implemented 'hf iclass dump xxxx',

all you need is the magic key to dump contents of an iclass card

diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index 71952b12f6cc9df2accf1f75f8ce1cb6999758c5..78605bda22e9c06668b40b5df3511d5b51b06251 100644 (file)
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -859,8 +859,11 @@ void UsbPacketReceived(uint8_t *packet, int len)
                        ReaderIClass(c->arg[0]);
                        break;
                case CMD_READER_ICLASS_REPLAY:
                        ReaderIClass(c->arg[0]);
                        break;
                case CMD_READER_ICLASS_REPLAY:

-                       ReaderIClass_Replay(c->arg[0], c->d.asBytes);
+                   ReaderIClass_Replay(c->arg[0], c->d.asBytes);

                        break;
                        break;

+               case CMD_ICLASS_ISO14443A_GETPUBLIC:
+                   IClass_iso14443A_GetPublic(c->arg[0]);
+                   break;

 #endif
 
                case CMD_SIMULATE_TAG_HF_LISTEN:
 #endif
 
                case CMD_SIMULATE_TAG_HF_LISTEN:

diff --git a/armsrc/apps.h b/armsrc/apps.h
index 12aedcc2f047caad4af76694b408c9868fb73ff7..237c52917685627795ff20e12b600f0b412b1e58 100644 (file)
--- a/armsrc/apps.h
+++ b/armsrc/apps.h
@@ -191,6 +191,7 @@ void RAMFUNC SnoopIClass(void);
 void SimulateIClass(uint8_t arg0, uint8_t *datain);
 void ReaderIClass(uint8_t arg0);
 void ReaderIClass_Replay(uint8_t arg0,uint8_t *MAC);
 void SimulateIClass(uint8_t arg0, uint8_t *datain);
 void ReaderIClass(uint8_t arg0);
 void ReaderIClass_Replay(uint8_t arg0,uint8_t *MAC);

+void IClass_iso14443A_GetPublic(uint8_t arg0);

 
 // hitag2.h
 void SnoopHitag(uint32_t type);
 
 // hitag2.h
 void SnoopHitag(uint32_t type);

diff --git a/armsrc/iclass.c b/armsrc/iclass.c
index c827ed51d6517c49301a71951bf593bca592393e..9971b670c93778bb48086e4dfe6a386467e676b8 100644 (file)
--- a/armsrc/iclass.c
+++ b/armsrc/iclass.c
@@ -41,6 +41,7 @@
 #include "util.h"
 #include "string.h"
 #include "common.h"
 #include "util.h"
 #include "string.h"
 #include "common.h"

+#include "cmd.h"

 // Needed for CRC in emulation mode;
 // same construction as in ISO 14443;
 // different initial value (CRC_ICLASS)
 // Needed for CRC in emulation mode;
 // same construction as in ISO 14443;
 // different initial value (CRC_ICLASS)


@@ -1485,7 +1486,7 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
        uint8_t check[]       = { 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
        uint8_t read[]        = { 0x0c, 0x00, 0x00, 0x00 };
        
        uint8_t check[]       = { 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
        uint8_t read[]        = { 0x0c, 0x00, 0x00, 0x00 };
        

-        uint16_t crc = 0;
+    uint16_t crc = 0;

        uint8_t cardsize=0;
        bool read_success=false;
        uint8_t mem=0;
        uint8_t cardsize=0;
        bool read_success=false;
        uint8_t mem=0;


@@ -1501,7 +1502,7 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
        uint8_t* resp = (((uint8_t *)BigBuf) + 3560);   // was 3560 - tied to other size changes
 
        // Reset trace buffer
        uint8_t* resp = (((uint8_t *)BigBuf) + 3560);   // was 3560 - tied to other size changes
 
        // Reset trace buffer

-       memset(trace, 0x44, RECV_CMD_OFFSET);
+    memset(trace, 0x44, RECV_CMD_OFFSET);

        traceLen = 0;
 
        // Setup SSC
        traceLen = 0;
 
        // Setup SSC


@@ -1620,4 +1621,227 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
        LED_A_OFF();
 }
 
