticate(tag_data, KEY, MAC, div_key, false, elite, rawkey, NRMAC_replay, verbose)) { DropField(); return 0; } @@ -987,7 +989,7 @@ static int CmdHFiClassReader_Dump(const char *Cmd) { DropField(); // AA2 authenticate credit key and git c_div_key - later store in dump block 4 uint8_t CSN[8]; - if (!iClass_select(CSN, verbose, false, true) || !iClass_authenticate(CSN, CreditKEY, MAC, c_div_key, true, false, false, verbose)){ + if (!iClass_select(CSN, verbose, false, true) || !iClass_authenticate(CSN, CreditKEY, MAC, c_div_key, true, false, false, NRMAC_replay, verbose)){ DropField(); return 0; } @@ -1045,13 +1047,13 @@ static int CmdHFiClassReader_Dump(const char *Cmd) { } -static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) { +static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool NRMAC_replay, bool verbose) { uint8_t MAC[4] = {0x00,0x00,0x00,0x00}; uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}; uint8_t CSN[8]; - if (!iClass_select(CSN, verbose, true, true) || !iClass_authenticate(CSN, KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose)) { + if (!iClass_select(CSN, verbose, true, true) || !iClass_authenticate(CSN, KEY, MAC, div_key, use_credit_key, elite, rawkey, NRMAC_replay, verbose)) { DropField(); return 0; } @@ -1091,29 +1093,30 @@ static void usage_hf_iclass_writeblock(void) { PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n"); PrintAndLog(" e : If 'e' is specified, elite computations applied to key"); PrintAndLog(" r : If 'r' is specified, no computations applied to key"); + PrintAndLog(" o : override protection and allow modification of blocks 0...4"); PrintAndLog("Samples:"); PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B"); PrintAndLog(" hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c"); - PrintAndLog(" hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0"); + PrintAndLog(" hf iclass writeblk b 03 d AAAAAAAAAAAAAAAA k 001122334455667B c o"); } static int CmdHFiClass_WriteBlock(const char *Cmd) { - uint8_t blockno=0; - uint8_t bldata[8]={0,0,0,0,0,0,0,0}; - uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}; + uint8_t blockno = 0; + uint8_t bldata[8] = {0}; + uint8_t KEY[8] = {0}; uint8_t keyNbr = 0; uint8_t dataLen = 0; char tempStr[50] = {0}; bool use_credit_key = false; bool elite = false; - bool rawkey= false; + bool rawkey = false; + bool override_protection = false; bool errors = false; uint8_t cmdp = 0; - while(param_getchar(Cmd, cmdp) != 0x00) - { - switch(param_getchar(Cmd, cmdp)) - { + + while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { + switch(param_getchar(Cmd, cmdp)) { case 'h': case 'H': usage_hf_iclass_writeblock(); @@ -1168,6 +1171,11 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) { rawkey = true; cmdp++; break; + case 'o': + case 'O': + override_protection = true; + cmdp++; + break; default: PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp)); errors = true; @@ -1179,30 +1187,50 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) { } } + if (elite && rawkey) { + PrintAndLog("You cannot combine the 'e' and 'r' options\n"); + errors = true; + } + if (cmdp < 6) { usage_hf_iclass_writeblock(); return 0; } - int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, true); + + if (blockno < 5) { + if (override_protection) { + PrintAndLog("Info: modifying keys, e-purse or configuration block."); + } else { + PrintAndLog("You are going to modify keys, e-purse or configuration block."); + PrintAndLog("You must add the 'o' (override) option to confirm that you know what you are doing"); + return 0; + } + } + + int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, false, true); + DropField(); return