#include "util.h"
#include "string.h"
#include "common.h"
+#include "cmd.h"
// Needed for CRC in emulation mode;
// same construction as in ISO 14443;
// different initial value (CRC_ICLASS)
uint8_t check[] = { 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
uint8_t read[] = { 0x0c, 0x00, 0x00, 0x00 };
- uint16_t crc = 0;
+ uint16_t crc = 0;
uint8_t cardsize=0;
bool read_success=false;
uint8_t mem=0;
uint8_t* resp = (((uint8_t *)BigBuf) + 3560); // was 3560 - tied to other size changes
// Reset trace buffer
- memset(trace, 0x44, RECV_CMD_OFFSET);
+ memset(trace, 0x44, RECV_CMD_OFFSET);
traceLen = 0;
// Setup SSC
LED_A_OFF();
}
+//1. Create Method to Read sectors/blocks 0,1,2 and Send to client
+void IClass_iso14443A_GetPublic(uint8_t arg0) {
+ uint8_t act_all[] = { 0x0a };
+ uint8_t identify[] = { 0x0c };
+ uint8_t select[] = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+ uint8_t readcheck_cc[]= { 0x88, 0x02 };
+ //uint8_t read[] = { 0x0c, 0x00, 0x00, 0x00 };
+ uint8_t card_data[24]={0};
+
+ //bool read_success=false;
+ uint8_t* resp = (((uint8_t *)BigBuf) + 3560); // was 3560 - tied to other size changes
+
+ // Reset trace buffer
+ memset(trace, 0x44, RECV_CMD_OFFSET);
+ traceLen = 0;
+
+ // Setup SSC
+ FpgaSetupSsc();
+ // Start from off (no field generated)
+ // Signal field is off with the appropriate LED
+ LED_D_OFF();
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ SpinDelay(200);
+
+ SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
+
+ // Now give it time to spin up.
+ // Signal field is on with the appropriate LED
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+ SpinDelay(200);
+
+ LED_A_ON();
+
+ for(int i=0;i<1;i++) {
+
+ if(traceLen > TRACE_SIZE) {
+ DbpString("Trace full");
+ break;
+ }
+
+ if (BUTTON_PRESS()) break;
+
+ // Send act_all
+ ReaderTransmitIClass(act_all, 1);
+ // Card present?
+ if(ReaderReceiveIClass(resp)) {
+ ReaderTransmitIClass(identify, 1);
+ if(ReaderReceiveIClass(resp) == 10) {
+ // Select card
+ memcpy(&select[1],resp,8);
+ ReaderTransmitIClass(select, sizeof(select));
+
+ if(ReaderReceiveIClass(resp) == 10) {
+ Dbprintf(" Selected CSN: %02x %02x %02x %02x %02x %02x %02x %02x",
+ resp[0], resp[1], resp[2],
+ resp[3], resp[4], resp[5],
+ resp[6], resp[7]);
+ }
+ memcpy(card_data,resp,8);
+ // Card selected
+ Dbprintf("Readcheck on Sector 2");
+ ReaderTransmitIClass(readcheck_cc, sizeof(readcheck_cc));
+ if(ReaderReceiveIClass(resp) == 8) {
+ Dbprintf(" CC: %02x %02x %02x %02x %02x %02x %02x %02x",
+ resp[0], resp[1], resp[2],
+ resp[3], resp[4], resp[5],
+ resp[6], resp[7]);
+ }
+ memcpy(card_data+8,resp,8);
+ //prep to read config block
+ /* read card configuration block
+ while(!read_success){
+ uint8_t sector_config=0x01;
+ memcpy(read+1,§or_config,1);
+ ReaderTransmitIClass(read, sizeof(read));
+ if(ReaderReceiveIClass(resp) == 8) {
+ Dbprintf(" CC: %02x %02x %02x %02x %02x %02x %02x %02x",
+ resp[0], resp[1], resp[2],
+ resp[3], resp[4], resp[5],
+ resp[6], resp[7]);
+ read_success=true;
+ memcpy(card_data+16,resp,8);
+ }
+ }*/
+ }
+ }
+ WDT_HIT();
+ }
+ //Dbprintf("DEBUG: %02x%02x%02x%02x%02x%02x%02x%02x",card_data[0],card_data[1],card_data[2],card_data[3],card_data[4],card_data[5],card_data[6],card_data[7]);
+ //Dbprintf("DEBUG: %02x%02x%02x%02x%02x%02x%02x%02x",card_data[8],card_data[9],card_data[10],card_data[11],card_data[12],card_data[13],card_data[14],card_data[15]);
+ LED_A_OFF();
+ LED_B_ON();
+ //send data back to the client
+ cmd_send(CMD_ACK,0,0,0,card_data,16);
+ LED_B_OFF();
+}
+
+//2. Create Read method (cut-down from above) based off responses from 1.