        LED_A_OFF();
 }
 

+//1. Create Method to Read sectors/blocks 0,1,2 and Send to client
+void IClass_iso14443A_GetPublic(uint8_t arg0) {
+       uint8_t act_all[]     = { 0x0a };
+       uint8_t identify[]    = { 0x0c };
+       uint8_t select[]      = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+       uint8_t readcheck_cc[]= { 0x88, 0x02 }; 
+       //uint8_t read[]        = { 0x0c, 0x00, 0x00, 0x00 };   
+       uint8_t card_data[24]={0};
+       
+       //bool read_success=false;
+       uint8_t* resp = (((uint8_t *)BigBuf) + 3560);   // was 3560 - tied to other size changes
+
+       // Reset trace buffer
+    memset(trace, 0x44, RECV_CMD_OFFSET);
+       traceLen = 0;
+
+       // Setup SSC
+       FpgaSetupSsc();
+       // Start from off (no field generated)
+       // Signal field is off with the appropriate LED
+       LED_D_OFF();
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+       SpinDelay(200);
+
+       SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
+
+       // Now give it time to spin up.
+       // Signal field is on with the appropriate LED
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+       SpinDelay(200);
+
+       LED_A_ON();
+
+       for(int i=0;i<1;i++) {
+       
+               if(traceLen > TRACE_SIZE) {
+                       DbpString("Trace full");
+                       break;
+               }
+               
+               if (BUTTON_PRESS()) break;
+
+               // Send act_all
+               ReaderTransmitIClass(act_all, 1);
+               // Card present?
+               if(ReaderReceiveIClass(resp)) {
+                       ReaderTransmitIClass(identify, 1);
+                       if(ReaderReceiveIClass(resp) == 10) {
+                               // Select card          
+                               memcpy(&select[1],resp,8);
+                               ReaderTransmitIClass(select, sizeof(select));
+
+                               if(ReaderReceiveIClass(resp) == 10) {
+                                       Dbprintf("     Selected CSN: %02x %02x %02x %02x %02x %02x %02x %02x",
+                                       resp[0], resp[1], resp[2],
+                                       resp[3], resp[4], resp[5],
+                                       resp[6], resp[7]);
+                               }
+                               memcpy(card_data,resp,8);
+                               // Card selected
+                               Dbprintf("Readcheck on Sector 2");
+                               ReaderTransmitIClass(readcheck_cc, sizeof(readcheck_cc));
+                               if(ReaderReceiveIClass(resp) == 8) {
+                                  Dbprintf("     CC: %02x %02x %02x %02x %02x %02x %02x %02x",
+                                       resp[0], resp[1], resp[2],
+                                       resp[3], resp[4], resp[5],
+                                       resp[6], resp[7]);
+                               }
+                               memcpy(card_data+8,resp,8);
+                               //prep to read config block
+                               /*  read card configuration block
+                                 while(!read_success){
+                                 uint8_t sector_config=0x01;
+                                 memcpy(read+1,&sector_config,1);
+                                 ReaderTransmitIClass(read, sizeof(read));
+                                 if(ReaderReceiveIClass(resp) == 8) {
+                                   Dbprintf("     CC: %02x %02x %02x %02x %02x %02x %02x %02x",
+                                       resp[0], resp[1], resp[2],
+                                       resp[3], resp[4], resp[5],
+                                       resp[6], resp[7]);
+                                       read_success=true;
+                    memcpy(card_data+16,resp,8);
+                                 }
+                               }*/
+                       }
+               }
+               WDT_HIT();
+       }
+       //Dbprintf("DEBUG: %02x%02x%02x%02x%02x%02x%02x%02x",card_data[0],card_data[1],card_data[2],card_data[3],card_data[4],card_data[5],card_data[6],card_data[7]);
+       //Dbprintf("DEBUG: %02x%02x%02x%02x%02x%02x%02x%02x",card_data[8],card_data[9],card_data[10],card_data[11],card_data[12],card_data[13],card_data[14],card_data[15]);
+       LED_A_OFF();
+       LED_B_ON();
+       //send data back to the client
+    cmd_send(CMD_ACK,0,0,0,card_data,16);
+       LED_B_OFF();
+}
+
+//2. Create Read method (cut-down from above) based off responses from 1. 
+//   Since we have the MAC could continue to use replay function.
+//3. Create Write method
+/*
+void IClass_iso14443A_write(uint8_t arg0, uint8_t blockNo, uint8_t *data, uint8_t *MAC) {
+       uint8_t act_all[]     = { 0x0a };
+       uint8_t identify[]    = { 0x0c };
+       uint8_t select[]      = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+       uint8_t readcheck_cc[]= { 0x88, 0x02 };
+       uint8_t check[]       = { 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+       uint8_t read[]        = { 0x0c, 0x00, 0x00, 0x00 };
+       uint8_t write[]       = { 0x87, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+       
+    uint16_t crc = 0;
+       
+       uint8_t* resp = (((uint8_t *)BigBuf) + 3560);   // was 3560 - tied to other size changes