ans; } static void usage_hf_iclass_clone(void) { - PrintAndLog("Usage: hf iclass clone f b l k c e|r"); + PrintAndLog("Usage: hf iclass clone f b l k c e|r o"); PrintAndLog("Options:"); PrintAndLog(" f : specify a filename to clone from"); PrintAndLog(" b : The first block to clone as 2 hex symbols"); - PrintAndLog(" l : Set the Data to write as 16 hex symbols"); + PrintAndLog(" l : The last block to clone as 2 hex symbols"); PrintAndLog(" k : Access Key as 16 hex symbols or 1 hex to select key from memory"); PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n"); PrintAndLog(" e : If 'e' is specified, elite computations applied to key"); PrintAndLog(" r : If 'r' is specified, no computations applied to key"); + PrintAndLog(" o : override protection and allow modification of target blocks 0...4"); PrintAndLog("Samples:"); PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e"); PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0"); PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e"); + PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e"); + PrintAndLog(" hf iclass clone f iclass_tagdump-121345.bin b 03 l 19 k 0 e o"); } @@ -1218,12 +1246,12 @@ static int CmdHFiClassCloneTag(const char *Cmd) { bool use_credit_key = false; bool elite = false; bool rawkey = false; + bool override_protection = false; bool errors = false; uint8_t cmdp = 0; - while(param_getchar(Cmd, cmdp) != 0x00) - { - switch(param_getchar(Cmd, cmdp)) - { + + while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { + switch (param_getchar(Cmd, cmdp)) { case 'h': case 'H': usage_hf_iclass_clone(); @@ -1277,7 +1305,7 @@ static int CmdHFiClassCloneTag(const char *Cmd) { case 'l': case 'L': if (param_gethex(Cmd, cmdp+1, &endblock, 2)) { - PrintAndLog("Start Block No must include 2 HEX symbols\n"); + PrintAndLog("Last Block No must include 2 HEX symbols\n"); errors = true; } cmdp += 2; @@ -1287,6 +1315,11 @@ static int CmdHFiClassCloneTag(const char *Cmd) { rawkey = true; cmdp++; break; + case 'o': + case 'O': + override_protection = true; + cmdp++; + break; default: PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp)); errors = true; @@ -1303,80 +1336,79 @@ static int CmdHFiClassCloneTag(const char *Cmd) { return 0; } - FILE *f; - - iclass_block_t tag_data[USB_CMD_DATA_SIZE/12]; - - if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) { - PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/8); + if (startblock < 5) { + if (override_protection) { + PrintAndLog("Info: modifying keys, e-purse or configuration block."); + } else { + PrintAndLog("You are going to modify keys, e-purse or configuration block."); + PrintAndLog("You must add the 'o' (override) option to confirm that you know what you are doing"); + return 0; + } } + + if ((endblock - startblock + 1) * 12 > USB_CMD_DATA_SIZE) { + PrintAndLog("Trying to write too many blocks at once. Max: %d", USB_CMD_DATA_SIZE/12); + } + // file handling and reading + FILE *f; f = fopen(filename,"rb"); if (!f) { PrintAndLog("Failed to read from file '%s'", filename); return 1; } - if (startblock<5) { - PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4"); - fclose(f); - return 0; - } - // now read data from the file from block 6 --- 19 - // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data - // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time, - // else we have to create a share memory - int i; + uint8_t tag_data[USB_CMD_DATA_SIZE/12][8]; fseek(f, startblock*8, SEEK_SET); - if (fread(tag_data, sizeof(iclass_block_t), endblock - startblock + 1, f) == 0 ) { - PrintAndLog("File