+// Since we have the MAC could continue to use replay function.
+//3. Create Write method
+/*
+void IClass_iso14443A_write(uint8_t arg0, uint8_t blockNo, uint8_t *data, uint8_t *MAC) {
+ uint8_t act_all[] = { 0x0a };
+ uint8_t identify[] = { 0x0c };
+ uint8_t select[] = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+ uint8_t readcheck_cc[]= { 0x88, 0x02 };
+ uint8_t check[] = { 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+ uint8_t read[] = { 0x0c, 0x00, 0x00, 0x00 };
+ uint8_t write[] = { 0x87, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+ uint16_t crc = 0;
+
+ uint8_t* resp = (((uint8_t *)BigBuf) + 3560); // was 3560 - tied to other size changes
+ // Reset trace buffer
+ memset(trace, 0x44, RECV_CMD_OFFSET);
+ traceLen = 0;
+
+ // Setup SSC
+ FpgaSetupSsc();
+ // Start from off (no field generated)
+ // Signal field is off with the appropriate LED
+ LED_D_OFF();
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ SpinDelay(200);
+
+ SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
+
+ // Now give it time to spin up.
+ // Signal field is on with the appropriate LED
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+ SpinDelay(200);
+
+ LED_A_ON();
+
+ for(int i=0;i<1;i++) {
+
+ if(traceLen > TRACE_SIZE) {
+ DbpString("Trace full");
+ break;
+ }
+
+ if (BUTTON_PRESS()) break;
+
+ // Send act_all
+ ReaderTransmitIClass(act_all, 1);
+ // Card present?
+ if(ReaderReceiveIClass(resp)) {
+ ReaderTransmitIClass(identify, 1);
+ if(ReaderReceiveIClass(resp) == 10) {
+ // Select card
+ memcpy(&select[1],resp,8);
+ ReaderTransmitIClass(select, sizeof(select));
+
+ if(ReaderReceiveIClass(resp) == 10) {
+ Dbprintf(" Selected CSN: %02x %02x %02x %02x %02x %02x %02x %02x",
+ resp[0], resp[1], resp[2],
+ resp[3], resp[4], resp[5],
+ resp[6], resp[7]);
+ }
+ // Card selected
+ Dbprintf("Readcheck on Sector 2");
+ ReaderTransmitIClass(readcheck_cc, sizeof(readcheck_cc));
+ if(ReaderReceiveIClass(resp) == 8) {
+ Dbprintf(" CC: %02x %02x %02x %02x %02x %02x %02x %02x",
+ resp[0], resp[1], resp[2],
+ resp[3], resp[4], resp[5],
+ resp[6], resp[7]);
+ }else return;
+ Dbprintf("Authenticate");
+ //for now replay captured auth (as cc not updated)
+ memcpy(check+5,MAC,4);
+ Dbprintf(" AA: %02x %02x %02x %02x",
+ check[5], check[6], check[7],check[8]);
+ ReaderTransmitIClass(check, sizeof(check));
+ if(ReaderReceiveIClass(resp) == 4) {
+ Dbprintf(" AR: %02x %02x %02x %02x",
+ resp[0], resp[1], resp[2],resp[3]);
+ }else {
+ Dbprintf("Error: Authentication Fail!");
+ return;
+ }
+ Dbprintf("Write Block");
+
+ //read configuration for max block number
+ read_success=false;
+ read[1]=1;
+ uint8_t *blockno=&read[1];
+ crc = iclass_crc16((char *)blockno,1);
+ read[2] = crc >> 8;
+ read[3] = crc & 0xff;
+ while(!read_success){
+ ReaderTransmitIClass(read, sizeof(read));
+ if(ReaderReceiveIClass(resp) == 10) {
+ read_success=true;
+ mem=resp[5];
+ memory.k16= (mem & 0x80);
+ memory.book= (mem & 0x20);
+ memory.k2= (mem & 0x8);
+ memory.lockauth= (mem & 0x2);
+ memory.keyaccess= (mem & 0x1);
+
+ }
+ }
+ if (memory.k16){
+ cardsize=255;
+ }else cardsize=32;
+ //check card_size
+
+ memcpy(write+1,blockNo,1);
+ memcpy(write+2,data,8);
+ memcpy(write+10,mac,4);
+ while(!send_success){
+ ReaderTransmitIClass(write, sizeof(write));
+ if(ReaderReceiveIClass(resp) == 10) {
+ write_success=true;
+ }
+ }//
+ }
+ WDT_HIT();
+ }
+
+ LED_A_OFF();
+}*/
//-----------------------------------------------------------------------------
// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
// Copyright (C) 2011 Gerhard de Koning Gans
+// Copyright (C) 2014 Midnitesnake & Andy Davies
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
return 0;
}
-/*void iso14a_set_timeout(uint32_t timeout) {
- UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_SET_TIMEOUT, 0, timeout}};
- SendCommand(&c);
-}*/
-
int CmdHFiClassSnoop(const char *Cmd)
{
