fix 'hf iclass writebl' and 'hf iclass clone' (#896)

* check for correct responses after block updates
* reduce number of tries from 10 to 3
* Allow to override warning on attempt to clone blocks < 5
* add same warning and override option to 'hf iclass writebl'
* some reformatting and minor refactoring
* Drop field after dump and clone functions
* If dumping AA1 with Credit Key, authenticate as Debit Key
* Initialize reader when beginning to clone

diff --git a/armsrc/iclass.c b/armsrc/iclass.c
index 2a819855f1e163f073a5c11db53545d1a06df81f..28cfcaa66c407bf5a54d3c47afe817be5ad1cd71 100644 (file)
--- a/armsrc/iclass.c
+++ b/armsrc/iclass.c
@@ -848,6 +848,9 @@ void iClass_Dump(uint8_t startblock, uint8_t numblks) {
                }
        }
 
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+       LED_D_OFF();
+
        cmd_send(CMD_ACK, isOK, blkCnt, 0, readblockdata, blkCnt*8);
 
        LED_A_OFF();
@@ -863,12 +866,27 @@ static bool iClass_WriteBlock_ext(uint8_t blockNo, uint8_t *data) {
        bool isOK = false;
        uint32_t eof_time = 0;
 
-       isOK = sendCmdGetResponseWithRetries(write, sizeof(write), resp, sizeof(resp), 10, 10, 0, ICLASS_READER_TIMEOUT_UPDATE, &eof_time);
-       if (isOK && blockNo != 3 && blockNo != 4 && memcmp(write+2, resp, 8)) { // check response
-               isOK = false;
+       isOK = sendCmdGetResponseWithRetries(write, sizeof(write), resp, sizeof(resp), 10, 3, 0, ICLASS_READER_TIMEOUT_UPDATE, &eof_time);
+       if (!isOK) {
+               return false;
+       }
+       
+       uint8_t all_ff[8] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+       if (blockNo == 2) {
+               if (memcmp(data+4, resp, 4) || memcmp(data, resp+4, 4)) { // check response. e-purse update swaps first and second half
+                       return false;
+               }
+       } else if (blockNo == 3 || blockNo == 4) {
+               if (memcmp(all_ff, resp, 8)) { // check response. Key updates always return 0xffffffffffffffff
+                       return false;
+               }
+       } else {
+               if (memcmp(data, resp, 8)) { // check response. All other updates return unchanged data
+                       return false;
+               }
        }
 
-       return isOK;
+       return true;
 }
 
 
@@ -895,17 +913,16 @@ void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) {
 
        LED_A_ON();
 
-       int i;
        int written = 0;
        int total_blocks = (endblock - startblock) + 1;
 
-       for (i = 0; i < total_blocks; i++) {
+       for (uint8_t block = startblock; block <= endblock; block++) {
                // block number
-               if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){
-                       Dbprintf("Write block [%02x] successful", i + startblock);
+               if (iClass_WriteBlock_ext(block, data + (block-startblock)*12)) {
+                       Dbprintf("Write block [%02x] successful", block);
                        written++;
                } else {
-                       Dbprintf("Write block [%02x] failed", i + startblock);
+                       Dbprintf("Write block [%02x] failed", block);
                }
        }
 
@@ -914,9 +931,10 @@ void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) {
        else
                Dbprintf("Clone incomplete");
 
-       cmd_send(CMD_ACK, 1, 0, 0, 0, 0);
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        LED_D_OFF();
 
+       cmd_send(CMD_ACK, 1, 0, 0, 0, 0);
+
        LED_A_OFF();
 }

diff --git a/client/cmdhficlass.c b/client/cmdhficlass.c
index 9d7e6af003f553df9c404a4f0072ade48594b8a4..1400395aa8dbb97ca1b78d23ce54ddab3175de3f 100644 (file)
--- a/client/cmdhficlass.c
+++ b/client/cmdhficlass.c
@@ -51,11 +51,6 @@ static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
 };
 
 
-typedef struct iclass_block {
-       uint8_t d[8];
-} iclass_block_t;
-
-
 // iclass / picopass chip config structures and shared routines
 typedef struct {
        uint8_t app_limit;      //[8]
@@ -882,11 +877,11 @@ static int CmdHFiClassReader_Dump(const char *Cmd) {
                                        if (keyNbr < ICLASS_KEYS_MAX) {
                                                memcpy(KEY, iClass_Key_Table[keyNbr], 8);
                                        } else {
-                                               PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
+                                               PrintAndLog("\nERROR: Debit KeyNbr is invalid\n");
                                                errors = true;
                                        }
                                } else {
-                                       PrintAndLog("\nERROR: Credit Key is incorrect length\n");
+                                       PrintAndLog("\nERROR: Debit Key is incorrect length\n");
                                        errors = true;
                                }
                                cmdp += 2;
@@ -925,7 +920,6 @@ static int CmdHFiClassReader_Dump(const char *Cmd) {
 