reading error."); - fclose(f); - return 2; + for (int i = 0; i < endblock - startblock + 1; i++) { + if (fread(&tag_data[i], 1, 8, f) == 0 ) { + PrintAndLog("File reading error."); + fclose(f); + return 2; + } } - uint8_t MAC[4]={0x00,0x00,0x00,0x00}; - uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}; + uint8_t MAC[4] = {0x00, 0x00, 0x00, 0x00}; + uint8_t div_key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; uint8_t CSN[8]; - if (!iClass_select(CSN, true, false, false) || !iClass_authenticate(CSN, KEY, MAC, div_key, use_credit_key, elite, rawkey, true)) { + if (!iClass_select(CSN, true, true, true) || !iClass_authenticate(CSN, KEY, MAC, div_key, use_credit_key, elite, rawkey, false, true)) { DropField(); return 0; } UsbCommand w = {CMD_ICLASS_CLONE, {startblock, endblock}}; uint8_t *ptr; - // calculate all mac for every the block we will write - for (i = startblock; i <= endblock; i++){ - Calc_wb_mac(i, tag_data[i - startblock].d, div_key, MAC); - // usb command d start pointer = d + (i - 6) * 12 - // memcpy(pointer,tag_data[i - 6],8) 8 bytes - // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes; - // next one - ptr = w.d.asBytes + (i - startblock) * 12; - memcpy(ptr, &(tag_data[i - startblock].d[0]), 8); - memcpy(ptr + 8,MAC, 4); + // calculate MAC for every block we will write + for (int i = 0; i < endblock - startblock + 1; i++) { + Calc_wb_mac(startblock + i, tag_data[i], div_key, MAC); + ptr = w.d.asBytes + i * 12; + memcpy(ptr, tag_data[i], 8); + memcpy(ptr + 8, MAC, 4); } + uint8_t p[12]; - for (i = 0; i <= endblock - startblock;i++){ - memcpy(p,w.d.asBytes + (i * 12),12); - printf("Block |%02x|",i + startblock); - printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]); - printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]); + PrintAndLog("Cloning"); + for (int i = 0; i < endblock - startblock + 1; i++){ + memcpy(p, w.d.asBytes + (i * 12), 12); + PrintAndLog("Block |%02x| %02x%02x%02x%02x%02x%02x%02x%02x | MAC |%02x%02x%02x%02x|", + i + startblock, p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7], p[8], p[9], p[10], p[11]); } UsbCommand resp; SendCommand(&w); - if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) - { + if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) { PrintAndLog("Command execute timeout"); DropField(); return 0; } + + DropField(); return 1; } -static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose, bool auth) { +static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool NRMAC_replay, bool verbose, bool auth) { uint8_t MAC[4]={0x00,0x00,0x00,0x00}; uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}; @@ -1388,7 +1420,7 @@ static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, } if (auth) { - if (!iClass_authenticate(CSN, KEY, MAC, div_key, (keyType==0x18), elite, rawkey, verbose)) { + if (!iClass_authenticate(CSN, KEY, MAC, div_key, (keyType==0x18), elite, rawkey, NRMAC_replay, verbose)) { DropField(); return 0; } @@ -1418,13 +1450,14 @@ static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, static void usage_hf_iclass_readblock(void) { - PrintAndLog("Usage: hf iclass readblk b k [c] [e|r]\n"); + PrintAndLog("Usage: hf iclass readblk b k [c] [e|r|n]\n"); PrintAndLog("Options:"); PrintAndLog(" b : The block number as 2 hex symbols"); PrintAndLog(" k : Access Key as 16 hex symbols or 1 hex to select key from memory"); PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n"); PrintAndLog(" e : If 'e' is specified, elite computations applied to key"); PrintAndLog(" r : If 'r' is specified, no computations applied to key"); + PrintAndLog(" n : If 