UsbCommand c = {CMD_SNOOP_ICLASS};
memcpy(c.d.asBytes, CSN, 8);
SendCommand(&c);
- /*UsbCommand * resp = WaitForResponseTimeout(CMD_ACK, 1500);
- if (resp != NULL) {
- uint8_t isOK = resp->arg[0] & 0xff;
- PrintAndLog("isOk:%02x", isOK);
- } else {
- PrintAndLog("Command execute timeout");
- }*/
-
return 0;
}
uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
- uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ //uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
uint8_t result[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
des_context ctx_enc;
uint64_t crypted_id=0;
- if (strlen(Cmd)<3) {
- PrintAndLog("Usage: hf iclass dump <Key> <CSN> <CC>");
- PrintAndLog(" sample: hf iclass dump 0011223344556677 aabbccddeeffgghh FFFFFFFFFFFFFFFF");
+ if (strlen(Cmd)<1)
+ {
+ //PrintAndLog("Usage: hf iclass dump <Key> <CSN> <CC>");
+ //PrintAndLog(" sample: hf iclass dump 0011223344556677 aabbccddeeffgghh FFFFFFFFFFFFFFFF");
+ PrintAndLog("Usage: hf iclass dump <Key>");
+ PrintAndLog(" sample: hf iclass dump 0011223344556677");
return 0;
}
- if (param_gethex(Cmd, 0, KEY, 16)) {
+ if (param_gethex(Cmd, 0, KEY, 16))
+ {
PrintAndLog("KEY must include 16 HEX symbols");
return 1;
}
- if (param_gethex(Cmd, 1, CSN, 16)) {
+ /*if (param_gethex(Cmd, 1, CSN, 16))
+ {
PrintAndLog("CSN must include 16 HEX symbols");
return 1;
}
- if (param_gethex(Cmd, 2, CC_temp, 16)) {
+ if (param_gethex(Cmd, 2, CC_temp, 16))
+ {
PrintAndLog("CC must include 16 HEX symbols");
return 1;
+ }*/
+
+ UsbCommand c = {CMD_ICLASS_ISO14443A_GETPUBLIC, {0}};
+ //memcpy(c.d.asBytes, MAC, 4);
+ SendCommand(&c);
+
+ UsbCommand resp;
+ if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
+ uint8_t isOK = resp.arg[0] & 0xff;
+ uint8_t * data = resp.d.asBytes;
+
+ memcpy(CSN,data,8);
+ memcpy(CCNR,data+8,8);
+ PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
+ PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
+ PrintAndLog("isOk:%02x", isOK);
+ } else {
+ PrintAndLog("Command execute timeout");
}
- memcpy(CCNR,CC_temp,8);
+
+ //memcpy(CCNR,CC_temp,8);
des_setkey_enc( &ctx_enc, KEY);
des_crypt_ecb(&ctx_enc,CSN,result);
PrintAndLog("DES Key: %s",sprint_hex(result,8));
- uint64_t newz=0;
- crypted_id = bytes_to_num(result,8);
- uint64_t x = (crypted_id & 0xFFFF000000000000 );
- pushbackSixBitByte(&newz, getSixBitByte(crypted_id,0),7);
- pushbackSixBitByte(&newz, getSixBitByte(crypted_id,1),6);
- pushbackSixBitByte(&newz, getSixBitByte(crypted_id,2),5);
- pushbackSixBitByte(&newz, getSixBitByte(crypted_id,3),4);
- pushbackSixBitByte(&newz, getSixBitByte(crypted_id,4),3);
- pushbackSixBitByte(&newz, getSixBitByte(crypted_id,5),2);
- pushbackSixBitByte(&newz, getSixBitByte(crypted_id,6),1);
- pushbackSixBitByte(&newz, getSixBitByte(crypted_id,7),0);
- newz|= x;
- crypted_id=newz;
- num_to_bytes(crypted_id,8,result);
+ uint64_t newz=0;
+ crypted_id = bytes_to_num(result,8);
+ uint64_t x = (crypted_id & 0xFFFF000000000000 );
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,0),7);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,1),6);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,2),5);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,3),4);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,4),3);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,5),2);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,6),1);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,7),0);
+ newz|= x;
+ crypted_id=newz;
+ num_to_bytes(crypted_id,8,result);
PrintAndLog("DESr Key: %s",sprint_hex(result,8));
- //crypted_id = bytes_to_num(result,8);
- //memset(result,0,8);
hash0(crypted_id,div_key);
- //memcpy(div_key,result,8);
PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
calc_iclass_mac(CCNR,12,div_key,MAC);
- UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
- memcpy(c.d.asBytes, MAC, 4);
+ UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