 
 

+       // Reset trace buffer
+    memset(trace, 0x44, RECV_CMD_OFFSET);
+       traceLen = 0;
+
+       // Setup SSC
+       FpgaSetupSsc();
+       // Start from off (no field generated)
+       // Signal field is off with the appropriate LED
+       LED_D_OFF();
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+       SpinDelay(200);
+
+       SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
+
+       // Now give it time to spin up.
+       // Signal field is on with the appropriate LED
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+       SpinDelay(200);
+
+       LED_A_ON();
+
+       for(int i=0;i<1;i++) {
+       
+               if(traceLen > TRACE_SIZE) {
+                       DbpString("Trace full");
+                       break;
+               }
+               
+               if (BUTTON_PRESS()) break;
+
+               // Send act_all
+               ReaderTransmitIClass(act_all, 1);
+               // Card present?
+               if(ReaderReceiveIClass(resp)) {
+                       ReaderTransmitIClass(identify, 1);
+                       if(ReaderReceiveIClass(resp) == 10) {
+                               // Select card          
+                               memcpy(&select[1],resp,8);
+                               ReaderTransmitIClass(select, sizeof(select));
+
+                               if(ReaderReceiveIClass(resp) == 10) {
+                                       Dbprintf("     Selected CSN: %02x %02x %02x %02x %02x %02x %02x %02x",
+                                       resp[0], resp[1], resp[2],
+                                       resp[3], resp[4], resp[5],
+                                       resp[6], resp[7]);
+                               }
+                               // Card selected
+                               Dbprintf("Readcheck on Sector 2");
+                               ReaderTransmitIClass(readcheck_cc, sizeof(readcheck_cc));
+                               if(ReaderReceiveIClass(resp) == 8) {
+                                  Dbprintf("     CC: %02x %02x %02x %02x %02x %02x %02x %02x",
+                                       resp[0], resp[1], resp[2],
+                                       resp[3], resp[4], resp[5],
+                                       resp[6], resp[7]);
+                               }else return;
+                               Dbprintf("Authenticate");
+                               //for now replay captured auth (as cc not updated)
+                               memcpy(check+5,MAC,4);
+                               Dbprintf("     AA: %02x %02x %02x %02x",
+                                       check[5], check[6], check[7],check[8]);
+                               ReaderTransmitIClass(check, sizeof(check));
+                               if(ReaderReceiveIClass(resp) == 4) {
+                                  Dbprintf("     AR: %02x %02x %02x %02x",
+                                       resp[0], resp[1], resp[2],resp[3]);
+                               }else {
+                                 Dbprintf("Error: Authentication Fail!");
+                                 return;
+                               }
+                               Dbprintf("Write Block");
+                               
+                               //read configuration for max block number
+                               read_success=false;
+                               read[1]=1;
+                               uint8_t *blockno=&read[1];
+                               crc = iclass_crc16((char *)blockno,1);
+                               read[2] = crc >> 8;
+                               read[3] = crc & 0xff;
+                               while(!read_success){
+                                     ReaderTransmitIClass(read, sizeof(read));
+                                     if(ReaderReceiveIClass(resp) == 10) {
+                                        read_success=true;
+                                        mem=resp[5];
+                                        memory.k16= (mem & 0x80);
+                                        memory.book= (mem & 0x20);
+                                        memory.k2= (mem & 0x8);
+                                        memory.lockauth= (mem & 0x2);
+                                        memory.keyaccess= (mem & 0x1);
+
+                                     }
+                               }
+                               if (memory.k16){
+                                 cardsize=255;
+                               }else cardsize=32;
+                               //check card_size
+                               
+                               memcpy(write+1,blockNo,1);
+                               memcpy(write+2,data,8);
+                               memcpy(write+10,mac,4);
+                               while(!send_success){
+                                 ReaderTransmitIClass(write, sizeof(write));
+                                 if(ReaderReceiveIClass(resp) == 10) {
+                                   write_success=true;
+                               }
+                       }//
+               }
+               WDT_HIT();
+       }
+       
+       LED_A_OFF();
+}*/

diff --git a/client/cmdhficlass.c b/client/cmdhficlass.c
index 389fb5c1cbc8d9c01ba09a6ca15b453fe3368a8b..e68fdc4f1b0bc89a398e90554840865c69b3b4f4 100644 (file)
--- a/client/cmdhficlass.c
+++ b/client/cmdhficlass.c
@@ -1,6 +1,7 @@
 //-----------------------------------------------------------------------------
 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
 // Copyright (C) 2011 Gerhard de Koning Gans
 //-----------------------------------------------------------------------------
 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
 // Copyright (C) 2011 Gerhard de Koning Gans