        // if only credit key is given: try for AA1 as well (not for iclass but for some picopass this will work)
        if (!have_debit_key && have_credit_key) {
-               use_credit_key = true;
                memcpy(KEY, CreditKEY, 8);
        }
 
@@ -959,7 +953,7 @@ static int CmdHFiClassReader_Dump(const char *Cmd) {
        }
 
        // authenticate with debit key (or credit key if we have no debit key) and get div_key - later store in dump block 3
-       if (!iClass_authenticate(tag_data, KEY, MAC, div_key, use_credit_key, elite, rawkey, NRMAC_replay, verbose)){
+       if (!iClass_authenticate(tag_data, KEY, MAC, div_key, false, elite, rawkey, NRMAC_replay, verbose)) {
                DropField();
                return 0;
        }
@@ -1098,23 +1092,25 @@ static void usage_hf_iclass_writeblock(void) {
        PrintAndLog("  c         : If 'c' is specified, the key set is assumed to be the credit key\n");
        PrintAndLog("  e         : If 'e' is specified, elite computations applied to key");
        PrintAndLog("  r         : If 'r' is specified, no computations applied to key");
+       PrintAndLog("  o         : override protection and allow modification of blocks 0...4");
        PrintAndLog("Samples:");
        PrintAndLog("  hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
        PrintAndLog("  hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
-       PrintAndLog("  hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
+       PrintAndLog("  hf iclass writeblk b 03 d AAAAAAAAAAAAAAAA k 001122334455667B c o");
 }
 
 
 static int CmdHFiClass_WriteBlock(const char *Cmd) {
-       uint8_t blockno=0;
-       uint8_t bldata[8]={0,0,0,0,0,0,0,0};
-       uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+       uint8_t blockno = 0;
+       uint8_t bldata[8] = {0};
+       uint8_t KEY[8] = {0};
        uint8_t keyNbr = 0;
        uint8_t dataLen = 0;
        char tempStr[50] = {0};
        bool use_credit_key = false;
        bool elite = false;
        bool rawkey = false;
+       bool override_protection = false;
        bool errors = false;
        uint8_t cmdp = 0;
 
@@ -1174,6 +1170,11 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) {
                        rawkey = true;
                        cmdp++;
                        break;
+               case 'o':
+               case 'O':
+                       override_protection = true;
+                       cmdp++;
+                       break;
                default:
                        PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
                        errors = true;
@@ -1194,14 +1195,26 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) {
                usage_hf_iclass_writeblock();
                return 0;
        }
+
+       if (blockno < 5) {
+               if (override_protection) {
+                       PrintAndLog("Info: modifying keys, e-purse or configuration block.");
+               } else {
+                       PrintAndLog("You are going to modify keys, e-purse or configuration block.");
+                       PrintAndLog("You must add the 'o' (override) option to confirm that you know what you are doing");
+                       return 0;
+               }
+       }
+
        int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, rawkey, false, true);
+
        DropField();
        return ans;
 }
 
 
 static void usage_hf_iclass_clone(void) {
-       PrintAndLog("Usage:  hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r");
+       PrintAndLog("Usage:  hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> c e|r o");
        PrintAndLog("Options:");
        PrintAndLog("  f <filename>: specify a filename to clone from");
        PrintAndLog("  b <Block>   : The first block to clone as 2 hex symbols");
@@ -1210,10 +1223,13 @@ static void usage_hf_iclass_clone(void) {
        PrintAndLog("  c           : If 'c' is specified, the key set is assumed to be the credit key\n");
        PrintAndLog("  e           : If 'e' is specified, elite computations applied to key");
        PrintAndLog("  r           : If 'r' is specified, no computations applied to key");
+       PrintAndLog("  o           : override protection and allow modification of target blocks 0...4");
        PrintAndLog("Samples:");
        PrintAndLog("  hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
        PrintAndLog("  hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
        PrintAndLog("  hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
+       PrintAndLog("  hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
+       PrintAndLog("  hf iclass clone f iclass_tagdump-121345.bin b 03 l 19 k 0 e o");
 }
 
 
@@ -1229,6 +1245,7 @@ static int CmdHFiClassCloneTag(const char *Cmd) {
        bool use_credit_key = false;
        bool elite = false;
        bool rawkey = false;
+       bool override_protection = false;
        bool errors = false;
        uint8_t cmdp = 0;
 