'n' is specified, specifies a NR/MAC pair which can be obtained by 'hf iclass snoop'"); PrintAndLog("Samples:"); PrintAndLog(" hf iclass readblk b 06 k 0011223344556677"); PrintAndLog(" hf iclass readblk b 1B k 0011223344556677 c"); @@ -1441,10 +1474,12 @@ static int CmdHFiClass_ReadBlock(const char *Cmd) { char tempStr[50] = {0}; bool elite = false; bool rawkey = false; + bool NRMAC_replay = false; bool errors = false; bool auth = false; uint8_t cmdp = 0; - while (param_getchar(Cmd, cmdp) != 0x00) { + + while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { switch (param_getchar(Cmd, cmdp)) { case 'h': case 'H': @@ -1493,15 +1528,26 @@ static int CmdHFiClass_ReadBlock(const char *Cmd) { rawkey = true; cmdp++; break; + case 'n': + case 'N': + NRMAC_replay = true; + cmdp++; + break; default: PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp)); errors = true; break; } - if (errors) { - usage_hf_iclass_readblock(); - return 0; - } + } + + if (elite + rawkey + NRMAC_replay > 1) { + PrintAndLog("You cannot combine the 'e', 'r', and 'n' options\n"); + errors = true; + } + + if (errors) { + usage_hf_iclass_readblock(); + return 0; } if (cmdp < 2) { @@ -1511,7 +1557,7 @@ static int CmdHFiClass_ReadBlock(const char *Cmd) { if (!auth) PrintAndLog("warning: no authentication used with read, only a few specific blocks can be read accurately without authentication."); - return ReadBlock(KEY, blockno, keyType, elite, rawkey, true, auth); + return ReadBlock(KEY, blockno, keyType, elite, rawkey, NRMAC_replay, true, auth); } @@ -1681,10 +1727,9 @@ static int CmdHFiClassCalcNewKey(const char *Cmd) { bool elite = false; bool errors = false; uint8_t cmdp = 0; - while(param_getchar(Cmd, cmdp) != 0x00) - { - switch(param_getchar(Cmd, cmdp)) - { + + while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { + switch(param_getchar(Cmd, cmdp)) { case 'h': case 'H': usage_hf_iclass_calc_newkey(); @@ -1865,10 +1910,8 @@ static int CmdHFiClassManageKeys(const char *Cmd) { char tempStr[20]; uint8_t cmdp = 0; - while(param_getchar(Cmd, cmdp) != 0x00) - { - switch(param_getchar(Cmd, cmdp)) - { + while(param_getchar(Cmd, cmdp) != 0x00) { + switch(param_getchar(Cmd, cmdp)) { case 'h': case 'H': usage_hf_iclass_managekeys(); @@ -1928,11 +1971,13 @@ static int CmdHFiClassManageKeys(const char *Cmd) { return 0; } } + if (operation == 0){ PrintAndLog("no operation specified (load, save, or print)\n"); usage_hf_iclass_managekeys(); return 0; } + if (operation > 6){ PrintAndLog("Too many operations specified\n"); usage_hf_iclass_managekeys(); @@ -1968,12 +2013,12 @@ static int CmdHFiClassCheckKeys(const char *Cmd) { bool found_credit = false; bool errors = false; uint8_t cmdp = 0x00; - FILE * f; + FILE *f; char filename[FILE_PATH_SIZE] = {0}; uint8_t fileNameLen = 0; char buf[17]; uint8_t *keyBlock = NULL, *p; - int keyitems = 0, keycnt = 0; + int keycnt = 0; while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { switch (param_getchar(Cmd, cmdp)) { @@ -2006,32 +2051,33 @@ static int CmdHFiClassCheckKeys(const char *Cmd) { break; } } + if (errors) { usage_hf_iclass_chk(); return 0; } - if ( !(f = fopen( filename , "r")) ) { - PrintAndLog("File: %s: not found or locked.", filename); + if (!