+// Copyright (C) 2014 Midnitesnake & Andy Davies

 //
 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
 // at your option, any later version. See the LICENSE.txt file for the text of
 //
 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
 // at your option, any later version. See the LICENSE.txt file for the text of


@@ -164,11 +165,6 @@ int CmdHFiClassList(const char *Cmd)
   return 0;
 }
 
   return 0;
 }
 

-/*void iso14a_set_timeout(uint32_t timeout) {
-       UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_SET_TIMEOUT, 0, timeout}};
-       SendCommand(&c);
-}*/
-

 int CmdHFiClassSnoop(const char *Cmd)
 {
   UsbCommand c = {CMD_SNOOP_ICLASS};
 int CmdHFiClassSnoop(const char *Cmd)
 {
   UsbCommand c = {CMD_SNOOP_ICLASS};


@@ -198,14 +194,6 @@ int CmdHFiClassSim(const char *Cmd)
   memcpy(c.d.asBytes, CSN, 8);
   SendCommand(&c);
 
   memcpy(c.d.asBytes, CSN, 8);
   SendCommand(&c);
 

-  /*UsbCommand * resp = WaitForResponseTimeout(CMD_ACK, 1500);
-  if (resp != NULL) {
-       uint8_t                isOK  = resp->arg[0] & 0xff;
-       PrintAndLog("isOk:%02x", isOK);
-  } else {
-       PrintAndLog("Command execute timeout");
-  }*/
-

   return 0;
 }
 
   return 0;
 }
 


@@ -258,75 +246,198 @@ int CmdHFiClassReader_Dump(const char *Cmd)
   uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
   uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
   uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
   uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
   uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
   uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

-  uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+  //uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

   uint8_t result[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
   uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
   des_context ctx_enc;
   uint64_t crypted_id=0;
 
   uint8_t result[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
   uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
   des_context ctx_enc;
   uint64_t crypted_id=0;
 

-  if (strlen(Cmd)<3) {
-    PrintAndLog("Usage:  hf iclass dump <Key> <CSN> <CC>");
-    PrintAndLog("        sample: hf iclass dump 0011223344556677 aabbccddeeffgghh FFFFFFFFFFFFFFFF");
+  if (strlen(Cmd)<1) 
+  {
+    //PrintAndLog("Usage:  hf iclass dump <Key> <CSN> <CC>");
+    //PrintAndLog("        sample: hf iclass dump 0011223344556677 aabbccddeeffgghh FFFFFFFFFFFFFFFF");
+    PrintAndLog("Usage:  hf iclass dump <Key>");
+    PrintAndLog("        sample: hf iclass dump 0011223344556677");

     return 0;
   }
 
     return 0;
   }
 

-  if (param_gethex(Cmd, 0, KEY, 16)) {
+  if (param_gethex(Cmd, 0, KEY, 16)) 
+  {

     PrintAndLog("KEY must include 16 HEX symbols");
     return 1;
   }
   
     PrintAndLog("KEY must include 16 HEX symbols");
     return 1;
   }
   

-  if (param_gethex(Cmd, 1, CSN, 16)) {
+  /*if (param_gethex(Cmd, 1, CSN, 16)) 
+  {

     PrintAndLog("CSN must include 16 HEX symbols");
     return 1;
   }
     PrintAndLog("CSN must include 16 HEX symbols");
     return 1;
   }

-  if (param_gethex(Cmd, 2, CC_temp, 16)) {
+  if (param_gethex(Cmd, 2, CC_temp, 16)) 
+  {

     PrintAndLog("CC must include 16 HEX symbols");
     return 1;
     PrintAndLog("CC must include 16 HEX symbols");
     return 1;

+  }*/
+  
+  UsbCommand c = {CMD_ICLASS_ISO14443A_GETPUBLIC, {0}};
+  //memcpy(c.d.asBytes, MAC, 4);
+  SendCommand(&c);
+  
+  UsbCommand resp;
+  if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
+    uint8_t isOK    = resp.arg[0] & 0xff;
+    uint8_t * data  = resp.d.asBytes;
+    
+    memcpy(CSN,data,8);
+    memcpy(CCNR,data+8,8);
+    PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
+    PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
+       PrintAndLog("isOk:%02x", isOK);
+  } else {
+       PrintAndLog("Command execute timeout");