+ memcpy(d.d.asBytes, MAC, 4);
+ SendCommand(&d);
+
+ return 0;
+}
+
+int CmdHFiClass_iso14443A_write(const char *Cmd)
+{
+ uint8_t readerType = 0;
+ uint8_t MAC[4]={0x00,0x00,0x00,0x00};
+ uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t result[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ des_context ctx_enc;
+ uint64_t crypted_id=0;
+ uint8_t blockNo=0;
+ uint8_t bldata[8]={0};
+
+ if (strlen(Cmd)<3)
+ {
+ PrintAndLog("Usage: hf iclass write <Key> <Block> <Data>");
+ PrintAndLog(" sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
+ return 0;
+ }
+
+ if (param_gethex(Cmd, 0, KEY, 16))
+ {
+ PrintAndLog("KEY must include 16 HEX symbols");
+ return 1;
+ }
+
+ blockNo = param_get8(Cmd, 1);
+ if (blockNo>32)
+ {
+ PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
+ return 1;
+ }
+ if (param_gethex(Cmd, 2, bldata, 8))
+ {
+ PrintAndLog("Block data must include 8 HEX symbols");
+ return 1;
+ }
+
+ UsbCommand c = {CMD_ICLASS_ISO14443A_GETPUBLIC, {0}};
+ //memcpy(c.d.asBytes, MAC, 4);
+ SendCommand(&c);
+
+ UsbCommand resp;
+ if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
+ uint8_t isOK = resp.arg[0] & 0xff;
+ uint8_t * data = resp.d.asBytes;
+
+ memcpy(CSN,data,8);
+ memcpy(CCNR,data+8,8);
+ PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
+ PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
+ PrintAndLog("isOk:%02x", isOK);
+ } else {
+ PrintAndLog("Command execute timeout");
+ }
+
+ des_setkey_enc( &ctx_enc, KEY);
+ des_crypt_ecb(&ctx_enc,CSN,result);
+ PrintAndLog("DES Key: %s",sprint_hex(result,8));
+ uint64_t newz=0;
+ crypted_id = bytes_to_num(result,8);
+ uint64_t x = (crypted_id & 0xFFFF000000000000 );
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,0),7);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,1),6);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,2),5);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,3),4);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,4),3);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,5),2);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,6),1);
+ pushbackSixBitByte(&newz, getSixBitByte(crypted_id,7),0);
+ newz|= x;
+ crypted_id=newz;
+ num_to_bytes(crypted_id,8,result);
+ PrintAndLog("DESr Key: %s",sprint_hex(result,8));
+ hash0(crypted_id,div_key);
+ PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
+ calc_iclass_mac(CCNR,12,div_key,MAC);
+
+ UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
+ memcpy(c.d.asBytes, bldata, 8);
+ memcpy(c.d.asBytes+8, MAC, 4);
SendCommand(&c);
+ UsbCommand resp;
+ if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
+ uint8_t isOK = resp.arg[0] & 0xff;
+ uint8_t * data = resp.d.asBytes;
+
+ if (isOK)
+ PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
+ else
+ PrintAndLog("isOk:%02x", isOK);
+ } else {
+ PrintAndLog("Command execute timeout");
+ }
return 0;
}
static command_t CommandTable[] =
{
- {"help", CmdHelp, 1, "This help"},
- {"list", CmdHFiClassList, 0, "List iClass history"},
- {"snoop", CmdHFiClassSnoop, 0, "Eavesdrop iClass communication"},
- {"sim", CmdHFiClassSim, 0, "Simulate iClass tag"},
- {"reader", CmdHFiClassReader, 0, "Read an iClass tag"},
- {"replay", CmdHFiClassReader_Replay, 0, "Read an iClass tag via Reply Attack"},
- {"dump", CmdHFiClassReader_Dump, 0, "Authenticate and Dump iClass tag"},
+ {"help", CmdHelp, 1, "This help"},
+ {"list", CmdHFiClassList, 0, "List iClass history"},
+ {"snoop", CmdHFiClassSnoop, 0, "Eavesdrop iClass communication"},
+ {"sim", CmdHFiClassSim, 0, "Simulate iClass tag"},
+ {"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
+ {"replay",CmdHFiClassReader_Replay, 0, "Read an iClass tag via Reply Attack"},
+ {"dump", CmdHFiClassReader_Dump, 0, "Authenticate and Dump iClass tag"},
+ {"write", CmdHFiClass_iso14443A_write, 0, "Authenticate and Write iClass block"},
{NULL, NULL, 0, NULL}
};
projects / proxmark3-svn / commitdiff