(f = fopen(filename , "r"))) { + PrintAndLog("File %s not found or locked.", filename); return 1; } - while( fgets(buf, sizeof(buf), f) ){ + while (fgets(buf, sizeof(buf), f)) { if (strlen(buf) < 16 || buf[15] == '\n') continue; while (fgetc(f) != '\n' && !feof(f)) ; //goto next line - if( buf[0]=='#' ) continue; //The line start with # is comment, skip + if (buf[0] == '#') continue; //The line start with # is comment, skip if (!isxdigit(buf[0])){ - PrintAndLog("File content error. '%s' must include 16 HEX symbols",buf); + PrintAndLog("File content error. '%s' must include 16 HEX symbols", buf); continue; } buf[16] = 0; - p = realloc(keyBlock, 8 * (keyitems += 64)); + p = realloc(keyBlock, 8 * (keycnt + 1)); if (!p) { PrintAndLog("Cannot allocate memory for default keys"); free(keyBlock); @@ -2043,60 +2089,39 @@ static int CmdHFiClassCheckKeys(const char *Cmd) { memset(keyBlock + 8 * keycnt, 0, 8); num_to_bytes(strtoull(buf, NULL, 16), 8, keyBlock + 8 * keycnt); - //PrintAndLog("check key[%2d] %016" PRIx64, keycnt, bytes_to_num(keyBlock + 8*keycnt, 8)); keycnt++; memset(buf, 0, sizeof(buf)); } fclose(f); PrintAndLog("Loaded %2d keys from %s", keycnt, filename); - // time - uint64_t t1 = msclock(); - uint8_t CSN[8]; if (!iClass_select(CSN, false, true, true)) { - PrintAndLog("Couldn't select card"); DropField(); return 0; } for (uint32_t c = 0; c < keycnt; c++) { - printf("."); fflush(stdout); - if (ukbhit()) { - int gc = getchar(); (void)gc; - printf("\naborted via keyboard!\n"); - break; - } - memcpy(key, keyBlock + 8 * c , 8); + memcpy(key, keyBlock + 8 * c, 8); // debit key - if (!iClass_authenticate(CSN, key, mac, div_key, false, use_elite, use_raw, false)) - continue; - - // key found. - PrintAndLog("\n--------------------------------------------------------"); - PrintAndLog(" Found AA1 debit key\t\t[%s]", sprint_hex(key, 8)); - found_debit = true; + if (iClass_authenticate(CSN, key, mac, div_key, false, use_elite, use_raw, false, false)) { + PrintAndLog("\n Found AA1 debit key\t\t[%s]", sprint_hex(key, 8)); + found_debit = true; + } // credit key - if (!iClass_authenticate(CSN, key, mac, div_key, true, use_elite, use_raw, false)) - continue; - - // key found - PrintAndLog("\n--------------------------------------------------------"); - PrintAndLog(" Found AA2 credit key\t\t[%s]", sprint_hex(key, 8)); - found_credit = true; + if (iClass_authenticate(CSN, key, mac, div_key, true, use_elite, use_raw, false, false)) { + PrintAndLog("\n Found AA2 credit key\t\t[%s]", sprint_hex(key, 8)); + found_credit = true; + } // both keys found. if (found_debit && found_credit) break; } - t1 = msclock() - t1; - - PrintAndLog("\nTime in iclass checkkeys: %.0f seconds\n", (float)t1/1000.0); - DropField(); free(keyBlock); PrintAndLog(""); @@ -2172,7 +2197,7 @@ static command_t CommandTable[] = { {"chk", CmdHFiClassCheckKeys, 0, " Check keys"}, {"clone", CmdHFiClassCloneTag, 0, "[options..] Authenticate and Clone from iClass bin file"}, {"decrypt", CmdHFiClassDecrypt, 1, "[f ] Decrypt tagdump" }, - {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1"}, + {"dump", CmdHFiClassReader_Dump, 0, "[options..] Authenticate and Dump iClass tag's AA1 and/or AA2"}, {"eload", CmdHFiClassELoad, 0, "[f ] (experimental) Load data into iClass emulator memory"}, {"encryptblk", CmdHFiClassEncryptBlk, 1, " Encrypt given block data"}, {"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"}, @@ -2182,7 +2207,6 @@ static command_t CommandTable[] = { {"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"}, {"reader", CmdHFiClassReader, 0, " Look for iClass tags until a key or the pm3 button is pressed"}, {"readtagfile", CmdHFiClassReadTagFile, 1, "[options..] Display Content from tagfile"}, - {"replay", CmdHFiClassReader_Replay, 0, " Read an iClass tag via Reply Attack"}, {"sim", CmdHFiClassSim, 0, "[options..] Simulate iClass tag"}, {"snoop", CmdHFiClassSnoop, 0, " Eavesdrop iClass communication"}, {"writeblk", CmdHFiClass_WriteBlock, 0, "[options..] Authenticate and Write iClass block"},