   }
   
   }
   

-  memcpy(CCNR,CC_temp,8);
+  
+  //memcpy(CCNR,CC_temp,8);

   des_setkey_enc( &ctx_enc, KEY);
   des_crypt_ecb(&ctx_enc,CSN,result);
   PrintAndLog("DES Key: %s",sprint_hex(result,8));
   des_setkey_enc( &ctx_enc, KEY);
   des_crypt_ecb(&ctx_enc,CSN,result);
   PrintAndLog("DES Key: %s",sprint_hex(result,8));

-    uint64_t newz=0;
-       crypted_id = bytes_to_num(result,8);
-       uint64_t x = (crypted_id & 0xFFFF000000000000 );
-       pushbackSixBitByte(&newz, getSixBitByte(crypted_id,0),7);
-       pushbackSixBitByte(&newz, getSixBitByte(crypted_id,1),6);
-       pushbackSixBitByte(&newz, getSixBitByte(crypted_id,2),5);
-       pushbackSixBitByte(&newz, getSixBitByte(crypted_id,3),4);
-       pushbackSixBitByte(&newz, getSixBitByte(crypted_id,4),3);
-       pushbackSixBitByte(&newz, getSixBitByte(crypted_id,5),2);
-       pushbackSixBitByte(&newz, getSixBitByte(crypted_id,6),1);
-       pushbackSixBitByte(&newz, getSixBitByte(crypted_id,7),0);
-       newz|= x;
-       crypted_id=newz;
-       num_to_bytes(crypted_id,8,result);
+  uint64_t newz=0;
+  crypted_id = bytes_to_num(result,8);
+  uint64_t x = (crypted_id & 0xFFFF000000000000 );
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,0),7);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,1),6);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,2),5);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,3),4);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,4),3);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,5),2);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,6),1);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,7),0);
+  newz|= x;
+  crypted_id=newz;
+  num_to_bytes(crypted_id,8,result);

   PrintAndLog("DESr Key: %s",sprint_hex(result,8));    
   PrintAndLog("DESr Key: %s",sprint_hex(result,8));    

-  //crypted_id = bytes_to_num(result,8);
-  //memset(result,0,8);

   hash0(crypted_id,div_key);
   hash0(crypted_id,div_key);

-  //memcpy(div_key,result,8);

   PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
   calc_iclass_mac(CCNR,12,div_key,MAC);
 
   PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
   calc_iclass_mac(CCNR,12,div_key,MAC);
 

-  UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
-  memcpy(c.d.asBytes, MAC, 4);
+  UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
+  memcpy(d.d.asBytes, MAC, 4);
+  SendCommand(&d);
+
+  return 0;
+}
+
+int CmdHFiClass_iso14443A_write(const char *Cmd)
+{
+  uint8_t readerType = 0;
+  uint8_t MAC[4]={0x00,0x00,0x00,0x00};
+  uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+  uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+  uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+  uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+  uint8_t result[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+  uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+  des_context ctx_enc;
+  uint64_t crypted_id=0;
+  uint8_t blockNo=0;
+  uint8_t bldata[8]={0};
+
+  if (strlen(Cmd)<3) 
+  {
+    PrintAndLog("Usage:  hf iclass write <Key> <Block> <Data>");
+    PrintAndLog("        sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
+    return 0;
+  }
+
+  if (param_gethex(Cmd, 0, KEY, 16)) 
+  {
+    PrintAndLog("KEY must include 16 HEX symbols");
+    return 1;
+  }
+  
+  blockNo = param_get8(Cmd, 1);
+  if (blockNo>32)
+  {
+        PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
+        return 1;
+  }
+  if (param_gethex(Cmd, 2, bldata, 8)) 
+  {
+        PrintAndLog("Block data must include 8 HEX symbols");
+        return 1;
+  }
+  
+  UsbCommand c = {CMD_ICLASS_ISO14443A_GETPUBLIC, {0}};
+  //memcpy(c.d.asBytes, MAC, 4);
+  SendCommand(&c);
+  
+  UsbCommand resp;
+  if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
+    uint8_t isOK    = resp.arg[0] & 0xff;
+    uint8_t * data  = resp.d.asBytes;
+    
+    memcpy(CSN,data,8);
+    memcpy(CCNR,data+8,8);
+    PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
+    PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
+       PrintAndLog("isOk:%02x", isOK);
+  } else {
+       PrintAndLog("Command execute timeout");
+  }
+  
+  des_setkey_enc( &ctx_enc, KEY);
+  des_crypt_ecb(&ctx_enc,CSN,result);
+  PrintAndLog("DES Key: %s",sprint_hex(result,8));
+  uint64_t newz=0;
+  crypted_id = bytes_to_num(result,8);
+  uint64_t x = (crypted_id & 0xFFFF000000000000 );
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,0),7);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,1),6);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,2),5);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,3),4);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,4),3);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,5),2);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,6),1);
+  pushbackSixBitByte(&newz, getSixBitByte(crypted_id,7),0);
+  newz|= x;
+  crypted_id=newz;
+  num_to_bytes(crypted_id,8,result);
+  PrintAndLog("DESr Key: %s",sprint_hex(result,8));    
+  hash0(crypted_id,div_key);
+  PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
+  calc_iclass_mac(CCNR,12,div_key,MAC);
+
+  UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
+  memcpy(c.d.asBytes, bldata, 8);
+  memcpy(c.d.asBytes+8, MAC, 4);