@@ -1297,6 +1314,11 @@ static int CmdHFiClassCloneTag(const char *Cmd) {
                        rawkey = true;
                        cmdp++;
                        break;
+               case 'o':
+               case 'O':
+                       override_protection = true;
+                       cmdp++;
+                       break;
                default:
                        PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
                        errors = true;
@@ -1313,75 +1335,74 @@ static int CmdHFiClassCloneTag(const char *Cmd) {
                return 0;
        }
 
-       FILE *f;
-
-       iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
-
-       if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
-               PrintAndLog("Trying to write too many blocks at once.  Max: %d", USB_CMD_DATA_SIZE/8);
+       if (startblock < 5) {
+               if (override_protection) {
+                       PrintAndLog("Info: modifying keys, e-purse or configuration block.");
+               } else {
+                       PrintAndLog("You are going to modify keys, e-purse or configuration block.");
+                       PrintAndLog("You must add the 'o' (override) option to confirm that you know what you are doing");
+                       return 0;
+               }
+       }
+       
+       if ((endblock - startblock + 1) * 12 > USB_CMD_DATA_SIZE) {
+               PrintAndLog("Trying to write too many blocks at once.  Max: %d", USB_CMD_DATA_SIZE/12);
        }
+
        // file handling and reading
+       FILE *f;
        f = fopen(filename,"rb");
        if (!f) {
                PrintAndLog("Failed to read from file '%s'", filename);
                return 1;
        }
 
-       if (startblock<5) {
-               PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
-               fclose(f);
-               return 0;
-       }
-       // now read data from the file from block 6 --- 19
-       // ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
-       // then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
-       // else we have to create a share memory
-       int i;
+       uint8_t tag_data[USB_CMD_DATA_SIZE/12][8];
        fseek(f, startblock*8, SEEK_SET);
-       if (fread(tag_data, sizeof(iclass_block_t), endblock - startblock + 1, f) == 0 ) {
-               PrintAndLog("File reading error.");
-               fclose(f);
-               return 2;
+       for (int i = 0; i < endblock - startblock + 1; i++) {
+               if (fread(&tag_data[i], 1, 8, f) == 0 ) {
+                       PrintAndLog("File reading error.");
+                       fclose(f);
+                       return 2;
+               }
        }
 
-       uint8_t MAC[4]={0x00,0x00,0x00,0x00};
-       uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+       uint8_t MAC[4] = {0x00, 0x00, 0x00, 0x00};
+       uint8_t div_key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
        uint8_t CSN[8];
 
-       if (!iClass_select(CSN, true, false, false) || !iClass_authenticate(CSN, KEY, MAC, div_key, use_credit_key, elite, rawkey, false, true)) {
+       if (!iClass_select(CSN, true, true, true) || !iClass_authenticate(CSN, KEY, MAC, div_key, use_credit_key, elite, rawkey, false, true)) {
                DropField();
                return 0;
        }
 
        UsbCommand w = {CMD_ICLASS_CLONE, {startblock, endblock}};
        uint8_t *ptr;
-       // calculate all mac for every the block we will write
-       for (i = startblock; i <= endblock; i++) {
-               Calc_wb_mac(i, tag_data[i - startblock].d, div_key, MAC);
-               // usb command d start pointer = d + (i - 6) * 12
-               // memcpy(pointer,tag_data[i - 6],8) 8 bytes
-               // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
-               // next one
-               ptr = w.d.asBytes + (i - startblock) * 12;
-               memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
-               memcpy(ptr + 8,MAC, 4);
+       // calculate MAC for every block we will write
+       for (int i = 0; i < endblock - startblock + 1; i++) {
+               Calc_wb_mac(startblock + i, tag_data[i], div_key, MAC);
+               ptr = w.d.asBytes + i * 12;
+               memcpy(ptr, tag_data[i], 8);
+               memcpy(ptr + 8, MAC, 4);
        }
+
        uint8_t p[12];
-       for (i = 0; i <= endblock - startblock;i++){
-               memcpy(p,w.d.asBytes + (i * 12),12);
-               printf("Block |%02x|",i + startblock);
-               printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
-               printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
+       PrintAndLog("Cloning");
+       for (int i = 0; i < endblock - startblock + 1; i++){
+               memcpy(p, w.d.asBytes + (i * 12), 12);
+               PrintAndLog("Block |%02x| %02x%02x%02x%02x%02x%02x%02x%02x | MAC |%02x%02x%02x%02x|",
+                       i + startblock, p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7], p[8], p[9], p[10], p[11]);
        }
 
        UsbCommand resp;
        SendCommand(&w);
-       if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
+       if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
                PrintAndLog("Command execute timeout");
                DropField();
                return 0;
        }
 
+       DropField();
        return 1;
 }