   SendCommand(&c);
 
   SendCommand(&c);
 

+  UsbCommand resp;
+  if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
+    uint8_t isOK    = resp.arg[0] & 0xff;
+    uint8_t * data  = resp.d.asBytes;
+
+    if (isOK)
+      PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
+    else
+      PrintAndLog("isOk:%02x", isOK);
+  } else {
+      PrintAndLog("Command execute timeout");
+  }

   return 0;
 }
 
 
 static command_t CommandTable[] = 
 {
   return 0;
 }
 
 
 static command_t CommandTable[] = 
 {

-  {"help",    CmdHelp,        1, "This help"},
-  {"list",    CmdHFiClassList,   0, "List iClass history"},
-  {"snoop",   CmdHFiClassSnoop,  0, "Eavesdrop iClass communication"},
-  {"sim",     CmdHFiClassSim,    0, "Simulate iClass tag"},
-  {"reader",  CmdHFiClassReader, 0, "Read an iClass tag"},
-  {"replay",  CmdHFiClassReader_Replay, 0, "Read an iClass tag via Reply Attack"},
-  {"dump",       CmdHFiClassReader_Dump, 0, "Authenticate and Dump iClass tag"},
+  {"help",     CmdHelp,                        1,      "This help"},
+  {"list",     CmdHFiClassList,        0,      "List iClass history"},
+  {"snoop",    CmdHFiClassSnoop,       0,      "Eavesdrop iClass communication"},
+  {"sim",      CmdHFiClassSim,         0,      "Simulate iClass tag"},
+  {"reader",CmdHFiClassReader, 0,      "Read an iClass tag"},
+  {"replay",CmdHFiClassReader_Replay,  0,      "Read an iClass tag via Reply Attack"},
+  {"dump",     CmdHFiClassReader_Dump, 0,              "Authenticate and Dump iClass tag"},
+  {"write",    CmdHFiClass_iso14443A_write,    0,      "Authenticate and Write iClass block"},

   {NULL, NULL, 0, NULL}
 };
 
   {NULL, NULL, 0, NULL}
 };
 

diff --git a/include/usb_cmd.h b/include/usb_cmd.h
index cd5a8b75264133a3185d5628c38bbccd88db6c9c..00b9b586cacb90a6c53217ed8396215f2675b152 100644 (file)
--- a/include/usb_cmd.h
+++ b/include/usb_cmd.h
@@ -116,7 +116,9 @@ typedef struct {
 #define CMD_SNOOP_ICLASS                                                  0x0392
 #define CMD_SIMULATE_TAG_ICLASS                                           0x0393
 #define CMD_READER_ICLASS                                                 0x0394
 #define CMD_SNOOP_ICLASS                                                  0x0392
 #define CMD_SIMULATE_TAG_ICLASS                                           0x0393
 #define CMD_READER_ICLASS                                                 0x0394

-#define CMD_READER_ICLASS_REPLAY                                         0x0395
+#define CMD_READER_ICLASS_REPLAY                                                                                 0x0395
+#define CMD_ICLASS_ISO14443A_GETPUBLIC                                                                   0x0396
+#define CMD_ICLASS_ISO14443A_WRITE                                                                               0x0397

 
 // For measurements of the antenna tuning
 #define CMD_MEASURE_ANTENNA_TUNING                                        0x0400
 
 // For measurements of the antenna tuning
 #define CMD_MEASURE_ANTENNA_TUNING                                        0x0400